5 ms·
Can they include BBC as well? They have opted into disguising their malicious cookies as "Legitimate Interest", which will stay even if you reject the cookies a
by csunbird 5y ago
Can they include BBC as well? They have opted into disguising their malicious cookies as "Legitimate Interest", which will stay even if you reject the cookies and requires toggling off 100+ of them individually.
- deleted 5y ago[deleted]
- mrweasel 5y agoI've seen "Legitimate Interest", but no where has anyone explained what that actually means.
- robin_reala 5y agoTypically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout). The fact that the BBC have chosen to add consent options to a purported legitimate interest is a hint that they’re trying to confuse the user.
- martin_a 5y ago> The fact that the BBC have chosen to add consent options [...] is a hint that they’re trying to confuse the user. Yes, just another dark pattern which you see so often with those cookie banners.
- merijnv 5y ago> Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout). Nope, that'd be the "contract" basis (i.e. this information is strictly necessary for the user's intended task). Legitimate interest is for non-essential data that it is, somehow, in the user's best interest to gather. But convincing a judge of that data being in the user's best interest is a...tricky bar to clear.
- martin_a 5y agoThe GDPR has a part about that, it's where this wording comes from. It boils down to basic visitor counting without privacy violations. Companies obviously try to broaden the definition of that.
- thrawn0r 5y agoIt's one of the reasons that allows a company to collect/process personal information without a) consent b) contractual obligation c) legal requirements It's a bit loopholey, but has high hurdles since the processor needs to argue that their legitimate interest is bigger than the right for data privacy of the user. The processor has to create a DPIA (data privacy impact assessment) to show that they indeed balanced these both sides. The document can only be requested from the data protection authorities and are not public though.
- tpxl 5y agoThose are things you need for the website to work. Session/login cookies are examples of this. It also applies to other data, for example if you order something they have a legitimate interest to ask for and store your address (but only for the purposes of shipping, they cannot use it for anything else). This has been twisted into "It's legitimate we track you because this is how we make money and we can't exist without money" which is obvious bullshit.
- megous 5y agoGDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." in its preface. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Anyway, flimsy legitimate interest excuses are easiest to override. You just object to data processing, then it's upon the other side to provide overriding reasons why their legitimate interest is more important than your "interests or fundamental rights and freedoms" of which right to object to data processing is one. Almost nobody even tried to pass that hurdle when I objected to data processing. And those few that did try, I just sent them the decision to fine for almost identical situation (where a company tried to claim legitimate interest for mining data from public registries and sources and publishing them on a website) from my country's DPA. And that made them comply too.
- dorgo 5y ago>You just object to data processing The problem with objecting is that they claim to need to store your info for the future to exclude you from data gathering. And presumably give that blacklist to everybody else to "exlude" you.
- megous 5y agoFine by me, as long as they can't use it for anything else.
- movedx 5y agoThanks to Brexit the BBC cannot be held accountable to the EU anymore, no? Edit: thanks for the responses. Understood: it still applies.
- WJW 5y agoGDPR is not limited to companies inside the EU only. It covers (the PII of) every _user_ from the EU, location of the website does not matter.
- hervature 5y agoGDPR applies to all websites that want to operate within the EU.
- throwaway3699 5y agoThe BBC does not operate in the EU, except to serve an ad supported version.
- speedgoose 5y agoSo it does ?
- robin_reala 5y agoGDPR isn’t an EU law, it’s an EU directive, which means that it was (mostly) required to be implemented into member states’ own legal system. This was done in the UK before leaving the EU, in the Data Protection Act 2018.
- zepin 5y agoGDPR is not a directive, but a "regulation" (hence the name, General Data Protection Regulation). It is enforceable "as is" in the whole EU without the need to be transposed into the various national laws.
- Angostura 5y agoGDPR is embodied in U.K. law as the 2018 Data Protection Act. It continues to function post-Brexit
- sneak 5y agoThe extension you want is called Cookie Autodelete. Then, it simply doesn't matter what you leave on. The extension deletes all identifiers from the site 15 seconds after tab close.
- csunbird 5y agoBut, unfortunately, even if you auto delete cookies, by accepting or not objecting "Legitimate interest for anti-fraud purposes" allow browser fingerprinting scripts to be run and does not require cookies to be present. Yes, the advertising companies are that evil.