Not so many, since they tried to link all 3 only few years ago

https://www.theverge.com/2019/3/6/18253472/mark-zuckerberg-f...

Messenger though has always just been the chat function on Facebook, which can nowadays also be used via a dedicated website/app if you like. It doesn't even have separate account infrastructure on the backend, unlike Instagram. Looks like they're getting around that by essentially creating a second Facebook account, with social media features disabled.

I would venture to say that messenger as a separate service/app has been a thing for at least a decade now.

So when you have to split the two apart, it's likely a hard legal requirement that there's no way account A can know anything about account B anymore. This means, countless metrics and logs and whatever has to be thrown away. So I imagine, there's lots of auditing of systems and every single property that is stored somewhere was scrutinized in long meetings.

Less an engineering burden than a policy and legal burden.

Beyond biographic details which are 99% disconnected from my old individual instagram/fb data (FB can just buy some correlation between email/phone/IP from my credit card or private postage company or whatever) they probably only profile IRL off the last 1-2yrs of your browsing behaviour in most cases.

The classic privacy invading ads usecase is a woman who is pregnant suddenly getting ads for kid stuff before other people they know they are pregnant. They probably won't be getting those ads a year later. At most they are now labelled as potential mother in some macro profile, but for day-to-day targetting it's all about the current thing she's looking at online.

I'm not defending this stuff and macro details matter for privacy at the nation-state and higher level, but my general point is that it's a living machine, constantly adapting with a short timeframe of data to maximize utility, not one that cares much about what you googled a few yrs ago 99% of the time.

Really requires a huge effort to pull together the right people and get fast feedback loops to stop inertia.

If their business assumptions are "users will never have a choice about how much we track them", they deserve what they got.

"They" being engineers, eh?

It's a tough sell to justify greenfield dev effort when there's a BigCorp paved road laid out for you.

If you’re a volunteer Roman legionnaire don’t be surprised when you are ordered to march on Gaul.

I feel like IC latitude isn't usually sufficient to say "Do we really want to require the identity our platform is based around?"

I personally wouldn't think that Facebook engineers would have had their hand forced on something like this.

So I'd imagine the internal pressure over something closer to main products would be the same or worse.

Centralizing identity was (prior to the EU) a core moat for Facebook/Meta.

They only linked them a few years ago, in anticipation of an antitrust battle. They are now unliking them because they have lost/ceded that fight.

From a user perspective is appears like the users have been relatively loosely coupled.

It would be less painful if it were a universal option, and they didn't have to test with a bunch of geo-linked options.

It also highlights how much revenue is tied to this bundling of service since it's probably very expensive to maintain this dual configuration.

Some examples include

- Banning encrypted messaging (almost passed)

- Cookie pop ups

- Various regulations harming open source (discussed before on HN)

Also due to how Europe is wired up, the cost of doing startup business is higher, why there are fewer and fewer successful European software growth companies.

> Banning encrypted messaging (almost passed)

It's a positive thing that it was brought up and struck down. EU is the actually the one you should be thanking because most European countries would ban it.

> Cookie pop ups

Malicious compliance by websites, but at least users have a choice of opting out of tracking. Again, a positive thing.

> Various regulations harming open source (discussed before on HN)

The most recent changes are so watered down that it basically only applies to commercial open source companies that are turning a profit. It's helping users more than it's harming the open source community.

If the legislation had been written correctly then the current nightmare wouldn’t exist.

Should have been a browser level setting the sites are forced to comply with. The pop-up per site with free rein how obtuse it can work was always gonna suck. Pure incompetence from the politicians involved.

Getting the legalise of legislation right first time is almost impossible when there is an army of lawyers, paid by corporations, whose job it is to unpick it.

That’s not fine. It’s anti-thetical to the very idea of the web. Accepting this shit as a compromise is exactly what we did with adblockers and that battle is still ongoing, and not solved. Whenever the greasy finger of corporations end up inside our browsers, whether it’s fingerprinting or meaningless consent screens, or tracking cookies/pixels/scripts, things are not dandy, imo. I don’t have a solution. Just saying.

I'm genuinely curious and not trying to pick a fight here. The core idea behind html when it was first conceived was that it allowed you as the viewer to present that info in any way that you chose. You can change the font, etc to suit your own preferences.

This idea got killed by content providers who mostly want to hardwire their content layout because they know better. So where is this "idea of the web" coming from. Surely there's no longer a central core idea, it's just what each of us make of it, and as a result we're often in conflict about how things go.

Did choice get formally taken away? Does the content provider get to choose how it's done now?

Like with “democracy”, it is not possible to create a comprehensive formal definition that embodies the full spirit of the idea. Without getting too philosophical, the web is client-server based where the provider controls the server, and the user controls the client. There are fierce battles being fought on both fronts:

- Providers are being lured by ad tech giving you a free (as in beer) space in exchange for relinquishing any control of the server. An example would be YouTube where you get free hosting if you comply with opaque community guidelines and strike systems. Limiting linking to other “platforms” aka websites is another example. A more subtle example would be cloud infrastructure where switching provider is designed to be prohibitive.

- Users are under attack based on their IP geo, VPN usage, extensions (ad-blockers primarily), fingerprinting, UA sniffing, JS obfuscation, video DRM etc. The most egregious example is to force users to download an app (a client that the provider controls fully). Captchas is a more subtle example.

Note that there are real hard problems with a healthy web, notably DOS protection, which needs some level of client fingerprinting (like IP rate limiting).

However, large businesses – many of whose success is built entirely on top of the web – are actively eroding it for banal selfish reasons. Much like how democracy can be leveraged by those who don’t believe in it in order to gain traction, only to later be dismantled to maintain power and control.

Legislation is not a technical spec. It's made purposely to be interpreted. And companies are made to optimize their profit given the constraints set by the law. Sometimes companies have to bet that if they do X, they won't get a fine, and decide if they want to take that risk.

Companies can even bet that the fine will be smaller than the profit, which is often the case. And that, IMHO, is the problem: we (I mean our governments) should be much, much more aggressive with the fines. BigTech can basically do anything they want because the fines are always ridiculous (because BigTech are too big, sure).

It was written correctly. Because it's a General Data Protection Regulation. It applies in equal measure to websites, apps, paper records, SaaS, shops, government entities etc.

And it says: "do not get more data than is required for your business. If you want more data, the user must give consent, where opting out is the default, and must be as easy as opting in".

Now, what exactly is badly written in the law? You can start with quoting exactly where it requires existing cookie popups.

For example, GitHub found out they need exactly none: https://github.blog/2020-12-17-no-cookie-for-you/

> Should have been a browser level setting the sites are forced to comply with.

It's called the Do Not Track header, and at one point Safari removed it because the companies you think are blameless used it to track users

It's true, though. The technical language could've been written in a way that makes it more difficult for websites to circumvent, and less annoying for users. Or the regulation could've been amended to clarify and improve the technical aspects.

That said, getting to a regulation at all was probably a bigger nightmare, with Big Tech lobbying against it every step of the way. So I'm glad that we even have the current GDPR, and that the EU is still leading the way in privacy regulations globally.

You seem to be inverting cause and consequence: it's the websites who are annoying to the users, not the law. The banner is optional, it only exists because websites want to collect your private data, not even to make the thing work.

> Or the regulation could've been amended to clarify and improve the technical aspects.

The regulation has been clarified to mean something important: refusal must be as easy, visible and doable as acceptance, so people can click "refuse" everywhere. Lack of acceptance mean refusal, so people can close the banner.

No, I mean that the law could've been written in a way that makes giving consent less cumbersome for users. I agree with GP: if it had been a browser setting that websites _must_ comply with, like the abused and now dead DoNotTrack header, then we wouldn't have ended up with annoying consent forms to begin with. After all, it does make sense for this to be a global user preference, rather than something the user needs to consent to on each site. Even without getting into technical details, this should be evident to anyone.

I'm not aware of why this didn't happen, or why the DNT header was killed, but it wouldn't surprise me if the (ad)tech industry strongly lobbied against it, and won. The internet loves to criticize this oversight as incompetence from politicians, but politicians couldn't have elaborated the technical aspects of the law without IT consultants, and these surely understood what could be the implications. The fact they went with the consent form approach, and the fact this hasn't been rectified years later, is probably a sign that the tech industry still has considerable sway in regulatory matters.

But to blame this situation on the law itself, or the EU, is just delusional. I'm still happy it exists, warts and all.

Actually Google is seeing the wind turn and is slowly moving away from cookies, so it did even better than what you wanted: it will effectively kill (unnecessary) cookies as a whole.

I have no issue believing lawmakers did in fact take advices from IT experts, seeing how they could make the difference between useful and unuseful cookies. But the law never goes into implementation details, that's another level of regulation, and the real effect is coming: the major browser will block third-party cookies. That will change everything.

That's a cynical take. In reality, companies took advantage of the loose technical language to do the least possible work to comply with the law, while doing their best to implement dark patterns to confuse the user into clicking "Agree". This is something that can be improved with stricter regulation, but it will always be a cat and mouse game.

> It was a prerequisite step for GDPR that was designed to legalise data collection and trading.

Another cynical, and also false, take. The GDPR wasn't "designed" for that. In fact, it actively tries to prevent it. An EU citizen can contact any company in the EU and demand to access all their personal data, or for it to be deleted. This is an unequivocal win for people to regain control over their personal information.

Is this the best that governments can do? Certainly not. I'm still glad that at least something exists, and the tech industry is not entirely unregulated, as in most other parts of the world.

> These are corrupt laws

No. These laws are a step in the right direction. Unfortunately, the strong influence and rapid pace of development of the tech industry means that governments will always play catch up, even when they want to pass laws that protect their citizens.

> most people blindly believe EU is good and totally not in bed with big corporations.

Citation needed. Name me a government that is not in bed with Big . Big Tech in particular is in strong symbiosis with governments, as they both share some common goals. So, sure, there's that. And yet despite of it, the EU still passes laws that fight Big Tech's reach, and fines companies when they don't comply. Can it do better? Sure. But name me a government on Earth that does a better job at this than the EU.

We don't need to get political here. But it's foolish to spew cynical takes when some governments are at least trying to fight Big Tech, and even more foolish to imply that their attempts are making things worse for its citizens.

If the goal of the GDPR was to train people to click "Agree" and to legalise data collection, then that law was an abject failure.

That said 33% of consent, legal to be sold is better than 100% of gray area.

Before GDPR you didn't have explicit consent and you still could be on the hook for trading personal data.

The system is working as intended.

Without tracking it's easy to:

a) compare the total number of visitors vs those who accepted tracking

b) just increase a counter for each "No"

Now, would it?

> It's a positive thing that it was brought up and struck down.

You see, the thing about european legislation is that certain stuff, especially stuff people oppose, is proposed over and over again until it passes. It costs almost nothing to re-propose things like killing net neutrality or banning end-to-end encryption, but it's very costly to oppose them. Which the politicians and lobbyists know and use to their advantage.

Most notably, this means a bunch of stuff gets "zero-rated" (e.g. free unlimited facebook/whatsapp with any phone plan, but other data is limited), which was explicitly called out as anti-competitive when the fight was going on about net neutrality in the states.

No it's not. People should be fired for proposing such things as they breach human rights.

It's like being happy that someone proposed genocide of all men over 60 to save on pensions and that the idea didn't pass.

Anyway, reading sibling comments it seems like it's not that simple either way.

But coming from a good idea - make vendors responsible for the software they put out, to prevent tons of abusive practices like shutting of cloud services making paperweights, or never updating massively holed software harder. The ramifications for open source were then realised, and the legislation which is still under planning/review has been drastically updated to make it more applicable for open source software.

> Banning encrypted messaging (almost passed)

But didn't?

> Also due to how Europe is wired up, the cost of doing startup business is higher, why there are fewer and fewer successful European software growth companies.

Which has little to do with regulations, much more to do with the size and wealth of the potential markets.

> why there are fewer and fewer successful European software growth companies

Is that bad though? Are software "growth" companies a requirement for something? There are tons of successful software companies in various European countries, just not at the level of their American counterparts. Again, with quote obvious reasoning - there are 4x the people in the US compared to France (which is top 2 by population in the EU), and Americans both earn and spend more in USD not adjusted for anything.

I really believe the primary reason is that Europe is not one culturally homogeneous area that speaks one language - like the US. Having that is such a huge benefit.

Doing marketing, promo, getting traction, legal documents, taxes, - anything - for your startup in your ONE country is already difficult. Now imagine doing it in 25 countries before you get to have scale benefits equal to the US or China.

Germany is so different, that we'll need to hire several experts for the different regions in Germany. France too. Italy and Spain, unattainable (we are told) without at least a local branch and solid local staff. That's still only a portion of the EU.

"Cookie banners" are not the reason tech is hard in Europe. If you believe that, you really don't know anything about Europe or the EU.

There are likely several reasons at play, culture being a big one. However, there are other reasons at play such as differences in law, financing, immigration, the job market. Bert Huber, an entrepreneur in the EU has given this some thought:

https://berthub.eu/articles/posts/is-europe-just-not-good-at...

[1] You can read the text: https://eur-lex.europa.eu/eli/reg/2016/679/oj there is a single instance of "cookie" (in the preamble) and no instance of "banner".

There are proposed browser signal specifications that would meet legal GDPR consent defintions. See https://www.dataprotectioncontrol.org/spec/

And as for why DNT did not took off, it's because MSFT sabotaged it by making DNT set by default in Internet Explorer. The social contract in that time between adtech, publishers and users was that the signal would strictly be opt-in. The adtech industry used IE making DNT the default as justification for not honoring any of the signals being sent by browsers. It doesn't take a lot of reasoning to realize MSFT did this on purpose, knowing it itself earns income from ads.

Browsers do not have automated means to give consent/not give consent under ePrivacy because the largest browser is ran by an ad company. Monetarily speaking, the ad company earns more if it coerces its users with dark patterns into giving consent under ePrivacy than it does offering pro-user choice technologies to give a blanket not consent.

And ePrivacy itself is not just about cookies. EDPB recently released binding recommendations that severely expanded the perceived scope of ePrivacy (the true scope was always as it is, the adtech industry just ignored it). ePrivacy includes JavaScript side tracking, fingerprinting with various APIs and so on. It's not just cookies.

You probably want to tell that to CMA first.

Even more, many times I find myself wondering why a site is not responsive to my clicks just to find out there's some hidden cookie consent that didn't fire up properly and now I have to inspect the DOM to remove it manually.

It's funny how you slipped in "growth companies" in there.

How about... profitable companies? In the past 10-15 years most "successful" US companies have been fueled by unlimited investor money with zero expectations of profits. I mean, look at YC's "top startups list". They lose billions of dollars every year. But sure, they grow. Like cancer

Websites do not have to show cookie pop ups if they are using only technical cookies like auth tokens.

Go to European Commision page - bam, cookie banner.

Though yes, government services shouldn't use anything but essential cookies (for which you don't need a cookie popup)

You said only scammy businesses have cookie banners... no, all websites have cookie banners now in EU, and it's majorly annoying, unless you use extensions that click it for you.

(The most popular one is owned by Avast. Which is a horrible company that sells users data. So... yay?)

I didn't

> all websites have cookie banners now in EU

All the sites that collect more data than strictly necessary, yes.

Here's an example of a website that spent need a cookie banner: https://github.blog/2020-12-17-no-cookie-for-you/

> The most popular one is owned by Avast. Which is a horrible company that sells users data

Indeed. This should tell you all you need to know about these cookie popups and companies that use Avast's, or IAB's or Admiral's cookie popups.

It’s usually “we value your privacy”, which always makes me think “you put a value on it, alright, can’t wait to take it away”.

> In most cases, the add-on just blocks or hides cookie related pop-ups. When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do).

When I click "I agree" I am not agreeing to cookies but rather to tracking. If the website wants to track me with (say) browser fingerprinting, deleting the cookies will not stop them from tracking me across sessions. Even worse: since I agreed they no longer need to show me a warning, so I may not even notice that I may want to revoke that consent.

If I don't want to be tracked, saying "I do not consent" is the only legally-actionable way. Deleting cookies works now because cookies are still cost-effective, but this won't remain true forever.

Often leave you wondering why you can’t click anything on the page

¹ The GDPR is clear that rejecting must be as simple as accepting.

HN might not be representative, but the number of comments we see defending companies's right to make as much money as they can and against regulation that would add costs to businesses is IMHO pretty high. If that's the general US sentiment, politicians the have little upside in putting burdens on tech companies in the first place.

As for cookie laws, can we honestly say that they have done anything to protect people from corporate spying and abuse of private information? Real regulation would be to outlaw that kind of spying, not putting up annoying banners so that some web developer can feel good about themselves.

On spendings, probably. On regulations, oh boy do people care.

Regulations have pretty direct impact on each countries' economy, and they get discussed nationally before being applied. That means meat prices rises when some practices get banned or a whole sector suddenly getting competitive when barriers to entry are lowered.

For better or worse, people care a lot, and the negative sentiments are enough to fuel may extreme side politics.

Probably a bit controversial but to some degree, that is a good thing. It prevents personality cult and allows to pursue agendas that think in longer terms.

In Switzerland, quite a big part of the population could probably not name the current seven members of the federal council - they can actually get work done, without having to appease the public at every corner.

Very bold claim. Do you have any sources to back it up? EU politics are in the news all the time here.

With that approach I think we'll always get products that are optimized for free + ads first and foremost, as the US public reacts better to those, and once it's setup it's just so hard to pivot to paying models.

https://en.wikipedia.org/wiki/Brussels_effect

Though, it can be argued that the US plug is a bit better since the standart that almost all companies finally agreed to adopt is the Tesla one. However, it could have been the other way around too - the companies could have adopted a very shitty plug if Tesla had a shitty plug simply because their adoption is based on the charging network dominance and not on the plug superiority.

So, I guess its not a clear cut.

Only if you consider malice ~= profit.

And competitors that already do that get an uplift (over time, but still).

It's almost as if the best (or rather: least-worst) option we have lies somewhere in-between laissez faire capitalism and mandatory state-ownership of all industry...

Yes, which describes both the US and Europe. It just comes down to where to fall on that spectrum.

I don't know how or why that was ever legal in the first place, and why Facebook and LinkedIn haven't been sued to death over it.

The contacts-matching system is how Facebook and LinkedIn'ss ultra-creepy "People you might know" list works, and I have no-doubt this will have led to things like journalists' confidential sources being discovered and harmful outing of closeted people, and worse.

Extra evil because you can be triangulated from the uploads of many naive people, so essentially they win in the end.

[1]: https://grapheneos.org/usage#contact-scopes

Given the current enshittification trends, I would not be surprised if in the next few years Samsung, Acer, LG, et al decide that a subscription model for monitors is exactly what they need to pump those share prices up.

I've heard similar things about their other appliances but I've only ever owned the fridge.

Good.

People keep bashing EU for making innovation hard, and there are a lot of truth to it.

But I welcome this kind of restrictions.

Nothing is stopping any of the thousands of EU companies innovating in all sorts of fields.

[0] https://www.economist.com/europe/2022/02/26/europe-is-the-fr...

“western Europeans were a quarter poorer than Americans in 1990, and remain a quarter poorer today. ”

And when they say they do less research Id argue the research is done in universities for the benefit of mankind instead of something corporations do. Latest example is Stable Diffusion developed by the CompVis group at LMU Munich.

But if you ask the common man he will say it is something by OpenAI.

There are really no good institutions left, only good people.

The US tech giants were coasting and amassing compound wealth without by innovating but buying the innovative companies or disregarding a basic human right: privacy.

True innovation is and should be difficult and it shouldn't come at the cost of human rights that people has fought over for centuries, sometimes with their own blood.

If you consider the GDPR or DMA limitations on "innovation", then I don't want you innovating.

> Google currently shares data across its services for the purposes described in its Privacy Policy at g.co/privacypolicy and depending on the previous choices you’ve made about your privacy settings, such as Web & App Activity, YouTube History, and Personalized ads

> As of March 6, 2024, new laws in Europe will require Google to get your consent to link certain services if you want them to continue to share data with each other and other Google services as they do today. For example, linked Google services might work together to help personalize your content and ads, depending on your settings.

The whole text is here: https://pastebin.com/iSmeJ5WB

I remember having to somehow contact support back in the day when google made me merge my youtube account and my gmail email, since they had the same name and email address. Lots of strange buggy behaviour.

This question relates to algorithms and the definition Facebook has set up for "EU User". What parameters have Facebook's legal team considered adequate to label an account belonging to an EU user? It is difficult to say.

They will probably look into multiple factors like phone number location and GPS-backed data to identify the true location of an EU user. Now, the interesting part is that if you use a VPN quite frequently, you will notice that IP geolocation data is treated as a universal truth on cookieless interactions. Facebook will likely have a significant amount of data beyond IP geolocation data to infer the location information of their user. But they are likely not going to do that as they launch this new feature. So, it all comes down to how seriously Facebook wants or is required to identify an EU user.

So you can't unlink your facebook and messenger, just create a new messenger account without a facebook account. That's sad.

About linked services Google currently shares data across its services for the purposes described in its Privacy Policy at g.co/privacypolicy, and depending on the previous choices that you've made about your privacy settings, such as Web and App Activity, YouTube History and personalised ads.

As of 6 March 2024, new laws in Europe will require Google to get your consent to link certain services if you want them to continue to share data with each other and other Google services as they do today. For example, linked Google services might work together to help personalise your content and ads, depending on your settings.

Services you can choose to link You can choose which services to link from this list of Google services:

Search YouTube Google Play Ad services Chrome Google Shopping Google Maps All other Google services that are not listed here are always linked and therefore able to share data with each other for the purposes described in our Privacy Policy, depending on your privacy settings

What data is used Personal data that is collected about your interaction with Google services can be shared across any linked services. This includes:

Searches Videos you watch on YouTube Apps you install from Google Play Associated info, such as your device info All the other types of info described in our Privacy Policy How Google uses this data Google uses data shared across linked services for all the purposes that are set out in our privacy policy:

Providing personalised services, including content and ads, depending on your privacy settings Maintaining and improving our services Developing new services Understanding how people use our services to ensure and improve the performance of our services Performing other purposes described in our privacy policy What won’t be affected The choices you make about linked services will not change:

The purposes for which Google uses data Your privacy settings, such as choices you have made about personalising Google services Aspects of a service that don’t involve sharing data The following can always be shared across Google services:

Info that’s associated with your Google Account and not specific to any service, such as your profile picture or the info used to verify your identity Content or info you’ve chosen to make publicly available on Google services, such as comments you’ve posted on YouTube Your data from all Google services, regardless of whether they are linked, may still be shared across all services for certain purposes, like preventing fraud, protecting against spam and abuse, and complying with the law.

Your data may also be shared across Google services to effectively help you complete tasks when two services are offered together. For example, if you make a purchase on Google Play, Play and Google Payments will share related info so that you can complete your purchase.

Things you should know Other settings let you control whether you see personalised content or ads. Linking Google services is not about sharing your data with third-party services.

If services aren’t linked, some features that involve sharing data across Google services will be limited. For example, if you have personalisation on for a service in your privacy settings but don’t link that service, you won’t get personalisation based on data from other services, but can still get personalisation based on data from that service.

You won’t be signed out of any Google services if you choose not to link services.

How to manage linked services You can manage your choices, including selecting other Google services to keep linked or withdrawing your consent, in your Google Account at myaccount.google.com/linked-services. You can also manage your other settings, like Web & App Activity, YouTube History and personalised ads, in your Google Account.

> Your data from all Google services, regardless of whether they are linked, may still be shared across all services for certain purposes, like preventing fraud, protecting against spam and abuse, and complying with the law.