19 ms·

IAB Europe cookie consent pop-ups to be found in breach of GDPR

269 points by youngtaff 5y ago

ThePhysicist 5y ago
In 2018 I built a privacy-friendly open-source consent manager (https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro) which is used on many websites across Europe. From the beginning I never liked the IAB, didn't implement it and told people that I regard it as unlawful since e.g. a user cannot possibly make an informed decision that involves thousands of third-parties. Still many of our users kept asking me about it since it was "the way" to become compliant. So I finally asked the IAB how one could potentially implement their framework as an open-source framework. Their answer was basically that it's not possible. You have to register as a CMP provider and ensure that your users are using your software in their compliant (ha ha) way, which is of course impossible to enforce with an open-source software that everyone can self-host. In general, in my opinion the IAB is mostly a framework to shift liability from the advertisers who steal the users' data to the publishers and CMP providers. Therefore I'm quite happy we never got around to implement this "feature" in our CMP, and I hope the IAB will quickly die and takes all those alibi CMP providers down with them.
- Nextgrid 5y ago
  I like that your solution actually handles loading the third-party libraries and only does so after consent has been given, so that if a user opts out absolutely no data (not even a DNS lookup) is sent to the third-party. A lot of consent management solutions appear to load the third-party scripts regardless and only focus on cookies, even though the real danger is IP-based tracking and browser fingerprinting which doesn't depend on cookies or any persistent data being stored (they've adapted as modern browsers heavily restrict cookies).
- sdoering 5y ago
  I am a user of klaro.js and just wanted to express my thanks for the work you do. One question, that arose though is how one would fulfill the requirements of GDPR regarding the logging of consent as a kind of 'paper trail'. As I understand the requirements one would need to store some Form of identification (like an arbitrary ID, the time and scope of consent and also store this for the user or on their machine). I understand how this could work for email opt ins. But consent on a web page? I always wonder.
  - ThePhysicist 5y ago
    Thanks! So documenting consent can happen directly in the users' browser, this is also GDPR & ePrivacy compliant. Those legislations don't require server-side storage of consents, it's another myth propagated by CMP providers to sell subscriptions. Storing consent server-side only makes sense for identified users (e.g. those that are logged in on your site) as there you actually have something that you can link the consent to. For an anonymous user that e.g. has a Google Analytics ID stored in the browser you'd have to store a link to that ID on the server-side as well in order to link it to the consent, and that is not privacy-friendly. Storing IP addresses also isn't a good idea as you're again creating more privacy risks for the user than necessary.
    - whoknowswhat11 5y ago
      Is this really the case. The key is that the data controller be able to demonstrate AND RECORD that consent was received. If I clear my cookies, how does data controller prove consent? “keep a record of consent statements received, so [the controller] can show how consent was obtained, when consent was obtained and the information provided to the data subject at the time ... [and] also be able to show that the data subject was informed and the controller’s workflow met all relevant criteria for a valid consent.” With that guidance in mind, and from a practical standpoint, consider keeping records of the following: The name or other identifier of the data subject that consented; The dated document, a timestamp, or note of when an oral consent was made; The version of the consent request and privacy policy existing at the time of the consent; and, The document or data capture form by which the data subject submitted his or her data." Just seems like some huge liability here if you didn't record the required elements in a manner that allowed you to produce them. Does GDPR allow me to requisition my users devices if I'm investigated? Of course, we are told GDPR is "easy".
      - throwaway14356 5y ago
        but it is. either stay under the radar or just stop gathering data that you dont need.
      - 5y ago
- em-bee 5y ago
  could you point to an example of your actual consent form? i could not find any.
  - ThePhysicist 5y ago
    You can just follow the link to our website (https://heyklaro.com https://heyklaro.com), we use the CMP there as well.
    - lrem 5y ago
      This looks _really_ good.
    - enlyth 5y ago
      Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey It's still preying on the psychology of users that have been taught for years that green = good, accept, happy path, things will work If you look at something like Apple's consent which as "Ask app not to track" and "Allow tracking" (can't remember exact phrasing), the binary choice is presented in a fair and equal way which makes you actually think about what you're pressing, because there's no clear "right" choice they want to you to press unconsciously Edit: I understand though, you have a paid product, you boast about your acceptance rates as part of your marketing strategy, and no company is going to pay for something that decreases their ability to track users. I've been in the same position as a developer where I'm asked to implement the maximum amount of obtrusiveness to coerce people to accept tracking, like overlays with the famous 'body { overflow: hidden }', because our marketing departments start to go ballistic when they can't track every single users every move. It just makes me sad sometimes that this is what we're dedicating our time to.
      - spurgu 5y ago
        > Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey Since all the other consent forms are like this it makes sense to not change the established standard. I would for sure misclick, since I've by now gotten this dark pattern ingrained (I automatically go for the grey button).
- jacquesm 5y ago
  The IAB is the fox guarding the henhouse. It always was a paper thin figleaf and you're a hero for doing your part to expose that.
- tomjen3 5y ago
  As an EU citizen, what is the point of the consent forms? Are there really that many people who click accept?
  - Macha 5y ago
    Yes, years of computer use have conditioned users to just click the box to make the dialog go away. Add to that the minimising language and "make our products better" language the form's presentation is couched in and the dark patterns to make opting out hard, I think most users accept.
  - frankzander 5y ago
    Yeah ... dark patterns - its always blue what you should click
  - lrem 5y ago
    Apart from everyone being trained to accept everything, some people genuinely enjoy the "share this" buttons and so on.
  - dmitriid 5y ago
    When presented in a clear manner with Accept/Decline, the absolute vast majority of users will click decline. So the leeches at IAB, OneTrust and everyone else employ a variety of dark patterns to make the user just click "Accept".
- stavros 5y ago
  Ugh, finally a consent manager with an "I decline" button. I can't believe how rare they are.
- djbusby 5y ago
  Your site "you currently cannot scan arbitrary URLs." So, how can we use the scanner?
panic 5y ago
The site appears to be down for me right now. Here's the post from IAB Europe: https://iabeurope.eu/all-news/update-on-the-belgian-data-protection-authoritys-investigation-of-iab-europe/ https://iabeurope.eu/all-news/update-on-the-belgian-data-pro... And another article on the topic: https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach-belgium/ https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...
- tlamponi 5y ago
  FWIW, here's an archive link for the original url: http://archive.is/lazAg http://archive.is/lazAg
- dang 5y ago
  Ok, we've changed to the latter from https://www.iccl.ie/news/online-consent-pop-ups-used-by-google-and-other-tech-firms-declared-illegal/ https://www.iccl.ie/news/online-consent-pop-ups-used-by-goog..., which is currently down. Thanks!
- therealmarv 5y ago
  lol'ed at TechCrunch... first I have to accept all to read the article...
mpweiher 5y ago
This is fantastic news! In my layperson's knowledge of GDPR, these awful consent popups always seemed completely illegal: 1. They prevent access without a lengthy/arduous process. Certainly in violation of the spirit of the legislation and almost certainly also the letter. 2. This was of course entirely intentional, in order to annoy users into clicking yes and laying blame on the GDPR "The GDPR made us annoy you". It doesn't. 3. They often do not allow a single click deny, you have to go through sometimes dozens of vendors and deny them one-by-one. This is so obviously illegal it isn't even funny. 4. What's worse, if they do have a "Deny all" button, it's almost certainly there to trick you. Because they have essentially the same list of trackers duplicated under the "legitimate interest" category. Which "Deny all" won't catch. You have to "object" to the legitimate interest. So if you hit "Deny all", you will instead be tracked by all. This is so brazen it's almost breathtaking. Anyway, good to see progress on this front. The ad-industry is still in deep denial about GDPR, thinking that they can continue their business model in the face of it. They can't. Their business model is illegal, and has been since GDPR came into force. The conflict has been brewing for some time now, weaving its way up through the channels. Exciting times.
- whoknowswhat11 5y ago
  [flagged]
  - emn13 5y ago
    There are multiple ways to satisfy the requirements, but that's hardly Kafkaesque. It's simply convenient for the ad business to pretend the rules are incomprehensible, because they'd really rather not understand them. I'm sure there are real problems with the GDPR (e.g. perhaps how and particularly where it's enforced, and how it favors large business over small, and that there aren't enough practical exemptions for small-scale data collection), but the fact that there's no reasonable and clearly legal loophole for the ads/tracker-business isn't one of them. That's not Kafkaesque, that's by design.
  - akvadrako 5y ago
    That GDPR popup seems fine. It's allowed to require some cookies. It would only be a problem if they tracked you before you clicked "Accept All".
whoknowswhat11 5y ago
Good lord. Now the consent pop-ups are a violation. Are we going to have pop-ups for the pop-ups next in Europe? Kind of funny.
- brtkdotse 5y ago
  Or you could, you know, not track your users.
  - whoknowswhat11 5y ago
    Even the EU's own website using cookies. https://europa.eu/european-union/index_en https://europa.eu/european-union/index_en Most users don't care about a session cookie or whatever. In fact for some sites / SPAs etc where users are behind NATs are CGNATs they are pretty needed / useful. Or if the website is being hosted behind a load balancer, you can do a sticky session with the cookie, and many more uses.
    - stan_rogers 5y ago
      Session cookies (and other cookie types that are actually necessary for proper site functioning) do not require, and never have required, consent. It's all of the other crap that does.
      - whoknowswhat11 5y ago
        Do you understand that even if you don't click accept, if you browse the EU's own websites, they track you? https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en The anti-google / pro-gdpr stuff is almost religious orthodoxy now in terms of its unwillingness to evaluate facts.
        Nicksil 5y ago
        >Do you understand that even if you don't click accept, if you browse the EU's own websites, they track you? >https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en >The anti-google / pro-gdpr stuff is almost religious orthodoxy now in terms of its unwillingness to evaluate facts. No, you can set your browser's do not track preference and this website will honor it (among the vanishingly few who do).
Nextgrid 5y ago
The fact that it took so long clearly demonstrates the incompetence (or potential conflicts of interest?) of the regulators, but better late than never. I guess they could no longer maintain their charade for any longer under the pressure of various pro-privacy organizations. Note that even then this seems to be just a ruling and actual consequences are still dependent on individual regulators. Given their prior lack of action it will presumably take years before we see any fines resulting from this.
jeffbee 5y ago
Are there privacy organizations that can stop themselves from putting out unhinged, frothing-at-the-mouth press releases like these? I'd like to be aligned with some privacy interests but I absolutely no intention of associating with anyone who would write this.
- whoknowswhat11 5y ago
  Right - agreed - (you'll get downvoted here though - HN moving towards the reddit orthodoxy model vs the discussion model). Its super off-putting What about letting users control cookies browser side? No permission needed and total control.
  - Nicksil 5y ago
    >Right - agreed - (you'll get downvoted here though - HN moving towards the reddit orthodoxy model vs the discussion model). >Its super off-putting Nothing about any of your comments on this topic has demonstrated you're the least bit interested in having a discussion.
    - whoknowswhat11 5y ago
      Nothing has made it seem like anyone actually looks at any of this themselves. I've been following this a while now. Open a new incognitio window and go here: https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en Do not click accept on anything. Check your cookies. Tracking cookies have been set before consent. Many on HN are ranting about how something like this is illegal or that the GDPR is easy. The answer is that the GDPR is NOT easy. That some would say that setting tracking cookies on landing without consent is not legal, others that it is, and the EU is all over on enforcement. If you browse an EU website, they track you without any explicit consent. I prefer this approach personally, all their websites used to have a modal pop-up, you could not move forward until you consented. Between phone, desktop etc etc, SO annoying. I'm sure it turned a lot of folks off GDPR, so they cheat with this to try and avoid annoying people (as many others do).
aboringusername 5y ago
It deeply saddens me that for all of the greatness humanity is capable of we're still dealing with pop-ups and "cookies" when the solution is obvious and should have been in place years ago (and the current situation has ruined the modern web because "senator we sell ads") All you need is to build this in to devices sold in EU - iOS, Android, Windows...Each give you privacy controls at the OS layer that applications must respect, on the browser level, this may be a "reject tracking and cookies". Boom. Done. All EU websites will be required to check for this API and their JS code must be plain to see for any visitor using the "view source" option. Going forward, we can build privacy controls at the technical layer, so regardless of the'stack'/'layer' software and hardware is built with GDPR in mind. We are still a long, long way away from that reality and truthfully, we will likely not be there for many decades. Sadly, it seems this "cookie" debacle is one that is more society based than technical, and it's obvious cookies should probably be replaced by now with better solutions. Maybe the GDPR might finally yield some positive changes but I remain doubtful. The industries it wants to disrupt have powerful lobbyists (hence why most right to repair legislation doesn't dare challenge Apple, for example).
- tomjen3 5y ago
  We already have that: Browsers should be required to ask for permission to set cookies and websites should respect that. If you do that today, you will never get past the GDPR popups.
- Nextgrid 5y ago
  I guess the misconception about GDPR and cookies is still around. Presumably it's due to the earlier ePrivacy Directive (aka "cookie law") which I agree is completely stupid, but GDPR covers more than just cookies. The GDPR mandates that data subjects provide informed consent before you are able to collect and/or process their personal data for non-essential purposes (ads & analytics don't count). The technical means you use doesn't matter. It can be cookies, but it can also be browser fingerprinting or IP addresses (which you can't deny as the remote server needs to know your IP to communicate with you), or it can even be information you manually enter (such as name & address for payment processing). A purely technical solution will only cover the black & white case of "provide the data or not", it will not cover more nuanced cases where you need to provide the data for essential purposes (the IP so you can load the website, personal details for payment processing) but do not wish this same data to be used for other, non-essential purposes. A legal solution here is needed and that's what the GDPR is about.
ushakov 5y ago
The most ridiculous are those “legitimate interest” checkboxes, which you have to uncheck manually one by one https://imgur.com/a/LIPUfCQ https://imgur.com/a/LIPUfCQ
- therealmarv 5y ago
  exactly... they should be opt-in and not opt-out
  - ushakov 5y ago
    they also should not lie about “legitimacy”
    - MaxBarraclough 5y ago
      It's against the law to do so, [0] but the law is almost never enforced. [0] https://news.ycombinator.com/item?id=27060609 https://news.ycombinator.com/item?id=27060609
  - desas 5y ago
    If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.
    - jacquesm 5y ago
      They're not.
      - thecopy 5y ago
        They are (according to GDPR.)
      - bulatb 5y ago
        The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f). Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis. No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ === Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.
deleted 5y ago
[deleted]
JCWasmx86 5y ago
Fantastic news! Sadly the majority of cookie "consent" banners is still in breach of GDPR.
thegrimmest 5y ago
Am I the only one who thinks this is all a bit mental? Say you have a (real, physical) business. And say you have some customers who are regulars. You can use your eyes to see what your customers frequently buy/engage with and your brain to remember. You can also use a notepad to write things down. This is commonplace - "The usual today John?". Now say John travels to another town, and the proprietor of a similar establishment in that town, wanting to provide John with the best level of service, calls you to ask "Hey, what does John like?", and you tell them. Now we just supplement your eyes and notepad with technology, and replace phone calls with packet exchanges. What has changed exactly? Don't you have a right to record who transacts with you? Isn't that information yours, to do with as you please? Can "John" command us to forget we ever saw him? Where in this sequence are anyone's rights violated? How is any of this reasonable?
- leephillips 5y ago
  No, you don’t have that right. If I buy toe fungus cream at your store you absolutely may not tell other shopkeepers about that. I can’t even get my head around a mentality that considers this behavior to be moral or even normal.
  - thegrimmest 5y ago
    > If I buy toe fungus cream at your store you absolutely may not tell other shopkeepers about that Why exactly? Which laws would I be violating if I did?
    - Nextgrid 5y ago
      Well now you'd be violating the GDPR. Before we didn't have these laws because this wasn't a problem in practice - nobody was calling other businesses at scale to tell them who was buying fungus cream. If they were, we would've had a law equivalent to the GDPR to prevent that. Actually, there was one incident in the US where a politician's video rental history was disclosed against his wishes and as a result a law was drafted to prevent this practice in the future: https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act
whalesalad 5y ago
Aliens on other planets are observing the way we're bikeshedding cookie popups and laughing, then crying for us.
- Nextgrid 5y ago
  Aliens (and any other sentient species intelligent enough) would cringe at how our species is expending insane resources to essentially waste our peers' time (by showing them ads) and trick them into buying things they don't actually need all while destroying our planet.
- tgv 5y ago
  What a weird way of callinga your opinion superior.
tgsovlerkhgsel 5y ago
I really hope they actually issue a hefty fine here, instead of just a "now stop doing that". Not issuing a fine would send a signal that simply ignoring the law until you're told to follow it pays off, since the companies involved certainly made much more profit in that time than they would have made had they followed the law. Also, the fines should be issued to everyone involved in this mess - middlemen and library providers like IAB, the ad companies actually collecting the data, and most importantly the publishers that sent their visitor's data to them.
- justapassenger 5y ago
  > Not issuing a fine would send a signal that simply ignoring the law until you're told to follow it pays off That’s how capitalism works. For better or worse. If as a person you break the law, you are prosecuted and punished, without consideration who you are and what you contribute to the society. It's very easy to be erased from society (lifetime sentence) and/or lose lifetime earnings (via huge fines, compared to your income potential). For corporations it's totally different. Consideration of who they are is a huge part of punishment. Countries don’t want to kill/severely injure companies, especially big ones, as they worry about fallout effects to their whole economy. As a corporation you can commit much much bigger crimes and get and equivalent of a parking ticket in terms of impact.
JackWritesCode 5y ago
And if you’re serving those pop-ups from US-controlled servers (even if they’re in the EU), you’re violating the Schrems II ruling.
friendzis 5y ago
As has been said since first days of GDPR. GDPR requires explicit consent and childish excuses like "your continued use implies ..." not only does not count, but does not exist as a concept.
gandalfian 5y ago
"The Interactive Advertising Bureau (IAB) is an advertising business organization that develops industry standards, conducts research, and provides legal support for the online advertising industry. The organization represents many of the most prominent media outlets globally, but mostly in the United States, Canada and Europe." From Wikipedia https://en.m.wikipedia.org/wiki/Interactive_Advertising_Bureau https://en.m.wikipedia.org/wiki/Interactive_Advertising_Bure...
- Nicksil 5y ago
  https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau
  - bmn__ 5y ago
    https://addons.mozilla.org/firefox/addon/no-more-mobile/ https://addons.mozilla.org/firefox/addon/no-more-mobile/
deleted 5y ago
[deleted]
Fnoord 5y ago
Not sure it applies to this one but I regularly notice is dark patterns and default options which are opt-out (it has to be fully opt-in, even with defaults). Of course that is in breach of GDPR.
indymike 5y ago
Next headline: the web, email and computers in general declared in breach of GDPR.
leephillips 5y ago
Whatever the GDPR was supposed to accomplish, wouldn’t it have been better to simply criminalize whatever the law imagines people should have to give “consent” to?
mcguire 5y ago
Note for those of us who were confused: IAB Europe is some kind of advertising/marketing thing. No relation to the Internet Architecture Board.
m0zg 5y ago
One thing GDPR v2 should mandate: these popups MUST have a prominent button to only enable the "necessary" cookies. Better yet, create a site which would state my preference globally and which they'd have to obey. Without this, companies outdo themselves with deceptive design to make you enable more cookies than you'd like, and it's fucking annoying.
- aembleton 5y ago
  We could bring back DNT header for another go. With some legislation and fines, it could be made useful by requiring it to be respected.

269 points by youngtaff 5y ago

In 2018 I built a privacy-friendly open-source consent manager (https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro) which is used on many websites across Europe. From the beginning I never liked the IAB, didn't implement it and told people that I regard it as unlawful since e.g. a user cannot possibly make an informed decision that involves thousands of third-parties. Still many of our users kept asking me about it since it was "the way" to become compliant. So I finally asked the IAB how one could potentially implement their framework as an open-source framework. Their answer was basically that it's not possible. You have to register as a CMP provider and ensure that your users are using your software in their compliant (ha ha) way, which is of course impossible to enforce with an open-source software that everyone can self-host. In general, in my opinion the IAB is mostly a framework to shift liability from the advertisers who steal the users' data to the publishers and CMP providers. Therefore I'm quite happy we never got around to implement this "feature" in our CMP, and I hope the IAB will quickly die and takes all those alibi CMP providers down with them.

Nextgrid 5y ago
I like that your solution actually handles loading the third-party libraries and only does so after consent has been given, so that if a user opts out absolutely no data (not even a DNS lookup) is sent to the third-party. A lot of consent management solutions appear to load the third-party scripts regardless and only focus on cookies, even though the real danger is IP-based tracking and browser fingerprinting which doesn't depend on cookies or any persistent data being stored (they've adapted as modern browsers heavily restrict cookies).
sdoering 5y ago
I am a user of klaro.js and just wanted to express my thanks for the work you do. One question, that arose though is how one would fulfill the requirements of GDPR regarding the logging of consent as a kind of 'paper trail'. As I understand the requirements one would need to store some Form of identification (like an arbitrary ID, the time and scope of consent and also store this for the user or on their machine). I understand how this could work for email opt ins. But consent on a web page? I always wonder.
- ThePhysicist 5y ago
  Thanks! So documenting consent can happen directly in the users' browser, this is also GDPR & ePrivacy compliant. Those legislations don't require server-side storage of consents, it's another myth propagated by CMP providers to sell subscriptions. Storing consent server-side only makes sense for identified users (e.g. those that are logged in on your site) as there you actually have something that you can link the consent to. For an anonymous user that e.g. has a Google Analytics ID stored in the browser you'd have to store a link to that ID on the server-side as well in order to link it to the consent, and that is not privacy-friendly. Storing IP addresses also isn't a good idea as you're again creating more privacy risks for the user than necessary.
  - whoknowswhat11 5y ago
    Is this really the case. The key is that the data controller be able to demonstrate AND RECORD that consent was received. If I clear my cookies, how does data controller prove consent? “keep a record of consent statements received, so [the controller] can show how consent was obtained, when consent was obtained and the information provided to the data subject at the time ... [and] also be able to show that the data subject was informed and the controller’s workflow met all relevant criteria for a valid consent.” With that guidance in mind, and from a practical standpoint, consider keeping records of the following: The name or other identifier of the data subject that consented; The dated document, a timestamp, or note of when an oral consent was made; The version of the consent request and privacy policy existing at the time of the consent; and, The document or data capture form by which the data subject submitted his or her data." Just seems like some huge liability here if you didn't record the required elements in a manner that allowed you to produce them. Does GDPR allow me to requisition my users devices if I'm investigated? Of course, we are told GDPR is "easy".
    - throwaway14356 5y ago
      but it is. either stay under the radar or just stop gathering data that you dont need.
    - 5y ago
em-bee 5y ago
could you point to an example of your actual consent form? i could not find any.
- ThePhysicist 5y ago
  You can just follow the link to our website (https://heyklaro.com https://heyklaro.com), we use the CMP there as well.
  - lrem 5y ago
    This looks _really_ good.
  - enlyth 5y ago
    Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey It's still preying on the psychology of users that have been taught for years that green = good, accept, happy path, things will work If you look at something like Apple's consent which as "Ask app not to track" and "Allow tracking" (can't remember exact phrasing), the binary choice is presented in a fair and equal way which makes you actually think about what you're pressing, because there's no clear "right" choice they want to you to press unconsciously Edit: I understand though, you have a paid product, you boast about your acceptance rates as part of your marketing strategy, and no company is going to pay for something that decreases their ability to track users. I've been in the same position as a developer where I'm asked to implement the maximum amount of obtrusiveness to coerce people to accept tracking, like overlays with the famous 'body { overflow: hidden }', because our marketing departments start to go ballistic when they can't track every single users every move. It just makes me sad sometimes that this is what we're dedicating our time to.
    - spurgu 5y ago
      > Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey Since all the other consent forms are like this it makes sense to not change the established standard. I would for sure misclick, since I've by now gotten this dark pattern ingrained (I automatically go for the grey button).
jacquesm 5y ago
The IAB is the fox guarding the henhouse. It always was a paper thin figleaf and you're a hero for doing your part to expose that.
tomjen3 5y ago
As an EU citizen, what is the point of the consent forms? Are there really that many people who click accept?
- Macha 5y ago
  Yes, years of computer use have conditioned users to just click the box to make the dialog go away. Add to that the minimising language and "make our products better" language the form's presentation is couched in and the dark patterns to make opting out hard, I think most users accept.
- frankzander 5y ago
  Yeah ... dark patterns - its always blue what you should click
- lrem 5y ago
  Apart from everyone being trained to accept everything, some people genuinely enjoy the "share this" buttons and so on.
- dmitriid 5y ago
  When presented in a clear manner with Accept/Decline, the absolute vast majority of users will click decline. So the leeches at IAB, OneTrust and everyone else employ a variety of dark patterns to make the user just click "Accept".
stavros 5y ago
Ugh, finally a consent manager with an "I decline" button. I can't believe how rare they are.
djbusby 5y ago
Your site "you currently cannot scan arbitrary URLs." So, how can we use the scanner?

panic 5y ago

The site appears to be down for me right now. Here's the post from IAB Europe: https://iabeurope.eu/all-news/update-on-the-belgian-data-protection-authoritys-investigation-of-iab-europe/ https://iabeurope.eu/all-news/update-on-the-belgian-data-pro... And another article on the topic: https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach-belgium/ https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...

tlamponi 5y ago
FWIW, here's an archive link for the original url: http://archive.is/lazAg http://archive.is/lazAg
dang 5y ago
Ok, we've changed to the latter from https://www.iccl.ie/news/online-consent-pop-ups-used-by-google-and-other-tech-firms-declared-illegal/ https://www.iccl.ie/news/online-consent-pop-ups-used-by-goog..., which is currently down. Thanks!
therealmarv 5y ago
lol'ed at TechCrunch... first I have to accept all to read the article...

mpweiher 5y ago

This is fantastic news! In my layperson's knowledge of GDPR, these awful consent popups always seemed completely illegal: 1. They prevent access without a lengthy/arduous process. Certainly in violation of the spirit of the legislation and almost certainly also the letter. 2. This was of course entirely intentional, in order to annoy users into clicking yes and laying blame on the GDPR "The GDPR made us annoy you". It doesn't. 3. They often do not allow a single click deny, you have to go through sometimes dozens of vendors and deny them one-by-one. This is so obviously illegal it isn't even funny. 4. What's worse, if they do have a "Deny all" button, it's almost certainly there to trick you. Because they have essentially the same list of trackers duplicated under the "legitimate interest" category. Which "Deny all" won't catch. You have to "object" to the legitimate interest. So if you hit "Deny all", you will instead be tracked by all. This is so brazen it's almost breathtaking. Anyway, good to see progress on this front. The ad-industry is still in deep denial about GDPR, thinking that they can continue their business model in the face of it. They can't. Their business model is illegal, and has been since GDPR came into force. The conflict has been brewing for some time now, weaving its way up through the channels. Exciting times.

whoknowswhat11 5y ago
[flagged]
- emn13 5y ago
  There are multiple ways to satisfy the requirements, but that's hardly Kafkaesque. It's simply convenient for the ad business to pretend the rules are incomprehensible, because they'd really rather not understand them. I'm sure there are real problems with the GDPR (e.g. perhaps how and particularly where it's enforced, and how it favors large business over small, and that there aren't enough practical exemptions for small-scale data collection), but the fact that there's no reasonable and clearly legal loophole for the ads/tracker-business isn't one of them. That's not Kafkaesque, that's by design.
- akvadrako 5y ago
  That GDPR popup seems fine. It's allowed to require some cookies. It would only be a problem if they tracked you before you clicked "Accept All".

whoknowswhat11 5y ago

Good lord. Now the consent pop-ups are a violation. Are we going to have pop-ups for the pop-ups next in Europe? Kind of funny.

brtkdotse 5y ago
Or you could, you know, not track your users.
- whoknowswhat11 5y ago
  Even the EU's own website using cookies. https://europa.eu/european-union/index_en https://europa.eu/european-union/index_en Most users don't care about a session cookie or whatever. In fact for some sites / SPAs etc where users are behind NATs are CGNATs they are pretty needed / useful. Or if the website is being hosted behind a load balancer, you can do a sticky session with the cookie, and many more uses.
  - stan_rogers 5y ago
    Session cookies (and other cookie types that are actually necessary for proper site functioning) do not require, and never have required, consent. It's all of the other crap that does.
    - whoknowswhat11 5y ago
      Do you understand that even if you don't click accept, if you browse the EU's own websites, they track you? https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en The anti-google / pro-gdpr stuff is almost religious orthodoxy now in terms of its unwillingness to evaluate facts.
      - Nicksil 5y ago
        >Do you understand that even if you don't click accept, if you browse the EU's own websites, they track you? >https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en >The anti-google / pro-gdpr stuff is almost religious orthodoxy now in terms of its unwillingness to evaluate facts. No, you can set your browser's do not track preference and this website will honor it (among the vanishingly few who do).

Nextgrid 5y ago

The fact that it took so long clearly demonstrates the incompetence (or potential conflicts of interest?) of the regulators, but better late than never. I guess they could no longer maintain their charade for any longer under the pressure of various pro-privacy organizations. Note that even then this seems to be just a ruling and actual consequences are still dependent on individual regulators. Given their prior lack of action it will presumably take years before we see any fines resulting from this.

jeffbee 5y ago

Are there privacy organizations that can stop themselves from putting out unhinged, frothing-at-the-mouth press releases like these? I'd like to be aligned with some privacy interests but I absolutely no intention of associating with anyone who would write this.

whoknowswhat11 5y ago
Right - agreed - (you'll get downvoted here though - HN moving towards the reddit orthodoxy model vs the discussion model). Its super off-putting What about letting users control cookies browser side? No permission needed and total control.
- Nicksil 5y ago
  >Right - agreed - (you'll get downvoted here though - HN moving towards the reddit orthodoxy model vs the discussion model). >Its super off-putting Nothing about any of your comments on this topic has demonstrated you're the least bit interested in having a discussion.
  - whoknowswhat11 5y ago
    Nothing has made it seem like anyone actually looks at any of this themselves. I've been following this a while now. Open a new incognitio window and go here: https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en Do not click accept on anything. Check your cookies. Tracking cookies have been set before consent. Many on HN are ranting about how something like this is illegal or that the GDPR is easy. The answer is that the GDPR is NOT easy. That some would say that setting tracking cookies on landing without consent is not legal, others that it is, and the EU is all over on enforcement. If you browse an EU website, they track you without any explicit consent. I prefer this approach personally, all their websites used to have a modal pop-up, you could not move forward until you consented. Between phone, desktop etc etc, SO annoying. I'm sure it turned a lot of folks off GDPR, so they cheat with this to try and avoid annoying people (as many others do).

aboringusername 5y ago

It deeply saddens me that for all of the greatness humanity is capable of we're still dealing with pop-ups and "cookies" when the solution is obvious and should have been in place years ago (and the current situation has ruined the modern web because "senator we sell ads") All you need is to build this in to devices sold in EU - iOS, Android, Windows...Each give you privacy controls at the OS layer that applications must respect, on the browser level, this may be a "reject tracking and cookies". Boom. Done. All EU websites will be required to check for this API and their JS code must be plain to see for any visitor using the "view source" option. Going forward, we can build privacy controls at the technical layer, so regardless of the'stack'/'layer' software and hardware is built with GDPR in mind. We are still a long, long way away from that reality and truthfully, we will likely not be there for many decades. Sadly, it seems this "cookie" debacle is one that is more society based than technical, and it's obvious cookies should probably be replaced by now with better solutions. Maybe the GDPR might finally yield some positive changes but I remain doubtful. The industries it wants to disrupt have powerful lobbyists (hence why most right to repair legislation doesn't dare challenge Apple, for example).

tomjen3 5y ago
We already have that: Browsers should be required to ask for permission to set cookies and websites should respect that. If you do that today, you will never get past the GDPR popups.
Nextgrid 5y ago
I guess the misconception about GDPR and cookies is still around. Presumably it's due to the earlier ePrivacy Directive (aka "cookie law") which I agree is completely stupid, but GDPR covers more than just cookies. The GDPR mandates that data subjects provide informed consent before you are able to collect and/or process their personal data for non-essential purposes (ads & analytics don't count). The technical means you use doesn't matter. It can be cookies, but it can also be browser fingerprinting or IP addresses (which you can't deny as the remote server needs to know your IP to communicate with you), or it can even be information you manually enter (such as name & address for payment processing). A purely technical solution will only cover the black & white case of "provide the data or not", it will not cover more nuanced cases where you need to provide the data for essential purposes (the IP so you can load the website, personal details for payment processing) but do not wish this same data to be used for other, non-essential purposes. A legal solution here is needed and that's what the GDPR is about.

ushakov 5y ago

The most ridiculous are those “legitimate interest” checkboxes, which you have to uncheck manually one by one https://imgur.com/a/LIPUfCQ https://imgur.com/a/LIPUfCQ

therealmarv 5y ago
exactly... they should be opt-in and not opt-out
- ushakov 5y ago
  they also should not lie about “legitimacy”
  - MaxBarraclough 5y ago
    It's against the law to do so, [0] but the law is almost never enforced. [0] https://news.ycombinator.com/item?id=27060609 https://news.ycombinator.com/item?id=27060609
- desas 5y ago
  If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.
  - jacquesm 5y ago
    They're not.
    - thecopy 5y ago
      They are (according to GDPR.)
    - bulatb 5y ago
      The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f). Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis. No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ === Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.

deleted 5y ago

[deleted]

JCWasmx86 5y ago

Fantastic news! Sadly the majority of cookie "consent" banners is still in breach of GDPR.

thegrimmest 5y ago

Am I the only one who thinks this is all a bit mental? Say you have a (real, physical) business. And say you have some customers who are regulars. You can use your eyes to see what your customers frequently buy/engage with and your brain to remember. You can also use a notepad to write things down. This is commonplace - "The usual today John?". Now say John travels to another town, and the proprietor of a similar establishment in that town, wanting to provide John with the best level of service, calls you to ask "Hey, what does John like?", and you tell them. Now we just supplement your eyes and notepad with technology, and replace phone calls with packet exchanges. What has changed exactly? Don't you have a right to record who transacts with you? Isn't that information yours, to do with as you please? Can "John" command us to forget we ever saw him? Where in this sequence are anyone's rights violated? How is any of this reasonable?

leephillips 5y ago
No, you don’t have that right. If I buy toe fungus cream at your store you absolutely may not tell other shopkeepers about that. I can’t even get my head around a mentality that considers this behavior to be moral or even normal.
- thegrimmest 5y ago
  > If I buy toe fungus cream at your store you absolutely may not tell other shopkeepers about that Why exactly? Which laws would I be violating if I did?
  - Nextgrid 5y ago
    Well now you'd be violating the GDPR. Before we didn't have these laws because this wasn't a problem in practice - nobody was calling other businesses at scale to tell them who was buying fungus cream. If they were, we would've had a law equivalent to the GDPR to prevent that. Actually, there was one incident in the US where a politician's video rental history was disclosed against his wishes and as a result a law was drafted to prevent this practice in the future: https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act

whalesalad 5y ago

Aliens on other planets are observing the way we're bikeshedding cookie popups and laughing, then crying for us.

Nextgrid 5y ago
Aliens (and any other sentient species intelligent enough) would cringe at how our species is expending insane resources to essentially waste our peers' time (by showing them ads) and trick them into buying things they don't actually need all while destroying our planet.
tgv 5y ago
What a weird way of callinga your opinion superior.

tgsovlerkhgsel 5y ago

I really hope they actually issue a hefty fine here, instead of just a "now stop doing that". Not issuing a fine would send a signal that simply ignoring the law until you're told to follow it pays off, since the companies involved certainly made much more profit in that time than they would have made had they followed the law. Also, the fines should be issued to everyone involved in this mess - middlemen and library providers like IAB, the ad companies actually collecting the data, and most importantly the publishers that sent their visitor's data to them.

justapassenger 5y ago
> Not issuing a fine would send a signal that simply ignoring the law until you're told to follow it pays off That’s how capitalism works. For better or worse. If as a person you break the law, you are prosecuted and punished, without consideration who you are and what you contribute to the society. It's very easy to be erased from society (lifetime sentence) and/or lose lifetime earnings (via huge fines, compared to your income potential). For corporations it's totally different. Consideration of who they are is a huge part of punishment. Countries don’t want to kill/severely injure companies, especially big ones, as they worry about fallout effects to their whole economy. As a corporation you can commit much much bigger crimes and get and equivalent of a parking ticket in terms of impact.

JackWritesCode 5y ago

And if you’re serving those pop-ups from US-controlled servers (even if they’re in the EU), you’re violating the Schrems II ruling.

friendzis 5y ago

As has been said since first days of GDPR. GDPR requires explicit consent and childish excuses like "your continued use implies ..." not only does not count, but does not exist as a concept.

gandalfian 5y ago

"The Interactive Advertising Bureau (IAB) is an advertising business organization that develops industry standards, conducts research, and provides legal support for the online advertising industry. The organization represents many of the most prominent media outlets globally, but mostly in the United States, Canada and Europe." From Wikipedia https://en.m.wikipedia.org/wiki/Interactive_Advertising_Bureau https://en.m.wikipedia.org/wiki/Interactive_Advertising_Bure...

Nicksil 5y ago
https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau
- bmn__ 5y ago
  https://addons.mozilla.org/firefox/addon/no-more-mobile/ https://addons.mozilla.org/firefox/addon/no-more-mobile/

deleted 5y ago

[deleted]

Fnoord 5y ago

Not sure it applies to this one but I regularly notice is dark patterns and default options which are opt-out (it has to be fully opt-in, even with defaults). Of course that is in breach of GDPR.

indymike 5y ago

Next headline: the web, email and computers in general declared in breach of GDPR.

leephillips 5y ago

Whatever the GDPR was supposed to accomplish, wouldn’t it have been better to simply criminalize whatever the law imagines people should have to give “consent” to?

mcguire 5y ago

Note for those of us who were confused: IAB Europe is some kind of advertising/marketing thing. No relation to the Internet Architecture Board.

m0zg 5y ago

One thing GDPR v2 should mandate: these popups MUST have a prominent button to only enable the "necessary" cookies. Better yet, create a site which would state my preference globally and which they'd have to obey. Without this, companies outdo themselves with deceptive design to make you enable more cookies than you'd like, and it's fucking annoying.

aembleton 5y ago
We could bring back DNT header for another go. With some legislation and fines, it could be made useful by requiring it to be respected.