6 ms·

Many sites ruin your experience because they don't know any better. GDPR is perceived as a Sword of Damocles by many smaller and medium sized companies and they

Many sites ruin your experience because they don't know any better. GDPR is perceived as a Sword of Damocles by many smaller and medium sized companies and they will annoy you with elaborate consent solution for which they are paying a ton of money even if they most probably wouldn't need to do it. For the big players it is easy. They often don't annoy you with consent banners because: - they have legal departments that understand GDPR and protect them (e.g. GitHub) - they require your login and therefore have your consent anyway (e.g. Facebook) - they can afford to skip Cookies because they have elaborate fingerprinting solutions - they just ignore the law and risk be sued (e.g. Germany's Spiegel Online)

frenchy 6y ago
> - they can afford to skip Cookies because they have elaborate fingerprinting solutions This is really just a special case of your last point. As far as I know, there is nothing cookie specific in the GDPR.
- Fradow 6y ago
  That's because the "Cookie Law", which real name is the ePrivacy directive, is separate (and predates) from the GDPR. This directive defines in (24) [1] : So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users. The definition is broad. Does server-side fingerprinting solutions fits into it? Maybe not in the letter of the law, but at least in the spirit. Until a court decide either way, we won't know for sure. [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
hrktb 6y ago
> they don't know any better There is a ton of literature about how it should be done, there has been enough press for anyone to be aware that it's a serious subject that needs to be studied, and small companies will often consult with external legal advisors because they can't afford to get on the wrong side of the law on this aspect. I've participated to a ton of these discussions in small and big entities, basically everytime a new service is launched or significantly changed. In my opinion it's pretty close to handling your finances: you don't go through all the hoops to pass you holiday rental as expenses just because you didn't know better.
- leesalminen 6y ago
  > because they can't afford to get on the wrong side of the law on this aspect. Conversely, some can't afford to get on the right side of the law on this aspect. In our case, we had ~15 customers in the EU (out of ~2000), totaling $2,000/mo MRR. After talking with our legal counsel, we decided to exit the EU market entirely. Our business model was a simple niche B2B SaaS. We never sold, shared, or traded any data of any kind. When we fired our EU customers, they were very upset! They assumed we were doing something "shady", which wasn't the case at all. The regulatory burden simply wasn't worth the relatively small MRR. The quotes provided for a third-party DPO was higher than our revenue in the market, and the only other option was for me (an overworked founder) to take on that role, and I valued my time higher than that MRR. Those customers lost out, because after we exited, so did every other player in our niche. Nobody wanted to deal with it.
  - trulyme 6y ago
    Cool! Care to share the niche? P.S.: no opportunity is lost. There is always someone else who seizes it. :)
    - jariel 6y ago
      "P.S.: no opportunity is lost. There is always someone else who seizes it. :)" I'm sure these corporations want a random person in HN to provide service to 12 customers? It's false to suggest that material barriers to providing services are only contextually relevant. It's a permanent tax and it's real.
  - newswasboring 6y ago
    Is there no open source effort to make this easy? Or is it one of those instances where people want to do it but don't want to take the legal stands (which is completely understandable). Edit: Also if you are not selling/using this data, why can't you remove everything but session cookies? Please note I'm not a web developer so the answer can just be because it's too much work.
    - 6y ago
Xylakant 6y ago
> they have legal departments that understand GDPR and protect them (e.g. GitHub) Funny coincidence that you picked GitHub since pretty much to the day two month ago that they removed all non-essential cookies https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ No cookie banner is required for session cookies etc.
dkersten 6y ago
> they require your login and therefore have your consent anyway (e.g. Facebook) Requiring you to login doesn't automatically mean consent. In fact, the laws state that you cannot make consent a requirement for using the service. You can do login without needing any consent, as cookies needed for functioning of the site are exempt, but even if it wasn't the case, opting into some doesn't automatically opt you in to all. > they can afford to skip Cookies because they have elaborate fingerprinting solutions The law isn't actually about cookies at all and rather about tracking/storing. Things like localstorage are counted the same as cookies. I'd have to check the exact language, but I wouldn't be surprised if fingerprinting isn't against the cookie law too.

frenchy 6y ago

> - they can afford to skip Cookies because they have elaborate fingerprinting solutions This is really just a special case of your last point. As far as I know, there is nothing cookie specific in the GDPR.

Fradow 6y ago
That's because the "Cookie Law", which real name is the ePrivacy directive, is separate (and predates) from the GDPR. This directive defines in (24) [1] : So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users. The definition is broad. Does server-side fingerprinting solutions fits into it? Maybe not in the letter of the law, but at least in the spirit. Until a court decide either way, we won't know for sure. [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

hrktb 6y ago

> they don't know any better There is a ton of literature about how it should be done, there has been enough press for anyone to be aware that it's a serious subject that needs to be studied, and small companies will often consult with external legal advisors because they can't afford to get on the wrong side of the law on this aspect. I've participated to a ton of these discussions in small and big entities, basically everytime a new service is launched or significantly changed. In my opinion it's pretty close to handling your finances: you don't go through all the hoops to pass you holiday rental as expenses just because you didn't know better.

leesalminen 6y ago
> because they can't afford to get on the wrong side of the law on this aspect. Conversely, some can't afford to get on the right side of the law on this aspect. In our case, we had ~15 customers in the EU (out of ~2000), totaling $2,000/mo MRR. After talking with our legal counsel, we decided to exit the EU market entirely. Our business model was a simple niche B2B SaaS. We never sold, shared, or traded any data of any kind. When we fired our EU customers, they were very upset! They assumed we were doing something "shady", which wasn't the case at all. The regulatory burden simply wasn't worth the relatively small MRR. The quotes provided for a third-party DPO was higher than our revenue in the market, and the only other option was for me (an overworked founder) to take on that role, and I valued my time higher than that MRR. Those customers lost out, because after we exited, so did every other player in our niche. Nobody wanted to deal with it.
- trulyme 6y ago
  Cool! Care to share the niche? P.S.: no opportunity is lost. There is always someone else who seizes it. :)
  - jariel 6y ago
    "P.S.: no opportunity is lost. There is always someone else who seizes it. :)" I'm sure these corporations want a random person in HN to provide service to 12 customers? It's false to suggest that material barriers to providing services are only contextually relevant. It's a permanent tax and it's real.
- newswasboring 6y ago
  Is there no open source effort to make this easy? Or is it one of those instances where people want to do it but don't want to take the legal stands (which is completely understandable). Edit: Also if you are not selling/using this data, why can't you remove everything but session cookies? Please note I'm not a web developer so the answer can just be because it's too much work.
  - 6y ago

Xylakant 6y ago

> they have legal departments that understand GDPR and protect them (e.g. GitHub) Funny coincidence that you picked GitHub since pretty much to the day two month ago that they removed all non-essential cookies https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ No cookie banner is required for session cookies etc.

dkersten 6y ago

> they require your login and therefore have your consent anyway (e.g. Facebook) Requiring you to login doesn't automatically mean consent. In fact, the laws state that you cannot make consent a requirement for using the service. You can do login without needing any consent, as cookies needed for functioning of the site are exempt, but even if it wasn't the case, opting into some doesn't automatically opt you in to all. > they can afford to skip Cookies because they have elaborate fingerprinting solutions The law isn't actually about cookies at all and rather about tracking/storing. Things like localstorage are counted the same as cookies. I'd have to check the exact language, but I wouldn't be surprised if fingerprinting isn't against the cookie law too.