4 ms·

As a consumer I feel more trapped than protected. Instead of really disincentivizing the abuse of data, there is now a complicated network of bureaucracy that h

by ls15 5y ago

As a consumer I feel more trapped than protected. Instead of really disincentivizing the abuse of data, there is now a complicated network of bureaucracy that has been externalized from the EU via companies to the consumer. For the industry it is now about gathering consent from the user through dark patterns and making sure that each of n rules is fulfilled, while the data itself is most likely just as abused as before.

mpweiher 5y ago
> trapped ... dark patterns Yes, this is what it feels like. Now. Because the industry is in a Wil-E-Coyote moment. Their business model has always been more than shady, a shadiness that has now officially been defined as illegal. Industry response to "you are not allowed to do this" has been "but I really wanna", and they think that they can get out of complying with the law via these dark patterns about tricking the user into giving them "consent". All of this crap is illegal. Tricking users into "giving" you "consent" is illegal, as is coercing them. The law is very clear about this. It will take a while for the wheels of justice to grind, but grind they will. In the meantime, we apologise for the inconvenience, but the world will be a better place.
robin_reala 5y ago
If you consent it’s definitely as abused as previously, but at least in the EU there’s definitely less abuse of people who choose not to consent.
bborud 5y ago
Where the letter of the law is more important than the intent, there's always more wiggle room to screw over the consumer. But where intent and interpretation is given more weight, things tend to be less predictable for businesses. There was a story yesterday about someone getting terribly upset about researchers probing the GDPR compliance of the website of a blogger. Some froth developed around people's mouths as the site in question was called a "victim" and any shrugs seen as "victim-blaming". (And I was thoroughly downvoted for pointing out that calling website owners "victims" was a bit more drama than was called for) GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard.
- ls15 5y ago
  > GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard. And that's why I find the line of argumentation that says 'the consent law is fine, just give it more time' a bit frustrating. It is such a waste of time and energy, while it does not really tackle the core issue of data abuse, but it negatively impacts everyone's user experience. I think that the law is not well adjusted plays a major role in the situation that we have today. We are in the fourth year of the law and I see no impulses that would lead to a world without full page overlays on most websites on first visit, where the only primary action is "Accept all". While I as a techie take the time to reject most cookies, the more tech-illiterate part of my family has already sold my firstborn child for a couple of news articles.
  - bborud 5y ago
    I've stopped reading several online publications, and using several service providers because they either try to dark-pattern-bully me into consenting, or just can't seem to "remember" my choices. Every time I see one of the GDPR popups it incentivizes me to think "do I really need to access this content?" - and more and more often I just think "no" and delete the bookmark or make a mental note that "this website isn't worth the click".
    - Linosaurus 5y ago
      > or just can't seem to "remember" my choices. That's actually a good question... how would you do that. I guess the website would need explicit consent to save a cookie with the information that you consent to nothing else.
      - ls15 5y ago
        And that's how cookie consent management platforms (CMP) were born. Storing your privacy preferences on yet another third-party platform since 2017. I always found this kind of ironic.
jacquesm 5y ago
But the problem lies with the companies, not with the law. Companies could trivially comply with the law.
- shadowgovt 5y ago
  But what competitive advantages do they unlock if they choose to non-trivially comply with the law? This situation was wholly predictable the minute it was decided to pass laws to codify what were previously best practices. We now get to enjoy the same benefits the law has granted in the past on environmental protection, civil rights, labor practices, patents, and copyright... With similar grey areas, fuzzy and contradictory outcomes, and but-what-if attempts to augur the legal process. Not to imply any of those laws should never have been passed! Merely observing that when we use this tool to solve our problem, this is how this tool operates. The pattern is well-established and basically at least as old as rule-of-law.
  - jacquesm 5y ago
    The competitive advantage of being allowed to operate their business.
Xelbair 5y ago
It's trivial to comply with the laws. Honestly it is, we are dealing with huge amounts of medical-tier PII data(not actually medical, but as vulnerable as as protected). It's just that companies are reluctant to give up the profiling powers they get from their current system.
- shadowgovt 5y ago
  In general, it's trivial to comply with any regulation: just don't do anything like the bad thing. In the US, It's nearly impossible to trip over any major EPA regulation if you just don't produce industrial chemicals, or do heavy manufacturing, or transport goods, or own real estate. For obvious reasons, companies choose not to comply in that way, and ambitious companies will instead often test the limits of what the regulation actually prohibits.
sdoering 5y ago
I work in Germany as a data analyst as well as a freelancer. It is trivially easy to comply. The moment you want to monitor your users' behavior for whatever reason, though you need to ask them. They are not your guinea pigs. I strongly believe you can have a great business, even do advertising, without selling out your customers/visitors. And blaming the law because industry is using dark patterns to circumvent it seems odd to me. Do I like these consent banners? Most of them not. Neither as consumer, nor as the one implementing them. But the hiddeous ones to me are a symptom of a rotten company not valuing their customers. Not a symptom of a bad law.
- ls15 5y ago
  > Do I like these consent banners? Most of them not. Neither as consumer, nor as the one implementing them. Then why would you implement them (assuming your company is not rotten), if not for compliance with regulation that failed to find the sweet spot?
  - deleted 5y ago
    [deleted]
  - martin_a 5y ago
    Not OP, but the sweet spot is there: For anything under your control, that does not collect personal information, or shares data with third parties, you don't need any consent at all. But you might find it easier (or whatever) to integrate Google Analytics than set up your own Matomo instance, so you'll have to ask the users if they want their data shared with Google. It's not as complicated as most companies want to portray it. edit: I had our company website at this point. Locally hosted fonts, no external tracking, own Matomo instance, everything was great and I could finally remove the cookie banner. Then marketing came around the corner, wanted to run paid ads on LinkedIn and Xing, also it was "sooooo comfortable" to link Google Analytics with Google Ads and see how your campaigns perform. Now there are more external scripts than ever, we have Cookiebot (let's see for how much longer :-D) and a cookie banner with the usual settings and lawyer copy on it. I hate it.
    - 5y ago
mmarq 5y ago
If you don’t collect personal data (and 99% of those that do shouldn’t), you don’t need to do anything to be compliant. If you need personal data and don’t do anything weird with it (weird being systematic violation of your users’ privacy), compliance is straightforward (I’ve lead two GDPR compliance projects in the past 2-3 years). If a company has to show 300 banners and asks for consent multiple times, it’s because they are doing extremely weird stuff. Legislation just made it visible.

by ls15 5y ago

mpweiher 5y ago

> trapped ... dark patterns Yes, this is what it feels like. Now. Because the industry is in a Wil-E-Coyote moment. Their business model has always been more than shady, a shadiness that has now officially been defined as illegal. Industry response to "you are not allowed to do this" has been "but I really wanna", and they think that they can get out of complying with the law via these dark patterns about tricking the user into giving them "consent". All of this crap is illegal. Tricking users into "giving" you "consent" is illegal, as is coercing them. The law is very clear about this. It will take a while for the wheels of justice to grind, but grind they will. In the meantime, we apologise for the inconvenience, but the world will be a better place.

robin_reala 5y ago

If you consent it’s definitely as abused as previously, but at least in the EU there’s definitely less abuse of people who choose not to consent.

bborud 5y ago

Where the letter of the law is more important than the intent, there's always more wiggle room to screw over the consumer. But where intent and interpretation is given more weight, things tend to be less predictable for businesses. There was a story yesterday about someone getting terribly upset about researchers probing the GDPR compliance of the website of a blogger. Some froth developed around people's mouths as the site in question was called a "victim" and any shrugs seen as "victim-blaming". (And I was thoroughly downvoted for pointing out that calling website owners "victims" was a bit more drama than was called for) GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard.

ls15 5y ago
> GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard. And that's why I find the line of argumentation that says 'the consent law is fine, just give it more time' a bit frustrating. It is such a waste of time and energy, while it does not really tackle the core issue of data abuse, but it negatively impacts everyone's user experience. I think that the law is not well adjusted plays a major role in the situation that we have today. We are in the fourth year of the law and I see no impulses that would lead to a world without full page overlays on most websites on first visit, where the only primary action is "Accept all". While I as a techie take the time to reject most cookies, the more tech-illiterate part of my family has already sold my firstborn child for a couple of news articles.
- bborud 5y ago
  I've stopped reading several online publications, and using several service providers because they either try to dark-pattern-bully me into consenting, or just can't seem to "remember" my choices. Every time I see one of the GDPR popups it incentivizes me to think "do I really need to access this content?" - and more and more often I just think "no" and delete the bookmark or make a mental note that "this website isn't worth the click".
  - Linosaurus 5y ago
    > or just can't seem to "remember" my choices. That's actually a good question... how would you do that. I guess the website would need explicit consent to save a cookie with the information that you consent to nothing else.
    - ls15 5y ago
      And that's how cookie consent management platforms (CMP) were born. Storing your privacy preferences on yet another third-party platform since 2017. I always found this kind of ironic.

jacquesm 5y ago

But the problem lies with the companies, not with the law. Companies could trivially comply with the law.

shadowgovt 5y ago
But what competitive advantages do they unlock if they choose to non-trivially comply with the law? This situation was wholly predictable the minute it was decided to pass laws to codify what were previously best practices. We now get to enjoy the same benefits the law has granted in the past on environmental protection, civil rights, labor practices, patents, and copyright... With similar grey areas, fuzzy and contradictory outcomes, and but-what-if attempts to augur the legal process. Not to imply any of those laws should never have been passed! Merely observing that when we use this tool to solve our problem, this is how this tool operates. The pattern is well-established and basically at least as old as rule-of-law.
- jacquesm 5y ago
  The competitive advantage of being allowed to operate their business.

Xelbair 5y ago

It's trivial to comply with the laws. Honestly it is, we are dealing with huge amounts of medical-tier PII data(not actually medical, but as vulnerable as as protected). It's just that companies are reluctant to give up the profiling powers they get from their current system.

shadowgovt 5y ago
In general, it's trivial to comply with any regulation: just don't do anything like the bad thing. In the US, It's nearly impossible to trip over any major EPA regulation if you just don't produce industrial chemicals, or do heavy manufacturing, or transport goods, or own real estate. For obvious reasons, companies choose not to comply in that way, and ambitious companies will instead often test the limits of what the regulation actually prohibits.

sdoering 5y ago

I work in Germany as a data analyst as well as a freelancer. It is trivially easy to comply. The moment you want to monitor your users' behavior for whatever reason, though you need to ask them. They are not your guinea pigs. I strongly believe you can have a great business, even do advertising, without selling out your customers/visitors. And blaming the law because industry is using dark patterns to circumvent it seems odd to me. Do I like these consent banners? Most of them not. Neither as consumer, nor as the one implementing them. But the hiddeous ones to me are a symptom of a rotten company not valuing their customers. Not a symptom of a bad law.

ls15 5y ago
> Do I like these consent banners? Most of them not. Neither as consumer, nor as the one implementing them. Then why would you implement them (assuming your company is not rotten), if not for compliance with regulation that failed to find the sweet spot?
- deleted 5y ago
  [deleted]
- martin_a 5y ago
  Not OP, but the sweet spot is there: For anything under your control, that does not collect personal information, or shares data with third parties, you don't need any consent at all. But you might find it easier (or whatever) to integrate Google Analytics than set up your own Matomo instance, so you'll have to ask the users if they want their data shared with Google. It's not as complicated as most companies want to portray it. edit: I had our company website at this point. Locally hosted fonts, no external tracking, own Matomo instance, everything was great and I could finally remove the cookie banner. Then marketing came around the corner, wanted to run paid ads on LinkedIn and Xing, also it was "sooooo comfortable" to link Google Analytics with Google Ads and see how your campaigns perform. Now there are more external scripts than ever, we have Cookiebot (let's see for how much longer :-D) and a cookie banner with the usual settings and lawyer copy on it. I hate it.
  - 5y ago

mmarq 5y ago

If you don’t collect personal data (and 99% of those that do shouldn’t), you don’t need to do anything to be compliant. If you need personal data and don’t do anything weird with it (weird being systematic violation of your users’ privacy), compliance is straightforward (I’ve lead two GDPR compliance projects in the past 2-3 years). If a company has to show 300 banners and asks for consent multiple times, it’s because they are doing extremely weird stuff. Legislation just made it visible.