7 ms·

This is like a case study of well-intentioned, carefully designed regulation doing more harm than good. Honestly, I'd rather just have a browser addin that bloc

by dash2 8y ago

This is like a case study of well-intentioned, carefully designed regulation doing more harm than good. Honestly, I'd rather just have a browser addin that blocks the cookies I don't want. The market was working fine. Now every new website is a pain, and my organization has hired some amiable lady to be "GDPR expert". She doesn't appear to know anything about anything, but she sure seems nice.

paxys 8y ago
I wouldn't call GDPR "carefully designed" at all. It is ridiculously broad and vague, and so far all implementations (including the cookie warnings all over the internet) are best guesses.
- kybernetikos 8y ago
  Most of the cookie warnings are clearly against guidance which says that consent must not be a condition of service to be considered freely given, must be opt in not opt out and that even with consent the use of pii must be in the user's interests. Almost no cookie warnings meet the law and many of the ones that do could use a different lawful basis and not show a dialog at all.
  - paxys 8y ago
    > consent must not be a condition of service So what do you do if your website literally cannot function without cookies?
    - rcxdude 8y ago
      Then you do not need to ask consent to use them. You only need consent for cookies or data collection if it is not necessary to the service (and 'necessary for tracking ads' does not count as necessary).
      - paxys 8y ago
        Why not, if that's how you are paying for the site to exist?
        rcxdude 8y ago
        Because that's what the law says. Your business model is not allowed to infringe on the rights of your users to control their data. You can pay for the site to exist in other ways, but not by collecting your users data without their consent.
scrollaway 8y ago
GDPR absolutely does not do "more harm than good". It extends well, well beyond these dumb cookie warnings. GDPR puts the citizen/customer in power of their own data. They can ask for their data, they can ask for it to be deleted, they have (however shitty the UX) control over where it goes. They can contact large corporations and request these things and be heard out. I don't know how to explain it any other way: These things are fucking important. As for your organization's GDPR expert who doesn't know anything about anything, this sounds like a "your organization" problem. Replace GDPR with some other acronym such as HIPAA, PCI or even SEO or PHP, it's still your organization's fault for hiring someone who doesn't know their stuff. How is that GDPR's fault? Edit: Yes, keep downvoting facts. GDPR isn't just cookie warnings, how is that controversial?
- fixermark 8y ago
  > I don't know how to explain it any other way: These things are fucking important. I believe that thought is treated as an axiom by some and an under-tested hypothesis by others.
  - scrollaway 8y ago
    That they're not important to everyone doesn't make them unimportant for everyone. It's kinda like other rights such as free speech. Some people don't need/use it. Some specific people might arguably be better off without it. But Everyone needs it; as in, it needs to be available to everyone for it to work.
    - fixermark 8y ago
      It's worth noting that the United States considers a right to keep and bear arms as important as a right to free speech. Internationally, reasonable disagreement on rights seen by some as fundamental is to be expected.
      - scrollaway 8y ago
        You make a fair point, but the right to bear arms is mainly controversial for safety reasons. What safety issues are there with providing customers control (or at least visibility) over their data? It's also worth pointing out that the right to bear arms, by its origin, should probably be called the "right to revolt". While this is still a controversial issue for governments (governments don't want revolt), it's less controversial for citizens.
ska 8y ago
The market was working fine. At the very least, this is up for debate.
rcxdude 8y ago
The harm is being done by companies attempting to keep the status quo by nagging users unless they give consent. I hope some of the worst offenders in this regard get slapped by regulators. You can be 100% GDPR compliant and have a functional website without needing any cookie or GDPR consent boxes.

by dash2 8y ago

paxys 8y ago

I wouldn't call GDPR "carefully designed" at all. It is ridiculously broad and vague, and so far all implementations (including the cookie warnings all over the internet) are best guesses.

kybernetikos 8y ago
Most of the cookie warnings are clearly against guidance which says that consent must not be a condition of service to be considered freely given, must be opt in not opt out and that even with consent the use of pii must be in the user's interests. Almost no cookie warnings meet the law and many of the ones that do could use a different lawful basis and not show a dialog at all.
- paxys 8y ago
  > consent must not be a condition of service So what do you do if your website literally cannot function without cookies?
  - rcxdude 8y ago
    Then you do not need to ask consent to use them. You only need consent for cookies or data collection if it is not necessary to the service (and 'necessary for tracking ads' does not count as necessary).
    - paxys 8y ago
      Why not, if that's how you are paying for the site to exist?
      - rcxdude 8y ago
        Because that's what the law says. Your business model is not allowed to infringe on the rights of your users to control their data. You can pay for the site to exist in other ways, but not by collecting your users data without their consent.

scrollaway 8y ago

GDPR absolutely does not do "more harm than good". It extends well, well beyond these dumb cookie warnings. GDPR puts the citizen/customer in power of their own data. They can ask for their data, they can ask for it to be deleted, they have (however shitty the UX) control over where it goes. They can contact large corporations and request these things and be heard out. I don't know how to explain it any other way: These things are fucking important. As for your organization's GDPR expert who doesn't know anything about anything, this sounds like a "your organization" problem. Replace GDPR with some other acronym such as HIPAA, PCI or even SEO or PHP, it's still your organization's fault for hiring someone who doesn't know their stuff. How is that GDPR's fault? Edit: Yes, keep downvoting facts. GDPR isn't just cookie warnings, how is that controversial?

fixermark 8y ago
> I don't know how to explain it any other way: These things are fucking important. I believe that thought is treated as an axiom by some and an under-tested hypothesis by others.
- scrollaway 8y ago
  That they're not important to everyone doesn't make them unimportant for everyone. It's kinda like other rights such as free speech. Some people don't need/use it. Some specific people might arguably be better off without it. But Everyone needs it; as in, it needs to be available to everyone for it to work.
  - fixermark 8y ago
    It's worth noting that the United States considers a right to keep and bear arms as important as a right to free speech. Internationally, reasonable disagreement on rights seen by some as fundamental is to be expected.
    - scrollaway 8y ago
      You make a fair point, but the right to bear arms is mainly controversial for safety reasons. What safety issues are there with providing customers control (or at least visibility) over their data? It's also worth pointing out that the right to bear arms, by its origin, should probably be called the "right to revolt". While this is still a controversial issue for governments (governments don't want revolt), it's less controversial for citizens.

ska 8y ago

The market was working fine. At the very least, this is up for debate.

rcxdude 8y ago

The harm is being done by companies attempting to keep the status quo by nagging users unless they give consent. I hope some of the worst offenders in this regard get slapped by regulators. You can be 100% GDPR compliant and have a functional website without needing any cookie or GDPR consent boxes.