3 ms·

I have mixed feelings. On one hand, the data harvesting targeted by cookie laws and associated privacy stuff is important and legislators/regulators are right

I have mixed feelings. On one hand, the data harvesting targeted by cookie laws and associated privacy stuff is important and legislators/regulators are right to target it. OTOH, effectiveness is pretty marginal. There have been some (minor) gains on disclosure. Somewhat better progress on data selling/sharing/security. But, no real gains on consent, which is a big part of the regulatory effort and this specific case. Between dark patterns, take-it-or-leave it propositions and predatory defaults... I don't think most people have a more censenting relationship with amazon or google than before. Regulators (also prosecutors, often) tend to focus enforceability on easy to prosecute, legible stuff. "Must contain small print" rules. This is how we end up with such meticulous small print norms for advertising pharmaceuticals, financial products and other regulated industries. Fines themselves do not deter profitability monsters like this and the "fix" is going to be an update to the popup, small print, naming of buttons and other things that don't really matter much outside of a legalistic perspective. I'm all for the goals of these efforts. Consent. Privacy. Non-abusive relationships with companies generally. That said, I'm worried that most of the regulatory enforcement efforts are focused on technicalities without reference to real world achievements.

Nextgrid 6y ago
> no real gains on consent, which is a big part of the regulatory effort and this specific case Consent is regulated under the GDPR and the majority of consent banners/popups you see today are not compliant. For example, the regulation explicitly mandates that pre-ticked checkboxes are not compliant and that it must be as easy to accept than to decline. According to the article, this fine is for a breach of the ePrivacy rules (which is the earlier - and somewhat stupid - "cookie law") which exclusively cares about cookies as opposed to the broader goal of the GDPR. On the plus side, enforcement of ePrivacy might suggest that we'll see enforcement of the GDPR too, and that's great news.
- dalbasal 6y ago
  Ultimately compliance is defined by precedent, and by example. Both are being established here, in this case. So, good point about the actual act their being charged under. Either way though, the concept of consent is similar in the GDPR. It is notable that GDPR makes more effort to define consent better, and implicitly deals with the fact that choice and such are important. How that translates into enforcement/compliance... I guess we'll see. I think we both agree that none of these recent legislative changes (also in the US and elsewhere) have given us much improvement on consent, so far. You just might be more optimistic than me on prospects. I think the problem is a hard one, at least within our current normative frames. A regulator has very few nearby examples to draw on, for an enforceable model of consent. They need a binary, but a broader concept of consent isn't very amenable to that.
- cromulent 6y ago
  The interaction between the "cookie law" and GDPR is a bit complex, and maybe things will become clearer after a few court cases. For example, the recent clarification said: "The GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement (for example ‘opt-out boxes’)." But of course that applies to PII, not all cookies, and so if you have generic analytics cookies that do not result in PII then this does not apply. I think. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...
simpss 6y ago
it takes a lot of time for regulators to catch up with all the shenanigans the bigger offenders are pulling. But, it does give internal employees the tools to fix it in smaller companies, or smaller companies that use the services of these global companies(ex, google analytics). Pre-gdpr, if I raised some of these points in any of my workplaces, nothing ever came out of it. Now, it's a different story. Same with direct-marketing spam e-mails, where a customer complains. It'll take some time for regulators to sort out the big offenders, but the regulation is already having a positive effect within smaller companies.
iamacyborg 6y ago
> OTOH, effectiveness is pretty marginal. There have been some (minor) gains on disclosure. Somewhat better progress on data selling/sharing/security. But, no real gains on consent, which is a big part of the regulatory effort and this specific case. From experience, a lot of folks were waiting to see what Google/Amazon/FB/etc were doing and using them as examples of what to do. These fines should help apply some downward pressure now that the regulator has explicitly called out this illegal behaviour.
- dalbasal 6y ago
  I agree, and it's a good point about the industry using Google/Amazon/FB/etc as a template. I hadn't considered that in this context. My greater reason for "scoring" progress on consent as "no real gains" is less about "compliance" and more about the goals of this compliance. What does consent mean to a non-lawyer and would do we want legislators/regulators to pursue it in the first place? The model of consent being litigated here doesn't, imo, lead to noticeably more choice or dominion vis a vis companies. It just leads to technicalities about how popups need to be designed. Form rather than substance. I think the reason these laws have been more effective on disclosure is that the legible, lawyerly definition of disclosure is the same as the common sense one. Consent... not so much. The actual point is not whether or not a document was correctly initialed on page 6.

Nextgrid 6y ago

> no real gains on consent, which is a big part of the regulatory effort and this specific case Consent is regulated under the GDPR and the majority of consent banners/popups you see today are not compliant. For example, the regulation explicitly mandates that pre-ticked checkboxes are not compliant and that it must be as easy to accept than to decline. According to the article, this fine is for a breach of the ePrivacy rules (which is the earlier - and somewhat stupid - "cookie law") which exclusively cares about cookies as opposed to the broader goal of the GDPR. On the plus side, enforcement of ePrivacy might suggest that we'll see enforcement of the GDPR too, and that's great news.

dalbasal 6y ago
Ultimately compliance is defined by precedent, and by example. Both are being established here, in this case. So, good point about the actual act their being charged under. Either way though, the concept of consent is similar in the GDPR. It is notable that GDPR makes more effort to define consent better, and implicitly deals with the fact that choice and such are important. How that translates into enforcement/compliance... I guess we'll see. I think we both agree that none of these recent legislative changes (also in the US and elsewhere) have given us much improvement on consent, so far. You just might be more optimistic than me on prospects. I think the problem is a hard one, at least within our current normative frames. A regulator has very few nearby examples to draw on, for an enforceable model of consent. They need a binary, but a broader concept of consent isn't very amenable to that.
cromulent 6y ago
The interaction between the "cookie law" and GDPR is a bit complex, and maybe things will become clearer after a few court cases. For example, the recent clarification said: "The GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement (for example ‘opt-out boxes’)." But of course that applies to PII, not all cookies, and so if you have generic analytics cookies that do not result in PII then this does not apply. I think. https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

simpss 6y ago

it takes a lot of time for regulators to catch up with all the shenanigans the bigger offenders are pulling. But, it does give internal employees the tools to fix it in smaller companies, or smaller companies that use the services of these global companies(ex, google analytics). Pre-gdpr, if I raised some of these points in any of my workplaces, nothing ever came out of it. Now, it's a different story. Same with direct-marketing spam e-mails, where a customer complains. It'll take some time for regulators to sort out the big offenders, but the regulation is already having a positive effect within smaller companies.

iamacyborg 6y ago

> OTOH, effectiveness is pretty marginal. There have been some (minor) gains on disclosure. Somewhat better progress on data selling/sharing/security. But, no real gains on consent, which is a big part of the regulatory effort and this specific case. From experience, a lot of folks were waiting to see what Google/Amazon/FB/etc were doing and using them as examples of what to do. These fines should help apply some downward pressure now that the regulator has explicitly called out this illegal behaviour.

dalbasal 6y ago
I agree, and it's a good point about the industry using Google/Amazon/FB/etc as a template. I hadn't considered that in this context. My greater reason for "scoring" progress on consent as "no real gains" is less about "compliance" and more about the goals of this compliance. What does consent mean to a non-lawyer and would do we want legislators/regulators to pursue it in the first place? The model of consent being litigated here doesn't, imo, lead to noticeably more choice or dominion vis a vis companies. It just leads to technicalities about how popups need to be designed. Form rather than substance. I think the reason these laws have been more effective on disclosure is that the legible, lawyerly definition of disclosure is the same as the common sense one. Consent... not so much. The actual point is not whether or not a document was correctly initialed on page 6.