4 ms·

Is it safe to assume you've never had to deal with those downright malevolent dark patterns and button labyrinths, designed to make it extremely unlikely for an

Is it safe to assume you've never had to deal with those downright malevolent dark patterns and button labyrinths, designed to make it extremely unlikely for anyone in the general population to actually reject tracking?

simongray 5y ago
There are solutions to most of that, e.g. https://chrome.google.com/webstore/detail/consent-o-matic/mdjildafknihdffpkfmmpnpoiajfjnjd https://chrome.google.com/webstore/detail/consent-o-matic/md...
- danuker 5y ago
  This is more of a workaround. A solution to a poliical problem is political, not technical.
  - mlatu 5y ago
    i would call it societal; society still needs to grasp in what way they are being exploited. it's still not clear to most people
  - emsixteen 5y ago
    How is it political?
    - danuker 5y ago
      The decision to force service providers collect consent from their own users is a political decision. And a fundamentally bad one: providers' incentive is to make it easy to get consent and hard to refuse. I don't know what policy is better than this, but right now, we only get more annoyance without any benefits in privacy. Pretty much every page I've visited issues 3rd party requests before I consent to data sharing.
- KronisLV 5y ago
  Those are (nice) solutions to a problem that shouldn't be allowed to (legally) exist. The industry shouldn't be allowed to play clever with the ways to coerce their users into giving up their information just because they know that most of those users are not interested in navigating difficult dialogs.
  - black_puppydog 5y ago
    They shouldn't be allowed, and they aren't allowed. Actually the new digital services act [0] is shaping up to clarify these, but IIRC there have also been first cases decided in courts. [0]: https://edri.org/our-work/the-eu-parliament-takes-strong-stance-against-surveillance-ads/ https://edri.org/our-work/the-eu-parliament-takes-strong-sta...
  - friendzis 5y ago
    This particular behavior is actually illegal. GDPR [Recital 32] clearly states that "Consent should be given by a clear affirmative act <...> Silence, pre-ticked boxes or inactivity should not therefore constitute consent." [Recital 32]: https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/
ohgodplsno 5y ago
Those patterns are more and more being punished by GDPR enforcement. Companies may try playing around the letter of the law, but Europe runs pretty solidly on the spirit of the law. See events like these: https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europes-consent-popups-are-unlawful/ https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europe...
- zxcvbn4038 5y ago
  And American companies are absolutely dumbfounded when they try to play the “misplaced comma” card in the EU and they still get slapped down. It is a very American attitude — I always wondered what ST:TNG would have been like if Picard wasn’t always able to save the day by invoking some obscure sub paragraph of some obscure treaty. Note to Elon that if he launches lawyers into space it doesn’t kill them, he just ends up with a lot of lawyers in space. https://en.m.wikipedia.org/wiki/The_Ensigns_of_Command https://en.m.wikipedia.org/wiki/The_Ensigns_of_Command The other aspect of EU law that always gets US companies is that penalties are large enough to actually be penalizing. In the US companies can basically ignore the law until they get caught, pay a token $100,000 or $1,000,000 fine (which sounds impressive in all the papers), then invent a new interpretation of the law and go do it again. In the EU the regulators start looking at percentages of income during the entire time the illegal activity occurred, so again the US companies are caught completely off guard when they get asked to forfeit billions of dollars.
ornornor 5y ago
Couldn’t be further from reality.
boudin 5y ago
Don't blame the lawmaker for the bad behaviour of people who are trying to bypass it... If you're on such website, you know that the website itself shouldn't be trusted.
- mlatu 5y ago
  the laws are teethless if they are not enforced, and playing hot potatoe with responsibilities like is the case with Max Schrems makes it all laughable. dont blame the lawmaker for participants bad behaviour? well, ok. allright. but i DO blame the responsible authorities for licking the misbehaving participants' boots
  - dbrgn 5y ago
    Enforcing requires court cases and time. That's how law works, unfortunately. Fortunately organizations like NOYB (with Max Schrems) are doing exactly this: https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner... Once there are a few high-profile cases with high fines to set a precedent, this hopefully changes the way companies handle cookie banners.
  - the_other 5y ago
    > the laws are teethless if they are not enforced How many sites have you reported?
  - krageon 5y ago
    > if they are not enforced Ok, but they are enforced. So this entire line of reasoning makes absolutely zero sense. If your demand is that every infraction is enforced immediately, then you will be disappointed. Such things take time. > i DO blame the responsible authorities for licking the misbehaving participants' boots There's a single European country that does this (Ireland) and it is definitely a stain on an otherwise healthy situation in terms of enforcement. It is not fair to attribute their willful ignorance in the face of plain bribing to the rest of the enforcement agencies.
  - fsflover 5y ago
dtech 5y ago
So what do you propose: "People are working around it so we should just give up"? I don't think it's time to admit defeat like that. This can change, but enforcement and courts by nature are slow. With EU courts striking down asymptotic consent banners as illegal, sites are spooked, and you now see sites adding a "reject all" button next to the "accept all". I still have hope we get there.
- lillecarl 5y ago
  Some reject all buttons don't set a cookie/localstorage for the rejection meaning the banner will be on every page, darkest of patterns!
formerly_proven 5y ago
I some cases the "people do illegal things regardless" argument can hold some water, but that's not the case for the GDPR, which is worded very clearly and hence it's really obvious that this kind of thing violates it. Most of these banners violate the GDPR even before they're showing up, because the GDPR actually restricts your ability to embed non-first-party content without consent. That's why Google Fonts violates the GDPR, for example. Arguably every vanilla Wordpress install violates the GDPR because Wordpress embeds something from s.w.org on every page (presumably for install count / analytics reasons). This kinda sounds like a bad thing but it's not. It's actually a huge boon, because it's an excellent legal excuse to get rid of embedding stuff from 213789 origins and CDNs, which only has negative performance effects since caches have been origin-segregated for years, meaning that even if another page uses the same jQuery version from cdnjs, it will be downloaded again anyway.
- shadowgovt 5y ago
  > which is worded very clearly Hard disagree. I've been racking my brain as of late trying to decide if default apache access logs violate the GDPR, and stackexchange searches on the topic seem to confirm the confusion. If the legality of data collection hinges on what is considered necessary for service maintenance in the eye of a judge, the law is not clear.
  - formerly_proven 5y ago
    You can keep such logs under article 6.1.f if the retention period is 30 days or less (causing self-fulfillment of article 17) or indefinitely if you remove/anonymize PII from them. Of course article 17.3 gives you an exemption for various purposes, e.g. if you had a breach you don't need to delete the logs from that period while investigating it.
    - shadowgovt 5y ago
      I fail to see how a 30-day or fewer retention policy impinges on article 17 one way or the other, nor do I see how article 6.1 gives any protection on the topic of the default Apache HTTP access logs (which include IP addresses).
efdee 5y ago
In my experience, almost all of those consent popups work the same way. On the first popup, press the button that doesn't say they can just use all cookies. On the second popup, press the button that says it saves your preferences.

simongray 5y ago

There are solutions to most of that, e.g. https://chrome.google.com/webstore/detail/consent-o-matic/mdjildafknihdffpkfmmpnpoiajfjnjd https://chrome.google.com/webstore/detail/consent-o-matic/md...

danuker 5y ago
This is more of a workaround. A solution to a poliical problem is political, not technical.
- mlatu 5y ago
  i would call it societal; society still needs to grasp in what way they are being exploited. it's still not clear to most people
- emsixteen 5y ago
  How is it political?
  - danuker 5y ago
    The decision to force service providers collect consent from their own users is a political decision. And a fundamentally bad one: providers' incentive is to make it easy to get consent and hard to refuse. I don't know what policy is better than this, but right now, we only get more annoyance without any benefits in privacy. Pretty much every page I've visited issues 3rd party requests before I consent to data sharing.
KronisLV 5y ago
Those are (nice) solutions to a problem that shouldn't be allowed to (legally) exist. The industry shouldn't be allowed to play clever with the ways to coerce their users into giving up their information just because they know that most of those users are not interested in navigating difficult dialogs.
- black_puppydog 5y ago
  They shouldn't be allowed, and they aren't allowed. Actually the new digital services act [0] is shaping up to clarify these, but IIRC there have also been first cases decided in courts. [0]: https://edri.org/our-work/the-eu-parliament-takes-strong-stance-against-surveillance-ads/ https://edri.org/our-work/the-eu-parliament-takes-strong-sta...
- friendzis 5y ago
  This particular behavior is actually illegal. GDPR [Recital 32] clearly states that "Consent should be given by a clear affirmative act <...> Silence, pre-ticked boxes or inactivity should not therefore constitute consent." [Recital 32]: https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/

ohgodplsno 5y ago

Those patterns are more and more being punished by GDPR enforcement. Companies may try playing around the letter of the law, but Europe runs pretty solidly on the spirit of the law. See events like these: https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europes-consent-popups-are-unlawful/ https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europe...

zxcvbn4038 5y ago
And American companies are absolutely dumbfounded when they try to play the “misplaced comma” card in the EU and they still get slapped down. It is a very American attitude — I always wondered what ST:TNG would have been like if Picard wasn’t always able to save the day by invoking some obscure sub paragraph of some obscure treaty. Note to Elon that if he launches lawyers into space it doesn’t kill them, he just ends up with a lot of lawyers in space. https://en.m.wikipedia.org/wiki/The_Ensigns_of_Command https://en.m.wikipedia.org/wiki/The_Ensigns_of_Command The other aspect of EU law that always gets US companies is that penalties are large enough to actually be penalizing. In the US companies can basically ignore the law until they get caught, pay a token $100,000 or $1,000,000 fine (which sounds impressive in all the papers), then invent a new interpretation of the law and go do it again. In the EU the regulators start looking at percentages of income during the entire time the illegal activity occurred, so again the US companies are caught completely off guard when they get asked to forfeit billions of dollars.

ornornor 5y ago

Couldn’t be further from reality.

boudin 5y ago

Don't blame the lawmaker for the bad behaviour of people who are trying to bypass it... If you're on such website, you know that the website itself shouldn't be trusted.

mlatu 5y ago
the laws are teethless if they are not enforced, and playing hot potatoe with responsibilities like is the case with Max Schrems makes it all laughable. dont blame the lawmaker for participants bad behaviour? well, ok. allright. but i DO blame the responsible authorities for licking the misbehaving participants' boots
- dbrgn 5y ago
  Enforcing requires court cases and time. That's how law works, unfortunately. Fortunately organizations like NOYB (with Max Schrems) are doing exactly this: https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner... Once there are a few high-profile cases with high fines to set a precedent, this hopefully changes the way companies handle cookie banners.
- the_other 5y ago
  > the laws are teethless if they are not enforced How many sites have you reported?
- krageon 5y ago
  > if they are not enforced Ok, but they are enforced. So this entire line of reasoning makes absolutely zero sense. If your demand is that every infraction is enforced immediately, then you will be disappointed. Such things take time. > i DO blame the responsible authorities for licking the misbehaving participants' boots There's a single European country that does this (Ireland) and it is definitely a stain on an otherwise healthy situation in terms of enforcement. It is not fair to attribute their willful ignorance in the face of plain bribing to the rest of the enforcement agencies.
- fsflover 5y ago

dtech 5y ago

So what do you propose: "People are working around it so we should just give up"? I don't think it's time to admit defeat like that. This can change, but enforcement and courts by nature are slow. With EU courts striking down asymptotic consent banners as illegal, sites are spooked, and you now see sites adding a "reject all" button next to the "accept all". I still have hope we get there.

lillecarl 5y ago
Some reject all buttons don't set a cookie/localstorage for the rejection meaning the banner will be on every page, darkest of patterns!

formerly_proven 5y ago

I some cases the "people do illegal things regardless" argument can hold some water, but that's not the case for the GDPR, which is worded very clearly and hence it's really obvious that this kind of thing violates it. Most of these banners violate the GDPR even before they're showing up, because the GDPR actually restricts your ability to embed non-first-party content without consent. That's why Google Fonts violates the GDPR, for example. Arguably every vanilla Wordpress install violates the GDPR because Wordpress embeds something from s.w.org on every page (presumably for install count / analytics reasons). This kinda sounds like a bad thing but it's not. It's actually a huge boon, because it's an excellent legal excuse to get rid of embedding stuff from 213789 origins and CDNs, which only has negative performance effects since caches have been origin-segregated for years, meaning that even if another page uses the same jQuery version from cdnjs, it will be downloaded again anyway.

shadowgovt 5y ago
> which is worded very clearly Hard disagree. I've been racking my brain as of late trying to decide if default apache access logs violate the GDPR, and stackexchange searches on the topic seem to confirm the confusion. If the legality of data collection hinges on what is considered necessary for service maintenance in the eye of a judge, the law is not clear.
- formerly_proven 5y ago
  You can keep such logs under article 6.1.f if the retention period is 30 days or less (causing self-fulfillment of article 17) or indefinitely if you remove/anonymize PII from them. Of course article 17.3 gives you an exemption for various purposes, e.g. if you had a breach you don't need to delete the logs from that period while investigating it.
  - shadowgovt 5y ago
    I fail to see how a 30-day or fewer retention policy impinges on article 17 one way or the other, nor do I see how article 6.1 gives any protection on the topic of the default Apache HTTP access logs (which include IP addresses).

efdee 5y ago

In my experience, almost all of those consent popups work the same way. On the first popup, press the button that doesn't say they can just use all cookies. On the second popup, press the button that says it saves your preferences.