4 ms·

> Let's imagine...the car builders all decides to just cut the engine if you go over the limit. We don't need to imagine a world like that, because it has noth

> Let's imagine...the car builders all decides to just cut the engine if you go over the limit. We don't need to imagine a world like that, because it has nothing to do with what we are talking about. Let's stick to the real world. The EU implemented a law. Everybody is scared of the power of the government, so they implemented what they thought was the intention of the law, to avoid prosecution. The mom-and-pop flower shop down the street could care less about making troll political statements about technical internet topics. Turns out, the law had stupid unintended consequences. Was the person who designed it stupid? Or is the entire world stupid? If your answer is "the entire world is stupid," then I'd argue you don't understand how the field of design is supposed to work.

belorn 7y ago
> so they implemented what they thought was the intention of the law, to avoid prosecution. That's not what actually happened. Companies got scared that the law would impact their business model, for which the law was directly design to impact, and asked lawyers to find the minimum change which could be argued as being in compliance. When you ask lawyers to find a solution to a problem you do not get the intention of the law. If you ask a lawyer to find a solution to tax law you don't get the intention of the tax law, you get tax avoidance, the direct opposite. And if you ask a lawyer about consent, as I have done during conferences, you get straight answers like "People can consent to a 20 page EULA they have not read or have the legal education to translate". It not that the word is stupid or that the person who designed the law is stupid. It just happens that if you pay a lot of people who have studied and spent a large part of their life to find clever interpretations of words what you get is a clever interpretation that may or may not be what a judge will see. To make a quick parallel, a bunch of lawyers for companies are arguing that while the company is having millions in profits and giving out a lot of dividends to shareholder, the company is at the same time in "economical crisis" and thus deserve government grant money in order to handle corona. The department in charge of giving out the money asked its lawyers and they agreed, but the politicians are now a bit upset since they disagree. And so now everyone is arguing/blaming each other and discussing if they should change the law to specify what an economic crisis is and isn't and if the change to the law should be retroactive or not.
- pembrook 7y ago
  So you're telling me the EU government, who's entire job is creating effective laws...couldn't have seen that coming? It sounds like you're saying the lawyers are smart, but the government is still stupid. Why didn't the government have any lawyers involved in writing the law? Isn't that pretty...stupid?
  - saagarjha 7y ago
    Trying to make good laws is not easy, and trying to anticipate how companies will react to them is also not easy. Really, n a vacuum, I think I can forgive them for not anticipating that "people will put up so many banners that it will undermine our law and make it look like we wanted more banners rather than people not using tracking cookies".
    - miracle2k 7y ago
      Yes, that was entirely predictable, was in fact predicted, and was really the whole experience of the cookie banners which have already plagued the web for years before the GDPR.
      - kd5bjo 7y ago
        For the GDPR to be effective, there will need to be several more rounds of “yes, we really need you to change”. It’s a big change in business practices, and businesses don’t like change when it come to their revenue. Lots of laws get passed and then not effectively enforced, and I can’t really blame businesses for not wanting to entirely upend their business model for something the EU might not care about in a few years.
mrweasel 7y ago
The law has stupid unintended consequences because it would kill the business of the tracking companies it targets, if they where to follow the intention of the law. The same companies have their customers convinced that they need data collection to turn a profit. As a result we see all kinds of stupid attempt to circumvent the law because an entire industry of shady data collectors and brokers have convinced businesses that the only way of making money online is by tracking people.
- renewiltord 7y ago
  That makes the law stupid, dude. I want my lawmakers to apply a slight modicum of systems thinking.
- pembrook 7y ago
  You're starting with a false premise. The basis of your argument is: All data collection is bad. Therefore, in your model of the world, an evil conspiracy of bad actors are looking to strategically undermine the law with various dastardly convoluted schemes. I understand why you're arguing that, given the premise you're starting with. However, the majority of business on the internet are not doing evil things with your data. They simply want to better target their offerings to their customers, allow for you to keep items in a shopping cart, etc. If they are providing better services to their customers, they make more money and the customers are happier. It's a win win for everybody involved. Could it simply be that, most businesses put cookie popups on their sites because they don't want to get fined? Not because they are embroiled in an elaborate scheme to undermine the law? Could it be that the EU should have created a smarter law that would actually help people be more aware of data tracking? Instead of stupid popups?
  - saagarjha 7y ago
    > However, the majority of business on the internet are not doing evil things with your data. They simply want to better target their offerings to their customers, allow for you to keep items in a shopping cart, etc. If they are providing better services to their customers, they make more money and the customers are happier. It's a win win for everybody involved. I wouldn't be so sure. There aren't that many advertising and analytics companies, but they make products that are widely used (and clearly misused) everywhere. The websites using such tools were never told that they could avoid having the banner if they just didn't have tracking cookies.
kodablah 7y ago
> The EU implemented a law. Only by using a very loose definition of "implemented" sans common implementation measures like clarification and enforcement.
- bmn__ 7y ago
  It's being enforced. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ The huge list of people or organisations that come into compliance after an admonishment from the data commissioner does not even make the news. > implementation measures like clarification No directive needs clarification to be implemented as law. That's the most absurd thing I've heard all year.
Rexxar 7y ago
> If your answer is "the entire world is stupid," I have never say that and it's not correct to suggest it. Lots of people are abusing other people with tracking and they have a financial interest to say that the law is bad and to act in bad faith. And they are doing it.
tgsovlerkhgsel 7y ago
> so they implemented what they thought was the intention of the law No, they didn't. They implemented something that they thought allows them to continue with the practices that the law was specifically designed to combat. The user has very little motivation to accept tracking. The web site has a lot of motivation to track the user (because personalized ads = more money). Thus, web sites make saying no as difficult as possible, while making saying yes as easy as possible. A 100% compliant, user-friendly implementation would be showing non-personalized ads, then occasionally replacing one of those ads with a banner "want to receive ads that are actually relevant? click here to enable personalized ads" (which would lead to an informed consent dialog and set a cookie that would then apply to all web sites that use that ad provider). But pop-ups coercing the user to consent are more profitable. This could be fixed by enforcing the actual law (punishing the companies that tried to weasel out of it and processed data without valid consent) so that trying to weasel out of it is no longer a valid strategy.

belorn 7y ago

> so they implemented what they thought was the intention of the law, to avoid prosecution. That's not what actually happened. Companies got scared that the law would impact their business model, for which the law was directly design to impact, and asked lawyers to find the minimum change which could be argued as being in compliance. When you ask lawyers to find a solution to a problem you do not get the intention of the law. If you ask a lawyer to find a solution to tax law you don't get the intention of the tax law, you get tax avoidance, the direct opposite. And if you ask a lawyer about consent, as I have done during conferences, you get straight answers like "People can consent to a 20 page EULA they have not read or have the legal education to translate". It not that the word is stupid or that the person who designed the law is stupid. It just happens that if you pay a lot of people who have studied and spent a large part of their life to find clever interpretations of words what you get is a clever interpretation that may or may not be what a judge will see. To make a quick parallel, a bunch of lawyers for companies are arguing that while the company is having millions in profits and giving out a lot of dividends to shareholder, the company is at the same time in "economical crisis" and thus deserve government grant money in order to handle corona. The department in charge of giving out the money asked its lawyers and they agreed, but the politicians are now a bit upset since they disagree. And so now everyone is arguing/blaming each other and discussing if they should change the law to specify what an economic crisis is and isn't and if the change to the law should be retroactive or not.

pembrook 7y ago
So you're telling me the EU government, who's entire job is creating effective laws...couldn't have seen that coming? It sounds like you're saying the lawyers are smart, but the government is still stupid. Why didn't the government have any lawyers involved in writing the law? Isn't that pretty...stupid?
- saagarjha 7y ago
  Trying to make good laws is not easy, and trying to anticipate how companies will react to them is also not easy. Really, n a vacuum, I think I can forgive them for not anticipating that "people will put up so many banners that it will undermine our law and make it look like we wanted more banners rather than people not using tracking cookies".
  - miracle2k 7y ago
    Yes, that was entirely predictable, was in fact predicted, and was really the whole experience of the cookie banners which have already plagued the web for years before the GDPR.
    - kd5bjo 7y ago
      For the GDPR to be effective, there will need to be several more rounds of “yes, we really need you to change”. It’s a big change in business practices, and businesses don’t like change when it come to their revenue. Lots of laws get passed and then not effectively enforced, and I can’t really blame businesses for not wanting to entirely upend their business model for something the EU might not care about in a few years.

mrweasel 7y ago

The law has stupid unintended consequences because it would kill the business of the tracking companies it targets, if they where to follow the intention of the law. The same companies have their customers convinced that they need data collection to turn a profit. As a result we see all kinds of stupid attempt to circumvent the law because an entire industry of shady data collectors and brokers have convinced businesses that the only way of making money online is by tracking people.

renewiltord 7y ago
That makes the law stupid, dude. I want my lawmakers to apply a slight modicum of systems thinking.
pembrook 7y ago
You're starting with a false premise. The basis of your argument is: All data collection is bad. Therefore, in your model of the world, an evil conspiracy of bad actors are looking to strategically undermine the law with various dastardly convoluted schemes. I understand why you're arguing that, given the premise you're starting with. However, the majority of business on the internet are not doing evil things with your data. They simply want to better target their offerings to their customers, allow for you to keep items in a shopping cart, etc. If they are providing better services to their customers, they make more money and the customers are happier. It's a win win for everybody involved. Could it simply be that, most businesses put cookie popups on their sites because they don't want to get fined? Not because they are embroiled in an elaborate scheme to undermine the law? Could it be that the EU should have created a smarter law that would actually help people be more aware of data tracking? Instead of stupid popups?
- saagarjha 7y ago
  > However, the majority of business on the internet are not doing evil things with your data. They simply want to better target their offerings to their customers, allow for you to keep items in a shopping cart, etc. If they are providing better services to their customers, they make more money and the customers are happier. It's a win win for everybody involved. I wouldn't be so sure. There aren't that many advertising and analytics companies, but they make products that are widely used (and clearly misused) everywhere. The websites using such tools were never told that they could avoid having the banner if they just didn't have tracking cookies.

kodablah 7y ago

> The EU implemented a law. Only by using a very loose definition of "implemented" sans common implementation measures like clarification and enforcement.

bmn__ 7y ago
It's being enforced. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ The huge list of people or organisations that come into compliance after an admonishment from the data commissioner does not even make the news. > implementation measures like clarification No directive needs clarification to be implemented as law. That's the most absurd thing I've heard all year.

Rexxar 7y ago

> If your answer is "the entire world is stupid," I have never say that and it's not correct to suggest it. Lots of people are abusing other people with tracking and they have a financial interest to say that the law is bad and to act in bad faith. And they are doing it.

tgsovlerkhgsel 7y ago

> so they implemented what they thought was the intention of the law No, they didn't. They implemented something that they thought allows them to continue with the practices that the law was specifically designed to combat. The user has very little motivation to accept tracking. The web site has a lot of motivation to track the user (because personalized ads = more money). Thus, web sites make saying no as difficult as possible, while making saying yes as easy as possible. A 100% compliant, user-friendly implementation would be showing non-personalized ads, then occasionally replacing one of those ads with a banner "want to receive ads that are actually relevant? click here to enable personalized ads" (which would lead to an informed consent dialog and set a cookie that would then apply to all web sites that use that ad provider). But pop-ups coercing the user to consent are more profitable. This could be fixed by enforcing the actual law (punishing the companies that tried to weasel out of it and processed data without valid consent) so that trying to weasel out of it is no longer a valid strategy.