Norway Fining Meta $98,500 per Day for User Privacy Breach

[jsnell]

Discussed multiple times in the last couple of months. There seems to be nothing new in this submission, it's just somebody churning away at the content marketing mill.

https://news.ycombinator.com/item?id=37403583

https://news.ycombinator.com/item?id=37173344

https://news.ycombinator.com/item?id=37045185

https://news.ycombinator.com/item?id=36756101

https://news.ycombinator.com/item?id=37403633

[VisitorAnalyt]

Big tech - and Meta's approach to user data security - has long felt too powerful for Europe's data protection authorities to control. Given this, Norway's success is showing other European countries the way, and this points to a significant improvement in EU citizen personal data protection in the coming years.

[bettercallsalad]

> EU citizen personal data protection

Sadly, there is no personal data protection. EU has recently agreed to allow data transfer to US [1]

[1] https://arstechnica.com/tech-policy/2023/07/big-tech-can-tra...

[Y_Y]

Worth nothing that Norway is not in the EU yet, though the statement remains true.

[drooopy]

What has less value than pocket change? Because that's what this fine is to Meta or Big Tech in general. And how exactly is Norway pointing the way when other EU states such as Italy, Ireland, France etc have imposed similar fines to Alphabet and/or Meta in the past?

[jonplackett]

Is it actually changing anything though, or are Meta just paying the fine and continuing their merry way?

[jve]

I want to ask here: Is there any study/experiment about what way say offline in proximity of our Android mobile devices leads to ads in Google?

My collegue made an experiment with his wife. Put their phones down, talk about different kinds of CRMs and DID NOT SEARCH for that stuff. Lo and behold, ads about different kinds of CRMs start popping up.

I'm skeptical to these things and initially didn't believe. Then people I ask confirm - hey, yeah, I was only talking about it, now I get those ads! He said he was talking non-English, however CRM software names are english.

Coincidance?

I would love to hear some experiment results in this direction.

[Kollided]

"A widespread myth regarding online advertising is that Google and Facebook are listening to us speak and showing ads on this basis. This is not true, even if it often seems to be. There is a good explanation for this misconception. All of us have probably been part of a discussion on a specific topic—only to see online ads on the same topic immediately afterward. This is not a case of Google recording your speech and using it to target advertising. The most common reason is that people take keener note of matters that they have just discussed. If your phone is showing you ads for holidays in Maui, you probably ignore them. However, if you have just spent time with your cousin in a café, discussing places to visit in Maui during your holiday, the same ad will grab you in a different way. Another explanation is that your friend has been browsing for Internet content relevant to your discussion, even if you haven't. So, if you discussed haggis with your colleagues during your coffee break and you see a Facebook ad for delicious haggis in the afternoon, there is no conspiracy. Inspired by your discussion, your colleague has gone online for a genuine haggis recipe, from the same address space as your workstation. Sometimes, the most peculiar things have perfectly logical explanations."

*If It's Smart, It's Vulnerable", Mikko Hyppönen

[sneak]

I am so tired of these memes. The network traffic out of common social media mobile apps is fully studied and understood. You can even inspect it yourself if you like, using an access point, an http reverse proxy, a self-generated CA (manually installed on device), and some netfilter rules. AFAIK the social media apps aren't doing cert pinning, but even if they are you can find the pins in the apk and patch your own in over top.

It would be obvious if they were exfiltrating audio data. They are not.

[filleokus]

I think no hard evidence has ever come from theories like this. And like the sibling comment said, considering how much scrutiny major social media apps (and the Android OS) is under from security researchers - surely someone would have noticed by know.

But. I also think this shows how spookily good the surveillance ad tech really is, and to what extent the major players (Alphabet, Meta etc) keep track of people. Non-techy people attribute it to microphones and dictation, while in reality it is just enormous amount of old school digital behaviour tracking.

(And a dash or two of frequency illusion bias of course, people tend to ignore the "hot single moms in your area" or super general ads with less impressive targeting)

[InfamousRece]

This could be some variation of Baader-Meinhof phenomenon: https://en.m.wikipedia.org/wiki/Frequency_illusion

[mda]

It doesn't. Maybe try with something more obscure. It is a phenomenon called frequency bias (it has different names)

[kornhole]

I often hear different variations of this story, but I have never seen it well documented. I have not seen an online ad in over three years since I switched to Graphene OS without any adware on my devices.

[yard2010]

Facebook is a $815 Billion company. This is merely a slap on the wrist. Honest question, why not 100x? They can and will pay, and other governments can follow and end this lizard way of doing business

[ekianjo]

Revenue is not the same as net income. And market cap is utterly meaningless

[Zetobal]

Just make it an even 1% of revenue per day going up 1% every other day.

[guidedlight]

They should double it every month.

[ed_blackburn]

It's when these matters start moving from civil to criminal and directors fear criminal proceedings that enforcement is taken seriously by organisations that apply every decision through the lens of is the fine the cost of doing business?

[charcircuit]

This isn't a user privacy breach. Recommending posts is a core functionality of social media. People understand that the site learns your interest. It's not a privacy breach if TikTok learns you like watching piano videos. Nor is it a privacy breach if X learns you like to see posts from artists.

[awesomeMilou]

The issue at hand isn't their recommender system for content, it's that they use the same recommender system for ads, which is apparently illegal in Norway.

As I understand it, it's legal to offer recommender systems for personalized content suggestions, but you cannot do the same for personalized ads.

[gremlinunderway]

Just because its been imposed as a "standard" for so long before anyone objected doesn't make it a core functionality of social media. Sites don't need to learn my interest by profiling me like the Stasi.

[madsbuch]

maybe this could be the next way to pad their sovereign wealth fund, when the oil is gone.

[imjonse]

When reporting fines for large companies in media, these should also be expressed as percentage of daily/yearly profits or revenues, to highlight the fact that most of the time they won't have any effect.

[zgs]

$30 million per annum wouldn't even represent a bump against their revenue. Until the fines are revenue based, it's not going to matter.

[jstanley]

Of course they care about $30 million per year. That's enough to fund a good-sized full-time team just to work on this one single problem.

You can't go idly throwing away $30 million a year, even if you're Facebook. Yes, they can get away with it once or twice, but if that is your approach to unnecessary $30 million costs, you're not going to last very long.

[frabcus]

Norway is only 5 million people - if every country in the world did it the fine would be more like $30 billion per annum, which is about a quarter of Facebook's revenue.

Still, agreed would be better if it was a more punitive fine!

[sam_goody]

I actually think they care about $30M, especially as this just might start a slew of copycats, or similar suits in Norway.

It is better for them to do something big enough to hurt, but not big enough to get all of Meta's guns blazing. This will accepted, and we can start from there with the next step (applying this same ruling to a hundred other users, or in a hundred other courts)

A million here, a million there, and before you know it you are talking about real money - Everett Dirksen

[pipo234]

Small steps. Norway population (5.5 million) is equivalent to 0.07% of the total world population. Meta's revenue would be proportional, and so would be the fine. To avoid inconveniencing foreigners, Norwegian advertisers would have to pony up $98,500 every day.

To frame it differently: if all GDPR countries were to fine similarly it'd scale up to $3-4 billion annually and that would start to hurt a little.

[Dah00n]

META is trying to fight this in the courts (with no success). At some point other countries will see that it is watertight and they'll follow Norways line. In my opinion META can do what Norway tells them to do or end up not being in the EU, either forced out or leaving themselves. I can't see any other outcome.

[0xDEF]

No, but when multiple bigger European countries and the EU starts fining them things start to add up.

[jve]

I hear this argument every-single-time some fine against bigcorp.

Someone should sum all those fines, maybe then it will have a dent?

Moreover revenue is useless in this context, we should compare with profit anyways. And maybe profit against Norway particulary or any other country in question.

[ffhhttt]

If you make it clear to the court that you’re just willing to treat the fine as a tax and pay it indefinitely without having any intention of altering your behavior, I’m sure they’ll start imposing other penalties after some time

[gnfargbl]

If we boldly link market cap and individual net worth, then this is like someone with a net worth of $1m being fined 12 cents per day. From Meta's point of view, what makes this more than just an additional tax?

[jncfhnb]

Well we shouldn’t do that because thats a deeply naive way to think about market values, people don’t really think about wealth taxes, and you’re confusing taxes with fines.

What you should compare it to is the net income derived from Norway.

[MontgomeryPi2]

Indeed. How many centuries would Meta need to pay this fine before it starts to begin to hurt/be noticed I wonder.

[imglorp]

The fine should double every day of continued violation, if you want to get their attention.

[Denvercoder9]

Generally regulators increase fines like this over time if the violation is not resolved. GDPR allows a maximum fine of 4% of global turnover.

[nonrandomstring]

I am curious. How does this work?

Do big-tech companies actually pay these fines? In cash? By daily bank transfer? Direct debit?

And to whom? Margrethe, the Queen of Denmark? Or to some bank? Or are bank notes scattered to wind in Copenhagen square so the people can stuff them into their pockets?

Or do the governments of countries whose laws are broken have a nod-and-wink tacit agreement that "fines" are just numbers for the press to print and assuage our sense of outrage. Aren't we just starting to use numbers like this as abstract tokens of justice?

I'd like to see Zuck made to personally lug an enormous pirate's chest of treasure up to the gates of Copenhagen, or face blood-eagling at dawn.

[mikro2nd]

You might care to learn the difference between Norway and Denmark.

[Etheryte]

What do you mean? Big tech companies pay fines much the same way regular companies pay fines. Going to court and other foreplay notwithstanding, it's generally just a bank transfer to the relevant authority. If you messed up on taxes you usually pay to the tax authority of that country, for many other matters it's often whatever the equivalent of the ministry of finance is. Of course this differs from country to country, but this is a pretty straightforward matter in general. I'm not sure where the confusion comes from?

[pjc50]

Given that this is Norway, they probably use Vipps.

[vages]

The fines are paid to the Data Protection Authority in Norway. You can read their own press here: https://www.datatilsynet.no/en/news/ The kind of tit-for-tat you’re insinuating rarely happens, if ever. I would expect the fines to enter the state’s finances the same way other a fine for speeding does.

Echoing other comments about how Norway and Denmark are separate countries.

[rsynnott]

Bank transfer would be normal. In some countries a particularly awkward Naughty Company could probably do it in coins if they wanted to (depends on legal tender rules).

[stOneskull]

i wonder where the money goes

a big viking party would be cool

[fbn79]

META privacy breach are nothing when you have App like TEMU ---> https://grizzlyreports.com/we-believe-pdd-is-a-dying-fraudul...

[oknotcool]

What's up with the whataboutism, both can be bad.