4 ms·

That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of

That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of "surprises". So yes, a browser could come with an "Accept all" setting, probably disabled by default, but which browser vendor is going to go through the trouble of implementing that, proposing an API and above all getting every Privacy Agency of the world to accept that?

pydry 5y ago
Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent. Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could. Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.
- MereInterest 5y ago
  If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent for a surgery two weeks later if I hadn't been aware of the risks of the surgery at the time that I signed the form. Being informed of the specifics for a particular procedure is necessary, not just being informed of the general risks of medical procedures. In the same way, GDPR requires informed consent about the specific use of data by a specific data controller. From https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ : > For consent to be informed and specific, the data subject must at least be notified about the controller’s identity, what kind of data will be processed, how it will be used and the purpose of the processing operations as a safeguard against ‘function creep’. The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent in the context of the GDPR, because the consent was given prior to the human being informed about the specific use by the specific site.
  - pydry 5y ago
    >If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent Medical consent is a whole different kettle of fish and I may be off base here but I am pretty sure you can preauthorize consent for, e.g. theres a risk you may become unconscious and need follow up treatment. >The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent It's absolutely possible to have all of this information sent in an API to software acting on behalf of the user. The user has been informed and the obligations of the website will have been discharged. What the users browser does with this is the users business.
  - eternityforest 5y ago
    We cannot have a modern technological society if we treat tracking with the same concern we treat medical consent. That road leads to banning street photography and CCTV, and being able to get a gag order to stop people from saying "Yeah I saw Brian at the bar last night". When does it stop? There are no uses of cookies an average user cares about that aren't already illegal. They are basically all for the same thing, to spy on you and sell your data to third parties to the fullest extent of the law, excluding any data you would actually notice being sold like credit card numbers, and many users don't care.
    - MereInterest 5y ago
      This is a late reply, but I'd been thinking on what you said and wanted to figure out where my disagreement lay. I think the biggest issue is that scale must be considered, and not merely whether each individual action is justified. * Asking if somebody saw Brian at the bar last night is acceptable. Asking everybody if they saw Brian somewhere is acceptable in limited circumstances, such as Brian having been kidnapped. Asking everybody to list out who they saw and when is an unacceptable violation of privacy. * Street photography is acceptable. Taking a picture once every day of the same house may be acceptable, such as if it is a historically interesting building, or if it is your own house. Collecting millions of street photographs, along with the time they were taken and who was in each photograph, is an unacceptable violation of privacy. * CCTV is acceptable. Maintaining records of CCTV indefinitely may be acceptable, depending on the type of building. (e.g. The Pentagon may be justified in keeping CCTV recordings indefinitely, but the local laundromat is not.) Linking CCTV cameras together into a centralized query-able network that tracks people between locations is an unacceptable violation of privacy. There are two common features that I realized in these examples. First, even if an individual action is acceptable and justified, repetition and coordination of that action may not be. This is similar to how saying hello when crossing paths with somebody is a courtesy and a pleasantry, but saying hello to the same person every 30 seconds is stalking. The difference in scale produces a different in outcome. Second, there exist gradations of privacy, rather than being a binary divide between public and private spaces. Between a completely private space, such as a person inside their own home with the windows drawn, and a completely public space, such as a person giving a speech on live TV, there are intermediate spaces. A person who is walking down the street has partial privacy, where their actions may be remembered by passersby for a day or two, but wouldn't be remembered a month or a year later. In the past, these gradations of privacy were maintained by the limits of human memory and the high cost of technological memory, but the cost of technological memory has fallen to a point where this social construct is breaking down. Summing up, I would say that we cannot have a modern technological society if we *don't* treat tracking with the same concern we treat medical consent.
- pmontra 5y ago
  > Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. IANAL so it's pointless for me to argue on that point. Of course if somebody is happy to accept in advance any privacy policy and will confirm all of those automated choices in a court (if they'll ever be challenged, can't think why), no problem with that. My point was that we shouldn't expect a major browser vendor to go through all the process to build an API with those legal implications. I wouldn't bet on major websites adopting that API anyway. It looks so much following the letter of the law and circumventing the spirit of it. Very risky, both legally and as a middle finger to the regulators.
  - eternityforest 5y ago
    Why not? Google loves tracking(At least when it's their own) and users hate popups. A feature saving 2 seconds on 90% of sites is a big deal.
  - pydry 5y ago
    >It looks so much following the letter of the law and circumventing the spirit of it. I dont think this is true either. The consent options would typically come under a few pretty well defined headers (e.g. advertising) and could include the capability of raising specific exceptions for nonstandard requests.

pydry 5y ago

Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent. Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could. Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.

MereInterest 5y ago
If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent for a surgery two weeks later if I hadn't been aware of the risks of the surgery at the time that I signed the form. Being informed of the specifics for a particular procedure is necessary, not just being informed of the general risks of medical procedures. In the same way, GDPR requires informed consent about the specific use of data by a specific data controller. From https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ : > For consent to be informed and specific, the data subject must at least be notified about the controller’s identity, what kind of data will be processed, how it will be used and the purpose of the processing operations as a safeguard against ‘function creep’. The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent in the context of the GDPR, because the consent was given prior to the human being informed about the specific use by the specific site.
- pydry 5y ago
  >If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent Medical consent is a whole different kettle of fish and I may be off base here but I am pretty sure you can preauthorize consent for, e.g. theres a risk you may become unconscious and need follow up treatment. >The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent It's absolutely possible to have all of this information sent in an API to software acting on behalf of the user. The user has been informed and the obligations of the website will have been discharged. What the users browser does with this is the users business.
- eternityforest 5y ago
  We cannot have a modern technological society if we treat tracking with the same concern we treat medical consent. That road leads to banning street photography and CCTV, and being able to get a gag order to stop people from saying "Yeah I saw Brian at the bar last night". When does it stop? There are no uses of cookies an average user cares about that aren't already illegal. They are basically all for the same thing, to spy on you and sell your data to third parties to the fullest extent of the law, excluding any data you would actually notice being sold like credit card numbers, and many users don't care.
  - MereInterest 5y ago
    This is a late reply, but I'd been thinking on what you said and wanted to figure out where my disagreement lay. I think the biggest issue is that scale must be considered, and not merely whether each individual action is justified. * Asking if somebody saw Brian at the bar last night is acceptable. Asking everybody if they saw Brian somewhere is acceptable in limited circumstances, such as Brian having been kidnapped. Asking everybody to list out who they saw and when is an unacceptable violation of privacy. * Street photography is acceptable. Taking a picture once every day of the same house may be acceptable, such as if it is a historically interesting building, or if it is your own house. Collecting millions of street photographs, along with the time they were taken and who was in each photograph, is an unacceptable violation of privacy. * CCTV is acceptable. Maintaining records of CCTV indefinitely may be acceptable, depending on the type of building. (e.g. The Pentagon may be justified in keeping CCTV recordings indefinitely, but the local laundromat is not.) Linking CCTV cameras together into a centralized query-able network that tracks people between locations is an unacceptable violation of privacy. There are two common features that I realized in these examples. First, even if an individual action is acceptable and justified, repetition and coordination of that action may not be. This is similar to how saying hello when crossing paths with somebody is a courtesy and a pleasantry, but saying hello to the same person every 30 seconds is stalking. The difference in scale produces a different in outcome. Second, there exist gradations of privacy, rather than being a binary divide between public and private spaces. Between a completely private space, such as a person inside their own home with the windows drawn, and a completely public space, such as a person giving a speech on live TV, there are intermediate spaces. A person who is walking down the street has partial privacy, where their actions may be remembered by passersby for a day or two, but wouldn't be remembered a month or a year later. In the past, these gradations of privacy were maintained by the limits of human memory and the high cost of technological memory, but the cost of technological memory has fallen to a point where this social construct is breaking down. Summing up, I would say that we cannot have a modern technological society if we *don't* treat tracking with the same concern we treat medical consent.
pmontra 5y ago
> Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. IANAL so it's pointless for me to argue on that point. Of course if somebody is happy to accept in advance any privacy policy and will confirm all of those automated choices in a court (if they'll ever be challenged, can't think why), no problem with that. My point was that we shouldn't expect a major browser vendor to go through all the process to build an API with those legal implications. I wouldn't bet on major websites adopting that API anyway. It looks so much following the letter of the law and circumventing the spirit of it. Very risky, both legally and as a middle finger to the regulators.
- eternityforest 5y ago
  Why not? Google loves tracking(At least when it's their own) and users hate popups. A feature saving 2 seconds on 90% of sites is a big deal.
- pydry 5y ago
  >It looks so much following the letter of the law and circumventing the spirit of it. I dont think this is true either. The consent options would typically come under a few pretty well defined headers (e.g. advertising) and could include the capability of raising specific exceptions for nonstandard requests.