Hacker News new | ask | show | jobs
by notimetorelax 1941 days ago
It is illegal, they cannot offer free but tracked vs paid and untracked service. I guess GDPR enforcement didn't reach them yet.
2 comments

weird. they are well known in germany
I think enforcement is not there yet, here’s another very similar example: https://iapp.org/news/a/ico-tells-washington-post-it-offers-...
Yes you can, you can provide an add supported service with tracking and a paid one without.

Both via legitimate interest and consent.

The service cannot be dependent on the acceptance of third party cookies, no. That is, the service provided to those that reject third party cookies cannot be worse (slower or incomplete, for example) compared to the visitors who accept cookies.

So you can supply an ad supported version and a paid version without ads, but you cannot require that those that choose the ad supported version must accept tracking ads.

I have gotten confirmation from several DPAs that state a very different interpretation.

You can’t segregate the same service, two distinct services one that is provided with ads that include 3rd party cookies and a separate paid service that does not is perfectly fine.

What you cannot do is to create multiple tiers in a free service based on different levels of tracking.

That sounds like an extremely business friendly interpretation of the regulation. Creating a separate service (the paid one) shouldn’t in any way change the circumstances for the first service (the one with ads).

What you are describing sounds like a business can simply declare “well untargeted ads doesn’t pay enough so the options are tracking ads or paid subscriptions”. The regulation shouldn’t and doesn’t let a site make that decision. It would make it completely useless!

DPAs including the German on are quite “business” friendly unless it will be challenged in court.

You can’t force someone to provide their business at a loss.

As long as you don’t penalize or segregate users based on their decision alone it does not run afoul of GDPR, neither does blocking someone completely you just need to have a valid business reason for doing that and it has to be tied to the nature of the service including how it’s funded.

> You can’t force someone to provide their business at a loss.

Of course not. But no one is forced to provide the ad funded service at all.

I was careful in my post to write tracked vs untracked. Sure they can show the ads, just don’t track me unless I consent.