5 ms·

Techcrunch (and tumblr and yahoo and others) is part of something called Oath, you're probably only going to see the consent overlay/redirect if you have an IP

Techcrunch (and tumblr and yahoo and others) is part of something called Oath, you're probably only going to see the consent overlay/redirect if you have an IP that shows as being within the EU. You will have the option to accept or configure what "partners" you want to track you when you're on Oath sites. There is a list of hundreds of these partners with links to each of their privacy policies and a switch to turn them on or off. The problem is partly that they are defaulting to tracking you and sharing information with partners, under GDPR it is supposed to be the default to not tracking and share data. It is also supposed to be equally easy to choose tracking vs not-tracking, with the Oath dialogue the option to turn it all off is not as easy or prominent as the option to accept tracking. Sorry about the image not being in english, but the language is automatically set based on location. Example: https://imgur.com/a/PFM1W69 https://imgur.com/a/PFM1W69

gjm11 7y ago
"Not as easy or prominent" is quite an understatement. Here's how it goes. Visit, say, TechCrunch. You get an overlay saying "TechCrunch is part of Oath; please let us do all the things" with a big "OK" button and a "Manage Options" button-made-to-look-not-like-a-button. So, you click on "Manage Options". Now you have a new page with a big "OK" button (which obviously will, again, give them permission to do all the things), a "Learn more" link, and a "Manage" link. The "learn more" link takes you to a page saying how wonderful it is that Oath wants all your data; that page doesn't appear to give you any options to configure or control anything. So, you click on "Manage". This takes you, of course, to yet another page on which you cannot yet manage anything. "Oath works with partners ...". Three links. "You can change your choices at any time by visiting the 'Partners' tab in our _Privacy dashboard_"; "See how partners use your data. _Show_"; "See and customize which partners can use your data. _Show_". (And of course a big "Done" button which gives them permission to do all the things.) It sounds as if the first is for changing things once you've set them, and the second only lets you look but not touch. So, follow the third link. This doesn't take you to a new page. Instead, it replaces the paragraph the link was in with a two-tabbed thing. One tab is called "Foundational partners" and has a list of 11 partners (people like Amazon, Google, Facebook, as well as some less well-known names). You have no ability here to change anything, but there are links to these people's privacy policies. The first three I looked at (Amazon, Google, eBay) link to pages that give information but _still_ no ability to change anything. The other tab here is called "IAB partners". This has a list of _238_ separate partners and a little on/off switch for each. There is -- I'm sure there used not to be, so they've actually improved this -- an option that says either "Select all" or "Deselect all". ... But then, at the bottom, you see: "Visit the following industry links to opt out of personalised advertising from those third parties who are members of the _European Interactive Digital Advertising Alliance_ (EDAA), _Digital Advertising Alliance_ (DAA) or _Network Advertising Initiative_ (NAI)." So. You need to go three levels in before you get any ability to change anything. At that point, you can opt out of personalized ads from their "IAB partners". (Can you opt out of _being tracked_ by them? It doesn't exactly say you can, but one can hope that that's the effect.) But if you want to opt out of anything involving their "Foundational partners" you need to go to their 11 individual websites and go poking around (good luck!). And then there are some unspecified _other_ partners in the EDAA, the DAA, and the NAI. For each of those there's a link taking you to the relevant organization's site, with its own clumsy and typically-dysfunctional mechanism for opting out. And, again, all they actually say will be achieved by opting out is that you won't get personalized ads; you might hope this will also stop them tracking you, and who knows? you might be right. None of this is anything remotely like GDPR-compliant, so far as I can make out.
- SCHiM 7y ago
  > None of this is anything remotely like GDPR-compliant, so far as I can make out. A while ago android got slammed in (I think France) for hiding a privacy related option behind a single button. If that's the cutoff they'll probably be found to be in violation. It won't come quickly of course, google got fined in 2018 for things they did in 2008/2009 ish? But at least people are documenting and reporting them. We can hope that in 10 years they'll get fined out of business.
- scalio 7y ago
  Now here's a reason why I disable js.
- dredmorbius 7y ago
  Thanks for writing that. I'd attempted to opt out of Oath's tracking a few days back and noted the same. Eventually gave up and blocked all cookies (including 1st party) in uMatrix, which addresses desktop but not mobile privacy. I've also finally got OpenWRT adblock configured on my router, ofering LAN-wide covrage, which helps. But yes, the exerience is utterly hostile and violates the GDPR in both letter and spirit. I'm coming to think that domain-boxed containers as a default cannot come soon enough. Firefox's tools are useful but nowhere near complete.
  - anoncake 7y ago
    I think you can use uMatrix in Firefox on Android.[1] I know uBlock Origin works. But the UI is borderline unusable on a phone. [1] At least until 2020, see https://github.com/mozilla-mobile/fenix/issues/574#issuecomment-465257697 https://github.com/mozilla-mobile/fenix/issues/574#issuecomm... and https://www.zdnet.com/article/mozilla-end-of-firefox-for-android-slated-for-2020-as-fenix-rises/ https://www.zdnet.com/article/mozilla-end-of-firefox-for-and...
    - dredmorbius 7y ago
      Actually, you're right and I have it installed, though still tend to use Chrome (incognito) on account of performance.
anoncake 7y ago
> Sorry about the image not being in english, but the language is automatically set based on location. Interestingly, Tumblr respects the Accept-language header. English screenshot: https://i.imgur.com/7yZLAir.png https://i.imgur.com/7yZLAir.png

gjm11 7y ago

"Not as easy or prominent" is quite an understatement. Here's how it goes. Visit, say, TechCrunch. You get an overlay saying "TechCrunch is part of Oath; please let us do all the things" with a big "OK" button and a "Manage Options" button-made-to-look-not-like-a-button. So, you click on "Manage Options". Now you have a new page with a big "OK" button (which obviously will, again, give them permission to do all the things), a "Learn more" link, and a "Manage" link. The "learn more" link takes you to a page saying how wonderful it is that Oath wants all your data; that page doesn't appear to give you any options to configure or control anything. So, you click on "Manage". This takes you, of course, to yet another page on which you cannot yet manage anything. "Oath works with partners ...". Three links. "You can change your choices at any time by visiting the 'Partners' tab in our _Privacy dashboard_"; "See how partners use your data. _Show_"; "See and customize which partners can use your data. _Show_". (And of course a big "Done" button which gives them permission to do all the things.) It sounds as if the first is for changing things once you've set them, and the second only lets you look but not touch. So, follow the third link. This doesn't take you to a new page. Instead, it replaces the paragraph the link was in with a two-tabbed thing. One tab is called "Foundational partners" and has a list of 11 partners (people like Amazon, Google, Facebook, as well as some less well-known names). You have no ability here to change anything, but there are links to these people's privacy policies. The first three I looked at (Amazon, Google, eBay) link to pages that give information but _still_ no ability to change anything. The other tab here is called "IAB partners". This has a list of _238_ separate partners and a little on/off switch for each. There is -- I'm sure there used not to be, so they've actually improved this -- an option that says either "Select all" or "Deselect all". ... But then, at the bottom, you see: "Visit the following industry links to opt out of personalised advertising from those third parties who are members of the _European Interactive Digital Advertising Alliance_ (EDAA), _Digital Advertising Alliance_ (DAA) or _Network Advertising Initiative_ (NAI)." So. You need to go three levels in before you get any ability to change anything. At that point, you can opt out of personalized ads from their "IAB partners". (Can you opt out of _being tracked_ by them? It doesn't exactly say you can, but one can hope that that's the effect.) But if you want to opt out of anything involving their "Foundational partners" you need to go to their 11 individual websites and go poking around (good luck!). And then there are some unspecified _other_ partners in the EDAA, the DAA, and the NAI. For each of those there's a link taking you to the relevant organization's site, with its own clumsy and typically-dysfunctional mechanism for opting out. And, again, all they actually say will be achieved by opting out is that you won't get personalized ads; you might hope this will also stop them tracking you, and who knows? you might be right. None of this is anything remotely like GDPR-compliant, so far as I can make out.

SCHiM 7y ago
> None of this is anything remotely like GDPR-compliant, so far as I can make out. A while ago android got slammed in (I think France) for hiding a privacy related option behind a single button. If that's the cutoff they'll probably be found to be in violation. It won't come quickly of course, google got fined in 2018 for things they did in 2008/2009 ish? But at least people are documenting and reporting them. We can hope that in 10 years they'll get fined out of business.
scalio 7y ago
Now here's a reason why I disable js.
dredmorbius 7y ago
Thanks for writing that. I'd attempted to opt out of Oath's tracking a few days back and noted the same. Eventually gave up and blocked all cookies (including 1st party) in uMatrix, which addresses desktop but not mobile privacy. I've also finally got OpenWRT adblock configured on my router, ofering LAN-wide covrage, which helps. But yes, the exerience is utterly hostile and violates the GDPR in both letter and spirit. I'm coming to think that domain-boxed containers as a default cannot come soon enough. Firefox's tools are useful but nowhere near complete.
- anoncake 7y ago
  I think you can use uMatrix in Firefox on Android.[1] I know uBlock Origin works. But the UI is borderline unusable on a phone. [1] At least until 2020, see https://github.com/mozilla-mobile/fenix/issues/574#issuecomment-465257697 https://github.com/mozilla-mobile/fenix/issues/574#issuecomm... and https://www.zdnet.com/article/mozilla-end-of-firefox-for-android-slated-for-2020-as-fenix-rises/ https://www.zdnet.com/article/mozilla-end-of-firefox-for-and...
  - dredmorbius 7y ago
    Actually, you're right and I have it installed, though still tend to use Chrome (incognito) on account of performance.

anoncake 7y ago

> Sorry about the image not being in english, but the language is automatically set based on location. Interestingly, Tumblr respects the Accept-language header. English screenshot: https://i.imgur.com/7yZLAir.png https://i.imgur.com/7yZLAir.png