14 ms·
People shouldn't have to be experts in this stuff either just to put up a website somewhere, or worse keep up with every new ruling.
by qiqitori 5y ago
People shouldn't have to be experts in this stuff either just to put up a website somewhere, or worse keep up with every new ruling.
- demindiro 5y agoYou don't need GA for a website either. Many websites probably don't even need any form of analytics at all.
- pyronik19 5y agoDo you really think we are in a better place now with GPDR and all these annoying cookie banners all over the place?
- dale_glass 5y agoOverall, yes. At the very least it's been incredibly enlightening. It's amazing how random websites have 50 "partners" all of which for some reason need to know what I'm doing.
- nickpp 5y agoSo you think your "enlightenment" is worth the millions of work-hours people are putting in just to read and click a cookie banner they give absolutely not a single crap about?
- jen20 5y agoThey wouldn't have to do this if they didn't spew personal information indiscriminately to scumbag "partners". So yes, I do think that is worthwhile. The cost is born by the correct people.
- nickpp 5y agoThe cost is borne by every single internet user in EU clicking countless stupid boxes every single day - for nothing. Also by the EU users losing access to ad-supported free services.
- FredPret 5y agoAnd every single user outside the EU. I never voted for these crazy runaway regulations, but I can’t browse many sites on mobile at all with all the damn banners. EU bureaucrats are effectively prescribing how the web should work for everyone. Ridiculous.
- dale_glass 5y agoNot for nothing, as you can see in this post. Little by little we're stopping to send private data to the US. That's a good thing, even if it's painful at the start.
- nickpp 5y ago>That's a good thing Says who?! I have zero problems sending my private data to the US. I did it for years and I still think is one of the better places to send my private data to. Definitely better than my own country.
- dale_glass 5y agoMe, obviously, since I made the comment? And why the heck would I want to give my data to a bunch of random companies? What's the benefit in it for me, anyway?
- nickpp 5y ago> What's the benefit in it for me, anyway? Free content and services. What do you lose in exchange?
- dale_glass 5y ago
- account42 5y agoYes.
- nickpp 5y agoNever a shortage of people willing to dictate other people how to live their lives.
- smolder 5y agoNever a shortage of people mad that they can't eat trans fats or inhale leaded gasoline exhaust anymore, either. Not great analogies, since giving up personal info to use free services is a reasonable choice for individuals... But in aggregate, it's like giving up a bit of sovereignty to be that transparent. Microtargetting has helped enable some serious societal harms, i.e. spreading lies to the gullible while evading scrutiny from others, and that pales to how intelligence agencies can use the hoards of personal data. I think France and the EU are moving in the right direction, given the CLOUD act exists, and given all the other bad societal effects enabled by a surveillance focused economy. US politics hasn't weathered the shift well, unless of course your fitness function for politics is how resilient the elected government is against voters, i.e. how little can it serve their interests without losing power.
- account42 5y agoNoone is dictating you how to live your life. The recent EU privacy laws are about giving people a choice how there data is used. You are free to accept the cookies. You are even free to automate that via browser extensions. You are free to build websites in ways that don't require tracking user data and thus don't require consent. You are free to vote for politicans that are against privacy right or even campaign yourself. But a fundamental issue with freedom is that sometimes freedoms conflict with each other. Here the freedom to do whatever you want conflicts with the right to privacy of others and the EU has decided that in this instance the right to privace takes precedence.
- nickpp 5y agoI am not free to use add-supported US services when they stop being provided to EU citizens due the onerous requirements imposed on them by privacy laws. I am not free to use a website and give away "my data" by default without having to click Allow All on a damn cookie popup. The EU politicians unilaterally decided to steal these freedoms from all EU citizens. The right to privacy is not a freedom. I am not sure it's even a real right. But it was easily accessible even before the current privacy laws, even if it needed a little technical competence. It wasn't the default though. And the current laws do not provide me the privacy I actually need: from EU government(s).
- rascul 5y agoCookie banners were already a thing before GDPR.
- p_l 5y agoYou know those "cookie banners" are illegal under GDPR too, and done specifically to annoy people into agreeing?
- xtracto 5y agoThis is so funny. Under GDPR everything is illegal, the only legal website is no website. Good for Europe, they are just going to law themselves out of the internet. Up to the point were your ISP doing hops to send your TCP packet will be illegal unless you approve them sharing that info with all the shops.
- FredPret 5y agoWhat about clicking or typing in a site? Is your webserver processing those? That means you’re gratuitously using user data to run your for-profit business! That should be illegal! /s
- datavirtue 5y agoHell yeah. The banners are the fault of the website owner. They don't have to display them.
- shadowgovt 5y agoBut they do, and it's terrible. I feel for my European brothers and sisters these days. As an American, I hardly ever see these banners. Went to an EU country for work and... Holy cow. Y'all get these banners every site. How do you tolerate it?
- nickpp 5y agoSearching for "Allow All" becomes a reflex after a while. I don't know anybody rejecting anything anymore, it's even worse.
- shadowgovt 5y agoHonestly, I've never felt the urge to reject. I'm a guest in their data house, soaking their bandwidth for free. Track away.
- can16358p 5y agoThis is weird. I'm neither in US or Europe but still see all those cookie banners everywhere on every site. Thanks to GDPR, we have a much more private web. /s
- jen20 5y agoDo you really think GDPR and cookie banners are related? Most are non-compliant in the first place, and were around for years beforehand. Yes, I think we're in a vastly better place, where there is a cost to doing bad things.
- nickpp 5y agoUnfortunately the cost in borne by us, regular EU internet users through a much degraded Internet browsing experience.
- M2Ys4U 5y ago100%. (Also, the GDPR is not responsible for cookie banners)
- shadowgovt 5y agoGood law understands consequences. The market responding to the law with billions of cookie banners was as predictable as prohibition leading to bootlegging.
- M2Ys4U 5y ago>The market responding to the law with billions of cookie banners was as predictable as prohibition leading to bootlegging. And now the regulators are responding to it.[0] [0] https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europes-consent-popups-are-unlawful/ https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europe...
- shadowgovt 5y agoThat ruling declares that a centralized solution is no good. The predictable outcome from that ruling is a decentralized solution: a few libraries attempting to build frameworks that are compliant, everyone implementing their own one-off versions of permission-granting and cookie consent using those frmeworks as a basis, and the Authority chasing mom-and-pop sites that are out of compliance until the sun goes cold. In a sense, that may satisfy the goals: the data will be decentralized, stored widely, and harder to aggregate. On the other hand, what we learned from the virus era and the Windows OS monoculture is thousands of nodes running the same software (but not centrally maintained; maintained by people who have a job other than maintaining a website and are therefore slow to patch security holes) will be vulnerable to scripted attacks against frameworks. My prediction is a net increase in stolen PII and, while individual site-runners will get screwed, the number of sites collecting the data won't go down. It's just too valuable, and the odds you will get hit by a hacker are too low. In any case, it'll be a hell of a ride.
- AndrewDucker 5y agoPut up a static website and you're fine. Collect people's data (and that's what a user analytics system does) and then you're responsible for it, and you have to follow the rules.
- rascul 5y agoStatic websites can collect data too. Lots of stuff can go into web server logs.
- jeroenhd 5y agoAnd web server logs are fine for troubleshooting and detecting abuse, you don't even need to ask for consent! Only things like tracking, ads, and sending data to areas without equivalent privacy laws are forbidden. The intent and usage of the collected information is a big part of what is and isn't allowed.
- nickpp 5y agoSource? AFAIK web-server logs logging IPs are not allowed under GDPR.
- rascul 5y agoThat would be interesting. They all log IPs by default. Here's an example from nginx: 192.168.1.122 - - [10/Feb/2022:11:32:35 +0000] "GET /audio/pop.wav HTTP/1.1" 206 28366 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0" "-"
- AndrewStephens 5y agoI looked into this at back when the GDPR came into effect [0]. I am not a lawyer but in summary: Web sites are allowed to log data (including visitor requests and IPs) required for the smooth running of the site. It could be argued that keeping logs allows for trouble-shooting so web server logging is probably OK in most circumstances. However, there is no reason to keep months/years of logs around. Having this data is actually a liability under the GDPR and you should be aggressively deleting logs after a few days. [0] https://sheep.horse/2018/6/the_eu_general_data_protection_regulation_and_me_%28.html https://sheep.horse/2018/6/the_eu_general_data_protection_re...
- MereInterest 5y agoIf you want to toss some static HTML into a host, go for it. If you want to record statistics on how many page hits you had, go for it. If you want to add JavaScript for interactions and making it look prettier, go for it. But if you want to contribute to a privacy-violating network that tracks individual users, then that goes far beyond wanting "just to put up a website somewhere".
- true_religion 5y agoWell, you can totally contribute to a privacy violating network … so long as the data is located and processed in France. They are only tryin to keep their monopoly on government oversight which is reasonable for a governing body (our citizens = our control).
- viro 5y agoThat's why this whole thing is nothing but protectionism.
- pgeorgi 5y ago> so long as the data is located and processed in France. ... you also have to ask for permission first. The main difference is that for a data processor in France it seems possible to get all the right contracts in place, while a US based data processor is incapable of doing that thanks to FISA and similar US initiatives.
- Nextgrid 5y ago> you can totally contribute to a privacy violating network … so long as the data is located and processed in France. While that's not the issue being discussed here, you should by default only collect & process the minimum amount of data needed for the product/service to function. Analytics aren't part of that and would need to be opt-in.
- shadowgovt 5y agoAt this point, tossing some static text up with default apache configs runs afoul of GDPR opt-out and data-scrubbing requirements, IIUC.
- can16358p 5y agoThis! GDPR is a big block towards technological improvement. Do virtually any business that involves user registration at some point, and now you need to be sure that you're compliant with all those rules, spending limited resources on that to avoid ridiculous fines. It benefits only the big players who has lawyers to know exactly what to do and not, and a nightmare for anyone who tries to grow a small business or have a small website.
- M2Ys4U 5y ago> GDPR is a big block towards technological improvement. It's exactly the opposite. It forces technology to be developed in a way that protects human rights (specifically the right to privacy). Innovation is not automatically good if you're innovating in the wrong direction. Think of it as a vector, not a scalar.
- nickpp 5y agoWho is deciding what is the wrong and good direction to innovate in for everybody else?
- can16358p 5y agoApparently some politicians in EU who has a grudge against US-based tech companies. "Hey Google and Facebook is doing so well let's make harder for everyone using their services." I neither have sympathy for those companies and never been to US, but adter all these GDPR regulations I actually started to sympathize.
- FredPret 5y agoI was anti-Brexit when it happened, but am beginning to see the wisdom of it.
- can16358p 5y agoIt was already non-invasive. I, as a conscious human being browse a website, use their (potentially free) services. The website can of course put a cookie and track me. If I'm really paranoid I could block cookies etc but regardless, no one forces me to use their website. If someone pointed a gun and forced me to go to a website, enter my personal data and give my data to trackers that would be something else (still not website's fault but anyway).
- FredPret 5y agoSo true. I have a collection of small, US-focused websites. I'm investigating low-effort ways to geo-fence the EU. At some point it just becomes easier to ban Europeans, rather than keep up with whatever they'll come up with next. I saw in this thread that the Google fonts on my website are now a problem as well!? That's the first I heard of it.
- criddell 5y ago> That’s the first I heard of it. This is the perfect example of why government oversight is needed. You run a bunch of websites and aren’t aware that you are inadvertently involved in violating the privacy of the people who visit your sites. How are non-technical people supposed to deal with this?
- FredPret 5y agoNo, this is a perfect example of the exact opposite. A bureaucrat on the other side of the planet comes to a conclusion and I, who never voted for this person or knew about their existence, am legally bound by their decision. On pain of who knows what fines or penalties. I’m nearly overwhelmed by the amount of work on my core product, I can’t add “keep up with European legal opinion” to my todo list as well. As I said, it’s simpler to just geofence everything.