France Launches Second Salvo Against Facebook (liberation.fr)

Eunuchswear writes: After Mondays decision by the French CNIL (National Center for Computers and Freedom) that Facebook must stop tracking non-users, the DGCCRF (General Direction for Competition, Consumption and Repression of Fraud), has ruled that Facebooks terms of use are abusive and must be changed within 60 days." The linked story is in French, but for those of us who don't speak the language, Google translate works. Here's the DGCCRF's Facebook page.

Comments

how about other third-party tracking?

[Trepidity]

Knowing nothing about French law, is there anything Facebook-specific that led to this ruling? Is there a reason it wouldn't apply to other third-party tracking? For example Doubleclick and those kinds of networks track me across the web even if I've never signed up for an account with them or otherwise accepted their ToS.

Re:how about other third-party tracking?

[Opportunist]

Probably mostly that politicians can't see cookies as easily as they can see FB.

Re:how about other third-party tracking?

[ihtoit]

Monday's ruling is the result of an action concerning nonsubscriber tracking (AKA thid party cookies). Tuesday's concerns unfair contract terms (which is such a problem across all private industry, most European countries have had legislation in place for YEARS to deal with it) which "allow" Facebook to unilaterally delete content, co-opt content, change contract terms without notice... yes, Facebook's ToU for the European sector specifies that content posted by users belongs to Facebook (Section 2 paragraph 1).

Re:how about other third-party tracking?

[Anonymous Coward]

The problem is that Facebook holds personally identifiable information, which is a breach of the European Data Protection Directive.

In Europe you cannot as a company hold identifying personal data on an individual unless you have legitimate reason to do so, reasons include things such as:

- They have given their permission for you to have the data

- You're working under a law enforcement or similar exemption

- You're being contracted to process the data on behalf of a company that has been given permission (but you cannot do anything other than process it as contracted - i.e. you cannot sell it on or use it yourself)

So if someone has signed up to Facebook, they've given permission for it to hold personal information. But if they have never signed up, and say, someone tags them in a photo with their name, then Facebook is breaking the law (other people cannot give consent for a company to hold your personal information). The problem is that Facebook links all this together with tracking, and so builds a whole personal profile on people it has no legal basis to do so.

It's possible that other ad companies also infringe too, but whether they get this treatment depends on whether an explicit complaint has been made. Most companies however are really just identifying a computer or browser, and whilst some jurisdictions class this in itself as personal data not all do, if France doesn't then it's easy to see why simple cookie tracking doesn't fall under the same laws as tracking people and trying to associate it with clearly identifiable information such as pictures of people, who they know, and so forth. The problem for Facebook is that they're intent on collecting not merely anonymised identifying data, but non-anonymised identifying data. Most ad networks don't really care what your name is, just what you are likely to want to buy. Facebook wants your name, address, telephone number, list of friends and family, and pictures of every moment of your life.

The point of these data protection laws is that people should be able to have a choice to have no association with a company, to have a choice for companies not to hold data on them, and Facebook is clearly ignoring that choice - it's trying to gather data and build profiles on everyone, including people who don't want Facebook to have a profile on them.

Which isn't to say I'm defending the likes of Doubleclick and Google, frankly I hate all tracking and think that the anonymised data used by ad networks isn't and can't ever be anonymised enough such that it should be any more legal without consent. But as it stands this is an evolving area of law in most countries and there's non consistency on whether anonymised (no matter how poorly) data is personal data or not.

I also think it's worth bearing in mind that companies like Facebook are inevitably going to come under more scrutiny because of their tax situations. They use the argument for avoiding corporation tax that they're probably not technically breaking the law because the loopholes they use are in a grey area and aren't explicitly banned. Given that it's not really surprising that authorities decide that if they want to play that game that maybe it's time to examine where they technically are breaking the law and start to enforce it a bit more anally too.

Companies like Facebook can't really complain about having the law enforced against them when they like to make such a fuss about how they're not breaking the law when it comes to things like tax. They really can't have it both ways - expect the law to be treated explicitly when it suits them in exploiting a loophole, but not expect it to be treated explicitly arguing over-reach when they're actually in breach of it elsewhere. Either you have a view that the law should be treated explicitly as written in which case they really need to accept their guilt here and do the necessary, or you believe that the law can't ever cover every edge case and believe there should be some leeway allowing people to foll

Re:how about other third-party tracking?

[aliquis]

Why care about Facebook anyway?

* It clearly doesn't care about privacy.
* It have no consistent behavior for what it allows and not (report one post/group once and it likely remain, have lots of people do it and it's removed.)
* It don't provide much freedom and don't act as an enabling medium for expressing your opinion and hence does not help with the lack of freedom of speech in Europe.
* It's run by a migration activist who want to fight Europeans who want to have their people, culture, society and self-rule intact and protect themselves against foreign invasion.

Sure it has better coverage but it's only coverage of politically correct content so that's a negative.

I use Twitter because the freedom is much greater there.
I would had wanted complete freedom of speech and less government and full anonymity though.

Re:how about other third-party tracking?

[Anonymous Coward]

Arbitrary rulings from the EU and multiple EU countries against US internet companies have been cropping up for years.

Can you name an example?

The top EU court tried to ruin the internet recently by stating that, since the US spies on people, the legal agreement letting US internet companies to move user data to, you know, places other than Europe (gasp!) was invalid because they might give that data to the US to spy on people. This ruling threatened to cut off how the internet works and was perfectly reasonable...

The ruling merely stated that companies are not allowed to violate customers' rights by storing their data in a jurisdiction where their privacy cannot be guaranteed.

Well, nevermind that the UK does the same spying that is apparently illegal for the US to do, but gets no mention of punishment. Or that France and Germany do the exact same thing as well.

It is not a matter of punishing. It is a matter of uphulding the law.

throws protectionist legal trantrums some more

Protectionism in Europe is nowhere near as bad as it is in the U.S. Some are explicit (like the Buy American Act, the Jones Act and lots of tariffs); others are more implicit, like having standards and units differing from the rest of the world in arbitrary ways to set entrance barriers.

Re:how about other third-party tracking?

[silentcoder]

Of course, America only accepts that one way.
One of the biggest news stories here in South Africa over the past few months was the strong possibility that AGOA would not be renewed. AGOA is a law Obama signed to help African economies grow by giving them tax-free imports into the US. A good idea in principle - but, as always, good ideas get corrupted when US corporations get involved. AGOA is now *also* used to blackmail African countries to change laws that have nothing to do with competitiveness for American exporters. In South Africa's case, the threat is that AGOA would not be renewed unless we agree to no longer require sanitary standards for chicken. Our own chicken farmers have been living with these standards for years and sell chicken quite competitively but US chicken is notoriously low quality and notoriously high risk for disease spreading - risks that are amplified by exporting, and they come nowhere near the (common sense) standards we've had for decades to prevent outbreaks of diseases like Salmonella.

So US sourced chicken has been very rare in our stores since so few US chicken exporters complied with the regulations. This safety law will probably be lost, to secure US companies the ability to export here - because we cannot afford to lose the cheap export markets to the US (that's a pretty significant percentage of our GDP).
Despite most South Africans pragmatically accepting the laxer standards as something we simply have to do - nobody is happy about it, South Africans right now feel extremely bullied by America and feel that our public health is being traded for American profits.

The grand irony: laws or no laws, we have a thriving industrial scale chicken farming industry (which is a nett exporter) - there is almost no way that American companies could compete anyway since local farmers don't have expensive international shipping to pay for. Only a few truly massive factory-farm companies may even bother to enter the market, where they won't sell well because of being more expensive- so American companies are deluded if they think they will actually GET profit from this - but local chicken will also go down in quality if the standards are relaxed.
It's a nett harm for South African consumers - of a meat product that is dietary stable (and often the only proteine source) for the most poor and vulnerable people in our country. And the people who demanded it, will make only a tiny bit of money from it. The only thing that pisses somebody off more than being killed so a billionaire can make another billion - is being killed so a billionaire can make another penny.

You have to start somewhere

[Anonymous Coward]

We all know that there are many, many trackers on the web; many of them are not visible to end users *at all*. But you have to start somewhere. Besides, Facebook has way more data than any of them because not only can they assign a unique ID to you and make inferences based on your browsing habits, they know exactly who you are, your name, who your friends and enemies are, your politics, sexual preferences... basically everything. Even if you don't have an account they've got this data because your friends tag you in photos.

Furthermore, Facebook gives you privacy settings, but how they behave are less than obvious... your pictures can be found by anybody with the link, for example. Facebook reserves the right to change your privacy settings without notifying you first. This is clearly illegal in Europe: just because there is a EULA does not mean that visitors waive their rights under European law.

Most importantly, to me anyway, is that in Europe you can request that firms delete data that they have on you. Facebook does not do this. They simply flag an account as "deleted", but they keep it. Try it yourself if you dare: delete your account, wait a couple of weeks, and create a new one. Without doing anything, all of your old "friends" will pop up in the friend suggestions... because they already know who they are.

I had a FB profile for a couple of weeks in 2008 or so, and "deleted" it. I regret that deeply because I have no way of actually deleting it and I know that FB is quietly and automatically collating everything it can on me. I'm Belgian, so at least they can't set their tracking cookie any more, but the issue is still not redressed. I really am grateful to France for fighting the good fight on this one.

Re:You have to start somewhere

[drinkypoo]

Try it yourself if you dare: delete your account, wait a couple of weeks, and create a new one. Without doing anything, all of your old "friends" will pop up in the friend suggestions... because they already know who they are.

You know, while you're correct about what they're doing, this doesn't prove anything at all. All they have to do is keep a record of your email address as a past friend on everyone else's accounts. Then they could completely scrub your account, and this would still happen.

Re:You have to start somewhere

[Applehu Akbar]

How about we start with "Fuck off France"?

It's really interesting, the levels to which Europe is currently trying to impose their laws on the rest of the world. Who do they think they are, imposing their laws on everyone, the U.S. or something?

European police agencies are in an arms race with the US in global law enforcement. It's regrettable that Thailand has underage prostitutes, but that is Thailand's problem. Where in the Constitution does it say that this justifies having the FBI police Asian countries?

Re:You have to start somewhere

[moronoxyd]

"impose their laws on the rest of the world"?

Facebook is providing services to the French people. So they have to abide by French law.

If you want to talk about countries pushing their laws on others just have a look at the DMCA. This is a US law, yet it seems to be in effect everywhere around the world.