4 ms·

I still haven't understood those. Can you explain it to me please?

by phh 5y ago

g_p 5y ago
"Legitimate interest" is a grounds for data processing under GDPR. Someone seemed to cotton on to the (incorrect, per my understanding) notion that it was applicable to placement of cookies. That's covered by the ePrivacy Directive (and national implementing laws), and they don't make any provision for "legitimate interest". Nonetheless, regulators move slowly, and companies want cookies. Having this gives them two bites at the same cherry (in their eyes), and enforcement is a long way off, and unlikely to scale. While not EU any more, the UK ICO guidance is really clear on their implementation of the ePrivacy Directive - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... There's only 2 exceptions to the strict requirement for consent - to communicate the data to the user, and to deliver functionality directly requested (i.e. shopping basket, login session). But enough people try to claim "legitimate interest" that others think it's OK...
- matheusmoreira 5y ago
  Advertising is hereby declared an illegitimate interest. Awesome!
- alkonaut 5y ago
  > enforcement is a long way off, and unlikely to scale. Companies want cookies because it gives them an expected economic profit. The expected profit minus the expected fine (risk of a fine times its expected size) is the expected net. To make this equation result in a negative net you can both increase the risk of being fined, or the size of the expected fine. So first of all, there should be a few massive (As in company-ending) fines, and they shouldn't be for some unusual or extreme violation - they should be for common practices such as using a common cookie banner service that blatantly misinterprets the legal text. Next, the scaling of the enforcement. It's difficult to scale, but considering how much money could actually be made from these fines, it does seem possible to have a massive self-funding organization do this. Also, quite a few companies probably right now think something like "Well, without tracking ads we'd be out of business anyway and I don't see how we can change business model to subscriptions or similar, so let's just try to keep using dark patterns for as long as we can rather than just ceasing operations". To counter this, you'd need to add a factor to the equation that makes busineesses think "Ok, we should probably just get off the internet rather than use these dark patterns to keep margins". I'm not sure what would push the thinking in that direction, but probably personal legal responsibility rather than simply financial risk (i.e. risk of personal fines or prison for decisionmakers).
ratww 5y ago
"Legitimate Interest" is when you need to collect personal information, but not for shady stuff. An example is for Fraud prevention, network security (eg: Cloudflare), or for legal reasons (eg: purchase information). As long as you don't use this information for anything else you're in the clear, and don't need a cookie banner. Another example: "An organisation is looking into the way it stores job applicants’ personal details. It is legally required to store this information for six months, in case a candidate lodges a discrimination case." https://www.itgovernance.eu/blog/en/the-gdpr-legitimate-interest-what-is-it-and-when-does-it-apply https://www.itgovernance.eu/blog/en/the-gdpr-legitimate-inte... The problem described by Ekaros is that TrustArc and other cookie banner companies have interpreted this as meaning "I can add a checkbox so the user can say it is in their legitimate interest for ad-networks to harvest their data". Here's an example, "Legitimate Interest" is hidden on a second tab: https://preview.redd.it/zzsl63h7nly51.png?width=1358&format=png&auto=webp&s=5cb3a3a290d21460cb66bdeb8aa3dfe1d331ff6c https://preview.redd.it/zzsl63h7nly51.png?width=1358&format=... This is a dark pattern. This interpretation of GDPR is incorrect. Legitimate interest does not need a checkbox. Also, asking customers if something is legitimate interest or not doesn't make it so. Also, the fact that the "Legitimate Interest" checkbox is checked by default goes against the spirit of GDPR.
- himinlomax 5y ago
  Iirc check by default is against the letter of GDPR.
- detaro 5y ago
  Where has the German government banned cookie banner providers?
  - ratww 5y ago
    That was conjecture and unrelated to this, I removed it.

I still haven't understood those. Can you explain it to me please?

by phh 5y ago

I still haven't understood those. Can you explain it to me please?

g_p 5y ago

"Legitimate interest" is a grounds for data processing under GDPR. Someone seemed to cotton on to the (incorrect, per my understanding) notion that it was applicable to placement of cookies. That's covered by the ePrivacy Directive (and national implementing laws), and they don't make any provision for "legitimate interest". Nonetheless, regulators move slowly, and companies want cookies. Having this gives them two bites at the same cherry (in their eyes), and enforcement is a long way off, and unlikely to scale. While not EU any more, the UK ICO guidance is really clear on their implementation of the ePrivacy Directive - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... There's only 2 exceptions to the strict requirement for consent - to communicate the data to the user, and to deliver functionality directly requested (i.e. shopping basket, login session). But enough people try to claim "legitimate interest" that others think it's OK...

matheusmoreira 5y ago
Advertising is hereby declared an illegitimate interest. Awesome!
alkonaut 5y ago
> enforcement is a long way off, and unlikely to scale. Companies want cookies because it gives them an expected economic profit. The expected profit minus the expected fine (risk of a fine times its expected size) is the expected net. To make this equation result in a negative net you can both increase the risk of being fined, or the size of the expected fine. So first of all, there should be a few massive (As in company-ending) fines, and they shouldn't be for some unusual or extreme violation - they should be for common practices such as using a common cookie banner service that blatantly misinterprets the legal text. Next, the scaling of the enforcement. It's difficult to scale, but considering how much money could actually be made from these fines, it does seem possible to have a massive self-funding organization do this. Also, quite a few companies probably right now think something like "Well, without tracking ads we'd be out of business anyway and I don't see how we can change business model to subscriptions or similar, so let's just try to keep using dark patterns for as long as we can rather than just ceasing operations". To counter this, you'd need to add a factor to the equation that makes busineesses think "Ok, we should probably just get off the internet rather than use these dark patterns to keep margins". I'm not sure what would push the thinking in that direction, but probably personal legal responsibility rather than simply financial risk (i.e. risk of personal fines or prison for decisionmakers).

ratww 5y ago

"Legitimate Interest" is when you need to collect personal information, but not for shady stuff. An example is for Fraud prevention, network security (eg: Cloudflare), or for legal reasons (eg: purchase information). As long as you don't use this information for anything else you're in the clear, and don't need a cookie banner. Another example: "An organisation is looking into the way it stores job applicants’ personal details. It is legally required to store this information for six months, in case a candidate lodges a discrimination case." https://www.itgovernance.eu/blog/en/the-gdpr-legitimate-interest-what-is-it-and-when-does-it-apply https://www.itgovernance.eu/blog/en/the-gdpr-legitimate-inte... The problem described by Ekaros is that TrustArc and other cookie banner companies have interpreted this as meaning "I can add a checkbox so the user can say it is in their legitimate interest for ad-networks to harvest their data". Here's an example, "Legitimate Interest" is hidden on a second tab: https://preview.redd.it/zzsl63h7nly51.png?width=1358&format=png&auto=webp&s=5cb3a3a290d21460cb66bdeb8aa3dfe1d331ff6c https://preview.redd.it/zzsl63h7nly51.png?width=1358&format=... This is a dark pattern. This interpretation of GDPR is incorrect. Legitimate interest does not need a checkbox. Also, asking customers if something is legitimate interest or not doesn't make it so. Also, the fact that the "Legitimate Interest" checkbox is checked by default goes against the spirit of GDPR.

himinlomax 5y ago
Iirc check by default is against the letter of GDPR.
detaro 5y ago
Where has the German government banned cookie banner providers?
- ratww 5y ago
  That was conjecture and unrelated to this, I removed it.