5 ms·

What stops Google from presenting users with a large popup with lots of legal notices mixed with sweet talking marketese? Most people would just click "Okay, I

What stops Google from presenting users with a large popup with lots of legal notices mixed with sweet talking marketese? Most people would just click "Okay, I agree" having never read anything in that popup.

Xylakant 9y ago
Informed consent is required and hiding the crucial information in a sea of legalese would violate that. EULAs get slapped down for such things on a regular basis.
- guy98238710 9y ago
  I didn't mean it to be deceptive. They could just explain things at length in sweet language. Then inject consent request at a point in the workflow where people are most likely to click it away in hurry. The point is that Google or Facebook would get away with this while smaller sites won't.
  - x0x0 9y ago
    Under gdpr, consent requires * brevity * clarity * consent to be separate from other T&Cs * default opt-out for everything * each purpose for which processing will take place to be individually enumerated and consented * granularity: the ability to opt-out (default) to each processing purpose There's no ban on including a button that opts a user in to everything, but you would have to take care to make it very difficult to click by accident or I can possibly see a regulator permitting this. See eg discussion of "clear affirmative action" (A32). And I think the eu will very specifically place the highest scrutiny on google and facebook, rather than the least. edit: no doubt, some smart-asses are going to push their luck, but they'll get slapped down in short order (imo). The GDPR regulators will be looking to make an example of some companies. Also, the stick here is the larger of 10m euro or 4% of global turnover.
PeterisP 9y ago
The simplest thing is that they must provide an option to refuse (without making getting service conditional on it), and there's explicit legal requirement that "revoking consent must be as easy as giving it". If next to "Okay, I agree" button there's a "No, just let me through" button, people are going to do just that.
- wtfstatists 9y ago
  Private Data is necessery for Ads. Ads are necessery for Revenue. Revenue is necessery to provide Service. Whats the problem ?
  - yellow_postit 9y ago
    Exactly this. A veneer of personalization can make it so that you must consent to get the service. Realistically not every use can be put down a priori because that would preclude allAB testing of new features. I’m expecting a much larger “cookie pop up” but getting an option to reset data will be nice (until I need to use the service again)
    - PeterisP 9y ago
      Note that you must get consent for each separate use. If users give you consent to use that data for service personalization, then that must be separate from using the same data for ad personalization and from consent for sharing that data with third parties - even if the first use case is objectively needed by your users, the other uses must be opt-in and can be refused. "Realistically not every use can be put down a priori because that would preclude allAB testing of new features." means just that - it does preclude you from AB testing of new uses of that data as you might have done before. It's illegal now unless you get user consent beforehand. It doesn't prevent AB testing as such, but it does prevent "hidden" AB testing that doesn't inform users and doesn't give them an option to refuse.
      - x0x0 9y ago
        And crucially, under the consent basis, you have to explicitly enumerate the 3rd parties by name. You can no longer use a defined, every precisely defined, class of 3rd parties. The other available basis, legitimate interests, would be extremely hard to use as a basis for 3rd party target data sharing.

Xylakant 9y ago

Informed consent is required and hiding the crucial information in a sea of legalese would violate that. EULAs get slapped down for such things on a regular basis.

guy98238710 9y ago
I didn't mean it to be deceptive. They could just explain things at length in sweet language. Then inject consent request at a point in the workflow where people are most likely to click it away in hurry. The point is that Google or Facebook would get away with this while smaller sites won't.
- x0x0 9y ago
  Under gdpr, consent requires * brevity * clarity * consent to be separate from other T&Cs * default opt-out for everything * each purpose for which processing will take place to be individually enumerated and consented * granularity: the ability to opt-out (default) to each processing purpose There's no ban on including a button that opts a user in to everything, but you would have to take care to make it very difficult to click by accident or I can possibly see a regulator permitting this. See eg discussion of "clear affirmative action" (A32). And I think the eu will very specifically place the highest scrutiny on google and facebook, rather than the least. edit: no doubt, some smart-asses are going to push their luck, but they'll get slapped down in short order (imo). The GDPR regulators will be looking to make an example of some companies. Also, the stick here is the larger of 10m euro or 4% of global turnover.

PeterisP 9y ago

The simplest thing is that they must provide an option to refuse (without making getting service conditional on it), and there's explicit legal requirement that "revoking consent must be as easy as giving it". If next to "Okay, I agree" button there's a "No, just let me through" button, people are going to do just that.

wtfstatists 9y ago
Private Data is necessery for Ads. Ads are necessery for Revenue. Revenue is necessery to provide Service. Whats the problem ?
- yellow_postit 9y ago
  Exactly this. A veneer of personalization can make it so that you must consent to get the service. Realistically not every use can be put down a priori because that would preclude allAB testing of new features. I’m expecting a much larger “cookie pop up” but getting an option to reset data will be nice (until I need to use the service again)
  - PeterisP 9y ago
    Note that you must get consent for each separate use. If users give you consent to use that data for service personalization, then that must be separate from using the same data for ad personalization and from consent for sharing that data with third parties - even if the first use case is objectively needed by your users, the other uses must be opt-in and can be refused. "Realistically not every use can be put down a priori because that would preclude allAB testing of new features." means just that - it does preclude you from AB testing of new uses of that data as you might have done before. It's illegal now unless you get user consent beforehand. It doesn't prevent AB testing as such, but it does prevent "hidden" AB testing that doesn't inform users and doesn't give them an option to refuse.
    - x0x0 9y ago
      And crucially, under the consent basis, you have to explicitly enumerate the 3rd parties by name. You can no longer use a defined, every precisely defined, class of 3rd parties. The other available basis, legitimate interests, would be extremely hard to use as a basis for 3rd party target data sharing.