3 ms·

"Legitimate interest" is a grounds for data processing under GDPR. Someone seemed to cotton on to the (incorrect, per my understanding) notion that it was appl

by g_p 5y ago

"Legitimate interest" is a grounds for data processing under GDPR. Someone seemed to cotton on to the (incorrect, per my understanding) notion that it was applicable to placement of cookies. That's covered by the ePrivacy Directive (and national implementing laws), and they don't make any provision for "legitimate interest". Nonetheless, regulators move slowly, and companies want cookies. Having this gives them two bites at the same cherry (in their eyes), and enforcement is a long way off, and unlikely to scale. While not EU any more, the UK ICO guidance is really clear on their implementation of the ePrivacy Directive - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... There's only 2 exceptions to the strict requirement for consent - to communicate the data to the user, and to deliver functionality directly requested (i.e. shopping basket, login session). But enough people try to claim "legitimate interest" that others think it's OK...

matheusmoreira 5y ago
Advertising is hereby declared an illegitimate interest. Awesome!
alkonaut 5y ago
> enforcement is a long way off, and unlikely to scale. Companies want cookies because it gives them an expected economic profit. The expected profit minus the expected fine (risk of a fine times its expected size) is the expected net. To make this equation result in a negative net you can both increase the risk of being fined, or the size of the expected fine. So first of all, there should be a few massive (As in company-ending) fines, and they shouldn't be for some unusual or extreme violation - they should be for common practices such as using a common cookie banner service that blatantly misinterprets the legal text. Next, the scaling of the enforcement. It's difficult to scale, but considering how much money could actually be made from these fines, it does seem possible to have a massive self-funding organization do this. Also, quite a few companies probably right now think something like "Well, without tracking ads we'd be out of business anyway and I don't see how we can change business model to subscriptions or similar, so let's just try to keep using dark patterns for as long as we can rather than just ceasing operations". To counter this, you'd need to add a factor to the equation that makes busineesses think "Ok, we should probably just get off the internet rather than use these dark patterns to keep margins". I'm not sure what would push the thinking in that direction, but probably personal legal responsibility rather than simply financial risk (i.e. risk of personal fines or prison for decisionmakers).

by g_p 5y ago

matheusmoreira 5y ago

Advertising is hereby declared an illegitimate interest. Awesome!

alkonaut 5y ago

> enforcement is a long way off, and unlikely to scale. Companies want cookies because it gives them an expected economic profit. The expected profit minus the expected fine (risk of a fine times its expected size) is the expected net. To make this equation result in a negative net you can both increase the risk of being fined, or the size of the expected fine. So first of all, there should be a few massive (As in company-ending) fines, and they shouldn't be for some unusual or extreme violation - they should be for common practices such as using a common cookie banner service that blatantly misinterprets the legal text. Next, the scaling of the enforcement. It's difficult to scale, but considering how much money could actually be made from these fines, it does seem possible to have a massive self-funding organization do this. Also, quite a few companies probably right now think something like "Well, without tracking ads we'd be out of business anyway and I don't see how we can change business model to subscriptions or similar, so let's just try to keep using dark patterns for as long as we can rather than just ceasing operations". To counter this, you'd need to add a factor to the equation that makes busineesses think "Ok, we should probably just get off the internet rather than use these dark patterns to keep margins". I'm not sure what would push the thinking in that direction, but probably personal legal responsibility rather than simply financial risk (i.e. risk of personal fines or prison for decisionmakers).