#zucked

I'm in the home stretch of my 20+ city book tour for my new novel PICKS AND SHOVELS. Catch me in PDX TOMORROW (June 20) at BARNES AND NOBLE with BUNNIE HUANG and at the TUALATIN public library on SUNDAY (June 22). After that, it's LONDON (July 1) with TRASHFUTURE'S RILEY QUINN and then a big finish in MANCHESTER on July 2.

Back in 2006, AOL tried something incredibly bold and even more incredibly stupid: they dumped a data-set of 20,000,000 "anonymized" search queries from 650,000 users (yes, AOL had a search engine – there used to be lots of search engines!):

https://en.wikipedia.org/wiki/AOL_search_log_release

The AOL dump was a catastrophe. In an eyeblink, many of the users in the dataset were de-anonymized. The dump revealed personal, intimate and compromising facts about the lives of AOL search users. The AOL dump is notable for many reasons, not least because it jumpstarted the academic and technical discourse about the limits of "de-identifying" datasets by stripping out personally identifying information prior to releasing them for use by business partners, researchers, or the general public.

It turns out that de-identification is fucking hard. Just a couple of datapoints associated with an "anonymous" identifier can be sufficent to de-anonymize the user in question:

https://www.pnas.org/doi/full/10.1073/pnas.1508081113

But firms stubbornly refuse to learn this lesson. They would love it if they could "safely" sell the data they suck up from our everyday activities, so they declare that they can safely do so, and sell giant data-sets, and then bam, the next thing you know, a federal judge's porn-browsing habits are published for all the world to see:

https://www.theguardian.com/technology/2017/aug/01/data-browsing-habits-brokers

Indeed, it appears that there may be no way to truly de-identify a data-set:

https://pursuit.unimelb.edu.au/articles/understanding-the-maths-is-crucial-for-protecting-privacy

Which is a serious bummer, given the potential insights to be gleaned from, say, population-scale health records:

https://www.nytimes.com/2019/07/23/health/data-privacy-protection.html

It's clear that de-identification is not fit for purpose when it comes to these data-sets:

https://www.cs.princeton.edu/~arvindn/publications/precautionary.pdf

But that doesn't mean there's no safe way to data-mine large data-sets. "Trusted research environments" (TREs) can allow researchers to run queries against multiple sensitive databases without ever seeing a copy of the data, and good procedural vetting as to the research questions processed by TREs can protect the privacy of the people in the data:

https://pluralistic.net/2022/10/01/the-palantir-will-see-you-now/#public-private-partnership

But companies are perennially willing to trade your privacy for a glitzy new product launch. Amazingly, the people who run these companies and design their products seem to have no clue as to how their users use those products. Take Strava, a fitness app that dumped maps of where its users went for runs and revealed a bunch of secret military bases:

https://gizmodo.com/fitness-apps-anonymized-data-dump-accidentally-reveals-1822506098

Facebook encourages me to share my content. I'm a monitized account.

Yet they keep share-banning me.

I do not share more than the average - certainly much less than other monitized pages, and as I mentioned, I'm even encouraged to do so.

The only reasons I still play along are because I have a lot of memories with my late husband there, and I get more engagement there than I do anywhere else. As an author, that's important.

I'm so beyond over Zuckerberg and his ridiculous totalitarian online playground.

THIS PLACE IS A FCKING PRISON ON PLANET BULLSHT.

I'm now banned / restricted on Facebook for another 30 days because I posted this art still of Keith Haring putting body paint and sculpture on Grace Jones *to my Instagram stories*.

I can't like, comment, or post on anything on FB for the entire month.

Fourth, assign a random word in lieu of the forbidden word.  For instance, in China, freethinking netizens drop in the name “Zhao”—a common surname in that country—in place of other words that might perk up the censors.  Indeed, Epoch Times, a Falun Gong-related dissident publication appearing in the West, has helpfully provided a list of 20 code-words and phrases, all aimed at slipping past the censors; for instance, the Beijing regime’s secret police are ironized as “national treasure.”

Fifth, whole phrases can be “repurposed.” For instance, the Chinese words “grass mud horse” have been hijacked by regime opponents in a way that makes for a dig at the government and a naughty pun in Chinese.

A leak from the European Data Protection Board reveals that the EU’s top privacy regulator is about to overrule the Irish Data Protection Commission and declare Facebook’s business model illegal, banning surveillance-based ads without explicit consent:

https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal

In some ways, this is unsurprising. Since the GDPR’s beginning, it’s been crystal clear that the intention of the landmark privacy regulation was to extinguish commercial surveillance and ring down the curtain on “consent theater” — the fiction that you “agree” to be spied on by clicking “I agree” or just by landing on a web-page that has a link to some fine-print.

Under the GDPR, the default for data-collection is meaningful consent, meaning that a company that wants to spy on you and then sell or use the data it gathers has to ask you about each piece of data they plan to capture and each use they plan to make of it.

These uses have to be individually enumerated, and the user has to actively opt into giving up each piece of data and into each use of that data. That means that if you’re planning to steal 700 pieces of information from me and then use it in 700 ways, you need to ask me 1,400 questions and get a “Yes” to each of them.

What’s more, I have to be given a single tickbox at the start of this process that says, “No to all,” and then I have to be given access to all the features of the site or service.

The point of this exercise is to reveal consent theater for the sham it is. For all that apologists for commercial surveillance insist that “people like ads, so long as they’re well-targeted” and “the fact that people use high-surveillance services like Facebook shows a ‘revealed preference’ for being spied on,” we all know that no one likes surveillance.

There’s empirical proof of this! When Apple added one-click tracker opt-out on its Ios platform, 96% of users opted out, costing Facebook more than $10b in the first year (talk about a ‘revealed preference!’) (of course, Apple only opted those users out of tracking by its rivals, and secretly continued highly invasive, nonconsenual tracking of its customers):

https://pluralistic.net/2022/11/14/luxury-surveillance/#liar-liar

Properly enforced, the GDPR would have upended the order of the digital world: any argument about surveillance between product managers at a digital firm would have been settled in favor of privacy, because the pro-privacy side could argue that no one would give consent, and the very act of asking would scare off lots of users.

But the GDPR wasn’t properly enforced, thanks to structural problems with European federalism itself. The first line of GDPR enforcement came from privacy regulators in whatever country a privacy-violator called home. That meant that when Big Tech companies violated the GDPR, they’d have to account for themselves to the privacy regulator in Ireland.

For multinational corporations, Ireland is what old-time con-artists used to call a “made town,” where the cop on the beat is in on the side of the criminals. Ireland’s decision to transform itself into a tax haven means that it can’t afford to upset the corporations that fly Irish flags of convenience and maintain the pretense that all their profits are floating in a state of untaxable grace in the Irish Sea.

That’s because there are plenty of other EU countries that compete with Ireland in the international race to the bottom on corporate governance: Malta, Luxembourg, the Netherlands, Cyprus, etc (and of course, there’s post-Brexit UK, where the plan is to create an unregulated haven for the worst, wealthiest companies in the world).

All this means that seeking Irish justice from a corporation that wronged you is like asking a court in Moscow to punish an oligarch’s commercial empire on your behalf. Irish regulators are either “dingo babysitters” (guards in league with the guarded) or resource-starved into ineffectual torpor.

That’s how Facebook got away with violating the GDPR for so many years. The company hid behind the laughable fairy-tale that it didn’t need our consent to spy on us because it had a “legitimate purpose” for its surveillance, namely, that it was contractually obliged to spy on us thanks to the “agreement” we clicked on when we signed up for the service.

That is, you and Facebook had entered into a contract whereby Facebook promised you that it would spy on you, and if it didn’t spy on you, it would be violating that promise.

Har.

Har.

Har.

But while the GDPR has a structural weakness — allowing corporations to choose to be regulated in countries that can’t afford to piss them off — it also has a key strength: the private right of action, that is, the right of individuals to sue companies that violate the law, rather than having to convince a public prosecutor to take up their case.

https://www.eff.org/deeplinks/2019/01/you-should-have-right-sue-companies-violate-your-privacy

The private right of action is vital to any privacy regulation, which is why companies fight it so hard. Whenever a privacy bill with a private right of action comes up, they tell scare-stories about “ambulance chasers” who’ll “clog up the system,” trotting out urban legends like the McDonald’s Hot Coffee story:

https://pluralistic.net/2022/06/12/hot-coffee/#mcgeico

But here we are, in the last days of 2022, and the private right of action is about to do what the Irish regulators wouldn’t do: force Facebook to obey the law. For that, we can thank Max Schrems and the nonprofit he founded, noyb.

Schrems, you may recall, is the Austrian activist, who, as a Stanford law student, realized that EU law barred American tech companies from sending their surveillance data on Europeans to US data-centers, which the NSA and other spy agencies treated as an arm of their own surveillance projects:

https://pluralistic.net/2020/07/16/text-adventures-resurgent/#nein

Schrems brought a case against the Irish regulator to the EU’s top privacy authority, arguing that it had failed its duty by ruling that Facebook’s “contractual obligation” excuse held water. According to the leaked report, Schrems has succeeded, which means, once again, Facebook’s business model is illegal.

Facebook will doubtless appeal, but the writing is on the wall here: it’s the end of the line for surveillance advertising in Europe, an affluent territory with 500m+ residents. This decision will doubtless give a tailwind to other important privacy cases in the EU, like Johnny Ryan’s case against the ad-tech consortium IAB over its “audience taxonomy” codes:

https://pluralistic.net/2021/06/16/inside-the-clock-tower/#inference

It’s also likely good news for Schrems’ other ongoing cases, like the one he’s brought against Google:

https://pluralistic.net/2020/05/15/out-here-everything-hurts/#noyb

Facebook has repeatedly threatened to leave the EU if it is required to stop breaking the law:

https://pluralistic.net/2020/09/22/uncivvl/#fb-v-eu

This is a pretty implausible threat, growing less plausible by the day. The company keeps delivering bad news to investors, who are not mollified by Mark Zuckerberg’s promise to rescue the company by convincing all of humanity to spend the rest of their lives as highly surveilled, legless, sexless, low-polygon cartoon characters:

https://www.fool.com/investing/2022/12/06/why-meta-platforms-stock-dove-today/

Zuckerberg and his entire senior team have seen their net worth plummet with Meta’s share price, and that means the company needs to pay engineers with actual dollars, rather than promises of shares, which kills the massive wage-bill discount the company has enjoyed. This is not a company that can afford to walk away from Europe!

Between Apple’s mobile (third-party) tracker-blocking and the EU calling time on surveillance ads, things are looking grim for Facebook. You love to see it! But things could get even worse, and soon, thanks to the double-edged sword of “network effects.”

Facebook is a network effects business: people join the service to socialize with the people who are already there — then more people join to socialize with them. But what network effects give, they can also take away: a service that gets more valuable when a new user signs up loses value when that user leaves.

This is beautifully explained in danah boyd’s “What if failure is the plan?” which recounts boyd’s experiences watching MySpace unravel as key nodes in its social graph disappeared when users quit: “Failure of social media sites tends to be slow then fast”:

http://www.zephoria.org/thoughts/archives/2022/12/05/what-if-failure-is-the-plan.html

Facebook long understood this, which is why it spent years creating artificial “switching costs” — penalties it could impose on users who quit, such as the loss of their family photos:

https://www.eff.org/deeplinks/2021/08/facebooks-secret-war-switching-costs

This is why Facebook and other tech giants are so scared of interoperability, and why they are so furious about the new EU Digital Markets Act (DMA), which will force them to allow new services to connect to their platforms, so that users who quit Big Tech won’t have to lose their friends or data:

https://www.eff.org/deeplinks/2022/04/eu-digital-markets-acts-interoperability-rule-addresses-important-need-raises

An interoperable Facebook would make it easy to leave social media by removing the penalties Facebook imposes on its disloyal users, and the EU’s privacy framework means that when they flee to a smaller safe haven, they won’t have to worry about commercial surveillance:

https://www.eff.org/interoperablefacebook

But what about advertising-supported media? Sure, being spied on sucks, but a subscription-first media landscape is a world where “the truth is paywalled, but the lies are free”:

https://www.currentaffairs.org/2020/08/the-truth-is-paywalled-but-the-lies-are-free/

Ironically, killing surveillance ads is good news for ad-driven media. Surveillance-based ad-targeting is nowhere near as effective as Google, Facebook and the other ad-tech companies claim (these companies are compulsive liars, it would be amazing if the only time they told the truth is when they were boasting about their products!):

https://onezero.medium.com/how-to-destroy-surveillance-capitalism-8135e6744d59

And consent-theater or no, targeted ads reach fewer users every day, thanks to ad- blockers, AKA, “the biggest boycott in world history”:

https://blogs.harvard.edu/doc/2015/09/28/beyond-ad-blocking-the-biggest-boycott-in-human-history/

And when a publisher does manage to display a targeted ad, they get screwed. The Googbook dupololy is a crooked affair, with the two tech companies illegally colluding (via the Jedi Blue conspiracy) to divert money from publishers to their own pockets:

https://techcrunch.com/2022/03/11/google-meta-jedi-blue-eu-uk-antitrust-probes/

Targeted ads are a cesspit of ad-fraud. 15% of all ad revenues are just unaccounted for:

https://twitter.com/swodinsky/status/1511172472762163202

The remaining funds aren’t any more trustworthy. Ad-tech is a bezzle (“the magic interval when a confidence trickster knows he has the money he has appropriated but the victim does not yet understand that he has lost it”):

https://pluralistic.net/2021/01/04/how-to-truth/

As Tim Hwang foretold in his essential Subprime Attention Crisis, the pretense that targeted ads are wildly effective has been slowly but surely losing ground to the wider awareness of the fraud behind the system, and a reckoning is at hand:

https://pluralistic.net/2020/10/05/florida-man/#wannamakers-ghost

Experiments with contextual ads (ads based on the content of the page you’re looking at, not on your behavior and demographics) have found them to about as effective in generated clicks and sales as surveillance ads.

https://pluralistic.net/2022/04/29/taken-in-context/#creep-me-not

But this is misleading. Contextual ads don’t require consent opt-in (because they’re not based on your data) and they don’t drive users to install blockers the way creepy surveillance ads do, so lots more people will see a contextual ad than a surveillance one. Thus, even if contextual ads generate slightly less money per reader or viewer, they generate far more money overall, because they are aren’t blocked.

Even better for publishers: contextual ads don’t erode their own rate cards. Today, when you visit a high-quality publisher like the Washington Post, many ad brokers bid to show you an ad, but only one wins the auction. However, all the others have tagged you as a “Washington Post reader,” and they can sell that to bottom-feeder junk sites. That is, they can collude with Tabooleh or its rivals to offer advertisers a chance to advertise to Post readers at a fraction of what the Post charges. Lather, rinse, repeat, and the Post’s own ad revenues are drained.

This doesn’t apply with contextual ads. Indeed, none of the tech giants’ much-vaunted “data advantage” — the largely overstated value of knowing what you did online 10 or 20 years ago, the belief in which keeps new companies out of the market — applies to context ads:

https://pluralistic.net/2021/04/11/halflife/#minatory-legend

The transformative power of banning surveillance advertising goes beyond merely protecting our privacy. It also largely answers the case for “link taxes” (pseudo-copyright systems that let giant media companies decide who can link to them and charge for the privilege).

The underlying case for link taxes, snippet taxes, etc, is that Big Tech is stealing the news media’s content (by letting their users talk about and quote the news), when the reality is that Big Tech is stealing their money (through ad-fraud):

https://doctorow.medium.com/big-tech-isnt-stealing-news-publishers-content-a97306884a6b

Unrigging the ad-tech market is a much better policy than establishing a link-tax, like the Democrats are poised to do with their Journalism Competition and Preservation Act (JCPA):

https://www.politico.com/newsletters/politico-influence/2022/12/06/jcpa-opponents-spring-into-action-to-block-ndaa-inclusion-00072602

It’s easy to understand why the monopoly/private-equity-dominated news industry wants JCPA, rather than a clean ad market. The JCPA just imposes a tax on the crooked ad-tech giants that is paid to the largest media companies, while a fair ad market would reward the media outlets that invested most in news (and thus in expensive, unionized news-gathering reporters).

Indeed, the JCPA only works if the ad-tech market remains corrupt: the excess Big Tech rents that Big News wants to claim here are the product of a rigged system. Unrig the system and there won’t be any money to pay the link tax with.

Image: Anthony Quintano (modified) https://commons.wikimedia.org/wiki/File:Mark_Zuckerberg_F8_2018_Keynote_%2841118883004%29.jpg

CC BY 2.0 https://creativecommons.org/licenses/by/2.0/deed.en