3 ms·

It feels as if the companies are working hard to make it annoying and complex to opt out. Every iteration makes things a bit worse. We need people like Max to

by zibzab 5y ago

It feels as if the companies are working hard to make it annoying and complex to opt out. Every iteration makes things a bit worse. We need people like Max to stop this annoying trend. Edit: while at it, i have to get this off my chest: Legitimate Interest is probably illegal and violates GDPR. Max should go after that next.

deleted 5y ago
[deleted]
tcldr 5y ago
Legitimate interest is one of the six legal bases for processing personal data under the GDPR, alongside: consent, performance of a contract, a vital interest, a legal requirement, and a public interest. I don’t think we’ve seen much in the way of precedent being set here, but theoretically if you can demonstrate and document a measured approach to the way you collect and process data it should be fine. (Objection not withstanding.) On the other hand, a drag net approach to collecting and sharing data won’t stand up to legitimate interest claims no matter how many toggles you put on your cookie banners.
- zibzab 5y ago
  My personal take is that there is no real legitimate interest here and these companies are just testing to see how far they can push this.
- xg15 5y ago
  In the dialogs I have seen so far, the "legitimate interest" page was always a perfect carbon-copy of the "consent" page - with the only difference that the "consent" options were off by default while the "legimate interest" options were on by default. I understand that, legally, the buttons represent different actions (not giving consent vs objecting a legitimate interest claim) but practically, the only purpose the "legitimate interest" page seems to serve is as a way to have on-by-default options that are still borderline legal. I can't imagine this is in the spirit of the law.
  - pieno 5y ago
    I think a lot of sites are conflating cookie consent and GDPR consent. You only need GDPR consent when processing personal data, so you don’t need consent just for storing settings in a cookie (as long as those settings do not contain personal data or identifiers linked to personal data). But many sites will ask “GDPR consent” or claim “GDPR legitimate interest” for those settings cookies in any case (in my view that’s a dark pattern in itself because you’re actually making the side harder or impossible to use and thereby inducing visitors to just click the big green “accept all” button to get it over with already…)
    - M2Ys4U 5y ago
      >I think a lot of sites are conflating cookie consent and GDPR consent. They are doing that, however the the legal standard of consent under the ePrivacy Directive is the same as the GDPR. The ePD initially referenced the definition in the Data Protection Directive, but that was replaced by the GDPR.
      - tcldr 5y ago
        As I understand, there's currently an update to the ePD working its way through which aims to clarify some of these points and unify it with the GDPR. Here's what they say about analytics for example: > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0...
- g_p 5y ago
  What most websites don't realise is that cookies aren't only covered by GDPR, but also the ePrivacy directive (or more specifically its national implementation, since it is a directive). The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc. The combination of GDPR and ePD means that your ePD cookie consent must meet GDPR standard levels of consent, which require clear, unambiguous opt-in, informed consent. And that rules out many dark patterns we see everywhere. The German "Planet 49" ruling confirms that consent is required for cookies. Therefore every time I see "legitimate interest" on a cookie banner, I know it's an ill-informed attempt at a dark pattern by someone who wants a second bite at the cherry, and doesn't understand they: 1. Require consent 2. Need this consent to be actively given (opt in, not opt out). 3. Can't just ask the question again with a pre-ticked box and hide it behind a tab or fold...
  - tcldr 5y ago
    > The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc. I think this area has always been a bit murky, actually. There's currently a review of the ePD taking place to unify it with the GDPR and clarify on points such as these. This is in the working group's memo from March 2021 > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. Source: https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0... This seems a reasoned approach.
glitchcrab 5y ago
Of all the major players in this space, Trustarc are by far the worst imo. "Please wait while we save your preferences. This may take a few minutes". No it shouldn't, you're just taking punitive action because I didn't opt in to all the tracking. I guarantee that if I just accepted all cookies then the popup would disappear immediately.
- zibzab 5y ago
  Can HN readers do an analysis of trustarcs code and publish it here? Is that thing doing anything or communicating with any servers while we are waiting?
  - isbvhodnvemrwvn 5y ago
    It is, but it shouldn't have to in the first place.
- heckerhut 5y ago
  100% correct. I tested both options.
xg15 5y ago
Based on the occasional comments here, some analytics sites seem to track how many % of visitors actually accept cookies through the banners. It's not a surprising thing to do, but it pretty quickly leads to the percentage becoming yet another metric to "optimize". I think it's save to assume there is no practical way to make more visitors want to accept more cookies. That leaves only one way to optimize that metric, and that is dark patterns.
- thewebcount 5y ago
  I have to ask, do people really click on these things? I have never once clicked on a cookie banner. I mostly leave them alone neither accepting nor denying. In most cases I read the page using Reader mode, so other than seeing them flash in at the bottom for a second, I don't even see them. When a page doesn't work in Reader mode, I still ignore it and don't interact with it, even when it takes up half the page. If I'm prohibited from viewing the page without it and Reader view doesn't work, I hit the back button and leave the page. Who is clicking on these things and accepting them? Can anyone share their acceptance rate? I'm seriously curious how many people accept them and why. I've almost never had any bad consequence of ignoring them other than poor website design, which is usually a given even without them.
  - jlokier 5y ago
    On my phone I use a browser, Firefox Focus, that wipes all saved state every time it's used. That means no cookies and the banners are always there fresh. I didn't pick it specifically out of concern for tracking. I just tried it and found it nice to use, and it gives a little more peace of mind, so I made it the default So like you, I browse with the banners because they are always there anyway and there's no point clicking them. If a big one is in the way, I'm reluctant to take the easy route and pseudo-"agree" even knowing that all local state is wiped when I finish reading that page. Just because the insidious trackers might take it as pseudo-"consent" to use other tracking techniques that go beyond browser state. But who am I kidding. Such trackers are unlikely to respect the law or the stated intentions of people browsing anyway.
aspyct 5y ago
Yeah, legitimate interest toggles have become a nightmare recently. Dozens of teeny tiny switches to click, it's infuriating. Let alone the fact that "selling my data to make money" hardly qualifies ad "legitimate" in my book. Come on, that's exactly why GDPR exists in the first place! I'm hitting the back button more and more these days.

by zibzab 5y ago

deleted 5y ago

[deleted]

tcldr 5y ago

Legitimate interest is one of the six legal bases for processing personal data under the GDPR, alongside: consent, performance of a contract, a vital interest, a legal requirement, and a public interest. I don’t think we’ve seen much in the way of precedent being set here, but theoretically if you can demonstrate and document a measured approach to the way you collect and process data it should be fine. (Objection not withstanding.) On the other hand, a drag net approach to collecting and sharing data won’t stand up to legitimate interest claims no matter how many toggles you put on your cookie banners.

zibzab 5y ago
My personal take is that there is no real legitimate interest here and these companies are just testing to see how far they can push this.
xg15 5y ago
In the dialogs I have seen so far, the "legitimate interest" page was always a perfect carbon-copy of the "consent" page - with the only difference that the "consent" options were off by default while the "legimate interest" options were on by default. I understand that, legally, the buttons represent different actions (not giving consent vs objecting a legitimate interest claim) but practically, the only purpose the "legitimate interest" page seems to serve is as a way to have on-by-default options that are still borderline legal. I can't imagine this is in the spirit of the law.
- pieno 5y ago
  I think a lot of sites are conflating cookie consent and GDPR consent. You only need GDPR consent when processing personal data, so you don’t need consent just for storing settings in a cookie (as long as those settings do not contain personal data or identifiers linked to personal data). But many sites will ask “GDPR consent” or claim “GDPR legitimate interest” for those settings cookies in any case (in my view that’s a dark pattern in itself because you’re actually making the side harder or impossible to use and thereby inducing visitors to just click the big green “accept all” button to get it over with already…)
  - M2Ys4U 5y ago
    >I think a lot of sites are conflating cookie consent and GDPR consent. They are doing that, however the the legal standard of consent under the ePrivacy Directive is the same as the GDPR. The ePD initially referenced the definition in the Data Protection Directive, but that was replaced by the GDPR.
    - tcldr 5y ago
      As I understand, there's currently an update to the ePD working its way through which aims to clarify some of these points and unify it with the GDPR. Here's what they say about analytics for example: > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0...
g_p 5y ago
What most websites don't realise is that cookies aren't only covered by GDPR, but also the ePrivacy directive (or more specifically its national implementation, since it is a directive). The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc. The combination of GDPR and ePD means that your ePD cookie consent must meet GDPR standard levels of consent, which require clear, unambiguous opt-in, informed consent. And that rules out many dark patterns we see everywhere. The German "Planet 49" ruling confirms that consent is required for cookies. Therefore every time I see "legitimate interest" on a cookie banner, I know it's an ill-informed attempt at a dark pattern by someone who wants a second bite at the cherry, and doesn't understand they: 1. Require consent 2. Need this consent to be actively given (opt in, not opt out). 3. Can't just ask the question again with a pre-ticked box and hide it behind a tab or fold...
- tcldr 5y ago
  > The ePD says consent is the only legal basis permitted for placing non essential cookies. Essential has a very narrow meaning that effectively covers a shopping basket or login cookie for features you elect to use. It doesn't cover analytics etc. No presumed consent, no opt-out, etc. I think this area has always been a bit murky, actually. There's currently a review of the ePD taking place to unify it with the GDPR and clarify on points such as these. This is in the working group's memo from March 2021 > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. Source: https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0... This seems a reasoned approach.

glitchcrab 5y ago

Of all the major players in this space, Trustarc are by far the worst imo. "Please wait while we save your preferences. This may take a few minutes". No it shouldn't, you're just taking punitive action because I didn't opt in to all the tracking. I guarantee that if I just accepted all cookies then the popup would disappear immediately.

zibzab 5y ago
Can HN readers do an analysis of trustarcs code and publish it here? Is that thing doing anything or communicating with any servers while we are waiting?
- isbvhodnvemrwvn 5y ago
  It is, but it shouldn't have to in the first place.
heckerhut 5y ago
100% correct. I tested both options.

xg15 5y ago

Based on the occasional comments here, some analytics sites seem to track how many % of visitors actually accept cookies through the banners. It's not a surprising thing to do, but it pretty quickly leads to the percentage becoming yet another metric to "optimize". I think it's save to assume there is no practical way to make more visitors want to accept more cookies. That leaves only one way to optimize that metric, and that is dark patterns.

thewebcount 5y ago
I have to ask, do people really click on these things? I have never once clicked on a cookie banner. I mostly leave them alone neither accepting nor denying. In most cases I read the page using Reader mode, so other than seeing them flash in at the bottom for a second, I don't even see them. When a page doesn't work in Reader mode, I still ignore it and don't interact with it, even when it takes up half the page. If I'm prohibited from viewing the page without it and Reader view doesn't work, I hit the back button and leave the page. Who is clicking on these things and accepting them? Can anyone share their acceptance rate? I'm seriously curious how many people accept them and why. I've almost never had any bad consequence of ignoring them other than poor website design, which is usually a given even without them.
- jlokier 5y ago
  On my phone I use a browser, Firefox Focus, that wipes all saved state every time it's used. That means no cookies and the banners are always there fresh. I didn't pick it specifically out of concern for tracking. I just tried it and found it nice to use, and it gives a little more peace of mind, so I made it the default So like you, I browse with the banners because they are always there anyway and there's no point clicking them. If a big one is in the way, I'm reluctant to take the easy route and pseudo-"agree" even knowing that all local state is wiped when I finish reading that page. Just because the insidious trackers might take it as pseudo-"consent" to use other tracking techniques that go beyond browser state. But who am I kidding. Such trackers are unlikely to respect the law or the stated intentions of people browsing anyway.

aspyct 5y ago

Yeah, legitimate interest toggles have become a nightmare recently. Dozens of teeny tiny switches to click, it's infuriating. Let alone the fact that "selling my data to make money" hardly qualifies ad "legitimate" in my book. Come on, that's exactly why GDPR exists in the first place! I'm hitting the back button more and more these days.