6 ms·

Unfortunately the law was so bad even its creators can’t implement/understand/respect it.

by nickpp 5y ago

beebeepka 5y ago
Is it, though? I thought they are only required if the site is setting tracking cookies. Is that not straight forward enough?
- GekkePrutser 5y ago
  No it's required for all types of tracking including but not exclusively cookies. Only days collection that is absolutely required to provide the service may be collected without consent and for that purpose only.
  - Beldin 5y ago
    To put that slightly differently: warnings/popups are never needed unless you're taking data from your visitor which has nothing to do with the function(s) your offering the visitor. The GDPR spells out when you're allowed to collect data; asking for consent is basically its emergency escape hatch. You only need to do that if there is absolutely no (functional) reason to get that data, but you want it anyway.
    - nickpp 5y ago
      GDPR doesn't spell out anything. It's the most vague f-ing BS I have ever seen. There are no definitions, no guidelines. 6 years later there is no consensus on simple questions like website analytics which is probably the most common usage scenario for the kind of data GDPR covers. This law is beyond bad.
      - dmitriid 5y ago
        > There are no definitions, no guidelines. There are both definitions and guidelines. You just didn't even care to read it. For example, cookies: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Popups: https://gdpr.eu/recital-32-conditions-for-consent/ https://gdpr.eu/recital-32-conditions-for-consent/ === start quote === Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent. === end quote === > there is no consensus on simple questions like website analytics which is probably the most common usage scenario for the kind of data GDPR covers. The consensus is there. And it's spelled clearly in the law.
        nickpp 5y ago
        Please tell me the consensus and guideline for website analytics. Please tell me the consensus and guideline on how to store the rejection for using cookies so I don't ask the website visitor every time he visits. Please tell me the consensus and guideline on what "legitimate purposes" are. With examples per industry please. And most of all, please tell me the consensus and guideline for cookie banners and popups, considering they are used on the EU's websites themselves.
        dmitriid 5y ago
        > Please tell me the consensus and guideline for website analytics. Literally described in one of the links. > Please tell me the consensus and guideline on how to store the rejection for using cookies You can use a cookie for that. If it's for a logged-in user, you can store that in the user profile. > Please tell me the consensus and guideline on what "legitimate purposes" are. Text in one of the links literally contains a link to further reading on legitimate interest. > And most of all, please tell me the consensus and guideline for cookie banners and popups Literally described in both links. Once again. It's painfully clear that you never bothered to read and understand anything about the law in the past 6 years. Your clueless questions about "why does gdpr and europa sites have cookie banners" only serve as further proof.
        nickpp 5y ago
        > Literally described in one of the links. The https://gdpr.eu/ https://gdpr.eu/ website is not official. Its description of "analytics cookies" cannot be found anywhere in the actual GDPR & Co regulations. > You can use a cookie for that. Use a cookie to store the literal "No cookies" preference? Great example of the contradictory and irrational text of the GDPR. > Text in one of the links literally contains a link to further reading on legitimate interest. More vague and contradictory BS. > Literally described in both links. Too bad that description is not actually valid and if you'll actually check the GDPR text (not the non-official gdpr.eu website) you'll find no such descriptions. Moreover, the cookie banner on both websites is actually illegal under GDPR. Check out https://ico.org.uk/ https://ico.org.uk/ for a correct (but horrifying) implementation. You are correct, I am not an every-day GDPR expert. I only encounter it when implementing on various websites and there only for analytics - no ads or anything more. But its requirements were always for the worse. Because of its vague and contradictory definitions everybody (including me) adopted the safest implementation and thus the current web of cookie banners and popups was born. I hope you are happy with it, it solves nothing but it makes everybody's life worse.
  - beebeepka 5y ago
    Law is reasonable then. You track your user, you notify them . I fail to see the problem. Then again, I am not running shady websites and selling user data
    - kortilla 5y ago
      Yes, very reasonable. Gdpr pop ups on nearly every site with dark patterns making it annoying to opt out. A resounding success.
      - dmitriid 5y ago
        Once again, those popups are illegal under GDPR. So yes, it's a failure of law enforcement, but doesn't make the law itself unreasonable.
        kortilla 5y ago
        If a law is realistically unenforceable then it’s unreasonable. A law that requires some agency in Europe to police all of the websites around the world is pretty fucking stupid.
        dmitriid 5y ago
        > If a law is realistically unenforceable then it’s unreasonable. It is enforceable, and there have already been fines. > A law that requires some agency in Europe to police all of the websites No, they are not going to police every website in the world. Once again, if it 6 years later you still couldn't read and understand a rather reasonably written law with multiple explanations and examples, you are a part of the problem.
        nickpp 5y ago
        After 6 years, Google itself (which has all the lawyers and engineers it needs) has resorted to the same f-ing ugly cookie popup everyone else is using. The problem is the law. It's a crappy law.
dmitriid 5y ago
The law is very straightforward and can be quite easily implemented by anyone. Notable exceptions are finance institutions where GDPR is superseded by relevant financial laws of each country. There are explainers, compliance checklists, whatever you want to implement it. It was three years before it went in effect, and it's been 3 years since it went into effect. If you don't understand it by now, you definitely don't deserve to be handling personal data.
- nickpp 5y ago
  The only straightforward thing about this law is how ignorant were its creators. The cost of implementing it was in the billions. The human time cost paid for all those damn cookie popups we keep having to click on is probably already in the thousands of life-times wasted, and it keeps on growing.
  - dmitriid 5y ago
    > The cost of implementing it was in the billions. Cry me a river. If you was careless with users' data, who cares? > The human time cost paid for all those damn cookie popups we keep having to click on is probably already in the thousands of life-times wasted, and it keeps on growing. Ah yes, and the problem is the law that protects users' data, and not the companies who couldn't care less about privacy.
    - nickpp 5y ago
      The very https://gdpr.eu/ https://gdpr.eu/ website has a cookie banner!!! When everybody breaks a law, including its creators, it's the law that is broken.
      - jlokier 5y ago
        Cookie banners are fine when done appropriately. The one on https://gdpr.eu/ https://gdpr.eu/ is very well done. It does not break the law. It's an example of excellence others should follow. Unintrusive. As easy to opt out as to opt in. Clear buttons, simple language. Clear text. If you prefer to ignore the banner that's fine too. On desktop it's unintrusive and you can just ignore it. I tried scrolling, it just stays out of the way. Each button is clear: "Ok", "No", "Privacy policy". Perfect. (It could be better on mobile for size, but it's still easy to click away.) No dark patterns, dirty tricks, misleading controls, no "yes means no" controls, no "visit our 1000 partner sites to opt out" insanity, no other dirty tricks. You will not "accidentally" end up tracked when you didn't want to be. You will not be misled into believing a 70% screen size, deliberately slow panel is required. Panels on other sites are deliberately slow and harder to opt out of. They want you to be annoyed. That's because they want you to believe the GDPR requires stupid, slow, large, intrusive, complicated banners. So that you will tell everyone how bad the GDPR is. But the GDPR doesn't require those things. In fact, when you see a banner that says "due to the GDPR we must..." it is often a straight up lie, and parts of the banner are against the law, not required by it. https://gdpr.eu/ https://gdpr.eu/ - thanks for highlighting that great example. I will take that as inspiration next time I need a good quality, sleek, fast, easy, compliant and user-friendly banner. Such banners are not required, though. My sites don't have cookie banners and that's fine. They don't track users against the expectations of the users. My sites do have optional logins, user identification, and use cookies for those things, but logins don't require cookie banners because people expect their identity to be tracked by the act of logging in. And, importantly, their identity used only for what users would expect. My sites do have basic request logging and monitoring too, as you would expect for security and ops, but again those don't require cookie banners if they are done respectfully.
anoncake 5y ago
gdpr.eu is not official. This has been mentioned on HN dozens of times.
- dmitriid 5y ago
  There's the law, you complain that it's badly written, that it's impossible to understand, that it's impossible to implement. Even though it has multiple recitals to explain things. Because you've never read it and never tried to understand it. There are multiple guides and explanations for the law. You complain that those are not official. One thing is definitely clear: 6 years later it's not a problem with the law. It's the problem with you and other people like you who diss GDPR without taking a single step to understand it.
  - anoncake 5y ago
    I do what now?

Unfortunately the law was so bad even its creators can’t implement/understand/respect it.

by nickpp 5y ago

Unfortunately the law was so bad even its creators can’t implement/understand/respect it.

Is it, though? I thought they are only required if the site is setting tracking cookies. Is that not straight forward enough?

GekkePrutser 5y ago
No it's required for all types of tracking including but not exclusively cookies. Only days collection that is absolutely required to provide the service may be collected without consent and for that purpose only.
- Beldin 5y ago
  To put that slightly differently: warnings/popups are never needed unless you're taking data from your visitor which has nothing to do with the function(s) your offering the visitor. The GDPR spells out when you're allowed to collect data; asking for consent is basically its emergency escape hatch. You only need to do that if there is absolutely no (functional) reason to get that data, but you want it anyway.
  - nickpp 5y ago
    GDPR doesn't spell out anything. It's the most vague f-ing BS I have ever seen. There are no definitions, no guidelines. 6 years later there is no consensus on simple questions like website analytics which is probably the most common usage scenario for the kind of data GDPR covers. This law is beyond bad.
    - dmitriid 5y ago
      > There are no definitions, no guidelines. There are both definitions and guidelines. You just didn't even care to read it. For example, cookies: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Popups: https://gdpr.eu/recital-32-conditions-for-consent/ https://gdpr.eu/recital-32-conditions-for-consent/ === start quote === Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent. === end quote === > there is no consensus on simple questions like website analytics which is probably the most common usage scenario for the kind of data GDPR covers. The consensus is there. And it's spelled clearly in the law.
      - nickpp 5y ago
        Please tell me the consensus and guideline for website analytics. Please tell me the consensus and guideline on how to store the rejection for using cookies so I don't ask the website visitor every time he visits. Please tell me the consensus and guideline on what "legitimate purposes" are. With examples per industry please. And most of all, please tell me the consensus and guideline for cookie banners and popups, considering they are used on the EU's websites themselves.
        dmitriid 5y ago
        > Please tell me the consensus and guideline for website analytics. Literally described in one of the links. > Please tell me the consensus and guideline on how to store the rejection for using cookies You can use a cookie for that. If it's for a logged-in user, you can store that in the user profile. > Please tell me the consensus and guideline on what "legitimate purposes" are. Text in one of the links literally contains a link to further reading on legitimate interest. > And most of all, please tell me the consensus and guideline for cookie banners and popups Literally described in both links. Once again. It's painfully clear that you never bothered to read and understand anything about the law in the past 6 years. Your clueless questions about "why does gdpr and europa sites have cookie banners" only serve as further proof.
        nickpp 5y ago
        > Literally described in one of the links. The https://gdpr.eu/ https://gdpr.eu/ website is not official. Its description of "analytics cookies" cannot be found anywhere in the actual GDPR & Co regulations. > You can use a cookie for that. Use a cookie to store the literal "No cookies" preference? Great example of the contradictory and irrational text of the GDPR. > Text in one of the links literally contains a link to further reading on legitimate interest. More vague and contradictory BS. > Literally described in both links. Too bad that description is not actually valid and if you'll actually check the GDPR text (not the non-official gdpr.eu website) you'll find no such descriptions. Moreover, the cookie banner on both websites is actually illegal under GDPR. Check out https://ico.org.uk/ https://ico.org.uk/ for a correct (but horrifying) implementation. You are correct, I am not an every-day GDPR expert. I only encounter it when implementing on various websites and there only for analytics - no ads or anything more. But its requirements were always for the worse. Because of its vague and contradictory definitions everybody (including me) adopted the safest implementation and thus the current web of cookie banners and popups was born. I hope you are happy with it, it solves nothing but it makes everybody's life worse.
- beebeepka 5y ago
  Law is reasonable then. You track your user, you notify them . I fail to see the problem. Then again, I am not running shady websites and selling user data
  - kortilla 5y ago
    Yes, very reasonable. Gdpr pop ups on nearly every site with dark patterns making it annoying to opt out. A resounding success.
    - dmitriid 5y ago
      Once again, those popups are illegal under GDPR. So yes, it's a failure of law enforcement, but doesn't make the law itself unreasonable.
      - kortilla 5y ago
        If a law is realistically unenforceable then it’s unreasonable. A law that requires some agency in Europe to police all of the websites around the world is pretty fucking stupid.
        dmitriid 5y ago
        > If a law is realistically unenforceable then it’s unreasonable. It is enforceable, and there have already been fines. > A law that requires some agency in Europe to police all of the websites No, they are not going to police every website in the world. Once again, if it 6 years later you still couldn't read and understand a rather reasonably written law with multiple explanations and examples, you are a part of the problem.
        nickpp 5y ago
        After 6 years, Google itself (which has all the lawyers and engineers it needs) has resorted to the same f-ing ugly cookie popup everyone else is using. The problem is the law. It's a crappy law.

dmitriid 5y ago

The law is very straightforward and can be quite easily implemented by anyone. Notable exceptions are finance institutions where GDPR is superseded by relevant financial laws of each country. There are explainers, compliance checklists, whatever you want to implement it. It was three years before it went in effect, and it's been 3 years since it went into effect. If you don't understand it by now, you definitely don't deserve to be handling personal data.

nickpp 5y ago
The only straightforward thing about this law is how ignorant were its creators. The cost of implementing it was in the billions. The human time cost paid for all those damn cookie popups we keep having to click on is probably already in the thousands of life-times wasted, and it keeps on growing.
- dmitriid 5y ago
  > The cost of implementing it was in the billions. Cry me a river. If you was careless with users' data, who cares? > The human time cost paid for all those damn cookie popups we keep having to click on is probably already in the thousands of life-times wasted, and it keeps on growing. Ah yes, and the problem is the law that protects users' data, and not the companies who couldn't care less about privacy.
  - nickpp 5y ago
    The very https://gdpr.eu/ https://gdpr.eu/ website has a cookie banner!!! When everybody breaks a law, including its creators, it's the law that is broken.
    - jlokier 5y ago
      Cookie banners are fine when done appropriately. The one on https://gdpr.eu/ https://gdpr.eu/ is very well done. It does not break the law. It's an example of excellence others should follow. Unintrusive. As easy to opt out as to opt in. Clear buttons, simple language. Clear text. If you prefer to ignore the banner that's fine too. On desktop it's unintrusive and you can just ignore it. I tried scrolling, it just stays out of the way. Each button is clear: "Ok", "No", "Privacy policy". Perfect. (It could be better on mobile for size, but it's still easy to click away.) No dark patterns, dirty tricks, misleading controls, no "yes means no" controls, no "visit our 1000 partner sites to opt out" insanity, no other dirty tricks. You will not "accidentally" end up tracked when you didn't want to be. You will not be misled into believing a 70% screen size, deliberately slow panel is required. Panels on other sites are deliberately slow and harder to opt out of. They want you to be annoyed. That's because they want you to believe the GDPR requires stupid, slow, large, intrusive, complicated banners. So that you will tell everyone how bad the GDPR is. But the GDPR doesn't require those things. In fact, when you see a banner that says "due to the GDPR we must..." it is often a straight up lie, and parts of the banner are against the law, not required by it. https://gdpr.eu/ https://gdpr.eu/ - thanks for highlighting that great example. I will take that as inspiration next time I need a good quality, sleek, fast, easy, compliant and user-friendly banner. Such banners are not required, though. My sites don't have cookie banners and that's fine. They don't track users against the expectations of the users. My sites do have optional logins, user identification, and use cookies for those things, but logins don't require cookie banners because people expect their identity to be tracked by the act of logging in. And, importantly, their identity used only for what users would expect. My sites do have basic request logging and monitoring too, as you would expect for security and ops, but again those don't require cookie banners if they are done respectfully.

anoncake 5y ago

gdpr.eu is not official. This has been mentioned on HN dozens of times.

dmitriid 5y ago
There's the law, you complain that it's badly written, that it's impossible to understand, that it's impossible to implement. Even though it has multiple recitals to explain things. Because you've never read it and never tried to understand it. There are multiple guides and explanations for the law. You complain that those are not official. One thing is definitely clear: 6 years later it's not a problem with the law. It's the problem with you and other people like you who diss GDPR without taking a single step to understand it.
- anoncake 5y ago
  I do what now?