Thread · 20 tweets · 23 Sept 2018

This is a good question: what is the root cause of the lack of privacy online today? Why does media track so much? My personal take is that it boils down to browsers and mobile platforms. Not only is that the master fix, but it is within reach. Follow the thread❗👇

First, I have some assumptions that I want to ensure you know: 1) Without a free and well-funded press before long we'd have no privacy at all. This does NOT justify an exception regime for media, but it constrains the solution. Getting rid of media is not the right option.

2) I do not buy into strict deontologism. It's not enough to make a rule, we need to make it work. If you force people into a choice between the law and survival, don't be surprised that they at least bend the rules. If you incentivise defection, expect defectors.

3) The #GDPR is the biggest step forward for human rights in a while. But it's still new and still fragile. We need to work to make it work. If we don't, someone will use the problems to take it away.

Now, how did we get to such a dire place? The press has been sustained by advertising since the 19th century. Over time, practices developed to give that decent governance (at least in reputable organisations) and it all kind of worked.

I strongly recommend @superwuster's "The Attention Merchants" if you want to understand advertising (and you should if you want to understand privacy today). I have zero worries for the ad industry. They'll be eating the roaches after the nuclear winter.

Around twenty years ago advertising changed. It stopped being about content and started being about "audiences" as they say. By which you should understand that it's about using your personal data to place you into segments.

These segments are invasive. They call them anonymous because the only thing they don't know about you is your name. It's like being naked on stage reading your 15-year-old diary to a crowd of strangers you can't see. But hey they don't have your name so that's okay, right?

Where does that data come from? It's easy: your browser doesn't work for you, it works for them. Whenever you visit a site, it happily tells anyone who wants to know who you are by sharing third-party cookies. Like a car that says who you are to every billboard.

If you know the first thing about Web technology, at this point you're thinking: "Hang on there Robin. That doesn't just happen. The site _also_ has to cooperate." And you're right, it does. The question you want to ask is: why does it?

To simplify, you can count two types of advertising. In programmatic (a form of automated marketplace) buyers bid on impressions. Prices are driven by personal data. A bid going out with an unrecognised user is probably with 90-95% less. Yes, that much.

In direct, ads are sold directly from the media to the buyer; but buyers want to recognise people who see their ads. With no cookies, you might not get the deal at all (or at a much lower price), and that might include no paper either.

If *everyone* agreed to stop doing that, advertisers would be forced to find a new model, and privacy would win. The #GDPR helps a lot there, but not enough. There are still too many incentives for dark UX patterns and other issues.

If a whole lot more people subscribed to newspapers, that would also solve the problem. But while it's getting better, it's not getting better fast enough. So the options are: a) Die. b) Enable tracking. c) Fix the problem upstream. Shocker: I'm all for (c).

If the problem isn't solved at the source, don't be surprised to find problems downstream of it. @quinnnorton says is better:

One step upstream is the ad industry. Hey, if you look hard enough you can find some ethical folks. But let's be honest, that's not the right place to look. Brave's complaint will hopefully help, but they need to be pushed into a whole other model. brave.com/adtech-data-br…

Another step upstream we find browsers (and mobile platforms — I'll analyse the former but it applies to the latter). A few questions are worth asking: • Are they sharing cookies on request from the user? No, the user has for the most part no clue and didn't ask.

• Are they required by the technical standards of the Web or the Internet to share cookies? No, the cookie RFCs are clear that it's optional and a browser decision. • Are they required to share so that things work? No, several browsers have stopped doing that and they work.

The conclusion is that browsers (Chrome & Edge primarily) are independently making decisions to share personal data for no defensible reason, simply out of pure self-interest. They are data controllers. They have no #GDPR legal basis. They also break Article 25.

Too many privacy advocates give browsers a pass when it comes to privacy, when in fact it is the choke point. That's what creates the data market. On purpose. Shut that down and there is no data market. Fix browsers; save the world. Yes, it really is that easy. 🔚