3 ms·

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking t

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking the law.

dorgo 6y ago
the law requries either consent or legitimate interest ( there are even more options - but not relevant here ). So they can track you without consent and not breaking the law.
- Semaphor 6y ago
  There are somewhat strict rules of what is legitimate interest. And sending data to a US company (Google Analytics) even requires some extra steps beyond normal consent, now that the privacy shield has been scrapped.
- PeterisP 6y ago
  "Legitimate interest" (Article 6.1.f) is one of the weaker clauses for lawfulness of processing as it comes with the following caveats: 1. Having some legitimate interest is not necessarily sufficient - the privacy interests of the data subject can override the legitimate interests of the controller (Article 6.1.f itself), so the controller has to explicitly take the privacy interests of the data subject into account, and the reasonable expectations of data subjects matter. So this can be tricky, as it's up to the organization to demonstrate that their legitimate need outweighs the data subject interests. 2. the right to object of Article 21 applies for this clause, with explicit clarification in 21.2 that yes, people do have the right to object to direct marketing profiling; 3. the controller is required to explicitly inform the users "At the latest at the time of the first communication with the data subject" that they have the right to object to this processing (Article 21.4, and Recital 70); 4. As article 21.5 states "the data subject may exercise his or her right to object by automated means using technical specifications", so this opens the way for specifications such as the upcoming Global Privacy Control header (https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/) which would be a legally binding "I object" mechanism. Because of this, whenever an organization can assert some other basis for lawfulness of processing (e.g. consent or performance of contract) then that would be a safer option than trying to assert a legitimate need.
  - gingerlime 6y ago
    Very true! yet lots of companies still (try to) hide behind it. My recent experience was with Sonos. They heavily track you without opt-in/explicit consent and hide behind legitimate interest. https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-you/ https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-y...
- gingerlime 6y ago
  when it comes to cookies the ePrivacy directive 5.3 is more strict and requires explicit consent for non-essential cookies and similar technology (incl. fingerprinting). Look up the recent case against Apple IDFA. Legitimate interest does not come into play here actually. on mobile so can’t easily post links unfortunately. EDIT: here’s a couple of links https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa https://noyb.eu/en/noyb-files-complaints-against-apples-trac... https://blog.gingerlime.com/2020/does-ios-14-protect-your-privacy/ https://blog.gingerlime.com/2020/does-ios-14-protect-your-pr...

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking the law.

dorgo 6y ago

the law requries either consent or legitimate interest ( there are even more options - but not relevant here ). So they can track you without consent and not breaking the law.

Semaphor 6y ago
There are somewhat strict rules of what is legitimate interest. And sending data to a US company (Google Analytics) even requires some extra steps beyond normal consent, now that the privacy shield has been scrapped.
PeterisP 6y ago
"Legitimate interest" (Article 6.1.f) is one of the weaker clauses for lawfulness of processing as it comes with the following caveats: 1. Having some legitimate interest is not necessarily sufficient - the privacy interests of the data subject can override the legitimate interests of the controller (Article 6.1.f itself), so the controller has to explicitly take the privacy interests of the data subject into account, and the reasonable expectations of data subjects matter. So this can be tricky, as it's up to the organization to demonstrate that their legitimate need outweighs the data subject interests. 2. the right to object of Article 21 applies for this clause, with explicit clarification in 21.2 that yes, people do have the right to object to direct marketing profiling; 3. the controller is required to explicitly inform the users "At the latest at the time of the first communication with the data subject" that they have the right to object to this processing (Article 21.4, and Recital 70); 4. As article 21.5 states "the data subject may exercise his or her right to object by automated means using technical specifications", so this opens the way for specifications such as the upcoming Global Privacy Control header (https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/) which would be a legally binding "I object" mechanism. Because of this, whenever an organization can assert some other basis for lawfulness of processing (e.g. consent or performance of contract) then that would be a safer option than trying to assert a legitimate need.
- gingerlime 6y ago
  Very true! yet lots of companies still (try to) hide behind it. My recent experience was with Sonos. They heavily track you without opt-in/explicit consent and hide behind legitimate interest. https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-you/ https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-y...
gingerlime 6y ago
when it comes to cookies the ePrivacy directive 5.3 is more strict and requires explicit consent for non-essential cookies and similar technology (incl. fingerprinting). Look up the recent case against Apple IDFA. Legitimate interest does not come into play here actually. on mobile so can’t easily post links unfortunately. EDIT: here’s a couple of links https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa https://noyb.eu/en/noyb-files-complaints-against-apples-trac... https://blog.gingerlime.com/2020/does-ios-14-protect-your-privacy/ https://blog.gingerlime.com/2020/does-ios-14-protect-your-pr...