6 ms·

Can we kill off anything that takes more than a second or two to 'not opt-in' as well? It's obviously against the spirit of the law to have 200 different boxes

Can we kill off anything that takes more than a second or two to 'not opt-in' as well? It's obviously against the spirit of the law to have 200 different boxes that must be individually unticked, or the sort of nonsense that Oracle were pulling a while back (maybe still do) with the intentional delay spinner if you don't 'opt-in'.

gpderetta 6y ago
it is against both the spirit and the letter, as preticked boxes are not considered a valid opt-in.
- deleted 6y ago
  [deleted]
- smolder 6y ago
  It's amazing how stubbornly site operators are clinging to tricks to get user data as if it's not all prohibited by GDPR.
  - mindslight 6y ago
    They're used to stonewalling USian regulators who will capitulate after a round or two.
  - Mirioron 6y ago
    Well, would you rather the site just not exist then? Because I'm pretty sure that most of these sites already aren't making much money. If you make it much much much harder for them to get money then they won't survive.
    - turbinerneiter 6y ago
      So then shut them down. There is no human right to run a profitable website, there is however a human right to privacy. If you can't run a website without literally violating the users basic human rights, then just don't.
      - Mirioron 6y ago
        Users have a choice to use the website. Do you complain that a bar is violating your basic human rights if it has a camera in it? Should all bars with that be shut down? Same for shopping centers and everywhere else. If you don't like it then simply don't use the website. It's really not that difficult.
        gpderetta 6y ago
        the GDPR does apply to a camera in a bar. As long as it is used exclusively for security and data purged regularly, it can be claimed to be required. Certainly the bar owner cannot distribute the videos without explicit consent. And yes, that can be problematic in many cases (for examples, capturing faces of people in a concert).
        deleted 6y ago
        [deleted]
        PeterisP 6y ago
        GDPR definitely applies to cameras in bars or shopping centers - in fact, much more of GDPR enforcement has been about issues such as those, the web world is not that important. If a shopping center would want to distribute surveillance camera data to 'trusted partners' for marketing research without informed consent of the customers, that would definitely be a GDPR violation, and there would not be a "if you don't like it then don't go to that supermarket" situation but "if your supermarket can't survive without that income, then tough luck".
        gpderetta 6y ago
        there is this misunderstanding that GDPR is only (or primarily) about cookies or even online presence.
        wlll 6y ago
        > Users have a choice to use the website. Correct, and thankfully website operators don't get the choice to violate users privacy without consent.
    - smolder 6y ago
      Yes, I would. I would prefer that adtech as it is became unviable. People will come up with better schemes to pay for content online. Just showing ads without the ubiquitous targeting and tracking worked fine for television.
      - deleted 6y ago
        [deleted]
      - forgotmylogin2 6y ago
        No, it didn't. It worked horrible for television. Every hour of television was filled with over 15 minutes of ads. It was horrible for the consumer.
        smolder 6y ago
        The harm that can and most likely will be done by under-regulated trade of peoples intimate information is far greater than the harm of showing them ads. Targeted disinformation has already made a huge mess of US politics. Turning "personal computers", phones, and IoT junk into surveillance devices a la 1984 was either profoundly short-sighted and stupid or a very clever attack on individual liberty and agency, depending on intent of each actor involved. To the extent that knowledge is power, people are being tricked into giving up far too much. I say tricked because of what isn't immediately obvious when transacting with some tracking system on an otherwise free website: When you give up a small piece of seemingly insignificant data about yourself a million times per year, the aggregate is wildly more significant than the sum of those pieces. When you and everyone you know give up the aggregate of each persons aggregate information, again, its value is compounded. Finally, since no one has any insight into nor control over where their data ends up or how it's used down the road, the danger of sharing is even less evident. Good can and does come from transparency, but this is one-way transparency. It's top-down and is begging for abuse. If we had a truly voter-representative government, it would have already created laws to mitigate the easy-to-anticipate problems that arise from massive accumulations of personal information, and we would no doubt have a better, if less profitable, WWW as a result.
  - tgsovlerkhgsel 6y ago
    It's even more amazing how regulators have been tolerating such blatant abuses instead of just grabbing the Alexa Top 1000, filtering for sites in their jurisdiction, and then going top-to-bottom slapping every violator with a fine. Start from the top of the list every month, and slap any continued violator with 10x the previous fine. Go as far as time allows within the month. I bet by the start of month 3, 90% of the sites would be compliant instead of 99% of them blatantly violating the rules.
rlpb 6y ago
I would define this as: if a site deliberately makes it any easier to "opt-in" than not, then a user giving up and just clicking the opt-in does not constitute freely giving consent, and any data gathered that way is not in compliance.
- Vinnl 6y ago
  And I feel even that is giving publishers some leeway. Even if a button is theoretically as easy to hit as another button, if it's just a bit of underlined text vs a button with a solid and bright background, they'll still get most of their users "consenting". (I'm wondering if they're teaching me to hit the de-emphasised button by default.)
- input_sh 6y ago
  It's already in there. Article 7, third paragraph: > It shall be as easy to withdraw as to give consent.
  - marvin 6y ago
    Imagine seeing some 10 million euro fines over that. Would be glorious.
    - solarkraft 6y ago
      Would be. But I'm not aware of much actual GDPR enforcement ... :(
      - Gwypaas 6y ago
        It is starting to come, still mostly big players though https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
      - BurningFrog 6y ago
        Once you've made everyone a criminal, enforcement is always selective.
hanniabu 6y ago
I'd base it if clicks and not time. You shouldn't need to do more than 2 clicks and any usage of the site for that process shouldn't be deemed implicit consent.
- esotericn 6y ago
  Both are necessary. Otherwise, you get the 'opt-in = site loads immediately, opt-out = site takes >1 minute to load' scenario and everyone opts in anyway.
p410n3 6y ago
Thats actually what the new ePrivacy regulation is planning. It's just not been adopted still, although it originally should have been 2018. To quote: "Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors." Source: https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...
- peterhil 6y ago
  Finally! EU should have required browser vendors in the first place to handle the intent of the privacy regulation on GDPR, to avoid having this discussion...
  - M2Ys4U 6y ago
    The extant ePrivacy directive is from 2002. So... maybe you should go back in time and tell the EU back at the turn of the millennium that...
    - peterhil 6y ago
      Oh, so why it didn’t happen so that browser vendors and W3C did not add some HTTP header to disallow tracking, and browsers did not represent users options to manage their privacy, instead of these mandatory annoying popups?
  - PeterisP 6y ago
    A law requiring websites to honor 'do not track' header would be sufficient and require no big changes to internet protocols or browsers. People say that DNT failed because it was selected by default - but no, it failed because compliance was voluntary. The EU principles require explicit opt-in confirmation, so a browser setting that's set to "not track" by default is a reasonable way to do it, it only needs enforcement to ensure that websites (in EU jurisdiction) treat the DNT header as binding instruction to not track that user.
thewebcount 6y ago
And while we're at it, let's forbid putting a cookie in your browser that says you opted-out as the opt-out mechanism. It's so stupid. I specifically said I didn't want any of your cookies on my machine, and now to not get your cookies, I have to accept a cookie. Nope, just blocking all cookies instead. If that makes your site not work, I'll just tell my friends your site is broken instead of sending them links to it.

gpderetta 6y ago

it is against both the spirit and the letter, as preticked boxes are not considered a valid opt-in.

deleted 6y ago
[deleted]
smolder 6y ago
It's amazing how stubbornly site operators are clinging to tricks to get user data as if it's not all prohibited by GDPR.
- mindslight 6y ago
  They're used to stonewalling USian regulators who will capitulate after a round or two.
- Mirioron 6y ago
  Well, would you rather the site just not exist then? Because I'm pretty sure that most of these sites already aren't making much money. If you make it much much much harder for them to get money then they won't survive.
  - turbinerneiter 6y ago
    So then shut them down. There is no human right to run a profitable website, there is however a human right to privacy. If you can't run a website without literally violating the users basic human rights, then just don't.
    - Mirioron 6y ago
      Users have a choice to use the website. Do you complain that a bar is violating your basic human rights if it has a camera in it? Should all bars with that be shut down? Same for shopping centers and everywhere else. If you don't like it then simply don't use the website. It's really not that difficult.
      - gpderetta 6y ago
        the GDPR does apply to a camera in a bar. As long as it is used exclusively for security and data purged regularly, it can be claimed to be required. Certainly the bar owner cannot distribute the videos without explicit consent. And yes, that can be problematic in many cases (for examples, capturing faces of people in a concert).
      - deleted 6y ago
        [deleted]
      - PeterisP 6y ago
        GDPR definitely applies to cameras in bars or shopping centers - in fact, much more of GDPR enforcement has been about issues such as those, the web world is not that important. If a shopping center would want to distribute surveillance camera data to 'trusted partners' for marketing research without informed consent of the customers, that would definitely be a GDPR violation, and there would not be a "if you don't like it then don't go to that supermarket" situation but "if your supermarket can't survive without that income, then tough luck".
        gpderetta 6y ago
        there is this misunderstanding that GDPR is only (or primarily) about cookies or even online presence.
      - wlll 6y ago
        > Users have a choice to use the website. Correct, and thankfully website operators don't get the choice to violate users privacy without consent.
  - smolder 6y ago
    Yes, I would. I would prefer that adtech as it is became unviable. People will come up with better schemes to pay for content online. Just showing ads without the ubiquitous targeting and tracking worked fine for television.
    - deleted 6y ago
      [deleted]
    - forgotmylogin2 6y ago
      No, it didn't. It worked horrible for television. Every hour of television was filled with over 15 minutes of ads. It was horrible for the consumer.
      - smolder 6y ago
        The harm that can and most likely will be done by under-regulated trade of peoples intimate information is far greater than the harm of showing them ads. Targeted disinformation has already made a huge mess of US politics. Turning "personal computers", phones, and IoT junk into surveillance devices a la 1984 was either profoundly short-sighted and stupid or a very clever attack on individual liberty and agency, depending on intent of each actor involved. To the extent that knowledge is power, people are being tricked into giving up far too much. I say tricked because of what isn't immediately obvious when transacting with some tracking system on an otherwise free website: When you give up a small piece of seemingly insignificant data about yourself a million times per year, the aggregate is wildly more significant than the sum of those pieces. When you and everyone you know give up the aggregate of each persons aggregate information, again, its value is compounded. Finally, since no one has any insight into nor control over where their data ends up or how it's used down the road, the danger of sharing is even less evident. Good can and does come from transparency, but this is one-way transparency. It's top-down and is begging for abuse. If we had a truly voter-representative government, it would have already created laws to mitigate the easy-to-anticipate problems that arise from massive accumulations of personal information, and we would no doubt have a better, if less profitable, WWW as a result.
- tgsovlerkhgsel 6y ago
  It's even more amazing how regulators have been tolerating such blatant abuses instead of just grabbing the Alexa Top 1000, filtering for sites in their jurisdiction, and then going top-to-bottom slapping every violator with a fine. Start from the top of the list every month, and slap any continued violator with 10x the previous fine. Go as far as time allows within the month. I bet by the start of month 3, 90% of the sites would be compliant instead of 99% of them blatantly violating the rules.

rlpb 6y ago

I would define this as: if a site deliberately makes it any easier to "opt-in" than not, then a user giving up and just clicking the opt-in does not constitute freely giving consent, and any data gathered that way is not in compliance.

Vinnl 6y ago
And I feel even that is giving publishers some leeway. Even if a button is theoretically as easy to hit as another button, if it's just a bit of underlined text vs a button with a solid and bright background, they'll still get most of their users "consenting". (I'm wondering if they're teaching me to hit the de-emphasised button by default.)
input_sh 6y ago
It's already in there. Article 7, third paragraph: > It shall be as easy to withdraw as to give consent.
- marvin 6y ago
  Imagine seeing some 10 million euro fines over that. Would be glorious.
  - solarkraft 6y ago
    Would be. But I'm not aware of much actual GDPR enforcement ... :(
    - Gwypaas 6y ago
      It is starting to come, still mostly big players though https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
    - BurningFrog 6y ago
      Once you've made everyone a criminal, enforcement is always selective.

hanniabu 6y ago

I'd base it if clicks and not time. You shouldn't need to do more than 2 clicks and any usage of the site for that process shouldn't be deemed implicit consent.

esotericn 6y ago
Both are necessary. Otherwise, you get the 'opt-in = site loads immediately, opt-out = site takes >1 minute to load' scenario and everyone opts in anyway.

p410n3 6y ago

Thats actually what the new ePrivacy regulation is planning. It's just not been adopted still, although it originally should have been 2018. To quote: "Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors." Source: https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...

peterhil 6y ago
Finally! EU should have required browser vendors in the first place to handle the intent of the privacy regulation on GDPR, to avoid having this discussion...
- M2Ys4U 6y ago
  The extant ePrivacy directive is from 2002. So... maybe you should go back in time and tell the EU back at the turn of the millennium that...
  - peterhil 6y ago
    Oh, so why it didn’t happen so that browser vendors and W3C did not add some HTTP header to disallow tracking, and browsers did not represent users options to manage their privacy, instead of these mandatory annoying popups?
- PeterisP 6y ago
  A law requiring websites to honor 'do not track' header would be sufficient and require no big changes to internet protocols or browsers. People say that DNT failed because it was selected by default - but no, it failed because compliance was voluntary. The EU principles require explicit opt-in confirmation, so a browser setting that's set to "not track" by default is a reasonable way to do it, it only needs enforcement to ensure that websites (in EU jurisdiction) treat the DNT header as binding instruction to not track that user.

thewebcount 6y ago

And while we're at it, let's forbid putting a cookie in your browser that says you opted-out as the opt-out mechanism. It's so stupid. I specifically said I didn't want any of your cookies on my machine, and now to not get your cookies, I have to accept a cookie. Nope, just blocking all cookies instead. If that makes your site not work, I'll just tell my friends your site is broken instead of sending them links to it.