3 ms·

Well, in France yes already (and the links are in French, basically the first one is about a basic hack where you could change the id of the user in the URL of

by jarnix 8y ago

Well, in France yes already (and the links are in French, basically the first one is about a basic hack where you could change the id of the user in the URL of the current page to get others users' invoices -no comment-, and the second one because the users could not decide what cookies could be stored on their computers, they did not offer any choice eg through a CMP or something else) Optical Center : 250 k€ https://www.clubic.com/rgpd/actualite-844065-sanction-rgpd-premier-degat-250-000-optical-center.html https://www.clubic.com/rgpd/actualite-844065-sanction-rgpd-p... Challenges.fr : 25 k€ https://www.legalis.net/actualite/le-conseil-detat-confirme-la-sanction-de-challenges-fr-pour-ses-cookies/ https://www.legalis.net/actualite/le-conseil-detat-confirme-...

jiveturkey 8y ago
magnifique!
IdontRememberIt 8y ago
Will the interpretation depend on the country until someone raises the case to the highest court? Do we have to check the precedent of all European countries?
0x4f3759df 8y ago
The first one frames it as lucky because the fine could have been 20mil€...
scoom 8y ago
Users always can decide what cookies can be stored on their computers - Europe is braindead on this issue.
- genericid 8y ago
  They can't. It may be technically possible, but users can't. Even for power users it's a pain in the ass.
  - delian66 8y ago
    Yes, they can. You are simply wrong.
- shabble 8y ago
  How do I allow this site to set the 'user' cookie, but not the '_cfuid' one? Since Cloudflare is proxying, both cookies are first-party. FF61 on Mac. Solutions for Chrome would also be interesting. Note that I specifically don't want 'self destructing cookies' or session- or time-limited ones. I just want to white/blacklist by site, cookie name, and perhaps cookie content. I've briefly looked for suitable extensions, but not yet found anything.
donthavekeepass 8y ago
These links are misleading as neither of those fines was imposed based on GDPR: The first article says that the fine was imposed based on a national law due to a data breach in 2017 (and says that the fine could’ve been higher now under GDPR), the fine in the second article was handed out based ePrivacy / Cookie legislation. Neither of those are directly related to GDPR, although the first case would also be punishable under it (but wasn’t when it happened). I would’ve been surprised if the authorities had handed out fines that fast, as they usually need to give companies a reasonable amount of time to fix problems after they are revealed.

by jarnix 8y ago

jiveturkey 8y ago

magnifique!

IdontRememberIt 8y ago

Will the interpretation depend on the country until someone raises the case to the highest court? Do we have to check the precedent of all European countries?

0x4f3759df 8y ago

The first one frames it as lucky because the fine could have been 20mil€...

scoom 8y ago

Users always can decide what cookies can be stored on their computers - Europe is braindead on this issue.

genericid 8y ago
They can't. It may be technically possible, but users can't. Even for power users it's a pain in the ass.
- delian66 8y ago
  Yes, they can. You are simply wrong.
shabble 8y ago
How do I allow this site to set the 'user' cookie, but not the '_cfuid' one? Since Cloudflare is proxying, both cookies are first-party. FF61 on Mac. Solutions for Chrome would also be interesting. Note that I specifically don't want 'self destructing cookies' or session- or time-limited ones. I just want to white/blacklist by site, cookie name, and perhaps cookie content. I've briefly looked for suitable extensions, but not yet found anything.

donthavekeepass 8y ago

These links are misleading as neither of those fines was imposed based on GDPR: The first article says that the fine was imposed based on a national law due to a data breach in 2017 (and says that the fine could’ve been higher now under GDPR), the fine in the second article was handed out based ePrivacy / Cookie legislation. Neither of those are directly related to GDPR, although the first case would also be punishable under it (but wasn’t when it happened). I would’ve been surprised if the authorities had handed out fines that fast, as they usually need to give companies a reasonable amount of time to fix problems after they are revealed.