4 ms·

How do sites abuse Legitimate Interest? LI is something vendors declare to the IAB, not the sites. These CMPs just present that information to the user (in comp

How do sites abuse Legitimate Interest? LI is something vendors declare to the IAB, not the sites. These CMPs just present that information to the user (in complicated ways) so they can Accept/Decline/Object.

ratww 5y ago
> How do sites abuse Legitimate Interest? By pretending that advertisement and tracking are part of Legitimate Interest, and having a "secondary section" that is not only pre-accepted, but also overrides the proper consent part. To really decline consent in those cases, you must uncheck all "Legitimate Interest" checkboxes. Not only those things are not legitimate interest, this also overrides the lack-of-consent provided by users for a couple vendors. Legitimate interest is not a get out of jail free card. You can't apply it to everything and pretend you got consent. https://i.imgur.com/M9gUEVi.png https://i.imgur.com/M9gUEVi.png
- secondcoming 5y ago
  LI is separate Legal Basis to Consent, that's why there are two lists in the CMP. The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. One does not override the other. The full list of the LI purposes claimed by adtech players is available at [0] As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything. In any case, it's not sites that are the issue. It's the CMP screens. [0] https://vendor-list.consensu.org/v2/vendor-list.json https://vendor-list.consensu.org/v2/vendor-list.json
  - ratww 5y ago
    > LI is separate Legal Basis to Consent, that's why there are two lists in the CMP.* I never said the opposite and never said that was problem. Presenting non-Legitimate Interest as if it were, however is shady and probably illegal. > The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. I never said that being separated is a problem. The problem is using anything that is firmly NOT in the Legitimate interest camp as if it were, and using that to mislead customers. > One does not override the other. It does in this case, and it is easily verifiable. Even if I disallow a certain tracking vendor, it will still load stuff from this vendor in websites, even though nothing from this vendor configures "Legitimate Interest". And all my data will still be piped to those adware, etc, vendors, that provide no functions other than adware, tracking and other shady stuff that GDPR requires consent for. > As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything.* That's beside the point. If it were really Legitimate Interest, there would be no need for asking.
youngtaff 5y ago
Tracking for Ad fraud is one example where they claim legitimate interest, which is BS IMV

ratww 5y ago

> How do sites abuse Legitimate Interest? By pretending that advertisement and tracking are part of Legitimate Interest, and having a "secondary section" that is not only pre-accepted, but also overrides the proper consent part. To really decline consent in those cases, you must uncheck all "Legitimate Interest" checkboxes. Not only those things are not legitimate interest, this also overrides the lack-of-consent provided by users for a couple vendors. Legitimate interest is not a get out of jail free card. You can't apply it to everything and pretend you got consent. https://i.imgur.com/M9gUEVi.png https://i.imgur.com/M9gUEVi.png

secondcoming 5y ago
LI is separate Legal Basis to Consent, that's why there are two lists in the CMP. The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. One does not override the other. The full list of the LI purposes claimed by adtech players is available at [0] As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything. In any case, it's not sites that are the issue. It's the CMP screens. [0] https://vendor-list.consensu.org/v2/vendor-list.json https://vendor-list.consensu.org/v2/vendor-list.json
- ratww 5y ago
  > LI is separate Legal Basis to Consent, that's why there are two lists in the CMP.* I never said the opposite and never said that was problem. Presenting non-Legitimate Interest as if it were, however is shady and probably illegal. > The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules. I never said that being separated is a problem. The problem is using anything that is firmly NOT in the Legitimate interest camp as if it were, and using that to mislead customers. > One does not override the other. It does in this case, and it is easily verifiable. Even if I disallow a certain tracking vendor, it will still load stuff from this vendor in websites, even though nothing from this vendor configures "Legitimate Interest". And all my data will still be piped to those adware, etc, vendors, that provide no functions other than adware, tracking and other shady stuff that GDPR requires consent for. > As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything.* That's beside the point. If it were really Legitimate Interest, there would be no need for asking.

youngtaff 5y ago

Tracking for Ad fraud is one example where they claim legitimate interest, which is BS IMV