4 ms·
(For background, I was responsible for figuring out GDPR compliance in a past job, so I've picked through the literal text and a lot of interpretations of it.)
by munchbunny 8y ago
(For background, I was responsible for figuring out GDPR compliance in a past job, so I've picked through the literal text and a lot of interpretations of it.)
I think there's a spectrum, but I think the vast majority of the cookie notices I've encountered have been implemented in a sneaky way that runs counter to the spirit of the law.
The spirit of the law is that sites should explain how the data is used in a way that the layperson can understand, and it should be clear to the layperson that (in most cases) the site is legally obligated to give you a way to say "no."
As it stands, most GDPR notices give you a choice between "OK" and "more info" (where the "no" option is hidden) or between "Yes" and a subtle X in the upper left (because upper right would be too obvious). And they don't tell you that by clicking "Yes", you are consenting to having your information brokered and sold to innumerable advertisers.
I think that's a dirty UX trick, and that for the purposes of getting consent the "no" button actually should be an obvious "no" button.
The reason the badge isn't possible is that GDPR did the right thing to enforce privacy by default, and all of the sites that want to monetize your data for advertising have to get your explicit consent. So you get all of these notices because they have to and want to ask you. Were it not for advertising, you GDPR would have been a pretty peaceful transition with a few exceptions like "oh yeah we keep crash reports, you're okay with that right?"
- gregopet 8y agoGiven how hostile some content providers are towards the GDPR I always assumed pressing X means they will violate the law and store my data anyway. I mean, most of them already violate that clause where consent for advertising or tracking should be opt-in, not opt-out. X implying consent is just an extension of that.
- ankit219 8y agoAdd to it that most sites make it impossible for you to use the site without enabling cookies or if you dont consent to them storing cookies.
- munchbunny 8y agoGDPR actually draws a reasonable line for this. Using cookies to remember your login or browser sessionis fine, and you can probably not even ask to do this. Analytics is a bit trickier, but as long as the data is aggregated and no "personal data" is collected, you're on the safe side of the gray area. The problem is that using cookies for advertising does require you to ask, so how do you conflate the two? I've seen some sites phrase it like "we use cookies to personalize your experience". You can interpret that to mean session cookies, but you can also interpret that to mean marketing. I hope EU regulators end up actually going after people for doing sneaky crap like this.
- ankit219 8y agoIndirectly the solution/workaround the sites have come up with is saying, "if you want to use our site, you will have to agree to our cookie settings. Else don't use the site." I have cookies disabled by default. Whenever a site does not work without cookies (news sites, travel sites, and blog sites especially), I open them in a guest mode. Still feel, its a bit tedious thing to do, but works for me.
- munchbunny 8y agoThe irony of course is that GDPR actually forbids this sort of "all or nothing" deal under specific circumstances. But it's a gray area, so sites just say "accept how we use cookies." Oh well, it's still better than before.
- namibj 8y agoActually it's really hard to argue informed consent with this. The regulators could easily slap them for that, if they'd want to.
- deleted 8y ago[deleted]