4 ms·

The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for se

by geon 5y ago

The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality. You can not use them to track users on third party sites, or store personally identifiable info without explicit consent, and in that case, denying consent should be as easy, and not affect other functionality, such as blocking content.

lp0_on_fire 5y ago
> developers misunderstand it. Then maybe the law needs some adjusting to make compliance more manageable.
- Teever 5y ago
  Why? maybe developers beed some adjusting to make compliance numbers higher.
  - lp0_on_fire 5y ago
    Because GDPR has been around for a few years and its still unmanageable. Laws need to be realistic to make compliance easy and widespread. Maybe there needs to be resources for training or something. There are lots of things you can tweak while still getting the benefits.
    - LordDragonfang 5y ago
      Compliance is easy and manageable, for the most part. It's just that companies want to still do the things the law is trying to disincentivize, and want to put as many dark patterns as they can in the way of users avoiding it. So the "unmanageable" part is trying to figure out how close you can come to breaking the law without being blatant.
- krageon 5y ago
  If you as a developer are tasked with understanding this, you take the time to read the actual rules and then you misunderstand it, you are incompetent. But this is not what generally happens. Folks don't read, just yolo some terrible explanation off of SO and then complain when someone tells them they are not compliant. That's laziness. Those are the only reasons for noncompliance, outside of actual malice.
  - alkonaut 5y ago
    It can be cheaper to misunderstand it. So long as risk of getting fined is low, and the fines aren't higher than they are, you aren't really tasked with being compliant. You are given a task to implement something in compliance but what that means is as compliant as possible while still making sure the business survives, possibly even on the same business model. That latter part isn't explicitly given to a developer in the instructions - but it's going to be made clear that if you don't want to put up the minimum-effort cookie wall, there is someone else that can do that job. This is why we need a law that people actually fear to the point where they would rather switch off the lights and take down the sign, than try to put up an off the shelf cookie wall that can be configured to have an "Accept all" button.
    - krageon 5y ago
      Terrible take. If breaking the law to make money is how you operate, you're not a company. You're a criminal cartel.
      - alkonaut 5y ago
        That’s how all these sites operate now. It’s cheaper to keep operating in violation than shutting down. That’s what should change.
TomasEkeli 5y ago
very much this. I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.
- throwaway_sb666 5y ago
  If the law is right, but not possible to enforce, some fixing may be needed
  - litgab 5y ago
    Like with drug dealers?
    - throwaway_sb666 5y ago
      Yeah like instead of having them on the street, they could have a shop and you could tax them a lot and make sure people know what they are getting into. Same with sharing personal data - maybe not a bad parallel :)
  - jjoonathan 5y ago
    Everyone and their dog who has been getting away with bad behavior is going to take that stance as a stalling tactic. It might be true, but either way it's going to have a lot of bad-faith weight behind it, so we need to make our strategy robust to that inevitability. I'll default to skepticism but keep my mind open to proposals that are concrete and specific.
    - throwaway_sb666 5y ago
      Check my other comment: https://news.ycombinator.com/item?id=30755527 https://news.ycombinator.com/item?id=30755527
  - miki123211 5y ago
    IMO, the problem with GDPR is the same problem we have with a lot of European laws. There's nobody who's incentivized to enforce compliance. If you were able to sue for GDPR violations, either on your own or in a class lawsuit, you would have an incentive to prove that the violation has indeed occurred. As long as your lawyer was working on commission, they would share that incentive. As it stands, all you can do is file a complaint with your GDPR office and hope it makes a difference. You don't get any money from that, so hiring a lawyer to get such a complaint right is an expense you will not get reimbursed for. More importantly, the person investigating your complaint is probably on a salary, not a commission, so they don't personally care about how successful they are. Compare that to the ADA[1], for example, where you literally get legal firms looking for disabled Americans, finding places that don't comply with the law and suing them. Enforcement was partially privatized, and the free market, as it often does, found a better and more efficient way of enforcing the law than the government could dream of.
naniwaduni 5y ago
The law should not have had the consent provision. Without consent provisions, the law makes a fine general prohibition on unnecessary use of personal data,† albeit with a few kinks that I'm glossing over with "unnecessary". But it has the outlines of a sensible regulation, the corner cases could surely have been smoothed out in court. The consent provision ruins everything. The fact of its existence reframes otherwise unlawful processing as "you need to get consent" instead of "you shouldn't be doing this", which is how it should be framed. It turns the whole regulation into a farce, restricting data processing to necessary uses except if you have the ability to document and semi-coerce consent (subtly enough to not invalidate the content you've obtained, but empirically that's clearly not closely examined). And lo, a parasite industry dedicated to coercing and documenting "consent"! †Just talking article 6 here, I don't really want to get into the weeds of chapter 3.

by geon 5y ago

lp0_on_fire 5y ago

> developers misunderstand it. Then maybe the law needs some adjusting to make compliance more manageable.

Teever 5y ago
Why? maybe developers beed some adjusting to make compliance numbers higher.
- lp0_on_fire 5y ago
  Because GDPR has been around for a few years and its still unmanageable. Laws need to be realistic to make compliance easy and widespread. Maybe there needs to be resources for training or something. There are lots of things you can tweak while still getting the benefits.
  - LordDragonfang 5y ago
    Compliance is easy and manageable, for the most part. It's just that companies want to still do the things the law is trying to disincentivize, and want to put as many dark patterns as they can in the way of users avoiding it. So the "unmanageable" part is trying to figure out how close you can come to breaking the law without being blatant.
krageon 5y ago
If you as a developer are tasked with understanding this, you take the time to read the actual rules and then you misunderstand it, you are incompetent. But this is not what generally happens. Folks don't read, just yolo some terrible explanation off of SO and then complain when someone tells them they are not compliant. That's laziness. Those are the only reasons for noncompliance, outside of actual malice.
- alkonaut 5y ago
  It can be cheaper to misunderstand it. So long as risk of getting fined is low, and the fines aren't higher than they are, you aren't really tasked with being compliant. You are given a task to implement something in compliance but what that means is as compliant as possible while still making sure the business survives, possibly even on the same business model. That latter part isn't explicitly given to a developer in the instructions - but it's going to be made clear that if you don't want to put up the minimum-effort cookie wall, there is someone else that can do that job. This is why we need a law that people actually fear to the point where they would rather switch off the lights and take down the sign, than try to put up an off the shelf cookie wall that can be configured to have an "Accept all" button.
  - krageon 5y ago
    Terrible take. If breaking the law to make money is how you operate, you're not a company. You're a criminal cartel.
    - alkonaut 5y ago
      That’s how all these sites operate now. It’s cheaper to keep operating in violation than shutting down. That’s what should change.

TomasEkeli 5y ago

very much this. I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.

throwaway_sb666 5y ago
If the law is right, but not possible to enforce, some fixing may be needed
- litgab 5y ago
  Like with drug dealers?
  - throwaway_sb666 5y ago
    Yeah like instead of having them on the street, they could have a shop and you could tax them a lot and make sure people know what they are getting into. Same with sharing personal data - maybe not a bad parallel :)
- jjoonathan 5y ago
  Everyone and their dog who has been getting away with bad behavior is going to take that stance as a stalling tactic. It might be true, but either way it's going to have a lot of bad-faith weight behind it, so we need to make our strategy robust to that inevitability. I'll default to skepticism but keep my mind open to proposals that are concrete and specific.
  - throwaway_sb666 5y ago
    Check my other comment: https://news.ycombinator.com/item?id=30755527 https://news.ycombinator.com/item?id=30755527
- miki123211 5y ago
  IMO, the problem with GDPR is the same problem we have with a lot of European laws. There's nobody who's incentivized to enforce compliance. If you were able to sue for GDPR violations, either on your own or in a class lawsuit, you would have an incentive to prove that the violation has indeed occurred. As long as your lawyer was working on commission, they would share that incentive. As it stands, all you can do is file a complaint with your GDPR office and hope it makes a difference. You don't get any money from that, so hiring a lawyer to get such a complaint right is an expense you will not get reimbursed for. More importantly, the person investigating your complaint is probably on a salary, not a commission, so they don't personally care about how successful they are. Compare that to the ADA[1], for example, where you literally get legal firms looking for disabled Americans, finding places that don't comply with the law and suing them. Enforcement was partially privatized, and the free market, as it often does, found a better and more efficient way of enforcing the law than the government could dream of.

naniwaduni 5y ago

The law should not have had the consent provision. Without consent provisions, the law makes a fine general prohibition on unnecessary use of personal data,† albeit with a few kinks that I'm glossing over with "unnecessary". But it has the outlines of a sensible regulation, the corner cases could surely have been smoothed out in court. The consent provision ruins everything. The fact of its existence reframes otherwise unlawful processing as "you need to get consent" instead of "you shouldn't be doing this", which is how it should be framed. It turns the whole regulation into a farce, restricting data processing to necessary uses except if you have the ability to document and semi-coerce consent (subtly enough to not invalidate the content you've obtained, but empirically that's clearly not closely examined). And lo, a parasite industry dedicated to coercing and documenting "consent"! †Just talking article 6 here, I don't really want to get into the weeds of chapter 3.