3 ms·

The Yahoo! one [1] is definitely in violation of GDPR, right? GDPR doesn't cover me as I'm neither in the EU nor am I an EU citizen, so I really hope someone le

by adtac 8y ago

The Yahoo! one [1] is definitely in violation of GDPR, right? GDPR doesn't cover me as I'm neither in the EU nor am I an EU citizen, so I really hope someone lets the regulators know about this. The first major penalty will be example setting. Which made me curious: could a service exist where citizens not covered by GDPR submit complaints, so that a GDPR-covered citizen could put the complaint in formally? [1] Hidden opt-out is non-compliant, but Yahoo! went ahead and opted you in to a hundred different ad services automatically: http://gdprhallofshame.com/content/images/2018/05/ouch.jpg http://gdprhallofshame.com/content/images/2018/05/ouch.jpg

detuur 8y ago
Yahoo is bad, especially concerning the opt-in, but by far not the worst. Those are Google and Facebook, which have made all of their services "all-or-nothing". If you don't accept every single bit of data processing, your only alternative is to delete your account. Literally runs counter to everything the GDPR stands for.
- ioulian 8y ago
  You are right, no "normal" person would want to delete their google/facebook account, so they just "accept" the tracking. I mean, if you already have a android phone, NEST and use google everyday, would you want to delete your account? You can live without facebook, but google makes a lot of hardware that is quite useful. Let see how it all ends :D
- aeorgnoieang 8y ago
  > Literally runs counter to everything the GDPR stands for. If the idea is that no one should be able to avoid complying with the GDPR, even if they decide they no longer want to do business with whomever it is exactly that's covered by it, then maybe the whole thing was a bad tradeoff. I'll grant that Google and Facebook might be acting in bad faith – hell, I'll just assume they are – but surely, for some not-necessarily-insignificant number of other entities, it should be perfectly fine if they decide that the costs of compliance exceed the corresponding benefits.
lmkg 8y ago
> The Yahoo! one [1] is definitely in violation of GDPR, right? I don't see any obvious reason why it would be. Yahoo! is being transparent about their data sub-processors, and letting you control how and with whom your data is shared. That's what GDPR says on the tin. If there's an argument to be made, it's around the Principle of Data Minimization. But that's one of those subjective things. And, considering the size and scope of Yahoo!, it's not inconceivable they have legitimate (scare-quotes optional) uses for all those sub-processors.
- adtac 8y ago
  Oh, it's perfectly fine to have as many sub-processors as they want. But default opt-in is non-compliant; if I understand the regulation correctly, the user has to manually opt into every processor. An opt-out dark pattern is specifically prohibited in GDPR.
  - lmkg 8y ago
    Depends on what those dials actually represent (the screenshot is blurry for me). If the legal basis for the sub-processors is Legitimate Interest, then consent isn't required and the dials represent a Right to Erasure request. That would all be above-board and legit. If the legal basis is Consent, then you are correct, it must be opt-in rather than opt-out.
zamazingo 8y ago
> The Yahoo! one [1] is definitely in violation of GDPR, right? They either made it much worse after the author did the screenshots, or it was already extremely bad --that I could not find the link to open up that huge list of third parties. I clicked on all the links I could find in that screen except for that huge 'I Agree' button.

by adtac 8y ago

detuur 8y ago

Yahoo is bad, especially concerning the opt-in, but by far not the worst. Those are Google and Facebook, which have made all of their services "all-or-nothing". If you don't accept every single bit of data processing, your only alternative is to delete your account. Literally runs counter to everything the GDPR stands for.

ioulian 8y ago
You are right, no "normal" person would want to delete their google/facebook account, so they just "accept" the tracking. I mean, if you already have a android phone, NEST and use google everyday, would you want to delete your account? You can live without facebook, but google makes a lot of hardware that is quite useful. Let see how it all ends :D
aeorgnoieang 8y ago
> Literally runs counter to everything the GDPR stands for. If the idea is that no one should be able to avoid complying with the GDPR, even if they decide they no longer want to do business with whomever it is exactly that's covered by it, then maybe the whole thing was a bad tradeoff. I'll grant that Google and Facebook might be acting in bad faith – hell, I'll just assume they are – but surely, for some not-necessarily-insignificant number of other entities, it should be perfectly fine if they decide that the costs of compliance exceed the corresponding benefits.

lmkg 8y ago

> The Yahoo! one [1] is definitely in violation of GDPR, right? I don't see any obvious reason why it would be. Yahoo! is being transparent about their data sub-processors, and letting you control how and with whom your data is shared. That's what GDPR says on the tin. If there's an argument to be made, it's around the Principle of Data Minimization. But that's one of those subjective things. And, considering the size and scope of Yahoo!, it's not inconceivable they have legitimate (scare-quotes optional) uses for all those sub-processors.

adtac 8y ago
Oh, it's perfectly fine to have as many sub-processors as they want. But default opt-in is non-compliant; if I understand the regulation correctly, the user has to manually opt into every processor. An opt-out dark pattern is specifically prohibited in GDPR.
- lmkg 8y ago
  Depends on what those dials actually represent (the screenshot is blurry for me). If the legal basis for the sub-processors is Legitimate Interest, then consent isn't required and the dials represent a Right to Erasure request. That would all be above-board and legit. If the legal basis is Consent, then you are correct, it must be opt-in rather than opt-out.

zamazingo 8y ago

> The Yahoo! one [1] is definitely in violation of GDPR, right? They either made it much worse after the author did the screenshots, or it was already extremely bad --that I could not find the link to open up that huge list of third parties. I clicked on all the links I could find in that screen except for that huge 'I Agree' button.