4 ms·
> The Yahoo! one [1] is definitely in violation of GDPR, right? I don't see any obvious reason why it would be. Yahoo! is being transparent about their data su
by lmkg 8y ago
> The Yahoo! one [1] is definitely in violation of GDPR, right?
I don't see any obvious reason why it would be. Yahoo! is being transparent about their data sub-processors, and letting you control how and with whom your data is shared. That's what GDPR says on the tin.
If there's an argument to be made, it's around the Principle of Data Minimization. But that's one of those subjective things. And, considering the size and scope of Yahoo!, it's not inconceivable they have legitimate (scare-quotes optional) uses for all those sub-processors.
- adtac 8y agoOh, it's perfectly fine to have as many sub-processors as they want. But default opt-in is non-compliant; if I understand the regulation correctly, the user has to manually opt into every processor. An opt-out dark pattern is specifically prohibited in GDPR.
- lmkg 8y agoDepends on what those dials actually represent (the screenshot is blurry for me). If the legal basis for the sub-processors is Legitimate Interest, then consent isn't required and the dials represent a Right to Erasure request. That would all be above-board and legit. If the legal basis is Consent, then you are correct, it must be opt-in rather than opt-out.