3 ms·

Basically every site is violating GDPR. Who cares? The EU does not.

by a_imho 6y ago

seslaire 6y ago
It's the member states that are tasked with enforcing it. Here's what they've been up to: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- a_imho 6y ago
  The EU member states do not care. Is it better? It was adopted 4 years ago, enforceable for the past 2 years. Still every single site that even cares about showing a nagbox offers only opt-outs. Those numbers listed are a joke compared to the 4% worldwide revenue stick. What's the point of the big words if we are not prepared to back them up?
  - colejohnson66 6y ago
    What do you mean “The EU member states do not care”? @seslaire literally posted a link to a list of GDPR enforcements.
    - a_imho 6y ago
      I don't get the confusion 1. Most sites are blatantly non compliant, see opt-outs (presets). For example if someone from covered regions does a search on Google right now it presents them with 2 buttons, 'I agree' and 'See more', the former is pre-checked to enable tracking everything, the latter leads into a labyrinth of settings. Not even an opt-out everything is presented (itself non compliant, but still). It is presented everytime, unless they sign up for a Google Account and/or download their browser extension. This is definitely not how private by default should work. 2. The EU created a stick big enough in theory to go after anyone, yet they refuse to do so for years. Indeed, we are probably interpreting those numbers differently. They are a slap on the wrist at best and anchoring the discussion at the wrong point. For example in the above case the potential fines for Google could be up to ~$6B yet the listings do not add up to $60M, that's two orders of magnitude. As it stands, GDPR achieved very little so far to protect the average user. Tracking is as bad and invasive as it has been for years.
asddubs 6y ago
elaborate?
- a_imho 6y ago
  At the very minimum users should be presented with clear and understandable opt-ins. What we got is an obfuscated mess of legalese and dark patterns of opt-outs.
- hansvm 6y ago
  Another comment mentioned dark patterns and opt-outs. Once they have your data though they also refuse to respond to deletion requests and whatnot. Even major companies without any reasonable price interest in PII like Atlassian are guilty here. Their position is that if you've created an account and they unilaterally give access control to the account to a third party then since you aren't able to log in there's no way to verify your identity to prove that it's you requesting the PII removal. Proof of identity like a passport doesn't suffice, and proof of account ownership like login credentials also does not suffice.

Basically every site is violating GDPR. Who cares? The EU does not.

by a_imho 6y ago

Basically every site is violating GDPR. Who cares? The EU does not.

It's the member states that are tasked with enforcing it. Here's what they've been up to: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/

a_imho 6y ago
The EU member states do not care. Is it better? It was adopted 4 years ago, enforceable for the past 2 years. Still every single site that even cares about showing a nagbox offers only opt-outs. Those numbers listed are a joke compared to the 4% worldwide revenue stick. What's the point of the big words if we are not prepared to back them up?
- colejohnson66 6y ago
  What do you mean “The EU member states do not care”? @seslaire literally posted a link to a list of GDPR enforcements.
  - a_imho 6y ago
    I don't get the confusion 1. Most sites are blatantly non compliant, see opt-outs (presets). For example if someone from covered regions does a search on Google right now it presents them with 2 buttons, 'I agree' and 'See more', the former is pre-checked to enable tracking everything, the latter leads into a labyrinth of settings. Not even an opt-out everything is presented (itself non compliant, but still). It is presented everytime, unless they sign up for a Google Account and/or download their browser extension. This is definitely not how private by default should work. 2. The EU created a stick big enough in theory to go after anyone, yet they refuse to do so for years. Indeed, we are probably interpreting those numbers differently. They are a slap on the wrist at best and anchoring the discussion at the wrong point. For example in the above case the potential fines for Google could be up to ~$6B yet the listings do not add up to $60M, that's two orders of magnitude. As it stands, GDPR achieved very little so far to protect the average user. Tracking is as bad and invasive as it has been for years.

asddubs 6y ago

elaborate?

a_imho 6y ago
At the very minimum users should be presented with clear and understandable opt-ins. What we got is an obfuscated mess of legalese and dark patterns of opt-outs.
hansvm 6y ago
Another comment mentioned dark patterns and opt-outs. Once they have your data though they also refuse to respond to deletion requests and whatnot. Even major companies without any reasonable price interest in PII like Atlassian are guilty here. Their position is that if you've created an account and they unilaterally give access control to the account to a third party then since you aren't able to log in there's no way to verify your identity to prove that it's you requesting the PII removal. Proof of identity like a passport doesn't suffice, and proof of account ownership like login credentials also does not suffice.