6 ms·

In 2018 I built a privacy-friendly open-source consent manager (https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro) which is used on many web

In 2018 I built a privacy-friendly open-source consent manager (https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro) which is used on many websites across Europe. From the beginning I never liked the IAB, didn't implement it and told people that I regard it as unlawful since e.g. a user cannot possibly make an informed decision that involves thousands of third-parties. Still many of our users kept asking me about it since it was "the way" to become compliant. So I finally asked the IAB how one could potentially implement their framework as an open-source framework. Their answer was basically that it's not possible. You have to register as a CMP provider and ensure that your users are using your software in their compliant (ha ha) way, which is of course impossible to enforce with an open-source software that everyone can self-host. In general, in my opinion the IAB is mostly a framework to shift liability from the advertisers who steal the users' data to the publishers and CMP providers. Therefore I'm quite happy we never got around to implement this "feature" in our CMP, and I hope the IAB will quickly die and takes all those alibi CMP providers down with them.

Nextgrid 5y ago
I like that your solution actually handles loading the third-party libraries and only does so after consent has been given, so that if a user opts out absolutely no data (not even a DNS lookup) is sent to the third-party. A lot of consent management solutions appear to load the third-party scripts regardless and only focus on cookies, even though the real danger is IP-based tracking and browser fingerprinting which doesn't depend on cookies or any persistent data being stored (they've adapted as modern browsers heavily restrict cookies).
sdoering 5y ago
I am a user of klaro.js and just wanted to express my thanks for the work you do. One question, that arose though is how one would fulfill the requirements of GDPR regarding the logging of consent as a kind of 'paper trail'. As I understand the requirements one would need to store some Form of identification (like an arbitrary ID, the time and scope of consent and also store this for the user or on their machine). I understand how this could work for email opt ins. But consent on a web page? I always wonder.
- ThePhysicist 5y ago
  Thanks! So documenting consent can happen directly in the users' browser, this is also GDPR & ePrivacy compliant. Those legislations don't require server-side storage of consents, it's another myth propagated by CMP providers to sell subscriptions. Storing consent server-side only makes sense for identified users (e.g. those that are logged in on your site) as there you actually have something that you can link the consent to. For an anonymous user that e.g. has a Google Analytics ID stored in the browser you'd have to store a link to that ID on the server-side as well in order to link it to the consent, and that is not privacy-friendly. Storing IP addresses also isn't a good idea as you're again creating more privacy risks for the user than necessary.
  - whoknowswhat11 5y ago
    Is this really the case. The key is that the data controller be able to demonstrate AND RECORD that consent was received. If I clear my cookies, how does data controller prove consent? “keep a record of consent statements received, so [the controller] can show how consent was obtained, when consent was obtained and the information provided to the data subject at the time ... [and] also be able to show that the data subject was informed and the controller’s workflow met all relevant criteria for a valid consent.” With that guidance in mind, and from a practical standpoint, consider keeping records of the following: The name or other identifier of the data subject that consented; The dated document, a timestamp, or note of when an oral consent was made; The version of the consent request and privacy policy existing at the time of the consent; and, The document or data capture form by which the data subject submitted his or her data." Just seems like some huge liability here if you didn't record the required elements in a manner that allowed you to produce them. Does GDPR allow me to requisition my users devices if I'm investigated? Of course, we are told GDPR is "easy".
    - throwaway14356 5y ago
      but it is. either stay under the radar or just stop gathering data that you dont need.
    - 5y ago
em-bee 5y ago
could you point to an example of your actual consent form? i could not find any.
- ThePhysicist 5y ago
  You can just follow the link to our website (https://heyklaro.com https://heyklaro.com), we use the CMP there as well.
  - lrem 5y ago
    This looks _really_ good.
  - enlyth 5y ago
    Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey It's still preying on the psychology of users that have been taught for years that green = good, accept, happy path, things will work If you look at something like Apple's consent which as "Ask app not to track" and "Allow tracking" (can't remember exact phrasing), the binary choice is presented in a fair and equal way which makes you actually think about what you're pressing, because there's no clear "right" choice they want to you to press unconsciously Edit: I understand though, you have a paid product, you boast about your acceptance rates as part of your marketing strategy, and no company is going to pay for something that decreases their ability to track users. I've been in the same position as a developer where I'm asked to implement the maximum amount of obtrusiveness to coerce people to accept tracking, like overlays with the famous 'body { overflow: hidden }', because our marketing departments start to go ballistic when they can't track every single users every move. It just makes me sad sometimes that this is what we're dedicating our time to.
    - spurgu 5y ago
      > Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey Since all the other consent forms are like this it makes sense to not change the established standard. I would for sure misclick, since I've by now gotten this dark pattern ingrained (I automatically go for the grey button).
jacquesm 5y ago
The IAB is the fox guarding the henhouse. It always was a paper thin figleaf and you're a hero for doing your part to expose that.
tomjen3 5y ago
As an EU citizen, what is the point of the consent forms? Are there really that many people who click accept?
- Macha 5y ago
  Yes, years of computer use have conditioned users to just click the box to make the dialog go away. Add to that the minimising language and "make our products better" language the form's presentation is couched in and the dark patterns to make opting out hard, I think most users accept.
- frankzander 5y ago
  Yeah ... dark patterns - its always blue what you should click
- lrem 5y ago
  Apart from everyone being trained to accept everything, some people genuinely enjoy the "share this" buttons and so on.
- dmitriid 5y ago
  When presented in a clear manner with Accept/Decline, the absolute vast majority of users will click decline. So the leeches at IAB, OneTrust and everyone else employ a variety of dark patterns to make the user just click "Accept".
stavros 5y ago
Ugh, finally a consent manager with an "I decline" button. I can't believe how rare they are.
djbusby 5y ago
Your site "you currently cannot scan arbitrary URLs." So, how can we use the scanner?

Nextgrid 5y ago

I like that your solution actually handles loading the third-party libraries and only does so after consent has been given, so that if a user opts out absolutely no data (not even a DNS lookup) is sent to the third-party. A lot of consent management solutions appear to load the third-party scripts regardless and only focus on cookies, even though the real danger is IP-based tracking and browser fingerprinting which doesn't depend on cookies or any persistent data being stored (they've adapted as modern browsers heavily restrict cookies).

sdoering 5y ago

I am a user of klaro.js and just wanted to express my thanks for the work you do. One question, that arose though is how one would fulfill the requirements of GDPR regarding the logging of consent as a kind of 'paper trail'. As I understand the requirements one would need to store some Form of identification (like an arbitrary ID, the time and scope of consent and also store this for the user or on their machine). I understand how this could work for email opt ins. But consent on a web page? I always wonder.

ThePhysicist 5y ago
Thanks! So documenting consent can happen directly in the users' browser, this is also GDPR & ePrivacy compliant. Those legislations don't require server-side storage of consents, it's another myth propagated by CMP providers to sell subscriptions. Storing consent server-side only makes sense for identified users (e.g. those that are logged in on your site) as there you actually have something that you can link the consent to. For an anonymous user that e.g. has a Google Analytics ID stored in the browser you'd have to store a link to that ID on the server-side as well in order to link it to the consent, and that is not privacy-friendly. Storing IP addresses also isn't a good idea as you're again creating more privacy risks for the user than necessary.
- whoknowswhat11 5y ago
  Is this really the case. The key is that the data controller be able to demonstrate AND RECORD that consent was received. If I clear my cookies, how does data controller prove consent? “keep a record of consent statements received, so [the controller] can show how consent was obtained, when consent was obtained and the information provided to the data subject at the time ... [and] also be able to show that the data subject was informed and the controller’s workflow met all relevant criteria for a valid consent.” With that guidance in mind, and from a practical standpoint, consider keeping records of the following: The name or other identifier of the data subject that consented; The dated document, a timestamp, or note of when an oral consent was made; The version of the consent request and privacy policy existing at the time of the consent; and, The document or data capture form by which the data subject submitted his or her data." Just seems like some huge liability here if you didn't record the required elements in a manner that allowed you to produce them. Does GDPR allow me to requisition my users devices if I'm investigated? Of course, we are told GDPR is "easy".
  - throwaway14356 5y ago
    but it is. either stay under the radar or just stop gathering data that you dont need.
  - 5y ago

em-bee 5y ago

could you point to an example of your actual consent form? i could not find any.

ThePhysicist 5y ago
You can just follow the link to our website (https://heyklaro.com https://heyklaro.com), we use the CMP there as well.
- lrem 5y ago
  This looks _really_ good.
- enlyth 5y ago
  Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey It's still preying on the psychology of users that have been taught for years that green = good, accept, happy path, things will work If you look at something like Apple's consent which as "Ask app not to track" and "Allow tracking" (can't remember exact phrasing), the binary choice is presented in a fair and equal way which makes you actually think about what you're pressing, because there's no clear "right" choice they want to you to press unconsciously Edit: I understand though, you have a paid product, you boast about your acceptance rates as part of your marketing strategy, and no company is going to pay for something that decreases their ability to track users. I've been in the same position as a developer where I'm asked to implement the maximum amount of obtrusiveness to coerce people to accept tracking, like overlays with the famous 'body { overflow: hidden }', because our marketing departments start to go ballistic when they can't track every single users every move. It just makes me sad sometimes that this is what we're dedicating our time to.
  - spurgu 5y ago
    > Looks great design wise, but I still see some dark patterns like making the accept button green, and decline grey Since all the other consent forms are like this it makes sense to not change the established standard. I would for sure misclick, since I've by now gotten this dark pattern ingrained (I automatically go for the grey button).

jacquesm 5y ago

The IAB is the fox guarding the henhouse. It always was a paper thin figleaf and you're a hero for doing your part to expose that.

tomjen3 5y ago

As an EU citizen, what is the point of the consent forms? Are there really that many people who click accept?

Macha 5y ago
Yes, years of computer use have conditioned users to just click the box to make the dialog go away. Add to that the minimising language and "make our products better" language the form's presentation is couched in and the dark patterns to make opting out hard, I think most users accept.
frankzander 5y ago
Yeah ... dark patterns - its always blue what you should click
lrem 5y ago
Apart from everyone being trained to accept everything, some people genuinely enjoy the "share this" buttons and so on.
dmitriid 5y ago
When presented in a clear manner with Accept/Decline, the absolute vast majority of users will click decline. So the leeches at IAB, OneTrust and everyone else employ a variety of dark patterns to make the user just click "Accept".

stavros 5y ago

Ugh, finally a consent manager with an "I decline" button. I can't believe how rare they are.

djbusby 5y ago

Your site "you currently cannot scan arbitrary URLs." So, how can we use the scanner?