6 ms·

This is fantastic news! In my layperson's knowledge of GDPR, these awful consent popups always seemed completely illegal: 1. They prevent access without a len

This is fantastic news! In my layperson's knowledge of GDPR, these awful consent popups always seemed completely illegal: 1. They prevent access without a lengthy/arduous process. Certainly in violation of the spirit of the legislation and almost certainly also the letter. 2. This was of course entirely intentional, in order to annoy users into clicking yes and laying blame on the GDPR "The GDPR made us annoy you". It doesn't. 3. They often do not allow a single click deny, you have to go through sometimes dozens of vendors and deny them one-by-one. This is so obviously illegal it isn't even funny. 4. What's worse, if they do have a "Deny all" button, it's almost certainly there to trick you. Because they have essentially the same list of trackers duplicated under the "legitimate interest" category. Which "Deny all" won't catch. You have to "object" to the legitimate interest. So if you hit "Deny all", you will instead be tracked by all. This is so brazen it's almost breathtaking. Anyway, good to see progress on this front. The ad-industry is still in deep denial about GDPR, thinking that they can continue their business model in the face of it. They can't. Their business model is illegal, and has been since GDPR came into force. The conflict has been brewing for some time now, weaving its way up through the channels. Exciting times.

whoknowswhat11 5y ago
[flagged]
- emn13 5y ago
  There are multiple ways to satisfy the requirements, but that's hardly Kafkaesque. It's simply convenient for the ad business to pretend the rules are incomprehensible, because they'd really rather not understand them. I'm sure there are real problems with the GDPR (e.g. perhaps how and particularly where it's enforced, and how it favors large business over small, and that there aren't enough practical exemptions for small-scale data collection), but the fact that there's no reasonable and clearly legal loophole for the ads/tracker-business isn't one of them. That's not Kafkaesque, that's by design.
- akvadrako 5y ago
  That GDPR popup seems fine. It's allowed to require some cookies. It would only be a problem if they tracked you before you clicked "Accept All".
  - whoknowswhat11 5y ago
    We are being told "They often do not allow a single click deny, you have to go through sometimes dozens of vendors and deny them one-by-one. This is so obviously illegal it isn't even funny." The site sets two cookies on landing regardless of any clicks anywhere. Edited because I can't reply: There are lots of lies being told on this discussion. The EU websites track you even if you don't hit accept. It's a 13 month cookie. Go here: https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en " When opening a page where Europa Analytics is enabled, the browsing experience is registered by the service. If you refuse cookies, you will also stop the Europa Analytics service. If you choose, though, to contribute your browsing experience on our websites as part of the anonymous statistics, you will enable us to significantly improve the performance of our communication, its outreach and its cost-efficiency."
    - akvadrako 5y ago
      Setting cookies if fine according to the GDPR. It's tracking cookies which are of relevance.
      - whoknowswhat11 5y ago
        I went to their website in incognito mode. https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en Before accepting any cookies I got a _pk_id cookie expiring in 13 months. They are clear this is what will happen. Just check it for yourself before you listen to the lies / blather you read here. The EU's own websites track you on first landing. Note - I have been following this. They used to do a blocking cookie pop-up. This actually had nothing set on pop-up, but blocked you from using their websites until you gave consent or denied it. The problem was, these required cookie popups are so annoying that many folks have (perhaps illegally) moved to the EU's new model, where they stick it at the bottom, they set the cookies, and if you just use the website you get them.
- LogonType10 5y ago
  You can't make someone understand something when their salary depends on them not understanding.
- deworms 5y ago
  The rules are actually very simple, you have to obtain a clear, explicit consent given out of a user's own free will to track him, or you're breaking the law. Don't like it? Tough luck.
  - whoknowswhat11 5y ago
    It's not that simple. If I do a blocking banner that said, we track users on this site to pay for it with ads, click OK or leave - under GDPR there are lots of gotcha's that make this potentially insufficient. I think folks claiming GDPR is "simple" do not understand it - and how complicated it is. We have this for age restricted sites already - if you are under 18 leave, if over 18 continue, content is NSFW. Reddit does the same thing for adult subreddits, you get a popup, this content may be NSFW, if you are at work and will be fire, leave, if not click through if you want - you've been warned. This model however may NOT be permitted under GDPR which has a TON more requirements on tracking consent, recordkeeping for consent, versioning of disclosures, tracking versioned disclosures to consent identifiers tied to other identifiers etc. If you violate any of this you are breaking the law, are committing crimes, and may need to pay $20M or a % of turnover whichever is GREATER!
- deleted 5y ago
  [deleted]
ethbr0 5y ago
"Do not track", set once and effective until changed, should be the legal end all, be all. I have signalled my default intent, and I have not changed it. Respect it. Of course, the ad industry is hell-bent on preventing anything convenient.
- mnw21cam 5y ago
  Yeah, I still don't quite get the argument against do not track, and why its clear declaration of intent couldn't be made binding. I mean, you're effectively telling web sites "Do not track me", and they are responding with "Hi, we'd like to track you - please spend ten minutes working through our dark patterns if you're not OK with that".
  - Nextgrid 5y ago
    They obviously wouldn't want to just comply with DNT (or any other easy way to opt-out) as they'd be signing their own death certificate. Instead they exploited the apathy & incompetence of the regulators with their so-called "consent" flow. Considering the GDPR was supposed to be enforced since 2018 and they've made it to 2021 without any consequences I'd say that strategy paid off.
  - scatters 5y ago
    Unfortunately, DNT is not a clear declaration of intent, because privacy evangelists view it as their moral duty to make that decision for everyone. It's an inconvenient fact that - perhaps a decade ago - we had DNT, and advertisers were starting to respect it, but then browser makers decided to default it to on, making it pointless.
    - gpvos 5y ago
      Yet default-on is the only reasonable default setting.
    - guitarbill 5y ago
      "Browser makers" - you mean Microsoft in IE10? Were there any other browsers that did this? And what did privacy evangelists have to do with it? I'm not sure that was the sole downfall; DNT also had no teeth because it couldn't really be enforced.
PaulKeeble 5y ago
I have also see some sites that are also using a pattern where you either accept their tracking of you or you can't use the site at all, they just block the content or send you to a useless site. That isn't legal either, consent has to be something people actively give and not giving it can't be a reason to reject service. Quite a lot of gyms are getting this wrong in regards fignerprints, they don't get to force that mechanism on you and deny you access if you wont provide it. When the legislation first came in I reported about 100 websites that were breaking the law in obvious ways, they are still like that and the ICO hasn't even responded to those complaints.
- Nextgrid 5y ago
  This has been my experience as well - the complaints take lots of time to write and manage (you have to first complain to the company and give them 30 days to respond, etc) and in the end the ICO was completely useless anyway.
dmitriid 5y ago
> This was of course entirely intentional, in order to annoy users into clicking yes and laying blame on the GDPR And this worked. Even on HN an awful lot of people blame the prevalence of cookie banners and consent forms on GDPR, and call GDPR a stupid law.

whoknowswhat11 5y ago

[flagged]

emn13 5y ago
There are multiple ways to satisfy the requirements, but that's hardly Kafkaesque. It's simply convenient for the ad business to pretend the rules are incomprehensible, because they'd really rather not understand them. I'm sure there are real problems with the GDPR (e.g. perhaps how and particularly where it's enforced, and how it favors large business over small, and that there aren't enough practical exemptions for small-scale data collection), but the fact that there's no reasonable and clearly legal loophole for the ads/tracker-business isn't one of them. That's not Kafkaesque, that's by design.
akvadrako 5y ago
That GDPR popup seems fine. It's allowed to require some cookies. It would only be a problem if they tracked you before you clicked "Accept All".
- whoknowswhat11 5y ago
  We are being told "They often do not allow a single click deny, you have to go through sometimes dozens of vendors and deny them one-by-one. This is so obviously illegal it isn't even funny." The site sets two cookies on landing regardless of any clicks anywhere. Edited because I can't reply: There are lots of lies being told on this discussion. The EU websites track you even if you don't hit accept. It's a 13 month cookie. Go here: https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en " When opening a page where Europa Analytics is enabled, the browsing experience is registered by the service. If you refuse cookies, you will also stop the Europa Analytics service. If you choose, though, to contribute your browsing experience on our websites as part of the anonymous statistics, you will enable us to significantly improve the performance of our communication, its outreach and its cost-efficiency."
  - akvadrako 5y ago
    Setting cookies if fine according to the GDPR. It's tracking cookies which are of relevance.
    - whoknowswhat11 5y ago
      I went to their website in incognito mode. https://ec.europa.eu/info/privacy-policy/europa-analytics_en https://ec.europa.eu/info/privacy-policy/europa-analytics_en Before accepting any cookies I got a _pk_id cookie expiring in 13 months. They are clear this is what will happen. Just check it for yourself before you listen to the lies / blather you read here. The EU's own websites track you on first landing. Note - I have been following this. They used to do a blocking cookie pop-up. This actually had nothing set on pop-up, but blocked you from using their websites until you gave consent or denied it. The problem was, these required cookie popups are so annoying that many folks have (perhaps illegally) moved to the EU's new model, where they stick it at the bottom, they set the cookies, and if you just use the website you get them.
LogonType10 5y ago
You can't make someone understand something when their salary depends on them not understanding.
deworms 5y ago
The rules are actually very simple, you have to obtain a clear, explicit consent given out of a user's own free will to track him, or you're breaking the law. Don't like it? Tough luck.
- whoknowswhat11 5y ago
  It's not that simple. If I do a blocking banner that said, we track users on this site to pay for it with ads, click OK or leave - under GDPR there are lots of gotcha's that make this potentially insufficient. I think folks claiming GDPR is "simple" do not understand it - and how complicated it is. We have this for age restricted sites already - if you are under 18 leave, if over 18 continue, content is NSFW. Reddit does the same thing for adult subreddits, you get a popup, this content may be NSFW, if you are at work and will be fire, leave, if not click through if you want - you've been warned. This model however may NOT be permitted under GDPR which has a TON more requirements on tracking consent, recordkeeping for consent, versioning of disclosures, tracking versioned disclosures to consent identifiers tied to other identifiers etc. If you violate any of this you are breaking the law, are committing crimes, and may need to pay $20M or a % of turnover whichever is GREATER!
deleted 5y ago
[deleted]

ethbr0 5y ago

"Do not track", set once and effective until changed, should be the legal end all, be all. I have signalled my default intent, and I have not changed it. Respect it. Of course, the ad industry is hell-bent on preventing anything convenient.

mnw21cam 5y ago
Yeah, I still don't quite get the argument against do not track, and why its clear declaration of intent couldn't be made binding. I mean, you're effectively telling web sites "Do not track me", and they are responding with "Hi, we'd like to track you - please spend ten minutes working through our dark patterns if you're not OK with that".
- Nextgrid 5y ago
  They obviously wouldn't want to just comply with DNT (or any other easy way to opt-out) as they'd be signing their own death certificate. Instead they exploited the apathy & incompetence of the regulators with their so-called "consent" flow. Considering the GDPR was supposed to be enforced since 2018 and they've made it to 2021 without any consequences I'd say that strategy paid off.
- scatters 5y ago
  Unfortunately, DNT is not a clear declaration of intent, because privacy evangelists view it as their moral duty to make that decision for everyone. It's an inconvenient fact that - perhaps a decade ago - we had DNT, and advertisers were starting to respect it, but then browser makers decided to default it to on, making it pointless.
  - gpvos 5y ago
    Yet default-on is the only reasonable default setting.
  - guitarbill 5y ago
    "Browser makers" - you mean Microsoft in IE10? Were there any other browsers that did this? And what did privacy evangelists have to do with it? I'm not sure that was the sole downfall; DNT also had no teeth because it couldn't really be enforced.

PaulKeeble 5y ago

I have also see some sites that are also using a pattern where you either accept their tracking of you or you can't use the site at all, they just block the content or send you to a useless site. That isn't legal either, consent has to be something people actively give and not giving it can't be a reason to reject service. Quite a lot of gyms are getting this wrong in regards fignerprints, they don't get to force that mechanism on you and deny you access if you wont provide it. When the legislation first came in I reported about 100 websites that were breaking the law in obvious ways, they are still like that and the ICO hasn't even responded to those complaints.

Nextgrid 5y ago
This has been my experience as well - the complaints take lots of time to write and manage (you have to first complain to the company and give them 30 days to respond, etc) and in the end the ICO was completely useless anyway.

dmitriid 5y ago

> This was of course entirely intentional, in order to annoy users into clicking yes and laying blame on the GDPR And this worked. Even on HN an awful lot of people blame the prevalence of cookie banners and consent forms on GDPR, and call GDPR a stupid law.