3 ms·

Sort of related, does anyone know if all the consent form popups will stop once the UK leaves the EU?

by mjgs 6y ago

asplake 6y ago
Hope so. In general I’m a fan of GDPR but I’d be glad to see this one go
- remus 6y ago
  For what it's worth those cookie popups are actually from the EU e-privacy directive (which is implemented as PECR in the UK), so they aren't because of GDPR.
  - mjgs 6y ago
    I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. When you browse from outside the UK, the sites don’t have the consent forms.
    - remus 6y ago
      > I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. If they're asking about cookies for GDPR then that's a mistake on the part of those sites. You can read about the details of PECR here https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... Of course under GDPR they may need to get permission for other forms of data processing (signing you up to a marketing mailing list, for example), but the rash of cookie permissions banners are because of PECR and similar legislation in other EU countries.
      - mjgs 6y ago
        So the only way to not have consent forms is to browse from outside the UK & EU? It’s getting more and more difficult to have a good experience browsing the web. That worries me.
    - jlokier 6y ago
      Consent is not required for "essential" cookies, because they are essential. Things like keeping track of your logged in state or shopping cart. (Even if consent were required for that, it should be asked at the point where you login or add the first item). For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that. I've personally implemented websites in the EU with logging in, carts and analytical tracking that didn't require up-front consent popups because their behaviour was already reasonable and therefore compliant. Some of us believe that the bigger sites deliberately use obnoxious consent forms in order to encourage USA residents to remain politically in favour of "implied consent" to individual behaviour tracking. In other words, obnoxious on purpose to give the impression the EU system is more onerous to each user than it really has to be. After the UK leaves the EU I will do my browsing via a VPN through an EU country specifically because I want to be able to deny all such consents except to sites that I trust and support. (In practice I grant consent to about 10% of sites and deny the other 90%). If I can find a browser extension to automate denying consent that would be great, but if I can't then I'll do it manually. The thought of my consent to being tracked down to the level of individual, personal detailed behaviour being "implied consent" the USA way is horrible. I do not consent, full stop. It seems an affront to basic legal principles that the norm is for people to not be told about or therefore have the opportunity for informed consent to the detailed databases built up about their every action online, similar to credit files but much more detailed and secretive.
      - mjgs 6y ago
        Having some way to auto deny consent seems like a good idea. But anything automatic can have serious downsides, what happens if you start denying ‘good’ sites without realising it. Should all things that require consent be blocked? This World Wide Web of permissions sounds like it’s going to be a bit of a nightmare.
        kuschku 6y ago
        The default should always be "block everything". When you try to do an action on a website that requires additional consent, you should be asked additionally. Just like the iOS/new Android permissions Dialogs. No to all by default, only allowing specific permissions on demand.
pbaumel 6y ago
I'm no expert, but the UK implemented the EU's General Data Protection Regulation by passing the Data Protection Act 2018 [1] which will still be in place come 1 January 2021. There could be revised/new legislation in future though. [1] https://www.legislation.gov.uk/ukpga/2018/12/enacted https://www.legislation.gov.uk/ukpga/2018/12/enacted
verytrivial 6y ago
I think they will go away over time. [RANT] They should never have been implemented that way IMHO -- a different API or IETF-ish agreed HTML meta tag that would inform the browser of the scope, entities etc. would have allowed the browser to offer overall policy choices to the user. Most would be "I don't care, do whatever you want to me" but those who do care could have been picky. That would also have allowed the browser to generate reports for the user regarding which sites currently have which permissions, etc. This would have put the onus on the browser implementation to get it right, and not e.g. fail to show the messages, but one could argue that any browser could get the random CSS used for these prompts wrong and not show the message. I'm a GDPR fan and will likely use this jurisdiction transfer as a ceremonial point to close my FB account for good.
- mjgs 6y ago
  I’ve been wondering about whether it should be something implemented in the browser too. Instinctively I feel that better browser tools would be beneficial, but it’s an odd problem that we are trying to solve. I am not even sure we understand the root issue. Some companies want to use the web to try to change users behaviour, and many users want those companies to change their behaviour. That’s not a solvable problem, it’s a circular reference bug. So maybe better tools might actually make it worse, in a race to the bottom sort of situation. My main concern is that the consent forms, however well meaning they might be, are creating a horrible environment. There are lots of perverse incentives for people to ruin the web experience. Some players stand to gain a lot from a horrible web environment. For example ones that have competing information products. I’m increasingly thinking it would be better to just not have consent forms, and with better browser tools, people would hopefully go to websites that treated them well.
  - jnxx 6y ago
    > Some companies want to use the web to try to change users behaviour And just by looking at Google, they are doing that in an increasingly aggressive way.
    - 6y ago
remus 6y ago
If you mean cookie banners then no, they won't stop. UK data protections laws are going to be almost entirely unchanged come 1st Jan. Having said that this doesn't mean there will be no practical effects, as our status with regards to other EEA countries is changing so data transfer between EEA and the UK is affected. It also seems likely that UK data protection laws will start to diverge from EU data protection laws over time, though what this might look like in practice is anyones guess.

Sort of related, does anyone know if all the consent form popups will stop once the UK leaves the EU?

by mjgs 6y ago

Sort of related, does anyone know if all the consent form popups will stop once the UK leaves the EU?

asplake 6y ago

Hope so. In general I’m a fan of GDPR but I’d be glad to see this one go

remus 6y ago
For what it's worth those cookie popups are actually from the EU e-privacy directive (which is implemented as PECR in the UK), so they aren't because of GDPR.
- mjgs 6y ago
  I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. When you browse from outside the UK, the sites don’t have the consent forms.
  - remus 6y ago
    > I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. If they're asking about cookies for GDPR then that's a mistake on the part of those sites. You can read about the details of PECR here https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... Of course under GDPR they may need to get permission for other forms of data processing (signing you up to a marketing mailing list, for example), but the rash of cookie permissions banners are because of PECR and similar legislation in other EU countries.
    - mjgs 6y ago
      So the only way to not have consent forms is to browse from outside the UK & EU? It’s getting more and more difficult to have a good experience browsing the web. That worries me.
  - jlokier 6y ago
    Consent is not required for "essential" cookies, because they are essential. Things like keeping track of your logged in state or shopping cart. (Even if consent were required for that, it should be asked at the point where you login or add the first item). For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that. I've personally implemented websites in the EU with logging in, carts and analytical tracking that didn't require up-front consent popups because their behaviour was already reasonable and therefore compliant. Some of us believe that the bigger sites deliberately use obnoxious consent forms in order to encourage USA residents to remain politically in favour of "implied consent" to individual behaviour tracking. In other words, obnoxious on purpose to give the impression the EU system is more onerous to each user than it really has to be. After the UK leaves the EU I will do my browsing via a VPN through an EU country specifically because I want to be able to deny all such consents except to sites that I trust and support. (In practice I grant consent to about 10% of sites and deny the other 90%). If I can find a browser extension to automate denying consent that would be great, but if I can't then I'll do it manually. The thought of my consent to being tracked down to the level of individual, personal detailed behaviour being "implied consent" the USA way is horrible. I do not consent, full stop. It seems an affront to basic legal principles that the norm is for people to not be told about or therefore have the opportunity for informed consent to the detailed databases built up about their every action online, similar to credit files but much more detailed and secretive.
    - mjgs 6y ago
      Having some way to auto deny consent seems like a good idea. But anything automatic can have serious downsides, what happens if you start denying ‘good’ sites without realising it. Should all things that require consent be blocked? This World Wide Web of permissions sounds like it’s going to be a bit of a nightmare.
      - kuschku 6y ago
        The default should always be "block everything". When you try to do an action on a website that requires additional consent, you should be asked additionally. Just like the iOS/new Android permissions Dialogs. No to all by default, only allowing specific permissions on demand.

pbaumel 6y ago

I'm no expert, but the UK implemented the EU's General Data Protection Regulation by passing the Data Protection Act 2018 [1] which will still be in place come 1 January 2021. There could be revised/new legislation in future though. [1] https://www.legislation.gov.uk/ukpga/2018/12/enacted https://www.legislation.gov.uk/ukpga/2018/12/enacted

verytrivial 6y ago

I think they will go away over time. [RANT] They should never have been implemented that way IMHO -- a different API or IETF-ish agreed HTML meta tag that would inform the browser of the scope, entities etc. would have allowed the browser to offer overall policy choices to the user. Most would be "I don't care, do whatever you want to me" but those who do care could have been picky. That would also have allowed the browser to generate reports for the user regarding which sites currently have which permissions, etc. This would have put the onus on the browser implementation to get it right, and not e.g. fail to show the messages, but one could argue that any browser could get the random CSS used for these prompts wrong and not show the message. I'm a GDPR fan and will likely use this jurisdiction transfer as a ceremonial point to close my FB account for good.

mjgs 6y ago
I’ve been wondering about whether it should be something implemented in the browser too. Instinctively I feel that better browser tools would be beneficial, but it’s an odd problem that we are trying to solve. I am not even sure we understand the root issue. Some companies want to use the web to try to change users behaviour, and many users want those companies to change their behaviour. That’s not a solvable problem, it’s a circular reference bug. So maybe better tools might actually make it worse, in a race to the bottom sort of situation. My main concern is that the consent forms, however well meaning they might be, are creating a horrible environment. There are lots of perverse incentives for people to ruin the web experience. Some players stand to gain a lot from a horrible web environment. For example ones that have competing information products. I’m increasingly thinking it would be better to just not have consent forms, and with better browser tools, people would hopefully go to websites that treated them well.
- jnxx 6y ago
  > Some companies want to use the web to try to change users behaviour And just by looking at Google, they are doing that in an increasingly aggressive way.
  - 6y ago

remus 6y ago

If you mean cookie banners then no, they won't stop. UK data protections laws are going to be almost entirely unchanged come 1st Jan. Having said that this doesn't mean there will be no practical effects, as our status with regards to other EEA countries is changing so data transfer between EEA and the UK is affected. It also seems likely that UK data protection laws will start to diverge from EU data protection laws over time, though what this might look like in practice is anyones guess.