4 ms·

My understanding is that's not sufficient. Here's where I personally got very worried (sorry this is so long): MailChimp recently sent out an email to their c

My understanding is that's not sufficient. Here's where I personally got very worried (sorry this is so long): MailChimp recently sent out an email to their customers advising that all their current HTTPS Submit forms are not GDPR compliant. They're rolling out all new submit forms in May that have legalese that must be explicitly agreed to, in addition to the Email field & Submit button. It's a Modal blocking form so the visitor can't possibly do anything else. Here is an example of their new modal submit form, it's a doozy: https://kb.mailchimp.com/binaries/content/gallery/mailchimpkb/common/lists/signup-forms/gdpr/gdpr_mktgperm.png https://kb.mailchimp.com/binaries/content/gallery/mailchimpk... I don't do any "customized ads" or "direct mail", but apparently that boilerplate of legalese and "we use your email address to send you email, tick here to confirm you want email" is still required. It's a bit like the Cookie notifications all over again. I realize I haven't directly responded to your blog comment submit button, but I hope this explains the motivation / understanding behind my comments here. I too would have thought an email field & submit form would be a reasonable expectation, but the form designed by MailChimp's lawyers is way more legalese & boilerplate than I ever anticipated would be required by GDPR. (Honestly, I do also get the comments here about "you're not going to be caught or made an example of so don't worry" too. In practice I will do what I can to be compliant, listen to what my visitors & customers want, and hope for the best.)

guitarbill 9y ago
Of course it's fucking sufficient, that's literally the definition of "legitimate interest" [0]. I write comment. I want you to publish comment. You publish comment, and don't spam me - maybe even don't require my email. If you say, "hey, provide your email, and I'll send you newsletters and you can unsubscribe at any time", and I say "sweet, sign me up", and then you only send me newsletters with no tracking or adtech, that's legitimate interest. If you use a third party, if they store only the minimum necessary and don't use it for anything else, that'd be fine to. E.g. obviously they need my email address, but only for sending the emails. And if Mailchip were decent, they'd just send out plain emails. The problem is probably their emails are full of tracking links and other adtech garbage, and who knows who they sell info on to? Then again, they call themselves a marketing platform, not a newsletter service, or email sender. Kind of obvious. Also, that's a shitty dialog. Mailchimp's private policy and terms are probably largely void under EU law anyway, just by being almost incomprehensible by the lay person. How am I supposed to give consent freely when it would take days to read? Probably best to avoid Mailchimp. Thanks GDPR! Edit: ordering [0] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

guitarbill 9y ago

Of course it's fucking sufficient, that's literally the definition of "legitimate interest" [0]. I write comment. I want you to publish comment. You publish comment, and don't spam me - maybe even don't require my email. If you say, "hey, provide your email, and I'll send you newsletters and you can unsubscribe at any time", and I say "sweet, sign me up", and then you only send me newsletters with no tracking or adtech, that's legitimate interest. If you use a third party, if they store only the minimum necessary and don't use it for anything else, that'd be fine to. E.g. obviously they need my email address, but only for sending the emails. And if Mailchip were decent, they'd just send out plain emails. The problem is probably their emails are full of tracking links and other adtech garbage, and who knows who they sell info on to? Then again, they call themselves a marketing platform, not a newsletter service, or email sender. Kind of obvious. Also, that's a shitty dialog. Mailchimp's private policy and terms are probably largely void under EU law anyway, just by being almost incomprehensible by the lay person. How am I supposed to give consent freely when it would take days to read? Probably best to avoid Mailchimp. Thanks GDPR! Edit: ordering [0] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...