13 ms·

The omnipresent "Please accept our privacy policy (or leave)" is worthless cargo cult GDPR pseudo-compliance. If it's neither freely given nor informed, it's no

The omnipresent "Please accept our privacy policy (or leave)" is worthless cargo cult GDPR pseudo-compliance. If it's neither freely given nor informed, it's not consent under GDPR. See Art. 7: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." See Recital 32: "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data ... This could include ticking a box when visiting an internet website ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent." If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach). Please feel free to downvote this if you don't like it, but I'm merely telling you what the law says. If you disagree factually, I'd appreciate a comment though.

alkonaut 8y ago
> If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach) Exactly this. Basically what the GDPR says is: if your business doesn't require the data, you cant use it without the user's consent. And data used for better advertising is NOT essential to e.g. a news site. What's more, the regulation syas that you can NOT simply say "accept or leave" in that case. You then have to provide the service to the user without storing that non essential data. You can't provide a service, even for free, that you condition on storing data not essential for that service. There is no "if you don't like it, leave" clause. Basically: spiegel.de has to be prepared to show their news to anyone, including those that do not wish to be tracked by their ads. Right now we are in a period of denial where site owners believe they can have these "By entering you agree to..." banners. Once the first large fines are handed out, It'll be fun to watch.
- icedchai 8y ago
  This is the view of a US person: These are private owned and operated web sites. The site owner determines what is "essential." If you do not agree to to the terms, do not use the site. If you don't want to be tracked for advertising, that's on you to install ad blockers.
  - tgsovlerkhgsel 8y ago
    Are you allowed to sell your kidney in the US? (No, you aren't.) This means that a site operator can't offer you access to a super awesome news site in exchange for your kidney. They can't get away by saying "but you can choose not to use the site". Well, Europe does the same thing for your personal data.
    - umanwizard 8y ago
      Trading a kidney for access to a news site would obviously be insane, and we should have laws to prevent insane people from harming themselves. On the other hand, if a person of sound mind decided they would rather have $1,000,000 than both of their kidneys, why shouldn't they be able to sell one, logically? The idea of selling one's organs sets off the human involuntary disgust/outrage reaction ("of COURSE it should be illegal! how DARE you suggest such a thing?!"), but if we put that aside, is there a rational reason it shouldn't be allowed?
      - tgsovlerkhgsel 8y ago
        The news site was an obviously over-the-top example, but the more realistic $1,000,000 offer would be just as illegal. The rational reason for that is that in the real world, not all choices are made by perfectly rational, superhumanely intelligent actors that have and consider all the information. Also, not all decisions on a free market are truly freely made. If all standard housing/mortgage contracts contain that you have to sign away your kidney as a security deposit in case you can't pay your rent/mortgage rates, do you really have a choice? With data on web sites, it's the same. Almost every web site collects data. You don't realistically have the option of going to a different news site if you don't like that deal.
vonmoltke 8y ago
> If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach). You can use absolutely no external tracking and be GDPR-noncompliant. In fact, an Apache web server running the default test page is technically noncompliant. Everyone loves to jump to the tracking ads and data selling, since they are easy targets, but the scope of the law is much broader than that.
flukus 8y ago
There is also this in article Article 7.4 (https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/) > 4 It shall be as easy to withdraw as to give consent. If you prompt me to accept on every page then you must also prompt me to decline on every page, otherwise you fail this test. Hiding the option to withdraw consent in some random settings page is obviously not as easy as clicking yes when prompted. Most sites have already created all their tracking cookies before the user even sees the opt-in form too, which isn't compliant with the GDPR or the old cookie law.
- Mirioron 8y ago
  So you want more pop ups? Because I'm sure they're willing to oblige.
  - PeterisP 8y ago
    Well, no, if they're required to harass the "consenters" equally to the "nonconsenters", then that (a) removes the motivation for users to fake consent just to get away from the harassment; and (b) motivates the site developer to choose an amount of popups that's actually appropriate for the UX they want, since that'll affect all users all the time. If a site doesn't wants to cover itself all the time with a popup regarding cookies, then they're not allowed to cover itself all the time for users who never consent to tracking.

alkonaut 8y ago

> If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach) Exactly this. Basically what the GDPR says is: if your business doesn't require the data, you cant use it without the user's consent. And data used for better advertising is NOT essential to e.g. a news site. What's more, the regulation syas that you can NOT simply say "accept or leave" in that case. You then have to provide the service to the user without storing that non essential data. You can't provide a service, even for free, that you condition on storing data not essential for that service. There is no "if you don't like it, leave" clause. Basically: spiegel.de has to be prepared to show their news to anyone, including those that do not wish to be tracked by their ads. Right now we are in a period of denial where site owners believe they can have these "By entering you agree to..." banners. Once the first large fines are handed out, It'll be fun to watch.

icedchai 8y ago
This is the view of a US person: These are private owned and operated web sites. The site owner determines what is "essential." If you do not agree to to the terms, do not use the site. If you don't want to be tracked for advertising, that's on you to install ad blockers.
- tgsovlerkhgsel 8y ago
  Are you allowed to sell your kidney in the US? (No, you aren't.) This means that a site operator can't offer you access to a super awesome news site in exchange for your kidney. They can't get away by saying "but you can choose not to use the site". Well, Europe does the same thing for your personal data.
  - umanwizard 8y ago
    Trading a kidney for access to a news site would obviously be insane, and we should have laws to prevent insane people from harming themselves. On the other hand, if a person of sound mind decided they would rather have $1,000,000 than both of their kidneys, why shouldn't they be able to sell one, logically? The idea of selling one's organs sets off the human involuntary disgust/outrage reaction ("of COURSE it should be illegal! how DARE you suggest such a thing?!"), but if we put that aside, is there a rational reason it shouldn't be allowed?
    - tgsovlerkhgsel 8y ago
      The news site was an obviously over-the-top example, but the more realistic $1,000,000 offer would be just as illegal. The rational reason for that is that in the real world, not all choices are made by perfectly rational, superhumanely intelligent actors that have and consider all the information. Also, not all decisions on a free market are truly freely made. If all standard housing/mortgage contracts contain that you have to sign away your kidney as a security deposit in case you can't pay your rent/mortgage rates, do you really have a choice? With data on web sites, it's the same. Almost every web site collects data. You don't realistically have the option of going to a different news site if you don't like that deal.

vonmoltke 8y ago

> If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach). You can use absolutely no external tracking and be GDPR-noncompliant. In fact, an Apache web server running the default test page is technically noncompliant. Everyone loves to jump to the tracking ads and data selling, since they are easy targets, but the scope of the law is much broader than that.

flukus 8y ago

There is also this in article Article 7.4 (https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/) > 4 It shall be as easy to withdraw as to give consent. If you prompt me to accept on every page then you must also prompt me to decline on every page, otherwise you fail this test. Hiding the option to withdraw consent in some random settings page is obviously not as easy as clicking yes when prompted. Most sites have already created all their tracking cookies before the user even sees the opt-in form too, which isn't compliant with the GDPR or the old cookie law.

Mirioron 8y ago
So you want more pop ups? Because I'm sure they're willing to oblige.
- PeterisP 8y ago
  Well, no, if they're required to harass the "consenters" equally to the "nonconsenters", then that (a) removes the motivation for users to fake consent just to get away from the harassment; and (b) motivates the site developer to choose an amount of popups that's actually appropriate for the UX they want, since that'll affect all users all the time. If a site doesn't wants to cover itself all the time with a popup regarding cookies, then they're not allowed to cover itself all the time for users who never consent to tracking.