13 ms·

It doesn't force you to anything unless you click OK. And even then you can manage your preferences then with Oath.

craigsmansion 8y ago
It forces you to accept cookies that aren't necessary for the functioning of the site to view the content. According to the GDPR, you can't do that.
- arcbyte 8y ago
  I don't know where this misconception comes from. Consent is totally different from contract - and both are part of reasons under the GDPR to use private data. True, consent requires necessity, but contract is wide open. When you click accept you aren't consenting, you are (theoretically) forming a contract, not consenting.
  - yorwba 8y ago
    > you are (theoretically) forming a contract, not consenting. How is forming a contract different from consenting? Do you mean to imply that a contract can be formed without consenting to the contract terms? The GDPR does allow processing if "[it] is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract" ( https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ ), but if you want to argue that tracking is necessary to fulfill the contractual obligation to display personalized ads, then first you'd need to get consent for that contract. How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ , which says e.g.: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." So is the contract with TechCrunch about reading articles or about looking at ads? And is the reading of articles conditional on the ads?
    - arcbyte 8y ago
      GDPR doesn't change contract law - they're orthogonal. It is true that in the everyday meaning of the word "consent", you would "consent" to a contract, but that is not at all how it is being used in the GDPR - the consent is to the one-sided, without consideration use of your private information. It has nothing to do with consenting to anything else, whether the formation of a contract or the shaving of your dog. While I applaud you going to the source, your reference: "How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/" https://gdpr-info.eu/art-7-gdpr/" does not mean what you think it means. It is simply a specific callout to emphasize the "freely given" aspect of consent (and NOT contracts) and remind enforcers that refusing to perform or taking some out from performing a contract should be considered undue pressure to get consent and therefore not "freely given". For instance, an extreme example would be if, after you ordered and paid for a pizza, and after I agreed to make and deliver you that pizza, I subsequently threaten to breach that pizza delivery contract if you don't "consent" to give me a complete list of movies you've watched this week. ALthough we do have a contract, we're not forming a new movie-history contract because I'm not offering anything for it or agreeing to do anything. I'm just using that pre-existing contractual relationship between us to threaten you into something that you may not want to do. They're completely separate concepts. Note the phrase "inter alia" which means "among other things", which is a signal from the authors that this is not the only consideration on "freely giving" consent. It has nothing to do with consenting to form a contract. Note also the word "performance" as it relates to a contract, which is completely distinct from "formation" of a contract. Furthermore, you've (theoretically) been forming contracts with these websites every time you visit them and accept their ToS and privacy policies and whatever else you click "OK" on - just go read them. They restrict you from many things that you could possibly do (reverse engineering, automated scraping, etc) in consideration for serving you up the content. GDPR is just another line item to add into that list for you to accept in the (theoretical) contract. Lastly, I keep saying "theoretical" because at least in the US, I'm not aware of a direct case on the topic of whether website ToS are actually enforceable. There's a click-wrap case that is close, but other than that....
  - deleted 8y ago
    [deleted]
- johnchristopher 8y ago
  Again, Techcrunch doesn't force you to accept anything. They aren't obliged to show you any content they don't want to show you. Now they propose you accept tracking by the means of cookies in order to access their content and the purpose of those cookies is clearly stated: advertising. It's also clearly stated who has access to this data. It's up to you to decide whether it's worthy or not. It'd be different if there was a cookie they didn't warn you about and isn't needed to view the content. > It forces you to accept cookies that aren't necessary for the functioning of the site to view the content. So, no. That's not what's happening here.
  - Terretta 8y ago
    The law pretty much rules out advertising as a valid reason, and that they can't discriminate on showing content based on opting out of the non-valid reasons (like ads).
    - umvi 8y ago
      Excuse my ignorance, but I'm interpreting this to mean that under GDPR users should be able to opt out of cookies and still view the content? That doesn't seem right. Shouldn't I, the creator, be able to say "consent to having cookies or don't use my site?"
      - toomuchtodo 8y ago
        That's a moral argument, not a legal argument. GDPR codifies through law that you are unable to, legally.
        umvi 8y ago
        That makes about as much sense (to me) as: "Fill out this survey and you can have a candy bar" "Nope, I won't fill out the survey but I'll still take the candy bar"
        Terretta 8y ago
exceptione 8y ago
I don't allow cookies, unless I whitelisted your website.
Angostura 8y ago
Have you tried managing your preferences? It's a circular hellscape.
- johnchristopher 8y ago
  Indeed, it is. That's a problem because giving consent should be as easy as withdrawing it and right now it's slow, clunky and I am pretty sure it's also unreliable.
Sir_Substance 8y ago
GDPR recital 43.2 establishes that you may not make provision of a service conditional upon someone granting consent for processing of personal data if the personal data is not required to provide the service.
- JumpCrisscross 8y ago
  > if the personal data is not required to provide the service I guess TechCrunch would argue the tracking is required to enable the ad rates that pay the writers who write the content.
  - swift532 8y ago
    That is not what is meant in the GDPR writeup. I think we can all agree that it's clearly aimed at whether something is technically required for a service, as for example a cookie is required for a login (not the best of examples, but eh).
    - JumpCrisscross 8y ago
      > I think we can all agree There are twenty-eight countries whose regulators and courts will interpret this law differently. I don’t think we can say “we can all agree” about anything at this point.
  - Sir_Substance 8y ago
    If they can make that argument, then they do not require consent. They can collect information on the basis of Article 6 1.f: >Processing shall be lawful only if and to the extent that at least one of the following applies: >(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Since they're not doing that, either they haven't read the law, or they have and don't agree with your interpretation.
- 8y ago

It forces you to accept cookies that aren't necessary for the functioning of the site to view the content. According to the GDPR, you can't do that.

arcbyte 8y ago
I don't know where this misconception comes from. Consent is totally different from contract - and both are part of reasons under the GDPR to use private data. True, consent requires necessity, but contract is wide open. When you click accept you aren't consenting, you are (theoretically) forming a contract, not consenting.
- yorwba 8y ago
  > you are (theoretically) forming a contract, not consenting. How is forming a contract different from consenting? Do you mean to imply that a contract can be formed without consenting to the contract terms? The GDPR does allow processing if "[it] is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract" ( https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ ), but if you want to argue that tracking is necessary to fulfill the contractual obligation to display personalized ads, then first you'd need to get consent for that contract. How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ , which says e.g.: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." So is the contract with TechCrunch about reading articles or about looking at ads? And is the reading of articles conditional on the ads?
  - arcbyte 8y ago
    GDPR doesn't change contract law - they're orthogonal. It is true that in the everyday meaning of the word "consent", you would "consent" to a contract, but that is not at all how it is being used in the GDPR - the consent is to the one-sided, without consideration use of your private information. It has nothing to do with consenting to anything else, whether the formation of a contract or the shaving of your dog. While I applaud you going to the source, your reference: "How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/" https://gdpr-info.eu/art-7-gdpr/" does not mean what you think it means. It is simply a specific callout to emphasize the "freely given" aspect of consent (and NOT contracts) and remind enforcers that refusing to perform or taking some out from performing a contract should be considered undue pressure to get consent and therefore not "freely given". For instance, an extreme example would be if, after you ordered and paid for a pizza, and after I agreed to make and deliver you that pizza, I subsequently threaten to breach that pizza delivery contract if you don't "consent" to give me a complete list of movies you've watched this week. ALthough we do have a contract, we're not forming a new movie-history contract because I'm not offering anything for it or agreeing to do anything. I'm just using that pre-existing contractual relationship between us to threaten you into something that you may not want to do. They're completely separate concepts. Note the phrase "inter alia" which means "among other things", which is a signal from the authors that this is not the only consideration on "freely giving" consent. It has nothing to do with consenting to form a contract. Note also the word "performance" as it relates to a contract, which is completely distinct from "formation" of a contract. Furthermore, you've (theoretically) been forming contracts with these websites every time you visit them and accept their ToS and privacy policies and whatever else you click "OK" on - just go read them. They restrict you from many things that you could possibly do (reverse engineering, automated scraping, etc) in consideration for serving you up the content. GDPR is just another line item to add into that list for you to accept in the (theoretical) contract. Lastly, I keep saying "theoretical" because at least in the US, I'm not aware of a direct case on the topic of whether website ToS are actually enforceable. There's a click-wrap case that is close, but other than that....
- deleted 8y ago
  [deleted]
johnchristopher 8y ago
Again, Techcrunch doesn't force you to accept anything. They aren't obliged to show you any content they don't want to show you. Now they propose you accept tracking by the means of cookies in order to access their content and the purpose of those cookies is clearly stated: advertising. It's also clearly stated who has access to this data. It's up to you to decide whether it's worthy or not. It'd be different if there was a cookie they didn't warn you about and isn't needed to view the content. > It forces you to accept cookies that aren't necessary for the functioning of the site to view the content. So, no. That's not what's happening here.
- Terretta 8y ago
  The law pretty much rules out advertising as a valid reason, and that they can't discriminate on showing content based on opting out of the non-valid reasons (like ads).
  - umvi 8y ago
    Excuse my ignorance, but I'm interpreting this to mean that under GDPR users should be able to opt out of cookies and still view the content? That doesn't seem right. Shouldn't I, the creator, be able to say "consent to having cookies or don't use my site?"
    - toomuchtodo 8y ago
      That's a moral argument, not a legal argument. GDPR codifies through law that you are unable to, legally.
      - umvi 8y ago
        That makes about as much sense (to me) as: "Fill out this survey and you can have a candy bar" "Nope, I won't fill out the survey but I'll still take the candy bar"
        Terretta 8y ago

exceptione 8y ago

I don't allow cookies, unless I whitelisted your website.

Angostura 8y ago

Have you tried managing your preferences? It's a circular hellscape.

johnchristopher 8y ago
Indeed, it is. That's a problem because giving consent should be as easy as withdrawing it and right now it's slow, clunky and I am pretty sure it's also unreliable.

Sir_Substance 8y ago

GDPR recital 43.2 establishes that you may not make provision of a service conditional upon someone granting consent for processing of personal data if the personal data is not required to provide the service.

JumpCrisscross 8y ago
> if the personal data is not required to provide the service I guess TechCrunch would argue the tracking is required to enable the ad rates that pay the writers who write the content.
- swift532 8y ago
  That is not what is meant in the GDPR writeup. I think we can all agree that it's clearly aimed at whether something is technically required for a service, as for example a cookie is required for a login (not the best of examples, but eh).
  - JumpCrisscross 8y ago
    > I think we can all agree There are twenty-eight countries whose regulators and courts will interpret this law differently. I don’t think we can say “we can all agree” about anything at this point.
- Sir_Substance 8y ago
  If they can make that argument, then they do not require consent. They can collect information on the basis of Article 6 1.f: >Processing shall be lawful only if and to the extent that at least one of the following applies: >(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Since they're not doing that, either they haven't read the law, or they have and don't agree with your interpretation.
8y ago