Hacker Newsnew | past | comments | ask | show | jobs | submit | za3baec's commentslogin

TL;DR: LQDN claims Amazon used their users' data for targeted advertising without their consent

The interesting bit is section 2.3 page 17 and is very short.


Which is an absolute joke because everyone using amazon to actually purchase anything signs their terms and data collection is clearly part of those terms (as one would expect for an online retailer).

In addition, they run Amazon Marketplace and a well known recommendation engine and clearly allow sellers to advertise.

This always seems to be more about posturing than anything else. Or rely on weird logic loops.


Consent is only valid if it's informed and specific. More than that the data minimization applies - you can't require using personal data if it's not necessary.

https://gdpr.eu/article-4-definitions/

https://ico.org.uk/for-organisations/guide-to-data-protectio...


They run a marketplace and make $20 billion in ad revenue (or more) per year.

Obviously - targeting ads helps them make this money - how is this not a legit business purpose?


Legitimate business purpose is another basis for processing personal data, but it can't override interests of the data subject:

https://gdpr-info.eu/art-6-gdpr/

It's like asking why a doctor can't sedate you and transplant your kidney, you have another one so you don't need it and they'll make a ton of money.


If the statement "collecting this data without consent so we can more effectively sell ads helps us make money, so it's a legitimate business interest" was considered a valid argument, would that make much of GDPR toothless?


If "Wow this makes me a lot of money" made your business legitimate, the heroin industry would be enormous.


Is it reasonable to assume I can agree (as a non-lawyer) to terms and conditions that are 50 pages (wild guess) long? Especially since they are written in legalese?


They are very long because of things like the GPDR.

That said, amazons are pretty darn clear.

"We receive and store any information you provide in relation to Amazon Services. "

"We use your personal information to display interest-based ads for features, products, and services that might be of interest to you"


TC have always been long and legalese and it wasn't because of GPDR. I can't find your examples in the T&C, it seems to be about 'privacy notice'.

Am i supposed to read that too and keep up to date? I signed up in 2003, do you mind showing me what i agreed to?

And out of genuine curiosity, 'any information' seems to be a superset of 'personal information', isn't it? what is "any information"? and are you saying amazon is only using personal information (which is what, exactly?) to display ads?


Amazon is much better than most. You can read historic t&c's. That said, you have a big misunderstanding. If you have continued to use the site, all T&C's updated based on continued use.


The ruling states their EULA doesn't actually say that they are using the data they're collecting in order to advertise. Collecting data doesn't mean you're allowed to use that data for advertising without explicit, revocable consent.


In many jurisdictions, even if consent is informed and specific, a contract which is not the result of actual negotiations but is standard - e.g. between a client and a large company - can often have clauses nullified by the courts, either for being unfair/detrimental to the client, or for their presence being detrimental to public interest.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: