5 ms·

The most ridiculous are those “legitimate interest” checkboxes, which you have to uncheck manually one by one https://imgur.com/a/LIPUfCQ https://imgur.com/a/L

The most ridiculous are those “legitimate interest” checkboxes, which you have to uncheck manually one by one https://imgur.com/a/LIPUfCQ https://imgur.com/a/LIPUfCQ

therealmarv 5y ago
exactly... they should be opt-in and not opt-out
- ushakov 5y ago
  they also should not lie about “legitimacy”
  - MaxBarraclough 5y ago
    It's against the law to do so, [0] but the law is almost never enforced. [0] https://news.ycombinator.com/item?id=27060609 https://news.ycombinator.com/item?id=27060609
- desas 5y ago
  If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.
  - jacquesm 5y ago
    They're not.
    - thecopy 5y ago
      They are (according to GDPR.)
    - bulatb 5y ago
      The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f). Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis. No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ === Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.
      - jacquesm 5y ago
        > it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. That was the point. Then to force your users to consent adds insult to injury and is in contravention to the GDPR.
- mhils 5y ago
  Legitimate interest being opt-out makes sense, for example for fraud prevention. I absolutely agree though that adtech often blatantly claims they would have a legitimate interest, whereas they should ask for (opt-in) consent.
  - atleta 5y ago
    No, it doesn't make sense, because if it would be legitimate interest then they wouldn't have to ask for consent. That's the very point of legitimate interest. You can may that they are being nice, but it's obviously not the case and also would make no sense. You either claim that you are collecting data because it's your legitimate interest or you ask for permission. What they are hiding here is what you say: make some of their cookies opt-out.
    - thecopy 5y ago
      They dont need to ask for consent for legitimate interest, that is why they are opt-out (default on) as opposed to the consents which are opt in (default off)
      - lucumo 5y ago
        An opt-out for legitimate interest makes no sense. You either need it for a purpose or you don't. A typical legitimate interest is fraud detection. Being able to opt-out of that would defeat the purpose.
eitland 5y ago
Exactly: legitimate interested is an actual thing, but it doesn't cover > 500 third parties which is what I have found in these boxes (I selected all and processed them in Libre Office or something).
Macha 5y ago
In the last 3 months some "innovative" CMPs have also added the feature to have to click into a more info box per purpose to find the legitimate interest checkbox to untick.
jacquesm 5y ago
And none of which have an actual legitimate interest.
yissp 5y ago
But of course there's a convenient button to accept all of them.

The most ridiculous are those “legitimate interest” checkboxes, which you have to uncheck manually one by one https://imgur.com/a/LIPUfCQ https://imgur.com/a/LIPUfCQ

therealmarv 5y ago

exactly... they should be opt-in and not opt-out

ushakov 5y ago
they also should not lie about “legitimacy”
- MaxBarraclough 5y ago
  It's against the law to do so, [0] but the law is almost never enforced. [0] https://news.ycombinator.com/item?id=27060609 https://news.ycombinator.com/item?id=27060609
desas 5y ago
If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.
- jacquesm 5y ago
  They're not.
  - thecopy 5y ago
    They are (according to GDPR.)
  - bulatb 5y ago
    The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f). Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis. No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ === Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.
    - jacquesm 5y ago
      > it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. That was the point. Then to force your users to consent adds insult to injury and is in contravention to the GDPR.
mhils 5y ago
Legitimate interest being opt-out makes sense, for example for fraud prevention. I absolutely agree though that adtech often blatantly claims they would have a legitimate interest, whereas they should ask for (opt-in) consent.
- atleta 5y ago
  No, it doesn't make sense, because if it would be legitimate interest then they wouldn't have to ask for consent. That's the very point of legitimate interest. You can may that they are being nice, but it's obviously not the case and also would make no sense. You either claim that you are collecting data because it's your legitimate interest or you ask for permission. What they are hiding here is what you say: make some of their cookies opt-out.
  - thecopy 5y ago
    They dont need to ask for consent for legitimate interest, that is why they are opt-out (default on) as opposed to the consents which are opt in (default off)
    - lucumo 5y ago
      An opt-out for legitimate interest makes no sense. You either need it for a purpose or you don't. A typical legitimate interest is fraud detection. Being able to opt-out of that would defeat the purpose.

eitland 5y ago

Exactly: legitimate interested is an actual thing, but it doesn't cover > 500 third parties which is what I have found in these boxes (I selected all and processed them in Libre Office or something).

Macha 5y ago

In the last 3 months some "innovative" CMPs have also added the feature to have to click into a more info box per purpose to find the legitimate interest checkbox to untick.

jacquesm 5y ago

And none of which have an actual legitimate interest.

yissp 5y ago

But of course there's a convenient button to accept all of them.