5 ms·

I’m looking forward to the GDPR. It seems to target all the failures of the cookie law. The GDPR will not allow blanket consent statements, it will not allow “

I’m looking forward to the GDPR. It seems to target all the failures of the cookie law. The GDPR will not allow blanket consent statements, it will not allow “permission bundling” (eg. allow acces to everything or you can’t use the site). The changes Twitter rolled out in preparation of the GDPR look like a good thing. We’ll see how it turns out, but I think the GDPR will actually force companies to change, beyond cosmetic changes. And since it is valid for all “data subjects” in the EU, companies will have to consider that. The EU is too large a market that companies can ignore it.

dalbasal 9y ago
Idk... Some of it could be good, but a legislative approach like this could just turn into a compliance bureaucracy that doesn't help much, but has all sorts of side effects. A lot of people are keen on industry regulations (which GDPR sort of is) but i think are not aware of (a) how bad the bad ones are and (b) the very dominant corporate/incumbent bias they give a market. You can't start a financial firm, tobacco company, etc. There are good sides to that, but some serious (and largely unacknowledged, at least in Europe) aspects to it too. I realize generality and such get in the way of this, but... I think it would have been better if this move specifically targeted the 100 biggest companies, who have the scale an resources to actually use all this tracking data.
- igorkraw 9y ago
  Oth: it's a calibration process. If the regulations are to onerous, we can loosen them again, or companies will spring up that make compliance easy. https://www.chargebee.com/ https://www.chargebee.com/ solves the European VAT nightmare for example, until we have harmonization on that front. Is it inefficient? Depends on your model of the world: I'd rather pay a bit more for my goods/services and know that my privacy and data autonomy are preserved, and some people might argue that having the freedom of fiscal policy in differing regions is worth paying chargebee their premium. And if we figure out a way to slide into a better pareto point, cool. >I realize generality and such get in the way of this, but... I think it would have been better if this move specifically targeted the 100 biggest companies, who have the scale an resources to actually use all this tracking data. then they'd outsource it, hide it, whatever. See: tax laws. Law is like exercise, you can't specifically target abdominal fat,nor can you specifically target Fortune100 excesses
  - dalbasal 9y ago
    I don't have too much confidence in calibration. The legislative/regulative systems we have are not great at that. Legislation is principles and inflexible. Flexibility requires a more uprincipled, goal oriented approach. Also, goals (mine, anyway) like openness, cosmopolitanism, low barriers to entry and even playing fields... These are hard to measure. In almost all cases, industry regulation (what this is, more or less) tend to be incumbent friendly. Ie, we could be moderating FB slightly in exchange for killing its future competition.
    - tobylane 9y ago
      Some regulation only applies to incumbents, monopoly law for example.
- Angostura 9y ago
  > A lot of people are keen on industry regulations (which GDPR sort of is) but i think are not aware of (a) how bad the bad ones are and (b) the very dominant corporate/incumbent bias they give a market. I think rather than arguing in general terms that regulation is bad, it is more helpful to address any specific problems you have with GDPR. I've spent a few months looking at it at a small organisation that is having to implement it. My take is that its goals and the way they are implemented look pretty sound.
  - dalbasal 9y ago
    I don't think that I did. Just pointing out some recurring themes, generally. We don't have that many examples and "regulation" is a fairly squishy category. But, I think anyone who's worked in a business where the word "compliance" comes up regularly has a clear idea of what this means. Incumbent friendliness is a real concern. In my experience, it is taken as a given by industries facing potential "regulation".
    - tobylane 9y ago
      The other side of that is how much mental energy do you give to the ways companies are allowed to lie or mislead. If you’re renting an apartment is the sticker price what you’ll actually pay or are there admin costs both to starting the contract and every month. The UK has recently started to crack down on excessive charges relating to starting a renting contract, with broad positive support.
      - dalbasal 9y ago
        Idk if it's a case of mental energy. The legal/regulatory toolkit just isn't good. Every little point needs to be detailed, legible and explicit in order to be enforceable. "Informed" just isn't a yes or no point. Boiling it down to such an explicit set of requirements... you can easily boil out all the nutrition.
zmb_ 9y ago
> it will not allow “permission bundling” (eg. allow acces to everything or you can’t use the site) This is something I have not been able to come to terms with. I can understand requiring express consent to each item individually, rather than burying everything into a long ToS. But what I cannot understand is forcing me (as a service provider) into a contract with a customer even if the customer rejects some of my terms.
- wastedhours 9y ago
  IANAL, but if you deem the processing necessary, then you can use "fulfilment of a contract" or "legitimate interests" as your legal basis and argue on that. There's no "right" legal basis, and you can choose whichever you deem necessary. This just now means you have to be pretty darn sure you're choosing the right one (because, you've always had to protect and limit the amount of information you collect and process, now it's just much more explicit). As with everything GDPR (and most digital regulations in general), the large companies will win as they have the legal teams to draft the statements and scores of developers in order to get the UX process sorted (or argue their case in the event something goes awry).
- dalbasal 9y ago
  I think this is just a really hard one to solve.... Cookie restrictions basically amounted to an additional clause in terms and conditions, the thing we're disingenuously treating as a contract. Realistically no one reads them, not even lawyers. That is the expectation they we re written under. If people actually read before accepting, they would be 250 characters long. Very few services would put up with that much of a roadblock to signing up. Do you really think apple would tolerate an average iPhone sitting unopened for months while the user has the "contract" sitting on their todo pile along with mortgage refinancing and insurance paperwork? It makes a mockery of the whole thing, reductio ad absurdum for the whole concept of consent...with side effects. The dynamic this has created is one where the "contract's" job is to reserve all rights that can legally be reserved. There is no trade-off, no reason not to reserve any right. It's just silly to treat these as agreements. The idea with unbundling is to break this dynamic. Encourage some semblance of informed consent where the user is party to these decisions. Giving users an all or nothing proposition is a part of the problem. along with the insane levels of user engagement in legal boilerplate that would be required for the system to actually work the way we're pretending it does. That said, I think it won't work. We'll probably have a more complex version of the current system. Services will still have an incentive to obscure... and turn consent into a click-without-readung-or-fuck-off nag screen. They may just need 4seperate ones now.

dalbasal 9y ago

Idk... Some of it could be good, but a legislative approach like this could just turn into a compliance bureaucracy that doesn't help much, but has all sorts of side effects. A lot of people are keen on industry regulations (which GDPR sort of is) but i think are not aware of (a) how bad the bad ones are and (b) the very dominant corporate/incumbent bias they give a market. You can't start a financial firm, tobacco company, etc. There are good sides to that, but some serious (and largely unacknowledged, at least in Europe) aspects to it too. I realize generality and such get in the way of this, but... I think it would have been better if this move specifically targeted the 100 biggest companies, who have the scale an resources to actually use all this tracking data.

igorkraw 9y ago
Oth: it's a calibration process. If the regulations are to onerous, we can loosen them again, or companies will spring up that make compliance easy. https://www.chargebee.com/ https://www.chargebee.com/ solves the European VAT nightmare for example, until we have harmonization on that front. Is it inefficient? Depends on your model of the world: I'd rather pay a bit more for my goods/services and know that my privacy and data autonomy are preserved, and some people might argue that having the freedom of fiscal policy in differing regions is worth paying chargebee their premium. And if we figure out a way to slide into a better pareto point, cool. >I realize generality and such get in the way of this, but... I think it would have been better if this move specifically targeted the 100 biggest companies, who have the scale an resources to actually use all this tracking data. then they'd outsource it, hide it, whatever. See: tax laws. Law is like exercise, you can't specifically target abdominal fat,nor can you specifically target Fortune100 excesses
- dalbasal 9y ago
  I don't have too much confidence in calibration. The legislative/regulative systems we have are not great at that. Legislation is principles and inflexible. Flexibility requires a more uprincipled, goal oriented approach. Also, goals (mine, anyway) like openness, cosmopolitanism, low barriers to entry and even playing fields... These are hard to measure. In almost all cases, industry regulation (what this is, more or less) tend to be incumbent friendly. Ie, we could be moderating FB slightly in exchange for killing its future competition.
  - tobylane 9y ago
    Some regulation only applies to incumbents, monopoly law for example.
Angostura 9y ago
> A lot of people are keen on industry regulations (which GDPR sort of is) but i think are not aware of (a) how bad the bad ones are and (b) the very dominant corporate/incumbent bias they give a market. I think rather than arguing in general terms that regulation is bad, it is more helpful to address any specific problems you have with GDPR. I've spent a few months looking at it at a small organisation that is having to implement it. My take is that its goals and the way they are implemented look pretty sound.
- dalbasal 9y ago
  I don't think that I did. Just pointing out some recurring themes, generally. We don't have that many examples and "regulation" is a fairly squishy category. But, I think anyone who's worked in a business where the word "compliance" comes up regularly has a clear idea of what this means. Incumbent friendliness is a real concern. In my experience, it is taken as a given by industries facing potential "regulation".
  - tobylane 9y ago
    The other side of that is how much mental energy do you give to the ways companies are allowed to lie or mislead. If you’re renting an apartment is the sticker price what you’ll actually pay or are there admin costs both to starting the contract and every month. The UK has recently started to crack down on excessive charges relating to starting a renting contract, with broad positive support.
    - dalbasal 9y ago
      Idk if it's a case of mental energy. The legal/regulatory toolkit just isn't good. Every little point needs to be detailed, legible and explicit in order to be enforceable. "Informed" just isn't a yes or no point. Boiling it down to such an explicit set of requirements... you can easily boil out all the nutrition.

zmb_ 9y ago

> it will not allow “permission bundling” (eg. allow acces to everything or you can’t use the site) This is something I have not been able to come to terms with. I can understand requiring express consent to each item individually, rather than burying everything into a long ToS. But what I cannot understand is forcing me (as a service provider) into a contract with a customer even if the customer rejects some of my terms.

wastedhours 9y ago
IANAL, but if you deem the processing necessary, then you can use "fulfilment of a contract" or "legitimate interests" as your legal basis and argue on that. There's no "right" legal basis, and you can choose whichever you deem necessary. This just now means you have to be pretty darn sure you're choosing the right one (because, you've always had to protect and limit the amount of information you collect and process, now it's just much more explicit). As with everything GDPR (and most digital regulations in general), the large companies will win as they have the legal teams to draft the statements and scores of developers in order to get the UX process sorted (or argue their case in the event something goes awry).
dalbasal 9y ago
I think this is just a really hard one to solve.... Cookie restrictions basically amounted to an additional clause in terms and conditions, the thing we're disingenuously treating as a contract. Realistically no one reads them, not even lawyers. That is the expectation they we re written under. If people actually read before accepting, they would be 250 characters long. Very few services would put up with that much of a roadblock to signing up. Do you really think apple would tolerate an average iPhone sitting unopened for months while the user has the "contract" sitting on their todo pile along with mortgage refinancing and insurance paperwork? It makes a mockery of the whole thing, reductio ad absurdum for the whole concept of consent...with side effects. The dynamic this has created is one where the "contract's" job is to reserve all rights that can legally be reserved. There is no trade-off, no reason not to reserve any right. It's just silly to treat these as agreements. The idea with unbundling is to break this dynamic. Encourage some semblance of informed consent where the user is party to these decisions. Giving users an all or nothing proposition is a part of the problem. along with the insane levels of user engagement in legal boilerplate that would be required for the system to actually work the way we're pretending it does. That said, I think it won't work. We'll probably have a more complex version of the current system. Services will still have an incentive to obscure... and turn consent into a click-without-readung-or-fuck-off nag screen. They may just need 4seperate ones now.