5 ms·

The interminable pile of pop-ups on the EU web has become extremely annoying, and I don't blame ad firms and publishers for seeking to minimise the disruption t

The interminable pile of pop-ups on the EU web has become extremely annoying, and I don't blame ad firms and publishers for seeking to minimise the disruption to the user experience. At the same time, the protections that the GDPR seeks to provide are very important and it's absolutely right to protect them in law. But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? It devalues the whole point of the GDPR because no sane person would actually read the policies for every single website to see if their data is being used reasonably or not. I personally think that there should be a limited, well-defined set of data that can be transmitted to ad exchanges under an assumed consent. Fully anonymised and broad demographic data (eg: age range, sex, city, etc) for example. Anything beyond that should require an explicit consent. This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good.

Krasnol 8y ago
You only have to read the policies if you are interested in sharing the data and this can be linked properly. I don't see a problem there (besides the fact that many pages are not even able to link to the proper pages of course). The design of the wall of buttons is another topic. There is a design opportunity for a good solution there. Unfortunately what I see is the opposite. Pages that try to trick you into consent, pages who seem to link to other pages "checking something", "loading", "I'm sorry, try later", plainly not working buttons or no way to check all to "do not allow" but one button to "allow all". I really hope people who install those will pay and disappear when someone has finally enough of this crap.
- brain5ide 8y ago
  One could also argue that by avoiding the symmetric controls in these the websites are already aware of their malicious practices of the data they collect. This is cleverness, not stupidity.
Nursie 8y ago
> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? There is none, however it seems to me that a lot of these are going to be considered illegal after a while, particularly the ones that default-enable a ton of stuff under the cover of a single OK button. What would be really, really nice to see would be the web industry engaging with this properly, and changing their attitudes to private data, instead of effectively trying to hide behind multiple levels of disclaimer and implementing dark patterns to try to work around it. > This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good. This is already the case, as far as a lot of privacy campaigners are concerned. If you're not planning on using my data in nefarious ways (sharing it with commercial interests for money), but only use it in ways that support providing me the service (technically, not financially) we're golden, and you don't need any consent.
jeroenhd 8y ago
The constant boxes are actually against the spirit of the GDPR and it's only a matter of time until they are banned as well. The GDPR requires all tracking to be opt-in and to be completely optional. Blocking access to a page by requiring the users to tick one or more permission boxes is not opt-in. The same is true for many other GDPR permission forms (like Tumblr's) where all uses and parties were/are enabled by default and one needs to disable each one individually. It's a matter of time before one of these big firms gets investigated for these practices and a fine is dropped. Publishers will learn to stick to the rules soon enough.
- hartator 8y ago
  How can you be opt-in and be optional at the same time?
  - jimsmart 8y ago
    I'm not the parent poster, but I suspect here 'optional tracking' is taken to imply that they should not serve a 'Sorry we have no content to serve you, because you have not opted-in to our tracking' page, but should instead serve the content minus the tracking when one doesn't opt-in.
  - merijnv 8y ago
    Consent-based personal data processing must be optional. That's pretty explicit in the GDPR. You cannot predicate service on a user opting-in (consenting). That's not consent. That's coercion, and the GDPR pretty explicitly bans it. "But how can we monetise our service if we can't get paid via exploitation of personal data of our users?" Don't know, don't care, not my problem. The ad industry has proven itself incapable of self-regulation, so the GDPR explicitly destroys this entire business model. Figuring out a new that works is the industry's problem.
    - exergy 8y ago
      Precisely. What everyone forgets is that one of the biggest debacles with adtech was their inability to even guarantee that no malware was being fed with the ads. That's how bad it had gotten. It will take a long, long time before I have any sympathy for digital advertising.
icebraining 8y ago
Your proposal is exactly what the GDPR pushes for in Recital 26 - it exempts from the regulation "personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable". So the onus is completely on ad firms and publishers to stop trying to find tricks and loopholes, and actually follow the regulation as it's intended.
seszett 8y ago
> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? Ideally, it adds a cost to including third-party cookies and tracking users. Editors of websites could choose to be more respectful of their visitors's data, and then they would be able to provide a more seamless experience without annoying popups. In practice, apparently they are not willing to do that, either because money brought in by privacy-violating ads offsets the cost of losing users, or because they have not given much thought to it and are already used to showing lots of popups anyway, and think that one more will not change much. > I personally think that there should be a limited, well-defined set of data that can be transmitted to ad exchanges under an assumed consent. Fully anonymised and broad demographic data (eg: age range, sex, city, etc) for example. Anything beyond that should require an explicit consent. Fully anonymised and broad demographic data does not require consent, since it does not allow identifying users. As far as I know you could store the age range of users in a cookie and give just that to your ad exchange, although you should tell them at the time you ask for their age.
simonh 8y ago
>But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? If the consent boxes all have sharing options disabled by default, which they should, and only appear once for each site then I don't really mind all that much. click
hrktb 8y ago
> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? Setting aside if it's in line with GDPR, the interesting effect for me is that it adds a whole lot more friction to sites like TechCrunch for instance. Up until now the cookies banner was annoying, but at this point I'll never go to a site with heavy GDPR screens except if I really really want to read an article that is heavily discussed. Put it another way, I'm not sure we get trained to click these disclaimer, just opting out of the site becomes a simple option. In comparison arstechnica for instance is frictionless, and I hope it brings them a boost in visits comparatively.
BlackFly 8y ago
> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? The truth is that on the privacy advocacy side of this issue there is an understanding that those boxes are not meaningful, informed consent. On the programmatic advertising, suck up all the data side of the issue there is an understanding that an intrusive pop up with psychological nudges towards acceptance is meaningful, informed consent. The GDPR was drafted in the way it was because of the industry's poor reaction to the tracking cookie law. They added hefty fines and a necessity of informed, meaningful consent because the industry reacted with a wink and a nudge by implementing loop holes. This ruling seems to confirm that the commission was not joking, that it wasn't just political posturing, that they want the industry to cease and desist. Given that I have edited the html of any form ever given to me to change "I agree" to some form of "I don't agree and waive no rights", in what way have they diligently acquired meaningful, informed consent from me and therefore from anyone?

Krasnol 8y ago

You only have to read the policies if you are interested in sharing the data and this can be linked properly. I don't see a problem there (besides the fact that many pages are not even able to link to the proper pages of course). The design of the wall of buttons is another topic. There is a design opportunity for a good solution there. Unfortunately what I see is the opposite. Pages that try to trick you into consent, pages who seem to link to other pages "checking something", "loading", "I'm sorry, try later", plainly not working buttons or no way to check all to "do not allow" but one button to "allow all". I really hope people who install those will pay and disappear when someone has finally enough of this crap.

brain5ide 8y ago
One could also argue that by avoiding the symmetric controls in these the websites are already aware of their malicious practices of the data they collect. This is cleverness, not stupidity.

Nursie 8y ago

> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? There is none, however it seems to me that a lot of these are going to be considered illegal after a while, particularly the ones that default-enable a ton of stuff under the cover of a single OK button. What would be really, really nice to see would be the web industry engaging with this properly, and changing their attitudes to private data, instead of effectively trying to hide behind multiple levels of disclaimer and implementing dark patterns to try to work around it. > This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good. This is already the case, as far as a lot of privacy campaigners are concerned. If you're not planning on using my data in nefarious ways (sharing it with commercial interests for money), but only use it in ways that support providing me the service (technically, not financially) we're golden, and you don't need any consent.

jeroenhd 8y ago

The constant boxes are actually against the spirit of the GDPR and it's only a matter of time until they are banned as well. The GDPR requires all tracking to be opt-in and to be completely optional. Blocking access to a page by requiring the users to tick one or more permission boxes is not opt-in. The same is true for many other GDPR permission forms (like Tumblr's) where all uses and parties were/are enabled by default and one needs to disable each one individually. It's a matter of time before one of these big firms gets investigated for these practices and a fine is dropped. Publishers will learn to stick to the rules soon enough.

hartator 8y ago
How can you be opt-in and be optional at the same time?
- jimsmart 8y ago
  I'm not the parent poster, but I suspect here 'optional tracking' is taken to imply that they should not serve a 'Sorry we have no content to serve you, because you have not opted-in to our tracking' page, but should instead serve the content minus the tracking when one doesn't opt-in.
- merijnv 8y ago
  Consent-based personal data processing must be optional. That's pretty explicit in the GDPR. You cannot predicate service on a user opting-in (consenting). That's not consent. That's coercion, and the GDPR pretty explicitly bans it. "But how can we monetise our service if we can't get paid via exploitation of personal data of our users?" Don't know, don't care, not my problem. The ad industry has proven itself incapable of self-regulation, so the GDPR explicitly destroys this entire business model. Figuring out a new that works is the industry's problem.
  - exergy 8y ago
    Precisely. What everyone forgets is that one of the biggest debacles with adtech was their inability to even guarantee that no malware was being fed with the ads. That's how bad it had gotten. It will take a long, long time before I have any sympathy for digital advertising.

icebraining 8y ago

Your proposal is exactly what the GDPR pushes for in Recital 26 - it exempts from the regulation "personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable". So the onus is completely on ad firms and publishers to stop trying to find tricks and loopholes, and actually follow the regulation as it's intended.

seszett 8y ago

> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? Ideally, it adds a cost to including third-party cookies and tracking users. Editors of websites could choose to be more respectful of their visitors's data, and then they would be able to provide a more seamless experience without annoying popups. In practice, apparently they are not willing to do that, either because money brought in by privacy-violating ads offsets the cost of losing users, or because they have not given much thought to it and are already used to showing lots of popups anyway, and think that one more will not change much. > I personally think that there should be a limited, well-defined set of data that can be transmitted to ad exchanges under an assumed consent. Fully anonymised and broad demographic data (eg: age range, sex, city, etc) for example. Anything beyond that should require an explicit consent. Fully anonymised and broad demographic data does not require consent, since it does not allow identifying users. As far as I know you could store the age range of users in a cookie and give just that to your ad exchange, although you should tell them at the time you ask for their age.

simonh 8y ago

>But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? If the consent boxes all have sharing options disabled by default, which they should, and only appear once for each site then I don't really mind all that much. click

hrktb 8y ago

> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? Setting aside if it's in line with GDPR, the interesting effect for me is that it adds a whole lot more friction to sites like TechCrunch for instance. Up until now the cookies banner was annoying, but at this point I'll never go to a site with heavy GDPR screens except if I really really want to read an article that is heavily discussed. Put it another way, I'm not sure we get trained to click these disclaimer, just opting out of the site becomes a simple option. In comparison arstechnica for instance is frictionless, and I hope it brings them a boost in visits comparatively.

BlackFly 8y ago

> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? The truth is that on the privacy advocacy side of this issue there is an understanding that those boxes are not meaningful, informed consent. On the programmatic advertising, suck up all the data side of the issue there is an understanding that an intrusive pop up with psychological nudges towards acceptance is meaningful, informed consent. The GDPR was drafted in the way it was because of the industry's poor reaction to the tracking cookie law. They added hefty fines and a necessity of informed, meaningful consent because the industry reacted with a wink and a nudge by implementing loop holes. This ruling seems to confirm that the commission was not joking, that it wasn't just political posturing, that they want the industry to cease and desist. Given that I have edited the html of any form ever given to me to change "I agree" to some form of "I don't agree and waive no rights", in what way have they diligently acquired meaningful, informed consent from me and therefore from anyone?