4 ms·

I'm disappointed by Schneier's presentation of requiring consent as a way to protect people from privacy invasion. The practice of consent on websites right no

I'm disappointed by Schneier's presentation of requiring consent as a way to protect people from privacy invasion. The practice of consent on websites right now is ridiculous. Look no further than the GDPR-required cookie notices every European website has. You know, the popup boxes you only look at long enough to find the "I accept" button? That's not meaningful consent. Nor is every clickwrap software whose 20 page license has buried in it "by using this software you consent to letting us track your every movement and sell it to data brokers" or whatever nonsense is current. The only meaningful application of consent would be opt-in consent. Where you could use the software / website / whatever without agreeing to the invasion of privacy, and where the balance is tipped towards requiring consumers make an informed decision to opt in for some significant benefit. Of course no surveillance capitalist company, nor authoritarian government, would tolerate that kind of consent requirement.

rapnie 7y ago
I always look for the "I reject" or "Configure" buttons, and where they are missing or obscured by dark patterns, then I know enough: This site is not for me (even though I have Badger and uBlock).
theptip 7y ago
> Look no further than the GDPR-required cookie notices every European website has. You know, the popup boxes you only look at long enough to find the "I accept" button? That's not meaningful consent. The good thing about the GDPR in this context, is that it grants you the right to be forgotten; in the case of the OP: 1. It would not be legal for a company to collect information on you without your consent (if you are using their site, they are the data Controller). 2. It would not be legal for Facebook to share this data with another company, without listing the data collector as a Processor. 3. If you later discover that a company has shared your data to a broker, you can have them delete that data after the fact. 4. You're allowed to opt out of any collection that isn't required to provide the service; it's not permissible to just claim "I need to transmit your PII to this data broker in order to serve you news articles".) So at least we have remedies for the cases where a site is later found to be acting outside of the norms that folks assume when they click through the terms, unlike in the US where you cannot really put the genie back in the bottle once your data has leaked. I agree with your point that ideally people would pay attention to the permissions that apps/sites requested, and closely analyzed them, but it's quite clear to me that most humans don't care enough about privacy to take these actions ahead of time. So insasmuch as GDPR lets you fix those mistakes retroactively, it's providing a benefit.
- esotericn 7y ago
  People do pay attention to the permissions but it's very often intentionally obfuscated. Opting in is instant whereas clicking 'no' comes up with spinners, complex trees of options, whatever else (i.e. it's not actually opt in; the default, fast path has the box checked, so it's opt out, because the active action is to have to opt out).
  - LargoLasskhyfv 7y ago
    The most ridiculous way are the popups labeled something like 'choices' wherein you have to click every single one of up to 200 companies to NO/OFF, by setting a cookie on their sites, which often doesn't work, because overloaded, or intentionally? That is schizophrenic!

rapnie 7y ago

I always look for the "I reject" or "Configure" buttons, and where they are missing or obscured by dark patterns, then I know enough: This site is not for me (even though I have Badger and uBlock).

theptip 7y ago

> Look no further than the GDPR-required cookie notices every European website has. You know, the popup boxes you only look at long enough to find the "I accept" button? That's not meaningful consent. The good thing about the GDPR in this context, is that it grants you the right to be forgotten; in the case of the OP: 1. It would not be legal for a company to collect information on you without your consent (if you are using their site, they are the data Controller). 2. It would not be legal for Facebook to share this data with another company, without listing the data collector as a Processor. 3. If you later discover that a company has shared your data to a broker, you can have them delete that data after the fact. 4. You're allowed to opt out of any collection that isn't required to provide the service; it's not permissible to just claim "I need to transmit your PII to this data broker in order to serve you news articles".) So at least we have remedies for the cases where a site is later found to be acting outside of the norms that folks assume when they click through the terms, unlike in the US where you cannot really put the genie back in the bottle once your data has leaked. I agree with your point that ideally people would pay attention to the permissions that apps/sites requested, and closely analyzed them, but it's quite clear to me that most humans don't care enough about privacy to take these actions ahead of time. So insasmuch as GDPR lets you fix those mistakes retroactively, it's providing a benefit.

esotericn 7y ago
People do pay attention to the permissions but it's very often intentionally obfuscated. Opting in is instant whereas clicking 'no' comes up with spinners, complex trees of options, whatever else (i.e. it's not actually opt in; the default, fast path has the box checked, so it's opt out, because the active action is to have to opt out).
- LargoLasskhyfv 7y ago
  The most ridiculous way are the popups labeled something like 'choices' wherein you have to click every single one of up to 200 companies to NO/OFF, by setting a cookie on their sites, which often doesn't work, because overloaded, or intentionally? That is schizophrenic!