4 ms·

Do these notifications actually help with GDPR compliance or are they just a CYA for the websites?

gruez 8y ago
they were around before GDPR: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
Cthulhu_ 8y ago
Definitely cover your ass, given how the fines are instant bankruptcy for a lot of companies. I'm inclined to believe this + the cookie banners are also a lot of "well site X did it like that, we probably should do that as well" instead of reading and understanding the actual rules. The easy way out would of course be to not violate the GDPR, but with 3rd party advertisers that's a bit painful. I still don't know why big publishers don't just own the ads themselves, that is, have an ad department, have them approve ads and return statistics to the advertisers, have tracking all on the same domain, etc.
Rjevski 8y ago
GDPR compliance requires opt-out, so cookie notifications are useless as far as compliance now. If you don't/can't comply, then you might as well not mention cookies at all - in both cases you're in breach of GDPR but at least you won't be ruining your UX.
- PeterisP 8y ago
  GDPR compliance can not be done by opt-out, if consent is required, it requires opt-in - recital 32 (https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/) "Consent should be given by a clear affirmative act [...]", "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." No matter what your notifications and T&C says, the default UX path where the user clicks "meh, whatever, go on" until the popup disappears won't give the site any legal consent to use data because informed, specific, freely given opt-in consent didn't happen.
xg15 8y ago
Given that (from my IANAL understanding) the GDPR requires opt-in and forbids "click I accept or leave our service" style forced opt-in, I'd say this is not even CYA - it's closer to magical cargo cult incantations.
- etatoby 8y ago
  > the GDPR requires opt-in and forbids "click I accept or leave our service" That's an asinine law if I ever saw one. Telling me how I should run my business? Really? From what vantage point, if I may ask? If I had a company, I would ignore the whole thing and invite them to cross the pond and try their crap in my jurisdiction, under my laws. Or just block them altogether. If they want to go back to the middle ages, let them.
  - xg15 8y ago
    It's called "regulation". Yes, I think, the GDPR is quite opinionated in that they want to discourage "pay with your data"/"surveillance capitalism" type business models - the reasons have been discussed enough in the last years. I guess the authors understood that without that clause, there would be an obvious loophole that would indeed lead to nothing more than annoying pop-ups and reduce the desired consumer choice to name-only. So they took the logical step to close the loophole. Of course many businesses are trying to counter with a pop-up anyway. But then, that's not the fault of the regulation.
PeterisP 8y ago
IMHO not really, GDPR isn't really about (and thus can't be satisfied by) notifications and click-OK-to-continue "consent". For the common use cases of data by random websites, there really are two common scenarios GDPR-wise: 1) Whatever you're (not) doing with the user data falls under one of the multiple GDPR valid reasons for use that do not require user consent: in this case a clear and informative description in an easily accessible privacy policy is sufficient, and the notification/"agreement" isn't needed for GDPR compliance, the popup is useless. 2) Whatever you want to do with user data requires user consent, but you're not going to get GDPR-valid (informed, specific, freely given and opt-in) consent. There are specific sites that can get meaningful consent because users really want it (e.g. genealogy sites come to mind), but for the random "we want to track you for advertising purposes and share it with 200 third parties", it's not realistic. And the popups don't (can't) help you with that. A popup that allows you to opt out... well, if it's not opt-in, the consent isn't valid in the first place; if the user goes "meh, whatever", then that doesn't count as opt-in consent. If the user is required to "agree" to continue, then that doesn't count as freely given consent. If the user isn't clearly told everything before they intentionally opt-in to every single use case because they want you to do that particular thing, then that doesn't count as specific, informed consent. If you do implement all these things properly, then most users aren't going to opt-in in the "ad-tracking" scenario (which is the GDPR intended result), so companies don't want to implement it properly. So the nasty popup doesn't really grant you consent anyway (the process is inevitably missing at least one of these key criteria for valid consent), so GDPR-wise it's useless anyway.

they were around before GDPR: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

Cthulhu_ 8y ago

Definitely cover your ass, given how the fines are instant bankruptcy for a lot of companies. I'm inclined to believe this + the cookie banners are also a lot of "well site X did it like that, we probably should do that as well" instead of reading and understanding the actual rules. The easy way out would of course be to not violate the GDPR, but with 3rd party advertisers that's a bit painful. I still don't know why big publishers don't just own the ads themselves, that is, have an ad department, have them approve ads and return statistics to the advertisers, have tracking all on the same domain, etc.

Rjevski 8y ago

GDPR compliance requires opt-out, so cookie notifications are useless as far as compliance now. If you don't/can't comply, then you might as well not mention cookies at all - in both cases you're in breach of GDPR but at least you won't be ruining your UX.

PeterisP 8y ago
GDPR compliance can not be done by opt-out, if consent is required, it requires opt-in - recital 32 (https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/) "Consent should be given by a clear affirmative act [...]", "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." No matter what your notifications and T&C says, the default UX path where the user clicks "meh, whatever, go on" until the popup disappears won't give the site any legal consent to use data because informed, specific, freely given opt-in consent didn't happen.

xg15 8y ago

Given that (from my IANAL understanding) the GDPR requires opt-in and forbids "click I accept or leave our service" style forced opt-in, I'd say this is not even CYA - it's closer to magical cargo cult incantations.

etatoby 8y ago
> the GDPR requires opt-in and forbids "click I accept or leave our service" That's an asinine law if I ever saw one. Telling me how I should run my business? Really? From what vantage point, if I may ask? If I had a company, I would ignore the whole thing and invite them to cross the pond and try their crap in my jurisdiction, under my laws. Or just block them altogether. If they want to go back to the middle ages, let them.
- xg15 8y ago
  It's called "regulation". Yes, I think, the GDPR is quite opinionated in that they want to discourage "pay with your data"/"surveillance capitalism" type business models - the reasons have been discussed enough in the last years. I guess the authors understood that without that clause, there would be an obvious loophole that would indeed lead to nothing more than annoying pop-ups and reduce the desired consumer choice to name-only. So they took the logical step to close the loophole. Of course many businesses are trying to counter with a pop-up anyway. But then, that's not the fault of the regulation.

PeterisP 8y ago

IMHO not really, GDPR isn't really about (and thus can't be satisfied by) notifications and click-OK-to-continue "consent". For the common use cases of data by random websites, there really are two common scenarios GDPR-wise: 1) Whatever you're (not) doing with the user data falls under one of the multiple GDPR valid reasons for use that do not require user consent: in this case a clear and informative description in an easily accessible privacy policy is sufficient, and the notification/"agreement" isn't needed for GDPR compliance, the popup is useless. 2) Whatever you want to do with user data requires user consent, but you're not going to get GDPR-valid (informed, specific, freely given and opt-in) consent. There are specific sites that can get meaningful consent because users really want it (e.g. genealogy sites come to mind), but for the random "we want to track you for advertising purposes and share it with 200 third parties", it's not realistic. And the popups don't (can't) help you with that. A popup that allows you to opt out... well, if it's not opt-in, the consent isn't valid in the first place; if the user goes "meh, whatever", then that doesn't count as opt-in consent. If the user is required to "agree" to continue, then that doesn't count as freely given consent. If the user isn't clearly told everything before they intentionally opt-in to every single use case because they want you to do that particular thing, then that doesn't count as specific, informed consent. If you do implement all these things properly, then most users aren't going to opt-in in the "ad-tracking" scenario (which is the GDPR intended result), so companies don't want to implement it properly. So the nasty popup doesn't really grant you consent anyway (the process is inevitably missing at least one of these key criteria for valid consent), so GDPR-wise it's useless anyway.