Meta, YouTube face criminal spying complaints in Ireland

Facebook-owner Meta and Google's YouTube now face criminal complaints in Ireland for alleged unlawful surveillance of EU citizens via tracking scripts. Privacy consultant Alexander Hanff, who has occasionally contributed to The Register, has challenged Meta's collection of data without explicit consent under Ireland's computer …

[anonymous boring coward]

WTG!

[Anonymous Coward]

Blocking unwanted connections with a hosts file

Blocking unwanted connections with a hosts file

The Register: 4 known trackers were identified. Companies.

[hayzoos]

Re: Blocking unwanted connections with a hosts file

I thought modern browsers implement their own DNS client which may ignore the hosts file. Same goes for Certificate stores. Why reinvent the wheel? Follow the money.

[I could be a dog really]

Re: Blocking unwanted connections with a hosts file

Well at the moment it's still an "optional" feature. It's not a browser based DNS client, but the browser using DNSoverHTTP[S] (or DoH) where it stuffs the DNS request into an HTTP packet and sends ot to the configured DoH server. This does bypass the ISP who is unable to interfere with or snoop on DNS exchanges, but it hands one organisation (typically Google by default) a "useful" haul of DNS query information from your browser.

[SVD_NL]

Re: Blocking unwanted connections with a hosts file

Google Chrome is terrible with this, as is android.

It will overwrite any system settings for DNS if you don't turn off private DNS, even if the DNS you have in your system settings supports DoH, you need to explicitly specify it using FQDN in your private DNS settings.

[Anonymous Coward]

Re: Blocking unwanted connections with a hosts file

Yes. And DoH on Chrome also circumvents any DNS filtering that you might put in place to try and stop your kids from doing things they shouldn't do on the internet. And there's no way to block DoH without blocking a whole swathe of google and cloudflare IPs, which then means they can't log into their school account to do their homework.

[SVD_NL]

Re: Blocking unwanted connections with a hosts file

Yup, the only way would be using group policies to disable private DNS, or im assuming some paid "Google for families" subscription that "keeps your family safe*"

*no guarantees your families' data is kept safe

[DS999]

Re: Blocking unwanted connections with a hosts file

If people taking such measures to block tracking ever became common they could easily sidestep it. As an example, you'd change references on theregister.com's web site from something like "trackingpixel.facebook.com/pixel.jpg" (or whatever it is currently) to "theregister.com/facebook/trackingpixel.jpg" - or more likely "theregister.com/xyy451v/4519.jpg" because why give people an easy text search for blocking?

No chance to implement it via DNS since it would be in the website's domain, and even an add-on couldn't do it since that "xyy451v/4519.jpg" would be essentially random on each website and could be changed at a whim if anyone was bloody minded enough to try to list them all to allowing blocking one by one for popular sites.

The only reason they haven't done this is because so too few people are bothering to block things as they stand. It is like adblocking, until it became popular websites didn't start to take precautions against it by making their sites refuse to load if an adblocker was enabled. Tracker blocker will never be remotely as popular because it is silent, whereas ads are in your face so you can easily see the difference from installing an ad blocker.

[I could be a dog really]

Re: Blocking unwanted connections with a hosts file

This is indeed a known tactic since so many people now block third party cookies etc. by defualt.

And, as you might expect, the providers of defensive tools haven't been sat back twiddling their thumbs - and AIUI there are options now for blocking such stuff. The difficulty is that some sites (not that many, but some of them will be important to the users) use similar hierarchies for legitimate reasons - hence needing a certain amount of whitelisting.

[vtcodger]

Regulators

"Regulators have let us down ...

Claims that there are regulators who somehow control the behavior of the fine christian, capitalist IT pioneers who have brought us the modern internet are known to be specious. Yes, there have been reports of internet regulator sightings ever since DARPA net days. But upon investigation these invariably turn out to be honest mistakes (e.g. malfunctioning pop-over ads) when they are not out and out scams. It is long past time to move regulators from the endangered list to the extinct list.

[Dinanziame]

I'm unconvinced that this has any chance. Criminal complaints have a much higher bar to pass to be confirmed by courts. This feels like a publicity stunt.

I think a determinant point for YouTube will be whether the script which detects the adblocker does in fact send the information back to the server. If yes, then there can be a claim of spying — it's getting information about the user, which is the domain of GDPR. If the code just prevents the videos from playing without sending anything back, then it's just code which controls how the page is displayed, part of the page requested by the user, executed by the browser controlled by the user. You might as well sue about the bandwidth costs caused by ads that you didn't request.

[Jellied Eel]

I'm unconvinced that this has any chance. Criminal complaints have a much higher bar to pass to be confirmed by courts. This feels like a publicity stunt.

I really hope it does because data rapists have already decided they're free to dig deep into our personal and private data for no good reason. Even if it just raises awareness, that can be a good thing because politicians generally like to jump on populist bandwagons and sometimes get legislation passed, or amended. Downside is the data rapists have very deep pockets, and hire a lot of slightly used politicians like Nick Clegg to lobby against any changes.

[Someone Else]

...slightly used politicians...

I doubt there are any such things. Most politicians range from "heavily used" to "ridden hard and put up wet" to "broken down ol' hags."

_{But love the phrase!}

[I could be a dog really]

... will be whether the script which detects the adblocker does in fact send the information back to the server ...

For the specific law the complaint cites, that is irrelevant. He is not challenging a breach of GDPR (as pointed out, the regulators have demonstrated their inability - or outright unwillingness - to deal with that), but a breach of a law that says "you may not do something on someone's computer unless they give you permission".

In the first case, he's set the DNT (Do Not Track) flag, yet the sites are still running tracking scripts on the computer. Regardless of what they might do with the results, the script is running when the user has not just "not given permission" but actively refused permission (by setting DNT). That is a criminal offence.

Icon for for how I'd like to thank Alexander for his efforts over the years. It might be interesting if you are unfamiliar with his history to go and look up what else he's been calling out in the past (hint, lookup Phorm).

[Groo The Wanderer]

I doubt they're spying. Americans are people who follow the rule of law. The golden rule: he who has the gold makes the rules. :(

[Anonymous Coward]

Try China or Russia

At least you can challenge the rules in the US.

[Elongated Muskrat]

Re: Try China or Russia

For specific values of "you" where "you" is a member of the set of extremely rich people with political influence.

[Anonymous Coward]

Re: Try China or Russia

Ever heard of the Supreme Court? Of Roe v. Wade for instance? Any citizen can go to the Supreme Court. Pray, name the equivalent in Russia and China. LOL.

[Elongated Muskrat]

Re: Try China or Russia

Yeah, I think Russia and China do have courts stuffed full of political appointees, no praying required, and your example (of Roe vs Wade) demonstrates how that has become the state of affairs in the US as well. Let's not forget that Obama was prevented from appointing replacement judges because he was about to leave office, but Trump did exactly that, with some extreme right-wing religious nuts. Who then went and overturned RvW...

In any case, I found employing the services of google to be more effective than praying in the ascertainment of information:

The Supreme Court of Russia

The Chinese Supreme People's Court

[Elongated Muskrat]

Re: Try China or Russia

...meanwhile, democratic countries have a separation between the legislature and the judiciary, judges are not appointed by politicians, or via a political process, but get the job instead through experience, seniority and hard work. Somehow, in those countries, the judiciary applies the law as written (or as set in precedent by case law) without having to make decisions based on political, or religious ideology.

I wish I could say that my country is one of those, but our government is possibly even more corrupt than yours.

[Anonymous Coward]

Re: Try China or Russia

>>> judges are not appointed by politicians, or via a political process

Ludicrous. Figment of your imagination.

1/ There has to be some kind of process

2/ It's necessarily political, because this is how the people is represented (unless each judge is elected through direct universal suffrage, which no country does).

The way independence is strengthened is that politicians cannot revoke judges.

[Elongated Muskrat]

Re: Try China or Russia

Yes, ludicrous that politicians should appoint judges, especially the head of state.

In the UK, this is the process for appointment of senior judges:

https://www.supremecourt.uk/about/appointments-of-justices.html

The selection commission must have at least five members. Where a selection commission is convened for the appointment of a Justice other than the President of the UKSC, it must consist of:

the President of the UKSC, who will be the chair of the selection commission;

a senior UK judge (who is not a UKSC Justice) nominated by the President of the UKSC;

a member of the Judicial Appointments Commission;

a member of the Judicial Appointments Board for Scotland; and

a member of the Northern Ireland Judicial Appointments Commission.

Note how these do not include any politicians, does not include the Crown, the Prime Minister, the Home Secretary (the minister in charge of the Ministry of Justice), or any other publicly elected official. It is done by members of the judiciary, who have proven themselves to be impartial.

Most countries, rightly, see the system in the US, of elected or politically appointed judiciary, as corrupt and unworkable. Electing senior police (such as sheriffs) is also pretty brain-dead, as it leads to populist appointees, and although we have elected police and crime commissioners in the UK, they have no role in operational policing (and arguably are pretty useless).

Asserting that your way is the correct way, and that other systems don't exist, or are "ludicrous" only exposes your own ignorance, and inability to use your search engine of choice.

[Colin Bull 1]

Kickstarter option

If he had a Kickstarter option, I would put a few quid into it.

[AlexanderHanff]

Re: Kickstarter option

There is very little cost associated with the complaint currently, just the time it takes me to file the complaint and travel to Dublin to give the statement and if the case is prosecuted it will prosecuted by the State not by me, so there will be little to no cost involved there either. If the State prosecutor refuses to take up the case, then I would need to apply for a private prosecution at which point it becomes very expensive. - so we will have to see. But at this time there is no need for me to seek any funding.

[Sora2566]

I wish this guy the best of luck, but I don't think they've got a real chance... :(

[0laf]

Alex Hanff is rather tenacious. Not only will he give those corporations a hard time he'll likely clobber the courts as well.

[jonnycando]

I’m hoping for the gent’s success!

[notyetanotherid]

Offence

I know that El Reg has gone all leftpondian, but surely when directly quoting Irish law, it should have left the word "offence" alone, rather than converting it to American?

[Hunts Joe]

Youtube are idiots.

If they were reasonable about ads people wouldn't be so eager to block them, but there's no way I'm sitting through a 150 second advert to watch a video that may, or may not be what I expect.

[Michael Wojcik]

I don't block YouTube advertisements, and I've never seen one that lasts for anything close to 150 seconds. If I did encounter one, and it was unskippable, I'd just do what every single television viewer did for decades: ignore it, and probably get up to do something else for a couple of minutes. Somehow most of us lived through that experience, bleak and heart-rending though it was.

[captain veg]

At least with television advertising there is some sense of what it is paying for. With Youtube, not so much.

-A.

[Fred Daggy]

Used to be true

TV ads used to be just background filler. NOW THEY ARE 15, NO 20, NO 100 TIMES LOUDER THAN WHAT WAS PLAYING ON THE IDIOT BOX BEFORE.

Which is why I watch TV about twice a year. And Doctor Who.

[Filippo]

It is correct that most of us easily tolerated ads on television, and that we can tolerate ads on YT.

It is also correct that most YT videos are just not that interesting or useful, and opting to not view them without an ad blocker is a very reasonable response.

There is nothing dramatic going on here; everyone is sane whether they watch YT or not, with ad-blocking or not. It's a battle of "meh"s.

Except for the YT execs, who make their money from watching carefully all shifts of that subtle balance. If they thought that they could block ad-blockers without losing viewers, they may be in for a surprise.

And then there's tracking. That is not reasonable, not sane, largely not legal, and ought to be killed with fire.

[martinusher]

Making the Internet unusuable

I was in Europe recently and I found the Internet unusable -- the privacy Spam that websites now bother you asking whether you accept tracking or not (and allow you to control what cookies are places on your machine) is both irritating and a scam. They're irritating because you can't view the site without dealing with this hurdle and a scam because any user input can be used against you, to track you, to learn about you and generally add things to your computer. So I just immediately navigate away from that page -- I just close the page when I see one of those popups.

youTube's recent adblocker policies are 'amusing'. Starting a week ago I got hit with the "You're using an ad-blocker so can't view xxxxxx" on youTube. Too bad the only system that displays this is a generic Chromebook running Chrome with no extensions. This says a lot about their code -- the use of second and third order effects to spy on you, the lack of testing, all the hallmarks of clever people who haven't got a clue what they're doing, just all bright ideas and no programming discipline. If this is indicative of the likely response to EU directives -- we'll, its not surprise that sites are becoming unusable.

[Filippo]

Re: Making the Internet unusuable

The reason websites get so annoying is that they are doing their best to creep around the law, when they are not just breaking it and trying to convince you they aren't. That kind of action is always complex.

They could get rid of all of those banners and whatnot simply by not tracking you except through your user login.

[Elongated Muskrat]

Re: Making the Internet unusuable

It's the owners of those web sites that are making them unusable. I could put up a web site, today, with static content, and even adverts on it, without the need to run any scripts or set any cookies, or session tokens, at all. I wouldn't need to store any kind of state, unless there was something on that site which requires a user to log in, in which case, I think the session cookie, or token, or whatever I would be using to do so, would almost certainly be exempt from requiring assent from the user, as long as it is only used to assure continuity and security of that session.

Also, all those pop-overs nagging the user to set their "preferences" are completely unnecessary, if the site assumes no consent, and then provides a button for the user to click and explicitly consent to the tracking scripts. I can count the number of users who would actually want them, and choose to do so, on the fingers of one foot.

So, the conclusion is, of course, that the internet is unusable due to dodgy web sites, and dodgy advertisers, not because of EU law, and that EU law is an attempt to rein that in. If the US ever gets some sanity and follows suit, the business models of large internet companies (which have got very rich off the back of exploiting users) would have to change, at least outside of other countries with dodgy attitudes towards privacy, such as China, Russia, Iran and North Korea.

[gratou]

Weird that DNT is mentioned when no consent should be enough regardless of DNT.

[AlexanderHanff]

Not quite right

For civil law (ePrivacy Directive/GDPR) no consent is enough, for criminal law you have to have actually told them, "No Entry", DNT is my "No Entry" sign and they can't say they didn't know about it because they were in the working group at W3C where it was developed.

[Anonymous Coward]

If YouTube hates its customers so much

Just come out and tell us.

Why the slow-burn with all the ads for fake crap?

[Herring`]

Re: If YouTube hates its customers so much

It is classic enshitification

[fred_flinstone]

On the one hand this action needs supporting and pressure applied to the regulators to get on with the appriproate prosecutions/whatever.

On the other hand, while it is true the tracking leads to bigger profits and reduced privacy I suspect we would see a significant bump in software and hardware costs with tracking disabled (anyone remember when you had to actually pay for new versions of Windows...)

And on a related note, what about the tracking and advertising built into many new TV's?

[Elongated Muskrat]

I think the "having to pay for new versions of Windows" is a bit of a red herring though, because, firstly, AFAIK Microsoft still DO charge for new versions of Windows, and if they decided not to (which they may), it's because they are doing their level best to move everyone to a "subscription model" for software that runs on that platform (the most egregious example being Office 365).

Even bothering to search for it would have given you the enlightening answers here as to what Microsoft's main revenue streams are. In the second quarter of FY23:

Server Products and Cloud Services:$19.59B (+19.61%)

Office Products and Cloud Services: $11.84B (+5.21%)

Windows: $4.81B (-27.09%)

Gaming: $4.76B (-12.57%)

LinkedIn: $3.88B (+9.77%)

... plus a few more below $3.5B ...

As you can see, their Azure business is worth more than four times as much to them as Windows, and, arguably, has a much higher tie-in, once they are hosting your stuff it's harder to move than, for example, switching to Linux on your home PC.

[Elongated Muskrat]

...I'll just add, that one of those "others" is "Search and News Advertising," which may include some dodgy tracking, but more likely is just "relevant" ads related to search results, which, whilst annoying, isn't nearly as much of a big problem, and falls within the bounds of "acceptable" advertising.

[Sil]

Kudos

Kudos to Alexander Hanff

Without people like him and Max Schrems, corporations would continue their illegal surveillance 24/7.