5 ms·

The button is more prominent, yes. And it's still useless. Most tracking now comes from the "legitimate interest" purposes that you need to actively object to,

The button is more prominent, yes. And it's still useless. Most tracking now comes from the "legitimate interest" purposes that you need to actively object to, which is buried in a tertiary hidden panel or not available at all, or even forces you to object to several dozens of trackers one by one.

TrianguloY 4y ago
At least most websites still offer an object to all button. not fandom.com, there you need to click on 175 enabled-by-default switches: div[data-tracking-opt-in-overlay=true] input[type=checkbox][id^=switch]:checked
Vinnl 4y ago
I just expect that to be the next step in the long-ish road to improvements. The inaccessibility of the "Reject all" button was the most prominent issue, but as that gets addressed, the next step will probably be court battles to more clearly define what legitimate interest is and isn't, and if the advertisers win that, I'd expect the legislation to be updated to narrow that category down.
rocqua 4y ago
What are these 'legitimate interest' things, and is it even possible to object to them, legally speaking? I have never seen these I believe, unless you mean 'analytics cookies' and 'functional cookies', which I never saw hidden. I did presume that a 'reject all' included rejecting these cookies, if not it would be great to know.
- nirimda 4y ago
  There's some weird thing in the law. You can accept or reject data collection, but they can collect data for which a legitimate business interest exists unless you object - so if the law makes it default to no, you reject, but if it's default yes, you have to object. As far as I know, you have a right to object, so yes, legally speaking, it is possible to object to them. This means that there's frequently a second page of third-party/'legitimate interest' cookies, which might have an additional "Object all" button, or it might be that you have to click object one by one. One example is https://www.bbc.com https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right. This is because the BBC hates you and wants you to be unhappy.
  - rocqua 4y ago
    Is it possible to 'object' to these legitimate interest? Is it possible for a website to say, if you object to these, just don't use our website/service?
    - dspillett 4y ago
      Some sites certainly do present the only options "accept or go away", it slightly more subtle "by continuing..."¹. IIRC this is against both the meaning and the letter of the law, but that is not practical to properly enforce so they get away with it.
      - em-bee 4y ago
        the worst are accept or pay. i found it especially annoying to see that on a site like heise.de who should really know better.
        dspillett 4y ago
        There is at least some honesty in pay one way or another. The ad industry is so very rarely even that honest, that it is almost refreshing.
- dmitriid 4y ago
  IANAL and all that. This is the most vague part of the law because the law couldn't just forbid everything and then run into issues. For example, to run a business a merchant doesn't need anything more from you beside you name and address (and login info if they need to show you your order history). They don't need to ask you for your consent to collect this info because this info is required for their service to operate. However, they also want to run fraud protection. So they need to collect more data (e.g. your birth date, your IP address, perhaps other data). They have a legitimate reason to collect this data even if this data is not strictly required. As with any vague parts this "legitimate" part is now abused by the ad industry.
- nonrandomstring 4y ago
  > What are these 'legitimate interest' things While some comments are saying that legislation can narrow this down, I don't think it's anything that can be agreed up front any longer. Web is heading toward a complete change of protocol. One that can operate between mutually hostile and untrustworthy principles. (that's what the web is now, let's face it) What the service provider's and your "legitimate" requirements are, will have to be negotiated per transaction. It's the end of the "uniform" web. But I think that already happened and we're long into "The Splinternet". As I said in Digital Vegan, technology access will not be defined by the "have and the have-nots", but by the "will and the will-nots".
- dspillett 4y ago
  > What are these 'legitimate interest' things, In most cases "legitimate interests" checkboxes, particularly those referring to 3rd parties, basically mean "we see you preference not to be stalked and, while we may claim to respect you and your privacy, fuck you and your silly desire for privacy". > and is it even possible to object to them, legally speaking? Legally, in theory, yes. Practically, not really. You can go through and uncheck the hundreds of preselected consent options some sites present, but do you check that this actually results in tracking information not being dropped?
pimterry 4y ago
> Most tracking now comes from the "legitimate interest" purposes that you need to actively object to This is briefly touched on in the article: in the first graph you can see that the "Legitimate interest claimed" violations they detected dropped by 57% after they filed their complaints.
swhalen 4y ago
My layman's understanding of the GDPR was that it was the primary website (i.e. the website you are actually and intentionally visiting) that could store your data on the basis of a legitimate business interest -- for example because they need that information to deliver some stuff you ordered from them. However someone seems to have found a legal loophole whereby third parties ostensibly are able to track you on the grounds that their business is tracking, and they therefore have a legitimate interest in tracking you. Hopefully this loophole is eventually struck down in some French or German court, and the GDPR will one day be applied as intended. Tracking is not, and will never be, a legitimate business.
- mschuster91 4y ago
  > Tracking is not, and will never be, a legitimate business. The problem is, the way the Internet and its services are financed, it is pretty much a requirement. A lot of services absolutely depend on advertising revenue because affordable micro-transactions still are not a thing, not to mention 20 years of cultural ingrainment that services on the Internet have to be free when they are aimed at the general public. The alternative is philantropy aka rich billionaires footing the bill - we're seeing with the Washington Post (Bezos), Twitter (Musk) or Austrian newspapers just how problematic that is. The only relevant project surviving off of individual donations is Wikipedia and even that has issues (see e.g. the endowment debate that regularly pops up here), Mozilla depends on Google's money. Another alternative that regularly pops up, especially in Europe, is having the government fund services - but let's be real, who wants to use a messenger where the government has any sort of involvement? China shows why this is a very bad idea. So basically, now that we have established that currently advertising is required, another can of worms opens up: ad fraud, which is incredibly widespread. Everyone but the advertiser clients has a massive financial interest in manipulations: - ad networks want to claim "x millions of sites use our services to show ads", so they have an incentive to create fake sites that no one ever looks at - ad agencies want to claim reachout capacity (to their clients) and maximize ad eyeballs because often they're paid as a percentage of ad spend - content creators want to have as much income as they possibly can get. Click fraud and SEO spam fake sites/content mills come to mind here. Advertisers, in turn, want to minimize their ad spend and maximize the ROI. That means they need a way to target ads to specific demographic groups, they need a way to weed out fraudulent spending and they need a way to weed out undesirable context (i.e. no popular brand wants to show a pre-roll ad to Alex Jones claiming crisis actors). And that is where tracking and other "middlemen" companies come in - they serve to protect advertisers from overspending and bullshit, and provide the actual data required for targeting. The only groups that could get away without tracking and countless middlemen services are "household brands" that simply book ads at massive TV and radio stations and niche magazines and their advertising clients (say, a magazine about farming naturally yields itself to equipment manufacturers, pesticide and other farm suppliers) - but even there, media has an incentive to over-inflate their reader/viewer/listener counts to demand more money from advertisers, so they need third parties like Nielsen Ratings as independent "arbiters".

TrianguloY 4y ago

At least most websites still offer an object to all button. not fandom.com, there you need to click on 175 enabled-by-default switches: div[data-tracking-opt-in-overlay=true] input[type=checkbox][id^=switch]:checked

Vinnl 4y ago

I just expect that to be the next step in the long-ish road to improvements. The inaccessibility of the "Reject all" button was the most prominent issue, but as that gets addressed, the next step will probably be court battles to more clearly define what legitimate interest is and isn't, and if the advertisers win that, I'd expect the legislation to be updated to narrow that category down.

rocqua 4y ago

What are these 'legitimate interest' things, and is it even possible to object to them, legally speaking? I have never seen these I believe, unless you mean 'analytics cookies' and 'functional cookies', which I never saw hidden. I did presume that a 'reject all' included rejecting these cookies, if not it would be great to know.

nirimda 4y ago
There's some weird thing in the law. You can accept or reject data collection, but they can collect data for which a legitimate business interest exists unless you object - so if the law makes it default to no, you reject, but if it's default yes, you have to object. As far as I know, you have a right to object, so yes, legally speaking, it is possible to object to them. This means that there's frequently a second page of third-party/'legitimate interest' cookies, which might have an additional "Object all" button, or it might be that you have to click object one by one. One example is https://www.bbc.com https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right. This is because the BBC hates you and wants you to be unhappy.
- rocqua 4y ago
  Is it possible to 'object' to these legitimate interest? Is it possible for a website to say, if you object to these, just don't use our website/service?
  - dspillett 4y ago
    Some sites certainly do present the only options "accept or go away", it slightly more subtle "by continuing..."¹. IIRC this is against both the meaning and the letter of the law, but that is not practical to properly enforce so they get away with it.
    - em-bee 4y ago
      the worst are accept or pay. i found it especially annoying to see that on a site like heise.de who should really know better.
      - dspillett 4y ago
        There is at least some honesty in pay one way or another. The ad industry is so very rarely even that honest, that it is almost refreshing.
dmitriid 4y ago
IANAL and all that. This is the most vague part of the law because the law couldn't just forbid everything and then run into issues. For example, to run a business a merchant doesn't need anything more from you beside you name and address (and login info if they need to show you your order history). They don't need to ask you for your consent to collect this info because this info is required for their service to operate. However, they also want to run fraud protection. So they need to collect more data (e.g. your birth date, your IP address, perhaps other data). They have a legitimate reason to collect this data even if this data is not strictly required. As with any vague parts this "legitimate" part is now abused by the ad industry.
nonrandomstring 4y ago
> What are these 'legitimate interest' things While some comments are saying that legislation can narrow this down, I don't think it's anything that can be agreed up front any longer. Web is heading toward a complete change of protocol. One that can operate between mutually hostile and untrustworthy principles. (that's what the web is now, let's face it) What the service provider's and your "legitimate" requirements are, will have to be negotiated per transaction. It's the end of the "uniform" web. But I think that already happened and we're long into "The Splinternet". As I said in Digital Vegan, technology access will not be defined by the "have and the have-nots", but by the "will and the will-nots".
dspillett 4y ago
> What are these 'legitimate interest' things, In most cases "legitimate interests" checkboxes, particularly those referring to 3rd parties, basically mean "we see you preference not to be stalked and, while we may claim to respect you and your privacy, fuck you and your silly desire for privacy". > and is it even possible to object to them, legally speaking? Legally, in theory, yes. Practically, not really. You can go through and uncheck the hundreds of preselected consent options some sites present, but do you check that this actually results in tracking information not being dropped?

pimterry 4y ago

> Most tracking now comes from the "legitimate interest" purposes that you need to actively object to This is briefly touched on in the article: in the first graph you can see that the "Legitimate interest claimed" violations they detected dropped by 57% after they filed their complaints.

swhalen 4y ago

My layman's understanding of the GDPR was that it was the primary website (i.e. the website you are actually and intentionally visiting) that could store your data on the basis of a legitimate business interest -- for example because they need that information to deliver some stuff you ordered from them. However someone seems to have found a legal loophole whereby third parties ostensibly are able to track you on the grounds that their business is tracking, and they therefore have a legitimate interest in tracking you. Hopefully this loophole is eventually struck down in some French or German court, and the GDPR will one day be applied as intended. Tracking is not, and will never be, a legitimate business.

mschuster91 4y ago
> Tracking is not, and will never be, a legitimate business. The problem is, the way the Internet and its services are financed, it is pretty much a requirement. A lot of services absolutely depend on advertising revenue because affordable micro-transactions still are not a thing, not to mention 20 years of cultural ingrainment that services on the Internet have to be free when they are aimed at the general public. The alternative is philantropy aka rich billionaires footing the bill - we're seeing with the Washington Post (Bezos), Twitter (Musk) or Austrian newspapers just how problematic that is. The only relevant project surviving off of individual donations is Wikipedia and even that has issues (see e.g. the endowment debate that regularly pops up here), Mozilla depends on Google's money. Another alternative that regularly pops up, especially in Europe, is having the government fund services - but let's be real, who wants to use a messenger where the government has any sort of involvement? China shows why this is a very bad idea. So basically, now that we have established that currently advertising is required, another can of worms opens up: ad fraud, which is incredibly widespread. Everyone but the advertiser clients has a massive financial interest in manipulations: - ad networks want to claim "x millions of sites use our services to show ads", so they have an incentive to create fake sites that no one ever looks at - ad agencies want to claim reachout capacity (to their clients) and maximize ad eyeballs because often they're paid as a percentage of ad spend - content creators want to have as much income as they possibly can get. Click fraud and SEO spam fake sites/content mills come to mind here. Advertisers, in turn, want to minimize their ad spend and maximize the ROI. That means they need a way to target ads to specific demographic groups, they need a way to weed out fraudulent spending and they need a way to weed out undesirable context (i.e. no popular brand wants to show a pre-roll ad to Alex Jones claiming crisis actors). And that is where tracking and other "middlemen" companies come in - they serve to protect advertisers from overspending and bullshit, and provide the actual data required for targeting. The only groups that could get away without tracking and countless middlemen services are "household brands" that simply book ads at massive TV and radio stations and niche magazines and their advertising clients (say, a magazine about farming naturally yields itself to equipment manufacturers, pesticide and other farm suppliers) - but even there, media has an incentive to over-inflate their reader/viewer/listener counts to demand more money from advertisers, so they need third parties like Nielsen Ratings as independent "arbiters".