5 ms·

> The user consent parts of gdpr, are, imo, not good. Indeed, this seems to be really lacking as far as I've seen. Compliance with article 7 section 4 in part

by gnode 7y ago

> The user consent parts of gdpr, are, imo, not good. Indeed, this seems to be really lacking as far as I've seen. Compliance with article 7 section 4 in particular (provision of service must not be conditional on consent for processing of personal data not necessary for provision of that service) is blatantly ignored by many actors, with a message of "accept our tracking or we won't let you see our content". Others pretend to be in compliance by having an opt-out which never completes, or other dark patterns.

cevn 7y ago
Agree, this needs to be seriously enforced. Web browsing is a PITA now with all these popups that only have an "I Accept" box with no way to dismiss the notification otherwise. Usually I just close the tab.
- Benjamin_Dobell 7y ago
  Luckily they're usually poorly implemented and you can just "Inspect Element" + delete. Although, in saying that, given the lack of official opt-out functionality, using the site will probably result in tracking.
  - klez 7y ago
    Wasn't the point (or at least one of them) of the GDPR that the consent was to be opt-in?
    - gnode 7y ago
      Yes. So if they track you after you delete their consent overlay, you'd have grounds to complain about them to your data protection agency.
- TeMPOraL 7y ago
  Since so many companies seem to be outsourcing these popups, possibly because they're enrolled in some ad-network cooperations, I wonder if it would be possible to build a browser extension that would automatically submit these forms with everything set to "no consent".
vijayr02 7y ago
Thanks, I saw your reply to my question below as well. I wonder: what can we (as a community) do to change this? Can we: - make applications to the information commissioner about the most egregious breaches - create enough nuisance value that these entities need to acknowledge and address this issue I'm sure there are enough privacy minded individuals on HN that if we all agreed on a concerted plan of action we could make an impact?
- gnode 7y ago
  Lawyer activist Max Schrems created NOYB for this purpose: https://noyb.eu/ https://noyb.eu/ Supporting / joining them is probably the best way to make a concerted impact.
  - vijayr02 7y ago
    Thanks, I'm taking a look now!
Silhouette 7y ago
Compliance with article 7 section 4 in particular (provision of service must not be conditional on consent for processing of personal data not necessary for provision of that service) is blatantly ignored by many actors In fairness, that's because it's a legislative over-reach that the EU wants to enforce extra-territorially, but a lot of businesses outside the EU's jurisdiction have declined to undermine their entire business model because a foreign government decided they should. It is reasonable to say that people should have a choice about things like being tracked, and that such tracking may only be used with the subject's informed consent. This protects the privacy of those who value it by default. However, IMHO it is not reasonable to say that organisations that fundamentally rely on such data processing to be financially viable must then continue to provide service to users who choose not to participate. That's an entirely one-sided deal, and it's logically unsustainable to require businesses to operate on that basis. You'd never tell a bricks and mortar grocery store that if someone came in but didn't have any money with them then the store still had to let them take a chocolate bar and eat it, and I don't see the effects of the GDPR in this respect as any better than that.
- gnode 7y ago
  > rely on such data processing to be financially viable I'm not convinced this is true. Television, billboards, and print newspapers demonstrate that advertising can still exist and support a business model without invading the privacy of users. I'm also not convinced that user-targeted advertising is significantly more effective in practise than contextual advertising.
  - Silhouette 7y ago
    You might be right in at least some cases, but I don't think this is really the point. Requiring businesses to provide their services to arbitrary numbers of people who are offering them nothing in return is a dangerous and ultimately unsustainable strategy. Maybe if we were faced with some severe and immediate threat to public health and the business were a manufacturer of essential medication, there might be some overriding public interest justification for adopting that sort of position in law, but I think it would need to be a crisis of that sort of level to justify such direct intervention. I don't think the situation we're talking about here is anywhere close to justifying it on similar grounds. Nor do I see any obvious evidence that forcing the matter through regulatory action will motivate a shift to more desirable funding models for the affected businesses. First some good alternative models would have to be identified, and if we'd done that already, we probably wouldn't be having this conversation at all.

by gnode 7y ago

cevn 7y ago

Agree, this needs to be seriously enforced. Web browsing is a PITA now with all these popups that only have an "I Accept" box with no way to dismiss the notification otherwise. Usually I just close the tab.

Benjamin_Dobell 7y ago
Luckily they're usually poorly implemented and you can just "Inspect Element" + delete. Although, in saying that, given the lack of official opt-out functionality, using the site will probably result in tracking.
- klez 7y ago
  Wasn't the point (or at least one of them) of the GDPR that the consent was to be opt-in?
  - gnode 7y ago
    Yes. So if they track you after you delete their consent overlay, you'd have grounds to complain about them to your data protection agency.
TeMPOraL 7y ago
Since so many companies seem to be outsourcing these popups, possibly because they're enrolled in some ad-network cooperations, I wonder if it would be possible to build a browser extension that would automatically submit these forms with everything set to "no consent".

vijayr02 7y ago

Thanks, I saw your reply to my question below as well. I wonder: what can we (as a community) do to change this? Can we: - make applications to the information commissioner about the most egregious breaches - create enough nuisance value that these entities need to acknowledge and address this issue I'm sure there are enough privacy minded individuals on HN that if we all agreed on a concerted plan of action we could make an impact?

gnode 7y ago
Lawyer activist Max Schrems created NOYB for this purpose: https://noyb.eu/ https://noyb.eu/ Supporting / joining them is probably the best way to make a concerted impact.
- vijayr02 7y ago
  Thanks, I'm taking a look now!

Silhouette 7y ago

Compliance with article 7 section 4 in particular (provision of service must not be conditional on consent for processing of personal data not necessary for provision of that service) is blatantly ignored by many actors In fairness, that's because it's a legislative over-reach that the EU wants to enforce extra-territorially, but a lot of businesses outside the EU's jurisdiction have declined to undermine their entire business model because a foreign government decided they should. It is reasonable to say that people should have a choice about things like being tracked, and that such tracking may only be used with the subject's informed consent. This protects the privacy of those who value it by default. However, IMHO it is not reasonable to say that organisations that fundamentally rely on such data processing to be financially viable must then continue to provide service to users who choose not to participate. That's an entirely one-sided deal, and it's logically unsustainable to require businesses to operate on that basis. You'd never tell a bricks and mortar grocery store that if someone came in but didn't have any money with them then the store still had to let them take a chocolate bar and eat it, and I don't see the effects of the GDPR in this respect as any better than that.

gnode 7y ago
> rely on such data processing to be financially viable I'm not convinced this is true. Television, billboards, and print newspapers demonstrate that advertising can still exist and support a business model without invading the privacy of users. I'm also not convinced that user-targeted advertising is significantly more effective in practise than contextual advertising.
- Silhouette 7y ago
  You might be right in at least some cases, but I don't think this is really the point. Requiring businesses to provide their services to arbitrary numbers of people who are offering them nothing in return is a dangerous and ultimately unsustainable strategy. Maybe if we were faced with some severe and immediate threat to public health and the business were a manufacturer of essential medication, there might be some overriding public interest justification for adopting that sort of position in law, but I think it would need to be a crisis of that sort of level to justify such direct intervention. I don't think the situation we're talking about here is anywhere close to justifying it on similar grounds. Nor do I see any obvious evidence that forcing the matter through regulatory action will motivate a shift to more desirable funding models for the affected businesses. First some good alternative models would have to be identified, and if we'd done that already, we probably wouldn't be having this conversation at all.