5 ms·

You're actually wrong. It is the responsibility of the website to notify the user. Facebook has placed in its policies a rule that says that you cannot use it

You're actually wrong. It is the responsibility of the website to notify the user. Facebook has placed in its policies a rule that says that you cannot use its code/buttons/images on your site without obtaining consent by the user for FB to place cookies there. They have a reasonable expectation that you have complied with this, or the image/whatever would not have been caused to load by your site. Otherwise, think of the havoc. You decide that you want to get Facebook in trouble. So you place a Facebook button on your site and don't notify users or ask consent. Then you go call regulators. In this case, you'd find yourself in trouble, not Facebook.

x0x0 9y ago
You have no idea what you're talking about. Per GDPR, it's the controller's (in this case FB is def a controller) responsibility to ensure that their use of data has a legal basis. In this case, since this isn't necessary for fb, the only available basis is consent. As for your havoc example, that shows nothing. If FB allows people to post image buttons on their site, it's FB's responsibility to ensure consent or delete the data on ingress.
- downandout 9y ago
  it's the controller's (in this case FB is def a controller) responsibility to ensure that their use of data has a legal basis You're correct. They are ensuring it by placing it in their terms for the use of their code/images on other sites. Nowhere in the GDPR does it say that every third party whose content may be placed on a site must themselves obtain consent. What exactly do you envision? That each page you load have 40 different consent dialogs show up?
  - x0x0 9y ago
    nope, try again. FB doesn't get to use the data unless it's consented by the end user. It is distinctly not GDPR compliant for FB to claim that their TOS requires consent so it's not their problem. Feel free to read the discussion about co-controllers (called as joint controllers) and particularly the A29WG guidance.
    - downandout 9y ago
      Again, under your (incorrect) interpretation of the GDPR, what exactly do you envision? That each page you load have 40 different consent dialogs show up - one for each tracker and external image that is on the page? Some have hundreds.
      - x0x0 9y ago
        Yes, this is (finally) correct. For each external tracker, you will have to consent that use. By name. Per discussions you can find via google, even naming a well-defined class of 3rd party controllers is not enough; they have to be individually named. This is the impact on adtech. See eg https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/ . Or digiday, which is not exactly anti-adtech. https://digiday.com/media/gdpr-will-change-facebook-ad-targeting/ https://digiday.com/media/gdpr-will-change-facebook-ad-targe... . The fact that some page may have hundreds of co-controllers is immaterial, unless you envision "we don't want to" as a defense to the privacy regulators.
        downandout 9y ago
        I think we'll have to agree to disagree. I expect that EU users won't be spending all their time on the web issuing 50 approvals for each page they load. You may so despise ad-supported services that this is your dream for the world, but unfortunately for your dream (and fortunately for all users that actually want to be able to use the Web), even the heavy-handed GDPR does not mandate this.
        x0x0 9y ago
        I don't know why you think me relating a correct understanding of the GDPR is my endorsement (or not!) . This is what the GDPR requires. You've cited no sources for disagreeing with the formulation of the GDPR as pushed by the very privacy orgs who are in charge of it in 6 weeks.
        TheCoelacanth 9y ago
  - michaelmrose 9y ago
    How about most sites don't load resources from 40 different sites. Alternatively how about facebook ask for the users consent once to track them all over the web and remember that users choice. On ingress the data could be deleted if it didn't correspond to a user that had given consent.

x0x0 9y ago

You have no idea what you're talking about. Per GDPR, it's the controller's (in this case FB is def a controller) responsibility to ensure that their use of data has a legal basis. In this case, since this isn't necessary for fb, the only available basis is consent. As for your havoc example, that shows nothing. If FB allows people to post image buttons on their site, it's FB's responsibility to ensure consent or delete the data on ingress.

downandout 9y ago
it's the controller's (in this case FB is def a controller) responsibility to ensure that their use of data has a legal basis You're correct. They are ensuring it by placing it in their terms for the use of their code/images on other sites. Nowhere in the GDPR does it say that every third party whose content may be placed on a site must themselves obtain consent. What exactly do you envision? That each page you load have 40 different consent dialogs show up?
- x0x0 9y ago
  nope, try again. FB doesn't get to use the data unless it's consented by the end user. It is distinctly not GDPR compliant for FB to claim that their TOS requires consent so it's not their problem. Feel free to read the discussion about co-controllers (called as joint controllers) and particularly the A29WG guidance.
  - downandout 9y ago
    Again, under your (incorrect) interpretation of the GDPR, what exactly do you envision? That each page you load have 40 different consent dialogs show up - one for each tracker and external image that is on the page? Some have hundreds.
    - x0x0 9y ago
      Yes, this is (finally) correct. For each external tracker, you will have to consent that use. By name. Per discussions you can find via google, even naming a well-defined class of 3rd party controllers is not enough; they have to be individually named. This is the impact on adtech. See eg https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/ . Or digiday, which is not exactly anti-adtech. https://digiday.com/media/gdpr-will-change-facebook-ad-targeting/ https://digiday.com/media/gdpr-will-change-facebook-ad-targe... . The fact that some page may have hundreds of co-controllers is immaterial, unless you envision "we don't want to" as a defense to the privacy regulators.
      - downandout 9y ago
        I think we'll have to agree to disagree. I expect that EU users won't be spending all their time on the web issuing 50 approvals for each page they load. You may so despise ad-supported services that this is your dream for the world, but unfortunately for your dream (and fortunately for all users that actually want to be able to use the Web), even the heavy-handed GDPR does not mandate this.
        x0x0 9y ago
        I don't know why you think me relating a correct understanding of the GDPR is my endorsement (or not!) . This is what the GDPR requires. You've cited no sources for disagreeing with the formulation of the GDPR as pushed by the very privacy orgs who are in charge of it in 6 weeks.
      - TheCoelacanth 9y ago
- michaelmrose 9y ago
  How about most sites don't load resources from 40 different sites. Alternatively how about facebook ask for the users consent once to track them all over the web and remember that users choice. On ingress the data could be deleted if it didn't correspond to a user that had given consent.