5 ms·

You don't have to exclude people, you just have to make it inconvenient to not click ok. The majority will accept the default value. It is the same with ad-blo

You don't have to exclude people, you just have to make it inconvenient to not click ok. The majority will accept the default value. It is the same with ad-blockers. Youtube would be bankrupt if people weren't lazy.

kuschku 7y ago
Also wrong, the "not share" option has to be default, and displayed larger and clearly visible
- toohotatopic 7y ago
  Can you give me a reference for that, please. I have only found [1]: >It states that you should integrate data protection from the designing stage of processing activities. Article 25 of GDPR lists the requirements for data protection by design and default. But that's the processing, not the agreement. And about consent [2]: >Freely given - the person must not be pressured into giving consent or suffer any detriment if they refuse. >Specific - the person must be asked to consent to individual types of data processing. >Informed - the person must be told what they're consenting to. >Unambiguous - language must be clear and simple. >Clear affirmative action - the person must expressly consent by doing or saying something. But freely given doesn't forbid using the default or does it? [1]https://www.cookielawinfo.com/gdpr-privacy-by-design-and-default/ https://www.cookielawinfo.com/gdpr-privacy-by-design-and-def... [2]https://www.privacypolicies.com/blog/gdpr-consent-examples/ https://www.privacypolicies.com/blog/gdpr-consent-examples/
  - jlokier 7y ago
    You said yourself: >>Clear affirmative action - the person must expressly consent by doing or saying something It's not "clearly affirmative" if it's a default that's difficult to find the alternative to, or easy to select by mistake.
    - Supermancho 7y ago
      Thats a subjective interpretation of "clearly affirmative" that matches more closely with "obvious and clear or straightforward". An option can be obvious to find and yet worded unclearly as we have all encountered "do you want to opt out or not?" Y/N - wait what did the text blob above this say? Pretending this isnt a delicate issue creates more loopholes and bench time than helping consumers.
      - jlokier 7y ago
        I think "clearly affirmative" is only possible when it's "clear" - the consumer cannot clearly affirm to an unclearly-worded question. You can also cover it under "easy to select by mistake [the unintended answer]". I think the root of the problem in most cases is that companies don't want to help consumers, they actively want to mislead them and then claim plausible deniability. I don't understand which sense you mean by "pretending this isn't a delicate issue..." here. I can't even tell if you are pro-GDPR or anti-GDPR from that, and which of those positions you consider to be helping consumers more. Ironic, Y/N? :-)
        toohotatopic 7y ago
        Can you tell if I am pro- or anti-GDPR? They, like I, are not arguing for a side (I assume). We are pointing out that the legal situation is not as clear as the article suggests. Judging by the lack of won cases, a default ok button seems to be 'clearly affirmative' enough. The law states [1]: >It shall be as easy to withdraw as to give consent. Nothing states that consent has to be more difficult than non-consenting. >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. The request has to be distinguishable, not the consent. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
        jlokier 7y ago
        > Nothing states that consent has to be more difficult than non-consenting. Nobody is arguing that consent should be more difficult. The complaint is that non-consent is often much more difficult than consent, sometimes ridiculously so. In my personal experience I have been unable to find the no-consent option at all on some sites. Just links that go around in circles, sometimes to hundreds of ambiguous and mixed-polarity yes/no-or-was-it-no/yes-style options (one for each of hundreds of "partner sites" I've never heard of), with the only clear option being consent-to-all. If I eventually click on "ok" that is not freely given consent, it's coerced due to me being unable to find or understand how to decline it. It is technically easy to provide a "decline-to-all" option whenever they have provided a "consent-to-all" option. Therefore, clearly companies which provide an easy consent-to-all but make decline-to-all virtually impossible to select, or actually impossible, are doing so deliberately, intending to frustrate the consumer from exercising their rights. The law says that a person should be able to decline if they choose, that it should be easy enough to do, and easy to understand which option they are choosing. Such sites are not compliant with that principle, and it looks like deliberate non-compliance to me. > The request has to be distinguishable, not the consent. Well, "the request" is what we've been talking about. It means the UI. Things like "Ok" and "decline" buttons, how the options are presented, how they are explained clearly and unambiguously, the ease and accessibility of selecting the freely chosen option, that sort of thing.
  - bashinator 7y ago
    "Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent." https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
mattmanser 7y ago
You clearly don't know anything about GDPR, can you please stop commenting?
NeedMoreTea 7y ago
Except one of the aims of GDPR is to explicitly rule that out. Consent requires informed, positive opt-in. Not a dark-patterned default. See ICO's guidance on consent: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- toohotatopic 7y ago
  As you write: 'aim' and 'guidance'. But is it actually part of the law?
  - NeedMoreTea 7y ago
    They link to the actual legislation at the foot of the page, noting the relevant sections. GDPR is very readable, and pretty concise. They also link to two more in depth explorations of consent. Bear in mind the ICO are the UK's enforcement body, so are presenting an accurate picture of the law. To quote three relevant points from the linked page: The GDPR is clearer that an indication of consent must be unambiguous and involve a clear affirmative action (an opt-in). It specifically bans pre-ticked opt-in boxes. It also requires distinct (‘granular’) consent options for distinct processing operations. Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service. The GDPR gives a specific right to withdraw consent. You need to tell people about their right to withdraw, and offer them easy ways to withdraw consent at any time. If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis. So yes it's law, unless and until someone manages to appeal some interpretation of a point all the way up the chain.
    - toohotatopic 7y ago
      Imagine a disturbing box on a startpage which asks you for consent to some data processing, e.g. to show you the best matching advertisements. That box has a big ok button at the center and a small cross to exit at the top. That's a situation where most people will press ok and give clear affirmative consent. Since most people press ok, it doesn't matter to also offer the service to those who cancel. Actually those people still leave a signal and you can show special ads to anybody who isn't part of the ok-clicker database. I don't see how this would violate the GDPR: - unambigous and clear affirmative action. People press ok and not the closing cross. - no pre-ticket opt-in box - distinct consent to advertisement processing - separation from other terms - not a precondition of signing up - remaining right to withdraw consent - ability to also tell people about their right to withdraw in that box - possible to offer an easy way to withdraw Actually withdrawal has to be as easy as consent. The law states: >It shall be as easy to withdraw as to give consent. That's the point where everybody is violating the law because the opt-out button is not constantly shown like the ok-button for opt-in.
rhizome 7y ago
How about making it illegal to withold your data from commercial sites? Would that be reasonable?

kuschku 7y ago

Also wrong, the "not share" option has to be default, and displayed larger and clearly visible

toohotatopic 7y ago
Can you give me a reference for that, please. I have only found [1]: >It states that you should integrate data protection from the designing stage of processing activities. Article 25 of GDPR lists the requirements for data protection by design and default. But that's the processing, not the agreement. And about consent [2]: >Freely given - the person must not be pressured into giving consent or suffer any detriment if they refuse. >Specific - the person must be asked to consent to individual types of data processing. >Informed - the person must be told what they're consenting to. >Unambiguous - language must be clear and simple. >Clear affirmative action - the person must expressly consent by doing or saying something. But freely given doesn't forbid using the default or does it? [1]https://www.cookielawinfo.com/gdpr-privacy-by-design-and-default/ https://www.cookielawinfo.com/gdpr-privacy-by-design-and-def... [2]https://www.privacypolicies.com/blog/gdpr-consent-examples/ https://www.privacypolicies.com/blog/gdpr-consent-examples/
- jlokier 7y ago
  You said yourself: >>Clear affirmative action - the person must expressly consent by doing or saying something It's not "clearly affirmative" if it's a default that's difficult to find the alternative to, or easy to select by mistake.
  - Supermancho 7y ago
    Thats a subjective interpretation of "clearly affirmative" that matches more closely with "obvious and clear or straightforward". An option can be obvious to find and yet worded unclearly as we have all encountered "do you want to opt out or not?" Y/N - wait what did the text blob above this say? Pretending this isnt a delicate issue creates more loopholes and bench time than helping consumers.
    - jlokier 7y ago
      I think "clearly affirmative" is only possible when it's "clear" - the consumer cannot clearly affirm to an unclearly-worded question. You can also cover it under "easy to select by mistake [the unintended answer]". I think the root of the problem in most cases is that companies don't want to help consumers, they actively want to mislead them and then claim plausible deniability. I don't understand which sense you mean by "pretending this isn't a delicate issue..." here. I can't even tell if you are pro-GDPR or anti-GDPR from that, and which of those positions you consider to be helping consumers more. Ironic, Y/N? :-)
      - toohotatopic 7y ago
        Can you tell if I am pro- or anti-GDPR? They, like I, are not arguing for a side (I assume). We are pointing out that the legal situation is not as clear as the article suggests. Judging by the lack of won cases, a default ok button seems to be 'clearly affirmative' enough. The law states [1]: >It shall be as easy to withdraw as to give consent. Nothing states that consent has to be more difficult than non-consenting. >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. The request has to be distinguishable, not the consent. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
        jlokier 7y ago
        > Nothing states that consent has to be more difficult than non-consenting. Nobody is arguing that consent should be more difficult. The complaint is that non-consent is often much more difficult than consent, sometimes ridiculously so. In my personal experience I have been unable to find the no-consent option at all on some sites. Just links that go around in circles, sometimes to hundreds of ambiguous and mixed-polarity yes/no-or-was-it-no/yes-style options (one for each of hundreds of "partner sites" I've never heard of), with the only clear option being consent-to-all. If I eventually click on "ok" that is not freely given consent, it's coerced due to me being unable to find or understand how to decline it. It is technically easy to provide a "decline-to-all" option whenever they have provided a "consent-to-all" option. Therefore, clearly companies which provide an easy consent-to-all but make decline-to-all virtually impossible to select, or actually impossible, are doing so deliberately, intending to frustrate the consumer from exercising their rights. The law says that a person should be able to decline if they choose, that it should be easy enough to do, and easy to understand which option they are choosing. Such sites are not compliant with that principle, and it looks like deliberate non-compliance to me. > The request has to be distinguishable, not the consent. Well, "the request" is what we've been talking about. It means the UI. Things like "Ok" and "decline" buttons, how the options are presented, how they are explained clearly and unambiguously, the ease and accessibility of selecting the freely chosen option, that sort of thing.
- bashinator 7y ago
  "Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent." https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

mattmanser 7y ago

You clearly don't know anything about GDPR, can you please stop commenting?

NeedMoreTea 7y ago

Except one of the aims of GDPR is to explicitly rule that out. Consent requires informed, positive opt-in. Not a dark-patterned default. See ICO's guidance on consent: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

toohotatopic 7y ago
As you write: 'aim' and 'guidance'. But is it actually part of the law?
- NeedMoreTea 7y ago
  They link to the actual legislation at the foot of the page, noting the relevant sections. GDPR is very readable, and pretty concise. They also link to two more in depth explorations of consent. Bear in mind the ICO are the UK's enforcement body, so are presenting an accurate picture of the law. To quote three relevant points from the linked page: The GDPR is clearer that an indication of consent must be unambiguous and involve a clear affirmative action (an opt-in). It specifically bans pre-ticked opt-in boxes. It also requires distinct (‘granular’) consent options for distinct processing operations. Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service. The GDPR gives a specific right to withdraw consent. You need to tell people about their right to withdraw, and offer them easy ways to withdraw consent at any time. If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis. So yes it's law, unless and until someone manages to appeal some interpretation of a point all the way up the chain.
  - toohotatopic 7y ago
    Imagine a disturbing box on a startpage which asks you for consent to some data processing, e.g. to show you the best matching advertisements. That box has a big ok button at the center and a small cross to exit at the top. That's a situation where most people will press ok and give clear affirmative consent. Since most people press ok, it doesn't matter to also offer the service to those who cancel. Actually those people still leave a signal and you can show special ads to anybody who isn't part of the ok-clicker database. I don't see how this would violate the GDPR: - unambigous and clear affirmative action. People press ok and not the closing cross. - no pre-ticket opt-in box - distinct consent to advertisement processing - separation from other terms - not a precondition of signing up - remaining right to withdraw consent - ability to also tell people about their right to withdraw in that box - possible to offer an easy way to withdraw Actually withdrawal has to be as easy as consent. The law states: >It shall be as easy to withdraw as to give consent. That's the point where everybody is violating the law because the opt-out button is not constantly shown like the ok-button for opt-in.

rhizome 7y ago

How about making it illegal to withold your data from commercial sites? Would that be reasonable?