3 ms·

Perhaps. Though with GDPR the framework is intentionally vague on a lot of things. You often hear about limits and design requirements and such, well those don'

Perhaps. Though with GDPR the framework is intentionally vague on a lot of things. You often hear about limits and design requirements and such, well those don't exist. They are just legal "best guesses" with the frameworks inherent goal as a guide. Nobody knows whether default configs are disallowed as long as opt-in is positive action. The current best guesses for that vary and all that's known in GDPR in that regard is that there must be positive user opt-in with a good faith effort of informing the user. In this sense google likely thought they were satisfying this requirement. It can be argued and should because the arguments laid out in this discussion set precedence that acts as a more concrete requirement that sits on top of GDPR. Basically imo this could be a very interesting set of arguments that mean changes to a huge amount of websites.

mehrdadn 8y ago
> Nobody knows whether default configs are disallowed as long as opt-in is positive action. Isn't it just common sense based on everything in GDPR? I find it hard to believe that someone familiar with GDPR and without incentives to the contrary could legitly come away thinking the legislation intended to allow defaults to be anti-user-privacy.
- CorvusCrypto 8y ago
  Why would it be common sense? Literally nothing is written about design details. At a certain point burden will fall on the user and no it's not common sense where that point lies. Legal arguments such as this case are what concretely define expectations. I get the data protection part and it's easy to just say "anyone that does X is against data protection", but implementing stuff to satisfy GDPR is a mess of grey areas. It's just as likely a company sets defaults to streamline the UI experience for a user as is the case they did it to maliciously trick users (Yeah yeah google is evil etc. Etc. But remember these decisions affect all companies). This is not to mention the fact that many companies dont even offer customized settings and simply have only blanket opt-in checkboxes.

mehrdadn 8y ago

> Nobody knows whether default configs are disallowed as long as opt-in is positive action. Isn't it just common sense based on everything in GDPR? I find it hard to believe that someone familiar with GDPR and without incentives to the contrary could legitly come away thinking the legislation intended to allow defaults to be anti-user-privacy.

CorvusCrypto 8y ago
Why would it be common sense? Literally nothing is written about design details. At a certain point burden will fall on the user and no it's not common sense where that point lies. Legal arguments such as this case are what concretely define expectations. I get the data protection part and it's easy to just say "anyone that does X is against data protection", but implementing stuff to satisfy GDPR is a mess of grey areas. It's just as likely a company sets defaults to streamline the UI experience for a user as is the case they did it to maliciously trick users (Yeah yeah google is evil etc. Etc. But remember these decisions affect all companies). This is not to mention the fact that many companies dont even offer customized settings and simply have only blanket opt-in checkboxes.