9 ms·

It's not illegal to just cookie-wall your whole site without options, or is it? This site here e.g. does it: https://www.spiegel.de/ https://www.spiegel.de/ i

It's not illegal to just cookie-wall your whole site without options, or is it? This site here e.g. does it: https://www.spiegel.de/ https://www.spiegel.de/ imprint is still reachable, but if you want to read this news site you'll have to allow all the tracking crap.

notimetorelax 6y ago
It is illegal, they cannot offer free but tracked vs paid and untracked service. I guess GDPR enforcement didn't reach them yet.
- anotheryou 6y ago
  weird. they are well known in germany
  - notimetorelax 6y ago
    I think enforcement is not there yet, here’s another very similar example: https://iapp.org/news/a/ico-tells-washington-post-it-offers-invalid-cookie-consent-under-gdpr/ https://iapp.org/news/a/ico-tells-washington-post-it-offers-...
- dogma1138 6y ago
  Yes you can, you can provide an add supported service with tracking and a paid one without. Both via legitimate interest and consent.
  - alkonaut 6y ago
    The service cannot be dependent on the acceptance of third party cookies, no. That is, the service provided to those that reject third party cookies cannot be worse (slower or incomplete, for example) compared to the visitors who accept cookies. So you can supply an ad supported version and a paid version without ads, but you cannot require that those that choose the ad supported version must accept tracking ads.
    - dogma1138 6y ago
      I have gotten confirmation from several DPAs that state a very different interpretation. You can’t segregate the same service, two distinct services one that is provided with ads that include 3rd party cookies and a separate paid service that does not is perfectly fine. What you cannot do is to create multiple tiers in a free service based on different levels of tracking.
      - alkonaut 6y ago
        That sounds like an extremely business friendly interpretation of the regulation. Creating a separate service (the paid one) shouldn’t in any way change the circumstances for the first service (the one with ads). What you are describing sounds like a business can simply declare “well untargeted ads doesn’t pay enough so the options are tracking ads or paid subscriptions”. The regulation shouldn’t and doesn’t let a site make that decision. It would make it completely useless!
        dogma1138 6y ago
        DPAs including the German on are quite “business” friendly unless it will be challenged in court. You can’t force someone to provide their business at a loss. As long as you don’t penalize or segregate users based on their decision alone it does not run afoul of GDPR, neither does blocking someone completely you just need to have a valid business reason for doing that and it has to be tied to the nature of the service including how it’s funded.
        alkonaut 6y ago
        > You can’t force someone to provide their business at a loss. Of course not. But no one is forced to provide the ad funded service at all.
        dogma1138 6y ago
        No but it’s a valid business model. It’s not upto the DPAs to regulate things at this level just like you could run an astrology service and collect PII to give people readings, astrology is horseshit but you won’t run into issues with GDPR if you request users to give you their birthday and email to get spammed with BS on a daily basis.
ezzato 6y ago
The DPA (Lower Saxony) says it's not. German link: https://lfd.niedersachsen.de/startseite/themen/internet/datenschutzkonforme-einwilligungen-auf-webseiten-anforderungen-an-consent-layer-194906.html https://lfd.niedersachsen.de/startseite/themen/internet/date... They call it Nudging. I might translate this to a proper blog post in English.
- estaseuropano 6y ago
  I noticed that too. A lot of German media started doing this ("pur" subscription vs "full" subscription which also gives access to additional paywalled articles). I would be surprised if these huge publishers didn't do their legal legwork - or they are doing it just waiting for a test lawsuit to clarify the reading of the law.
  - anotheryou 6y ago
    the freemium in itself is certainly legal. In the case of spiegel though it's really accepting tracking for the free articles. sz.de e.g. has the usual toggle option for the different cookies.
Drakim 6y ago
A big part of GDPR is that you can't just say "by using our site you agree to forgo your GDPR rights" or "click here to agree not to invoke your GDPR rights" or anything like that.
- 7800 6y ago
  Yes, but I don’t understand how anyone thinks GDPR is viable, as it seems to inflict undue burden on those who responsible for the site in use. Almost everyone uses analytics. If PII like IP goes to an analytics site, how- in any way- would the site owner using those third party analytics tools be responsible for cleaning up all traces of that IP? You’re talking logs and DBs in every location from its entry into the site from the cloud hosting provider to everything that the site touches and touches on the way, and so on.
- anotheryou 6y ago
  And you are allowed to give data to any other party if they sign to agree with gdpr and you want their services...
w14 6y ago
Accessing the site with javascript switched off seems to defeat this.

notimetorelax 6y ago

It is illegal, they cannot offer free but tracked vs paid and untracked service. I guess GDPR enforcement didn't reach them yet.

anotheryou 6y ago
weird. they are well known in germany
- notimetorelax 6y ago
  I think enforcement is not there yet, here’s another very similar example: https://iapp.org/news/a/ico-tells-washington-post-it-offers-invalid-cookie-consent-under-gdpr/ https://iapp.org/news/a/ico-tells-washington-post-it-offers-...
dogma1138 6y ago
Yes you can, you can provide an add supported service with tracking and a paid one without. Both via legitimate interest and consent.
- alkonaut 6y ago
  The service cannot be dependent on the acceptance of third party cookies, no. That is, the service provided to those that reject third party cookies cannot be worse (slower or incomplete, for example) compared to the visitors who accept cookies. So you can supply an ad supported version and a paid version without ads, but you cannot require that those that choose the ad supported version must accept tracking ads.
  - dogma1138 6y ago
    I have gotten confirmation from several DPAs that state a very different interpretation. You can’t segregate the same service, two distinct services one that is provided with ads that include 3rd party cookies and a separate paid service that does not is perfectly fine. What you cannot do is to create multiple tiers in a free service based on different levels of tracking.
    - alkonaut 6y ago
      That sounds like an extremely business friendly interpretation of the regulation. Creating a separate service (the paid one) shouldn’t in any way change the circumstances for the first service (the one with ads). What you are describing sounds like a business can simply declare “well untargeted ads doesn’t pay enough so the options are tracking ads or paid subscriptions”. The regulation shouldn’t and doesn’t let a site make that decision. It would make it completely useless!
      - dogma1138 6y ago
        DPAs including the German on are quite “business” friendly unless it will be challenged in court. You can’t force someone to provide their business at a loss. As long as you don’t penalize or segregate users based on their decision alone it does not run afoul of GDPR, neither does blocking someone completely you just need to have a valid business reason for doing that and it has to be tied to the nature of the service including how it’s funded.
        alkonaut 6y ago
        > You can’t force someone to provide their business at a loss. Of course not. But no one is forced to provide the ad funded service at all.
        dogma1138 6y ago
        No but it’s a valid business model. It’s not upto the DPAs to regulate things at this level just like you could run an astrology service and collect PII to give people readings, astrology is horseshit but you won’t run into issues with GDPR if you request users to give you their birthday and email to get spammed with BS on a daily basis.

ezzato 6y ago

The DPA (Lower Saxony) says it's not. German link: https://lfd.niedersachsen.de/startseite/themen/internet/datenschutzkonforme-einwilligungen-auf-webseiten-anforderungen-an-consent-layer-194906.html https://lfd.niedersachsen.de/startseite/themen/internet/date... They call it Nudging. I might translate this to a proper blog post in English.

estaseuropano 6y ago
I noticed that too. A lot of German media started doing this ("pur" subscription vs "full" subscription which also gives access to additional paywalled articles). I would be surprised if these huge publishers didn't do their legal legwork - or they are doing it just waiting for a test lawsuit to clarify the reading of the law.
- anotheryou 6y ago
  the freemium in itself is certainly legal. In the case of spiegel though it's really accepting tracking for the free articles. sz.de e.g. has the usual toggle option for the different cookies.

Drakim 6y ago

A big part of GDPR is that you can't just say "by using our site you agree to forgo your GDPR rights" or "click here to agree not to invoke your GDPR rights" or anything like that.

7800 6y ago
Yes, but I don’t understand how anyone thinks GDPR is viable, as it seems to inflict undue burden on those who responsible for the site in use. Almost everyone uses analytics. If PII like IP goes to an analytics site, how- in any way- would the site owner using those third party analytics tools be responsible for cleaning up all traces of that IP? You’re talking logs and DBs in every location from its entry into the site from the cloud hosting provider to everything that the site touches and touches on the way, and so on.
anotheryou 6y ago
And you are allowed to give data to any other party if they sign to agree with gdpr and you want their services...

w14 6y ago

Accessing the site with javascript switched off seems to defeat this.