4 ms·

I hate the implication that those banners are some sort of consent. They're so commonplace now that people blindly click 'okay' or close them just to be able to

I hate the implication that those banners are some sort of consent. They're so commonplace now that people blindly click 'okay' or close them just to be able to read the site. If the wording was something else ("you agree that we can take your first born child") would it even hold up? The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.

swyx 6y ago
disagree button is the "Close" button unfortunately.
- type0 6y ago
  and often it works like - please leave the site nothing here for you button. Amazing how irl businesses use such types of third party booking systems with ads and other crap showed down your throat, that's for anything from hairdressers to carpenters, one would think at least they don't require you to login via fb, ah waaaait, some of them do. The web dystopia is here now, enjoy it.
reaperducer 6y ago
The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent. Some sites don't even give you a "Disagree." Liberty of London has no way to opt-out: "By closing this box or by clicking accept and close, you agree to our use of cookies." https://www.libertylondon.com https://www.libertylondon.com
thewebcount 6y ago
I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking the law.
- dorgo 6y ago
  the law requries either consent or legitimate interest ( there are even more options - but not relevant here ). So they can track you without consent and not breaking the law.
  - Semaphor 6y ago
    There are somewhat strict rules of what is legitimate interest. And sending data to a US company (Google Analytics) even requires some extra steps beyond normal consent, now that the privacy shield has been scrapped.
  - PeterisP 6y ago
    "Legitimate interest" (Article 6.1.f) is one of the weaker clauses for lawfulness of processing as it comes with the following caveats: 1. Having some legitimate interest is not necessarily sufficient - the privacy interests of the data subject can override the legitimate interests of the controller (Article 6.1.f itself), so the controller has to explicitly take the privacy interests of the data subject into account, and the reasonable expectations of data subjects matter. So this can be tricky, as it's up to the organization to demonstrate that their legitimate need outweighs the data subject interests. 2. the right to object of Article 21 applies for this clause, with explicit clarification in 21.2 that yes, people do have the right to object to direct marketing profiling; 3. the controller is required to explicitly inform the users "At the latest at the time of the first communication with the data subject" that they have the right to object to this processing (Article 21.4, and Recital 70); 4. As article 21.5 states "the data subject may exercise his or her right to object by automated means using technical specifications", so this opens the way for specifications such as the upcoming Global Privacy Control header (https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/) which would be a legally binding "I object" mechanism. Because of this, whenever an organization can assert some other basis for lawfulness of processing (e.g. consent or performance of contract) then that would be a safer option than trying to assert a legitimate need.
    - gingerlime 6y ago
      Very true! yet lots of companies still (try to) hide behind it. My recent experience was with Sonos. They heavily track you without opt-in/explicit consent and hide behind legitimate interest. https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-you/ https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-y...

swyx 6y ago

disagree button is the "Close" button unfortunately.

type0 6y ago
and often it works like - please leave the site nothing here for you button. Amazing how irl businesses use such types of third party booking systems with ads and other crap showed down your throat, that's for anything from hairdressers to carpenters, one would think at least they don't require you to login via fb, ah waaaait, some of them do. The web dystopia is here now, enjoy it.

reaperducer 6y ago

The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent. Some sites don't even give you a "Disagree." Liberty of London has no way to opt-out: "By closing this box or by clicking accept and close, you agree to our use of cookies." https://www.libertylondon.com https://www.libertylondon.com

thewebcount 6y ago

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking the law.

dorgo 6y ago
the law requries either consent or legitimate interest ( there are even more options - but not relevant here ). So they can track you without consent and not breaking the law.
- Semaphor 6y ago
  There are somewhat strict rules of what is legitimate interest. And sending data to a US company (Google Analytics) even requires some extra steps beyond normal consent, now that the privacy shield has been scrapped.
- PeterisP 6y ago
  "Legitimate interest" (Article 6.1.f) is one of the weaker clauses for lawfulness of processing as it comes with the following caveats: 1. Having some legitimate interest is not necessarily sufficient - the privacy interests of the data subject can override the legitimate interests of the controller (Article 6.1.f itself), so the controller has to explicitly take the privacy interests of the data subject into account, and the reasonable expectations of data subjects matter. So this can be tricky, as it's up to the organization to demonstrate that their legitimate need outweighs the data subject interests. 2. the right to object of Article 21 applies for this clause, with explicit clarification in 21.2 that yes, people do have the right to object to direct marketing profiling; 3. the controller is required to explicitly inform the users "At the latest at the time of the first communication with the data subject" that they have the right to object to this processing (Article 21.4, and Recital 70); 4. As article 21.5 states "the data subject may exercise his or her right to object by automated means using technical specifications", so this opens the way for specifications such as the upcoming Global Privacy Control header (https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/) which would be a legally binding "I object" mechanism. Because of this, whenever an organization can assert some other basis for lawfulness of processing (e.g. consent or performance of contract) then that would be a safer option than trying to assert a legitimate need.
  - gingerlime 6y ago
    Very true! yet lots of companies still (try to) hide behind it. My recent experience was with Sonos. They heavily track you without opt-in/explicit consent and hide behind legitimate interest. https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-you/ https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-y...