France's data protection watchdog, CNIL, fined Apple €8 million and Meta (Facebook's parent company) €60 million for violating EU privacy law. The fines stem from how the companies implemented targeted advertising on iOS and Android respectively. CNIL found that users were not given a simple enough mechanism to opt out of personalized ads; while both companies offered some control, users had to navigate multiple settings. Specifically, Apple defaulted to personalized ads requiring users to actively disable them, while Meta made ad personalization integral to its terms of service, requiring active consent to activate non-personalized ads. The CNIL considered both approaches violations of EU regulations that require clear and straightforward consent for personalized advertising.
The author argues that relying on US-based cloud providers is no longer safe for governments and societies, particularly in Europe. The CLOUD Act grants US authorities access to data stored by US companies regardless of location, undermining data sovereignty and exposing sensitive information to potential surveillance. This risk is compounded by increasing geopolitical tensions and the weaponization of data, making dependence on US cloud infrastructure a strategic vulnerability. The author advocates for shifting towards European-owned and operated cloud solutions that prioritize data protection and adhere to stricter regulatory frameworks like GDPR, ensuring digital sovereignty and reducing reliance on potentially adversarial nations.
Hacker News users largely agreed with the article's premise, expressing concerns about US government overreach and data access. Several commenters highlighted the lack of legal recourse for non-US entities against US government actions. Some suggested the EU's data protection regulations are insufficient against such power. The discussion also touched on the geopolitical implications, with commenters noting the US's history of using its technological dominance for political gain. A few commenters questioned the feasibility of entirely avoiding US cloud providers, acknowledging their advanced technology and market share. Others mentioned open-source alternatives and the importance of developing sovereign cloud infrastructure within the EU. A recurring theme was the need for greater digital sovereignty and reducing reliance on US-based services.
Summary of Comments ( 174 )
https://news.ycombinator.com/item?id=43770337
Hacker News commenters generally agree that the fines levied against Apple and Meta (formerly Facebook) are insignificant relative to their revenue, suggesting the penalties are more symbolic than impactful. Some point out the absurdity of the situation, with Apple being fined for giving users more privacy controls, while Meta is fined for essentially ignoring them. The discussion also questions the effectiveness of GDPR and similar regulations, arguing that they haven't significantly changed data collection practices and mostly serve to generate revenue for governments. Several commenters expressed skepticism about the EU's motives, suggesting the fines are driven by a desire to bolster European tech companies rather than genuinely protecting user privacy. A few commenters note the contrast between the EU's approach and that of the US, where similar regulations are seemingly less enforced.
The Hacker News post "Apple and Meta fined millions for breaching EU law" generated a modest number of comments, primarily focusing on the perceived absurdity of the fines and the EU's regulatory approach.
Several commenters expressed skepticism about the effectiveness and rationale behind the fines. One user questioned the logic of fining companies for allegedly violating user privacy while simultaneously mandating features (like ATT, App Tracking Transparency) that purportedly aim to protect user privacy. They highlighted the seemingly contradictory nature of being penalized for not adhering to a standard while also being forced to implement a mechanism that seemingly leads to that penalty.
Another commenter pointed out the relatively small amount of the fines compared to the companies' vast revenues, suggesting that such penalties are unlikely to deter future behavior. They argued that these fines essentially amount to a "cost of doing business" rather than a genuine deterrent.
The discussion also touched on the complexities of obtaining user consent and the practical challenges of adhering to regulations like GDPR. A commenter sarcastically remarked on the expectation that users should meaningfully engage with complex consent pop-ups, noting the impracticality of expecting users to carefully consider and understand the implications of every consent request.
One comment questioned the actual impact on user privacy, suggesting that the fines might be more about generating revenue for the EU than genuinely protecting users. They also suggested the possibility of regulatory capture, implying that regulators might be influenced by larger tech companies.
Finally, a comment highlighted the seeming disparity in the application of GDPR regulations, observing that smaller companies face stricter enforcement while larger companies often seem to escape significant consequences. They used the analogy of enforcing traffic laws strictly on bicycles while ignoring violations by large trucks.
In essence, the comments reflect a general sentiment of skepticism and cynicism towards the EU's approach to regulating tech giants, questioning the effectiveness and motivations behind the fines, and highlighting the practical difficulties and perceived inconsistencies in their application.