7 ms·

This is an illusion, only thing that happened is that you only get access to websites if you give away your GDPR consent. I love the ignorance of people over he

• switch007 6y ago
  I have never observed a non-techie do anything other than blindly click the call to action (i.e. agree to everything). The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent, avoiding the situation where consent was a grey area. It seems to have been spun to a great extent.
  • kalleboo 6y ago
    > The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent The law itself says that the default option should be to opt-out. Any site that doesn't have precisely equally prominent "agree to all" and "deny all" buttons violate the GDPR. The problem seems to be in the complete lack of enforcement.
  • devonbleak 6y ago
    My biggest annoyance lately is having to go set my cookie preferences on every. single. site. If only there was some sort of browser standard that I could set in the preferences there and sites would just obey it....
    • knorker 6y ago
      You mean like how we've been able to set cookie behavior in the browser since cookies were invented? Konqueror even had "confirm cookies" as default for a while back then.
      • ysavir 6y ago
        I think they're referencing the Do Not Track header.
        • knorker 6y ago
          Ok. So we already have do not track and cookie control. So what the hell is the EU doing?
    • thwarted 6y ago
      Remember P3P? https://en.m.wikipedia.org/wiki/P3P https://en.m.wikipedia.org/wiki/P3P
• dundarious 6y ago
  That is a huge and often unacknowledged factor. However, there are small (smaller than many think) victories even in having those click barriers -- a few percent more people can choose not to click. And unrelated to the GP's point and your response, but the ability to ask for all your data is a huge benefit.
  • deleted 6y ago
    [deleted]
• rlpb 6y ago
  > ...you only get access to websites if you give away your GDPR consent. If a model box only has "I consent" and "Learn more" buttons, then I don't consider clicking on "I consent" to mean freely given GDPR consent. Since it's the only reasonable way of viewing the website, and the GDPR doesn't permit a consent-wall, it's non-consent, and any use of my personal data following that event remains illegal. It's not a problem with the GDPR; it's a problem with the ICO failing to put a stop to this.
  • dheera 6y ago
    If there is a modal box I usually right click and get rid of the modal box with dev tools. That way I never gave any consent. Nowadays I have browser plugins that do that for me, but same idea. In any case I block cookies on all sites except for a few whitelisted ones so big "ha" to them if they think they can cookie me up. "Functional cookies" my ass. The sites work just fine without them.
    • anoncake 6y ago
      Do you really think those websites actually check if you "gave consent" before tracking you?
      • dheera 6y ago
        It feels good to not agree successfully in the lack of a "I don't agree" button. I block their cookies anyway. :) I need to find better ways to mess with their fingerprinting though, or maybe throw back some bogus cookies at them with badly-formatted data instead of blocking them.
        • pasabagi 6y ago
          Is this something people do? Is it possible for a user to edit a cookie in a malicious way? Do servers typically trust cookies they have placed on a user's machine?
          • 6y ago
• Nursie 6y ago
  > only thing that happened is that you only get access to websites if you give away your GDPR consent Well that seems untrue, as someone that regularly either outright declines, or goes through and chooses "functional only". I do occasionally see websites that say "we no longer serve the european market". That's a shame but it's up to them.
  • Macha 6y ago
    Yeah, the only sites I really come across that do that are local/regional US news sites, which by their nature I'm not really _that_ interested in, I've just been linked from reddit/HN.
• bajsejohannes 6y ago
  You are conflating GDPR and the annoying cookie dialogs. GDPR regulates, among other things, how information is stored and deleted on servers. I have worked at multiple companies in both Europe and the US who take this very seriously and has definitely altered their practices based on this. For example, pre-GDPR, we would "mark as deleted" but not delete. Now we delete.
• harperlee 6y ago
  The website accept button is not in the GDPR. [EDIT: it's a different law] GDPR covers way more requirements regarding data management. You need complete control over the lifecycle of sensitive data, exhaustive documentation of data transformations, you have concrete obligations regarding disclosure of incidents, data removal, limitations of for what data is used, user consent management, and the obligation to have people personally liable (which is big, just look at AML regulations to see the effect when not only the fuzzy concept of "the company" is liable).
  • macinjosh 6y ago
    It does not matter since it is a consequence of the GDPR anyway. Regulators can't just push aside negative consequences of their regulations by simply saying "that's not what we meant nor the outcome we wanted". This is why regulations fail. Regulators think they are providing incentives for good things and disincentives for bad things. In reality, they are just perverting incentives. To fix those problems more rules are added, and the cycle goes on. Pretty soon you have a foot high stack of regulations that small business owners can't afford to consider or follow so they just don't exist at some point.
    • harperlee 6y ago
      Sorry for not being clear: my point was not "the law does not explicitly ask for the button, that's just a misapplication" but more something like "the button thing is another completely different law, GDPR has way more topics and thus when you say 'I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button' I disagree wholeheartedly".
  • nmeofthestate 6y ago
    Yeah, that's what I was thinking - people are mixing up GDPR with the "cookies law" that mandated the [Accept All]/[Maze of Settings] choice on all websites that want to use cookies. The cookies mess was pre-GDPR.
• Lapoino 6y ago
  At least in SAP (german softwarecompany 100.000 employees) we have to follow gdrp very stricktly and we do. I don't know if that was the case before gdrp but we have to centraly clarify if and when we store user data, what we do with it and we have to show that we can delete user data if requested. Not sure how far small companies go through this thow.
  • ric2b 6y ago
    SAP makes mega-customizable software installed at thousands of large companies, it's probably on the extreme end of the difficulty spectrum when it comes to complying with GDPR.
• kalleboo 6y ago
  > thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites I know of small companies that before GDPR didn't really consider the implications of private data at all. They'd just let their SQL databases grow forever (mark as delete and have "script to actually delete the data" as a TODO that never happened), had random backups lying around on dev machines. GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets. It was a bit more work, and adds a small bit of friction, but these are still important things! Forcing cooks in restaurants to wash their hands after using the bathroom also adds friction to the process but is similarly important.
  • Silhouette 6y ago
    GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets. That is the theory. The reality is that many small businesses don't even know the GDPR exists. Others are not complying because they think they will get away with it, and they are probably right. The rules are so ambiguous in some important ways that even those who do intend to comply might not actually be compliant and won't find out until a regulator intervenes. And all of that together means that a small business that does try hard and become compliant is at a significant competitive disadvantage. To be clear, I am a firm believer in strong privacy protections, and my own businesses seek to be in the latter category. But the GDPR is flawed in important ways, and future regulation deviating from it is not necessarily a bad thing. Obviously it depends on whether the deviation is of the selling-out or the fixing-problems variety. Though admittedly, with the current UK government, I fear the former is much more likely.
    • asymmetric 6y ago
      In what important ways is the GDPR flawed?
      • Silhouette 6y ago
        One important way is ambiguity. For example, it relies on "legitimate interests" as a lawful basis for a lot of different types of processing, but there is no specific, actionable definition of that term. This is compounded by the right of the data subject to object to some processing, but again with only an ambiguous specification of when those rights take precedence over the legitimate interests of the data controller (other than a few specific cases, such as direct marketing). As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR. Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone. Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law. Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in. In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom. None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.