4 ms·

While GDPR in itself has accomplished the goal of raising awareness on data security and transparency, probably only temporarily, the mind numbingly idiotic pus

While GDPR in itself has accomplished the goal of raising awareness on data security and transparency, probably only temporarily, the mind numbingly idiotic push-button based consent model is an utter failure. 99% of people don't read anything before they push yes. Most people get increasingly annoyed at the mountain of e-mails, and the hundreds of pages they in principle have to read through. It's an extension of the already existing kafkaesque "press yes to allow cookies" that everyday has to be pressed multiple times with no real benefits other than wasting peoples time (at least in the EU). People are already completely over encumbered with information. The more people have to do the same thing the less they give-a-f. This carpet bombing of legal jargon makes people hate services, especially the smaller ones i am sure. "oh i don't want to deal with lots of legal contracts again". I completely agree that something has to be done about the data-mining and fingerprinting monster, but the way all of this is implemented only further exacerbates the mega-corp gardens because they can afford to hire armies of lawyers, and because people get tired of clicking "i consent" after the bare minimum has been done - which off course means only saying yes to companies highest on the Alexa ranking. Ironically these global conglomorates are the worst offenders and the original data-disaster culprit.

dbasedweeb 8y ago
99% of people don't read anything before they push yes. Most people get increasingly annoyed at the mountain of e-mails, and the hundreds of pages they in principle has to read through. No offense, but this feels like a “99%” and “most” that is something less than rigorous. I don’t think sound arguments for or against GDPR can come from the “Ah Reckon” space. Throwing out made-up numbers that just represent personal assumptions and anecdote is an impediment to real discussion of these issues. I’d add that GDPR explicitly forbids just the kind of “press yes to forfeit all of your rights” crap we’ve seen before. I realize that some sites are still trying to get away with it, it it’s non-compliant.
- ManFromUranus 8y ago
  No offense, but this feels like ivory tower obtuseness, I mean, they made a law, so of course it will get implemented EXACTLY as it was designed and nobody will abuse it ever and it will never become a monster. Laws always work and they always do what we intended them to do. We made murder illegal and now nobody gets murdered. It's just that simple. You read and understand every boilerplate contract of adhesion you've ever agreed to I'm sure, why can't these plebs simply do what you do all the time? <haughty laughter>
  - klez 8y ago
    > We made murder illegal and now nobody gets murdered No, we made murder illegal and now we have a system to deal with murderers when they kill someone. Out of analogy, we made non-consensual data collection illegal, and now we have a mean to handle the situation when it arises.
- PurpleBoxDragon 8y ago
  >No offense, but this feels like a “99%” and “most” that is something less than rigorous. I've read the contracts I have to sign, and generally this throws people off drastically. When I ask, they tell me I'm the first to read them. Things like leases at a place that has been around decades and I'm the first to sit down and read before signing. While it isn't rigorous, from my experience with wet ink legal documents, saying 1% do read EULAs and privacy policies is a very optimistic over estimation by magnitudes.
  - falcolas 8y ago
    I think that indicates that the legal documents weren't written to be read, more than people are too lazy to read them. They were written for a lawyer and for use in court, and it's not realistic to bring in a lawyer for every EULA and contract we encounter. And just as honestly, what are we going to do - say no? Saying no is more and more simply not allowed if you want to use a service. I've had job offers who would rather have me walk than change the terms of employment. There's not a website out there which allows you to use it if you do not consent to their EULA. Hell, I've encountered a EULA when starting my (purchased, not leased) car. You can't even post on Hacker News without consenting to 39 pages worth of privacy policy and TOS.
    - PurpleBoxDragon 8y ago
      And that is why I think the core of the issue is consent. The power difference between the lawyers who understand the legal system and write these documents and the users who are forced to agree to use the service is so great that consent cannot exist between the two parties. We legally allow it, much like some countries will legally let a 9 year old sign some document and then hold them to it, but that is a legal fiction that needs to be done away with. Of course this would be a massive shock to how we do things (how would you sign up for a loan), but that alone doesn't justify allowing such abuse of consent to continue.
- jkaptur 8y ago
  Here's an overview of reading on the web in general: https://www.nngroup.com/articles/how-little-do-users-read/ https://www.nngroup.com/articles/how-little-do-users-read/
- kossTKR 8y ago
  Thought it was pretty common knowledge that people don't read anything contractual. Anecdotally i have never personally witnessed any other than the most academically inclined legal nerds be interested in any terms of service or legal docs. Family, university peers, user analysis from my own services - all i have ever seen is frantic clicking until people get to where they want. Just googled and it seems i am on point: http://www.businessinsider.com/deloitte-study-91-percent-agree-terms-of-service-without-reading-2017-11?r=US&IR=T&IR=T http://www.businessinsider.com/deloitte-study-91-percent-agr... 91 percent! Also my point is not that the GDPR is stupid. I think most of the new protections are fair. I am just pointing out that the "one button click to consent" is completely meaningless because people have no idea what they are doing, are tired, are stressed out, or just don't care (most people).
- vorpalhex 8y ago
  > I’d add that GDPR explicitly forbids just the kind of “press yes to forfeit all of your rights” crap we’ve seen before. I realize that some sites are still trying to get away with it, it it’s non-compliant. I have yet to see a non-terrible GDPR screen, and I'm an American. Every single one so far has been either a giant box of doom, or a giant modal of doom with a dozen checkboxes and a freakin' contract on it. Nope, don't care, I just want to read the one paragraph of your blog - that's it.
  - cfadvan 8y ago
    The Atlantic has a great system, and it’s all opt-in as required by GDPR.
johnchristopher 8y ago
> It's an extension of the already existing kafkaesque "press yes to allow cookies" that everyday has to be pressed multiple times with no real benefits other than wasting peoples time (at least in the EU). It'd be less kafkaesque if the fucking ad industry could use a cookie to store my consent once I have given it.
m12k 8y ago
While all the 'yes I consent' buttons might be annoying (maybe even on a similar level to the inane cookie warnings) the real value of the GDPR lies in the granting people the right to recall that consent later and the companies being forced to comply. Facebook certainly wouldn't have an 'actually delete my profile' feature if they hadn't been forced to make it.
- kossTKR 8y ago
  My only gripe is with the sea of meaningless "i consent" buttons that gets increasingly diluted. Profile delete buttons, user data overview pages and the rest of GDPR i think is very welcome.
Angostura 8y ago
> 99% of people don't read anything before they push yes. Which is why defaulting to 'Accept cookies' is against the principle of the GDPR, other that for cookies vital to the running of the service.
phicoh 8y ago
If you have a dialog where the only option is to consent then either that is not real consent according to the GDPR or the consent was not really needed. In the first, you may just end up with a database for full of data that you may have to throw out when somebody complains. In the second case, why bother your users? If there is a real request to consent, then it is easy enough to decline. But so far, real requests for consent are quite rare. Most dialogs are basically: we are going to feed you cookies and violate your privacy; do you want to agree now or later?
maccard 8y ago
> 99% of people don't read anything before they push yes Unfortunately the option of reading something isn't always reasonable. Check out Ultimate Guitar [0]. Clicking "Manage my choices" gives a list of just shy of 250 vendors, and no explanation as to what or where they're sharing with those vendors. Other websites have longer lists, and have an opt-out per vendor!! These websites are deliberately making it as difficult as possible to reasonable manage your data. [0] https://www.ultimate-guitar.com/ https://www.ultimate-guitar.com/
Marysville 8y ago
But now you also have. "No I do not consent" buttons. If people are tired of it, they should just stick with 'No'.
- maccard 8y ago
  No, you have "Click Here to manage your settings" with 10 different pop ups and laundry lists of people you can opt out of having your data shared with. Some of those require you to disable cookies to opt out of their collection too, rather than allowing you to opt out via them.

dbasedweeb 8y ago

99% of people don't read anything before they push yes. Most people get increasingly annoyed at the mountain of e-mails, and the hundreds of pages they in principle has to read through. No offense, but this feels like a “99%” and “most” that is something less than rigorous. I don’t think sound arguments for or against GDPR can come from the “Ah Reckon” space. Throwing out made-up numbers that just represent personal assumptions and anecdote is an impediment to real discussion of these issues. I’d add that GDPR explicitly forbids just the kind of “press yes to forfeit all of your rights” crap we’ve seen before. I realize that some sites are still trying to get away with it, it it’s non-compliant.

ManFromUranus 8y ago
No offense, but this feels like ivory tower obtuseness, I mean, they made a law, so of course it will get implemented EXACTLY as it was designed and nobody will abuse it ever and it will never become a monster. Laws always work and they always do what we intended them to do. We made murder illegal and now nobody gets murdered. It's just that simple. You read and understand every boilerplate contract of adhesion you've ever agreed to I'm sure, why can't these plebs simply do what you do all the time? <haughty laughter>
- klez 8y ago
  > We made murder illegal and now nobody gets murdered No, we made murder illegal and now we have a system to deal with murderers when they kill someone. Out of analogy, we made non-consensual data collection illegal, and now we have a mean to handle the situation when it arises.
PurpleBoxDragon 8y ago
>No offense, but this feels like a “99%” and “most” that is something less than rigorous. I've read the contracts I have to sign, and generally this throws people off drastically. When I ask, they tell me I'm the first to read them. Things like leases at a place that has been around decades and I'm the first to sit down and read before signing. While it isn't rigorous, from my experience with wet ink legal documents, saying 1% do read EULAs and privacy policies is a very optimistic over estimation by magnitudes.
- falcolas 8y ago
  I think that indicates that the legal documents weren't written to be read, more than people are too lazy to read them. They were written for a lawyer and for use in court, and it's not realistic to bring in a lawyer for every EULA and contract we encounter. And just as honestly, what are we going to do - say no? Saying no is more and more simply not allowed if you want to use a service. I've had job offers who would rather have me walk than change the terms of employment. There's not a website out there which allows you to use it if you do not consent to their EULA. Hell, I've encountered a EULA when starting my (purchased, not leased) car. You can't even post on Hacker News without consenting to 39 pages worth of privacy policy and TOS.
  - PurpleBoxDragon 8y ago
    And that is why I think the core of the issue is consent. The power difference between the lawyers who understand the legal system and write these documents and the users who are forced to agree to use the service is so great that consent cannot exist between the two parties. We legally allow it, much like some countries will legally let a 9 year old sign some document and then hold them to it, but that is a legal fiction that needs to be done away with. Of course this would be a massive shock to how we do things (how would you sign up for a loan), but that alone doesn't justify allowing such abuse of consent to continue.
jkaptur 8y ago
Here's an overview of reading on the web in general: https://www.nngroup.com/articles/how-little-do-users-read/ https://www.nngroup.com/articles/how-little-do-users-read/
kossTKR 8y ago
Thought it was pretty common knowledge that people don't read anything contractual. Anecdotally i have never personally witnessed any other than the most academically inclined legal nerds be interested in any terms of service or legal docs. Family, university peers, user analysis from my own services - all i have ever seen is frantic clicking until people get to where they want. Just googled and it seems i am on point: http://www.businessinsider.com/deloitte-study-91-percent-agree-terms-of-service-without-reading-2017-11?r=US&IR=T&IR=T http://www.businessinsider.com/deloitte-study-91-percent-agr... 91 percent! Also my point is not that the GDPR is stupid. I think most of the new protections are fair. I am just pointing out that the "one button click to consent" is completely meaningless because people have no idea what they are doing, are tired, are stressed out, or just don't care (most people).
vorpalhex 8y ago
> I’d add that GDPR explicitly forbids just the kind of “press yes to forfeit all of your rights” crap we’ve seen before. I realize that some sites are still trying to get away with it, it it’s non-compliant. I have yet to see a non-terrible GDPR screen, and I'm an American. Every single one so far has been either a giant box of doom, or a giant modal of doom with a dozen checkboxes and a freakin' contract on it. Nope, don't care, I just want to read the one paragraph of your blog - that's it.
- cfadvan 8y ago
  The Atlantic has a great system, and it’s all opt-in as required by GDPR.

johnchristopher 8y ago

> It's an extension of the already existing kafkaesque "press yes to allow cookies" that everyday has to be pressed multiple times with no real benefits other than wasting peoples time (at least in the EU). It'd be less kafkaesque if the fucking ad industry could use a cookie to store my consent once I have given it.

m12k 8y ago

While all the 'yes I consent' buttons might be annoying (maybe even on a similar level to the inane cookie warnings) the real value of the GDPR lies in the granting people the right to recall that consent later and the companies being forced to comply. Facebook certainly wouldn't have an 'actually delete my profile' feature if they hadn't been forced to make it.

kossTKR 8y ago
My only gripe is with the sea of meaningless "i consent" buttons that gets increasingly diluted. Profile delete buttons, user data overview pages and the rest of GDPR i think is very welcome.

Angostura 8y ago

> 99% of people don't read anything before they push yes. Which is why defaulting to 'Accept cookies' is against the principle of the GDPR, other that for cookies vital to the running of the service.

phicoh 8y ago

If you have a dialog where the only option is to consent then either that is not real consent according to the GDPR or the consent was not really needed. In the first, you may just end up with a database for full of data that you may have to throw out when somebody complains. In the second case, why bother your users? If there is a real request to consent, then it is easy enough to decline. But so far, real requests for consent are quite rare. Most dialogs are basically: we are going to feed you cookies and violate your privacy; do you want to agree now or later?

maccard 8y ago

> 99% of people don't read anything before they push yes Unfortunately the option of reading something isn't always reasonable. Check out Ultimate Guitar [0]. Clicking "Manage my choices" gives a list of just shy of 250 vendors, and no explanation as to what or where they're sharing with those vendors. Other websites have longer lists, and have an opt-out per vendor!! These websites are deliberately making it as difficult as possible to reasonable manage your data. [0] https://www.ultimate-guitar.com/ https://www.ultimate-guitar.com/

Marysville 8y ago

But now you also have. "No I do not consent" buttons. If people are tired of it, they should just stick with 'No'.

maccard 8y ago
No, you have "Click Here to manage your settings" with 10 different pop ups and laundry lists of people you can opt out of having your data shared with. Some of those require you to disable cookies to opt out of their collection too, rather than allowing you to opt out via them.