November 2018

219 tweets

Replying to @seanmcarroll

You can't drop it but you can extend it to include its own checks and balances. Give it a metric such that moderate but pragmatic rates as more radical than extreme but unfeasible, for instance.
This is hilarious. Sad, too. But also hilarious. adage.com/article/digita…
I... I think we're going to need to call in Picard before we run out of facepalms. 🤦‍♂️
Quoting a tweet by @kateconger ↗

Replying to @null and @marcosc

Is something up with GitHub? I got subscribed to 188 earlier today 😭

Replying to @gsnedders and @marcosc

Yeah but it's an org I've been in for a year...

Replying to @null and @marcosc

You know things are fucked up when my first thought was "I have no clue what happened, but at least it wasn't all 2200 of them!" 😏

Replying to @TheAnnaGat and @nickarner, @ChadGrills, @nabeelqu, @sarthakgh, @PeterIsztin, @szferi, @MortenHoiJensen, @d_f_stone, @donf126, @erikphoel, @zck, @kenjfuj

Thank you, you’re too kind 🤗 Lovely to meet you all!
I think that's basically my job 😏
Quoting a tweet by @amatwyshyn ↗
Well-meaning as it is, this is why climate is losing. This responds to a lie by engaging on obscure details can never work - check the science! You better believe we have a very big political agend: we're here to c save the fucking planet.
Quoting a tweet by @sciam ↗
If you're at the NYC marathon, come support the Kids Anti Pollution Society (and get cookies) near Cumberland St!
The primary purpose of Chrome is to enable surveillance (via @jason_kint). eff.org/deeplinks/2018…
↺ 14
Terrifying and exciting: @Choire is kickstarting an advice column about “careers, money and the sometimes grim, sometimes hilarious Dungeons & Dragons-type maze that is the contemporary office.” I know I’ll read. nytimes.com/2018/11/05/bus…

Replying to @benwerd

Error at Gandalf.js line 1: BalrogException.
The relevance of this thread (with many amusing nuggets from Keynes) might prove quite interesting if you have ever argued on the Internet. Might.
Quoting a tweet by @ergo_praxis ↗
↺ 1
It's okay folks: when all the bees are dead we can use crabs as pollinators. Right? 🐝 ➡ 🦀
Quoting a tweet by @MaydaNathan ↗

Replying to @MaxGendler

To a point yes, though I can’t quite do the same «you _really_ believe that?!» face over Twitter. So maybe things are in fact getting better.

Replying to @MaxGendler

Replying to @danbri and @slightlylate

In fairness, baking in is horrendously hard and the odds of it addressing enough use cases for apps to forgo JS are tiny. Not to say we should never add elements, but the bar is high.

Replying to @slightlylate and @danbri

Actually, the article/main distinction is fine IMHO. I was more thinking of MathML (justified, but maybe not in this form) or XForms (lots of genuine use cases — forms still really suck — but not cowpathed).

Replying to @null and @amyvdh, @MaxGendler

You always win at gifs Amy, some day I hope you will teach me.

Replying to @preetster and @slightlylate, @danbri

This is awesome. My general concern here (as a former scientific publishing guy) is with binding a WC-backed language with some degree of shared semantics. It’s not technically hard, but there are a few wrong ways to do it.

Replying to @danbri and @preetster, @slightlylate, @max_froumentin

Oh, consuming this specific instance would not be an issue; the problem is more if there are three WC implementations of MathMLish how do you build something that can make sense of it without it sucking out the resources of a small company.

Replying to @DevilleSy and @temptoetiam

Another case of “publish or famish.”

Replying to @null and @prushforth

Enhancing can be good but you can easily end up screwing up the original semantics, too.

Replying to @null and @prushforth, @briankardell

The semantics of <img> are pretty limited so I wouldn’t worry too much about that case; it gets knottier when accessibility kicks in, the case of using links as buttons and vice versa comes to mind here.

Replying to @nickconfessore

It's great to read @MelMitchell1 in @nytopinion about how far AI is from general intelligence and the enduring mystery of people overhyping how close we are to it.
Quoting a tweet by @MelMitchell1 ↗
Right on queue…
Quoting a tweet by @nytimes ↗
Don’t take this the wrong way American friends, but for fuck’s sake do you really suck at running elections.
↺ 1

Replying to @mcnees

Hang in there.

Replying to @tabatkins

That does not make it suck less :)
If you weren’t anxious enough… IT’S NEEDLE TIME! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! NEE-DLE! Dems House 95+%: nytimes.com/interactive/20… Voldemort Senate 95+%: nytimes.com/interactive/20…
No matter what happens enough, fascism isn’t losing enough.

Replying to @TheAnnaGat

I’m not sure that centrist vs fascists actually counts as bipartisan.

Replying to @TheAnnaGat

Just doin’ my job m’am.
Just a reminder that whenever politics feels too divisive you can console yourself that at least it's not philosophy.
Quoting a tweet by @danielwharris ↗

Replying to @MikeIsaac

So if someone lived in a high-density dog area would leaving lots of pieces of cheddar on the streets annoy dog people? Just asking, uh, for science.

Replying to @taravancil

If you print a series, I’ll take one! (And whoa, so many losers commenting here. Please ignore those sad attention-craving morons.)
It would send a strong signal to just blanket stop covering the WH.
Quoting a tweet by @mcnees ↗

Replying to @TheAnnaGat

It's a competitive advantage, you learn better with it.
Part of the problem though is that in science people author in formats so archaic that you actually need a typesetter to clean up. Yes, that’s going to introduce mistakes, especially if you’d like publishing costs not to grow more insane than they already are.
Quoting a tweet by @masonporter ↗
Part of what’s interesting in this article is the amount of vote suppression that is structural to Texas too. Once more that is the key.
Quoting a tweet by @Noahpinion ↗

Replying to @mcnees

I love it. I have this idea too of podcasts but logged as text instead of just someone talking. I was thinking of calling them "pod logs", or "plogs" for short. The name feels a bit off somehow but maybe I can fix that after the kickstarter.

Replying to @lhirlimann

Yes. The syntax is Turing-complete (that’s always a mistake, it makes a lot of processing painful), it has too little separation of presentation & semantics, too little thought for a11y and i18n. The macro system also leads to much “works on my machine”.

Replying to @lhirlimann

I think LaTeX could be saved; I think it would be possible to build an iteration that would feel familiar to people and could reuse lots of existing stuff, but that’s a fair amount of work.
If you think you know just how tracked you are, it usually is worse. The one question missing from this article is: why would your browser be telling all these things about you to any random stranger who asks?
Quoting a tweet by @F_Kaltheuner ↗
↺ 5
@dontcallmeDOM @amyvdh Hi! At the Shezhen team meeting a few years back we had a brainstorming sessions about W3C values, and I’d written an early draft that I shared. But I can’t find it! Does it ring a bell?

Replying to @null and @amyvdh, @dontcallmeDOM

I’ve found you! But all it tells me is that you joined in Nov’13. Maybe it was in a private repo that I no longer can see?

Replying to @null and @amyvdh, @dontcallmeDOM

Thank yoooooooou! 😘

Replying to @michaelhkay and @random_walker

Or a bullying employer making it surreptitiously part of advancement, or the local mob making it part of protection… And that’s before even accounting for how terrible the tech is and basic principles of verifiability. Little papers in envelopes is great technology.

Replying to @superwuster

I suspect (but it would need proof) that it's an effect of gerrymandering. You want to give your opponents landslides in one district in exchange for several "good enough" wins for yourself. On a down year, if you've optimised right, your "good enough" wins should be very close.
It’s a promotional video, but there’s lots of cool info and great pics in it. Digitising The Times’s “morgue”: youtu.be/bPX-9bTzqZQ (feat. the handsome @beaufour too!)

Replying to @stevewilber and @MikeIsaac

Only occasionally, on topics that affect otherwise-privileged employees. That's not leadership in progress.
I wonder if that's related to the type of news that people get on Facebook, too.
Quoting a tweet by @JohnHolbein1 ↗
Conservatism is just tribalism. The whole thread is worth reading.
Quoting a tweet by @AmandaMarcotte ↗
↺ 1

Replying to @null and @mattdkerr, @stevewilber, @MikeIsaac

Or even just things they have a modicum of direct control over, like radicalisation, not sustaining genocide, the joint destruction of privacy and the journalistic business model...

Replying to @stevewilber and @MikeIsaac

More progressive employees and a more progressive sector are two very different things. You can hire legions of nice, fluffy, and smart Googlers if they're hapless about ethics (especially ethics at scale aka governance) then you'll get a monster. Which is obvious to all outside.
In many ways the path to Hell really is paved with ethically hapless well-meaning Googlers. Naked greed with better checks and balances is less harmful.

Thread of 2 tweets

Replying to @charleeparis

The findings are that people off Facebook read less news. I think that may be because on Facebook they get more viral news they don't need.
Epic level trolling from Berlin district offering to host Google in a former Stasi building.
Quoting a tweet by @SDullien ↗
↺ 4
Next time someone tries to convince you to go app-only...
Quoting a tweet by @Beschizza ↗
↺ 3
"Ancillary Justice", by Ann Leckie. I know, you all read it umpteen years ago and you all said it was great. Well, you were right.
Spot the @skdh cameo in "Totally Random"! 😀🎲
↺ 1

Replying to @skdh

I'm halfway through, it's sort of a weird and very simplified version of Bananaworld. I don't know if it will work as a way of popularising entanglement but I like the quirkiness!
It is incredibly disingenuous for Sundar to be equating Europe’s “right to be forgotten” and Chinese censorship. One (in Google’s case) is protection against the digital equivalent of branding as a form of punishment; the other is political control.
↺ 6
Many CEOs have poor understanding of data ethics, but when you’re the CEO of the world’s largest personal data repository, it’s your job to know better. If that’s the sort of argument that Google lobbyists are making, it’s cynically self-serving beyond the pale.

Thread of 3 tweets

Replying to @null and @mpk, @delroth_

I'm not surprised, that's how good people do bad things.

Replying to @rachelnabors and @LogicalAnalysis

You should check out the ongoing @NineDotsPrize 😏
Hell no! I wish there were more of those!
Quoting a tweet by @TheAnnaGat ↗
↺ 1
When reading a book I often get ideas about completely unrelated things, which I end up writing down on the inside cover. Getting some weird looks at work right now copying down governance ideas from “Categories for the Working Philosopher” 🙄
The lack of version control is easily one of the things that sucks most about G Suite. That makes this @Google ad both truer and funnier than I think was intended.
↺ 1
The wonderfully detailed story of how Facebook handled crisis. And when you’re done reading this, grab a copy of @superwuster’s “The Curse of Bigness”. nytimes.com/2018/11/14/tec…
↺ 1
@monteiro on how employee walk-outs are key to maintaining trust that unethical companies can reform themselves. Googlers showed that they could care (about themselves at least); we’re still waiting for the others. medium.com/@monteiro/when…
↺ 1

Replying to @danbri

I am well aware, but since I can’t see the others I have to appraise on observable aspects such as commitment to privacy, lack of trust behaviour, and not being harmful to democracy and the press — all of which I see as currently failing.

Replying to @TheAnnaGat and @BarackObama

Ah, wait, let me get my flag messaging set to tell you the same thing 😏
Millenials are ruining fascism.
Quoting a tweet by @Noahpinion ↗

Replying to @Noahpinion

Who the fuck reports dates in reverse chronological order? Had me panicked for a short while there.
"The Curse of Bigness: Antitrust in the New Gilded Age", by @superwuster. Short and ruthlessly clear, this provides an invaluable introduction to one of the defining - if underestimated - issues of our times.
↺ 2

Replying to @olivierthereaux

Yeah, those nonwhites are pretty economically chill I must say.

Replying to @macsym

I think you missed the irony there 😏

Replying to @null and @marcosc

Ready when you are, buddy.
Are you sure? — how user interfaces undermine consent uxdesign.cc/how-user-inter…
Je lis l'excellente décision de la @CNIL sur le cas Vectaury (plus d'infos à suivre), mais même si j'abonde dans son sens, franchement, des "mobinautes" utilisant leurs "ordiphones" — est-ce vraiment nécessaire?
↺ 1
Recently, the @CNIL issued a decision regarding the GDPR compliance of an unknown French adtech company named "Vectaury". It may seem like small fry, but the decision has potential wide-ranging impacts for Google, the IAB framework, and today's adtech. It's thread time! 👇
↺ 256
Vectaury was collecting geolocation data in order to create profiles (eg. people who often go to this or that type of shop) so as to power ad targeting. They operate through embedded SDKs and ad bidding, making them invisible to users.
↺ 4

Read the whole thread: 19 tweets →

Thread of 2 tweets

Replying to @incloud

Hahaha 😂

Replying to @MaxGendler

Yes! It's logical if you think in terms of risk, but it's great to see if spelled out!

Replying to @lawgeeknz and @CNIL

Happy to help!
If the binary form fits in 8 tweets then the ASCII must fit in one! Granted, this is a case in which the binary might be construed as more readable.

Thread of 2 tweets

Replying to @stringy and @mbeisen, @javafour, @Ennaaseret7

Thank you. This was perfect, just perfect.

Replying to @jason_kint

Right, they strongly disputed the idea that the framework was a CYA approach; the CNIL seems to have reached that conclusion.

Replying to @JibberJim

You can't just swap, the processor/controller distinction is decided in fact and not because you say it's one or the other. They would have to only work under direction, the preliminaries parts of the decision address that.

Replying to @null and @nhoizey

Hahaha, peut-être, j'en discute 😊

Replying to @GeekyAboutData

I disagree. Adtech could be driven primarily through first-party relationships (as processors) and perhaps even be safe enough not to require consent. There's a largely unexplored world of user-friendly ads to innovate in.

Replying to @JulesPolonetsky

Yes, it's certainly possible that stronger guarantees could work, but they don't say which ones! If I were to try something in this space, I would ask for review from a data authority first.

Replying to @gvoisin and @IABEurope

Right, but that consent is only valid for the controller that obtains it - unless other controllers can demonstrate that the original consent is valid for all of the data. In other words, contracts do not create consent transitivity.

Replying to @gvoisin and @IABEurope

What you describe is the classic Cover Your Arse approach that is typical in adtech and the backbone of the IAB framework. The @CNIL just stated that it's not good enough (in line with GDPR expectations).
Writing didn't end up making us dumb; I'm confident that we can make a non-toxic Web. But we should stop being surprised that those who make a lot of money from their own bad governance aren't rushing to fix things. It's all working pretty well for them!
↺ 4

Thread of 2 tweets

Replying to @shimown

I don't know man, the books are OK nowadays!

Replying to @__apf__

Come to this coast, it's nicely cold and damp! We couldn't get a forest fire started if we tried.

Replying to @Forsheit and @CNIL_en

What else do people do to relax?

Replying to @joejerome

#adtech does not *need* to be in trouble, there's a million innovative things they could do if they aligned with the actual reality of user expectations.

Replying to @joejerome

I don't think I have any magic bullet to convince them to actually do the self-reg they've been promising for the past twenty years... They need a reckoning that has to come as a shock. It could have been DNT, or GDPR, it could be this...
It's hard to see when you really don't want to. I used up much energy, patience, kindness last summer trying to explain to @IABEurope that their framework was just CYA (so not enough for GDPR) and not standards-grade but they took it as an attack instead.

Thread of 2 tweets

Replying to @epc_angela and @IABEurope, @Google

That's an excellent question Angela 😀 I have some ideas that, happy to chat!

Replying to @null and @nhoizey, @tweetbot

Bizarre!

Replying to @WKCosmo

That's a very philosophical statement, Will.

Replying to @trekonomics

You don't like a random excuse to spend the whole day cooking then eat too much? I'm revoking your French license.

Replying to @vanderleeden

Happy to help, but in general my approach is to avoid doing anything that would require consent, if at all possible.

Replying to @yuhong2

Thanks, I will look later.

Replying to @sassion_en and @gvoisin, @IABEurope

That may be key, but it will be hard. In cases like this one, if users are informed and free, they will not consent. It's just not justifiable to most people.

Replying to @lespacedunmatin

Un plaisir, anytime!

Replying to @praejudiz

Medical consent is usually much better documented than this type of consent though, and the processing is usually more justified and ethical. I'm sure a credible consent trail can be built.

Replying to @praejudiz

Also, aren't testing centers processors rather than controllers?

Replying to @DataPrivProtect and @sassion_en, @kleibold23, @CNIL_en

Absolutely, but the whole point of the IAB framework is that you actually have no idea who got the consent or how it was gotten much of the time. There are subtly different cases that need be teased apart.
Simile of the week.
Quoting a tweet by @LAM_Barrett ↗

Replying to @PrivacyMatters and @buchtan, @CNIL

Thank you, sir. 🙇

Replying to @mmatthiesen and @IABEurope

But the problem is that receiving a consent string is not enough to ensure that the consent was collected in a valid manner. A downstream controller needs to be proactive beyond trusting a signal. Also, the IAB framework is not sufficiently mature to count as a standard here.
↺ 1

Replying to @gabrielazanfir and @PrivacyMatters, @buchtan, @CNIL

Yes, that matches my reading. It’s basically what I say in the below tweet (but maybe not clearly enough).
↺ 1

Replying to @gabrielazanfir and @PrivacyMatters, @buchtan, @CNIL

The important aspect (as I read it) is that the contract is overridden by controller accountability responsibilities. Just getting a consent string is not enough, irrespective of whatever a contract says: you need to verify your upstream.
↺ 1

Replying to @PrivacyMatters and @buchtan, @CNIL

I’d be curious to hear your assessment; happy to help with bits of French if it’s of assistance.

Replying to @gabrielazanfir and @PrivacyMatters, @buchtan, @CNIL

Right — I think one way to look at it is that it is logic similar to establishing controllerness: a contract may inform the distinction, but the facts are what drive the assessment and they can readily contradict any contract.

Replying to @gabrielazanfir and @PrivacyMatters, @buchtan, @CNIL

Here it isn’t saying that you can’t have a contract ascribing responsibility for consent but it is not sufficient (not, I presume, necessary) and the facts of accountability matter more. This does make it hard to see how useful a contract would in general be, though.

Replying to @PrivacyMatters and @gabrielazanfir, @buchtan, @CNIL

Yes, I’d love to see an example of propagating revocation across the adtech ecosystem 🙄

Replying to @fatemehx2 and @Twitter

I mean... You do get balloons on your profile. Why don't you want to balloons on your profile? Who doesn't go to their own profile every day in the hope of maybe getting some balloons?

Replying to @BrendanEich and @jason_kint

It's all that bloody reporting!

Replying to @olygyf and @VickerySec, @jason_kint

"At Company X we value your privacy."

Replying to @nmiachon and @CNIL

Happy to help!

Replying to @NoDPIsigma and @PrivacyMatters, @gabrielazanfir, @buchtan, @CNIL

That's not detailed in the case.
↺ 10

Replying to @null and @accessiblestef, @heydonworks

They have more details than just my tweet, but yeah that's the gist.

Replying to @Mmaillot and @Quantcast

C'est rien, pour eux il y a une plus grosse plainte en cours. Je ne pense pas qu'ils vont s'en tirer à aussi bon compte.

Replying to @null and @skepticosaurus, @futureidentity

Indeed that's hard to miss, though you can't fault their writers for that.

Replying to @natashanyt

Which one are you eating?

Replying to @clarinette02

In that case I would think you can, at least if they were demonstrably diligent.
Much of the IAB's argument is that Vectaury did not follow the framework's policies. This is disputable, but even if true it's an issue in itself: their framework has no real verification and no enforcement. It's yet another trust-everyone festival.
↺ 1

Read the whole thread: 12 tweets →

Replying to @TheAnnaGat and @SachinB91, @vgr, @AustenAllred, @rrhoover, @nbashaw, @ne0liberal, @karaswisher, @sknthla, @syswarren, @primalpoly, @rivatez

I get @SimonDeDeo, @LogicalAnalysis, @TheAnnaGat, @trekonomics, @mcnees, and @jason_kint. I reckon that would make for a some pretty good discussions 😏

Replying to @nickconfessore and @mikiebarb

I think that's whats privacy regulation will be ten years from now. Happy to back this with a wager 😀

Replying to @mmatthiesen and @IABEurope

Receiving a consent signal is insufficient diligence if your processing requires consent. I'm not sure how to make this more precise, but I would welcome feedback.

Replying to @null and @arainert

Can you demo this on 14 one of these days?

Replying to @PrivacyMatters

Indeed. I've tried to explain to IAB folks the difference between a document a bunch of folks agreed on and an actual standard (which has a lot to do with this) but unfortunately it fell on deaf ears.
@johnnyryan's in-depth look at the IAB's statement on the @CNIL decision is a must-read for privacy and adtech folks.
Quoting a tweet by @johnnyryan ↗

Replying to @BrendanEich

If you find out how let me know!

Replying to @null and @defcon_5, @jason_kint

It can! But it has to be done seriously.

Replying to @MarcusJBrook and @jason_kint

It is! I just wish it could be done with adtech rather than against.

Replying to @natguy and @jason_kint

I don't know if you can really make consent now human. Consent is a tax on end users. I think we can design something safe and without surveillance theft does not require consent.
↺ 1
This is part of what pisses me off with the current "AI ethics" fad. We don't need AI ethics for this, just plain old ethics. Or, you know, just some fucking human decency.
Quoting a tweet by @zeynep ↗
↺ 8
...It feels like getting on an airplane to fly home, only to realize mid-flight that this is it: You’re going to spend the rest of your life on an airplane. It feels like grieving. It feels like having nothing to grieve."

Thread of 2 tweets

Replying to @null and @SimonDeDeo

Yes. I'm still floating through it. The feeling of what can't not have been.

Replying to @CBridge_Chief and @IGrobrien, @TDAN_com

True, though I'm not sure that Heidegger would be my first stop 😏

Replying to @KatSpi and @Turblog

Les super-héros Marvel? Il y a du choix...
I disagree with his conclusion (Facebook has been repeatedly told of problems and they've done nothing other than PR them away) but @smatthewliao provides a valuable moral framework inside of which to look at social media.
Quoting a tweet by @smatthewliao ↗

Replying to @heydonworks

Dumbass Observation in my Mentions
DMP audience segmentation: the early days.
Quoting a tweet by @industrial_book ↗
↺ 3

Replying to @versac and @genevievepetit

Trop de gentillesse 😘 On peut peut-être se voir la première semaine de janvier?

Replying to @skdh

That's a marked difference: I engineering the crackpots are other engineers. If you were to "just" change this one thing (that's almost impossible to change but who's counting) the Web would become perfect...

Replying to @WKCosmo and @skdh

High pay and toleration for arrogance make for a toxic mix. Debugging is also the opposite of black box reasoning and is very testable. You get crackpots on large scale human systems like Web standards, not on code projects.

Replying to @sas_assion and @sassion_en, @gvoisin, @IABEurope

I have yet to see a CMP for adtech purposes that is strong enough to be legal while not leading to massive (justified) attrition. The solutions aren't technical, they require an in-depth reform of adtech.

Replying to @TheAnnaGat

That's exactly where we are with data ethics. It's hard. It's even harder if you're a business in a comparable situation. Game-theoretic levers and all that.

Replying to @seanjreilly

The OS has full control over whether and how location data is shared, and it has direct access to (and trust from) the user. I can’t see an interpretation of the GDPR in which it isn’t a joint controller.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

I didn’t say that it’s invalid to pass a consent message — doing so would not invalidate valid consent. It is, however, invalid to rely on the framework as a source of consent: doing so will not yield valid consent; that’s the decision.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

That is also my understanding, and precisely why the framework doesn’t work. A somewhat distant relative of the framework might indeed work, but it would need to function as an actual standard, not just a fluffy agreement between interested parties.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

We’re a long way from that. You’d need interoperability testing, verification, enforcement, governance, participation from end-user stakeholders… The decision is that cover-your-ass is invalid and that’s all the framework gets you.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

The sooner adtech realises that, the better. We can absolutely fix this, but they have to have the courage to admit they’ve been wrong and accept the help that’s been on offer for months.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

Ah! I see where you’re coming from, but it’s the other way around. The default state of personal data is that you’re not supposed to process it unless you have a legal basis. One of these bases is consent, but it has to be valid. The issue is not that the framework…

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

…somehow makes legitimate processing invalid, it’s that it fails to be sufficient to convey valid consent. It is insufficient to establish valid consent. It’s not a surprising decision, either. You can’t just go «but they said they had consent ¯\_(ツ)_/¯!»

Replying to @mmatthiesen and @MatthewPCooke, @IABEurope

Okay, I must have missed some important pieces. Can you point me to: a) Your enforcement policy; b) The compliance mechanism that keeps it; and c) The post-mortem detailing how (a) and (b) failed in the Vectaury case and what you’re doing about it.

Replying to @mmatthiesen and @MatthewPCooke, @IABEurope

I would also be interested in seeing your RFC2119s and the test suite to support assertions of compliance. What are the governance mechanisms that keep these from motivated reasoning? This is data *protection*, it has to be about facts not promises.

Replying to @mmatthiesen and @MatthewPCooke, @IABEurope

I would also like to see the quantitative framework you have set up to ensure CMP validity, at the very least for high-risk processing like Vectaury’s. If consent is on par with the law for this kind of processing, the CMP should produce opt-in metrics comparable with an…

Replying to @mmatthiesen and @MatthewPCooke, @IABEurope

…informed panel. Eg. «A company called Vectaury will acquire your location every five minutes and use it to sell ads to arbitrary other companies — is that okay?» You can then see if the CMP is getting comparable results or violating expectations. Do you have that set up?

Replying to @mmatthiesen and @MatthewPCooke, @IABEurope

I am no authorised to discuss internal policies, however if you are aware of any profiling, third-party personalisation, or comparable high-risk processing taking place on one of our sites I would certainly welcome a report.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

But that’s the thing: the claim made by the framework is that it’s enough to be compliant. Also, the records aren’t kept by you but sent by others who’ve promised to be good. You can’t run an industry that way.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

It’s not hatred or annoyance: a lot of journalism relies on advertising, and it needs a sane and healthy adtech industry to survive. The time for a reckoning has come, instead all we’re seeing is denial. It’s frustrating.

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

Time and again I’ve offered help: this can absolutely be fixed, this can be turned into a net positive. But you can’t help people who think they don’t have a problem even as they burn…

Replying to @MatthewPCooke and @mmatthiesen, @IABEurope

It would come down to standard of proof in your «and that could be proven».
Serious question: are there any recent examples of Google placing some values above profits (without being forced to do so)?
Quoting a tweet by @juliacarriew ↗

Replying to @seanmmcdonald

Yes, I was thinking along those lines. Some companies set themselves up so that if they betrayed their values they would (in some credible time frame) lose whatever short-term gain the betrayal might bring. I'm super biased but we're publicly traded and I would say are like that.
Google used to be in a comparable position. If you want to organise the world's information for people you have to be credible, which drives value-based behaviour. But they switched to surveillance, the DFP-Android-Chrome hydra took over, and gone were the values.
It's a great case study of how you can lose your yourself while still retaining ethical employees because it takes time and non-motivated reasoning to see such thorough culture change.

Thread of 3 tweets

Replying to @nvbalaji

Companies that need to be credible tend to.

Replying to @skdh

I've had similar experiences a couple of times, notably once this guy asked me incredibly detailed questions about the best design for an XPath API (the title of my talk) if you wanted to build an XSLT processor atop it. I thought he should give the talk.

Thread of 2 tweets

Replying to @Velofisch and @mmatthiesen, @IABEurope, @sas_assion

Yes, it rides on whether the proof is sufficiently credible that downstream parties fulfil accountability requirements at a level required by the processing's risk. Withdrawal equivalence is also a major concern.