4 ms·

>With comments, it's easy. Somebody wants you to post the comment, which is why they submitted it. No extra consent needed... No, that's the point - consent is

>With comments, it's easy. Somebody wants you to post the comment, which is why they submitted it. No extra consent needed... No, that's the point - consent is required for that. And for the consent to be explicit, some are advising it needs to be a Modal blocking dialog that prevents the user from using any other part of the website before dealing with it, and that demonstrates the user did actually scroll through all the privacy terms, not just ignored them and clicked the checkbox. > This is a dumb argument, it's his personal blog, it's controlled by him. That including how much JS and social media trackers to stuff into each page. That's fair. I know I've personally been deleting Google Fonts and Adobe Typekit and hosting my own webfonts instead as a result of this. I'm still figuring out how to best replace Google Analytics, and looking to remove any Twitter & YouTube embeds I had in old posts that could possibly track visitors. (I agree that is all a good outcome of GDPR.)

guitarbill 9y ago
I'd say posting somebody's comment they want posted qualifies as legitimate interest, and therefore doesn't need consent. What other reasonable expectation could a person have that you'd do with that information? No need to overthink or overengineer this.
- SyneRyder 9y ago
  My understanding is that's not sufficient. Here's where I personally got very worried (sorry this is so long): MailChimp recently sent out an email to their customers advising that all their current HTTPS Submit forms are not GDPR compliant. They're rolling out all new submit forms in May that have legalese that must be explicitly agreed to, in addition to the Email field & Submit button. It's a Modal blocking form so the visitor can't possibly do anything else. Here is an example of their new modal submit form, it's a doozy: https://kb.mailchimp.com/binaries/content/gallery/mailchimpkb/common/lists/signup-forms/gdpr/gdpr_mktgperm.png https://kb.mailchimp.com/binaries/content/gallery/mailchimpk... I don't do any "customized ads" or "direct mail", but apparently that boilerplate of legalese and "we use your email address to send you email, tick here to confirm you want email" is still required. It's a bit like the Cookie notifications all over again. I realize I haven't directly responded to your blog comment submit button, but I hope this explains the motivation / understanding behind my comments here. I too would have thought an email field & submit form would be a reasonable expectation, but the form designed by MailChimp's lawyers is way more legalese & boilerplate than I ever anticipated would be required by GDPR. (Honestly, I do also get the comments here about "you're not going to be caught or made an example of so don't worry" too. In practice I will do what I can to be compliant, listen to what my visitors & customers want, and hope for the best.)
  - guitarbill 9y ago
    Of course it's fucking sufficient, that's literally the definition of "legitimate interest" [0]. I write comment. I want you to publish comment. You publish comment, and don't spam me - maybe even don't require my email. If you say, "hey, provide your email, and I'll send you newsletters and you can unsubscribe at any time", and I say "sweet, sign me up", and then you only send me newsletters with no tracking or adtech, that's legitimate interest. If you use a third party, if they store only the minimum necessary and don't use it for anything else, that'd be fine to. E.g. obviously they need my email address, but only for sending the emails. And if Mailchip were decent, they'd just send out plain emails. The problem is probably their emails are full of tracking links and other adtech garbage, and who knows who they sell info on to? Then again, they call themselves a marketing platform, not a newsletter service, or email sender. Kind of obvious. Also, that's a shitty dialog. Mailchimp's private policy and terms are probably largely void under EU law anyway, just by being almost incomprehensible by the lay person. How am I supposed to give consent freely when it would take days to read? Probably best to avoid Mailchimp. Thanks GDPR! Edit: ordering [0] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

guitarbill 9y ago

I'd say posting somebody's comment they want posted qualifies as legitimate interest, and therefore doesn't need consent. What other reasonable expectation could a person have that you'd do with that information? No need to overthink or overengineer this.

SyneRyder 9y ago
My understanding is that's not sufficient. Here's where I personally got very worried (sorry this is so long): MailChimp recently sent out an email to their customers advising that all their current HTTPS Submit forms are not GDPR compliant. They're rolling out all new submit forms in May that have legalese that must be explicitly agreed to, in addition to the Email field & Submit button. It's a Modal blocking form so the visitor can't possibly do anything else. Here is an example of their new modal submit form, it's a doozy: https://kb.mailchimp.com/binaries/content/gallery/mailchimpkb/common/lists/signup-forms/gdpr/gdpr_mktgperm.png https://kb.mailchimp.com/binaries/content/gallery/mailchimpk... I don't do any "customized ads" or "direct mail", but apparently that boilerplate of legalese and "we use your email address to send you email, tick here to confirm you want email" is still required. It's a bit like the Cookie notifications all over again. I realize I haven't directly responded to your blog comment submit button, but I hope this explains the motivation / understanding behind my comments here. I too would have thought an email field & submit form would be a reasonable expectation, but the form designed by MailChimp's lawyers is way more legalese & boilerplate than I ever anticipated would be required by GDPR. (Honestly, I do also get the comments here about "you're not going to be caught or made an example of so don't worry" too. In practice I will do what I can to be compliant, listen to what my visitors & customers want, and hope for the best.)
- guitarbill 9y ago
  Of course it's fucking sufficient, that's literally the definition of "legitimate interest" [0]. I write comment. I want you to publish comment. You publish comment, and don't spam me - maybe even don't require my email. If you say, "hey, provide your email, and I'll send you newsletters and you can unsubscribe at any time", and I say "sweet, sign me up", and then you only send me newsletters with no tracking or adtech, that's legitimate interest. If you use a third party, if they store only the minimum necessary and don't use it for anything else, that'd be fine to. E.g. obviously they need my email address, but only for sending the emails. And if Mailchip were decent, they'd just send out plain emails. The problem is probably their emails are full of tracking links and other adtech garbage, and who knows who they sell info on to? Then again, they call themselves a marketing platform, not a newsletter service, or email sender. Kind of obvious. Also, that's a shitty dialog. Mailchimp's private policy and terms are probably largely void under EU law anyway, just by being almost incomprehensible by the lay person. How am I supposed to give consent freely when it would take days to read? Probably best to avoid Mailchimp. Thanks GDPR! Edit: ordering [0] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...