5 ms·

> I've read this entire thread and I still don't know when I would need to prompt for cookies... Well that's the problem, right there! You're reading random HN

> I've read this entire thread and I still don't know when I would need to prompt for cookies... Well that's the problem, right there! You're reading random HN threads to get this information. Why not go to the source? https://ec.europa.eu/info/law/law-topic/data-protection_en https://ec.europa.eu/info/law/law-topic/data-protection_en The law itself is fairly easy to read and understand if you're a software developer. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1374-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Here is what looks to be pretty respectable commentary on when it triggers. Essentially, if you collect any sort of personal data whatsoever: https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/ If you store information that can identify the user, e.g. if you collate a user's IP address, you are almost certainly collecting personal data. Don't, if you can help it. If you must, that same site has some general guidance on how to collect consent: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ Read there more info on how to comply with the data collection. Essentially, if it is personal data, you must give the person informed control over their data, including the ability to withdraw consent at any time, in which case you must delete it.

dotancohen 5y ago
$ wc cookie-regs 4198 54871 354380 cookie-regs 54,000 words? Significant fines for non-compliance, even in the form of errors? And this is a legal spec, not a software spec, so there's no validating my implementation? And the terms are subject to possible change and different interpretations as one could get sued in any country? Or just put up the cookie notice and not worry.
- rendall 5y ago
  Dotan, I'm dropping into this thread after all that drama. I'm upset that you were insulted like that. That was unnecessary. Anyway, if you feel the need to implement a cookie pop-up to feel safe, I get it. The GDPR is really meant to protect users' rights to control their own data. If you implement that single principle in good faith, there won't be any gotcha moments where the EU cyber police fines you over some obscure clause in 50 thousand words of legalese. It's really the people who ignore or circumvent that principle who will be crushed. In my opinion, you will be serving your clients better if you take the time to understand the GDPR rather than annoying your client's users by cargo-culting UX from companies that are skirting or ignoring the law. If you do want to cargo-cult anyway, you could do worse than to crib from the EU website itself. Just saying. https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data...
  - dotancohen 5y ago
    Thanks, but I don't mind the insult. Quite the opposite, I do think that those who display an inability or unwillingness to learn should be shunned from the profession. I should have invested the time to write a response that clarified my position that legal compliance should be taken liberally, rather than just declaring that I don't understand law. For what it's worth, I completely agree with the spirit of the GDPR and don't really have an issue with the implementation - it's far better than not having it.
- bryanrasmussen 5y ago
  >And the terms are subject to possible change and different interpretations as one could get sued in any country? Do you have examples of this? I mean the different interpretations meaning that one country could sue you for an implementation that was deemed fine in another one.
  - dotancohen 5y ago
    I do not have examples, my field is software not law. My skill is identifying possible attack vectors, whether or not they've been exploited.
    - bryanrasmussen 5y ago
      >My skill is identifying possible attack vectors, whether or not they've been exploited. Ok, but EU legal systems (after Brexit) I think are all Napoleonic systems and not common law, furthermore as the 'cookie law' is a directive and not an actual law and is thus supposed to be imposed the same way across all EU lands I don't think this could be as exploitable as it might otherwise be.
      - Symbiote 5y ago
        Ireland, Malta and Cyprus are common law jurisdictions.
        bryanrasmussen 5y ago
        Ok, thanks, I wasn't aware of that, although I guess I should have thought in the case of Ireland it was so. Still a pretty narrow problem area. But even so as it's a directive I don't think it is open to interpretation the way a law might be.
      - dotancohen 5y ago
        > ...Napoleonic systems and not common law, furthermore as the > the 'cookie law' is a directive and not an actual law... And the fact that I have no idea what "Napoleonic systems" are, nor what "common law" is and how that differs from non-common law, nor what the difference would be between a "directive" and an "actual law", all shows why I won't understand that fifty thousand word spec. Of course, I could go get an education in law. Or I could implement the cookie popup.
- IanCal 5y ago
  The cookie notices as implemented are not, in most cases, valid.

dotancohen 5y ago

$ wc cookie-regs 4198 54871 354380 cookie-regs 54,000 words? Significant fines for non-compliance, even in the form of errors? And this is a legal spec, not a software spec, so there's no validating my implementation? And the terms are subject to possible change and different interpretations as one could get sued in any country? Or just put up the cookie notice and not worry.

rendall 5y ago
Dotan, I'm dropping into this thread after all that drama. I'm upset that you were insulted like that. That was unnecessary. Anyway, if you feel the need to implement a cookie pop-up to feel safe, I get it. The GDPR is really meant to protect users' rights to control their own data. If you implement that single principle in good faith, there won't be any gotcha moments where the EU cyber police fines you over some obscure clause in 50 thousand words of legalese. It's really the people who ignore or circumvent that principle who will be crushed. In my opinion, you will be serving your clients better if you take the time to understand the GDPR rather than annoying your client's users by cargo-culting UX from companies that are skirting or ignoring the law. If you do want to cargo-cult anyway, you could do worse than to crib from the EU website itself. Just saying. https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data...
- dotancohen 5y ago
  Thanks, but I don't mind the insult. Quite the opposite, I do think that those who display an inability or unwillingness to learn should be shunned from the profession. I should have invested the time to write a response that clarified my position that legal compliance should be taken liberally, rather than just declaring that I don't understand law. For what it's worth, I completely agree with the spirit of the GDPR and don't really have an issue with the implementation - it's far better than not having it.
bryanrasmussen 5y ago
>And the terms are subject to possible change and different interpretations as one could get sued in any country? Do you have examples of this? I mean the different interpretations meaning that one country could sue you for an implementation that was deemed fine in another one.
- dotancohen 5y ago
  I do not have examples, my field is software not law. My skill is identifying possible attack vectors, whether or not they've been exploited.
  - bryanrasmussen 5y ago
    >My skill is identifying possible attack vectors, whether or not they've been exploited. Ok, but EU legal systems (after Brexit) I think are all Napoleonic systems and not common law, furthermore as the 'cookie law' is a directive and not an actual law and is thus supposed to be imposed the same way across all EU lands I don't think this could be as exploitable as it might otherwise be.
    - Symbiote 5y ago
      Ireland, Malta and Cyprus are common law jurisdictions.
      - bryanrasmussen 5y ago
        Ok, thanks, I wasn't aware of that, although I guess I should have thought in the case of Ireland it was so. Still a pretty narrow problem area. But even so as it's a directive I don't think it is open to interpretation the way a law might be.
    - dotancohen 5y ago
      > ...Napoleonic systems and not common law, furthermore as the > the 'cookie law' is a directive and not an actual law... And the fact that I have no idea what "Napoleonic systems" are, nor what "common law" is and how that differs from non-common law, nor what the difference would be between a "directive" and an "actual law", all shows why I won't understand that fifty thousand word spec. Of course, I could go get an education in law. Or I could implement the cookie popup.
IanCal 5y ago
The cookie notices as implemented are not, in most cases, valid.