7 ms·

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that c

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it would make live more easy. But it would be enough if companies would just not use dark patterns. If there is a banner the "Accept all" and the "Deny all" must be both be the same level of "easy-ness" and the same amounts of clicks (and wait time). Only if you want to you would need to dive into the detailed categories. And even there: Most sites abuse "legitimate interest". Everything non essential should by default be inactive. But sadly it isn't. Disclaimer: I am a data analyst/Web analyst. I do this stuff for a living for clients. Still I value these things highly. And would love for it to be implemented correctly.

pydry 5y ago
If you program a browser to consent for you that is no different to consenting yourself. Just as writing and running an install script with --accept-tos is valid.
- pmontra 5y ago
  That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of "surprises". So yes, a browser could come with an "Accept all" setting, probably disabled by default, but which browser vendor is going to go through the trouble of implementing that, proposing an API and above all getting every Privacy Agency of the world to accept that?
  - pydry 5y ago
    Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent. Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could. Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.
    - MereInterest 5y ago
      If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent for a surgery two weeks later if I hadn't been aware of the risks of the surgery at the time that I signed the form. Being informed of the specifics for a particular procedure is necessary, not just being informed of the general risks of medical procedures. In the same way, GDPR requires informed consent about the specific use of data by a specific data controller. From https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ : > For consent to be informed and specific, the data subject must at least be notified about the controller’s identity, what kind of data will be processed, how it will be used and the purpose of the processing operations as a safeguard against ‘function creep’. The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent in the context of the GDPR, because the consent was given prior to the human being informed about the specific use by the specific site.
      - pydry 5y ago
        >If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent Medical consent is a whole different kettle of fish and I may be off base here but I am pretty sure you can preauthorize consent for, e.g. theres a risk you may become unconscious and need follow up treatment. >The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent It's absolutely possible to have all of this information sent in an API to software acting on behalf of the user. The user has been informed and the obligations of the website will have been discharged. What the users browser does with this is the users business.
      - eternityforest 5y ago
        We cannot have a modern technological society if we treat tracking with the same concern we treat medical consent. That road leads to banning street photography and CCTV, and being able to get a gag order to stop people from saying "Yeah I saw Brian at the bar last night". When does it stop? There are no uses of cookies an average user cares about that aren't already illegal. They are basically all for the same thing, to spy on you and sell your data to third parties to the fullest extent of the law, excluding any data you would actually notice being sold like credit card numbers, and many users don't care.
- denton-scratch 5y ago
  If you program a browser to auto-consent, then that isn't informed consent, even if your browser can read and parse a TOS (which I can't). Install scripts run with --accept-tos have nothing to do with personal data or privacy, and are outside the scope of GDPR.
radicalbyte 5y ago
It should literally be a setting in the browser - auto decline. That would make everyone's life a lot easier.
- Nextgrid 5y ago
  We had something like that called DNT, and not only did nobody honor it, but it was used as an extra fingerprinting vector, totally defeating its purpose. According to the GDPR, all non-essential tracking should be off by default, so "decline" is already the default if companies were compliant with the regulation (which is a big "if").
  - Beltiras 5y ago
    You should rewrite that ending in "since companies aren't"
  - renewiltord 5y ago
    I was in ad tech once. We obeyed it. Lots of traffic went through us. No one cared that we obeyed it and our competitors didn’t. Left the code in anyway but that’s the thing about these things: consumer behavior reveals that they don’t actually give a fuck about whether anyone obeys this or not except for the time when they want to be outraged.
    - Apocryphon 5y ago
      And the customer is always right.
    - Nextgrid 5y ago
      The thing is that from a user's perspective there's no way to tell whether someone obeys it or not because lying is not punished, so the safe thing to do is to assume the worst in all cases.
      - renewiltord 5y ago
        Right. It's rational for the user not to care. The point is that it was designed to fail since there's no closed loop verification. i.e. DNT was a bad design.
secondcoming 5y ago
How do sites abuse Legitimate Interest? LI is something vendors declare to the IAB, not the sites. These CMPs just present that information to the user (in complicated ways) so they can Accept/Decline/Object.
- ratww 5y ago
  > How do sites abuse Legitimate Interest? By pretending that advertisement and tracking are part of Legitimate Interest, and having a "secondary section" that is not only pre-accepted, but also overrides the proper consent part. To really decline consent in those cases, you must uncheck all "Legitimate Interest" checkboxes. Not only those things are not legitimate interest, this also overrides the lack-of-consent provided by users for a couple vendors. Legitimate interest is not a get out of jail free card. You can't apply it to everything and pretend you got consent. https://i.imgur.com/M9gUEVi.png https://i.imgur.com/M9gUEVi.png
  - secondcoming 5y ago
    LI is separate Legal Basis to Consent, that's why there are two lists in the CMP. The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. One does not override the other. The full list of the LI purposes claimed by adtech players is available at [0] As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything. In any case, it's not sites that are the issue. It's the CMP screens. [0] https://vendor-list.consensu.org/v2/vendor-list.json https://vendor-list.consensu.org/v2/vendor-list.json
    - ratww 5y ago
      > LI is separate Legal Basis to Consent, that's why there are two lists in the CMP.* I never said the opposite and never said that was problem. Presenting non-Legitimate Interest as if it were, however is shady and probably illegal. > The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. I never said that being separated is a problem. The problem is using anything that is firmly NOT in the Legitimate interest camp as if it were, and using that to mislead customers. > One does not override the other. It does in this case, and it is easily verifiable. Even if I disallow a certain tracking vendor, it will still load stuff from this vendor in websites, even though nothing from this vendor configures "Legitimate Interest". And all my data will still be piped to those adware, etc, vendors, that provide no functions other than adware, tracking and other shady stuff that GDPR requires consent for. > As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything.* That's beside the point. If it were really Legitimate Interest, there would be no need for asking.
FreeHugs 5y ago
"Accept all" and the "Deny all" must be both be the same level of "easy-ness" I think this is not clear until it has been tested in court. Many websites now have two offers: Free with 3rd part ads and paid. Surely paying is much less easy than clicking "Ok, show me the content with 3rd party ads". It will be very interesting, how courts see this.
- croes 5y ago
  Ads aren't the problem, tracking is. You can deliver ads without this complete user tracking.
- andylynch 5y ago
  I think it's pretty clear, GDPR literally says 'It shall be as easy to withdraw as to give consent'. The really problem is enforcement has been lacking, this is what NOYB are co. are working to fix.
  - FreeHugs 5y ago
    As far as I understand it, "withdraw" here is the withdraw of the consent at a later time. Consent that was previously given. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ I don't think it means that when asked for consent, the user must have an easy way to deny that consent. As the user can always decide to simply not use the website.
- sdoering 5y ago
  In Germany, the media sites that offered "either tracking/advertising" on vs "paid content approach" were already in court with that practice and won. The current situation is, that the courts decided, that the business model (advertising and by that tracking the sh*t out of people) is valid if they offer an alternative were people pay them for access to the content.
  - FreeHugs 5y ago
    were already in court Really? That surprises me. I did not hear about this. Do you have a link to such a case?
aahortwwy 5y ago
The banners are inherently dark patterns. Non-essential cookies could be enabled via a configuration menu opened by the user at a time of their choosing. But everybody knows no user is going to do that, particularly unprompted. So they create a pop-up banner to do both the prompting and the configuration. And everybody knows most users, when they see a pop-up, are just looking for the sequence of button presses needed to remove the pop-up. So they make sure that that's "enable all cookies" because they know if it's "only enable essential cookies" vanishingly few users will enable non-essentials. Why would they? If everything non-essential were required to be inactive by default I think the pop-ups would disappear entirely. There'd be no point to them because vanishingly few users would ever change the defaults.
coffeeblack 5y ago
Just like a robots.txt you could have a privacy.txt or so at the root of the site. Then the browser could take care of displaying it in a uniform way together with the “accept” and “reject” buttons in a uniform way. Would be much easier for the website and it would make it impossible to use dark patterns.
eternityforest 5y ago
I'm really surprised nobody caught this and that the law even managed to pass unmodified. They're treating "Accept cookies" with the same seriousness you'd expect from "Do you consent to me putting a whole package of cookie dough up your rear". The whole GDPR seems to be one step away from censorship. And it seems almost like the real intent has less to do with user choice and informed consent, and more to do with just trying to kill off data collection as a business model completely, before we have a replacement for it.

pydry 5y ago

If you program a browser to consent for you that is no different to consenting yourself. Just as writing and running an install script with --accept-tos is valid.

pmontra 5y ago
That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of "surprises". So yes, a browser could come with an "Accept all" setting, probably disabled by default, but which browser vendor is going to go through the trouble of implementing that, proposing an API and above all getting every Privacy Agency of the world to accept that?
- pydry 5y ago
  Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent. Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could. Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.
  - MereInterest 5y ago
    If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent for a surgery two weeks later if I hadn't been aware of the risks of the surgery at the time that I signed the form. Being informed of the specifics for a particular procedure is necessary, not just being informed of the general risks of medical procedures. In the same way, GDPR requires informed consent about the specific use of data by a specific data controller. From https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ : > For consent to be informed and specific, the data subject must at least be notified about the controller’s identity, what kind of data will be processed, how it will be used and the purpose of the processing operations as a safeguard against ‘function creep’. The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent in the context of the GDPR, because the consent was given prior to the human being informed about the specific use by the specific site.
    - pydry 5y ago
      >If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent Medical consent is a whole different kettle of fish and I may be off base here but I am pretty sure you can preauthorize consent for, e.g. theres a risk you may become unconscious and need follow up treatment. >The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent It's absolutely possible to have all of this information sent in an API to software acting on behalf of the user. The user has been informed and the obligations of the website will have been discharged. What the users browser does with this is the users business.
    - eternityforest 5y ago
      We cannot have a modern technological society if we treat tracking with the same concern we treat medical consent. That road leads to banning street photography and CCTV, and being able to get a gag order to stop people from saying "Yeah I saw Brian at the bar last night". When does it stop? There are no uses of cookies an average user cares about that aren't already illegal. They are basically all for the same thing, to spy on you and sell your data to third parties to the fullest extent of the law, excluding any data you would actually notice being sold like credit card numbers, and many users don't care.
denton-scratch 5y ago
If you program a browser to auto-consent, then that isn't informed consent, even if your browser can read and parse a TOS (which I can't). Install scripts run with --accept-tos have nothing to do with personal data or privacy, and are outside the scope of GDPR.

radicalbyte 5y ago

It should literally be a setting in the browser - auto decline. That would make everyone's life a lot easier.

Nextgrid 5y ago
We had something like that called DNT, and not only did nobody honor it, but it was used as an extra fingerprinting vector, totally defeating its purpose. According to the GDPR, all non-essential tracking should be off by default, so "decline" is already the default if companies were compliant with the regulation (which is a big "if").
- Beltiras 5y ago
  You should rewrite that ending in "since companies aren't"
- renewiltord 5y ago
  I was in ad tech once. We obeyed it. Lots of traffic went through us. No one cared that we obeyed it and our competitors didn’t. Left the code in anyway but that’s the thing about these things: consumer behavior reveals that they don’t actually give a fuck about whether anyone obeys this or not except for the time when they want to be outraged.
  - Apocryphon 5y ago
    And the customer is always right.
  - Nextgrid 5y ago
    The thing is that from a user's perspective there's no way to tell whether someone obeys it or not because lying is not punished, so the safe thing to do is to assume the worst in all cases.
    - renewiltord 5y ago
      Right. It's rational for the user not to care. The point is that it was designed to fail since there's no closed loop verification. i.e. DNT was a bad design.

secondcoming 5y ago

How do sites abuse Legitimate Interest? LI is something vendors declare to the IAB, not the sites. These CMPs just present that information to the user (in complicated ways) so they can Accept/Decline/Object.

ratww 5y ago
> How do sites abuse Legitimate Interest? By pretending that advertisement and tracking are part of Legitimate Interest, and having a "secondary section" that is not only pre-accepted, but also overrides the proper consent part. To really decline consent in those cases, you must uncheck all "Legitimate Interest" checkboxes. Not only those things are not legitimate interest, this also overrides the lack-of-consent provided by users for a couple vendors. Legitimate interest is not a get out of jail free card. You can't apply it to everything and pretend you got consent. https://i.imgur.com/M9gUEVi.png https://i.imgur.com/M9gUEVi.png
- secondcoming 5y ago
  LI is separate Legal Basis to Consent, that's why there are two lists in the CMP. The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. One does not override the other. The full list of the LI purposes claimed by adtech players is available at [0] As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything. In any case, it's not sites that are the issue. It's the CMP screens. [0] https://vendor-list.consensu.org/v2/vendor-list.json https://vendor-list.consensu.org/v2/vendor-list.json
  - ratww 5y ago
    > LI is separate Legal Basis to Consent, that's why there are two lists in the CMP.* I never said the opposite and never said that was problem. Presenting non-Legitimate Interest as if it were, however is shady and probably illegal. > The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. I never said that being separated is a problem. The problem is using anything that is firmly NOT in the Legitimate interest camp as if it were, and using that to mislead customers. > One does not override the other. It does in this case, and it is easily verifiable. Even if I disallow a certain tracking vendor, it will still load stuff from this vendor in websites, even though nothing from this vendor configures "Legitimate Interest". And all my data will still be piped to those adware, etc, vendors, that provide no functions other than adware, tracking and other shady stuff that GDPR requires consent for. > As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything.* That's beside the point. If it were really Legitimate Interest, there would be no need for asking.

FreeHugs 5y ago

"Accept all" and the "Deny all" must be both be the same level of "easy-ness" I think this is not clear until it has been tested in court. Many websites now have two offers: Free with 3rd part ads and paid. Surely paying is much less easy than clicking "Ok, show me the content with 3rd party ads". It will be very interesting, how courts see this.

croes 5y ago
Ads aren't the problem, tracking is. You can deliver ads without this complete user tracking.
andylynch 5y ago
I think it's pretty clear, GDPR literally says 'It shall be as easy to withdraw as to give consent'. The really problem is enforcement has been lacking, this is what NOYB are co. are working to fix.
- FreeHugs 5y ago
  As far as I understand it, "withdraw" here is the withdraw of the consent at a later time. Consent that was previously given. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ I don't think it means that when asked for consent, the user must have an easy way to deny that consent. As the user can always decide to simply not use the website.
sdoering 5y ago
In Germany, the media sites that offered "either tracking/advertising" on vs "paid content approach" were already in court with that practice and won. The current situation is, that the courts decided, that the business model (advertising and by that tracking the sh*t out of people) is valid if they offer an alternative were people pay them for access to the content.
- FreeHugs 5y ago
  were already in court Really? That surprises me. I did not hear about this. Do you have a link to such a case?

aahortwwy 5y ago

The banners are inherently dark patterns. Non-essential cookies could be enabled via a configuration menu opened by the user at a time of their choosing. But everybody knows no user is going to do that, particularly unprompted. So they create a pop-up banner to do both the prompting and the configuration. And everybody knows most users, when they see a pop-up, are just looking for the sequence of button presses needed to remove the pop-up. So they make sure that that's "enable all cookies" because they know if it's "only enable essential cookies" vanishingly few users will enable non-essentials. Why would they? If everything non-essential were required to be inactive by default I think the pop-ups would disappear entirely. There'd be no point to them because vanishingly few users would ever change the defaults.

coffeeblack 5y ago

Just like a robots.txt you could have a privacy.txt or so at the root of the site. Then the browser could take care of displaying it in a uniform way together with the “accept” and “reject” buttons in a uniform way. Would be much easier for the website and it would make it impossible to use dark patterns.

eternityforest 5y ago

I'm really surprised nobody caught this and that the law even managed to pass unmodified. They're treating "Accept cookies" with the same seriousness you'd expect from "Do you consent to me putting a whole package of cookie dough up your rear". The whole GDPR seems to be one step away from censorship. And it seems almost like the real intent has less to do with user choice and informed consent, and more to do with just trying to kill off data collection as a business model completely, before we have a replacement for it.