5 ms·

That seems crazy to me. It should be illegal for a website to track what you do on that site? We’re not talking about tracking activity across many sites, and y

That seems crazy to me. It should be illegal for a website to track what you do on that site? We’re not talking about tracking activity across many sites, and you don’t need a third-party tool to do this at all. If it were illegal, a huge number of sites wouldn’t even function without fundamentally changing the way they work. You know that the HN database has records of all your votes, comments, etc, right? I get the outrage at being tracked by third parties across the web, but that’s different from making it illegal for any website to track any of your activity on their site.

toomuchtodo 9y ago
It should be illegal for a site to store your personal data without your consent, which is what the GDPR dictates for EU residents. What is considered personal data is for governments, regulators, and courts to decide; not website owners. The days of the Internet being the Wild West are coming to a close, and not a moment too soon. Side note: it’s disturbing it took Mixpanel nine months to notice they were ingesting sensitive data. Turn on All The Ad Blocking.
- ryanwaggoner 9y ago
  I think your view of the GDPR is naive. 99% of people will just consent and that’ll be that. The second they want something the site offers and they have to register (the point at which they’re handing over PII), they’ll be forced to consent, and just like everyone does for cookies and TOS and privacy policy and whatever else, they’ll quickly be trained to consent and move on. I could be wrong, but that’s what I expect. The assymetry here is incredible. That data and the consent has a perceptual value of approximately zero to the consumer, and millions or billions in aggregate to these companies. They’ll figure out a way to get people to consent. Or most of the web just won’t be usable to you.
  - deleted 9y ago
    [deleted]
  - toomuchtodo 9y ago
    I think you’re underestimating the intent of the EU and the aggressive enforcement available to them. If we have to break the web, we break the web. Digital rights supercede tech profits.
    - stryk 9y ago
      I have not much more than a cursory understanding of this new law, but holy shit do I hope somebody breaks the web. Fast. This is out of control with the tracking and the monitoring and every other website seems to pull in 14 or so different javascript analytics with who-knows how many 3rd party companies that you had no idea you were interacting with when you went to the original site. I still don't understand how they plan to enforce this law worldwide, though. The EU is powerful, sure, but if I was China I might just tell them to piss off when they come knocking.
      - beojan 9y ago
        > The EU is powerful, sure, but if I was China I might just tell them to piss off when they come knocking. It's not really Chinese companies doing the tracking, it's American ones. The EU is simply too big a market for them to ignore.
        stryk 9y ago
        I don't disagree, but China was just an example of a country that could feasibly tell them to get bent. What would they do about it? Trade sanctions? Most of the shit in Europe is made in China, too.
        TeMPOraL 9y ago
        They won't go against China per se. They'll go against individual companies through whatever trade agreements connect Europe and China. Maybe Baidu or Alibaba would be strong enough to use Chinese government to turn this into a stalemate. But it probably wouldn't be worth the effort. I doubt they make that much money of wanton analytics abuse anyway. For every other company though, they either comply with GDPR or get out of the European market. (The trick depends in part on companies wanting access to EU more than EU wanting a particular company to sell to its people.)
  - joshuakarjala 9y ago
    According to GDPR you do not need consent to gather personal data which is reasonable with regards to the service your are providing. Why you do need consent for is to gather unneeded personal data or to send personl data to 3rd party providers for processing that is not essential to your service. You are not allowed to deny people access to your site based on lack of this kind of consent.
    - Tharkun 9y ago
      What are you basing that last paragraph on? It's my website, I'll damn well deny access to anyone I please.
      - TeMPOraL 9y ago
        > What are you basing that last paragraph on? It's my website, I'll damn well deny access to anyone I please. If you collect and process PIIs of EU citizens, the EU will do whatever it goddamn likes with you, which currently means some pretty high fines.
        ryanwaggoner 9y ago
        Only if they can enforce and collect them. I’m extremely skeptical that they can do so for companies with no ties to the EU. I suspect other countries will take a dim view of the EU attacking their sovereignty like that, and will probably just ignore it.
      - mattmanser 9y ago
        Perhaps you should read the parable of King Canute? Here's roughly what you must comply by, if you're not blocking the whole of the EU. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
        ithkuil 9y ago
        I'm not sure I understand what this means: > Avoid making consent to processing a precondition of a service. Does it mean I have to ensure my users can use the service even if I'm not allowed to "process" their data? I assume this must mean "processing" data for reasons not directly connected to the actual service. (E.g. using the data to gather business intelligence or sell it to third parties)
  - Angostura 9y ago
    Have a quick look at this for an idea of how the GDPR changes what consent means https://www.hallaminternet.com/how-to-make-your-website-gdpr-compliant/ https://www.hallaminternet.com/how-to-make-your-website-gdpr...
  - TeMPOraL 9y ago
    > I think your view of the GDPR is naive. 99% of people will just consent and that’ll be that. The second they want something the site offers and they have to register (the point at which they’re handing over PII), they’ll be forced to consent, and just like everyone does for cookies and TOS and privacy policy and whatever else, they’ll quickly be trained to consent and move on You're wrong. You see, the "Cookie Law" was a test. Can a gentle legal nudge make the web self-regulate into respecting its users? It turned out that no, it can't. Remember, you only have to show a cookie warning if you're doing something inherently user-hostile. That almost every site has one only shows how little anyone cares. Well, the gloves are off, GDPR is the next iteration, designed to make people care. If you're doing something shady, GDPR will make you explain, in points, how exactly are you going to fuck the user over, and make you request explicit consent for each single fuckery you want to do - and does not let you make the service conditional on the user bending over. The user is supposed to be able to tell "no" to everything and still use the service. Whatever pains this creates for businesses on-line, frankly, it's deserved.
    - wastedhours 9y ago
      So, you put those points into an interstitial. All sites create a similar looking interstitial with the same "Accept" checkbox. It becomes user behaviour (a la invasive cookie notices), cycle continues. I don't see how the informed consent bit wont become the same mindless box-ticking exercise web users already undertake? You can "use" the service, but it'll be positioned that it's not an option but to accept.
      - TeMPOraL 9y ago
        > You can "use" the service, but it'll be positioned that it's not an option but to accept. I feel this time around, such a construct will open the company to legal liability, and there's plenty of people (myself included) who will gladly report shady practices like that. EU seems really into making consent actually meaningful, so why I can't be sure, I'm convinced the "mindless box-ticking exercise" scenario won't play out.
        9y ago
  - WA 9y ago
    > I think your view of the GDPR is naive. 99% of people will just consent and that’ll be that. Maybe, but the GDPR also has much higher fines when it comes to a data breach. So there's quite an incentive for companies to care a little more about user privacy.
kangoo1707 9y ago
How would startups gather BI information then?
- tzahola 9y ago
  Not my problem.
- jacquesm 9y ago
  By asking politely?
- templar_muse 9y ago
  Why do they need it and are they gathering purely for the sake of gathering?

toomuchtodo 9y ago

It should be illegal for a site to store your personal data without your consent, which is what the GDPR dictates for EU residents. What is considered personal data is for governments, regulators, and courts to decide; not website owners. The days of the Internet being the Wild West are coming to a close, and not a moment too soon. Side note: it’s disturbing it took Mixpanel nine months to notice they were ingesting sensitive data. Turn on All The Ad Blocking.

ryanwaggoner 9y ago
I think your view of the GDPR is naive. 99% of people will just consent and that’ll be that. The second they want something the site offers and they have to register (the point at which they’re handing over PII), they’ll be forced to consent, and just like everyone does for cookies and TOS and privacy policy and whatever else, they’ll quickly be trained to consent and move on. I could be wrong, but that’s what I expect. The assymetry here is incredible. That data and the consent has a perceptual value of approximately zero to the consumer, and millions or billions in aggregate to these companies. They’ll figure out a way to get people to consent. Or most of the web just won’t be usable to you.
- deleted 9y ago
  [deleted]
- toomuchtodo 9y ago
  I think you’re underestimating the intent of the EU and the aggressive enforcement available to them. If we have to break the web, we break the web. Digital rights supercede tech profits.
  - stryk 9y ago
    I have not much more than a cursory understanding of this new law, but holy shit do I hope somebody breaks the web. Fast. This is out of control with the tracking and the monitoring and every other website seems to pull in 14 or so different javascript analytics with who-knows how many 3rd party companies that you had no idea you were interacting with when you went to the original site. I still don't understand how they plan to enforce this law worldwide, though. The EU is powerful, sure, but if I was China I might just tell them to piss off when they come knocking.
    - beojan 9y ago
      > The EU is powerful, sure, but if I was China I might just tell them to piss off when they come knocking. It's not really Chinese companies doing the tracking, it's American ones. The EU is simply too big a market for them to ignore.
      - stryk 9y ago
        I don't disagree, but China was just an example of a country that could feasibly tell them to get bent. What would they do about it? Trade sanctions? Most of the shit in Europe is made in China, too.
        TeMPOraL 9y ago
        They won't go against China per se. They'll go against individual companies through whatever trade agreements connect Europe and China. Maybe Baidu or Alibaba would be strong enough to use Chinese government to turn this into a stalemate. But it probably wouldn't be worth the effort. I doubt they make that much money of wanton analytics abuse anyway. For every other company though, they either comply with GDPR or get out of the European market. (The trick depends in part on companies wanting access to EU more than EU wanting a particular company to sell to its people.)
- joshuakarjala 9y ago
  According to GDPR you do not need consent to gather personal data which is reasonable with regards to the service your are providing. Why you do need consent for is to gather unneeded personal data or to send personl data to 3rd party providers for processing that is not essential to your service. You are not allowed to deny people access to your site based on lack of this kind of consent.
  - Tharkun 9y ago
    What are you basing that last paragraph on? It's my website, I'll damn well deny access to anyone I please.
    - TeMPOraL 9y ago
      > What are you basing that last paragraph on? It's my website, I'll damn well deny access to anyone I please. If you collect and process PIIs of EU citizens, the EU will do whatever it goddamn likes with you, which currently means some pretty high fines.
      - ryanwaggoner 9y ago
        Only if they can enforce and collect them. I’m extremely skeptical that they can do so for companies with no ties to the EU. I suspect other countries will take a dim view of the EU attacking their sovereignty like that, and will probably just ignore it.
    - mattmanser 9y ago
      Perhaps you should read the parable of King Canute? Here's roughly what you must comply by, if you're not blocking the whole of the EU. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
      - ithkuil 9y ago
        I'm not sure I understand what this means: > Avoid making consent to processing a precondition of a service. Does it mean I have to ensure my users can use the service even if I'm not allowed to "process" their data? I assume this must mean "processing" data for reasons not directly connected to the actual service. (E.g. using the data to gather business intelligence or sell it to third parties)
- Angostura 9y ago
  Have a quick look at this for an idea of how the GDPR changes what consent means https://www.hallaminternet.com/how-to-make-your-website-gdpr-compliant/ https://www.hallaminternet.com/how-to-make-your-website-gdpr...
- TeMPOraL 9y ago
  > I think your view of the GDPR is naive. 99% of people will just consent and that’ll be that. The second they want something the site offers and they have to register (the point at which they’re handing over PII), they’ll be forced to consent, and just like everyone does for cookies and TOS and privacy policy and whatever else, they’ll quickly be trained to consent and move on You're wrong. You see, the "Cookie Law" was a test. Can a gentle legal nudge make the web self-regulate into respecting its users? It turned out that no, it can't. Remember, you only have to show a cookie warning if you're doing something inherently user-hostile. That almost every site has one only shows how little anyone cares. Well, the gloves are off, GDPR is the next iteration, designed to make people care. If you're doing something shady, GDPR will make you explain, in points, how exactly are you going to fuck the user over, and make you request explicit consent for each single fuckery you want to do - and does not let you make the service conditional on the user bending over. The user is supposed to be able to tell "no" to everything and still use the service. Whatever pains this creates for businesses on-line, frankly, it's deserved.
  - wastedhours 9y ago
    So, you put those points into an interstitial. All sites create a similar looking interstitial with the same "Accept" checkbox. It becomes user behaviour (a la invasive cookie notices), cycle continues. I don't see how the informed consent bit wont become the same mindless box-ticking exercise web users already undertake? You can "use" the service, but it'll be positioned that it's not an option but to accept.
    - TeMPOraL 9y ago
      > You can "use" the service, but it'll be positioned that it's not an option but to accept. I feel this time around, such a construct will open the company to legal liability, and there's plenty of people (myself included) who will gladly report shady practices like that. EU seems really into making consent actually meaningful, so why I can't be sure, I'm convinced the "mindless box-ticking exercise" scenario won't play out.
      - 9y ago
- WA 9y ago
  > I think your view of the GDPR is naive. 99% of people will just consent and that’ll be that. Maybe, but the GDPR also has much higher fines when it comes to a data breach. So there's quite an incentive for companies to care a little more about user privacy.

kangoo1707 9y ago

How would startups gather BI information then?

tzahola 9y ago
Not my problem.
jacquesm 9y ago
By asking politely?
templar_muse 9y ago
Why do they need it and are they gathering purely for the sake of gathering?