How do you lot feel about Pay or say OK to ads model, asks ICO
- Reference: 1710155775
- News link: https://www.theregister.co.uk/2024/03/11/ico_pay_or_ads/
- Source link:
"Consent or Pay" models are where customers are encouraged to part with cash in return for services that don't involve their data being used for purposes such as advertising.
While the [1]ICO studiously avoided naming any companies or organizations in particular, one of the most famous [2]examples of the practice comes from Meta, which asked EU subscribers to choose between either paying to lose ads and allow data processing for advertising.
[3]
The subscription model, which has acquired several nicknames over the months, including "Pay or Okay," has attracted [4]considerable flack from privacy campaigners as well as several lawsuits – based on EU data protection laws.
[5]
[6]
As the local data watchdog, the ICO has waded into the arguments and asked for views on the model. The situation, it said, is... complicated.
According to the ICO, data protection law "allows for a wide range of different approaches and business models. It balances fundamental rights like the right to privacy with other rights, like the freedom to conduct a business."
[7]
The rules do not prohibit a "consent or pay" model, but it is very important that users understand what the "consent" part of the model actually means and what they are handing over instead of entering a credit card number. It must also be as easy for users to withdraw consent as it is for them to give it – just like under the UK GDPR rules, which are still almost identical to the EU GDPR and were implemented under the Data Protection Act 2018. (Changes to the law can be made post-Brexit, but the country still needs to toe the line or lose its " [8]data adequacy " badge that allows info flows between EU and UK.)
The ICO is kicking things off with four factors for consideration.
How should the fee for dodging personalized ads be calculated?
[9]
Are the ad-funded and paid-for services basically the same? If the paid-for version includes extras, then this wouldn't be the case.
What is the balance of power? It's hard to give consent freely when there is little choice in whether to use the service or not.
[10]IAB Europe's ad consent popups pose privacy problem
[11]Brexit dividend? 'Newly independent' UK will be world's 'data hub', claims digital minister
[12]Meta's pay-or-consent model hides 'massive illegal data processing ops': lawsuit
[13]'Scandal-plagued' data broker tracked visits to '600 Planned Parenthood locations'
[14]Mozilla adds paid-for data-deletion tier to Monitor, its privacy-breach radar
Finally, there is the question of privacy by design and whether users truly understand what data is being collected and for what purpose.
Ultimately, the ICO is pondering how to approach the "consent or pay" business models with regard to data protection law. It [15]said : "This call for views sets out the ICO's emerging thinking on 'consent or pay' business models. It should not be interpreted as confirmation that such an approach is legally compliant."
Interested parties have until April 17, 2024 to vent their spleen at the ICO.
Or alternatively, you could use the comments section to give your thoughts on the emerging Consent or Pay business models. ®
Get our [16]Tech Resources
[1] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/03/ico-launches-consent-or-pay-call-for-views-and-updates-on-cookie-compliance-work/
[2] https://www.theregister.com/2023/11/28/metas_eu_privacy_fee_triggers/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Ze84rYwHBaL4a122C7PufQAAAME&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2024/02/29/meta_gdpr_complaints/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ze84rYwHBaL4a122C7PufQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ze84rYwHBaL4a122C7PufQAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Ze84rYwHBaL4a122C7PufQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/07/06/uk_data_protection_bill/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Ze84rYwHBaL4a122C7PufQAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2024/03/08/ad_tracking_popups_in_europe/
[11] https://www.theregister.com/2022/10/06/new_dcms_head_newly_independent/
[12] https://www.theregister.com/2024/02/29/meta_gdpr_complaints/
[13] https://www.theregister.com/2024/02/15/data_broker_location_abortion/
[14] https://www.theregister.com/2024/02/06/mozilla_monitor_data/
[15] https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/call-for-views-on-consent-or-pay-business-models/
[16] https://whitepapers.theregister.com/
Re: Great Idea!
Here's a pile of very genuine high quality personal data and i'll even give you a [1]picture of me . Now pay up!
Not every problem can be solved by inventing a new market. Just look at Ofgem. As soon as you invent an artificial market, someone works out how to defraud it.
What I'd rather see, is a general ban on targeted advertising, data brokers etc. Not opt in or opt out, just Out. If that means a few Trillion is wiped off the NASDAQ, so be it.
[1] https://thispersondoesnotexist.com
Re: Great Idea!
Then everyone would have to pay and you automatically exclude those who can't afford to pay.
These services have to make money somehow.
Re: Great Idea!
They said "a general ban on targeted advertising" not a ban on any advertising
If that means advertising will be less effective then my response is "Oh dear, what a pity, never mind"
I'd argue that targeted advertising can still be allowed but ONLY if the target is the nature of the website\specific page being viewed with absolutely zero knowledge* about the viewer being needed or used
*except perhaps some very approximate geographical stuff as there's no point running ads for, say, an Australian product if the viewer is in Europe but happens to be looking at the Australian based website
Re: Great Idea!
And untargeted TV advertising had, an probably still has, a much higher CPM than targeted web advertising.
Re: Great Idea!
CPM? I had to look up that piece of marketing BS-Bingo
I don't really give a toss about their costs. What irks me is that different people see different versions of webpages and search results depending on who some data-broker thinks they are. That's what enables social manipulation.
Of course, social manipulation is ultimately what all Advertising boils down to, but at least with untargeted advertising it has to be done in the clear, where people can call out propaganda and abuse. Whereas targeted advertising allows abusive marketing practices to be done surreptitiously.
Re: These services have to make money somehow
That supposs that "these services" are actually useful to the general public.
I'm not sure that is always the case.
Actually, I'm pretty sure that is hardly ever the case.
Re: These services have to make money somehow
The Reg is a useful service. Facebook/twatter/ubend less-so
If the Reg were to embed some non-intrusive ads hosted by their own server that I could be sure weren't slurping my data to some ad-slinger company then I wouldn't block them. But as long as Javascript and cross-domain slurping is going on, i'm not having it.
Frankly I'd like to see the likes of Google, Meta and Microsoft broken up. If Google were to disappear off the face of the earth tomorrow, the only part of it that I would miss is GMail - their search is rubbish these days and AOSP would become so much better if Google died. But even GMail I use less and less these days. Youtube is a increasingly a cess-pool to compete with TikTok. The only part of Microsoft I'd miss is GitHub (which they shouldn't have been allowed to pillage in the first place) the rest of it (LinkedIn, Windows, Office, OpenAI etc) can be incinerated. Meta, I'd only miss WhatsApp (which again, they shouldn't have been allowed to buy) TikTok, X, amazon, Apple*.. I wouldn't miss these at all.
* Of course, some people would miss Apple a lot. There would need to be some kind of fanboi rehabilitation programme
Re: Great Idea!
"the auctioneers don't pay me anything"
Not true, you get to use their service free of charge. You are paid "in kind" rather than receiving direct financial return. It's still payment.
Re: Great Idea!
Not true, you get to use their service free of charge. You are paid "in kind" rather than receiving direct financial return. It's still payment.
Not always, eg Amazon's decision to slap ads into a service people were already paying for. Or services being paid for by advertisers, but that model seems to be increasingly broken. Advertisers are beginning to realise the claims around targetted advertising don't really work in reality. But the problem is still people using my services and personal data free of charge.
Best solution would be to just make cyberstalking and data rape illegal, so back to the basic principles of consent, and minimum personal information necessary. But the ad slingers and brokers absolutely hate that idea, and as another commentor put it, the current model is akin to pay and we won't rape you, or don't pay and you're consenting.
Re: Great Idea!
Please stop using the offensive reference to rape. It isn't applicable, in any way. When it comes to these services there is always a choice. If you don't like what a supplier of any service does, then don't use it. It is entirely within your choice to decide to use Amazon or not, unlike rape, where there is no choice.
Re: Great Idea!
Actually I think the reference he should have used is a Kray twins style protection racket. Especially as that's somewhat closer to the truth.
Re: Great Idea!
Where on the page is the *ucking ToS? Its at the f*cking bottom of the fu*king page, which, even if its displayed first, slips fuc*ing downward as more bullshit is downloaded to fill the page above it. By the time you've read and agreed to the ToS, its too late. In fact, by the time the ToS opens to your click, its too late.
Success story?
" We have seen an almost 80% success rate in effecting change from the 53 organisations we wrote to last year "
One a week contacted, with one fifth failing to co-operate. Well done, seeing that almost every commercial web site (pretty much regardless of scale) abuses user privacy, not only specifically by cookies but by scripted snooping tools that are typically not affected by "cookie banner" choices.
What's needed is a statutory opt in policy. It's really disappointing that this hasn't yet registered, despite Ofcom establishing in 2019 that " [...] only 15% of respondents were happy for online companies to collect and use their data to show more relevant adverts or information. Further, research conducted by Ofcom, the ICO and Which? all showed that the more consumers understood about how targeted advertising works, the more concerned they became about it, and began to feel less in control of their data and that, in addition, consumers can become less willing to receive personalised advertising " *
I suspect there are too many powerful vested interests for statutory opt in to be implemented. However it remains to be seen whether the targeted advert bubble will burst at some point. There are numerous studies indicating that user profile-based targeting doesn't really work for either web users or sellers, the primary beneficiaries being the brokers. It's with luck a just a matter of time before this becomes sufficiently known to drive reversion to page content oriented advertising (which does work and avoids the 'need' for user profiling).
* Competition & Markets Authority Online platforms and digital advertising Market study interim report 2019
.
I smell an attempt to move away from GDPR. This should be a non-argument. If you are collecting data you need to be completely transparent and obtain consent. If it's a paid for service you still need consent. Creating free tier to remove consent is just gaming the system because hardly anyone is going to pay for something you can have for free and they know it. I block ads and as much tracking as I can anyway but that's their own fault for taking the piss with them. The odd ad here and there wouldn't bother me to be honest but it never is.
The proposed DPDI bill already aims to nobble cookie banners, [1]the ICO is singing from the same hymn sheet , and it looks like they're is sounding out whether or not the Government can go a little further.
[1] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/03/ico-statement-on-re-introduction-of-data-protection-and-digital-information-bill/
" The proposed DPDI bill already aims to nobble cookie banners"
The DPDI Bill aims to nobble practically every data subject protection except those relating to direct material losses resulting from data breaches. It remains to be seen whether the result will pass European scrutiny for "adequacy" but it's very likely that will be a political decision. The fundamental that the GDPR is human rights law, not just data law has proved so inconvenient to big business that almost everyone has been bending over backwards to circumvent its provisions ever since 2018.
Oh, and by the way, the GDPR is silent on 'cookie banners' (and indeed on 'cookies'). The relevant UK legislation is the Privacy and Electronic Communications (EC Directive) Regulations 2003, implementing European Directive 2002/58/EC. It relates to cookies and other tracking devices (a fact that's usually ignored) but 'cookie banners' are purely an invention of those attempting to circumvent the legislation, in that, as implemented, they're the most annoying possible way to 'seek consent', in the obvious hope that most folks will just click through.
" I smell an attempt to move away from GDPR. "
France already does this - consent to potentially being tracked by hundreds of partners or cough up some coins. There's no such thing as the ability to say "don't track me" so I don't know what tortuous logic deems this as acceptable within the existing cookie legislation - being coerced to accept or pay is not freely given consent. It's barely better than asking for protection money (and I say barely better as knowing how scummy the online advertising industry is, I absolutely don't trust them to be tracking you anyway, because they can).
The thing is, in most cases I wouldn't particularly have any problem with the site I'm visiting dropping cookies on my machine, it's those fucking hundreds of parasites that come along for the ride. A pox on all their houses.
You can see the pile on coming...
Get away with this and you'll be entering your CC details on every website or "consenting".
Rapist: pay me or you consent to me fucking you?
Re: You can see the pile on coming...
while I hate the ad-based model, your comparison is simply wrong, with pay/consent you CAN walk away FREELY, unlike rape.
Sir Humphrey wrote the survey
I filled in the survey and it's unhelpful if (like me) you'd like "pay or ok" schemes to be nuked from orbit.
Re: Sir Humphrey wrote the survey
@Mark #255 Thanks for letting us know. I suspected as much but it's good to be informed that it's probably a waste of time.
Up to last year, free form submissions on such issues were invited, but this seems to be changing, finally confirming that the decisions have effectively already been made. That said, having submitted extensively as a data protection professional to successive consultations on data protection over several years right up to Parliamentary committee level, I can categorically state that there's zero evidence that any of my comments or suggestions have ever been considered. So it probably doesn't really matter how responses are invited as they're destined to be ignored anyway.
Data subject rights are obviously considered a drag on business, so they must be eviscerated while maintaining a facade of 'taking them seriously' and doing the minimum to keep the EU satisfied.
"It's hard to give consent freely when there is little choice in whether to use the service or not."
Are folks so desperate to use facebook they consider it a necessity for life? I can happily live without facebook etc. Oxygen, food and water less so.
Re: "It's hard to give consent freely when there is little choice........
I would agree if Facebook, Twitter and the like were the informal noticeboards and poncey IRC they started off as. Problem now is that they are embedded in all sorts of places. Some companies have no way to contact them for help or support outside of social media. Shit - there are hotels where Whatsapp is required to get in touch with room service or reception and I've had clients who wanted me to use Whatsapp instead of phone, text, email and, probably, just fuckihg talking to each other face to face.
Re: "It's hard to give consent freely"
Some people have no choice; for instance, if applying for a job with a company that requires contact to be made via social media.
Re: "It's hard to give consent freely"
That sounds like a good reason for avoiding that employer
Re: "It's hard to give consent freely when there is little choice "
And on aircraft, no choice at all
Advertisers should realise that the "targeting" information is coming from people who might be pissed off by their ads but are unwilling to pay not to get them. That should make them wonder whether what they're getting for their money is worth it.
The do realise and they don't care for two reasons. Firstly the hit rate can be very very low for them to be able to appear successful. Secondly, and more importantly, their customers don't really know how successful their ads are. The main thing they think they know is that to stop advertising would be a disaster. There's a pair of Freakonomics podcast about it (Does Advertising Actually Work) which are worth a listen to.
Spoiler: the answer to the question, according to Freakonomics, is along the lines of "not nearly as well as you'd like it to".
A minor point: "Flak" from the German FlugAbwehrKanone, not "Flack"....
And there is always a choice as to whether to use Meta's products or not.
although, your choice of using meta (and other ad-based services) already restrict your chances, e.g. certain jobs are only available through those 'social media, or any other sites that hover your data AND feed you ads. So if you don't agree to that, well, THIS job is not for you. And THAT job, and that one too.
Anyone that only uses social media to advertise their job openings is not worth applying to.
"Anyone that only uses social media to advertise their job openings is not worth applying to"
Individual agents of several otherwise entirely reputable agencies frequently refuse to interact with candidates (i.e. go silent) unless they can do it on linkedin. Agencies love these asocial media platforms because it eliminates the need to contact candidates individually until a decision has been made. After all, what's wanted is least effort for the commission, which is essentially the same motivation in principle that drives folks to post their content on goooooooogle's Blogger.com instead of setting up their own blog independently, and the same motivation that makes Blogger the place to go to view a blog rather than taking the trouble to search for an independent one. All round, it's unwillingness to make more than a minimal effort for the reward (an intrinsic and perfectly understandable human characteristic).
Despite what many are commenting, it is a difficult situation. To blindly say "Pay or Ok" should be banned is ridiculous.
I'm rabidly anti-tracking and certainly not in favour of giving big tech free-reign. All choices should be clear and transparent. However, someone has to pay somewhere, unless you consider the likes of Facebook to be public services that should be publically funded...? So, either the user pays up front, for which absolutely no data should be shared with anyone else, or they get a "free" service supported by ads. And advertisers, rightly or wrongly, want to target ads.
No one has an automatic right to use someone else's property and that includes the likes of Facebook. They should be made to be absolutely open and transparent, and to not give 3rd parties access to data unless that is explicitly agreed to and confirmed, say, annually by the user. But Facebook belongs to Meta. If you want to use it then you have to either pay or agree to their terms and conditions.
So yes, regulators should enforce openness and transparency but, ultimately, if users want to use a service then they can either pay or agree to Ts&Cs. If they don't read those, and the information is presented in a readily accessible format, then that's the user's problem.
"To blindly say "Pay or Ok" should be banned is ridiculous"
The site gets paid anyway, whenever someone clicks on an ad. Apparently, they also want to be paid whether you intend to or not. Does this suggest that the site revenue from ads is no longer sufficient? And might this further suggest that the "targeted advert" con is becoming threadbare? There have been quite a few rigorous studies suggesting that the primary beneficiaries of targeted advert broking are the brokers, not the advertisers, the platforms or the users, and this is supported by a lot of anecdote about the uselessness of the ads that turn up (" just bought a bed, so I'm inundated with bed adverts " etc.).
Re: "To blindly say "Pay or Ok" should be banned is ridiculous"
Targeted ads are, indeed, unnecessary nonsense but if that's the model a private company goes with then you either choose to use that supplier's product (the social media site) or you don't. Alternatively, you use it and take steps to protect your data. I use minimal, false details, layers of throw-away email addresses, don't provide phone numbers, use a VPN, use a privacy focused browser and ad blockers. Any site that refuses me access due to the use of the ad-blocker, that's fair enough and I respect that. I leave and find whatever I'm looking for elsewhere.
The UK's Information Commissioner's Office (ICO)
remarkably agile, for a change :(
Never
There should be a legal requirement for advertisements to be cleanly separable from editorial content, such that the client end can always remove adverts.
My screen, my rules.
If you show me an advertisement, not only am I never, ever going to buy anything from you; but I will recommend to my friends, family and anyone who will listen not to buy anything from you.
Re: Never
So, you want the content without paying for it at all? Why are you entitled to that?
Re: Never
People don't pay for content with their eyeballs. You know full well the rubbery linkages between the people who do pay (advertisers), who they pay (Google, mostly), and how Google pay a fraction of that to websites. Everybody in the chain knows that the majority of adverts are ignored, how is it different to actively ignore or block and advert, compared to passively ignoring it?
As they don't need to track you in order to display adds, this should be a non-issue. Consent to tracking should therefor be at your discretion (as per existing law), and if you want targeted ads: Why not ask the user what type of ad they'd want to see?
That they get paid to show adds regardless makes this claim for targeted adds suspect. That targeted ads don't equate to more conversions (people clicking the ad and purchasing the services), and that general ads can be more beneficial to the users (hey, didn't know about this thing... and I've already bought that other thing they keep pushing ads for... ) just adds to the doubt on the claimed reasons for why they need to track users for advertising.
That they can use this required consent to justify them selling your data: That's a significant issue. And yes, read the T's and C's and notice they often 'share with partners': Aka those who have paid them to collect your data. Yes, I do spend time reading T's and C's (I am that bored at times) and noticed how with some consent pages there's 'Legitimate interest (41* vendors)'!!! Seriously? How are 41 vendors claiming legitimate interest exceptions to consent for use of a site?
*Yes, I did notice some sites list the number of vendors they're claiming have legitimate interest. The highest I noted was, indeed, 41. If only they'd found one more vendor they could claim had legitimate interest... just one more... that would really be telling.
This is great!
It is about time people woke up to the price paid for the manipulation of their eyeballs. I think a lot of people will be shocked to see how much their identity has been monetized.
Imagine the permutations this could have... Let's say a user is financially well-off. As a target for advertisers, their advertising investment has a greater pay-off potential than if the ad appears for a broke person. Will Facebook charge more for advertising to that user? Do they do it already?
And therefore... Will Facebook charge rich people more to opt-out of advertisements versus poor people?
Even better.... It is logical people who can afford to pay for an opt-out will do so more often than those who cannot afford it. Therefore, Facebook advertisements will be primarily targeted at people without money. Does that lead to where Facebook is unable to sell advertisements? Sure millions of eyeballs saw the advertisement and want to buy, but if they are broke in the first place...
Yeah, this is going to be fun!
why not?
But add a non-transferable rule in there somewhere...
Great Idea!
So the recent story about TC Strings and the real-time auction for ads based on my personal infomation got me thinking. An auction is usually an arrangement between a seller and a buyer. I consign something to auction, someone buys it and the auctioneers take a fee. The TC Strings show that model is kinda broken. It's my data, but the auctioneers don't pay me anything. A transaction model obviously exists, it's just the seller is cut out of the loop.
So maybe Pay or Say OK could work. It just needs ad slingers and data harvesters to pay us for using our personal data. Sure, the price per indvidual transaction might be a small fraction of a penny, but given the number of trackers and harvesting transactions, it could quickly add up to a few beer tokens. Or just a way to compensate us for the current theft of both resources and privacy.