4 ms·

> It doesn't matter what the user consents to That's not entirely true. If a user really consents to being tracked for advertising purposes, the GDPR allows tr

> It doesn't matter what the user consents to That's not entirely true. If a user really consents to being tracked for advertising purposes, the GDPR allows tracking. Whether the consent banners inform users honestly about the extent of tracking is another question. I think they don't. What's worse is that Google still tracks users by default, even if they never visited an actual Google property, let alone have a Google account. That's an obvious violation of the GDPR but Google will probably try to shift the blame on publishers.

mtgx 8y ago
I think the biggest issue with GDPR so far is enforcement. It's still early days, but many companies don't even follow GDPR as they're supposed to, including Google and Facebook. That will only be settled after an enforcement wave against both large and average-sized companies (GDPR is more lenient towards small companies).
brennebeck 8y ago
Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?
- nwellnhof 8y ago
  GitLab seems to use the Cookiebot solution. I like that "Marketing" cookies are disabled by default, although they should be labeled as "Advertising". Also, even if you bother to read the purposes of all the 80 advertising cookies, the descriptions are incomplete and dishonest. For example: Doubleclick cookie notice: "Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user." Facebook cookie notice: "Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers." These descriptions fail to mention that the collected data will be combined with information from thousands of other websites you visit which allows to create sophisticated user profiles. From these profiles, you can infer things like gender, age, socio-economic status, interests, or hobbies with relatively high accuracy. Even if you asked them, Google and Facebook couldn't tell which hidden categories their machine learning models can discover.
  - dsumenkovic 8y ago
    At GitLab we really care about transparency and it's one of our core values. Here you can find out more about Cookies policy https://docs.gitlab.com/cookies-policy/ https://docs.gitlab.com/cookies-policy/
  - brennebeck 8y ago
    I agree with what you’re saying; you’re proposing some ideal changes. But I think given where we were as a community or what has become the norm in tracking/social, this is a great step and is a big improvement over the past. It looks like someone from GitLab replied in a sibling to my comment, so maybe giving this extra feedback will bring about further changes. Edit: and yes, I just checked and it looks like Cookiebot.
kruczek 8y ago
> If a user really consents to being tracked for advertising purposes, the GDPR allows tracking. That's not exactly true either. For the consent to be valid, it must be freely given - that is: 1. The user must have a choice to give consent or not give it 2. The service provided should be the same regardless of #1, unless the consent is necessary for the service (e.g. consent to store address for delivery of goods - although in such case this shouldn't really be based on consent) Unfortunately many sites either do not give opt out at all, or make it hard to find it - in such cases consent can't really be considered to be freely given.
- dogma1138 8y ago
  That is not true you are confusing single purpose with a “valid” purpose from the users point of view which isn’t actually the case your business needs can be just as a valid reason under the GDPR as anything, you do not have to provide service to users who decline if say it affects your ad revenue the GDPR cannot force you to provide a “free” service to users. Consent is just one lawful basis for data collection, business justification is another one and ad revenue is a perfectly valid reason in which case you don’t even need consent but just to inform the user. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... You can do what ever you want under “vital interests” as long as you feel comfortable explaining those to the regulator, not the user. Consent is used often because the current interpretation of most legal experts is that it shifts the liability to the user however this has never been tested.
  - deleted 8y ago
    [deleted]
  - detaro 8y ago
    The parent was responding to a claim that consent works as a base of processing, and only talking about that base. That other bases can work is true (I'm personally really curious how this is going to play out for ad-financed services), but just because they didn't mention it they aren't "confused" about anything.

mtgx 8y ago

I think the biggest issue with GDPR so far is enforcement. It's still early days, but many companies don't even follow GDPR as they're supposed to, including Google and Facebook. That will only be settled after an enforcement wave against both large and average-sized companies (GDPR is more lenient towards small companies).

brennebeck 8y ago

Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?

nwellnhof 8y ago
GitLab seems to use the Cookiebot solution. I like that "Marketing" cookies are disabled by default, although they should be labeled as "Advertising". Also, even if you bother to read the purposes of all the 80 advertising cookies, the descriptions are incomplete and dishonest. For example: Doubleclick cookie notice: "Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user." Facebook cookie notice: "Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers." These descriptions fail to mention that the collected data will be combined with information from thousands of other websites you visit which allows to create sophisticated user profiles. From these profiles, you can infer things like gender, age, socio-economic status, interests, or hobbies with relatively high accuracy. Even if you asked them, Google and Facebook couldn't tell which hidden categories their machine learning models can discover.
- dsumenkovic 8y ago
  At GitLab we really care about transparency and it's one of our core values. Here you can find out more about Cookies policy https://docs.gitlab.com/cookies-policy/ https://docs.gitlab.com/cookies-policy/
- brennebeck 8y ago
  I agree with what you’re saying; you’re proposing some ideal changes. But I think given where we were as a community or what has become the norm in tracking/social, this is a great step and is a big improvement over the past. It looks like someone from GitLab replied in a sibling to my comment, so maybe giving this extra feedback will bring about further changes. Edit: and yes, I just checked and it looks like Cookiebot.

kruczek 8y ago

> If a user really consents to being tracked for advertising purposes, the GDPR allows tracking. That's not exactly true either. For the consent to be valid, it must be freely given - that is: 1. The user must have a choice to give consent or not give it 2. The service provided should be the same regardless of #1, unless the consent is necessary for the service (e.g. consent to store address for delivery of goods - although in such case this shouldn't really be based on consent) Unfortunately many sites either do not give opt out at all, or make it hard to find it - in such cases consent can't really be considered to be freely given.

dogma1138 8y ago
That is not true you are confusing single purpose with a “valid” purpose from the users point of view which isn’t actually the case your business needs can be just as a valid reason under the GDPR as anything, you do not have to provide service to users who decline if say it affects your ad revenue the GDPR cannot force you to provide a “free” service to users. Consent is just one lawful basis for data collection, business justification is another one and ad revenue is a perfectly valid reason in which case you don’t even need consent but just to inform the user. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... You can do what ever you want under “vital interests” as long as you feel comfortable explaining those to the regulator, not the user. Consent is used often because the current interpretation of most legal experts is that it shifts the liability to the user however this has never been tested.
- deleted 8y ago
  [deleted]
- detaro 8y ago
  The parent was responding to a claim that consent works as a base of processing, and only talking about that base. That other bases can work is true (I'm personally really curious how this is going to play out for ad-financed services), but just because they didn't mention it they aren't "confused" about anything.