39 ms·

New EU data blockage as German court would ban many cookie management providers

306 points by pmlnr 5y ago

bencollier49 5y ago
Am I reading this incorrectly? This logic seems to apply equally to simply using EU-based servers from a US-based cloud provider for storing EU personal data.
- detaro 5y ago
  it does, it's just applying the previous rulings saying that to this specific company.
rklaehn 5y ago
So they make a big deal out of cookies, meanwhile you have to show your personal data and medical details to buy a coffee. What a joke. If we do vaccine passports, can we just stop the whole data protection charade completely?
thepangolino 5y ago
[dead]
qwerty456127 5y ago
All "cookie management providers" should be banned. Cookies are meant for a specific website to remember information about a visitor, every website should manage their cookies themselves. Together with the HTTP referer field (and referral URL parameters perhaps, maybe also IP addresses geolocation - this is questionable but let's be honest) first-party cookies are sufficient for all reasonable visitor tracking. Both can be disabled by a user who doesn't want to be tracked but are enabled by default.
- deepstack 5y ago
  All so all the fingerprinter/css/font/gpu identification. That ought to be illegal, and any provider caught using it ought to be punished.
  - asimpletune 5y ago
    I'm all for this, but, um, how?
    - tommek4077 5y ago
      One could just outlaw it. Like theft. It would not hinder you in the first place, but you would could be prosecuted.
      - mellavora 5y ago
        and unlike theft, much easier to establish and prove guilt.
    - deepstack 5y ago
      should be able to guess who is doing it. And if the legal infrastructure is there, it can be quite easy for whistleblower to expose that. This is the reason why user who care about their privacy ought to use only web page that works with No Javascript
    - beberlei 5y ago
      You are thinking like a software engineer that an illegal practice should be completely impossible to do, but socially it always sufficed to just put a reasonably high penalty on something and fine offenders regularly.
      - Sebb767 5y ago
        And, unlike some other computer crimes, it is sufficient to prevent local companies from using the technique. While someone who's hacking or laundering money might simply use a proxy in the Bahamas without problems, a company local company won't risk fines for using it. Sure, companies from far away can still advertise to you via tracking, but the value of their advertisements will go down sharply if no business near you can buy them.
      - ClumsyPilot 5y ago
- nomercy400 5y ago
  "Cookie Management Providers" are Cookie-Management-As-A-Service. Now it suddenly sounds hip and cloud-based and something your can buy and easily integrate instead of having to develop it in-house. Plus you are able to shift the blame to the "Cookie Management Provider" when issues arise.
kkdaemas 5y ago
Here's an idea for the EU: mandate that all major browsers ship with third-party cookies disabled by default and drop the whole cookie-banner nonsense.
- tpush 5y ago
  That wouldn't accomplish anything, as cookie banners have to do with tracking and not inherently with third-party cookies. Tracking via first-party cookies is still illegal and would require consent.
- perihelions 5y ago
  That kind of technical countermeasure only works when you're a statistical minority and adtech doesn't care enough to chase after you. If everyone were to block 3p cookies, the adversary would create new ways to share data on the backend, without clientside involvement, and we'd be right back where we started (other a small increase in friction).
- zeepzeep 5y ago
  Other idea: make browsers have a proper cookie banner and not one that tricks me into selling my soul, I never got why pages would need individual banners.
  - IMTDb 5y ago
    Please don't force browsers (clients) to fix what's fundamentally a server side (website doing shit with your data) issue. Browser can choose to respect the cookies (first, or third parties), but ultimately don't force them to do or not do anything.
    - zeepzeep 5y ago
      Forcing 3 companies to change their browsers is a lot easier than forcing millions of shady US businesses to do anything
      - 5y ago
KarlKemp 5y ago
The problem here is that a website is built in such a way that implementing the (admittedly annoying) cookie consent mechanisms goes through three different subcontractors/API providers. The needless dispersion of your users’ browsing history is in itself disrespectful. Yes, privacy regulation do make life complicated if you choose to ignore their core, and instead create some Frankensteinian caricature of an infrastructure to continue doing business exactly as before.
- zeepzeep 5y ago
  > Yes, privacy regulation do make life complicated if you choose to ignore their core Yes, 100%, it is relatively easy to just not track your ~~victims~~ customers every move.
- mrweasel 5y ago
  I also find the "We care about your privacy" message disrespectful, when the next step is "Please allow us to share information about you with these 628 other companies". Those two sentences are complete opposites.
pixelpoet 5y ago
I hope they fine the everliving crap out of these platforms that go "oh suuuure you can opt out of all this tracking, just spend 5 days turning off millions of individual settings in this maximally inconvenient dialog!"
- Ekaros 5y ago
  And do not forget these blatantly illegal "legitimate interest"... Which I have to manually turn off after turning of the rest...
  - phh 5y ago
    I still haven't understood those. Can you explain it to me please?
    - g_p 5y ago
      "Legitimate interest" is a grounds for data processing under GDPR. Someone seemed to cotton on to the (incorrect, per my understanding) notion that it was applicable to placement of cookies. That's covered by the ePrivacy Directive (and national implementing laws), and they don't make any provision for "legitimate interest". Nonetheless, regulators move slowly, and companies want cookies. Having this gives them two bites at the same cherry (in their eyes), and enforcement is a long way off, and unlikely to scale. While not EU any more, the UK ICO guidance is really clear on their implementation of the ePrivacy Directive - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... There's only 2 exceptions to the strict requirement for consent - to communicate the data to the user, and to deliver functionality directly requested (i.e. shopping basket, login session). But enough people try to claim "legitimate interest" that others think it's OK...
      - matheusmoreira 5y ago
        Advertising is hereby declared an illegitimate interest. Awesome!
paull39 5y ago
Cookies are especially important at Christmas. They taste good but it's best to bake your own. This topic is important but I guess it's so behind to today's fingerprinting that this whole topic is getting polemic.
- milicat 5y ago
  I'd guess fingerprinting without consent is also illegal under these regulations, but may be harder to persecute.
- zeepzeep 5y ago
  > so behind to today's fingerprinting Yes that's the sad thing, they do not need cookies anymore.
- ratww 5y ago
  GDPR doesn't say anything about cookies other than in examples. Fingerprinting, identification via IP, localStorage, all are equivalent under it. "Cookie Banner" is an industry term, which is incorrect.
pantulis 5y ago
"Here, however, the court reasoned that since data “are processed on Akamai servers, a data transfer to a third country is occurring,” simply because “Akamai Technologies Inc., as an American company, is subject to the CLOUD Act.”" This consideration is key, even when Akamai servers are hosted in the EU.
- runarb 5y ago
  > This consideration is key, even when Akamai servers are hosted in the EU. Is the fix as easy as that Akamai creating a subsidiary in the EU? I am in the EU and use AWS a lot, but I am not a customer of Amazon Inc. Instead, it sees this on the bill as who is the seller: "Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg".
  - fxtentacle 5y ago
    Yes it is. The whole point of that decision is to make sure Akamai cannot says "we're an US entity, so EU privacy laws don't apply to us". That's why they are now forced to create a local subsidy, which will then be forced to follow local laws.
    - detaro 5y ago
      Akamai did not claim "EU privacy laws don't apply to us", and that's really not what the case is about.
    - akie 5y ago
      The way I read the article, this will only work if the EU entity is legally able to tell the parent US entity to "get lost" in case the US government has decided it wants something from the EU entity. So it needs to be truly independent, at least that's the sense I got from the court's decision.
      - gls2ro 5y ago
        IANAL but I dont think a parent company can ask a local branch to not follow local rules. So for example if in EU is forbidden to store information without consent the local branch cannot do that on EU servers.
jstummbillig 5y ago
I recently spent an inordinate amount of time implementing effective self-hosted cookie control (as in: actually deferring loading of offending scripts until after being accepted, and then loading and executing after being accepted without having to trigger a page reload) It would be absolutely asinine to assume that a layman could understand, much less implement the currently available solutions in an effective manner, so here are the two scenarios that small businesses are faced with: a) They still wanna make use of cookie powered tech and just do it without consent, which opens them up to legal trouble b) They don't do it and give up on functionality, which big biz will be able to provide, putting them at a disadvantage and making the web less democratic in the process once again. While I have no particular thoughts about the type of providers targeted here, I am certain that the last thing the current setup needs is additional complication.
- tommek4077 5y ago
  What functionality would that be? Anything else than targeted ads?
  - jstummbillig 5y ago
    Whatever you want to use Cookies for. Analytics probably most of the time. I don't think small businesses typically run targeted ads on their own websites.
    - smarx007 5y ago
      I think that could actually be a problem. NOYB, a nonprofit GDPR watchdog in Austria, has firmly set its sights in enforcement on Google Analytics and Facebook/Twitter buttons because they are easy to remove. I think small mom&pop shops would have to go back to getting analytics via web server logs. Even small hosters like https://www.dogado.de/website/hosting https://www.dogado.de/website/hosting (wanted to actually link to CampusSpeicher but they seem to have been acquired) offer this (see under Highlights > Website-Statistiken). To be clear, NOYB allows 60 days after notification for removal (instead of 30 allowed by the law) before complaining to the national data protection agency and even then agencies rarely give out serious fines if you are ready to comply and did not grossly misuse the data, at least in Sweden: https://www.enforcementtracker.com https://www.enforcementtracker.com.
splintercell 5y ago
People may not like hearing this but this whole cookie issue is American capitalists fighting European bureaucrats and I know the former will win. On an even more fundamental level this is a conflict between American legal system of common law vs European statutory legal system.
- dariosalvi78 5y ago
  At least for now it seems that most American companies are trying to respect the gdpr instead of fighting it, so I am not sure that the American capitalism will win this battle.
- jetsetgo 5y ago
dariosalvi78 5y ago
If confirmed, this implies that the use of any provider that could in theory bring the data to a third country should be avoided.
- marginalia_nu 5y ago
  That's largely already a consequence of Schrems II.
- tiedemann 5y ago
  If that third country has something like the CLOUD Act, then yes.
- speedgoose 5y ago
  It's actually already the case but everyone prefers to put their heads in the sand and hope for the best. It's not like we have real alternatives to AWS or Azure in Europe right now.
  - dmitriid 5y ago
    AWS/GCP/Azure are very keen on keeping the business in Europe, so they have European datacenters, try to keep them GDPR-and-other-laws-compilant, and will even sign a legally binding agreement with you swearing to keep all data on EU servers only.
    - speedgoose 5y ago
      Yeah they do that. But at the same time they have the patriot act law to respect, and the European privacy shield is dead. So right now it's challenging to know whether using Azure is GDPR compliant or not. Most people I talked with on this topic think it's probably not compliant, but they prefer to wait and pay a fine if necessary as they are not lawyers.
    - kall 5y ago
      The Azure service fully operated by Deutsche Telekom seems pretty appealing right about now, but as far as I know they cancelled that. Maybe cloud providers will move to a kind of franchise model, effectively allowing smaller European companies to license an Outposts type software.
onion2k 5y ago
The cookie banner on iapp.org is provided by OneTrust via cookiepro.org[1]. This thing figures out your location (by IP address) and displays a banner at the bottom of the page with specific buttons for the laws based on where you live. It captures data from around 42k websites[2], with a unique user-specific ID, so OneTrust can track people across all those sites. If OneTrust operate other services, or if they share the data with other organizations, they can track you more widely. Cookie banners that seek to improve privacy for users by limiting what third parties can do have become another way to track people. Limiting the activity of cookie banner providers would not be a terrible idea. [1] https://www.cookiepro.com/products/cookie-consent/ https://www.cookiepro.com/products/cookie-consent/ [2] https://cookiepedia.co.uk/host/cookielaw.org https://cookiepedia.co.uk/host/cookielaw.org
milicat 5y ago
The law here is totally reasonable to protect people's right to data privacy. It's just that every damn website is trying its best to trick their users into consenting despite the law. Half the solution look illegal anyway, as you can't deny cookies with a single click. Plus the US Cloud Act is an authoritarian overreach and rightfully gives US providers a competitive disadvantage.
- kall 5y ago
  I too think these consent solutions are problematic, but the law as it is use here is a catastrophic overreach, if applied broadly. If you take the article at face value, it is illegal to create any kind of TCP/IP connection with a server that is operated by a company which does not operate exclusively in the EU. This is a strong interpretation, but it‘s really not far off from what the court did here: they declared it illegal that an IP Adress (!) was transmitted (not stored?) to a company that could potentially (?) be subject to non EU subpoenas. If NOYB managed to make the entire internet illegal just so they have a sharp axe to go after the things they don‘t like (Google Analytics, cookie "consent" banners), congratulations. They have built a slope so slippery it should have an ICU at the bottom.
  - bbu 5y ago
    It’s not noyb who built the slope, it’s the ever greedy companies trying to trick people I to all kinds of shady shit. Everything they get they deserve and I truly hope trustarc, onetrust and whatever their names are end up in bankruptcy.
    - kall 5y ago
      Sure those companies can go to hell, but is it really worth it? In my view there is no crime bad enough that it justifies having laws on the books that criminalize everyone just so we can selectively enforce them against the bad ones.
    - kall 5y ago
      Sure those companies can go to hell, but is it really worth it? In my view there is no crime bad enough that it justifies having laws on the books that criminalize everyone just so we can selectively enforce them against the bad ones. It may be worth noting that this doesn‘t involve a fine, only that they cease the activity. That is my personal silver lining as someone operating services within the EU that clearly are not lawful.
thejackgoode 5y ago
I am ambivalent and torn about what to think of European digital policies. On one hand there's GDPR and regulations like these that are absolutely overdue and EU is probably the only entity in the world who can improve situation given the current meta. On other hand, there's encryption regulation and absurd piracy strictness. Please someone with a formed perspective tell what's happening? What is a general vector of European policy on the internet?
- zeepzeep 5y ago
  > formed perspective I do not think I really qualify but hey. > What is a general vector of European policy on the internet? Generally the EU is very pro-privacy but sadly companies like Facebook bribe our "data protection officers" (sorry idk how to translate) and individual EU countries also just break the EU law on a regular.
  - martijnvds 5y ago
    They're called "data protection authorities" or "data protection commissions", and because lots of US tech companies are incorporated in Ireland, they get to "use" the Irish DPC. And they're not very good at their job (or maybe they are, if you're Facebook): https://www.euractiv.com/section/data-protection/news/irelands-privacy-watchdog-accused-of-paralysing-gdpr-enforcement/ https://www.euractiv.com/section/data-protection/news/irelan...
- dane-pgp 5y ago
  > On other hand, there's encryption regulation and absurd piracy strictness. Could you give an example of an EU regulation which actually restricts encryption? There have certainly been discussions about adding backdoors to encryption (as is typical for any jurisdiction that doesn't have them), but my understanding is that these proposals have reached a dead end. Here's an update from last week: > The lead committee for the internal market and consumer protection (IMCO) in the EU Parliament spoke out on Monday evening with a large majority with its current position on the planned Digital Services Act (DSA). ... It also includes the right to end-to-end encryption. “The member states must not prevent providers of switching services from offering end-to-end encrypted services,” demanded the representatives. This is essential for trust in the network and cybersecurity. https://marketresearchtelecast.com/digital-basic-law-eu-mps-for-identification-requirements-for-porn-uploads/226325/ https://marketresearchtelecast.com/digital-basic-law-eu-mps-...
uniqueuid 5y ago
Before the discussion descends into the usual "that's stupid and will kill all tech startups" vs. "that's right because all cookies are evil incarnate", I'll say again: This is a perfect example of the kind of legal processes we have now. The EU and Germany in particular have decades of privacy regulation and core values behind them. These core values won't change. Regulation for the past decades has ignored that tech routinely violates these values, and it's catching up now. Rules won't be as dramatic as in the past, but will differ widely from the us. In this context, it's legally important to account for entrepreneurial freedom (guaranteed by the constitution), but if there's an overriding reason to protect consumers, then it is entirely irrelevant how long companies have been doing this, how many do this and in what other countries they do it. To sum up, the law sometimes bites late, but it bites hard, and arguments surrounding competitiveness, business culture or internet culture are legally completely irrelevant.
- nkmnz 5y ago
  The arguments you list in the end are not legal arguments, but political ones, so it’s not a big surprise they are „legally completely irrelevant“ - unless politics turns them into law.
- sokoloff 5y ago
  “The wheels of justice turn slowly, but grind exceedingly fine.”
  - selfhoster11 5y ago
    Except when it gets stuck on monopolies and oligopolies, but that's not a problem, right?
    - uniqueuid 5y ago
      They also grind very selectively. The fundamental hope that democracy is based upon is that they will eventually (in finite time) grind all problems, even if not right away.
wiredfool 5y ago
The scope here is far, far higher than cookie management providers, If the scope is that a company with a us presence can’t have extraordinary access to data. Google analytics is going to be essentially outlawed in the EU. Hosting with any company with a US presence is going to be questionable. No Aws, Google Cloud, Digital Ocean, linode, azure, hetzner… (Leading to the further question of who you can host with — what big EU cloud providers are there without a us presence) I’m not sure where that leaves the EU, other than possibly hardware in a local data center.
- detaro 5y ago
  That's pretty much what Schrems-II said, yes. This is really not a very surprising finding with that background.
- myrmidon 5y ago
  Note: Hetzner is a german company with one datacenter in Nuremberg. edit: NVM I see your point now, that having any US presence is a problem (and Hetzner has a US datacenter too). So this would probably require massive company fragmentation/restructuring to potentially stay compliant? Really curious how this is gonna turn out.
  - wiredfool 5y ago
    Yeah. Ovh is in the US as well. Basically, given that the US is such a huge market, any provider is going to grow till they are in that market.
- mrweasel 5y ago
  You bring up a very good point: Hetzner potentially made a big mistake by opening US datacenters. We have helped customers who picked Hetzner, because it was legal for them to do so, and because they absolutely knew that their data would be safe in Germany... Now they question how much access the US employees might have. Similarly with OVH. A client is working on migrating stuff to OVH, because they felt confident enough that US employees of OVH would have to easy access to EU data. Then staff at OVH in the US takes down all of OVH for a few hours on a monday, that have made them reconsider.
harel 5y ago
All I know is that at this point I'm getting Cookie Rage every time I have to click on those cookie consent popups. Some are better than others. Some are so bad I give up and leave the site (Admiral, I'm looking at you). It's so annoying I don't even bother reading or thinking about what I'm clicking, which in effect reaches the opposite outcome of what these cookie consents were meant to do. None of them remember my choice, none of them are "not annoying". I get annoyed just "talking" about it...
- changoplatanero 5y ago
  Agreed. The status quo seems not helpful to the majority of people
- noisem4ker 5y ago
  Keep sane and get this browser extension: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
  - bmn__ 5y ago
    Better: https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
    - harel 5y ago
      Thank you both. Sanity might be salvagable!
- DocTomoe 5y ago
  See, you rage against the Cookies - I rage against the braindead politicians who made them basically mandatory and a legal framework that allows malevolent actors to use even slightest hints of (disputable) violations to ruin me if I don't have a banner. It made me a proponent of leaving the EU. Not because I don't think European unity would be beneficial, but because the current implementation is deeply faulty and little more than a convenient scapegoat of national governments pushing through changes they are too afraid of doing at home without democratic oversight.
smarx007 5y ago
I am not sure if Europeans can even take this article seriously after reading about "cookie management requirements apply for EU websites generally" which is wrong in at least three major ways: GDPR is not just about cookies, GDPR is about data processing and its purposes rather than management and storage, and GDPR applies to all websites (including American) who serve European customers. "Per the Court of Justice of the European Union, IP addresses are personal data (the court also considered Cookiebot’s “user key” to be personal data)." They seem to be using the term personal data (correctly) but I cannot help but sense some disdain for it in the writing as if the writer was still thinking personal data being PII (which it's not). A 5-star rating I give a driver is also personal data because it generated by me or obtained from me (and that's why you can get it when you request an export of your data under GDPR). But then the article goes on to nitpick on the definitions: "Because the Wiesbaden court cited the CLOUD Act as a reason to limit U.S.-based services, we note that the claim for “any US connection” is incorrect, because the CLOUD Act only applies under U.S. law where there is possession, custody, or control in the U.S." Possession, custody, or control pretty much covers everything when it comes to cloud computing infra. "NOYB has filed over 100 complaints alleging improper transfers to the U.S., for a range of data analytics and cookie plug-ins that are pervasive in the current online ecosystem." I am a happy supporter of NOYB and glad to see my donation being used well. Though I am a bit worried about being able to use Cloudflare in the future.
avodonosov 5y ago
In a sence it's also a move towards limiting user's freedom to chose where to store data, isn't it? If that develops further, people will be forbidden to store data outside of their country, so that the data can always be requested by local agencies.
- 9dev 5y ago
  I’d rather be a subject to local agencies than being forced to bow to US legislation, which is just a ridiculous overreach.
  - avodonosov 5y ago
    Depends on where you live :)
    - arlcode 5y ago
      Of course. And in some places in the world I definitely would prefer my data being processed far away. But like OP (I assume) I have the privilege to live in a society where, every few years, I have the opportunity to elect our leaders and discussion about laws happens in the public and needs to find a majority in parliament. In the EU my country has a voice and our elected representatives help shape the directives and regulations. While the US is also a democracy, I don't have any influence there at all (which is fine) and my data is foreign and is treated differently than that of US citizens. Furthermore, even if an American company does something blatantly illegal my practical recourses are severely limited by costs and distance (try suing someone in California) I am not ready to accept that when interacting with a local business any data needs to flow across the Atlantic. I really like the idea of having a local independent data handler who operates European infrastructure on behalf of companies like Microsoft did a few years back.
- sc11 5y ago
  > In a sence it's also a move towards limiting user's freedom to chose where to store data, isn't it? It's not, users can of course consent to data being stored elsewhere. The article explicitely points this out: > Instead, the court took the approach that data could only be lawfully transferred to the U.S. via a mutual legal assistance treaty (Article 48 GDPR), or under Article 49 GDPR’s derogations, such as consent. It confined its lawfulness analysis to those grounds alone.
slowmotiony 5y ago
Have the EU cookie regulations actually bring any measurable improvement to anything at all? The only effect I see is that now I have to go through hundreds of cookie related popups that include contracts, ToS and pages of legalese that will never be understood or even read by anyone. I was building a simple website for my team recently and the biggest problem I had was ensuring the compliance of cookies - I had to spend days reading through all kinds of laws and regulations only to eventually end up going through a "Cookie Policy Generator" which produced a 10-page legal text that I dont understand. Apparently I'm not the only one since there are a lot of business that offer "cookie policy management" as a service for companies. Here is the generator if anyone wants to try it out for themselves: https://www.activemind.de/datenschutz/generatoren/datenschutzerklaerung/ https://www.activemind.de/datenschutz/generatoren/datenschut...
- changoplatanero 5y ago
  I wish there was a browser settings where I can indicate that I want to automatically accept all cookies
  - luckylion 5y ago
    There's "I don't care about cookies", a plugin that does essentially that and will just accept all cookies from the common consent platforms. https://addons.mozilla.org/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/firefox/addon/i-dont-care-about-c... https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...
- MayeulC 5y ago
  That's absolutely not the spirit of the law. I suggest you read an intro to the GDPR, or GDPR itself, which is quite approachable. In short: you shouldn't track the user, unless the user opts into it. Cookies are one of the many ways that can be used for tracking. There are other regulation pertaining to data retention, processing, etc. But since you focus on cookies, that's the gist of it. You don't have to ask permission to deposit a login cookie, since that's functional and non-tracking. Using that cookie to track across websites requires consent. Depositing a Google Analytics cookie requires consent. Any website that shows me a cookie popup screams "we want to track you! We collect data on your online behavior and sell it to third parties!"
gmueckl 5y ago
This looks like a temporary injunction only and doesn't by itself establish any precedent. IANAL, but my understanding is that the court usually only evaluates whether that claim of harm is plausible and whether the burden put on the other party is too big to be justified when the final ruling is in their favor. The merits of the main arguments in the case aren't considered - that's what the main trial is for.
j_san 5y ago
As an European that had to deal with GDPR for his own projects this is really no surprise imo. Good that a court rules on this.
fxtentacle 5y ago
This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by hand and then some more on the hidden "legitimate interest" page. Instead, EU websites will now be forced to buy their cookie management from EU providers who adhere to EU privacy laws. So in effect, they are merely putting more of the spirit of the GDPR into laws. And for US providers, they can always open up a local EU subsidy, implement the relevant regulations, and then sell their service to EU customers again. So this is specifically to allow people to circumvent the EU rules by using "I'm an US provider" as an excuse. Also, I like how they called out that transmitting the visitor's IP and referrer URL to a US service might enable them to build a profile which would be legal under US law and illegal under EU law. That's why they now block the transfer of the visitor's information out of the EU in the first place.
- IMTDb 5y ago
  > This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by hand and then some more on the hidden "legitimate interest" page. As a (EU) user, I hate all cookie management popups. And those aren't brought by evil US companies. They a forced by dumb law that tries to "protect" me. This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) and specifically mentions that having a single setting I can tweak is not OK. The amount of thought that has gone in the law to ensure that people are nagged on every. single. page. they. visit. and. that. there. is. no. way. to. shortcut. this. boring. and. useless. process. is maddening...
  - detaro 5y ago
    And behind every nag is a company whose employees decided they'd rather you have the nag experience than not use tracking cookies or respect Do Not Track settings.
    - IMTDb 5y ago
      My "Do Not Track" setting is set to "Authorise Tracking". So companies are respecting that, but they have no choice to still nag me.
swhalen 5y ago
Good. Many "cookie management providers" deliberately act in bad faith. See for example the now standard requirement to "object" to so-called legitimate interest uses of personal data. The GDPR was intended to ban such behaviour and I, for one, welcome seeing the law enforced in line with its general intention.
jeroenhd 5y ago
Good. For the first time, the courts have actually reacted to the death of Privacy Shield and its replacements. These crappy "consent managers" shouldn't exist in the first place, but here we are. The only viable solution would be for the EU and USA to come to an agreement that guarantees privacy for citizens of either jurisdiction. So far, nothing of the sort has been accomplished because the US does not like to give up their power over US companies; I can't say I wouldn't do the same in their position.
- floatingatoll 5y ago
  Setting aside corporate sovereignty, the US government also specializes in collecting personal data without consent, and pays private US companies to do so when privacy protection laws are passed by their leaders. It is not clear whether they have the political will to sign the GDPR or a reasonable equivalent into law, and very rich companies like Google and Verizon would spend their entire fortune suing to stop it block it, suspend it, and otherwise drag their feet in court for a decade.
mschuster91 5y ago
> One significant aspect of the new decision is it seems to prohibit data processing even when the personal data is stored in the EU and never leaves the EU. I don't get why the article is so whiny about the court holding the US companies liable for the permissions the US government gave itself. The US has assumed jurisdiction and is trying / has succeeded ("legally") to kidnap people extraterritorially for decades now - Kim Dotcom, Julian Assange, Alexandra Elbakyan, a whole lot of Russian hackers that had been fake-invited to security conferences or job interviews: none of them has committed crimes on US soil or in an US territory, and yet the US is still trying to get people deported to the US so that they can be tried by the regime. The US government heaps piles of dung upon sovereignty of other countries. The US mega-corporations ignore tax laws wherever they can while destroying local markets with price dumping only affordable because of immense amounts of pension fund money being poured into venture capital. US advertising giants act like European legislation doesn't even affect them. The US threatened to sanction a German harbor for providing services to ships building North Stream 2 (not that I like that project very much, quite to the contrary, but nevertheless it is a disturbing overreach!). The EU is now beginning to assume the US and any entities based in it cannot be trusted for all of these reasons (even if no one says it in the open), and suddenly all the tech companies cry and complain. All I have to say is, the US is at fault here. You made your bed, now sleep in it. Or redirect some of the lobbying budget to campaigns of politicians willing to end the madness.
- detaro 5y ago
  It's also not new with this decision, since it just applies what Schrems-II found.
- Brybry 5y ago
  > immense amounts of pension fund money being poured into venture capital Is this still true? When ERISA was amended/relaxed and most pensions were defined benefits it was probably true. But aren't the vast majority of pension plans defined contribution now? Are defined contribution plans being funneled into venture capital (is that even allowed?) Certainly social security money is not -- they're required to invest that in US treasuries.
edbloom 5y ago
Very interesting. I see lots of hate to CMP's here in the comments (which as an EU consumer I totally get) but I have to ask, what's the alternative? CMP's seem like the least worst solution right now (I'm sure we can debate lots of potential better alternatives that could be baked into the browser - which is where I think this will eventually end up). CookieBot are probably one of the better CMP's I've used, but I'm surprised they haven't yet implemented full EU isolation - which surely is the short term solution here. Fathom have written extensively about their work on EU isolation which I think is very relevant here https://usefathom.com/features/eu-isolation https://usefathom.com/features/eu-isolation
- luckylion 5y ago
  I agree that CMPs are better than everybody rolling their own solution (lots of time wasted by developers and lawyers). However, CookieBot is terrible imho. They delay page load by about a second (!) because their APIs are so slow. Their tech is incredibly fragile, if their crawler has an issue and doesn't crawl your page completely, they'll silently (!) remove all cookies from the consent and leave you completely non-compliant until the next successful crawl (crawls take hours to days and are automatically done once a month). Their support has a response time of 3-5 business days (!) for commercial users and consists of people who barely know the product and definitely don't know anything about web tech. I don't have a favorite vendor in that market, but CookieBot is definitely the worst one I have worked with.
- alkonaut 5y ago
  Why is this even a service that needs to be offloaded to a third party? Implementing this properly obviously requires a ton of work, and no site is going to be able to dodge it by simply putting a banner service in front. Using these automated services that pretend to "automatically" block various categories of cookies is also a ripoof. They use simple keyword searches and similar to try to establish whether a specific script is used for statistics, preferences, etc. A properly implemented banner (i.e. hand-crafted for the site, and obviously updated each time any script is updated) would be pretty expensive to create and maintain. But if one doesn't see that as one of the key purposes of the law (i.e. push web sites towards using fewer of them because the technological and legal overhead is costlier than whatever the gain is) then I think it's being read a bit naively.
deleted 5y ago
[deleted]
michidk 5y ago
So this does mean that you basically are not allowed to use big cloud providers like AWS, Google Cloud and Azure as a company based in the EU. They are going to do so much economical damage with this decision.
- raxxorrax 5y ago
  No it doesn't mean anything like that.
HelloNurse 5y ago
If your company is considering involving foreign "cookie management providers" in the way it handles customer data, it is evidence of bad faith and intent to steal (and keep offshore, e.g. in the USA as described in the article) sensitive information.
- luckylion 5y ago
  These "foreign" CMPs are located in the EU (Denmark in this case) and as such totally legal. There's no evidence of bad faith, no intent to steal and keep anywhere but inside the EU.
  - HelloNurse 5y ago
    I'm afraid a separate company in a different country (or even in the same country) is "offshore" enough to be a barrier to proper compliance to privacy law, and it is clearly an intentional barrier.
    - luckylion 5y ago
      No, it's not. Privacy laws are harmonized in the EU.
dageshi 5y ago
Whether you think it's a good thing or a bad thing, I think eventually sites will look at their viewership from specific countries with additional regulations and simply geoblock them if the economic cost of compliance is more than the advertising gained from them.
- TavsiE9s 5y ago
  After GDPR came in effect a number of smaller, more regional US based newspapers have done exactly that. Too much of a hassle for the smaller players.
deleted 5y ago
[deleted]
Havoc 5y ago
As much as the banner stuff annoys me i am thankful that the EU is at least trying to manage the whole tracking mess against privacy. Far from perfect but at least they’re trying
thecleaner 5y ago
Honestly as long they react to concerns of other businesses who may genuinely need cookies for sessions etc, I admire that the EU is trying to get some experience on tech regulation. Catch is they must be willing to adapt and listen to feedback.
kall 5y ago
Seems appealing to exclusively accept users from Europe using iCloud Private Relay and Sign in with Apple with hidden e-mail and offload this whole shit show to Apple (or Google if they have something like this). Not touching PII (as defined by german courts) with a ten feet pole seems like the only reasonable course of action for a company without a legal department.
- ATsch 5y ago
  I mean, that was an explicit intent of the legislation, making PII a hazard to contain instead of a resource to extract.
  - kall 5y ago
    Yeah, I think that‘s a good idea. The problem is stretching the definition of PII beyond it‘s breaking point to include shortened (!) IP addresses, anonymous identifiers and fingerprintable http headers. Now this forbids the transmission, not the storage, of such data. What‘s even the point anymore?
    - ATsch 5y ago
      This is a really common misunderstanding of the differences between GDPR and US privacy laws. In the US, what is generally regulated is "posession" of data, with narrow definitions of what PII is and no restrictions on anything that isn't. In GDPR, what is regulated instead is the possible justifications for processing of that data. For example, (IANAL caveat aside, speak to an actual privacy lawyer) it is fine for me to store full, unredacted IP addresses in my access logs for diagnostic purposes. However I, for example: - have to be able to provide information on what is stored and under what justification - have to provide information on who that data is transmitted to - have to be able to show an authority it is really necessary for me to store this data unredacted - must put in place adequate measures to protect it - am liable for exposure of that data and may not: - store the data longer than necessary - use that data for other reasons, such as marketing - transmit that data to a third party unless it is contractually bound to the same restrictions as me When something is personal information, the only thing that means is that it is illegal to not have a justification for processing or storing it. So for your example, processing headers is fine, fingerprinting headers is probably not. Recording shortened ip addresses is fine, unnecessarily sending them to the US is probably not. Anonymous identifiers are fine, tracking people with them is probably not, etc.
idhqbfojqbx 5y ago
Judging by several comments in this thread it I feel it's important to highlight the historical dimension of data protection in Germany. The roots of privay rights in post war Germany are mainly in the famous "census ruling" in 1983, where the constitutional court established the right of informational self determinatio, based on Art. 1 (human dignity) in combination with Art. 2 (personal freedom) German Constitution. One of the first acts of the Nazis in 1933 was in fact a census, which partly paved orhanizationally the way to an even greater collection of data and atrocities we're all well aware of. That data protection is a constitutional right has to be seen in this histocial context. If someone is interested here's a deepl translation of passage of the "census ruling": The right to informational self-determination would not be compatible with a social order and a legal order enabling it in which citizens can no longer know who knows what, when and on what occasion about them. Those who are uncertain whether deviant behaviour will be noted at any time and permanently stored, used or passed on as information will try not to attract attention through such behaviour. [...] This would not only impair the individual's chances of development, but also the common good, because self-determination is an elementary functional condition of a free democratic community based on the ability of its citizens to act and participate. It follows from this: Under the modern conditions of data processing, the free development of the personality presupposes the protection of the individual against unlimited collection, storage, use and disclosure of his or her personal data. This protection is therefore encompassed by the fundamental right of Article 2 (1) in conjunction with Article 1 (1) of the Basic Law. In this respect, the fundamental right guarantees the individual's right to determine for himself or herself the disclosure and use of his or her personal data.
speleding 5y ago
This whole mess could be avoided if the EU would ask/force the browser vendors to implement a single setting. Then they can simply ordain that web sites should follow that setting. There are a bunch of details to work out (i.e. what should be the default setting, will this be an HTTP header or some API, what granularity, etc) but I'm sure the end result will be far more beneficial to society than a zillion companies each implementing their own cookie handling logic and researching their own compliance. And I say this as a free market liberal who is skeptical of government intervention.
jefftk 5y ago
Summary: a preliminary ruling from a German court says that you aren't allowed to collect GDPR consent using a US-affiliated service, even if the data never leaves the EU. Their argument is that because, as a US service, it is required under US law to share information in some situations where German law would prohibit it. (Not a lawyer)
deleted 5y ago
[deleted]
cblconfederate 5y ago
As a european i am always baffled by the amount of support that the GDPR cookie laws gets from co-europeans. I understand it as a way to create busywork for lawyers, lowly developers and copywriters but it doesnt provide me anything tangible as a developer in return, nor as a consumer (in fact browsing the web without a anti-anti-cookie browser extension is horrible). What do people get as benefit from all this irrelevant madness? Do people think they are really not being tracked or their communications not spied? And, has it helped european tech in a way that i have missed?
- marcosdumay 5y ago
  > Do people think they are really not being tracked or their communications not spied? I imagine most people think that the companies doing the spying will get a nice fine in the near future. I don't think anybody believes there's no spying, even more because the law also made the spying quite explicit. > And, has it helped european tech in a way that i have missed? I also imagine most believe it has helped European people. I'm not even one and I believe it has helped me.
gigatexal 5y ago
Good. Stop tracking me. It’s creepy. Charge me. Or don’t.
Gasp0de 5y ago
From my (German) point of view it isn't the decision of the German court that prevents American companies from doing business in Europe but rather the ridiculous laws that allow American spy agencies to request data from American companies even if it is saved overseas. Obviously having shitty internet laws will drive internet companies away from a country. The same thing is happening in Australia.
WanderPanda 5y ago
Where is the opt-out? I don‘t want to be „protected“
macco 5y ago
Finally, my hometown on Hacker News :) Sorry, I couldn't resist.
olliej 5y ago
This the obvious result of the CLOUD Act vs the rights of people who aren't Americans. The CLOUD act is built on the presumption that non-americans don't have the right to privacy, and so it includes language to the effect of "you must provide data that you or your subsidiaries have access to". This means Akamai storing data on EU servers is not sufficient (Akamai has access to the data), nor is an EU-based Akamai subsidiary sufficient because the US parent company is required to pass data from their subsidiaries to the US gov. This is a direct result not of EU over-regulation (which I'll admit, they love), but the US government deciding that every company that works overseas should be an extension of their intelligence services.
messutied 5y ago
> This consideration is key, even when Akamai servers are hosted in the EU. Does this mean that for those of us that manage our own cookie banner and overall website in Cloudflare (also US company) will have the same issue? And be deemed unlawful?

306 points by pmlnr 5y ago

Am I reading this incorrectly? This logic seems to apply equally to simply using EU-based servers from a US-based cloud provider for storing EU personal data.

detaro 5y ago
it does, it's just applying the previous rulings saying that to this specific company.

rklaehn 5y ago

So they make a big deal out of cookies, meanwhile you have to show your personal data and medical details to buy a coffee. What a joke. If we do vaccine passports, can we just stop the whole data protection charade completely?

thepangolino 5y ago

[dead]

qwerty456127 5y ago

All "cookie management providers" should be banned. Cookies are meant for a specific website to remember information about a visitor, every website should manage their cookies themselves. Together with the HTTP referer field (and referral URL parameters perhaps, maybe also IP addresses geolocation - this is questionable but let's be honest) first-party cookies are sufficient for all reasonable visitor tracking. Both can be disabled by a user who doesn't want to be tracked but are enabled by default.

deepstack 5y ago
All so all the fingerprinter/css/font/gpu identification. That ought to be illegal, and any provider caught using it ought to be punished.
- asimpletune 5y ago
  I'm all for this, but, um, how?
  - tommek4077 5y ago
    One could just outlaw it. Like theft. It would not hinder you in the first place, but you would could be prosecuted.
    - mellavora 5y ago
      and unlike theft, much easier to establish and prove guilt.
  - deepstack 5y ago
    should be able to guess who is doing it. And if the legal infrastructure is there, it can be quite easy for whistleblower to expose that. This is the reason why user who care about their privacy ought to use only web page that works with No Javascript
  - beberlei 5y ago
    You are thinking like a software engineer that an illegal practice should be completely impossible to do, but socially it always sufficed to just put a reasonably high penalty on something and fine offenders regularly.
    - Sebb767 5y ago
      And, unlike some other computer crimes, it is sufficient to prevent local companies from using the technique. While someone who's hacking or laundering money might simply use a proxy in the Bahamas without problems, a company local company won't risk fines for using it. Sure, companies from far away can still advertise to you via tracking, but the value of their advertisements will go down sharply if no business near you can buy them.
    - ClumsyPilot 5y ago
nomercy400 5y ago
"Cookie Management Providers" are Cookie-Management-As-A-Service. Now it suddenly sounds hip and cloud-based and something your can buy and easily integrate instead of having to develop it in-house. Plus you are able to shift the blame to the "Cookie Management Provider" when issues arise.

kkdaemas 5y ago

Here's an idea for the EU: mandate that all major browsers ship with third-party cookies disabled by default and drop the whole cookie-banner nonsense.

tpush 5y ago
That wouldn't accomplish anything, as cookie banners have to do with tracking and not inherently with third-party cookies. Tracking via first-party cookies is still illegal and would require consent.
perihelions 5y ago
That kind of technical countermeasure only works when you're a statistical minority and adtech doesn't care enough to chase after you. If everyone were to block 3p cookies, the adversary would create new ways to share data on the backend, without clientside involvement, and we'd be right back where we started (other a small increase in friction).
zeepzeep 5y ago
Other idea: make browsers have a proper cookie banner and not one that tricks me into selling my soul, I never got why pages would need individual banners.
- IMTDb 5y ago
  Please don't force browsers (clients) to fix what's fundamentally a server side (website doing shit with your data) issue. Browser can choose to respect the cookies (first, or third parties), but ultimately don't force them to do or not do anything.
  - zeepzeep 5y ago
    Forcing 3 companies to change their browsers is a lot easier than forcing millions of shady US businesses to do anything
    - 5y ago

KarlKemp 5y ago

The problem here is that a website is built in such a way that implementing the (admittedly annoying) cookie consent mechanisms goes through three different subcontractors/API providers. The needless dispersion of your users’ browsing history is in itself disrespectful. Yes, privacy regulation do make life complicated if you choose to ignore their core, and instead create some Frankensteinian caricature of an infrastructure to continue doing business exactly as before.

zeepzeep 5y ago
> Yes, privacy regulation do make life complicated if you choose to ignore their core Yes, 100%, it is relatively easy to just not track your ~~victims~~ customers every move.
mrweasel 5y ago
I also find the "We care about your privacy" message disrespectful, when the next step is "Please allow us to share information about you with these 628 other companies". Those two sentences are complete opposites.

pixelpoet 5y ago

I hope they fine the everliving crap out of these platforms that go "oh suuuure you can opt out of all this tracking, just spend 5 days turning off millions of individual settings in this maximally inconvenient dialog!"

Ekaros 5y ago
And do not forget these blatantly illegal "legitimate interest"... Which I have to manually turn off after turning of the rest...
- phh 5y ago
  I still haven't understood those. Can you explain it to me please?
  - g_p 5y ago
    "Legitimate interest" is a grounds for data processing under GDPR. Someone seemed to cotton on to the (incorrect, per my understanding) notion that it was applicable to placement of cookies. That's covered by the ePrivacy Directive (and national implementing laws), and they don't make any provision for "legitimate interest". Nonetheless, regulators move slowly, and companies want cookies. Having this gives them two bites at the same cherry (in their eyes), and enforcement is a long way off, and unlikely to scale. While not EU any more, the UK ICO guidance is really clear on their implementation of the ePrivacy Directive - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... There's only 2 exceptions to the strict requirement for consent - to communicate the data to the user, and to deliver functionality directly requested (i.e. shopping basket, login session). But enough people try to claim "legitimate interest" that others think it's OK...
    - matheusmoreira 5y ago
      Advertising is hereby declared an illegitimate interest. Awesome!

paull39 5y ago

Cookies are especially important at Christmas. They taste good but it's best to bake your own. This topic is important but I guess it's so behind to today's fingerprinting that this whole topic is getting polemic.

milicat 5y ago
I'd guess fingerprinting without consent is also illegal under these regulations, but may be harder to persecute.
zeepzeep 5y ago
> so behind to today's fingerprinting Yes that's the sad thing, they do not need cookies anymore.
ratww 5y ago
GDPR doesn't say anything about cookies other than in examples. Fingerprinting, identification via IP, localStorage, all are equivalent under it. "Cookie Banner" is an industry term, which is incorrect.

pantulis 5y ago

"Here, however, the court reasoned that since data “are processed on Akamai servers, a data transfer to a third country is occurring,” simply because “Akamai Technologies Inc., as an American company, is subject to the CLOUD Act.”" This consideration is key, even when Akamai servers are hosted in the EU.

runarb 5y ago
> This consideration is key, even when Akamai servers are hosted in the EU. Is the fix as easy as that Akamai creating a subsidiary in the EU? I am in the EU and use AWS a lot, but I am not a customer of Amazon Inc. Instead, it sees this on the bill as who is the seller: "Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg".
- fxtentacle 5y ago
  Yes it is. The whole point of that decision is to make sure Akamai cannot says "we're an US entity, so EU privacy laws don't apply to us". That's why they are now forced to create a local subsidy, which will then be forced to follow local laws.
  - detaro 5y ago
    Akamai did not claim "EU privacy laws don't apply to us", and that's really not what the case is about.
  - akie 5y ago
    The way I read the article, this will only work if the EU entity is legally able to tell the parent US entity to "get lost" in case the US government has decided it wants something from the EU entity. So it needs to be truly independent, at least that's the sense I got from the court's decision.
    - gls2ro 5y ago
      IANAL but I dont think a parent company can ask a local branch to not follow local rules. So for example if in EU is forbidden to store information without consent the local branch cannot do that on EU servers.

jstummbillig 5y ago

I recently spent an inordinate amount of time implementing effective self-hosted cookie control (as in: actually deferring loading of offending scripts until after being accepted, and then loading and executing after being accepted without having to trigger a page reload) It would be absolutely asinine to assume that a layman could understand, much less implement the currently available solutions in an effective manner, so here are the two scenarios that small businesses are faced with: a) They still wanna make use of cookie powered tech and just do it without consent, which opens them up to legal trouble b) They don't do it and give up on functionality, which big biz will be able to provide, putting them at a disadvantage and making the web less democratic in the process once again. While I have no particular thoughts about the type of providers targeted here, I am certain that the last thing the current setup needs is additional complication.

tommek4077 5y ago
What functionality would that be? Anything else than targeted ads?
- jstummbillig 5y ago
  Whatever you want to use Cookies for. Analytics probably most of the time. I don't think small businesses typically run targeted ads on their own websites.
  - smarx007 5y ago
    I think that could actually be a problem. NOYB, a nonprofit GDPR watchdog in Austria, has firmly set its sights in enforcement on Google Analytics and Facebook/Twitter buttons because they are easy to remove. I think small mom&pop shops would have to go back to getting analytics via web server logs. Even small hosters like https://www.dogado.de/website/hosting https://www.dogado.de/website/hosting (wanted to actually link to CampusSpeicher but they seem to have been acquired) offer this (see under Highlights > Website-Statistiken). To be clear, NOYB allows 60 days after notification for removal (instead of 30 allowed by the law) before complaining to the national data protection agency and even then agencies rarely give out serious fines if you are ready to comply and did not grossly misuse the data, at least in Sweden: https://www.enforcementtracker.com https://www.enforcementtracker.com.

splintercell 5y ago

People may not like hearing this but this whole cookie issue is American capitalists fighting European bureaucrats and I know the former will win. On an even more fundamental level this is a conflict between American legal system of common law vs European statutory legal system.

dariosalvi78 5y ago
At least for now it seems that most American companies are trying to respect the gdpr instead of fighting it, so I am not sure that the American capitalism will win this battle.
jetsetgo 5y ago

dariosalvi78 5y ago

If confirmed, this implies that the use of any provider that could in theory bring the data to a third country should be avoided.

marginalia_nu 5y ago
That's largely already a consequence of Schrems II.
tiedemann 5y ago
If that third country has something like the CLOUD Act, then yes.
speedgoose 5y ago
It's actually already the case but everyone prefers to put their heads in the sand and hope for the best. It's not like we have real alternatives to AWS or Azure in Europe right now.
- dmitriid 5y ago
  AWS/GCP/Azure are very keen on keeping the business in Europe, so they have European datacenters, try to keep them GDPR-and-other-laws-compilant, and will even sign a legally binding agreement with you swearing to keep all data on EU servers only.
  - speedgoose 5y ago
    Yeah they do that. But at the same time they have the patriot act law to respect, and the European privacy shield is dead. So right now it's challenging to know whether using Azure is GDPR compliant or not. Most people I talked with on this topic think it's probably not compliant, but they prefer to wait and pay a fine if necessary as they are not lawyers.
  - kall 5y ago
    The Azure service fully operated by Deutsche Telekom seems pretty appealing right about now, but as far as I know they cancelled that. Maybe cloud providers will move to a kind of franchise model, effectively allowing smaller European companies to license an Outposts type software.

onion2k 5y ago

The cookie banner on iapp.org is provided by OneTrust via cookiepro.org[1]. This thing figures out your location (by IP address) and displays a banner at the bottom of the page with specific buttons for the laws based on where you live. It captures data from around 42k websites[2], with a unique user-specific ID, so OneTrust can track people across all those sites. If OneTrust operate other services, or if they share the data with other organizations, they can track you more widely. Cookie banners that seek to improve privacy for users by limiting what third parties can do have become another way to track people. Limiting the activity of cookie banner providers would not be a terrible idea. [1] https://www.cookiepro.com/products/cookie-consent/ https://www.cookiepro.com/products/cookie-consent/ [2] https://cookiepedia.co.uk/host/cookielaw.org https://cookiepedia.co.uk/host/cookielaw.org

milicat 5y ago

The law here is totally reasonable to protect people's right to data privacy. It's just that every damn website is trying its best to trick their users into consenting despite the law. Half the solution look illegal anyway, as you can't deny cookies with a single click. Plus the US Cloud Act is an authoritarian overreach and rightfully gives US providers a competitive disadvantage.

kall 5y ago
I too think these consent solutions are problematic, but the law as it is use here is a catastrophic overreach, if applied broadly. If you take the article at face value, it is illegal to create any kind of TCP/IP connection with a server that is operated by a company which does not operate exclusively in the EU. This is a strong interpretation, but it‘s really not far off from what the court did here: they declared it illegal that an IP Adress (!) was transmitted (not stored?) to a company that could potentially (?) be subject to non EU subpoenas. If NOYB managed to make the entire internet illegal just so they have a sharp axe to go after the things they don‘t like (Google Analytics, cookie "consent" banners), congratulations. They have built a slope so slippery it should have an ICU at the bottom.
- bbu 5y ago
  It’s not noyb who built the slope, it’s the ever greedy companies trying to trick people I to all kinds of shady shit. Everything they get they deserve and I truly hope trustarc, onetrust and whatever their names are end up in bankruptcy.
  - kall 5y ago
    Sure those companies can go to hell, but is it really worth it? In my view there is no crime bad enough that it justifies having laws on the books that criminalize everyone just so we can selectively enforce them against the bad ones.
  - kall 5y ago
    Sure those companies can go to hell, but is it really worth it? In my view there is no crime bad enough that it justifies having laws on the books that criminalize everyone just so we can selectively enforce them against the bad ones. It may be worth noting that this doesn‘t involve a fine, only that they cease the activity. That is my personal silver lining as someone operating services within the EU that clearly are not lawful.

thejackgoode 5y ago

I am ambivalent and torn about what to think of European digital policies. On one hand there's GDPR and regulations like these that are absolutely overdue and EU is probably the only entity in the world who can improve situation given the current meta. On other hand, there's encryption regulation and absurd piracy strictness. Please someone with a formed perspective tell what's happening? What is a general vector of European policy on the internet?

zeepzeep 5y ago
> formed perspective I do not think I really qualify but hey. > What is a general vector of European policy on the internet? Generally the EU is very pro-privacy but sadly companies like Facebook bribe our "data protection officers" (sorry idk how to translate) and individual EU countries also just break the EU law on a regular.
- martijnvds 5y ago
  They're called "data protection authorities" or "data protection commissions", and because lots of US tech companies are incorporated in Ireland, they get to "use" the Irish DPC. And they're not very good at their job (or maybe they are, if you're Facebook): https://www.euractiv.com/section/data-protection/news/irelands-privacy-watchdog-accused-of-paralysing-gdpr-enforcement/ https://www.euractiv.com/section/data-protection/news/irelan...
dane-pgp 5y ago
> On other hand, there's encryption regulation and absurd piracy strictness. Could you give an example of an EU regulation which actually restricts encryption? There have certainly been discussions about adding backdoors to encryption (as is typical for any jurisdiction that doesn't have them), but my understanding is that these proposals have reached a dead end. Here's an update from last week: > The lead committee for the internal market and consumer protection (IMCO) in the EU Parliament spoke out on Monday evening with a large majority with its current position on the planned Digital Services Act (DSA). ... It also includes the right to end-to-end encryption. “The member states must not prevent providers of switching services from offering end-to-end encrypted services,” demanded the representatives. This is essential for trust in the network and cybersecurity. https://marketresearchtelecast.com/digital-basic-law-eu-mps-for-identification-requirements-for-porn-uploads/226325/ https://marketresearchtelecast.com/digital-basic-law-eu-mps-...

uniqueuid 5y ago

Before the discussion descends into the usual "that's stupid and will kill all tech startups" vs. "that's right because all cookies are evil incarnate", I'll say again: This is a perfect example of the kind of legal processes we have now. The EU and Germany in particular have decades of privacy regulation and core values behind them. These core values won't change. Regulation for the past decades has ignored that tech routinely violates these values, and it's catching up now. Rules won't be as dramatic as in the past, but will differ widely from the us. In this context, it's legally important to account for entrepreneurial freedom (guaranteed by the constitution), but if there's an overriding reason to protect consumers, then it is entirely irrelevant how long companies have been doing this, how many do this and in what other countries they do it. To sum up, the law sometimes bites late, but it bites hard, and arguments surrounding competitiveness, business culture or internet culture are legally completely irrelevant.

nkmnz 5y ago
The arguments you list in the end are not legal arguments, but political ones, so it’s not a big surprise they are „legally completely irrelevant“ - unless politics turns them into law.
sokoloff 5y ago
“The wheels of justice turn slowly, but grind exceedingly fine.”
- selfhoster11 5y ago
  Except when it gets stuck on monopolies and oligopolies, but that's not a problem, right?
  - uniqueuid 5y ago
    They also grind very selectively. The fundamental hope that democracy is based upon is that they will eventually (in finite time) grind all problems, even if not right away.

wiredfool 5y ago

The scope here is far, far higher than cookie management providers, If the scope is that a company with a us presence can’t have extraordinary access to data. Google analytics is going to be essentially outlawed in the EU. Hosting with any company with a US presence is going to be questionable. No Aws, Google Cloud, Digital Ocean, linode, azure, hetzner… (Leading to the further question of who you can host with — what big EU cloud providers are there without a us presence) I’m not sure where that leaves the EU, other than possibly hardware in a local data center.

detaro 5y ago
That's pretty much what Schrems-II said, yes. This is really not a very surprising finding with that background.
myrmidon 5y ago
Note: Hetzner is a german company with one datacenter in Nuremberg. edit: NVM I see your point now, that having any US presence is a problem (and Hetzner has a US datacenter too). So this would probably require massive company fragmentation/restructuring to potentially stay compliant? Really curious how this is gonna turn out.
- wiredfool 5y ago
  Yeah. Ovh is in the US as well. Basically, given that the US is such a huge market, any provider is going to grow till they are in that market.
mrweasel 5y ago
You bring up a very good point: Hetzner potentially made a big mistake by opening US datacenters. We have helped customers who picked Hetzner, because it was legal for them to do so, and because they absolutely knew that their data would be safe in Germany... Now they question how much access the US employees might have. Similarly with OVH. A client is working on migrating stuff to OVH, because they felt confident enough that US employees of OVH would have to easy access to EU data. Then staff at OVH in the US takes down all of OVH for a few hours on a monday, that have made them reconsider.

harel 5y ago

All I know is that at this point I'm getting Cookie Rage every time I have to click on those cookie consent popups. Some are better than others. Some are so bad I give up and leave the site (Admiral, I'm looking at you). It's so annoying I don't even bother reading or thinking about what I'm clicking, which in effect reaches the opposite outcome of what these cookie consents were meant to do. None of them remember my choice, none of them are "not annoying". I get annoyed just "talking" about it...

changoplatanero 5y ago
Agreed. The status quo seems not helpful to the majority of people
noisem4ker 5y ago
Keep sane and get this browser extension: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- bmn__ 5y ago
  Better: https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
  - harel 5y ago
    Thank you both. Sanity might be salvagable!
DocTomoe 5y ago
See, you rage against the Cookies - I rage against the braindead politicians who made them basically mandatory and a legal framework that allows malevolent actors to use even slightest hints of (disputable) violations to ruin me if I don't have a banner. It made me a proponent of leaving the EU. Not because I don't think European unity would be beneficial, but because the current implementation is deeply faulty and little more than a convenient scapegoat of national governments pushing through changes they are too afraid of doing at home without democratic oversight.

smarx007 5y ago

I am not sure if Europeans can even take this article seriously after reading about "cookie management requirements apply for EU websites generally" which is wrong in at least three major ways: GDPR is not just about cookies, GDPR is about data processing and its purposes rather than management and storage, and GDPR applies to all websites (including American) who serve European customers. "Per the Court of Justice of the European Union, IP addresses are personal data (the court also considered Cookiebot’s “user key” to be personal data)." They seem to be using the term personal data (correctly) but I cannot help but sense some disdain for it in the writing as if the writer was still thinking personal data being PII (which it's not). A 5-star rating I give a driver is also personal data because it generated by me or obtained from me (and that's why you can get it when you request an export of your data under GDPR). But then the article goes on to nitpick on the definitions: "Because the Wiesbaden court cited the CLOUD Act as a reason to limit U.S.-based services, we note that the claim for “any US connection” is incorrect, because the CLOUD Act only applies under U.S. law where there is possession, custody, or control in the U.S." Possession, custody, or control pretty much covers everything when it comes to cloud computing infra. "NOYB has filed over 100 complaints alleging improper transfers to the U.S., for a range of data analytics and cookie plug-ins that are pervasive in the current online ecosystem." I am a happy supporter of NOYB and glad to see my donation being used well. Though I am a bit worried about being able to use Cloudflare in the future.

avodonosov 5y ago

In a sence it's also a move towards limiting user's freedom to chose where to store data, isn't it? If that develops further, people will be forbidden to store data outside of their country, so that the data can always be requested by local agencies.

9dev 5y ago
I’d rather be a subject to local agencies than being forced to bow to US legislation, which is just a ridiculous overreach.
- avodonosov 5y ago
  Depends on where you live :)
  - arlcode 5y ago
    Of course. And in some places in the world I definitely would prefer my data being processed far away. But like OP (I assume) I have the privilege to live in a society where, every few years, I have the opportunity to elect our leaders and discussion about laws happens in the public and needs to find a majority in parliament. In the EU my country has a voice and our elected representatives help shape the directives and regulations. While the US is also a democracy, I don't have any influence there at all (which is fine) and my data is foreign and is treated differently than that of US citizens. Furthermore, even if an American company does something blatantly illegal my practical recourses are severely limited by costs and distance (try suing someone in California) I am not ready to accept that when interacting with a local business any data needs to flow across the Atlantic. I really like the idea of having a local independent data handler who operates European infrastructure on behalf of companies like Microsoft did a few years back.
sc11 5y ago
> In a sence it's also a move towards limiting user's freedom to chose where to store data, isn't it? It's not, users can of course consent to data being stored elsewhere. The article explicitely points this out: > Instead, the court took the approach that data could only be lawfully transferred to the U.S. via a mutual legal assistance treaty (Article 48 GDPR), or under Article 49 GDPR’s derogations, such as consent. It confined its lawfulness analysis to those grounds alone.

slowmotiony 5y ago

Have the EU cookie regulations actually bring any measurable improvement to anything at all? The only effect I see is that now I have to go through hundreds of cookie related popups that include contracts, ToS and pages of legalese that will never be understood or even read by anyone. I was building a simple website for my team recently and the biggest problem I had was ensuring the compliance of cookies - I had to spend days reading through all kinds of laws and regulations only to eventually end up going through a "Cookie Policy Generator" which produced a 10-page legal text that I dont understand. Apparently I'm not the only one since there are a lot of business that offer "cookie policy management" as a service for companies. Here is the generator if anyone wants to try it out for themselves: https://www.activemind.de/datenschutz/generatoren/datenschutzerklaerung/ https://www.activemind.de/datenschutz/generatoren/datenschut...

changoplatanero 5y ago
I wish there was a browser settings where I can indicate that I want to automatically accept all cookies
- luckylion 5y ago
  There's "I don't care about cookies", a plugin that does essentially that and will just accept all cookies from the common consent platforms. https://addons.mozilla.org/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/firefox/addon/i-dont-care-about-c... https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...
MayeulC 5y ago
That's absolutely not the spirit of the law. I suggest you read an intro to the GDPR, or GDPR itself, which is quite approachable. In short: you shouldn't track the user, unless the user opts into it. Cookies are one of the many ways that can be used for tracking. There are other regulation pertaining to data retention, processing, etc. But since you focus on cookies, that's the gist of it. You don't have to ask permission to deposit a login cookie, since that's functional and non-tracking. Using that cookie to track across websites requires consent. Depositing a Google Analytics cookie requires consent. Any website that shows me a cookie popup screams "we want to track you! We collect data on your online behavior and sell it to third parties!"

gmueckl 5y ago

This looks like a temporary injunction only and doesn't by itself establish any precedent. IANAL, but my understanding is that the court usually only evaluates whether that claim of harm is plausible and whether the burden put on the other party is too big to be justified when the final ruling is in their favor. The merits of the main arguments in the case aren't considered - that's what the main trial is for.

j_san 5y ago

As an European that had to deal with GDPR for his own projects this is really no surprise imo. Good that a court rules on this.

fxtentacle 5y ago

This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by hand and then some more on the hidden "legitimate interest" page. Instead, EU websites will now be forced to buy their cookie management from EU providers who adhere to EU privacy laws. So in effect, they are merely putting more of the spirit of the GDPR into laws. And for US providers, they can always open up a local EU subsidy, implement the relevant regulations, and then sell their service to EU customers again. So this is specifically to allow people to circumvent the EU rules by using "I'm an US provider" as an excuse. Also, I like how they called out that transmitting the visitor's IP and referrer URL to a US service might enable them to build a profile which would be legal under US law and illegal under EU law. That's why they now block the transfer of the visitor's information out of the EU in the first place.

IMTDb 5y ago
> This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by hand and then some more on the hidden "legitimate interest" page. As a (EU) user, I hate all cookie management popups. And those aren't brought by evil US companies. They a forced by dumb law that tries to "protect" me. This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) and specifically mentions that having a single setting I can tweak is not OK. The amount of thought that has gone in the law to ensure that people are nagged on every. single. page. they. visit. and. that. there. is. no. way. to. shortcut. this. boring. and. useless. process. is maddening...
- detaro 5y ago
  And behind every nag is a company whose employees decided they'd rather you have the nag experience than not use tracking cookies or respect Do Not Track settings.
  - IMTDb 5y ago
    My "Do Not Track" setting is set to "Authorise Tracking". So companies are respecting that, but they have no choice to still nag me.

swhalen 5y ago

Good. Many "cookie management providers" deliberately act in bad faith. See for example the now standard requirement to "object" to so-called legitimate interest uses of personal data. The GDPR was intended to ban such behaviour and I, for one, welcome seeing the law enforced in line with its general intention.

jeroenhd 5y ago

Good. For the first time, the courts have actually reacted to the death of Privacy Shield and its replacements. These crappy "consent managers" shouldn't exist in the first place, but here we are. The only viable solution would be for the EU and USA to come to an agreement that guarantees privacy for citizens of either jurisdiction. So far, nothing of the sort has been accomplished because the US does not like to give up their power over US companies; I can't say I wouldn't do the same in their position.

floatingatoll 5y ago
Setting aside corporate sovereignty, the US government also specializes in collecting personal data without consent, and pays private US companies to do so when privacy protection laws are passed by their leaders. It is not clear whether they have the political will to sign the GDPR or a reasonable equivalent into law, and very rich companies like Google and Verizon would spend their entire fortune suing to stop it block it, suspend it, and otherwise drag their feet in court for a decade.

mschuster91 5y ago

> One significant aspect of the new decision is it seems to prohibit data processing even when the personal data is stored in the EU and never leaves the EU. I don't get why the article is so whiny about the court holding the US companies liable for the permissions the US government gave itself. The US has assumed jurisdiction and is trying / has succeeded ("legally") to kidnap people extraterritorially for decades now - Kim Dotcom, Julian Assange, Alexandra Elbakyan, a whole lot of Russian hackers that had been fake-invited to security conferences or job interviews: none of them has committed crimes on US soil or in an US territory, and yet the US is still trying to get people deported to the US so that they can be tried by the regime. The US government heaps piles of dung upon sovereignty of other countries. The US mega-corporations ignore tax laws wherever they can while destroying local markets with price dumping only affordable because of immense amounts of pension fund money being poured into venture capital. US advertising giants act like European legislation doesn't even affect them. The US threatened to sanction a German harbor for providing services to ships building North Stream 2 (not that I like that project very much, quite to the contrary, but nevertheless it is a disturbing overreach!). The EU is now beginning to assume the US and any entities based in it cannot be trusted for all of these reasons (even if no one says it in the open), and suddenly all the tech companies cry and complain. All I have to say is, the US is at fault here. You made your bed, now sleep in it. Or redirect some of the lobbying budget to campaigns of politicians willing to end the madness.

detaro 5y ago
It's also not new with this decision, since it just applies what Schrems-II found.
Brybry 5y ago
> immense amounts of pension fund money being poured into venture capital Is this still true? When ERISA was amended/relaxed and most pensions were defined benefits it was probably true. But aren't the vast majority of pension plans defined contribution now? Are defined contribution plans being funneled into venture capital (is that even allowed?) Certainly social security money is not -- they're required to invest that in US treasuries.

edbloom 5y ago

Very interesting. I see lots of hate to CMP's here in the comments (which as an EU consumer I totally get) but I have to ask, what's the alternative? CMP's seem like the least worst solution right now (I'm sure we can debate lots of potential better alternatives that could be baked into the browser - which is where I think this will eventually end up). CookieBot are probably one of the better CMP's I've used, but I'm surprised they haven't yet implemented full EU isolation - which surely is the short term solution here. Fathom have written extensively about their work on EU isolation which I think is very relevant here https://usefathom.com/features/eu-isolation https://usefathom.com/features/eu-isolation

luckylion 5y ago
I agree that CMPs are better than everybody rolling their own solution (lots of time wasted by developers and lawyers). However, CookieBot is terrible imho. They delay page load by about a second (!) because their APIs are so slow. Their tech is incredibly fragile, if their crawler has an issue and doesn't crawl your page completely, they'll silently (!) remove all cookies from the consent and leave you completely non-compliant until the next successful crawl (crawls take hours to days and are automatically done once a month). Their support has a response time of 3-5 business days (!) for commercial users and consists of people who barely know the product and definitely don't know anything about web tech. I don't have a favorite vendor in that market, but CookieBot is definitely the worst one I have worked with.
alkonaut 5y ago
Why is this even a service that needs to be offloaded to a third party? Implementing this properly obviously requires a ton of work, and no site is going to be able to dodge it by simply putting a banner service in front. Using these automated services that pretend to "automatically" block various categories of cookies is also a ripoof. They use simple keyword searches and similar to try to establish whether a specific script is used for statistics, preferences, etc. A properly implemented banner (i.e. hand-crafted for the site, and obviously updated each time any script is updated) would be pretty expensive to create and maintain. But if one doesn't see that as one of the key purposes of the law (i.e. push web sites towards using fewer of them because the technological and legal overhead is costlier than whatever the gain is) then I think it's being read a bit naively.

deleted 5y ago

[deleted]

michidk 5y ago

So this does mean that you basically are not allowed to use big cloud providers like AWS, Google Cloud and Azure as a company based in the EU. They are going to do so much economical damage with this decision.

raxxorrax 5y ago
No it doesn't mean anything like that.

HelloNurse 5y ago

If your company is considering involving foreign "cookie management providers" in the way it handles customer data, it is evidence of bad faith and intent to steal (and keep offshore, e.g. in the USA as described in the article) sensitive information.

luckylion 5y ago
These "foreign" CMPs are located in the EU (Denmark in this case) and as such totally legal. There's no evidence of bad faith, no intent to steal and keep anywhere but inside the EU.
- HelloNurse 5y ago
  I'm afraid a separate company in a different country (or even in the same country) is "offshore" enough to be a barrier to proper compliance to privacy law, and it is clearly an intentional barrier.
  - luckylion 5y ago
    No, it's not. Privacy laws are harmonized in the EU.

dageshi 5y ago

Whether you think it's a good thing or a bad thing, I think eventually sites will look at their viewership from specific countries with additional regulations and simply geoblock them if the economic cost of compliance is more than the advertising gained from them.

TavsiE9s 5y ago
After GDPR came in effect a number of smaller, more regional US based newspapers have done exactly that. Too much of a hassle for the smaller players.

deleted 5y ago

[deleted]

Havoc 5y ago

As much as the banner stuff annoys me i am thankful that the EU is at least trying to manage the whole tracking mess against privacy. Far from perfect but at least they’re trying

thecleaner 5y ago

Honestly as long they react to concerns of other businesses who may genuinely need cookies for sessions etc, I admire that the EU is trying to get some experience on tech regulation. Catch is they must be willing to adapt and listen to feedback.

kall 5y ago

Seems appealing to exclusively accept users from Europe using iCloud Private Relay and Sign in with Apple with hidden e-mail and offload this whole shit show to Apple (or Google if they have something like this). Not touching PII (as defined by german courts) with a ten feet pole seems like the only reasonable course of action for a company without a legal department.

ATsch 5y ago
I mean, that was an explicit intent of the legislation, making PII a hazard to contain instead of a resource to extract.
- kall 5y ago
  Yeah, I think that‘s a good idea. The problem is stretching the definition of PII beyond it‘s breaking point to include shortened (!) IP addresses, anonymous identifiers and fingerprintable http headers. Now this forbids the transmission, not the storage, of such data. What‘s even the point anymore?
  - ATsch 5y ago
    This is a really common misunderstanding of the differences between GDPR and US privacy laws. In the US, what is generally regulated is "posession" of data, with narrow definitions of what PII is and no restrictions on anything that isn't. In GDPR, what is regulated instead is the possible justifications for processing of that data. For example, (IANAL caveat aside, speak to an actual privacy lawyer) it is fine for me to store full, unredacted IP addresses in my access logs for diagnostic purposes. However I, for example: - have to be able to provide information on what is stored and under what justification - have to provide information on who that data is transmitted to - have to be able to show an authority it is really necessary for me to store this data unredacted - must put in place adequate measures to protect it - am liable for exposure of that data and may not: - store the data longer than necessary - use that data for other reasons, such as marketing - transmit that data to a third party unless it is contractually bound to the same restrictions as me When something is personal information, the only thing that means is that it is illegal to not have a justification for processing or storing it. So for your example, processing headers is fine, fingerprinting headers is probably not. Recording shortened ip addresses is fine, unnecessarily sending them to the US is probably not. Anonymous identifiers are fine, tracking people with them is probably not, etc.

idhqbfojqbx 5y ago

Judging by several comments in this thread it I feel it's important to highlight the historical dimension of data protection in Germany. The roots of privay rights in post war Germany are mainly in the famous "census ruling" in 1983, where the constitutional court established the right of informational self determinatio, based on Art. 1 (human dignity) in combination with Art. 2 (personal freedom) German Constitution. One of the first acts of the Nazis in 1933 was in fact a census, which partly paved orhanizationally the way to an even greater collection of data and atrocities we're all well aware of. That data protection is a constitutional right has to be seen in this histocial context. If someone is interested here's a deepl translation of passage of the "census ruling": The right to informational self-determination would not be compatible with a social order and a legal order enabling it in which citizens can no longer know who knows what, when and on what occasion about them. Those who are uncertain whether deviant behaviour will be noted at any time and permanently stored, used or passed on as information will try not to attract attention through such behaviour. [...] This would not only impair the individual's chances of development, but also the common good, because self-determination is an elementary functional condition of a free democratic community based on the ability of its citizens to act and participate. It follows from this: Under the modern conditions of data processing, the free development of the personality presupposes the protection of the individual against unlimited collection, storage, use and disclosure of his or her personal data. This protection is therefore encompassed by the fundamental right of Article 2 (1) in conjunction with Article 1 (1) of the Basic Law. In this respect, the fundamental right guarantees the individual's right to determine for himself or herself the disclosure and use of his or her personal data.

speleding 5y ago

This whole mess could be avoided if the EU would ask/force the browser vendors to implement a single setting. Then they can simply ordain that web sites should follow that setting. There are a bunch of details to work out (i.e. what should be the default setting, will this be an HTTP header or some API, what granularity, etc) but I'm sure the end result will be far more beneficial to society than a zillion companies each implementing their own cookie handling logic and researching their own compliance. And I say this as a free market liberal who is skeptical of government intervention.

jefftk 5y ago

Summary: a preliminary ruling from a German court says that you aren't allowed to collect GDPR consent using a US-affiliated service, even if the data never leaves the EU. Their argument is that because, as a US service, it is required under US law to share information in some situations where German law would prohibit it. (Not a lawyer)

deleted 5y ago

[deleted]

cblconfederate 5y ago

As a european i am always baffled by the amount of support that the GDPR cookie laws gets from co-europeans. I understand it as a way to create busywork for lawyers, lowly developers and copywriters but it doesnt provide me anything tangible as a developer in return, nor as a consumer (in fact browsing the web without a anti-anti-cookie browser extension is horrible). What do people get as benefit from all this irrelevant madness? Do people think they are really not being tracked or their communications not spied? And, has it helped european tech in a way that i have missed?

marcosdumay 5y ago
> Do people think they are really not being tracked or their communications not spied? I imagine most people think that the companies doing the spying will get a nice fine in the near future. I don't think anybody believes there's no spying, even more because the law also made the spying quite explicit. > And, has it helped european tech in a way that i have missed? I also imagine most believe it has helped European people. I'm not even one and I believe it has helped me.

gigatexal 5y ago

Good. Stop tracking me. It’s creepy. Charge me. Or don’t.

Gasp0de 5y ago

From my (German) point of view it isn't the decision of the German court that prevents American companies from doing business in Europe but rather the ridiculous laws that allow American spy agencies to request data from American companies even if it is saved overseas. Obviously having shitty internet laws will drive internet companies away from a country. The same thing is happening in Australia.

WanderPanda 5y ago

Where is the opt-out? I don‘t want to be „protected“

macco 5y ago

Finally, my hometown on Hacker News :) Sorry, I couldn't resist.

olliej 5y ago

This the obvious result of the CLOUD Act vs the rights of people who aren't Americans. The CLOUD act is built on the presumption that non-americans don't have the right to privacy, and so it includes language to the effect of "you must provide data that you or your subsidiaries have access to". This means Akamai storing data on EU servers is not sufficient (Akamai has access to the data), nor is an EU-based Akamai subsidiary sufficient because the US parent company is required to pass data from their subsidiaries to the US gov. This is a direct result not of EU over-regulation (which I'll admit, they love), but the US government deciding that every company that works overseas should be an extension of their intelligence services.

messutied 5y ago

> This consideration is key, even when Akamai servers are hosted in the EU. Does this mean that for those of us that manage our own cookie banner and overall website in Cloudflare (also US company) will have the same issue? And be deemed unlawful?