3 ms·

Consent can't be a form of paywall under GDPR. GDPR defines that valid consent must be freely given, and explicitly mentions that if providing service is condit

Consent can't be a form of paywall under GDPR. GDPR defines that valid consent must be freely given, and explicitly mentions that if providing service is conditional on providing consent then that is not freely given consent. Which is absurd. Did I not "freely give" $20 when I bought a pizza because if I had been able to get the pizza without paying I would have? GDPR consent must be opt-in, fully informed, and freely given - something that some of your users intentionally choose because they want to. And there's no reason for customers to opt-in when you're not allowed to offer anything in exchange. I would respect the GDPR a lot more if it directly banned "unnecessary" data collection, rather than going through these silly rituals of companies using dark patterns to try to claim that users agreed.

PeterisP 6y ago
"And there's no reason for customers to opt-in when you're not allowed to offer anything in exchange." is kind of the point - the goal of GDPR is to stop the unwanted invasions of privacy, not extract some additional compensation from companies in exchange for being permitted to continue all these things. It's designed so that it would not be possible for a standard privacy-violating website to become GDPR compliant by writing some legalese or showing some popups or offering some discounts in exchange, the only way for the industry to become compliant should be by actual change in behavior so that there's much less tracking and violating the user's privacy. The valid reasons for customers to opt-in are in scenarios where they desire the result to be customised according to that private data - where the customer wants you to use that data because that actual use benefits them. E.g. a dating site user might want you to use all kinds of private data for the purposes of finding better date matches. And the same user might not want you to use that same data for any other purposes or share it with third parties. And the intended result of GDPR (as the enforcement slowly changes the common practices) is a world where these user's privacy preferences are actually respected. So the consent question comes down to essentially "are the users gifting you this data because they want you to have it?" - if so, knock yourself out, everyone's happy. But any selling or trading that consent is not binding or enforceable. The most effective analogy that I can think of is sexual consent. Like, if I sign a contract saying "You can fuck my arse and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my arse fucked unless I really want to (or there's some other legal basis, IDK, a warrant for a cavity search), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be rape no matter what I signed in the contract. In the exact same manner, under GDPR if I sign a contract saying "You can violate my privacy and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my privacy violated unless I want to (or there's some other legal basis), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be a privacy rights violation despite the contract.

PeterisP 6y ago

"And there's no reason for customers to opt-in when you're not allowed to offer anything in exchange." is kind of the point - the goal of GDPR is to stop the unwanted invasions of privacy, not extract some additional compensation from companies in exchange for being permitted to continue all these things. It's designed so that it would not be possible for a standard privacy-violating website to become GDPR compliant by writing some legalese or showing some popups or offering some discounts in exchange, the only way for the industry to become compliant should be by actual change in behavior so that there's much less tracking and violating the user's privacy. The valid reasons for customers to opt-in are in scenarios where they desire the result to be customised according to that private data - where the customer wants you to use that data because that actual use benefits them. E.g. a dating site user might want you to use all kinds of private data for the purposes of finding better date matches. And the same user might not want you to use that same data for any other purposes or share it with third parties. And the intended result of GDPR (as the enforcement slowly changes the common practices) is a world where these user's privacy preferences are actually respected. So the consent question comes down to essentially "are the users gifting you this data because they want you to have it?" - if so, knock yourself out, everyone's happy. But any selling or trading that consent is not binding or enforceable. The most effective analogy that I can think of is sexual consent. Like, if I sign a contract saying "You can fuck my arse and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my arse fucked unless I really want to (or there's some other legal basis, IDK, a warrant for a cavity search), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be rape no matter what I signed in the contract. In the exact same manner, under GDPR if I sign a contract saying "You can violate my privacy and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my privacy violated unless I want to (or there's some other legal basis), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be a privacy rights violation despite the contract.