6 ms·

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies. And since IP-detection was not allowed, we did it for all website visitors. And because we have to remember your settings, we had to create a seperate anonymized database outside of our normal website. And the website broke ALL THE TIME. Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. And for several months the web team had a constant nightmare of customer complaints about broken stuff. In the first year we ended up spending close to $250k on legal advice from European lawyers, and most of the advice boiled down to "you're not going to get in trouble if you just do what everyone else is doing". Seriously. Since then it's gotten better - most third party vendors have done a better job of offering anonymized cookie versions of their products. Or there is just more industry guidance available on what kind of cookies can be considered sufficiently anonymous. For people who claim GDPR compliance is clear and straightforward - I can't believe they actually have much experience working in Privacy. Actual implementation gets... very opaque. Especially when the law says it's illegal to deny service based on their cookie preference, but some services are literally impossible to provide without a cookie of some form.

oblio 5y ago
Growing pains. Like Neo being unplugged out of the Matrix. It takes a while to learn to respect privacy when all you knew was information = ads = $$$.
- legitster 5y ago
  Our company didn't engage in any ad or ad networks. But the cost of compliance is the same.
  - oblio 5y ago
    I understand, my point is that nobody has really thought about this in detail, so you can't just plug in libgdrp to avoid the legwork, like you do with libjpeg or libffmpeg.
- bduerst 5y ago
  Yeah this sounds more like change management issues with the tech rather than steady-state problems. Changing anything is hard, but what about after the change?
andyjansson 5y ago
> some services are literally impossible to provide without a cookie of some form. You seem to be under a misapprehension about what GDPR is about. It is not about cookies, it's about PII.
- legitster 5y ago
  At this point it's largely semantics. The ePrivacy directives were included in the same piece of GDPR legislation. And when people talk about GDPR they are talking about both.
  - M2Ys4U 5y ago
    >At this point it's largely semantics. The ePrivacy directives were included in the same piece of GDPR legislation. What? No. That's backwards. The ePrivacy Directive referenced the Data Protection Directive. The GDPR replaced the DPD, and references to the DPD are now references to the GDPR. That's really not the same as saying the ePD is "included in the same piece of GDPR legislation". >And when people talk about GDPR they are talking about both. And those people are wrong.
LinAGKar 5y ago
The GDPR isn't about cookies, it's about personal data. You can still use cookies for functional stuff, like keeping track of the shopping cart on the client. The problem here is that companies have an ingrained culture of taking the easy route and just grabbing all the data they can without regard to privacy, which now comes back to bite them.
privacylawthrow 5y ago
I'm a privacy lawyer that has worked on cookie consents for a number of commercial websites. Everything you said here is all too true. The real legal answer in a lot of cases is "Do what everyone else is doing. Don't be an outlier. Use industry tools because if there's a problem with an industry tool, they'll go after the tool and not its users." The comments about cookies not being part of GDPR are grossly wrong. One of the early discussions in the privacy law community was how to handle the collision of the new consent requirements under GDPR with the fact that the ePrivacy Directive requires consent for cookies. Prior to GDPR, a large number of EU jurisdictions allowed for implicit consent through a variety of actions, like scrolling a page, or non-actions, like seeing a banner and not clicking "no". GDPR redefined consent and that's why cookie banners pop up.
- belorn 5y ago
  As lawyer, could you make an argument how consent can be given by a person if they haven't read the legal document, the other party know that the person has not read the document, and even if the person had read the document they would not understand it because of its language, complexity and size. To put it in other words, if we used the same definition of consent in any other legal contexts that also require freely given informed consent, would the legal system still function?
bryanrasmussen 5y ago
> Especially when the law says it's illegal to deny service based on their cookie preference, but some services are literally impossible to provide without a cookie of some form. To clarify what others are saying here - it is illegal under GDPR to deny service based on people opting out of providing PII in the cases where that PII is not needed for providing the service, not for refusing to accept cookies (although, sure, there can be some relation between these things). If for example you were providing a service where you sent someone emails on their birthday with autogenerated Love from your AI Momma messages it would not be illegal for you to refuse to provide them access to your service if they opted out of you storing their email and birthday, because those two pieces of PII are needed for the service to work. That said, most services do not need to store any PII for any length of time to work. Thus if a service says you can't read our medical advice column unless you allow us to store all this stuff we just hoovered up from your browser forever, that would be illegal. Because they don't need any of that stuff to show you the article they already have written and ready to go.
tempnow987 5y ago
Yeah, anyone who says GDPR is "easy" is just lying through their teeth. It really is folks who have not actually had to implement or try to implement anything. The best is they claim (falsely) that you don't actually have to pop-up the consent dialogs. Not really true on almost any actual website that does anything anyone wants.
- legitster 5y ago
  I think it's easy to comply with GDPR if you run a website that doesn't offer any services or generate any income. I have to believe this is where a lot of these type of HN comments come from.
  - tempnow987 5y ago
    Even then it's actually not easy. You embed a youtube video? You host a font on a US CDN? There are TONs of gotchas even for the "free" sites. And then if you actually are running a business online - and want to let folks do almost anything, better get the pop-ups popping!
- elevatortrim 5y ago
  GDPR is easy when your only income is what your users pay you and you are not interested in their personal data. My company barely changed some internal documents and that was it.
alkonaut 5y ago
> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. Yes? Are you saying that when people reject your cookie consent, you block the cookies that are fundamental to your product? Why would you do that?
dmitriid 5y ago
> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course. basically, you created those problems for yourslef, and now blame the law. > For people who claim GDPR compliance is clear and straightforward - I can't believe they actually have much experience working in Privacy. It is very straightforward when it comes to the use cases you described. > Actual implementation gets... very opaque. That's your problem, not the law's problem. Ask only for data you strictly need. Keep safe. Do not share with/sell to third parties. This was true for years before GDPR, and the only reason everyone found it "so hard" is that everyone, including you and your corporate sites, didn't give two craps about users' privacy.
- alfiedotwtf 5y ago
  And what if you need third-parties like a payment gateway? How do you do this without sharing PII?
  - dmitriid 5y ago
    Payment gateways are covered by laws that supersede GDPR. So you share the strictly necessary info with them.
  - M2Ys4U 5y ago
    Are you under the assumption that the GDPR requires consent for all processing of personal data? Because it doesn't. There are six legal bases for processing personal data in in Article 6 of the GDPR. Consent is the first one, but the second one listed (paragraph (b)) is that the "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract". That covers your payment case.

oblio 5y ago

Growing pains. Like Neo being unplugged out of the Matrix. It takes a while to learn to respect privacy when all you knew was information = ads = $$$.

legitster 5y ago
Our company didn't engage in any ad or ad networks. But the cost of compliance is the same.
- oblio 5y ago
  I understand, my point is that nobody has really thought about this in detail, so you can't just plug in libgdrp to avoid the legwork, like you do with libjpeg or libffmpeg.
bduerst 5y ago
Yeah this sounds more like change management issues with the tech rather than steady-state problems. Changing anything is hard, but what about after the change?

andyjansson 5y ago

> some services are literally impossible to provide without a cookie of some form. You seem to be under a misapprehension about what GDPR is about. It is not about cookies, it's about PII.

legitster 5y ago
At this point it's largely semantics. The ePrivacy directives were included in the same piece of GDPR legislation. And when people talk about GDPR they are talking about both.
- M2Ys4U 5y ago
  >At this point it's largely semantics. The ePrivacy directives were included in the same piece of GDPR legislation. What? No. That's backwards. The ePrivacy Directive referenced the Data Protection Directive. The GDPR replaced the DPD, and references to the DPD are now references to the GDPR. That's really not the same as saying the ePD is "included in the same piece of GDPR legislation". >And when people talk about GDPR they are talking about both. And those people are wrong.

LinAGKar 5y ago

The GDPR isn't about cookies, it's about personal data. You can still use cookies for functional stuff, like keeping track of the shopping cart on the client. The problem here is that companies have an ingrained culture of taking the easy route and just grabbing all the data they can without regard to privacy, which now comes back to bite them.

privacylawthrow 5y ago

I'm a privacy lawyer that has worked on cookie consents for a number of commercial websites. Everything you said here is all too true. The real legal answer in a lot of cases is "Do what everyone else is doing. Don't be an outlier. Use industry tools because if there's a problem with an industry tool, they'll go after the tool and not its users." The comments about cookies not being part of GDPR are grossly wrong. One of the early discussions in the privacy law community was how to handle the collision of the new consent requirements under GDPR with the fact that the ePrivacy Directive requires consent for cookies. Prior to GDPR, a large number of EU jurisdictions allowed for implicit consent through a variety of actions, like scrolling a page, or non-actions, like seeing a banner and not clicking "no". GDPR redefined consent and that's why cookie banners pop up.

belorn 5y ago
As lawyer, could you make an argument how consent can be given by a person if they haven't read the legal document, the other party know that the person has not read the document, and even if the person had read the document they would not understand it because of its language, complexity and size. To put it in other words, if we used the same definition of consent in any other legal contexts that also require freely given informed consent, would the legal system still function?

bryanrasmussen 5y ago

> Especially when the law says it's illegal to deny service based on their cookie preference, but some services are literally impossible to provide without a cookie of some form. To clarify what others are saying here - it is illegal under GDPR to deny service based on people opting out of providing PII in the cases where that PII is not needed for providing the service, not for refusing to accept cookies (although, sure, there can be some relation between these things). If for example you were providing a service where you sent someone emails on their birthday with autogenerated Love from your AI Momma messages it would not be illegal for you to refuse to provide them access to your service if they opted out of you storing their email and birthday, because those two pieces of PII are needed for the service to work. That said, most services do not need to store any PII for any length of time to work. Thus if a service says you can't read our medical advice column unless you allow us to store all this stuff we just hoovered up from your browser forever, that would be illegal. Because they don't need any of that stuff to show you the article they already have written and ready to go.

tempnow987 5y ago

Yeah, anyone who says GDPR is "easy" is just lying through their teeth. It really is folks who have not actually had to implement or try to implement anything. The best is they claim (falsely) that you don't actually have to pop-up the consent dialogs. Not really true on almost any actual website that does anything anyone wants.

legitster 5y ago
I think it's easy to comply with GDPR if you run a website that doesn't offer any services or generate any income. I have to believe this is where a lot of these type of HN comments come from.
- tempnow987 5y ago
  Even then it's actually not easy. You embed a youtube video? You host a font on a US CDN? There are TONs of gotchas even for the "free" sites. And then if you actually are running a business online - and want to let folks do almost anything, better get the pop-ups popping!
elevatortrim 5y ago
GDPR is easy when your only income is what your users pay you and you are not interested in their personal data. My company barely changed some internal documents and that was it.

alkonaut 5y ago

> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. Yes? Are you saying that when people reject your cookie consent, you block the cookies that are fundamental to your product? Why would you do that?

dmitriid 5y ago

> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course. basically, you created those problems for yourslef, and now blame the law. > For people who claim GDPR compliance is clear and straightforward - I can't believe they actually have much experience working in Privacy. It is very straightforward when it comes to the use cases you described. > Actual implementation gets... very opaque. That's your problem, not the law's problem. Ask only for data you strictly need. Keep safe. Do not share with/sell to third parties. This was true for years before GDPR, and the only reason everyone found it "so hard" is that everyone, including you and your corporate sites, didn't give two craps about users' privacy.

alfiedotwtf 5y ago
And what if you need third-parties like a payment gateway? How do you do this without sharing PII?
- dmitriid 5y ago
  Payment gateways are covered by laws that supersede GDPR. So you share the strictly necessary info with them.
- M2Ys4U 5y ago
  Are you under the assumption that the GDPR requires consent for all processing of personal data? Because it doesn't. There are six legal bases for processing personal data in in Article 6 of the GDPR. Consent is the first one, but the second one listed (paragraph (b)) is that the "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract". That covers your payment case.