5 ms·

> Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law.. Because the law obviously didn't help stopping companies

> Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law.. Because the law obviously didn't help stopping companies from doing shady shit and made the user experience of the web worse?

llarsson 6y ago
Quite a few companies have been fined for violating the law, and we are seeing positive effects for privacy because of it. The cookie stuff, yes, it's annoying for us end users. I get it. But take how H&M were fined for violating the privacy of their employees. That they had to stop doing that is a Good Thing, right? https://www.bbc.com/news/technology-54418936 https://www.bbc.com/news/technology-54418936
- fguerraz 6y ago
  No, it is not a good thing. GDPR is a highly complex piece of legislation that is very hard to navigate and therefore only established companies with big bucks to spend on lawyers and extra engineering can profit from the ecosystem while everybody else is put at risk. Complex legislation and regulations is the best way to keep monopolies in place. Same goes for the financial sector, telecoms, etc. It's nearly impossible for new players to emerge. This complex frameworks are put it place so that big companies that do nasty things can get away with it because they will be able to demonstrate that they have complied with the regulations while emerging players will break their teeth on it. Instead of regulating _how_ data collection and processing should be done, we should penalise _what_ is done with the data in simple clear terms, and make _people_ (CEOs, etc.) responsible not just giving fines to companies. Basically, reintroduce skin in the game.
  - matsemann 6y ago
    GDPR is sooo easy to follow as a startup. Just gather the data you need and not everything else,and ask for consent. If anything, it was the big players getting work to do. Thousands of people on mailing lists with no control of how they got there. Asked and kept insane amounts of not necessary data. Data floating in hundreds of database tables spread over various services and third party vendors and data centers with no control. Cleaning up that was a huge job.
    - speleding 6y ago
      It really isn't that easy. Something like an IP address is considered personally identifiable information, and most web servers and frameworks log that by default. If you really want to comply it takes quite a bit of effort you are not accidentally logging IP addresses somewhere. You can argue you need that info for the operation of your site, but it's been established that you would still need to ask permission in that case, did you do that? Of course, they are unlikely to come after a startup for an infringement like that, but the point is that they could if they wanted to.
      - skinkestek 6y ago
        Speculation here, but informed speculation: I highly doubt you as a non shady actor will be punished because of your server logs as such. Start selling or otherwise sharing them with ad companies, directly or indirectly and you deserve and should expect a GDPR fine as soon as they can if you are in a jurisdiction where GDPR applies. Same if you involuntary leak data because of gross negligence: passwords in cleartext, unnecessary data collected and stored and later leaked etc etc In many cases I understand authorities will even contact companies first and try to guide them toward a compliant solution first instead of fining tjem right away. That said I wish there were some clarifications given wrt to server logs and IP addresses; running without is in many cases gross negligence in itself. Basic logging is first year defense against black arts curriculum.
      - anang 6y ago
        I don’t think the only factor considered is whether or not something is PII, rather even the intent is considered. If you were storing IP addresses to track and market to users, you need consent. If you’re using them for logging and security purposes, I think that falls under legitimate interest.
        speleding 6y ago
        Just Google "IP addresses GDPR" and you will see several different conclusions. I actually looked at the site of the enforcement authority in my country and they say you can only store the first 3 bytes of an IP address. But enforcement authorities in other countries may claim differently. My point is: it's really not that easy. It should be easy to get clear guidance on something straightforward like this, and not have to resort to Stack overflow answers.
MakersF 6y ago
The law forced the companies to be explicit about what they do, and ask for consent. The user experience is made shit by the companies doing shady things. If they didn't do shady shit, they wouldn't have to display any banner. I'd rather be informed, at least I can make a decision that way. Why shoot the messenger? The part that is missing is making rejecting as easy as accepting. So far there are a lot of dark patterns, but there are sites that make it very clear and easy, and I appreciate it.
- speleding 6y ago
  How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info). The law could have been much better if it simply asked browser makers to provide a single place to configure your preference, and then forced companies to abide by that setting.
  - sdflhasjd 6y ago
    I'm sure it's possible to do analytics in a user friendly way - you can do basic analytics without storing IPs or using cookies. The problem is that Google Analytics isn't _just_ collecting data for you, it's collecting a trove of other data that it's using to track and link users accross other websites.
  - TeMPOraL 6y ago
    > How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. Just because it's free and somewhat nice looking, doesn't mean it isn't shady shit. Maybe all you care about is counting unique visitors, but by doing that with Google Analytics, you're exposing your visitors to a complex surveillance product that collects data for its own purposes, and it sees much more than what's needed to just count unique visits.
    - 6y ago
ckastner 6y ago
> Because the law obviously didn't help stopping companies from doing shady shit It helped immensely. I work in the financial sector in an EU country, and most institutions in my country are terrified about the GDPR. The fact that some people will happily operate on the border or even closely beyond the border of law, applies to any other regulation as well.
- Aerroon 6y ago
  How is it helpful if most institutions are terrified? Doesn't it indicate that the regulation is unreasonable instead? If the EU commission can't run a website without a popup, then why would you expect anyone else to be able to?
  - ckastner 6y ago
    I meant terrified of doing shady stuff (as I was responding to the assertion that it didn't stop doing shady stuff), not terrified in general. Running a website without a popup is easy. Just stop any processing that is not necessary for you to provide the service. "But I want to track what users are doing!" - Well, then you have to show them a popup about that. The GDPR holds that data protection is a fundamental right. Consequently, the user's interests generally trump a website owner's interest.
    - Aerroon 6y ago
      >"But I want to track what users are doing!" - Well, then you have to show them a popup about that. I think most website owners don't care about that, but they do care about earning money to actually run the website. >The GDPR holds that data protection is a fundamental right. The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay for it or not. You cannot not show content to users who refuse to share the data. Effectively, everyone else has to subsidize them. And that's why you have a labyrinth of pop ups - GDPR breaks the normal monetization methods of the web. Suddenly they're surprised that this led to dark patterns.

llarsson 6y ago

Quite a few companies have been fined for violating the law, and we are seeing positive effects for privacy because of it. The cookie stuff, yes, it's annoying for us end users. I get it. But take how H&M were fined for violating the privacy of their employees. That they had to stop doing that is a Good Thing, right? https://www.bbc.com/news/technology-54418936 https://www.bbc.com/news/technology-54418936

fguerraz 6y ago
No, it is not a good thing. GDPR is a highly complex piece of legislation that is very hard to navigate and therefore only established companies with big bucks to spend on lawyers and extra engineering can profit from the ecosystem while everybody else is put at risk. Complex legislation and regulations is the best way to keep monopolies in place. Same goes for the financial sector, telecoms, etc. It's nearly impossible for new players to emerge. This complex frameworks are put it place so that big companies that do nasty things can get away with it because they will be able to demonstrate that they have complied with the regulations while emerging players will break their teeth on it. Instead of regulating _how_ data collection and processing should be done, we should penalise _what_ is done with the data in simple clear terms, and make _people_ (CEOs, etc.) responsible not just giving fines to companies. Basically, reintroduce skin in the game.
- matsemann 6y ago
  GDPR is sooo easy to follow as a startup. Just gather the data you need and not everything else,and ask for consent. If anything, it was the big players getting work to do. Thousands of people on mailing lists with no control of how they got there. Asked and kept insane amounts of not necessary data. Data floating in hundreds of database tables spread over various services and third party vendors and data centers with no control. Cleaning up that was a huge job.
  - speleding 6y ago
    It really isn't that easy. Something like an IP address is considered personally identifiable information, and most web servers and frameworks log that by default. If you really want to comply it takes quite a bit of effort you are not accidentally logging IP addresses somewhere. You can argue you need that info for the operation of your site, but it's been established that you would still need to ask permission in that case, did you do that? Of course, they are unlikely to come after a startup for an infringement like that, but the point is that they could if they wanted to.
    - skinkestek 6y ago
      Speculation here, but informed speculation: I highly doubt you as a non shady actor will be punished because of your server logs as such. Start selling or otherwise sharing them with ad companies, directly or indirectly and you deserve and should expect a GDPR fine as soon as they can if you are in a jurisdiction where GDPR applies. Same if you involuntary leak data because of gross negligence: passwords in cleartext, unnecessary data collected and stored and later leaked etc etc In many cases I understand authorities will even contact companies first and try to guide them toward a compliant solution first instead of fining tjem right away. That said I wish there were some clarifications given wrt to server logs and IP addresses; running without is in many cases gross negligence in itself. Basic logging is first year defense against black arts curriculum.
    - anang 6y ago
      I don’t think the only factor considered is whether or not something is PII, rather even the intent is considered. If you were storing IP addresses to track and market to users, you need consent. If you’re using them for logging and security purposes, I think that falls under legitimate interest.
      - speleding 6y ago
        Just Google "IP addresses GDPR" and you will see several different conclusions. I actually looked at the site of the enforcement authority in my country and they say you can only store the first 3 bytes of an IP address. But enforcement authorities in other countries may claim differently. My point is: it's really not that easy. It should be easy to get clear guidance on something straightforward like this, and not have to resort to Stack overflow answers.

MakersF 6y ago

The law forced the companies to be explicit about what they do, and ask for consent. The user experience is made shit by the companies doing shady things. If they didn't do shady shit, they wouldn't have to display any banner. I'd rather be informed, at least I can make a decision that way. Why shoot the messenger? The part that is missing is making rejecting as easy as accepting. So far there are a lot of dark patterns, but there are sites that make it very clear and easy, and I appreciate it.

speleding 6y ago
How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info). The law could have been much better if it simply asked browser makers to provide a single place to configure your preference, and then forced companies to abide by that setting.
- sdflhasjd 6y ago
  I'm sure it's possible to do analytics in a user friendly way - you can do basic analytics without storing IPs or using cookies. The problem is that Google Analytics isn't _just_ collecting data for you, it's collecting a trove of other data that it's using to track and link users accross other websites.
- TeMPOraL 6y ago
  > How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. Just because it's free and somewhat nice looking, doesn't mean it isn't shady shit. Maybe all you care about is counting unique visitors, but by doing that with Google Analytics, you're exposing your visitors to a complex surveillance product that collects data for its own purposes, and it sees much more than what's needed to just count unique visits.
  - 6y ago

ckastner 6y ago

> Because the law obviously didn't help stopping companies from doing shady shit It helped immensely. I work in the financial sector in an EU country, and most institutions in my country are terrified about the GDPR. The fact that some people will happily operate on the border or even closely beyond the border of law, applies to any other regulation as well.

Aerroon 6y ago
How is it helpful if most institutions are terrified? Doesn't it indicate that the regulation is unreasonable instead? If the EU commission can't run a website without a popup, then why would you expect anyone else to be able to?
- ckastner 6y ago
  I meant terrified of doing shady stuff (as I was responding to the assertion that it didn't stop doing shady stuff), not terrified in general. Running a website without a popup is easy. Just stop any processing that is not necessary for you to provide the service. "But I want to track what users are doing!" - Well, then you have to show them a popup about that. The GDPR holds that data protection is a fundamental right. Consequently, the user's interests generally trump a website owner's interest.
  - Aerroon 6y ago
    >"But I want to track what users are doing!" - Well, then you have to show them a popup about that. I think most website owners don't care about that, but they do care about earning money to actually run the website. >The GDPR holds that data protection is a fundamental right. The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay for it or not. You cannot not show content to users who refuse to share the data. Effectively, everyone else has to subsidize them. And that's why you have a labyrinth of pop ups - GDPR breaks the normal monetization methods of the web. Suddenly they're surprised that this led to dark patterns.