8 ms·

> Grindr is now relying on a new consent system and alleged "legitimate interest" to use data without user consent. This is in conflict with the decision of the

• dmitriid 6y ago
  I've seen this also in a separate tab: https://twitter.com/dmitriid/status/1347577262682607616 https://twitter.com/dmitriid/status/1347577262682607616
• danielbarla 6y ago
  The various dark patterns employed by these consent systems are fairly opaque to anyone who bothers to open them, and are clearly deliberate attempts at maintaining the old status quo of "opt-in by default". Frankly, I am surprised at how few of these fines are flying around, though I am quite happy to hear they _are_ happening. I do get that this type of regulation is very disruptive to many companies, but if they cannot survive with informed consent, then perhaps they should not have been so successful without it in the first place.
  • colejohnson66 6y ago
    I’ve also wondered why there aren’t “enough” fines. Are the countries just being cautious because they want to establish precedent before going after the “big fish” like Facebook or Google? Or is it something else?
    • Nasrudith 6y ago
      It sounds like a fear of backlash - essentially if you find like 3% of the population with parking tickets it is fine. If you fine 40% to 60% then you get a large contingent pissed off at you - regardless of validity of the laws and enforcement unpopularity is perilous to laws and officials.
      • mamon 6y ago
        If 40% to 60% of population gets fined then that means the law is stupid* and should be abolished. Backlash on law enforcement is totaly understandable. *"stupid" is relative term. Laws are made for particular society, if almost a half of that society disagrees with the rule then it shouldn't be a rule.
        • danielbarla 6y ago
          With this logic, there's essentially no regulatory way out of local minima, lemon markets and such. And, the freemium for personal data mining model is very much such a situation. And I don't think it's a fair statement that any large percentage of _people_ oppose this particular law; in my experience, most people don't seem to have a strong opinion about it, and those that do have a strong negative opinion very often don't really understand it (and are mostly reacting to the irritation that the various stakeholders are deliberately putting them through). Sampling the opinion of companies that live off ads is a bit like asking printer companies how they feel about toner prices.
        • birksherty 6y ago
          Not half of society, half of profit at any cost companies that doesn't care about ethics ever. So great laws actually even if gets 100% of those.
    • anticristi 6y ago
      GDPR is pretty recent (2018) and legal opinions on how to apply it (e.g. marketing tracking) are still in the making. I think fines are still applied "slowly" so that the industry has time to change. Constantly applying fines is not sustainable. You eventually want to get to the point where privacy "just happens".
  • HotHotLava 6y ago
    I'm baffled by the number of companies that should not have any need for third-party cookies and still go full-on dark pattern. In particular online shops: I'm already on their site, why would they loudly advertise "we're shady and want to trick you into selecting all cookies"? I've cancelled more than one purchase because I didn't want to bother with this.
    • javajosh 6y ago
      It's certainly down to bad legal advice. Lawyers are trained to take everything they can get. If it turns out that was too much, then they frame it as a bargaining chip, as leverage to at least recover some fraction of what they previously took. It's sneaky, immoral, unethical and illegal. It also works.
      • Taylor_OD 6y ago
        Taking everything one can get is not exclusive to lawyers. Many engineers would rather have more information/data than not enough. Better yet get all the data up front and then decide what you need later.
    • pbhjpbhj 6y ago
      One expects it of many companies. But the BBC seemingly have a dark pattern here - if you follow the cookie link it shows all cookies are turned off already, so there's nothing to do, no confirmation, nada. If you don't follow the link they of course have set tracking cookies ... so the cake^w link is a lie. IMO it would be fine to say "we were tracking you but when you followed the link we deleted those cookies and won't now set them". "Reject all", or default off ("no cookies are set, cock here to enable the committee types you wish") is better. What's far worse is the admission that they still use ad networks even when those networks are clearly breaking the law (ie they offer no settings to disable tracking). Indeed BBC should be going further and not allowing advertisers on their network to drop cookies if a user has disabled first-party cookies. Instead they say "go to these networks and disable it yourself", good luck with that! This from an org funded in [minor] part by taxation and whose rausin d'etre is supposed to be serving the public interest.
• sseneca 6y ago
  It’s almost impressive what these people have created. Now, when I stumble across the rare “Reject All” button on one of those pop ups, I don’t know if they even really mean “all” or if it keeps the trackers under “legitimate interests” enabled because they’re... “legitimate”. So the only safe option ends up being disabling all of them manually, which is absurd when these websites list hundreds and hundreds of trackers. It’s as if they used decades of HCI research precisely to make the user experience as horrible as possible. No wait, I’m sure they did exactly that.
  • piva00 6y ago
    With that they win the public's opinion. I make an effort to always explain to people I hear complaining about those pop-ups why they've been made to be annoying. Usually it helps to turn their opinion against GDPR towards the companies employing the dark patterns. No one likes to be blatantly manipulated.
    • curryst 6y ago
      I think that's a long lost battle and they know it. They're going for attrition. People don't want to be tracked, and clicking all the don't track buttons 78 times a day is annoying, so eventually they say fuck it and just start clicking Accept All. There need to be fines for this. They're clearly violating the spirit of the law, if not the exact letter (and I think much of Europe has legal systems that follow the spirit more than the letter, don't they?)
      • TeMPOraL 6y ago
        They're often violating the letter too. I'm in favor of a lot more fines, and substantial fines. Few companies need to be made example of. The current situation does further damage to how EU citizens perceive GDPR and EU itself - companies do their best to make the consent control experience as bad and tiresome as possible, and then they tell people to blame GDPR for how web browsing just got more annoying.
      • corty 6y ago
• switch007 6y ago
  I've also had "legitimate interest" used as a catch-all reply when you raise any concerns internally. It reminds me of "reasonable" wording in English law.
• alpaca128 6y ago
  Once again proof that what we need is the opposite approach; companies need to actively get explicit permission not just from the end user, but also from authorities to collect and share data, and the full report should be publicly accessible. Also I wouldn't mind a general ban on using personal data for marketing purposes, I don't know a scenario where this would be necessary and beneficial for the user. Right now companies just keep doing what they always did and hope for the best. As long as they're convinced they can just try not to get too much attention this data sharing problem will persist with barely a dent.
• dthul 6y ago
  On some websites I get a tracking / cookie consent popup which, if I choose not to consent to everything, leaves me hanging for a _very_ long time while "saving my settings". I am talking about 30-60 seconds here. That must be deliberate to keep you from denying consent. I forgot which company it was but I immediately recognize those popups.
  • alkonaut 6y ago
    Clearly a violation too, since the experience is now worse when not giving consent. That its clearly deliberate doesn't help either.
  • spoiler 6y ago
    Oracle does this. I've had this happen the other day while trying to access some documentation.
  • sseneca 6y ago
    Is it TrustArc? I remember having a similar experience with their pop-up, for example on Oracle's website when I'm looking for Java docs: https://docs.oracle.com/en/java/ https://docs.oracle.com/en/java/ That example doesn't have the long loading times for me any more, but I'm almost certain it was the TrustArc pop-up.
    • dthul 6y ago
      Yes, I believe it was TrustArc.
  • privacylawthrow 6y ago
    Some tools call APIs from a whole bunch of ad networks. That 60 seconds is likely spent getting opt out cookies from dozens of different ad network domains.
    • alkonaut 6y ago
      Still not acceptable to make a worse experience when the consent is rejected. They'd need to queue those things and process them async later, or find a solution that doesn't need those requests at all.
• MereInterest 6y ago
  This is a great example, that I intend to hang on to. I've run into a few people online with some severe willful ignorance about the GDPR. The worst was somebody arguing that since targeted advertising was their business model, that in itself constituted a "legitimate interest". So, pretty much exactly the sort of thing that GDPR forbids.
• rawbot 6y ago
  I have met few websites where you cannot uncheck the "legitimate interest" fields.
  • jiveturkey 6y ago
    That is how it should be. Legitimate interest means they don't need your consent. They actually shouldn't be prompting for it at all. Adding it to the consent box is a kind of cargo culting going on.
• Blikkentrekker 6y ago
  Most of these data consent forms are purposefully complicated so that many opt in to all to save time. The “advanced options” menu even loads suspiciously slowly at times. It should be required by law that there be a simple to access “opt out to everything” option that should be as easy to access as an “opt in to everything” option. Also, I would not be opposed if some browser standard were developed under governmental oversight that sends a blanket “opt out to everything” that websites would be required to respect by law.
  • poizan42 6y ago
    > It should be required by law that there be a simple to access “opt out to everything” option that should be as easy to access as an “opt in to everything” option. It arguably is already required with the language of article 7.2 and recital 32, especially this part > If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. But we will see how it gets interpreted as more cases works their way through the system.
    • Blikkentrekker 6y ago
      Yes, that is very arguable. The phrasing “The-opt-out-to-everything option must be as easily accessible as the opt-in-to-everything option.” is far less arguable and hiding one behind a further menu, but one not, is a clear violation of this rule.
• ardy42 6y ago
  > Edit: And worst of all is this very confusing pattern with two columns of toggle buttons, one of which concerns "legitimate interest": https://toot.cafe/@peter/105367185171860458 https://toot.cafe/@peter/105367185171860458 That's pretty awful, how are you even supposed to interpret that? I'm guessing it's something like "first || !second", because that would be the sleaziest.
  • Vinnl 6y ago
    I think the left column is the "legitimate interest" version of the cookie type, and the right column the "consent" version (whatever that means). So you can enable and disable either independently, but the former is enabled by default.
• mikestew 6y ago
  Most of those are now off by default, as it should be, except that if you scroll down you still see a number of "legitimate interest" ones enabled, even though you can turn them off manually. Taking a page from the RealNetworks playbook from twenty years ago, I see. Put the shit you don't care about up top and unchecked, keeping the interesting stuff checked but below the fold.
• YeGoblynQueenne 6y ago
  My biggest bugbear with these multi-modals is that much of the time the buttons that turn consent on or off are not labelled. You're supposed to guess from their colour and default position what is on and what is off, so when I make a choice I never know for sure how the website interpreted my choice. Some have an "accept all" button that could perhaps reveal which is "on" and which is "off", since when you press it all the buttons go to "on". But this happens so quickly and the modal is closed immediately afterwards, that there's no time to tell. And of course by then you've already accepted so it doesn't matter.