4 ms·

Here is what I don't understand. They clearly mean to ban online tracking. They make the laws. But instead of making a law that makes tracking illegal, they mak

Here is what I don't understand. They clearly mean to ban online tracking. They make the laws. But instead of making a law that makes tracking illegal, they make a law that says you must consent, and leave blank what consent means. Then they make rulings about what consent means that amount to "it is illegal to collect data for tracking." Why not just ban tracking and be done with it?

rtb 5y ago
This is a good question. I think the answer is that it's difficult to define up-front what is illegitimate "online tracking" and what is legitimate tracking of users necessary for things like accounts and saving of preferences (without drowning in special cases and loopholes). The idea was to let users decide for themselves, case by case, whether they wanted the tradeoff of being tracked for the rewards (including things like saving your preferences). The tracking industry didn't want to be banned and wouldn't give up without a fight, so they looked for a loophole in this fake consent spam.
simpss 5y ago
> and leave blank what consent means Actually, this is not left blank at all... -------------------- Consent means offering individuals real choice and control. Genuine consent should put individuals in charge, build trust and engagement, and enhance your reputation. Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. Be clear and concise. Make it easy for people to withdraw consent and tell them how. Avoid making consent to processing a precondition of a service. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
lmkg 5y ago
> They clearly mean to ban online tracking. There's your error. GDPR is not about online advertising. Things regulated by GDPR: * CCTV in public spaces. * Medical records. * Employment records that businesses keep about their employees. * Credit reports. * Government records like voter databases and housing information. * Trawling public business filings to send direct-mail spam. * The loyalty card issued by your grocery store which tracks your purchases. * The CRM database used by the sales guys in your SaaS company to keep track of hot leads. GDPR regulates a wide array of data collection, and outright banning is not the correct solution for most of them. So it's about what obligations are attached to data collection and processing. Online advertising is only a small part of what's being regulated. Even online, there are modes of data collection which are permissible. E.g. collecting anonymous site statistics for your own internal use. The obligations get harder and harder to satisfy when your business practice is to spread data hither and yon to whomever will pay a nickel for it.
vurpo 5y ago
The issue is that GDPR isn't fundamentally about online data collection or tracking, it's about all data collection in general. You can't ban everyone from collecting data about anyone in all situations, because there are many cases where people legitimately want or need their personal information to be collected and processed by someone else. For example medical records, magazine subscriptions, bank accounts, etc. These are all covered by the GDPR, in addition to illegitimate data collection for the purpose of ad tracking. So how do you define, in law, when a person legitimately wants a company to process their personal information, and when it should count as illegal tracking? The GDPR actually makes an attempt at defining this (doesn't just leave it blank), but many adtech companies just ignore this and break that law. See the article for an example.

rtb 5y ago

This is a good question. I think the answer is that it's difficult to define up-front what is illegitimate "online tracking" and what is legitimate tracking of users necessary for things like accounts and saving of preferences (without drowning in special cases and loopholes). The idea was to let users decide for themselves, case by case, whether they wanted the tradeoff of being tracked for the rewards (including things like saving your preferences). The tracking industry didn't want to be banned and wouldn't give up without a fight, so they looked for a loophole in this fake consent spam.

simpss 5y ago

> and leave blank what consent means Actually, this is not left blank at all... -------------------- Consent means offering individuals real choice and control. Genuine consent should put individuals in charge, build trust and engagement, and enhance your reputation. Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. Be clear and concise. Make it easy for people to withdraw consent and tell them how. Avoid making consent to processing a precondition of a service. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

lmkg 5y ago

> They clearly mean to ban online tracking. There's your error. GDPR is not about online advertising. Things regulated by GDPR: * CCTV in public spaces. * Medical records. * Employment records that businesses keep about their employees. * Credit reports. * Government records like voter databases and housing information. * Trawling public business filings to send direct-mail spam. * The loyalty card issued by your grocery store which tracks your purchases. * The CRM database used by the sales guys in your SaaS company to keep track of hot leads. GDPR regulates a wide array of data collection, and outright banning is not the correct solution for most of them. So it's about what obligations are attached to data collection and processing. Online advertising is only a small part of what's being regulated. Even online, there are modes of data collection which are permissible. E.g. collecting anonymous site statistics for your own internal use. The obligations get harder and harder to satisfy when your business practice is to spread data hither and yon to whomever will pay a nickel for it.

vurpo 5y ago

The issue is that GDPR isn't fundamentally about online data collection or tracking, it's about all data collection in general. You can't ban everyone from collecting data about anyone in all situations, because there are many cases where people legitimately want or need their personal information to be collected and processed by someone else. For example medical records, magazine subscriptions, bank accounts, etc. These are all covered by the GDPR, in addition to illegitimate data collection for the purpose of ad tracking. So how do you define, in law, when a person legitimately wants a company to process their personal information, and when it should count as illegal tracking? The GDPR actually makes an attempt at defining this (doesn't just leave it blank), but many adtech companies just ignore this and break that law. See the article for an example.