4 ms·

> I don't really see the problem with ads that discriminate based on profession or income. For me it's always been about control. If the surveillance companie

by Lio 5y ago

> I don't really see the problem with ads that discriminate based on profession or income. For me it's always been about control. If the surveillance companies (Google, Facebook, Twitter, etc.) used opt-in or honoured the Do Not Track header all this could be avoided. Those that want tracked and targeted ads could request them and those that don't would be left alone. Instead, by refusing to not honour, Do Not Track or using Dark UX Patterns to make it hard to opt out[1] they're affectively saying, "tough luck, we're going to do whatever we want regardless". It's a race to the bottom to see which company can get away with being the most obnoxious. We're left with legal means as the only curbs their behaviour. . 1. Why do so many web sites get away with an "Allow All" but no reliable[2] "Reject All"? 2. Why is there a second set of things to opt out of as "Legitimate Purpose"? Why doesn't the "Reject All", when present, not cover these too?

mschuster91 5y ago
> 2. Why is there a second set of things to opt out of as "Legitimate Purpose"? Why doesn't the "Reject All", when present, not cover these too? Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation ("legitimate interest")... but you do not need consent from the user for these.
- mmarq 5y ago
  Session IDs and loadbalancer cookies would be required cookies, "legitimate purpose" is a different concept
  - lawtalkinghuman 5y ago
    The whole point of misusing legitimate purpose is they're trying to end-run around consent. It's a bad hack until one of the national data protection agencies decides to say "no, you can't do that" and then it goes away.
- dmitriid 5y ago
  > Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation No you don't. You don't need to ask for permission for data you collect/store that is strictly required for your business to operate. Key word: strictly required. Meanwhile these leeches have latched on on a more nebulously defined "legitimate interest". For example, if you need fraud protection for your order-processing business, you have a legitimate interest to process and store more data than is strictly required. Since such legitimate interests are innumerable they are not explicitly defined in the law. So, the parasites clamp things like "siphon your data and sell it to the highest bidder" under "legitimate interest". Which skirts the law, and will fall apart under scrutiny. See the three-part test by UK's data authority, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-data-protectio... (UK is so far still bound by GDPR)
- etripe 5y ago
  I think they might be referring to the dark pattern where there are two sets of "Legitimate Purposes": 1. Actual legitimate purposes for core functionality 2. A toggleable "legitimate purposes" under the ads section Presenting the second option could be construed as malicious compliance or just dishonesty. On sites where I've seen this, there is no one-click option to disable those, which should make them non-compliant with GDPR.

by Lio 5y ago

mschuster91 5y ago

> 2. Why is there a second set of things to opt out of as "Legitimate Purpose"? Why doesn't the "Reject All", when present, not cover these too? Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation ("legitimate interest")... but you do not need consent from the user for these.

mmarq 5y ago
Session IDs and loadbalancer cookies would be required cookies, "legitimate purpose" is a different concept
- lawtalkinghuman 5y ago
  The whole point of misusing legitimate purpose is they're trying to end-run around consent. It's a bad hack until one of the national data protection agencies decides to say "no, you can't do that" and then it goes away.
dmitriid 5y ago
> Because you need to name stuff like session ID cookies, loadbalancer backend cookies and other stuff that is necessary for operation No you don't. You don't need to ask for permission for data you collect/store that is strictly required for your business to operate. Key word: strictly required. Meanwhile these leeches have latched on on a more nebulously defined "legitimate interest". For example, if you need fraud protection for your order-processing business, you have a legitimate interest to process and store more data than is strictly required. Since such legitimate interests are innumerable they are not explicitly defined in the law. So, the parasites clamp things like "siphon your data and sell it to the highest bidder" under "legitimate interest". Which skirts the law, and will fall apart under scrutiny. See the three-part test by UK's data authority, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-data-protectio... (UK is so far still bound by GDPR)
etripe 5y ago
I think they might be referring to the dark pattern where there are two sets of "Legitimate Purposes": 1. Actual legitimate purposes for core functionality 2. A toggleable "legitimate purposes" under the ads section Presenting the second option could be construed as malicious compliance or just dishonesty. On sites where I've seen this, there is no one-click option to disable those, which should make them non-compliant with GDPR.