4 ms·

> Did we consider that if everyone is breaking the law, the law itself might need a rework? No, GDPR is doing tons of good works. The whole web is a privacy a

> Did we consider that if everyone is breaking the law, the law itself might need a rework? No, GDPR is doing tons of good works. The whole web is a privacy and security nightmare and we've been tolerating this mess long enough. Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR. The reality is that 99% of websites need zero cookies, zero popups and no logging of IP addresses. The ones requiring login can set a login cookie without pestering the user.

robin_reala 5y ago
Exactly, everyone’s still breaking the law, but it’s not a binary thing. They’re breaking the law much less now, and they’re being much better about documenting the ways in which they’re breaking it than they were previously.
aidos 5y ago
Sure, but you have to also accept that there are aspects that have made the internet a worse experience without actually improving the situation from a privacy point of view.
- mpweiher 5y ago
  Yes, there are aspects that have gotten worse, but all those aspects are companies breaking the law in question. And no, privacy actually is improving. And enforcement is ramping up. We still have a way to go, but we're moving in the right direction.
- Nextgrid 5y ago
  To be fair, the GDPR does outlaw all the things we find annoying with the cookie banners (or rather, data processing consent flows, as they cover more than just cookies). The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead people into hating the GDPR. This problem would be resolved overnight (and everyone's privacy increased by orders of magnitude, since spyware would become illegal again) if those fines actually started coming down.
  - robin_reala 5y ago
    Billion-dollar fines can only happen if the company in question had a revenue of €25B per year and was hit with the maximum fine. But either way, enforcement is absolutely happening: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ has over a 1,000 rulings in its DB.
    - Nextgrid 5y ago
      It's not enough. That link gets posted all the time but it just shows that over 4 years, across all companies, the total fine amount is just over 1Bn. How much does Google or Facebook profit from non-consensual data processing in just a single year?
      - goodpoint 5y ago
        Clearly the EU wants to give companies the time to adapt. Internet privacy has been a laissez-faire dystopian wasteland for decades. Even with the current very gentle enforcement, GDPR has received a lot of push back and called draconian (by those who benefit from corporate surveillance).
  - throwaway_sb666 5y ago
    > The problem is continuous lack of enforcement Yeah, but it's hard to enforce a law at scale when the difference between legal and illegal behavior is not obvious to a layperson. The law is too technical. It also has shouldn't have options where a user can simply allow further data collection, since this makes it hard clearly say whether a certain practice is legal or not, since it "will depend". This creates more friction to enforcement. If things were more clear-cut, enforcement could be automated, and you would probably see those fines roll out. It is harder to say "this software library is illegal to use in the EU" if there are certain circumstances where it's not.
    - mnw21cam 5y ago
      > ...the difference between legal and illegal behavior is not obvious to a layperson. GDPR and cookie law is not hard to understand, so that excuse is a little bit lame to be honest. Besides, if you really need to understand what you must do by law, you should hire a lawyer. That's the same as with any other law.

robin_reala 5y ago

Exactly, everyone’s still breaking the law, but it’s not a binary thing. They’re breaking the law much less now, and they’re being much better about documenting the ways in which they’re breaking it than they were previously.

aidos 5y ago

Sure, but you have to also accept that there are aspects that have made the internet a worse experience without actually improving the situation from a privacy point of view.

mpweiher 5y ago
Yes, there are aspects that have gotten worse, but all those aspects are companies breaking the law in question. And no, privacy actually is improving. And enforcement is ramping up. We still have a way to go, but we're moving in the right direction.
Nextgrid 5y ago
To be fair, the GDPR does outlaw all the things we find annoying with the cookie banners (or rather, data processing consent flows, as they cover more than just cookies). The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead people into hating the GDPR. This problem would be resolved overnight (and everyone's privacy increased by orders of magnitude, since spyware would become illegal again) if those fines actually started coming down.
- robin_reala 5y ago
  Billion-dollar fines can only happen if the company in question had a revenue of €25B per year and was hit with the maximum fine. But either way, enforcement is absolutely happening: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ has over a 1,000 rulings in its DB.
  - Nextgrid 5y ago
    It's not enough. That link gets posted all the time but it just shows that over 4 years, across all companies, the total fine amount is just over 1Bn. How much does Google or Facebook profit from non-consensual data processing in just a single year?
    - goodpoint 5y ago
      Clearly the EU wants to give companies the time to adapt. Internet privacy has been a laissez-faire dystopian wasteland for decades. Even with the current very gentle enforcement, GDPR has received a lot of push back and called draconian (by those who benefit from corporate surveillance).
- throwaway_sb666 5y ago
  > The problem is continuous lack of enforcement Yeah, but it's hard to enforce a law at scale when the difference between legal and illegal behavior is not obvious to a layperson. The law is too technical. It also has shouldn't have options where a user can simply allow further data collection, since this makes it hard clearly say whether a certain practice is legal or not, since it "will depend". This creates more friction to enforcement. If things were more clear-cut, enforcement could be automated, and you would probably see those fines roll out. It is harder to say "this software library is illegal to use in the EU" if there are certain circumstances where it's not.
  - mnw21cam 5y ago
    > ...the difference between legal and illegal behavior is not obvious to a layperson. GDPR and cookie law is not hard to understand, so that excuse is a little bit lame to be honest. Besides, if you really need to understand what you must do by law, you should hire a lawyer. That's the same as with any other law.