4 ms·

Except one of the aims of GDPR is to explicitly rule that out. Consent requires informed, positive opt-in. Not a dark-patterned default. See ICO's guidance on

Except one of the aims of GDPR is to explicitly rule that out. Consent requires informed, positive opt-in. Not a dark-patterned default. See ICO's guidance on consent: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

toohotatopic 7y ago
As you write: 'aim' and 'guidance'. But is it actually part of the law?
- NeedMoreTea 7y ago
  They link to the actual legislation at the foot of the page, noting the relevant sections. GDPR is very readable, and pretty concise. They also link to two more in depth explorations of consent. Bear in mind the ICO are the UK's enforcement body, so are presenting an accurate picture of the law. To quote three relevant points from the linked page: The GDPR is clearer that an indication of consent must be unambiguous and involve a clear affirmative action (an opt-in). It specifically bans pre-ticked opt-in boxes. It also requires distinct (‘granular’) consent options for distinct processing operations. Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service. The GDPR gives a specific right to withdraw consent. You need to tell people about their right to withdraw, and offer them easy ways to withdraw consent at any time. If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis. So yes it's law, unless and until someone manages to appeal some interpretation of a point all the way up the chain.
  - toohotatopic 7y ago
    Imagine a disturbing box on a startpage which asks you for consent to some data processing, e.g. to show you the best matching advertisements. That box has a big ok button at the center and a small cross to exit at the top. That's a situation where most people will press ok and give clear affirmative consent. Since most people press ok, it doesn't matter to also offer the service to those who cancel. Actually those people still leave a signal and you can show special ads to anybody who isn't part of the ok-clicker database. I don't see how this would violate the GDPR: - unambigous and clear affirmative action. People press ok and not the closing cross. - no pre-ticket opt-in box - distinct consent to advertisement processing - separation from other terms - not a precondition of signing up - remaining right to withdraw consent - ability to also tell people about their right to withdraw in that box - possible to offer an easy way to withdraw Actually withdrawal has to be as easy as consent. The law states: >It shall be as easy to withdraw as to give consent. That's the point where everybody is violating the law because the opt-out button is not constantly shown like the ok-button for opt-in.
    - cmarschner 7y ago
      What I find very unsettling is that opt-out options are often processed much more slowly than the “ok with everything” option, to the point that it’s almost unusable. I remember Oath to be one if these networks.

toohotatopic 7y ago

As you write: 'aim' and 'guidance'. But is it actually part of the law?

NeedMoreTea 7y ago
They link to the actual legislation at the foot of the page, noting the relevant sections. GDPR is very readable, and pretty concise. They also link to two more in depth explorations of consent. Bear in mind the ICO are the UK's enforcement body, so are presenting an accurate picture of the law. To quote three relevant points from the linked page: The GDPR is clearer that an indication of consent must be unambiguous and involve a clear affirmative action (an opt-in). It specifically bans pre-ticked opt-in boxes. It also requires distinct (‘granular’) consent options for distinct processing operations. Consent should be separate from other terms and conditions and should not generally be a precondition of signing up to a service. The GDPR gives a specific right to withdraw consent. You need to tell people about their right to withdraw, and offer them easy ways to withdraw consent at any time. If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis. So yes it's law, unless and until someone manages to appeal some interpretation of a point all the way up the chain.
- toohotatopic 7y ago
  Imagine a disturbing box on a startpage which asks you for consent to some data processing, e.g. to show you the best matching advertisements. That box has a big ok button at the center and a small cross to exit at the top. That's a situation where most people will press ok and give clear affirmative consent. Since most people press ok, it doesn't matter to also offer the service to those who cancel. Actually those people still leave a signal and you can show special ads to anybody who isn't part of the ok-clicker database. I don't see how this would violate the GDPR: - unambigous and clear affirmative action. People press ok and not the closing cross. - no pre-ticket opt-in box - distinct consent to advertisement processing - separation from other terms - not a precondition of signing up - remaining right to withdraw consent - ability to also tell people about their right to withdraw in that box - possible to offer an easy way to withdraw Actually withdrawal has to be as easy as consent. The law states: >It shall be as easy to withdraw as to give consent. That's the point where everybody is violating the law because the opt-out button is not constantly shown like the ok-button for opt-in.
  - cmarschner 7y ago
    What I find very unsettling is that opt-out options are often processed much more slowly than the “ok with everything” option, to the point that it’s almost unusable. I remember Oath to be one if these networks.