mmgu

That meant that websites that had enabled a specific setting ("Enable anonymous cookie targeting") in Disqus were tracking Norwegian without informing them. Most of the websites in Norway and elsewhere did not know they were sharing users data through Disqus.

Major sites like the Wirecutter, The Hill, 9to5mac, Breitbart had enabled the setting in 2019. Of the 23 websites I contacted, all 11 that responded told me they were unaware of the tracking and had turned the setting off.

(I wrote the investigative articles in 2019 for the Norwegian public broadcaster NRK.)

A thread in English from then explains most of the findings: https://twitter.com/martingund/status/1207327648093003777

Comment · 5 years ago

There are some nuisances on jurisdiction, but if a company tracks users in Europe they may fall under the purview of European data protection authorities.

There are several factors that play in. For example that the data controller offers the delivery of goods in EU Member States, say a plugin like Disqus. It could also be that they have a .eu top level domain.

The Norwegian DPA also writes this in their advanced notice: "Online tracking using cookies and behavioural advertising are explicitly mentioned as activities which constitute monitoring of behaviour in the EDPB Guidelines on the territorial scope of the GDPR."

EDPB: Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) https://edpb.europa.eu/sites/default/files/files/file1/edpb_...

Comment · 5 years ago

We part of the European Economic Area (EEA) which is quite close to being a EU member, but without voting rights. Norway voted two times on membership and the compromise was EEA.

Comment · 5 years ago

Disqus does not track users from GDPR countries by default. My initial story in December 2019 for the Norwegian broadcaster NRK was a result of Disqus not knowing Norway had the GDPR (we are part of EEA, but not EU).

Users are checked based on IP whether they come from a GDPR country. If GDPR, they will be put in private mode. A user needs to create a profile and consent to sharing for tracking to begin.

Norwegian DPA opened an investigation as a result of our stories and Norwegians are now in private mode by default.

Comment · 6 years ago

As a journalist I can tell you that an important portion of what we report comes from sources that divulge proprietary, secret, or classified info.

Journalists don’t give up their sources due to the risks you are highlighting.

Anyway - for a open society to function we need to live in the same factual world and media contribute to that.

Comment · 6 years ago

Writer: Samsung Galaxy S7. I guess over 70 apps in navigation, weather, games, prayer apps, or relevant due to listing location companies in privacy policy.

I have not named apps / companies I that were not relevant to this feature. I found other things, but I had to focus on a clear story.

Comment · 6 years ago

Turning off ad id in the OS and checking which apps have access to location would do wonders. Would also recommend checking which apps have access to the contact list.

Comment · 6 years ago

I hacked the tweet thread together in 15 min so I think the article might be a better (although longer) read.