4 ms·

The issue though here is around consent pop-ups being found to violate the GDPR. I'm just pointing out that the pop-ups continue to be very complicated for folk

The issue though here is around consent pop-ups being found to violate the GDPR. I'm just pointing out that the pop-ups continue to be very complicated for folks to deal with. My understanding is that the cookie set by the consent pop-ups may now be classified as personal data, requiring a data controller, permissions etc. Or am I misunderstanding this latest twist? Shouldn't be hard to fix, but good lord if you are a smaller player. Just note, politically somehow cookies have become the big privacy boogeyman. Meanwhile personal data is harvested at HUGE scale (cable TV / smart TV/ ISPs etc) at least in the US without consequence. Ripoffs online are insane in quantity without much consequence. Major issues like DoS attacks go unaddressed and more. And because practically while the EU says ads and analytics are not essential, since for free websites they are in reality pretty essential, there is a lot of natural tension there. I am bummed about SSO issues now and modal cookie popups particularly on mobile etc. The other issue privacy folks are missing I think is focusing on this endless consent and reconsent on every website. I've seen data that 95%+ of folks click accept all. So you are delivering a product feature that annoys 95% of your target, it's a losing game. My own expectation, in long run this compliance overhead will help the mega platforms win out. They are the only ones (youtube / google / microsoft / apple etc) with the scale to really manage the years long investigations, million page doc requests etc. Ie, if you are going to put a video online, you are going to need to put it on youtube if you want anything analytic related to it. The other side is, vast folks ignore the law and just hope they won't be caught, or do a random (I accept) cookie popup and hope they are covered.

skinkestek 5y ago
> The issue though here is around consent pop-ups being found to violate the GDPR. Pop ups doesn't violate GDPR. Making a system, pop up or otherwise, that is significantly harder to opt out of than opting into and then going on to pretending that users deliberately chose tracking however, that is a violation. The rules are simple: tracking is opt in. You have to convince users there's something in it for them. And, as someone who gave especially Google the benefit of doubt for the longest time I can testify that for me at least it did not result in relevant ads at all. Relevat ads would be: - local shops (I got two ads for local shops in a decade) - family cars (I bought three used ones during that decade, not a single Google ad that I can remember) - programming conferences - power tools - programming tools (one for Jetbrains tools five years ago, also a few for WordPress hosting after I searched for it.) - insurance - toys for kids - family holidays - etc What I got: - ads for scammy dating sites
Nextgrid 5y ago
> consent pop-ups being found to violate the GDPR Consent pop-ups as a whole haven't been found to violate the GDPR. Specific patterns that certain consent pop-ups implement were determined to be in violation. > My understanding is that the cookie set by the consent pop-ups may now be classified as personal data I have re-read the press release and I don't see that anywhere. A cookie saying consent=true is absolutely not personal data. The problem is that personal data was being collected without proper consent (the pop-up that was supposed to obtain the consent does not comply with the regulation). > politically somehow cookies have become the big privacy boogeyman This is partly a holdover from the previous ePrivacy Directive which very much focused on cookies. Consent management solutions (both compliant and non-compliant) were designed to address that. These consent management solutions are now being repurposed to comply with the GDPR and some may not have adjusted their wording and still incorrectly focus on cookies even though the GDPR covers data collection & processing regardless of the technical means of doing so (so it's no longer specific to cookies - you can perfectly breach the GDPR without setting a single cookie). > Meanwhile personal data is harvested at HUGE scale (cable TV / smart TV/ ISPs etc) This is something that the GDPR addresses. Unfortunately enforcement has been severely lacking. > the EU says ads and analytics are not essential Ads aren't technically forbidden. Non-consensual data collection for targeting is. You are still allowed to serve ads as long as they aren't targeted based on the user's personal data (you can still target based on the currently viewed page's content for example). Analytics are frankly not essential - you don't lose anything if only 10% of people opt-in for example. But even then, it is absolutely possible to implement analytics in a privacy-respecting way without relying on any personal data (and thus not require consent); for example a single hit counter that just increments an integer every time a button is clicked should not require consent. You'll only need consent if you tie that analytics event to a persistent user session. > since for free websites they are in reality pretty essential This is due to a lack of proper enforcement of the GDPR. At the moment the big players violate the GDPR, so any site that decides to respect it will lose out. If the GDPR was enforced and everyone was complying, the playing field will level out and either ad prices for non-targeted ads will go up (as very few people opt into ads, so this leaves a lot of inventory on the table that advertisers will suddenly want to capture) or services will start to ask for payments, normalizing non-ad-supported services. > I am bummed about SSO issues now That's a problem because the lack of (enforced) legislation around cookies made browsers delete them aggressively. It would've been better if legislation such as the GDPR was enacted (and enforced) sooner so that abuse of cookies could've been dealt with legally, leaving the concept of cookies itself as-is so it can still be used legitimately. > modal cookie popups particularly on mobile That's again due to the lack of enforcement. A proper consent flow should allow you to easily decline all cookies, or even better, just not be there in the first place because the website doesn't have to collect & process any personal data for non-essential purposes (just FYI, cookies essential to the functionality of the website don't require consent - a session cookie on login or for a shopping cart does not need consent). > The other issue privacy folks are missing I think is focusing on this endless consent and reconsent on every website. Again see above. Most of the annoying consent flows aren't actually compliant. The reason they're there and are annoying is to trick you into clicking accept (and to hate on the GDPR). Hopefully this ruling will force them to comply with the law which says that it should be as easy to decline as it is to accept. > I've seen data that 95%+ of folks click accept all See previous paragraph. That's the intention behind these non-compliant consent flows. If it's too difficult to decline then people will click accept all. On the other hand, when the flow is implemented properly such as Apple's App Tracking Transparency flow (which gives you a system-generated modal that allows you to accept or decline in one-click), the opt-in rate is in the single-digit percentages. > in long run this compliance overhead will help the mega platforms win out I am not sure. They are (well, were) currently winning because they are big enough to risk it, but the tide is turning with rulings such as this one. Facebook is in big trouble for example because their business model (which relies on mandatory, large-scale data collection) is at odds with the GDPR and they are trying to legalese their way out of it, unsuccessfully: https://noyb.eu/en/austrian-supreme-court-facebook-dismissed https://noyb.eu/en/austrian-supreme-court-facebook-dismissed > if you are going to put a video online, you are going to need to put it on youtube if you want anything analytic related to it If you put a video online you can easily count the number of views by just analyzing server logs. What you can't do (and Google can't either) is track users to determine unique views for example (as that would require assigning each user a persistent ID).

skinkestek 5y ago

> The issue though here is around consent pop-ups being found to violate the GDPR. Pop ups doesn't violate GDPR. Making a system, pop up or otherwise, that is significantly harder to opt out of than opting into and then going on to pretending that users deliberately chose tracking however, that is a violation. The rules are simple: tracking is opt in. You have to convince users there's something in it for them. And, as someone who gave especially Google the benefit of doubt for the longest time I can testify that for me at least it did not result in relevant ads at all. Relevat ads would be: - local shops (I got two ads for local shops in a decade) - family cars (I bought three used ones during that decade, not a single Google ad that I can remember) - programming conferences - power tools - programming tools (one for Jetbrains tools five years ago, also a few for WordPress hosting after I searched for it.) - insurance - toys for kids - family holidays - etc What I got: - ads for scammy dating sites

Nextgrid 5y ago

> consent pop-ups being found to violate the GDPR Consent pop-ups as a whole haven't been found to violate the GDPR. Specific patterns that certain consent pop-ups implement were determined to be in violation. > My understanding is that the cookie set by the consent pop-ups may now be classified as personal data I have re-read the press release and I don't see that anywhere. A cookie saying consent=true is absolutely not personal data. The problem is that personal data was being collected without proper consent (the pop-up that was supposed to obtain the consent does not comply with the regulation). > politically somehow cookies have become the big privacy boogeyman This is partly a holdover from the previous ePrivacy Directive which very much focused on cookies. Consent management solutions (both compliant and non-compliant) were designed to address that. These consent management solutions are now being repurposed to comply with the GDPR and some may not have adjusted their wording and still incorrectly focus on cookies even though the GDPR covers data collection & processing regardless of the technical means of doing so (so it's no longer specific to cookies - you can perfectly breach the GDPR without setting a single cookie). > Meanwhile personal data is harvested at HUGE scale (cable TV / smart TV/ ISPs etc) This is something that the GDPR addresses. Unfortunately enforcement has been severely lacking. > the EU says ads and analytics are not essential Ads aren't technically forbidden. Non-consensual data collection for targeting is. You are still allowed to serve ads as long as they aren't targeted based on the user's personal data (you can still target based on the currently viewed page's content for example). Analytics are frankly not essential - you don't lose anything if only 10% of people opt-in for example. But even then, it is absolutely possible to implement analytics in a privacy-respecting way without relying on any personal data (and thus not require consent); for example a single hit counter that just increments an integer every time a button is clicked should not require consent. You'll only need consent if you tie that analytics event to a persistent user session. > since for free websites they are in reality pretty essential This is due to a lack of proper enforcement of the GDPR. At the moment the big players violate the GDPR, so any site that decides to respect it will lose out. If the GDPR was enforced and everyone was complying, the playing field will level out and either ad prices for non-targeted ads will go up (as very few people opt into ads, so this leaves a lot of inventory on the table that advertisers will suddenly want to capture) or services will start to ask for payments, normalizing non-ad-supported services. > I am bummed about SSO issues now That's a problem because the lack of (enforced) legislation around cookies made browsers delete them aggressively. It would've been better if legislation such as the GDPR was enacted (and enforced) sooner so that abuse of cookies could've been dealt with legally, leaving the concept of cookies itself as-is so it can still be used legitimately. > modal cookie popups particularly on mobile That's again due to the lack of enforcement. A proper consent flow should allow you to easily decline all cookies, or even better, just not be there in the first place because the website doesn't have to collect & process any personal data for non-essential purposes (just FYI, cookies essential to the functionality of the website don't require consent - a session cookie on login or for a shopping cart does not need consent). > The other issue privacy folks are missing I think is focusing on this endless consent and reconsent on every website. Again see above. Most of the annoying consent flows aren't actually compliant. The reason they're there and are annoying is to trick you into clicking accept (and to hate on the GDPR). Hopefully this ruling will force them to comply with the law which says that it should be as easy to decline as it is to accept. > I've seen data that 95%+ of folks click accept all See previous paragraph. That's the intention behind these non-compliant consent flows. If it's too difficult to decline then people will click accept all. On the other hand, when the flow is implemented properly such as Apple's App Tracking Transparency flow (which gives you a system-generated modal that allows you to accept or decline in one-click), the opt-in rate is in the single-digit percentages. > in long run this compliance overhead will help the mega platforms win out I am not sure. They are (well, were) currently winning because they are big enough to risk it, but the tide is turning with rulings such as this one. Facebook is in big trouble for example because their business model (which relies on mandatory, large-scale data collection) is at odds with the GDPR and they are trying to legalese their way out of it, unsuccessfully: https://noyb.eu/en/austrian-supreme-court-facebook-dismissed https://noyb.eu/en/austrian-supreme-court-facebook-dismissed > if you are going to put a video online, you are going to need to put it on youtube if you want anything analytic related to it If you put a video online you can easily count the number of views by just analyzing server logs. What you can't do (and Google can't either) is track users to determine unique views for example (as that would require assigning each user a persistent ID).