Meta faces lawsuit to stop 'surveillance advertising'

A lawsuit filed in the High Court of England and Wales has demanded that Meta's Facebook social media platform stops harvesting personal data for the purposes of advertising and marketing. The suit was filed by tech and human rights activist Tanya O'Carroll, who said this amounts to "surveillance advertising" with her legal …

[alain williams]

What about those who do not use facebook at all ?

Who go to some random web page that has a facebook image + javascript. Facebook has no agreement from people like me to collect or process my personal information.

I do block Javascript from facebook but that does not 100% stop them and most do not know (or care enough) to do so.

Facebook are not the only ones guilty of this.

[devin3782]

Re: What about those who do not use facebook at all ?

If you use firefox then I recommend the facebook container plugin, which prevents anything facebook from working on any domain other than facebook.com.

You'd be amazed how often the container icon appears on checkout forms of ecommerce sites so I'll wager facebook have screen scraped and taken your credit card details if you're not using it.

But also again as usual pi-hole, ublock origin and ghostery are your friends.

[DS999]

Re: What about those who do not use facebook at all ?

What happens if Facebook starts using a different domain like fb.com or metabook.com or something? I guess your plugin's author could play whack a mole and stamp those out as they are found, but Facebook can register them faster than the plugin can be updated.

If Facebook leveraged resources on a domain that's indispensible like Cloudflare you couldn't block it, or a lot of the internet would stop working for you. Why would Cloudflare sell out like that? Money, of course. Please note I'm not saying Cloudflare is doing this, just that Facebook could decide to do something like that if they wanted to reach even people like you determined to escape their grasp.

Your ability to hide from them is based mainly on the fact there aren't very many people going to such lengths, so Facebook probably doesn't think you're worth the effort.

[James Anderson]

Re: What about those who do not use facebook at all ?

Read the post.

The software blocks everything BUT Facebook.com.

[Anonymous Coward]

Re: What about those who do not use facebook at all ?

> Read the post.

The post says:

> I recommend the facebook container plugin, which prevents anything facebook from working on any domain other than facebook.com.

The point that the reply is making is that, it's effectively impossible to know what "anything facebook" includes, because Facebook can quietly register new domains, use new IP addresses, or piggy-back on other companies' domains and IP addresses by using third-party services to serve up their tracking functionality.

A Firefox plugin cannot be updated faster than a multi-billion dollar corporation can register domain names.

[Killfalcon]

Re: What about those who do not use facebook at all ?

It's an interesting hypothetical, but I've been using NoScript for years, and they haven't been doing that.

I assume there's a technical reason why, but most of the time web scripts don't spin up random domains (and almost never work by IP address). They might use a CDN or two, but even thought they could do so easily, it's rare to find a major player putting their code anywhere novel.

I think we can worry about that when it starts happening.

[M.V. Lipvig]

I hope she wins. But, unless the payout has a B instead of an M, and unless they are forced to pay out, expect no changes.

Once a payout appeal is denied the first time, the courts really do need to send an arrest warrant for a company CEO out 30 days after the appeal is denied, if the fine isn't paid or at least arranged for, and if arranged for, within 90 days.

[Rich 2]

Money

Personally I’d be happy for faecesbook et-al to not be fined at all. I just want them to be stopped from doing what they are doing

You can’t measure everything in monetary terms. Unfortunately, governments and courts don’t seem to get this

If they must be fined then fine then into the ground so they can never get up again

[Anonymous Coward]

Re: Money

Penalties should include a trading halt as an option instead of fines.

Your business is shut down for N days, and totally offline.

Aside from the companies themselves, their customers would suddenly be chary of being dependent on scofflaw companies.

[SW10]

They’ll be breaking the law

unless they are forced to pay out, expect no changes

Not quite. For the moment they’re claiming it’s all legit - and there’s nothing to prove them wrong. Might be illegal. Might not. ¯\_(ツ)_/¯

Once a court finds against them, it’s neither here nor there if the fine is £1 or £1B, they’ll be demonstrably breaking the law if they continue

[Falmari]

Re: They’ll be breaking the law

@SW10 "Once a court finds against them, it’s neither here nor there if the fine is £1 or £1B, they’ll be demonstrably breaking the law if they continue"

Well you know it I know it everyone here knows it, hell even FaceBook know they are breaking the law. But is this not a civil case, so if the court find against Meta any money that Meta have to pay is an award to the claimant not a fine. So they will not have been found guilty of breaking the law.

But it should be bloody obvious to which ever part of our so called justice system is responsible for enforcing Data Protection Act, that FaceBook have been breaking the law. Slap a bloody huge fine on them, if they continue to break the law fine them again and again until they stop breaking the DPA. But will that happen probably not.

Then again to the likes of FaceBook a fine is just the cost of doing business. Rather than fine FaceBook for breaking the law we should be prosecuting the person responsible, who decided to break the law starting with that Zucker at the top. The punishment should not be fines but jail time. Then maybe they will think twice about breaking the law.

[Killfalcon]

Re: They’ll be breaking the law

"Nothing changes until a rich man goes to jail", as they say.

[Evil Scot]

Re: They’ll be breaking the law

And if found guilty they could face 27 x $250,000,000. $6.7bn.

[Andy Landy]

Why stop at Meta?

They're all at it...

[Jedit]

Re: Why stop at Meta?

Nobody is saying Meta is where you stop, but in order to set a legal precedent you have to start somewhere. If Meta lose this, all the others who are "at it" will have to change tack or fall foul of the same rule.

[captain veg]

UK GDPR

"At the core of O'Carroll's complaint are allegations that Meta is breaking data protection law – the UK GDPR"

The UK GDPR. Err, what's that?

The current UK government is pursuing legislation to terminate anything that came from the EU* from the statute book, whatever the consequence. That includes GDPR.

-A.

* Rather a lot of supposedly EU-sourced legislation was actually just giving effect to directives from higher authorities, such as UNECE. Welcome to globalisaton.

[localzuk]

Seems clear cut

UK GDPR (and GDPR itself) is clear on this one - your data should only be processed if you opt into it, and you can't have service refused if you say no. So, I'm not sure Facebook has much of a leg to stand on here.

[Anonymous Coward]

Re: Seems clear cut

> UK GDPR (and GDPR itself) is clear on this one - your data should only be processed if you opt into it

Wrong! Your data must be processed via one, or more, valid lawful bases/conditions. Opt-ins only apply when Consent is being used as (one of) the lawful basis.

Article 6(1)(a) "Consent" is one of those defined lawful bases, however it is not the only one and Consent does not necessarily have to be used as a lawful basis.

Many companies will claim they use Article 6(1)(f) "Legitimate Interest" instead. As to whether their claim of legitimate interest is actually valid or not is another matter.

I don't know why people still claim that EU/UK GDPR requires consent to be used. A brief read of the ICO's website or many other guides to GDPR would be enough to set people straight regarding this.

[Anonymous Coward]

Re: Seems clear cut

Quite, and there is rather more to it too.

For starters there is the definition of data that can be stored at all and "Personally Identifiable Information" is a term writ large and loud.

Opt in vs opt out is a bit rubbish for privacy vs the full GDPR which looks into the issues in depth and really gets to grips with it. That's why it is established law for a collection of countries that normally kick seven shades of shit out of each other yet managed to agree on and enact.

"opt in" is something you might see as a clause in the notes pertaining to some legislation related to privacy and data.

[Anonymous Coward]

Re: Seems clear cut

> For starters there is the definition of data that can be stored at all and "Personally Identifiable Information" is a term writ large and loud. <

The GDPR does not mention "Personally Identifiable Information", it mentions "personal data".

"Personally Identifiable Information" (PII) tends to be a USA term which has a more restrictive definition than "personal data", i.e. "personal data" can include the likes of IP addresses whereas PII does not include that.

[localzuk]

Re: Seems clear cut

Please read my comment in the context in which it was posted - data being used to profile and advertise to people. You would be very hard pressed to use any other legal basis for processing data in this way, other than consent.

Especially when you take PECR into account as well.

A brief read of the ICO site will tell you that this would require consent to be used as the basis.

[Johnb89]

Turnabout would be fair play

I've said it before: express to anyone you know that works at Facebook (or google) that you have a legitimate interest in what they do in their bedroom, so will be putting a camera there.

Particularly if they are a VP or higher, or Director etc. If they think its ok to watch us, then its ok for us to watch them. Shall we organise to follow them home? Sit awkwardly close to them at the pub and listen?

Why do they think that's not ok?