6 ms·

I think that currently pretty much every service, device and website violates the GDPR. The GDPR requires consent or some other legitimate reason to store data

by TekMol 8y ago

I think that currently pretty much every service, device and website violates the GDPR. The GDPR requires consent or some other legitimate reason to store data about a person. I see dark patterns everywhere. I never give consent. But I get tracked to death everywhere all the time. Even before I touch anything on a website, it plants dozens of cookies on my machine. But cookies are not even the problem. Fingerprinting is. When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads. Even though I don't store cookies on any of them. Additionally, the web turned into an arcade game. The user has to rapid fire click away 'OK', 'I AGREE', 'I CONSENT', 'I UNDESTAND' buttons. He is not giving consent. He is just trying to get through this pile of nonsense to reach the content.

Swenrekcah 8y ago
The differece is that now it is explicitly illegal. I suspect after some grace period the most severe violations will start to get prosecuted and then I expect respectable companies to reconsider their tracking.
cm2012 8y ago
The user has the option to not get through the "pile of nonsense" and just close the website. The fact that the user does not should tell you something. Unless you think every website should force the user to go through a 15 minute webinar to help them specifically understand privacy policies before letting them browse the website?
- llampx 8y ago
  If the website was not tracking your every move and then selling the relevant bits to ad exchanges, they wouldn't need to do the 15 minute webinars.
- jonbronson 8y ago
  The lesson to companies should be, don't provide a Hobson's choice up front like this. Offer the webpage you meant to offer, and simply don't try to nickel and dime all the data out of your visitors.
  - cm2012 8y ago
    It's not like content producing companies are these super profitable behemoths that are just greedy for $1 more. Not using ad trackers would your reduce your revenue by 50% at the minimum - it's how scaled advertisers spend money, if you're not doing it, you're not getting those advertisers. It is indeed a Hobson's choice - do it or stop providing whatever content it is the reader wants.
    - Kim_Bruning 8y ago
      Am I the only person who liked the web a lot better before it encountered its own Eternal September? I'm not trying to be snarky! It's just that I'm not actually sure I like the direction the web took, and I'm not sure these "content producing companies" are indeed a net positive. Perhaps forcing a lot of (the more shady) commercial activity off of the web is actually the best thing that could happen. (Though they probably wouldn't leave quietly)
      - cm2012 8y ago
        If you don't like the new direction the web took and don't think any of the content with ads is valuable, then by all means don't use. But don't force me to stop reading the NYT or Twitter.
        Kim_Bruning 8y ago
        No one is stopping you from reading the NYT or twitter. But let them compete without the distortion of (ab)using quite so much Personally Identifying Information, and see if you'd still be happy to!
  - Sargos 8y ago
    So just kill the free and open internet and bring back the walled garden model of the mid 90s where you paid for website packages like you did for cable TV? That's not a future I want to live in. Europe is playing a dangerous game with the internet right now and I don't think they have enough tech-minded people in power to keep things sane and in check.
- xg15 8y ago
  Except, in today's internet that would mean pretty much not using the internet at all. Which - in today's society - would mean a greatly handicapped social life at least and would be plain impossible for many people who need to use those sites to do their job. So yes, technically you're right. As Discworld's Vetinari said, you always have a choice, even if that choice is between agreeing to the deal or being thrown into a spiked pit.
superfrank 8y ago
Anecdotally, pretty much every developer I've talked to about GDPR says in one way or another, their company has some sort of GDPR violation. It's pretty much the same story every time, there was a big scramble to fix any clear violations, but because GDPR was a bit vague, there are a lot of gray area violations that are still being cleaned up.
deleted 8y ago
[deleted]
Xcelerate 8y ago
> He is not giving consent. He is just trying to get through this pile of nonsense to reach the content. Then don’t access the content? Why should the user get content that someone has worked to create without having to give anything in return (whether that’s in the form of payment or information). There would be no monetary incentive to create content anymore.
- jklinger410 8y ago
  The faux-progressive modern perspective is to consider ostensibly true things as literally true.
  - throwawaymath 8y ago
    Do you mind dumbing this down a bit for me? What you wrote has gone completely over my head here. What is "faux-progressive modern" and what is the thing being considered true even if it's only "ostensibly true"?
    - deleted 8y ago
      [deleted]
  - Xcelerate 8y ago
    Yeah, I’m confused about what you’re trying to say as well. I can’t tell if you’re in favor of or against my argument.
- TekMol 8y ago
  I'm not talking about ethics or business models. I just say that pretty much every site, device and service out there violates the primary rule of the GDPR. They all store data about their users without the users consent. One of the main points of the GDPR is that the user has to actively agree to storage of data. Making it very clear that storing can not be the default. Yet when you visit the New York Times today, they tell you: By clicking "I Accept" or "X" on this banner, or using our site, you consent to the use of cookies unless you have disabled them. In one form or another every site, service and device out there is doing exactly this. Making it the default to store data about the user.
Maarten88 8y ago
Yes, every website now asks for consent to "use cookies" because GDPR "requires us to to ask this". These are weasel words, there is absolutely NO NEED to ask for this. The word "cookie" occurs only once in the GDPR directive text, in a list of examples of personally identifiable data, next to "IP address". Yet no site ever asks me for permission to use my ip address, somehow. The GDPR does have a requirement to ask for consent to do things like tracking my interests/behavior on a site and sending it to marketing data companies for specificly named purposes. I have yet to find the first website that uses plain language when asking for consent, and I can't wait for the first fines to be handed out.
- RandallBrown 8y ago
  The cookie law predates GDPR by quite a bit doesn't it?
  - wnevets 8y ago
    they certainly started popping up everywhere long before the GDPR
  - nicolaslem 8y ago
    Yes but there is a work in progress to replace the cookie law with the more GDPR aware ePrivacy regulation. https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_Union) https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...
bad_user 8y ago
> I think that currently pretty much every service, device and website violates the GDPR. Not really, my website doesn't :-) In case you're using Google Analytics, it's easy to make it compliant, you just activate IP anonymization, which you had to do anyway, out of common sense and because tracking by IP without consent was illegal anyway in countries like Germany. [1] https://support.google.com/analytics/answer/2763052 https://support.google.com/analytics/answer/2763052 [2] https://developers.google.com/analytics/devguides/collection/analyticsjs/ip-anonymization https://developers.google.com/analytics/devguides/collection... > When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads. Yes, I saw this behavior too, but I like to think that many businesses are not as unscrupulous. But I do take care of my privacy as an ongoing investment ... I'm Google free, I sandbox Facebook, I use privacy blockers, VPN, the works. GDPR is IMO a godsend. I'm sure the cost will be high for many companies, but that's just karma.
- gowld 8y ago
  > I'm sure the cost will be high for many companies, but that's just karma. What about for companies that do handle user data responsibly, but have trouble with the formal compliance costs?
  - Spearchucker 8y ago
    Not sure what your question is. If they handle data responsibly they're already compliant, no? In which case what compliance costs do such companies face?
  - sincerely 8y ago
    If you want to "handle user data" in any way but can't afford the formal compliance costs, then one less company is hoovering up user data. I don't see the problem.
  - bad_user 8y ago
    If the company handled user data responsibly already, it means the company was already respecting the privacy laws already in place in major European countries, Australia, etc and GDPR compliance shouldn't cost anything. There's also no such thing as responsible data handling for services tracking users without their consent. If no explicit consent was given, consent obtained with a layman explanation and with no dark patterns, then it shouldn't be legal. The problem often isn't how the data ends up being used, the problem is that the data is collected in the first place.
Meai 8y ago
I had some legitimately scary things that may or may not be tracking but I cannot explain it without tracking. I watch some youtube video where the audio mentions a historic place of battle and then seconds later it shows up in my Google Chrome autosuggestion because I wanted to google some more information on it. I dont see how that is possible, it was a very specific location. I only typed "battle of" and it showed me the exact battle that was just mentioned in the video. I dont see how that is possible unless Google has transcribed the audio of all the videos automatically and uses it for search suggestions. It was nothing I ever searched before, in fact I searched many many other battles and places before that one so it would make more sense for it to show me something I searched previously.
- Drakim 8y ago
  Google may have data that a lot of users searched for "battle of X" right after watching this particular youtube.
- aaaaaaaaaab 8y ago
  Ummm, google does transcribe the audio of all the videos automatically. That’s how they have subtitles for all videos (sometimes with hilarious results).
- lallysingh 8y ago
  It's only creepy if you believe you're the only consumer. Say when others watch that video, they search for "battle of whatever-you're-talking-about". They do the hard work. As for you watching a video and autocomplete coming in with the same topic, could it be that there was a surge of interest of that battle at the time? Otherwise it may be url analysis from other people searching through chrome.
- hnna12 8y ago
  I cannot prove anything but for the screenshot I took in utter shock, but I very recently started suffering headaches at night that cause the one side of my nose to completely block and generally make a mess of my sinuses. I had never spoken about it to anyone, searched for it online or otherwise had any similar problems before. One night I had a headache start while watching a video on YouTube with my iPhone so I put the phone down, video paused, on the side and spent the next hour sniffing and generally making some horrible sinus related noises. I woke the next morning, picked up the phone and finished the video. On going back to the recommendations, between physics talks and movie reviews was a video by a doctor about “instant sinus drainage”. Nothing else was in the recommendations like that — just one out of place yet creepily relevant video. I just didn’t believe these kinds of stories until then. I cannot fathom the sheer precision, relevance and timing. The only responses I’ve had about this are like “you must have searched x, or done y” and the reply is no, I really have not, honest to God, and I live alone. It knew via listening, there is no other explanation unless invoking a coincidence that stretches all credibility. Anyone got a third explanation?

by TekMol 8y ago

Swenrekcah 8y ago

The differece is that now it is explicitly illegal. I suspect after some grace period the most severe violations will start to get prosecuted and then I expect respectable companies to reconsider their tracking.

cm2012 8y ago

The user has the option to not get through the "pile of nonsense" and just close the website. The fact that the user does not should tell you something. Unless you think every website should force the user to go through a 15 minute webinar to help them specifically understand privacy policies before letting them browse the website?

llampx 8y ago
If the website was not tracking your every move and then selling the relevant bits to ad exchanges, they wouldn't need to do the 15 minute webinars.
jonbronson 8y ago
The lesson to companies should be, don't provide a Hobson's choice up front like this. Offer the webpage you meant to offer, and simply don't try to nickel and dime all the data out of your visitors.
- cm2012 8y ago
  It's not like content producing companies are these super profitable behemoths that are just greedy for $1 more. Not using ad trackers would your reduce your revenue by 50% at the minimum - it's how scaled advertisers spend money, if you're not doing it, you're not getting those advertisers. It is indeed a Hobson's choice - do it or stop providing whatever content it is the reader wants.
  - Kim_Bruning 8y ago
    Am I the only person who liked the web a lot better before it encountered its own Eternal September? I'm not trying to be snarky! It's just that I'm not actually sure I like the direction the web took, and I'm not sure these "content producing companies" are indeed a net positive. Perhaps forcing a lot of (the more shady) commercial activity off of the web is actually the best thing that could happen. (Though they probably wouldn't leave quietly)
    - cm2012 8y ago
      If you don't like the new direction the web took and don't think any of the content with ads is valuable, then by all means don't use. But don't force me to stop reading the NYT or Twitter.
      - Kim_Bruning 8y ago
        No one is stopping you from reading the NYT or twitter. But let them compete without the distortion of (ab)using quite so much Personally Identifying Information, and see if you'd still be happy to!
- Sargos 8y ago
  So just kill the free and open internet and bring back the walled garden model of the mid 90s where you paid for website packages like you did for cable TV? That's not a future I want to live in. Europe is playing a dangerous game with the internet right now and I don't think they have enough tech-minded people in power to keep things sane and in check.
xg15 8y ago
Except, in today's internet that would mean pretty much not using the internet at all. Which - in today's society - would mean a greatly handicapped social life at least and would be plain impossible for many people who need to use those sites to do their job. So yes, technically you're right. As Discworld's Vetinari said, you always have a choice, even if that choice is between agreeing to the deal or being thrown into a spiked pit.

superfrank 8y ago

Anecdotally, pretty much every developer I've talked to about GDPR says in one way or another, their company has some sort of GDPR violation. It's pretty much the same story every time, there was a big scramble to fix any clear violations, but because GDPR was a bit vague, there are a lot of gray area violations that are still being cleaned up.

deleted 8y ago

[deleted]

Xcelerate 8y ago

> He is not giving consent. He is just trying to get through this pile of nonsense to reach the content. Then don’t access the content? Why should the user get content that someone has worked to create without having to give anything in return (whether that’s in the form of payment or information). There would be no monetary incentive to create content anymore.

jklinger410 8y ago
The faux-progressive modern perspective is to consider ostensibly true things as literally true.
- throwawaymath 8y ago
  Do you mind dumbing this down a bit for me? What you wrote has gone completely over my head here. What is "faux-progressive modern" and what is the thing being considered true even if it's only "ostensibly true"?
  - deleted 8y ago
    [deleted]
- Xcelerate 8y ago
  Yeah, I’m confused about what you’re trying to say as well. I can’t tell if you’re in favor of or against my argument.
TekMol 8y ago
I'm not talking about ethics or business models. I just say that pretty much every site, device and service out there violates the primary rule of the GDPR. They all store data about their users without the users consent. One of the main points of the GDPR is that the user has to actively agree to storage of data. Making it very clear that storing can not be the default. Yet when you visit the New York Times today, they tell you: By clicking "I Accept" or "X" on this banner, or using our site, you consent to the use of cookies unless you have disabled them. In one form or another every site, service and device out there is doing exactly this. Making it the default to store data about the user.

Maarten88 8y ago

Yes, every website now asks for consent to "use cookies" because GDPR "requires us to to ask this". These are weasel words, there is absolutely NO NEED to ask for this. The word "cookie" occurs only once in the GDPR directive text, in a list of examples of personally identifiable data, next to "IP address". Yet no site ever asks me for permission to use my ip address, somehow. The GDPR does have a requirement to ask for consent to do things like tracking my interests/behavior on a site and sending it to marketing data companies for specificly named purposes. I have yet to find the first website that uses plain language when asking for consent, and I can't wait for the first fines to be handed out.

RandallBrown 8y ago
The cookie law predates GDPR by quite a bit doesn't it?
- wnevets 8y ago
  they certainly started popping up everywhere long before the GDPR
- nicolaslem 8y ago
  Yes but there is a work in progress to replace the cookie law with the more GDPR aware ePrivacy regulation. https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_Union) https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...

bad_user 8y ago

> I think that currently pretty much every service, device and website violates the GDPR. Not really, my website doesn't :-) In case you're using Google Analytics, it's easy to make it compliant, you just activate IP anonymization, which you had to do anyway, out of common sense and because tracking by IP without consent was illegal anyway in countries like Germany. [1] https://support.google.com/analytics/answer/2763052 https://support.google.com/analytics/answer/2763052 [2] https://developers.google.com/analytics/devguides/collection/analyticsjs/ip-anonymization https://developers.google.com/analytics/devguides/collection... > When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads. Yes, I saw this behavior too, but I like to think that many businesses are not as unscrupulous. But I do take care of my privacy as an ongoing investment ... I'm Google free, I sandbox Facebook, I use privacy blockers, VPN, the works. GDPR is IMO a godsend. I'm sure the cost will be high for many companies, but that's just karma.

gowld 8y ago
> I'm sure the cost will be high for many companies, but that's just karma. What about for companies that do handle user data responsibly, but have trouble with the formal compliance costs?
- Spearchucker 8y ago
  Not sure what your question is. If they handle data responsibly they're already compliant, no? In which case what compliance costs do such companies face?
- sincerely 8y ago
  If you want to "handle user data" in any way but can't afford the formal compliance costs, then one less company is hoovering up user data. I don't see the problem.
- bad_user 8y ago
  If the company handled user data responsibly already, it means the company was already respecting the privacy laws already in place in major European countries, Australia, etc and GDPR compliance shouldn't cost anything. There's also no such thing as responsible data handling for services tracking users without their consent. If no explicit consent was given, consent obtained with a layman explanation and with no dark patterns, then it shouldn't be legal. The problem often isn't how the data ends up being used, the problem is that the data is collected in the first place.

Meai 8y ago

I had some legitimately scary things that may or may not be tracking but I cannot explain it without tracking. I watch some youtube video where the audio mentions a historic place of battle and then seconds later it shows up in my Google Chrome autosuggestion because I wanted to google some more information on it. I dont see how that is possible, it was a very specific location. I only typed "battle of" and it showed me the exact battle that was just mentioned in the video. I dont see how that is possible unless Google has transcribed the audio of all the videos automatically and uses it for search suggestions. It was nothing I ever searched before, in fact I searched many many other battles and places before that one so it would make more sense for it to show me something I searched previously.

Drakim 8y ago
Google may have data that a lot of users searched for "battle of X" right after watching this particular youtube.
aaaaaaaaaab 8y ago
Ummm, google does transcribe the audio of all the videos automatically. That’s how they have subtitles for all videos (sometimes with hilarious results).
lallysingh 8y ago
It's only creepy if you believe you're the only consumer. Say when others watch that video, they search for "battle of whatever-you're-talking-about". They do the hard work. As for you watching a video and autocomplete coming in with the same topic, could it be that there was a surge of interest of that battle at the time? Otherwise it may be url analysis from other people searching through chrome.
hnna12 8y ago
I cannot prove anything but for the screenshot I took in utter shock, but I very recently started suffering headaches at night that cause the one side of my nose to completely block and generally make a mess of my sinuses. I had never spoken about it to anyone, searched for it online or otherwise had any similar problems before. One night I had a headache start while watching a video on YouTube with my iPhone so I put the phone down, video paused, on the side and spent the next hour sniffing and generally making some horrible sinus related noises. I woke the next morning, picked up the phone and finished the video. On going back to the recommendations, between physics talks and movie reviews was a video by a doctor about “instant sinus drainage”. Nothing else was in the recommendations like that — just one out of place yet creepily relevant video. I just didn’t believe these kinds of stories until then. I cannot fathom the sheer precision, relevance and timing. The only responses I’ve had about this are like “you must have searched x, or done y” and the reply is no, I really have not, honest to God, and I live alone. It knew via listening, there is no other explanation unless invoking a coincidence that stretches all credibility. Anyone got a third explanation?