5 ms·

IIRC, the GDPR is very explicit about what constitutes valid consent, so things like pre-checked check-boxes aren't valid. Is "consent" gained by a screen with

IIRC, the GDPR is very explicit about what constitutes valid consent, so things like pre-checked check-boxes aren't valid. Is "consent" gained by a screen with only an "I agree" button even kosher by it?

fredley 8y ago
Absolutely not. This is Facebook basically goading the EU by obviously flouting the rules.
willsinclair 8y ago
Later in the thread, he mentions that the consent they ask for doesn't really comply with the GDPR principles. > This appears to breach several important principles of the #GDPR, including the principle of purpose limitation, freely given, non-conditional consent, and of transparency. In other words, if Facebook attempts to collect consent in this manner, that consent will be unlawful.
ben509 8y ago
It may be that FB's lawyers come at it with a more American view whereby it's legal if it complies with the letter of the law. I suspect the Euro legal system tends to build a fence around the Torah, so to speak.
- dbbk 8y ago
  It doesn't seem to comply with the letter of the law though, based on the requirement of "freely given, non-conditional consent".
  - wang_li 8y ago
    What does it even mean to be conditional? Is the EU saying that FB has to provide their service to Europeans? Does the EU also require that businesses sell their services and products at a loss? Doesn't FB have some right to deny usage of their service to those who choose not to abide by FB's policies? Whether it's disapproval of tracking or behavior violations, it seems like FB should be able to say they don't want to provide their service to particular individuals.
    - vidarh 8y ago
      They can choose to not provide service to EU citizens. If they provide service to EU citizens, then with that comes limitations on what rights the have under EU law to pick and choose which EU citizens they want to provide service to. Nobody is forcing them to serve the EU market.
      - KozmoNau7 8y ago
        Their choices are to either be GDPR-complient, or to completely bar all EU users from accessing Facebook. They cannot use tracking opt-in as a requirement for access.
        cabaalis 8y ago
        American here; I just don't quite understand the premise. "Here is what you are giving us, and here is what you're getting in return" seems perfectly legit to me. If this interpretation of the law is correct, then the government is essentially saying the "in return" portion has to be eliminated. Which seems to be against the idea of trade.
        quadrangle 8y ago
        Are you suggesting that somehow any law is inherently wrong if it regulates trade at all? Trade is a means to the end of having healthy, productive populations. It's not something to prioritize above all else, especially in cases where trade hurts the well-being of populations. In the specific case of Facebook, near-zero of the users actually understand either what they are giving or the full extent of what they are getting or not (especially since the latter changes constantly as FB alters their policies and algorithms etc). So, it's more like "give us stuff you don't understand with ramifications you haven't thought about, and you get a complex, somewhat unpredictable, changing service." This is nothing like the theoretical trade between two participants with equal power and complete information.
        cabaalis 8y ago
- mrec 8y ago
  That sounds backwards to me. Mainland European legal systems are based on civil law, which heavily emphasizes letter rather than spirit. (As opposed to the common law traditions found in most of the Anglosphere.)
- TheCapn 8y ago
  I would be absolutely shocked if Facebook didn't have european legal professionals hired to deal with this instead of having their American lawyers try to interpret foreign law.
  - vidarh 8y ago
    Maybe, but my experience with US companies is that surprisingly large companies sometimes think they'll get away with just doing stuff that's legal under US law and pretend the EU is just another US state. E.g. I spent 3 years at Yahoo (more than a decade ago now) wrangling with US product managers that found it incredibly hard to accept that the "workarounds" they kept proposing for EU requirements for payments systems were highly illegal in the European countries we operated in, as a means to cut effort. My team existed pretty much only to form a protective layer between the US payments team and the European business because the European business didn't trust them to not pull a fast one to save time, because they didn't understand the seriousness of the requirements. But in many European countries, the courts takes a very dim view on that kind of attitude.
- icu 8y ago
  The European regulatory view is often 'outcomes based' rather than the American 'rules based'. What I mean is that in the European approach, you might follow the rules, but fail in the outcome or 'the spirit' of the law. In that case, you have still broken the law. If you allow a gross generalisation, European regulators point to perverse outcomes in the US where morality is subverted by the law as a reason why this approach is better. There is however a much higher compliance cost in the EU than in the US due to this approach.
underko 8y ago
My guess is that GDPR is not yet in effect thus they can use this to get consent in advance. After GDPR is in place these will be changed to comply with it.
- KozmoNau7 8y ago
  Then they will have to ask again with a fully GDPR-compliant opt-in procedure, after the 25th. You cannot grandfather in user consent, especially not with a blatantly non-compliant procedure like this one.
- Angostura 8y ago
  I shall wait a couple of weeks until GDPR is in force before logging in again. That will be interesting

fredley 8y ago

Absolutely not. This is Facebook basically goading the EU by obviously flouting the rules.

willsinclair 8y ago

Later in the thread, he mentions that the consent they ask for doesn't really comply with the GDPR principles. > This appears to breach several important principles of the #GDPR, including the principle of purpose limitation, freely given, non-conditional consent, and of transparency. In other words, if Facebook attempts to collect consent in this manner, that consent will be unlawful.

ben509 8y ago

It may be that FB's lawyers come at it with a more American view whereby it's legal if it complies with the letter of the law. I suspect the Euro legal system tends to build a fence around the Torah, so to speak.

dbbk 8y ago
It doesn't seem to comply with the letter of the law though, based on the requirement of "freely given, non-conditional consent".
- wang_li 8y ago
  What does it even mean to be conditional? Is the EU saying that FB has to provide their service to Europeans? Does the EU also require that businesses sell their services and products at a loss? Doesn't FB have some right to deny usage of their service to those who choose not to abide by FB's policies? Whether it's disapproval of tracking or behavior violations, it seems like FB should be able to say they don't want to provide their service to particular individuals.
  - vidarh 8y ago
    They can choose to not provide service to EU citizens. If they provide service to EU citizens, then with that comes limitations on what rights the have under EU law to pick and choose which EU citizens they want to provide service to. Nobody is forcing them to serve the EU market.
    - KozmoNau7 8y ago
      Their choices are to either be GDPR-complient, or to completely bar all EU users from accessing Facebook. They cannot use tracking opt-in as a requirement for access.
      - cabaalis 8y ago
        American here; I just don't quite understand the premise. "Here is what you are giving us, and here is what you're getting in return" seems perfectly legit to me. If this interpretation of the law is correct, then the government is essentially saying the "in return" portion has to be eliminated. Which seems to be against the idea of trade.
        quadrangle 8y ago
        Are you suggesting that somehow any law is inherently wrong if it regulates trade at all? Trade is a means to the end of having healthy, productive populations. It's not something to prioritize above all else, especially in cases where trade hurts the well-being of populations. In the specific case of Facebook, near-zero of the users actually understand either what they are giving or the full extent of what they are getting or not (especially since the latter changes constantly as FB alters their policies and algorithms etc). So, it's more like "give us stuff you don't understand with ramifications you haven't thought about, and you get a complex, somewhat unpredictable, changing service." This is nothing like the theoretical trade between two participants with equal power and complete information.
        cabaalis 8y ago
mrec 8y ago
That sounds backwards to me. Mainland European legal systems are based on civil law, which heavily emphasizes letter rather than spirit. (As opposed to the common law traditions found in most of the Anglosphere.)
TheCapn 8y ago
I would be absolutely shocked if Facebook didn't have european legal professionals hired to deal with this instead of having their American lawyers try to interpret foreign law.
- vidarh 8y ago
  Maybe, but my experience with US companies is that surprisingly large companies sometimes think they'll get away with just doing stuff that's legal under US law and pretend the EU is just another US state. E.g. I spent 3 years at Yahoo (more than a decade ago now) wrangling with US product managers that found it incredibly hard to accept that the "workarounds" they kept proposing for EU requirements for payments systems were highly illegal in the European countries we operated in, as a means to cut effort. My team existed pretty much only to form a protective layer between the US payments team and the European business because the European business didn't trust them to not pull a fast one to save time, because they didn't understand the seriousness of the requirements. But in many European countries, the courts takes a very dim view on that kind of attitude.
icu 8y ago
The European regulatory view is often 'outcomes based' rather than the American 'rules based'. What I mean is that in the European approach, you might follow the rules, but fail in the outcome or 'the spirit' of the law. In that case, you have still broken the law. If you allow a gross generalisation, European regulators point to perverse outcomes in the US where morality is subverted by the law as a reason why this approach is better. There is however a much higher compliance cost in the EU than in the US due to this approach.

underko 8y ago

My guess is that GDPR is not yet in effect thus they can use this to get consent in advance. After GDPR is in place these will be changed to comply with it.

KozmoNau7 8y ago
Then they will have to ask again with a fully GDPR-compliant opt-in procedure, after the 25th. You cannot grandfather in user consent, especially not with a blatantly non-compliant procedure like this one.
Angostura 8y ago
I shall wait a couple of weeks until GDPR is in force before logging in again. That will be interesting