7 ms·

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agree

by yayr 5y ago

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.

southerntofu 5y ago
> So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure Yes, and that's a good thing! A web page should only communicate with the server i've reached, there should be zero third-party involved unless i explicitly consent. That for example <img> tag can use an arbitrary URL is explained by the fact that back in the day storage/bandwidth was expensive. The same is true for video to this day, but i guess it's good that heavy-to-load content is click-to-play.
- nkmnz 5y ago
  Are you sure about the „explicitly“ part? I think it in certain cases, implicit consent should be enough, e.g. when a payment processor is contacted from a website. Even if you were running your own payment gateway, the user of your shop should be aware that the website will have to share information with their bank or credit card company. I think sharing data with third parties should not be easier than offline, but also not harder. Or do you sign a consent form each time you swipe your CC?
  - Xylakant 5y ago
    The GDPR does not require consent for everything. It allows processing data that’s required to provide the desired functionality and payment processors would be covered (IANAL, to take with a grain of salt) You’d still need to mention that in the pages privacy policy, but other than that you should be fine, as long as you have the proper paperwork in place (DPA,…) and the payment processor is themselves GDPR compliant.
    - nkmnz 5y ago
      I know, but I was referring to GGP call for explicit consent: > there should be zero third-party involved unless i explicitly consent.
      - Xylakant 5y ago
        My position on that is that clicking on “pay via X” constitutes consent.
  - southerntofu 5y ago
    You are correct. However me simply visiting a homepage (service) does not require communicating my data to third parties, and doing so is not in the legitimate interest of any of the first parties involved. In this case it would fall under the obligation of explicit content.
- baash05 5y ago
  I find that hard to understand. What server have you reached? Many sites are designed to be hosted by many servers at the same time. Sites hosted on Amazon are moved around depending on load and your location. Often you'll get part of the site from server X other bits from server Y.. images and css from an asset server and api data from one of many app servers.
  - southerntofu 5y ago
    You are correct. I just don't think that's a reasonable state of affairs. If that was part of a p2p model (eg. torrent/IPFS) it could be considered a reasonable tradeoff to allow for more eco-friendly (shorter routes, no need for high-powered servers) retrieval scheme. Hyperlinks are the foundation of the web. However, when we started loading resources (eg. images) from third parties due to high bandwidth/disk cost, we opened a Pandora's box which i believe does more harm than good.
Xylakant 5y ago
I see quite a few web pages in Germany that do not load JavaScript or any other content from YouTube,Twitter, Facebook until you explicitly opt in. Basically, the content is replaced by a placeholder saying “click here to load external content from.” - it’s technically not very hard to do so, and I quite like it. I don’t need to be tracked by any of those entities everywhere I go. Tracking and creating profiles is one of the large problems of Facebook like buttons and similar. > this could probably be avoided by extending the sites terms. Reading the judgement, I don’t think so. Consent is required before exposing the IP address and is must be explicitly given. Terms can help in cases where there is a technical requirement, for example “if you want to watch this embedded video, you must consent to this”, but they won’t save you when you just embed.
- marcus_cemes 5y ago
  > it’s technically not very hard to do so, and I quite like it For the average user, it's yet another thing to click without thinking, just to be able to visit a page. > Consent is required before exposing the IP address and is must be explicitly given There's the crux of the problem, it's difficult to know what to consent for without first displaying the website, so you implicitly give consent for "just the bare minimum", until you accept the rest. This sounds great, but is both an absolute nightmare for website developers (it's not very easy to do, with how the internet was designed, inline scripts, fonts, CDN stylesheets) and for "most" end-users who just expect good defaults and don't want to sign a consent form every time they visit a website.
  - still_grokking 5y ago
    The web isn't "the internet"! Also the late web was designed by guess who: Yes, the ad-spyware companies…
  - Xylakant 5y ago
    > > it’s technically not very hard to do so, and I quite like it > For the average user, it's yet another thing to click without thinking, just to be able to visit a page. And yet, they’re still protected: They’ll click on the video when they want to watch the video, load the like button when they want to like, the tweet button when they want to tweet. And all the other times when they visit a website that offers any of this functionality, no data is transmitted to YouTube, Facebook, Twitter. > This sounds great, but is both an absolute nightmare for website developers (it's not very easy to do, with how the internet was designed, inline scripts, fonts, CDN stylesheets There is no need to ask for consent for every Stylesheet you load from a CDN. You’re allowed to use cloudflare, cloudfront, fastly,… - they’ll all provide the required DPA that allows you to use them without consent. You need to be careful when it comes to things like like-buttons etc. that get loaded from places that use them to create user profiles for non-consenting users. Yes, that’s hard. But the culprits are the entities that siphon up every bit of data. Direct your ire there.
Kim_Bruning 5y ago
I think these are the wrong solutions. What they're trying to do is to desperately hold on to doing "business as usual". Just now with a CYA fig leaf, and do I detect a hint of possibly a dash of malicious compliance? What the EU actually wants to accomplish is to set a standard where people do business in a different (safer/higher quality/more ethical) way[1]; which many believe is both better for consumers and for business. I wouldn't be surprised if a next round of regulations were to explicitly target (actual or perceived) malicious compliance. My recommendation would be to find other ways of achieving your technical/advertising objectives that minimize the touching of peoples PII. [1] This is not unusual, the EU originated as the European Economic [Community/Union], and the regulating of safety, quality and ethics standards between businesses and trading countries has been in their bailiwick for a long time (as behooves a trade treaty organization). Not all kinds of regulation are bad for commerce. This kind promotes fair competition and interoperability, while preventing races to the bottom and tragedies of the commons.
- bushbaba 5y ago
  Sounds like ipv8 is needed to address this. :D
  - yayr 5y ago
    :-D something like zkIP (zero knowledge internet protocol)
    - still_grokking 5y ago
      You mean we should all switch to Tor? When everybody would use it, and ISPs would sell access, that could help the users to regain control over their data, and make privacy on the internet finally first class. I welcome this idea.
      - baash05 5y ago
        Sadly cloud flare blocks TOR, most of the time.

by yayr 5y ago

southerntofu 5y ago

> So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure Yes, and that's a good thing! A web page should only communicate with the server i've reached, there should be zero third-party involved unless i explicitly consent. That for example <img> tag can use an arbitrary URL is explained by the fact that back in the day storage/bandwidth was expensive. The same is true for video to this day, but i guess it's good that heavy-to-load content is click-to-play.

nkmnz 5y ago
Are you sure about the „explicitly“ part? I think it in certain cases, implicit consent should be enough, e.g. when a payment processor is contacted from a website. Even if you were running your own payment gateway, the user of your shop should be aware that the website will have to share information with their bank or credit card company. I think sharing data with third parties should not be easier than offline, but also not harder. Or do you sign a consent form each time you swipe your CC?
- Xylakant 5y ago
  The GDPR does not require consent for everything. It allows processing data that’s required to provide the desired functionality and payment processors would be covered (IANAL, to take with a grain of salt) You’d still need to mention that in the pages privacy policy, but other than that you should be fine, as long as you have the proper paperwork in place (DPA,…) and the payment processor is themselves GDPR compliant.
  - nkmnz 5y ago
    I know, but I was referring to GGP call for explicit consent: > there should be zero third-party involved unless i explicitly consent.
    - Xylakant 5y ago
      My position on that is that clicking on “pay via X” constitutes consent.
- southerntofu 5y ago
  You are correct. However me simply visiting a homepage (service) does not require communicating my data to third parties, and doing so is not in the legitimate interest of any of the first parties involved. In this case it would fall under the obligation of explicit content.
baash05 5y ago
I find that hard to understand. What server have you reached? Many sites are designed to be hosted by many servers at the same time. Sites hosted on Amazon are moved around depending on load and your location. Often you'll get part of the site from server X other bits from server Y.. images and css from an asset server and api data from one of many app servers.
- southerntofu 5y ago
  You are correct. I just don't think that's a reasonable state of affairs. If that was part of a p2p model (eg. torrent/IPFS) it could be considered a reasonable tradeoff to allow for more eco-friendly (shorter routes, no need for high-powered servers) retrieval scheme. Hyperlinks are the foundation of the web. However, when we started loading resources (eg. images) from third parties due to high bandwidth/disk cost, we opened a Pandora's box which i believe does more harm than good.

Xylakant 5y ago

I see quite a few web pages in Germany that do not load JavaScript or any other content from YouTube,Twitter, Facebook until you explicitly opt in. Basically, the content is replaced by a placeholder saying “click here to load external content from.” - it’s technically not very hard to do so, and I quite like it. I don’t need to be tracked by any of those entities everywhere I go. Tracking and creating profiles is one of the large problems of Facebook like buttons and similar. > this could probably be avoided by extending the sites terms. Reading the judgement, I don’t think so. Consent is required before exposing the IP address and is must be explicitly given. Terms can help in cases where there is a technical requirement, for example “if you want to watch this embedded video, you must consent to this”, but they won’t save you when you just embed.

marcus_cemes 5y ago
> it’s technically not very hard to do so, and I quite like it For the average user, it's yet another thing to click without thinking, just to be able to visit a page. > Consent is required before exposing the IP address and is must be explicitly given There's the crux of the problem, it's difficult to know what to consent for without first displaying the website, so you implicitly give consent for "just the bare minimum", until you accept the rest. This sounds great, but is both an absolute nightmare for website developers (it's not very easy to do, with how the internet was designed, inline scripts, fonts, CDN stylesheets) and for "most" end-users who just expect good defaults and don't want to sign a consent form every time they visit a website.
- still_grokking 5y ago
  The web isn't "the internet"! Also the late web was designed by guess who: Yes, the ad-spyware companies…
- Xylakant 5y ago
  > > it’s technically not very hard to do so, and I quite like it > For the average user, it's yet another thing to click without thinking, just to be able to visit a page. And yet, they’re still protected: They’ll click on the video when they want to watch the video, load the like button when they want to like, the tweet button when they want to tweet. And all the other times when they visit a website that offers any of this functionality, no data is transmitted to YouTube, Facebook, Twitter. > This sounds great, but is both an absolute nightmare for website developers (it's not very easy to do, with how the internet was designed, inline scripts, fonts, CDN stylesheets There is no need to ask for consent for every Stylesheet you load from a CDN. You’re allowed to use cloudflare, cloudfront, fastly,… - they’ll all provide the required DPA that allows you to use them without consent. You need to be careful when it comes to things like like-buttons etc. that get loaded from places that use them to create user profiles for non-consenting users. Yes, that’s hard. But the culprits are the entities that siphon up every bit of data. Direct your ire there.

Kim_Bruning 5y ago

I think these are the wrong solutions. What they're trying to do is to desperately hold on to doing "business as usual". Just now with a CYA fig leaf, and do I detect a hint of possibly a dash of malicious compliance? What the EU actually wants to accomplish is to set a standard where people do business in a different (safer/higher quality/more ethical) way[1]; which many believe is both better for consumers and for business. I wouldn't be surprised if a next round of regulations were to explicitly target (actual or perceived) malicious compliance. My recommendation would be to find other ways of achieving your technical/advertising objectives that minimize the touching of peoples PII. [1] This is not unusual, the EU originated as the European Economic [Community/Union], and the regulating of safety, quality and ethics standards between businesses and trading countries has been in their bailiwick for a long time (as behooves a trade treaty organization). Not all kinds of regulation are bad for commerce. This kind promotes fair competition and interoperability, while preventing races to the bottom and tragedies of the commons.

bushbaba 5y ago
Sounds like ipv8 is needed to address this. :D
- yayr 5y ago
  :-D something like zkIP (zero knowledge internet protocol)
  - still_grokking 5y ago
    You mean we should all switch to Tor? When everybody would use it, and ISPs would sell access, that could help the users to regain control over their data, and make privacy on the internet finally first class. I welcome this idea.
    - baash05 5y ago
      Sadly cloud flare blocks TOR, most of the time.