5 ms·

You said yourself: >>Clear affirmative action - the person must expressly consent by doing or saying something It's not "clearly affirmative" if it's a defaul

You said yourself: >>Clear affirmative action - the person must expressly consent by doing or saying something It's not "clearly affirmative" if it's a default that's difficult to find the alternative to, or easy to select by mistake.

Supermancho 7y ago
Thats a subjective interpretation of "clearly affirmative" that matches more closely with "obvious and clear or straightforward". An option can be obvious to find and yet worded unclearly as we have all encountered "do you want to opt out or not?" Y/N - wait what did the text blob above this say? Pretending this isnt a delicate issue creates more loopholes and bench time than helping consumers.
- jlokier 7y ago
  I think "clearly affirmative" is only possible when it's "clear" - the consumer cannot clearly affirm to an unclearly-worded question. You can also cover it under "easy to select by mistake [the unintended answer]". I think the root of the problem in most cases is that companies don't want to help consumers, they actively want to mislead them and then claim plausible deniability. I don't understand which sense you mean by "pretending this isn't a delicate issue..." here. I can't even tell if you are pro-GDPR or anti-GDPR from that, and which of those positions you consider to be helping consumers more. Ironic, Y/N? :-)
  - toohotatopic 7y ago
    Can you tell if I am pro- or anti-GDPR? They, like I, are not arguing for a side (I assume). We are pointing out that the legal situation is not as clear as the article suggests. Judging by the lack of won cases, a default ok button seems to be 'clearly affirmative' enough. The law states [1]: >It shall be as easy to withdraw as to give consent. Nothing states that consent has to be more difficult than non-consenting. >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. The request has to be distinguishable, not the consent. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
    - jlokier 7y ago
      > Nothing states that consent has to be more difficult than non-consenting. Nobody is arguing that consent should be more difficult. The complaint is that non-consent is often much more difficult than consent, sometimes ridiculously so. In my personal experience I have been unable to find the no-consent option at all on some sites. Just links that go around in circles, sometimes to hundreds of ambiguous and mixed-polarity yes/no-or-was-it-no/yes-style options (one for each of hundreds of "partner sites" I've never heard of), with the only clear option being consent-to-all. If I eventually click on "ok" that is not freely given consent, it's coerced due to me being unable to find or understand how to decline it. It is technically easy to provide a "decline-to-all" option whenever they have provided a "consent-to-all" option. Therefore, clearly companies which provide an easy consent-to-all but make decline-to-all virtually impossible to select, or actually impossible, are doing so deliberately, intending to frustrate the consumer from exercising their rights. The law says that a person should be able to decline if they choose, that it should be easy enough to do, and easy to understand which option they are choosing. Such sites are not compliant with that principle, and it looks like deliberate non-compliance to me. > The request has to be distinguishable, not the consent. Well, "the request" is what we've been talking about. It means the UI. Things like "Ok" and "decline" buttons, how the options are presented, how they are explained clearly and unambiguously, the ease and accessibility of selecting the freely chosen option, that sort of thing.
      - toohotatopic 7y ago
        >Therefore, clearly companies which provide an easy consent-to-all but make decline-to-all virtually impossible to select, or actually impossible, are doing so deliberately, intending to frustrate the consumer from exercising their rights. Yes, that's their business concept and it is legal. >The law says that a person should be able to decline if they choose, that it should be easy enough to do, and easy to understand which option they are choosing. The law states: >>It shall be as easy to withdraw as to give consent. >Such sites are not compliant with that principle, and it looks like deliberate non-compliance to me. I rather think that they follow the law to the T. People would love if their behavior would be illegal but they forgot that companies are involved in the law making process, too. The EU wants its companies to be competitive on the internet. Making it impossible for companies to finance themselves with advertising in their home market would kill their already weak internet economy. Who would accept the sharing of private data if a rejecting would be as easy as accepting? GDPR is a compromise between the protection of the netizens and the business interest of the economy. As such, it protects against the worst abuse but the world is not free. In one way or the other, somebody has to pay.

Supermancho 7y ago

Thats a subjective interpretation of "clearly affirmative" that matches more closely with "obvious and clear or straightforward". An option can be obvious to find and yet worded unclearly as we have all encountered "do you want to opt out or not?" Y/N - wait what did the text blob above this say? Pretending this isnt a delicate issue creates more loopholes and bench time than helping consumers.

jlokier 7y ago
I think "clearly affirmative" is only possible when it's "clear" - the consumer cannot clearly affirm to an unclearly-worded question. You can also cover it under "easy to select by mistake [the unintended answer]". I think the root of the problem in most cases is that companies don't want to help consumers, they actively want to mislead them and then claim plausible deniability. I don't understand which sense you mean by "pretending this isn't a delicate issue..." here. I can't even tell if you are pro-GDPR or anti-GDPR from that, and which of those positions you consider to be helping consumers more. Ironic, Y/N? :-)
- toohotatopic 7y ago
  Can you tell if I am pro- or anti-GDPR? They, like I, are not arguing for a side (I assume). We are pointing out that the legal situation is not as clear as the article suggests. Judging by the lack of won cases, a default ok button seems to be 'clearly affirmative' enough. The law states [1]: >It shall be as easy to withdraw as to give consent. Nothing states that consent has to be more difficult than non-consenting. >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. The request has to be distinguishable, not the consent. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
  - jlokier 7y ago
    > Nothing states that consent has to be more difficult than non-consenting. Nobody is arguing that consent should be more difficult. The complaint is that non-consent is often much more difficult than consent, sometimes ridiculously so. In my personal experience I have been unable to find the no-consent option at all on some sites. Just links that go around in circles, sometimes to hundreds of ambiguous and mixed-polarity yes/no-or-was-it-no/yes-style options (one for each of hundreds of "partner sites" I've never heard of), with the only clear option being consent-to-all. If I eventually click on "ok" that is not freely given consent, it's coerced due to me being unable to find or understand how to decline it. It is technically easy to provide a "decline-to-all" option whenever they have provided a "consent-to-all" option. Therefore, clearly companies which provide an easy consent-to-all but make decline-to-all virtually impossible to select, or actually impossible, are doing so deliberately, intending to frustrate the consumer from exercising their rights. The law says that a person should be able to decline if they choose, that it should be easy enough to do, and easy to understand which option they are choosing. Such sites are not compliant with that principle, and it looks like deliberate non-compliance to me. > The request has to be distinguishable, not the consent. Well, "the request" is what we've been talking about. It means the UI. Things like "Ok" and "decline" buttons, how the options are presented, how they are explained clearly and unambiguously, the ease and accessibility of selecting the freely chosen option, that sort of thing.
    - toohotatopic 7y ago
      >Therefore, clearly companies which provide an easy consent-to-all but make decline-to-all virtually impossible to select, or actually impossible, are doing so deliberately, intending to frustrate the consumer from exercising their rights. Yes, that's their business concept and it is legal. >The law says that a person should be able to decline if they choose, that it should be easy enough to do, and easy to understand which option they are choosing. The law states: >>It shall be as easy to withdraw as to give consent. >Such sites are not compliant with that principle, and it looks like deliberate non-compliance to me. I rather think that they follow the law to the T. People would love if their behavior would be illegal but they forgot that companies are involved in the law making process, too. The EU wants its companies to be competitive on the internet. Making it impossible for companies to finance themselves with advertising in their home market would kill their already weak internet economy. Who would accept the sharing of private data if a rejecting would be as easy as accepting? GDPR is a compromise between the protection of the netizens and the business interest of the economy. As such, it protects against the worst abuse but the world is not free. In one way or the other, somebody has to pay.