6 ms·

> Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. [...] > You must ask people to actively opt in. Don’t

> Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. [...] > You must ask people to actively opt in. Don’t use pre-ticked boxes, opt-out boxes or other default settings. Source: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

ascorbic 8y ago
I address this in the FAQ. You can easily choose whether it's opt in or opt out.
- Tomte 8y ago
  So, a „GDPR-hostile Google Analytics Opt-Out button, unless you change the defaults“ Yes, I see why your marketing sense told you to choose the untruthful version.
  - ascorbic 8y ago
    I'm using it in opt-in mode myself, and I'd hope most people would too. You'll see I recommend that in the docs too. The first step is getting site owners to give any opt-in or out facility at all, which is why I didn't make that the default. I'm sorry if you think that's untruthful. I'll probably change the default based on the feedback here.
- hnarn 8y ago
  If opt-in is the only legal option, why do you default to opt-out?
  - ascorbic 8y ago
    The feedback here is pretty clear that I choose the wrong option, so I'll probably change it. The default is obviously to not install it, which gives no opt in or out at all.
    - watt 8y ago
      Please consider also I have "Do not track" option turned on in my browser preferences. This should signal that I will not consent and am willing to take the consequences: even if it means you serve a "text only" version of the site.
seszett 8y ago
Yes. While I applaud all the dialogues I have seen recently on websites allowing me to opt-out from all the tracking and personnalisation and stuff that they used to conduct covertly, it's a bit surprising that they have put this up specifically because of GDPR, but at the same time (for a very large majority of them) leave it opt-out which is clearly not compliant.
jdietrich 8y ago
The GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis. (ibid.) Anonymous data is specifically excluded from GDPR. Google Analytics provides an IP anonymization feature. If you're absolutely confident that your users can't be personally identified based on the data being sent to Google Analytics, then you don't need consent. https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/ https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/6366371?hl=en&ref_topic=2919631 https://support.google.com/analytics/answer/6366371?hl=en&re...
- Silhouette 8y ago
  There is a broader issue with web sites that incorporate external content that I haven't yet seen addressed. The moment you load a resource on your page from an external source, you lose almost all control of what the operator of that external source does with any personal data that your visitor's browser sends to them, any cookies it sends with its reply, or what it does more generally in the case of executable resources. Given that modern web sites routinely incorporate external assets for a multitude of reasons, has anyone ever found any official, authoritative guidance on who is the data controller or data processor in such cases, how they are expected to meet any obligations they have in terms of transparency and obtaining consent, or the related question of who is responsible for giving notifications or obtaining consent if required under the "cookie law"?
  - Kliment 8y ago
    The way I understand it it's extremely simple. Say you have a site. You are the contact point with the data subject, and therefore you are the controller. Anyone you subcontract spying on your users to is a data processor acting on your behalf, and therefore you are responsible for their behavior. You should have agreements in place with all your external resource providers that touch personal data. If any personal data leaks to them, you are responsible for notifying users of this and obtaining their consent if required. In most cases for external assets where no personal data is expected to flow to the asset provider (say loading fonts from a CDN) it's sufficient for the asset provider to give you their assurance that they don't collect or store data from visitors you send their way. If you have an adverterrorist-operated spyware embed like most ad networks on your site, then it's your responsibility to ensure that the adverterrorists are handling the data in a compliant way, and you need to notify your users of your relationship and obtain their consent to pass their data to a third party. Just because you are using a third party to do the spying does not remove your responsibility.
_o_ 8y ago
Yes, you are right, the opt-out is violating GDPR (unless it is about changing mind after giving opt-in - this is again required and must be as easy as giving consent), you have to be preticked to "not giving consent" and user must actively click to give consent. Also you are missing explanation what giving consent means for the user including what data are used for what purpose. Watch out with GDPR, this is not cookie law, and on top of it, you can't force it for user as a condition for entering site (like Forbes is doing - they will get a complain, already beeing finalized by some privacy organisation)

ascorbic 8y ago

I address this in the FAQ. You can easily choose whether it's opt in or opt out.

Tomte 8y ago
So, a „GDPR-hostile Google Analytics Opt-Out button, unless you change the defaults“ Yes, I see why your marketing sense told you to choose the untruthful version.
- ascorbic 8y ago
  I'm using it in opt-in mode myself, and I'd hope most people would too. You'll see I recommend that in the docs too. The first step is getting site owners to give any opt-in or out facility at all, which is why I didn't make that the default. I'm sorry if you think that's untruthful. I'll probably change the default based on the feedback here.
hnarn 8y ago
If opt-in is the only legal option, why do you default to opt-out?
- ascorbic 8y ago
  The feedback here is pretty clear that I choose the wrong option, so I'll probably change it. The default is obviously to not install it, which gives no opt in or out at all.
  - watt 8y ago
    Please consider also I have "Do not track" option turned on in my browser preferences. This should signal that I will not consent and am willing to take the consequences: even if it means you serve a "text only" version of the site.

seszett 8y ago

Yes. While I applaud all the dialogues I have seen recently on websites allowing me to opt-out from all the tracking and personnalisation and stuff that they used to conduct covertly, it's a bit surprising that they have put this up specifically because of GDPR, but at the same time (for a very large majority of them) leave it opt-out which is clearly not compliant.

jdietrich 8y ago

The GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis. (ibid.) Anonymous data is specifically excluded from GDPR. Google Analytics provides an IP anonymization feature. If you're absolutely confident that your users can't be personally identified based on the data being sent to Google Analytics, then you don't need consent. https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/ https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/6366371?hl=en&ref_topic=2919631 https://support.google.com/analytics/answer/6366371?hl=en&re...

Silhouette 8y ago
There is a broader issue with web sites that incorporate external content that I haven't yet seen addressed. The moment you load a resource on your page from an external source, you lose almost all control of what the operator of that external source does with any personal data that your visitor's browser sends to them, any cookies it sends with its reply, or what it does more generally in the case of executable resources. Given that modern web sites routinely incorporate external assets for a multitude of reasons, has anyone ever found any official, authoritative guidance on who is the data controller or data processor in such cases, how they are expected to meet any obligations they have in terms of transparency and obtaining consent, or the related question of who is responsible for giving notifications or obtaining consent if required under the "cookie law"?
- Kliment 8y ago
  The way I understand it it's extremely simple. Say you have a site. You are the contact point with the data subject, and therefore you are the controller. Anyone you subcontract spying on your users to is a data processor acting on your behalf, and therefore you are responsible for their behavior. You should have agreements in place with all your external resource providers that touch personal data. If any personal data leaks to them, you are responsible for notifying users of this and obtaining their consent if required. In most cases for external assets where no personal data is expected to flow to the asset provider (say loading fonts from a CDN) it's sufficient for the asset provider to give you their assurance that they don't collect or store data from visitors you send their way. If you have an adverterrorist-operated spyware embed like most ad networks on your site, then it's your responsibility to ensure that the adverterrorists are handling the data in a compliant way, and you need to notify your users of your relationship and obtain their consent to pass their data to a third party. Just because you are using a third party to do the spying does not remove your responsibility.

_o_ 8y ago

Yes, you are right, the opt-out is violating GDPR (unless it is about changing mind after giving opt-in - this is again required and must be as easy as giving consent), you have to be preticked to "not giving consent" and user must actively click to give consent. Also you are missing explanation what giving consent means for the user including what data are used for what purpose. Watch out with GDPR, this is not cookie law, and on top of it, you can't force it for user as a condition for entering site (like Forbes is doing - they will get a complain, already beeing finalized by some privacy organisation)