6 ms·

exactly... they should be opt-in and not opt-out

by therealmarv 5y ago

ushakov 5y ago
they also should not lie about “legitimacy”
- MaxBarraclough 5y ago
  It's against the law to do so, [0] but the law is almost never enforced. [0] https://news.ycombinator.com/item?id=27060609 https://news.ycombinator.com/item?id=27060609
desas 5y ago
If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.
- jacquesm 5y ago
  They're not.
  - thecopy 5y ago
    They are (according to GDPR.)
  - bulatb 5y ago
    The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f). Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis. No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ === Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.
    - jacquesm 5y ago
      > it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. That was the point. Then to force your users to consent adds insult to injury and is in contravention to the GDPR.
mhils 5y ago
Legitimate interest being opt-out makes sense, for example for fraud prevention. I absolutely agree though that adtech often blatantly claims they would have a legitimate interest, whereas they should ask for (opt-in) consent.
- atleta 5y ago
  No, it doesn't make sense, because if it would be legitimate interest then they wouldn't have to ask for consent. That's the very point of legitimate interest. You can may that they are being nice, but it's obviously not the case and also would make no sense. You either claim that you are collecting data because it's your legitimate interest or you ask for permission. What they are hiding here is what you say: make some of their cookies opt-out.
  - thecopy 5y ago
    They dont need to ask for consent for legitimate interest, that is why they are opt-out (default on) as opposed to the consents which are opt in (default off)
    - lucumo 5y ago
      An opt-out for legitimate interest makes no sense. You either need it for a purpose or you don't. A typical legitimate interest is fraud detection. Being able to opt-out of that would defeat the purpose.

exactly... they should be opt-in and not opt-out

ushakov 5y ago

they also should not lie about “legitimacy”

MaxBarraclough 5y ago
It's against the law to do so, [0] but the law is almost never enforced. [0] https://news.ycombinator.com/item?id=27060609 https://news.ycombinator.com/item?id=27060609

desas 5y ago

If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.

jacquesm 5y ago
They're not.
- thecopy 5y ago
  They are (according to GDPR.)
- bulatb 5y ago
  The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f). Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis. No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ === Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.
  - jacquesm 5y ago
    > it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. That was the point. Then to force your users to consent adds insult to injury and is in contravention to the GDPR.

mhils 5y ago

Legitimate interest being opt-out makes sense, for example for fraud prevention. I absolutely agree though that adtech often blatantly claims they would have a legitimate interest, whereas they should ask for (opt-in) consent.

atleta 5y ago
No, it doesn't make sense, because if it would be legitimate interest then they wouldn't have to ask for consent. That's the very point of legitimate interest. You can may that they are being nice, but it's obviously not the case and also would make no sense. You either claim that you are collecting data because it's your legitimate interest or you ask for permission. What they are hiding here is what you say: make some of their cookies opt-out.
- thecopy 5y ago
  They dont need to ask for consent for legitimate interest, that is why they are opt-out (default on) as opposed to the consents which are opt in (default off)
  - lucumo 5y ago
    An opt-out for legitimate interest makes no sense. You either need it for a purpose or you don't. A typical legitimate interest is fraud detection. Being able to opt-out of that would defeat the purpose.