8 ms·

The cat and mouse games will continue until legal action is taken. Before loading any tracking at all the user should be shown a Yes/no option.

pndy 7y ago
If legal action would be taken, shouldn't browser have the controls regarding tracking preference? Setting up each page (provided that 'No' would still load page in either full or stripped-down variant) on each devices owned and/or reapplying choices whenever browser cache is cleared would be frustrating. Maybe DNT should return as respected feature within browser and user choice shouldn't affect the access to the content but only its form.
- toper-centage 7y ago
  Exactly. That's how we ended up with the terrible cookie warnings. The funny thing is that GDPR has language about respecting the DNT but no one cares.
  - tristador 7y ago
    Is there a good example of a large company that blatantly ignores DNT? I'd guess its hard to know as a lot of the tracking could be server side only.
- kube-system 7y ago
  DNT is counterproductive from a technical perspective. The more bits of entropy you give trackers, the easier you are to track.
  - fauigerzigerk 7y ago
    If DNT was legally binding, they wouldn't be allowed to use that additional bit of entropy. But I would prefer a PTM (please track me) header with legally binding semantics.
    - kube-system 7y ago
      Those who abuse it the most will just move to a jurisdiction where it is allowed. Or they'll do it anyway, since many of the worst threats on the internet are already criminal. On the internet, technical solutions > legal solutions.
      - fauigerzigerk 7y ago
        There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. Tracking only pays if you can track a huge number of people and sell ads to a huge number of advertisers. The profit per tracked user is too small to pay for running a criminal enterprise. Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law.
        kube-system 7y ago
        > There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. True, most illicit ads tend to be non-targeted. But some criminals do things like blackmail, fraud, espionage, etc. using tracking data. > Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law. That all depends on the specific business model, business partners, and their presence. Regardless, what I describe is not conjecture, many companies are shuffling around data to avoid GDPR rather than comply. https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law https://www.theguardian.com/technology/2018/apr/19/facebook-... A different company without a physical presence or business partner in the jurisdiction in question, might have little to no incentive to follow the law. In the end, even if companies are breaking the law, or even if they are fined, your data won't be protected unless they actually change their behavior as a result. Calculated non-compliance is a commonplace strategy for corporate legal compliance.
adrianN 7y ago
That didn't work out so well for the EU's cookie law. We need a different solution I think.
- dmitriid 7y ago
  I think it worked wonders with GDPR which exposed all this pus. Unfortunately, there EU has been too slow acting on it. Only British Airways has been slapped with a significant fine so far.
  - taurath 7y ago
    GDPR opt out rate is well well under 1%.
    - kelnos 7y ago
      What does that even mean? GDPR requires companies to request that people opt in to information gathering.
      - martin_a 7y ago
        And in reality, as long as no fear-mongering fines are handed out, companies will try to bypass it. There would be ways to get control over this, but law is slow.
      - kevsim 7y ago
        IANAL, but this is not entirely true. Under GDPR data can be used by claiming "legitimate interest" [0]. In the case of legitimate interest, the user needs to opt-out rather than opt-in. 0: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat...
      - leni536 7y ago
        I rarely see opt in GDPR popups, it's typically "accept tracking" or "more options...", the latter seemingly sending you down an infinite rabbit hole. Well, now that I think about it, this might count as opt in, but this is definitely a dark pattern.
dmitriid 7y ago
One acronym: GDPR It's also one of the reasons why people have become so acutely aware of the problem. When the umpteenth site asks you to consent to over 200 ad providers/trackers, there's clearly something wrong.
ewidar 7y ago
Actually from what I can see, checking US websites from Paris gives much less requests. Compare the request map for CNN from - Dulles, VA: 511 requests https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27dfdc2ad99109ede306579482 https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27df... - Paris, France: 77 requests https://requestmap.herokuapp.com/render/200123_87_39fdca38ac0919d45e5e950d816e29bc https://requestmap.herokuapp.com/render/200123_87_39fdca38ac... I don't know if it's for sure because of the cookies/gdpr law, but there is a clear difference, and that's a big win in my opinion.

pndy 7y ago

If legal action would be taken, shouldn't browser have the controls regarding tracking preference? Setting up each page (provided that 'No' would still load page in either full or stripped-down variant) on each devices owned and/or reapplying choices whenever browser cache is cleared would be frustrating. Maybe DNT should return as respected feature within browser and user choice shouldn't affect the access to the content but only its form.

toper-centage 7y ago
Exactly. That's how we ended up with the terrible cookie warnings. The funny thing is that GDPR has language about respecting the DNT but no one cares.
- tristador 7y ago
  Is there a good example of a large company that blatantly ignores DNT? I'd guess its hard to know as a lot of the tracking could be server side only.
kube-system 7y ago
DNT is counterproductive from a technical perspective. The more bits of entropy you give trackers, the easier you are to track.
- fauigerzigerk 7y ago
  If DNT was legally binding, they wouldn't be allowed to use that additional bit of entropy. But I would prefer a PTM (please track me) header with legally binding semantics.
  - kube-system 7y ago
    Those who abuse it the most will just move to a jurisdiction where it is allowed. Or they'll do it anyway, since many of the worst threats on the internet are already criminal. On the internet, technical solutions > legal solutions.
    - fauigerzigerk 7y ago
      There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. Tracking only pays if you can track a huge number of people and sell ads to a huge number of advertisers. The profit per tracked user is too small to pay for running a criminal enterprise. Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law.
      - kube-system 7y ago
        > There are clearly some things that are economically viable as a criminal enterprise, but I don't think tracking people for ad targeting purposes is one of those things. True, most illicit ads tend to be non-targeted. But some criminals do things like blackmail, fraud, espionage, etc. using tracking data. > Moving to a different jurisdiction is impossible as your customers (the advertisers) and the sites/apps where ads are placed would still be breaking the law. That all depends on the specific business model, business partners, and their presence. Regardless, what I describe is not conjecture, many companies are shuffling around data to avoid GDPR rather than comply. https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law https://www.theguardian.com/technology/2018/apr/19/facebook-... A different company without a physical presence or business partner in the jurisdiction in question, might have little to no incentive to follow the law. In the end, even if companies are breaking the law, or even if they are fined, your data won't be protected unless they actually change their behavior as a result. Calculated non-compliance is a commonplace strategy for corporate legal compliance.

adrianN 7y ago

That didn't work out so well for the EU's cookie law. We need a different solution I think.

dmitriid 7y ago
I think it worked wonders with GDPR which exposed all this pus. Unfortunately, there EU has been too slow acting on it. Only British Airways has been slapped with a significant fine so far.
- taurath 7y ago
  GDPR opt out rate is well well under 1%.
  - kelnos 7y ago
    What does that even mean? GDPR requires companies to request that people opt in to information gathering.
    - martin_a 7y ago
      And in reality, as long as no fear-mongering fines are handed out, companies will try to bypass it. There would be ways to get control over this, but law is slow.
    - kevsim 7y ago
      IANAL, but this is not entirely true. Under GDPR data can be used by claiming "legitimate interest" [0]. In the case of legitimate interest, the user needs to opt-out rather than opt-in. 0: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat...
    - leni536 7y ago
      I rarely see opt in GDPR popups, it's typically "accept tracking" or "more options...", the latter seemingly sending you down an infinite rabbit hole. Well, now that I think about it, this might count as opt in, but this is definitely a dark pattern.

dmitriid 7y ago

One acronym: GDPR It's also one of the reasons why people have become so acutely aware of the problem. When the umpteenth site asks you to consent to over 200 ad providers/trackers, there's clearly something wrong.

ewidar 7y ago

Actually from what I can see, checking US websites from Paris gives much less requests. Compare the request map for CNN from - Dulles, VA: 511 requests https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27dfdc2ad99109ede306579482 https://requestmap.herokuapp.com/render/200123_JH_ed7b9b27df... - Paris, France: 77 requests https://requestmap.herokuapp.com/render/200123_87_39fdca38ac0919d45e5e950d816e29bc https://requestmap.herokuapp.com/render/200123_87_39fdca38ac... I don't know if it's for sure because of the cookies/gdpr law, but there is a clear difference, and that's a big win in my opinion.