Protocol Source Code
What matters in tech, in your inbox every morning.
Image: Zarthon

What we’ve learned from two years of GDPR

Map of Europe

Good morning! This Thursday, President Trump escalates his Twitter war, lessons from two years of GDPR, and Instagram's plan to make creators rich.

(Was this email forwarded to you? Sign up here to get Source Code every day.)

People Are Talking

On Protocol: After a tumultuous recent past, Docker CEO Scott Johnston said the company is getting back to basics:

  • "We started our role as really making these development teams incredibly productive at building great apps. And so if it's containers today, what does it get augmented with tomorrow? What does it get augmented [with] the day after that? Keeping up with the different primitives that are relevant for developers and making it easy to consume, it's really important."

MasterClass raised $100 million mid-pandemic, and CEO David Rogier learned a few things in the process:

  • "Don't pitch. Don't do a traditional pitch. Talking over 30 slides via Zoom is the definition of boredom. You can't read the room. People easily get distracted. Make it a discussion. Let the conversation guide the flow."

The Big Story

'Big action to follow!'

The fight that started on Tuesday night between @realdonaldtrump and Twitter's fact-checkers spilled over into Wednesday without missing a beat.

  • "Twitter has now shown that everything we have been saying about them (and their other compatriots) is correct," President Trump tweeted yesterday. "Big action to follow!"
  • Kellyane Conway told "Fox & Friends" that Yoel Roth, Twitter's head of site integrity, was responsible for censoring Trump, adding: "somebody in San Francisco, wake him up and tell him he's about to get a lot more followers." Donald Trump Jr. and others reiterated the message. Users immediately began digging up Roth's old anti-Trump tweets and spamming them back to him and others.

Twitter told Protocol's Emily Birnbuam that "no one person at Twitter is responsible for our policies or enforcement actions, and it's unfortunate to see individual employees targeted for company decisions."

  • Roth has been receiving death threats and harassment, the company said, but is continuing to work.

As for what Trump meant by "big action"? We now have a pretty good idea. According to a draft executive order obtained by Protocol's Emily Birnbaum, which President Trump could sign as soon a Thursday, Secretary of Commerce Wilbur Ross will soon petition the FCC to clarify and change the rules of Section 230, which currently protect online companies from liability for anything people post on their networks.

  • Section 230, the draft order says, "does not extend to deceptive or pretextual actions restricting online content or actions inconsistent with an online platform's terms of service." That's editorial conduct, it says — and forfeits platform protections.
  • In essence, the FCC would be asked to decide whether social platforms sometimes made moderation decisions that meant those platforms were acting as a publishers and could therefore be regulated and prosecuted as such.

The order has other ideas, too:

  • It suggests bringing back the Tech Bias Reporting tool, which the Office of Digital Strategy used to "collect complaints of online censorship." It describes how the FTC would review those complaints and see if any constituted a breaking of the law.
  • It would encourage federal agencies to stop spending taxpayer dollars on "online platforms that violate free speech principles."
  • And it would establish a working group to watch over social platforms to make sure they followed the rules.

Much of the document's argument hinges on the idea that Facebook, Twitter and other social platforms are public spaces in which to engage in free expression and debate. (Trump actually tried to argue in the other direction in a 2018 case over whether he was allowed to block people on Twitter. Ironically, he lost.)

  • Really all you need to know about the thesis is right there in the intro, though: "When large, powerful social media companies censor opinions with which they disagree, they exercise a dangerous power."
  • Trump believes that's happening, and he's trying to stop it.


What we've learned from two years of GDPR

At its conception in 2018, Europe's flagship privacy law threatened to levy fines so big it could put Big Tech out of business. In its wake, California and a handful of other countries adopted privacy laws of their own.

So, two years in … did GDPR work? Other than a bunch of pop-up cookie disclaimers and a fight over Grandma's Facebook photos, has anything on the privacy front really changed?

  • On one hand, not really. Only 231 fines or sanctions were levied from May 2018 to March 2020, compared to a total of 144,376 privacy complaints that were filed in the law's first year. Many complaints remain simply unaddressed by the EU's understaffed and under-resourced Data Protection Authorities (DPAs).
  • "Even when wrongdoing is clear, DPAs hesitate to use their powers against major tech firms because they cannot afford the cost of legally defending their decisions against Big Tech legal firepower," Brave's Johnny Ryan told Protocol's Sofie Kodner.
  • Ireland and Luxembourg, the main European authorities dealing with the cases involving Amazon, Facebook, WhatsApp, Twitter, PayPal, Instagram, Microsoft and Google, have so far issued only one fine between them — against Ireland's state child care agency.

But companies have invested millions into compliance. Microsoft, for example, has adopted GDPR as its global standard (and is trying to get others to do the same). That's partly because GDPR has so far been pretty good news for Big Tech.

  • "They realize that they can weather any regulatory storm," Marietje Schaake, former member of EU Parliament and international policy director of Stanford Cyber Policy Center, told Sofie. For smaller companies, compliance is more difficult.
  • "It was sold as a big hammer to reign in the power of the big, especially American, corporations, when in fact it has actually solidified their position," Schaake said.
  • California's privacy law, unlike GDPR, puts a size threshold in place. On this, Schaake said GDPR has room for improvement: "We have to appreciate the different stakes in capacity."

One thing you can certainly say in GDPR's favor is that it has elevated privacy concerns for consumers, countries and companies alike. And there are likely still fines and enforcement to come. Two years may be a long time in tech, but it's nothing in government bureaucracy.



Walmart Continues to Launch COVID-19 Testing Sites

To increase access to COVID-19 testing, Walmart is partnering with Quest and eTrueNorth to bring mobile sites to underserved areas of America and make tests available at no cost to the individual.

Read more here.


Instagram cuts creators in on the ad business

A lot of creators make a living through Instagram, or because of it, but none of them gets a check from Facebook for their work on the platform. That's about to change: Instagram's going to start sharing revenue with creators on IGTV and let viewers buy badges on Instagram Live that support their favorite creators.

The rollout is small and careful — no surprise, this is Instagram after all — and a teensy bit controlling:

  • IGTV ads will show up on videos made by 200 partners and from a handful of advertisers. Instagram plans to review every single monetized video before it's published and comply with a somewhat puritanical set of rules: no swearing, no drugs, no drinking, no controversial conversations.
  • A small group will also be able to sell badges, for between 99 cents and $5, that viewers can buy during live streams.

If this works, it would pit Instagram against YouTube, where lots of creators already have big businesses. Instagram could become their go-to platform instead. Plus, if it can build a safer, ad-friendlier space, it could quickly steal more skittish YouTube advertisers.

  • This move seems partly designed to undo some of the weird, occasionally illegal product-placement stuff that happens on Instagram. But it's also just a way to keep creators around. They might flirt with new platforms, but paychecks are hard to resist.

Making Moves

Chad Thornton is the new head of design at Airtable. He's been a design leader at Dropbox, Medium and other tech companies — and now he's going to get crazy with databases.

Carl Bass is joining Box's board of directors. He's the former CEO of Autodesk, and will be asked to help Box continue to scale its business.

TSMC hired Nicholas Montella as its director of government relations. Montella, a former Chamber of Commerce executive, is TSMC's second major lobbyist hire in recent months.

In Other News

  • The Launch America rocket launch didn't happen. SpaceX and NASA will be back at it on Saturday afternoon.
  • On Protocol: After a rough first month, Quibi is changing tactics a bit. It's making changes so that it works on big screens, is rethinking its content, and more. It's a downright tech-company pivot.
  • Adobe had a number of its apps go down after what it called "a server issue." They were down for the better part of yesterday, and people were mad.
  • Don't miss this story from Recode about the Big Tech billionaires throwing their money and resources behind the Biden campaign — and the many, many projects they're working on to try and beat Trump.
  • Samsung launched Samsung Money, its debit-based answer to the Apple Card. SoFi is Samsung's financial partner and MasterCard handles the card. Just like Apple Pay, the card's really just an accessory to the digital wallet.
  • On Protocol: Right now, VR might be mostly for games. But it's having a small work-based moment, with teams looking for new ways to collaborate — and it might just stick around.
  • A group of Facebook "insiders and critics" filed a whistleblower complaint to the SEC, The Washington Post reported, saying that Facebook has failed to stop illegal activity on its platform — particularly opioid and other drug sales — and hasn't told investors what's going on.

One More Thing

The great bike farm in the sky

When Uber invested in Lime, it dumped its Jump bike-and-scooter service on the company as well. Which meant Lime suddenly had to deal with tens of thousands of red electric bikes with big red Jump logos on them. So what did it do? It destroyed (and recycled) tens of thousands of them. (The videos are wild.) Uber said many had significant issues, but groups representing essential workers said they'd have gladly taken and fixed them, and many charities said the same. In the meantime, add these to the growing list of bike-sharing graveyards cropping up all over the world.



Walmart COVID-19 testing: 100+ sites by the end of May

By the end of May, Walmart is working toward more than 100 sites, which will allow the company to deliver 20,000 tests a week to people who need them, especially in underserved areas and hot spots.

Read more here.

Thoughts, questions, tips? Send them to me,, or our tips line, Enjoy your day, see you tomorrow.

Recent Issues

The best of Protocol

The confessions of SBF

Your holiday book list

A tale of two FTXs