4 ms·

Make your choice: Accept that the next time you visit they will remember you. or Choose not to visit. or Delete your cookie or use curl or go private bro

by wolco 7y ago

Make your choice: Accept that the next time you visit they will remember you. or Choose not to visit. or Delete your cookie or use curl or go private browser mode or hunt in google for the title to read the cache page or pay someone to copy over the contents to text. Plenty of choices. I'd go private browser mode in your case. Well I would just accept the cookie.

fennecfoxen 7y ago
Why would anyone bother with doing that when they could simply act righteously indignant, and post complaints that some uppity American-based website is noncompliant with their enlightened and unimpeachable European dictates?
PeterisP 7y ago
It's not really about the cookies - it does not limit itself to "the next time you visit they will remember you" - even in the case of private browser mode (or if deleting cookies) it won't proceed without "agreeing" to the use of cookies and other similar technologies (i.e. whatever fingerprinting methods they can figure out - their privacy policy lists that they're tracking pretty much everything that I could think of, including my actions on other sites) and granting permission to a very large number of third parties to use this data in the future. That's not reasonable. Consent must be freely given (and if provision of services is conditional on consent, then it shall be deemed not freely given), it must be opt-in and it shall be as easy to withdraw consent as it was to give it. And if your legal basis for processing data is something other than consent, then don't ask to "agree" to it, implying that this happens with consent - but in their case their privacy policy does list consent as the basis for processing this data. Their current behavior of "surely you'll permit us to track everything" is both immoral and illegal, and it should be eliminated, not tolerated. It's worth noting that they are an exception. While various "GDPR-banners" are quite popular, as a matter of principle, I never agree to anything on them and refuse consent to everything, and it turns out that it's not a problem for most sites, they note the preference, follow the law and it ends at that. GDPR has no issues with storing a non-personalized cookie noting that preference, which some sites do, so as not to ask every time. So the fact that Verizon Media is agressively flounting the law is not appropriate. Most of the fault probably lies with the Irish regulator, which has been far too lax in proactively policing the many international companies (including Verizon Media) which have their EU operations and their GDPR compliance domiciled in Ireland, but I'm sure we'll force things to change eventually.
- wolco 7y ago
  In this case I don't understand. They ask for consent. You choose to provide it. If you are putting forward the idea that you should be able to not consent but still use the service or view the content. Anyone not providing access is doing an illegal act in Europe. I'm not sure that's fair either. You choose to visit the site.
  - PeterisP 7y ago
    Well, I personally choose not to provide it as a matter of principle, but regarding those who do click "agree" the position (both legal and moral) is that they don't really choose to consent. GDPR permits multiple legal basis of processing data (e.g. the need for data to fulfil a specific contract), but they generally don't apply to processing all kinds of semi-relevant data for targeting advertising. Consent is a legal basis under GDPR if and only if it's truly voluntary; one of the key criteria is consent being feely given. You can't "trade" something for that permission (give me consent and I'll give you X, refuse consent and I'll refuse X), it must be freely given because the user wants to give that data, because they believe that it's good for them for the service provider to have and use that data. I.e. you can voluntarily choose to allow tracking for advertising purposes because in that case the ads are more relevant to you, or you can refuse that tracking if you think that this is not what you want. So the idea is that privacy and consent to violations of privacy is not something that I can trade away (e.g. by choosing to visit a site) - it's not for sale, they can't buy it, I can't sell it. Offering something in return (e.g. the ability to visit the site) can not be a way to obtain consent. If refusing consent will result in access being revoked or some other bad consequences (e.g. losing discounts) then it's not considered a free choice. (GDPR recital 42 "... Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.) They can deny people access to the site. But if they extract a click on "I agree" by forcing to choose to click there or go away, then that click does not and should not be counted as a consent to violate people's privacy; these rights are fundamental and they can't be given away with a click or sold for some money or traded away as a point in, for example, an employment contract. Revoking access (or threatening to revoke access) to a site is not a legally (and morally) valid way to gain permission to violate the privacy all their users. And that is the intended point of GDPR - there should be no way for web companies to structure their legal or technical mechanisms in a way where they somehow obtain a permission to abuse the data of all their users. They can use some data of everyone for specific limited purposes (e.g. the legitimate need clause). They can use data for whatever purposes specific people choose to volunteer. But they do not, and should not have a way to "extract permission" to simply sell all their users privacy to third parties; nothing they can do in their privacy policy or terms and conditions or web click-throughs can provide that - the intended result is that they can't get the permission from everyone to do everything, and they actually have to stop doing many of the things they currently list in their privacy policy. And that's what I want Verizon Media to do - it's not that they haven't done some ritual to legitimize their tracking, it's that their current tracking is fundamentally illegitimate no matter what legalese they write in their terms and conditions, and they should stop the mass invasive tracking of all their users except the minority who might intentionally opt-in for whatever reason. And if they don't stop it, they need to be forced to stop.

by wolco 7y ago

fennecfoxen 7y ago

Why would anyone bother with doing that when they could simply act righteously indignant, and post complaints that some uppity American-based website is noncompliant with their enlightened and unimpeachable European dictates?

PeterisP 7y ago

It's not really about the cookies - it does not limit itself to "the next time you visit they will remember you" - even in the case of private browser mode (or if deleting cookies) it won't proceed without "agreeing" to the use of cookies and other similar technologies (i.e. whatever fingerprinting methods they can figure out - their privacy policy lists that they're tracking pretty much everything that I could think of, including my actions on other sites) and granting permission to a very large number of third parties to use this data in the future. That's not reasonable. Consent must be freely given (and if provision of services is conditional on consent, then it shall be deemed not freely given), it must be opt-in and it shall be as easy to withdraw consent as it was to give it. And if your legal basis for processing data is something other than consent, then don't ask to "agree" to it, implying that this happens with consent - but in their case their privacy policy does list consent as the basis for processing this data. Their current behavior of "surely you'll permit us to track everything" is both immoral and illegal, and it should be eliminated, not tolerated. It's worth noting that they are an exception. While various "GDPR-banners" are quite popular, as a matter of principle, I never agree to anything on them and refuse consent to everything, and it turns out that it's not a problem for most sites, they note the preference, follow the law and it ends at that. GDPR has no issues with storing a non-personalized cookie noting that preference, which some sites do, so as not to ask every time. So the fact that Verizon Media is agressively flounting the law is not appropriate. Most of the fault probably lies with the Irish regulator, which has been far too lax in proactively policing the many international companies (including Verizon Media) which have their EU operations and their GDPR compliance domiciled in Ireland, but I'm sure we'll force things to change eventually.

wolco 7y ago
In this case I don't understand. They ask for consent. You choose to provide it. If you are putting forward the idea that you should be able to not consent but still use the service or view the content. Anyone not providing access is doing an illegal act in Europe. I'm not sure that's fair either. You choose to visit the site.
- PeterisP 7y ago
  Well, I personally choose not to provide it as a matter of principle, but regarding those who do click "agree" the position (both legal and moral) is that they don't really choose to consent. GDPR permits multiple legal basis of processing data (e.g. the need for data to fulfil a specific contract), but they generally don't apply to processing all kinds of semi-relevant data for targeting advertising. Consent is a legal basis under GDPR if and only if it's truly voluntary; one of the key criteria is consent being feely given. You can't "trade" something for that permission (give me consent and I'll give you X, refuse consent and I'll refuse X), it must be freely given because the user wants to give that data, because they believe that it's good for them for the service provider to have and use that data. I.e. you can voluntarily choose to allow tracking for advertising purposes because in that case the ads are more relevant to you, or you can refuse that tracking if you think that this is not what you want. So the idea is that privacy and consent to violations of privacy is not something that I can trade away (e.g. by choosing to visit a site) - it's not for sale, they can't buy it, I can't sell it. Offering something in return (e.g. the ability to visit the site) can not be a way to obtain consent. If refusing consent will result in access being revoked or some other bad consequences (e.g. losing discounts) then it's not considered a free choice. (GDPR recital 42 "... Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.) They can deny people access to the site. But if they extract a click on "I agree" by forcing to choose to click there or go away, then that click does not and should not be counted as a consent to violate people's privacy; these rights are fundamental and they can't be given away with a click or sold for some money or traded away as a point in, for example, an employment contract. Revoking access (or threatening to revoke access) to a site is not a legally (and morally) valid way to gain permission to violate the privacy all their users. And that is the intended point of GDPR - there should be no way for web companies to structure their legal or technical mechanisms in a way where they somehow obtain a permission to abuse the data of all their users. They can use some data of everyone for specific limited purposes (e.g. the legitimate need clause). They can use data for whatever purposes specific people choose to volunteer. But they do not, and should not have a way to "extract permission" to simply sell all their users privacy to third parties; nothing they can do in their privacy policy or terms and conditions or web click-throughs can provide that - the intended result is that they can't get the permission from everyone to do everything, and they actually have to stop doing many of the things they currently list in their privacy policy. And that's what I want Verizon Media to do - it's not that they haven't done some ritual to legitimize their tracking, it's that their current tracking is fundamentally illegitimate no matter what legalese they write in their terms and conditions, and they should stop the mass invasive tracking of all their users except the minority who might intentionally opt-in for whatever reason. And if they don't stop it, they need to be forced to stop.