4 ms·

The screwed up cookie modals are not Eu's doing: Eu mandated that the users should be clearly told what would be tracked, they should be given an easy way to a

The screwed up cookie modals are not Eu's doing: Eu mandated that the users should be clearly told what would be tracked, they should be given an easy way to accept, reject, and choose which of them they accept. The corporations - mainly the US - chose to 'get around' these requirements in the undying US corporate tradition: Make it difficult for the user to reject cookies so they will have to give up and just accept. Most modals have only an 'accept' and 'choose' sections, and the 'choose' section includes a gigantic list of 'vendors' which you have to individually turn off one by one. So that you will give up and just click 'accept'. Some of them offer a 'reject all' button way at the bottom of of the list, after listing 30-40 vendors. So basically its the usual corporate trickery to force user to do things they don't want to. However, this is illegal - Eu works on civil law, and civil law is a clear, well defined legal practice. If it says you have to do some specific thing, there isnt much 'interpret my way around it'. So, per that law, all the cookie modals that do not give the users an EASY way to reject cookies are in violation of that law. It absolutely does not matter zit if the user 'consents' to the terms. Mutual agreements and contract law overriding actual law is a trait of the Anglosaxon common law, not civil law. In civil law, it doesnt matter zit if the other party agreed to something illegal per law. Therefore, not only all these pesky modals that try to force you into accepting those ~80 cookies from a random website you visit are not Eu's doing, but also most of them are actually in violation of the GDPR law.

irusensei 4y ago
IMO if it's open to abuse then it wasn't properly designed. And If its being abused even while not open to interpretations then its not enforceable, which also means its a bad design. I feel like people give a pass and even defend it because it had good intentions. Clearly it wasn't well thought and people should criticize it more instead. Bad execution can ruin good ideas. Of course there are other good things on GDPR as a whole but this cookie consent thing was a disaster. I live in the EU but use a VPN routing my connections to a nearby non-eu country to have an overall better browsing experience.
- troad 4y ago
  > Bad execution can ruin good ideas. There’s no good idea that the EU won’t find some way to execute poorly, alas.
  - unity1001 4y ago
    There are zillions of good ideas that the Eu mandated - ideas which you dont even notice because they became parts of your daily life. They range from the obligation that food producers must have all the ingredients clearly listed in their products to the expiration dates. From no-spam laws to right to repair. What you say just sounds like Daily Mirror grade smear.
    - troad 4y ago
      I grew up in Australia. We somehow mysteriously managed to have expiration dates on food too, despite our distance from Brussels. What developed country doesn’t have expiration dates? The EU is great at taking credit for things it had very little to do with. Sometimes it’s obvious things that happen elsewhere without the EU (expiration dates on food), sometimes it’s the work of other organisations (like NATO). “Oh, there’s peace in Europe? Yeah, the EU did that. Oh, there’s war in Europe? Hmm, more EU should fix that.” > What you say just sounds like Daily Mirror grade smear. I’m a euro-federalist, so I doubt the Daily Mirror would be interested. The EU is a mixed bag and I want it to do better. Reflexively attacking people whose views you know very little about seems unconstructive.
      - unity1001 4y ago
        > We somehow mysteriously managed to have expiration dates on food too, despite our distance from Brussels A large part of the world adopted such rules after the Eu implemented them. The Eu is seen as the leader and standard in these things. Eu implemented consumer protections, everyone else in OECD also did. Eu implemented EUVAT, OECD countries are also doing it. Also various US states. Eu implemented GDPR, and suddenly from Brazil to US every other country or state has their own GDPR. Now the Eu has its digital gatekeepers law. Watch how long will it take for other OECD countries to adopt similar laws. > Reflexively attacking people whose views you know very little Sorry but we are on public internet. We dont have the time to sit and get to know people. If you are talking like the people from a certain group, then its normal that people respond to you as if you were from that group. Moreover, the culture that people grow up in affects their perspective greatly. Not surprisingly, having grown in an Anglosaxon country seems to have shaped your perspective too.
Fire-Dragon-DoL 4y ago
I have a question around this. So if the website doesn't collect any data at all, except for what is needed for running the website and preventing malicious users (so, collecting ips for a week in the logs to use fail2ban), do they need a "privacy" section? I ask because a privacy section requires a lawyer, and that is a big cost for a simple static website with no earning goals
- unity1001 4y ago
  > So if the website doesn't collect any data at all, except for what is needed for running the website and preventing malicious users (so, collecting ips for a week in the logs to use fail2ban), do they need a "privacy" section? I dont think they do. There are such sites indeed and I havent seen any prompts in them. > so, collecting ips for a week in the logs to use fail2ban IP by solely itself wouldnt constitute 'Personally identifiable information' as far as I know. But Im not sure. > I ask because a privacy section requires a lawyer Not really. Website privacy legal templates already exist and they are pretty standard at this point.
  - Fire-Dragon-DoL 4y ago
    Well the prompt is required only if you have to accept stuff, otherwise a privacy section would be sufficient. IP is considered identifiable information if it's used for some purpose (e.g. statistics for website visits). I'm pretty sure it's considered "legit use" if it's for filtering malicious users. Could you point to some of those standards? I had a customers reaching out and found myself without any idea how to handle that privacy section.
    - unity1001 4y ago
      Prompt is necessary to accept/reject in case there is any potential of collecting data. Since you cant collect data if someone does not have an accept button. if you dont collect data, I believe you dont need to disclose it. > IP is considered identifiable information Not at all. IP by itself is meaningless and it just points to a computer or a proxy. Only if you have other information then it starts becoming identifiable. Even in court cases that involve IPs its not enough - the ISP gives the IP to the court, but then the court must find who was the person using that IP at that given point in time in that house, even the person using the computer. > Could you point to some of those standards? You can just google privacy section templates with GDPR keyword. There are a lot of templates as such. WordPress itself provides an easy way to create such templates and it already has GDPR tools built in.

irusensei 4y ago

IMO if it's open to abuse then it wasn't properly designed. And If its being abused even while not open to interpretations then its not enforceable, which also means its a bad design. I feel like people give a pass and even defend it because it had good intentions. Clearly it wasn't well thought and people should criticize it more instead. Bad execution can ruin good ideas. Of course there are other good things on GDPR as a whole but this cookie consent thing was a disaster. I live in the EU but use a VPN routing my connections to a nearby non-eu country to have an overall better browsing experience.

troad 4y ago
> Bad execution can ruin good ideas. There’s no good idea that the EU won’t find some way to execute poorly, alas.
- unity1001 4y ago
  There are zillions of good ideas that the Eu mandated - ideas which you dont even notice because they became parts of your daily life. They range from the obligation that food producers must have all the ingredients clearly listed in their products to the expiration dates. From no-spam laws to right to repair. What you say just sounds like Daily Mirror grade smear.
  - troad 4y ago
    I grew up in Australia. We somehow mysteriously managed to have expiration dates on food too, despite our distance from Brussels. What developed country doesn’t have expiration dates? The EU is great at taking credit for things it had very little to do with. Sometimes it’s obvious things that happen elsewhere without the EU (expiration dates on food), sometimes it’s the work of other organisations (like NATO). “Oh, there’s peace in Europe? Yeah, the EU did that. Oh, there’s war in Europe? Hmm, more EU should fix that.” > What you say just sounds like Daily Mirror grade smear. I’m a euro-federalist, so I doubt the Daily Mirror would be interested. The EU is a mixed bag and I want it to do better. Reflexively attacking people whose views you know very little about seems unconstructive.
    - unity1001 4y ago
      > We somehow mysteriously managed to have expiration dates on food too, despite our distance from Brussels A large part of the world adopted such rules after the Eu implemented them. The Eu is seen as the leader and standard in these things. Eu implemented consumer protections, everyone else in OECD also did. Eu implemented EUVAT, OECD countries are also doing it. Also various US states. Eu implemented GDPR, and suddenly from Brazil to US every other country or state has their own GDPR. Now the Eu has its digital gatekeepers law. Watch how long will it take for other OECD countries to adopt similar laws. > Reflexively attacking people whose views you know very little Sorry but we are on public internet. We dont have the time to sit and get to know people. If you are talking like the people from a certain group, then its normal that people respond to you as if you were from that group. Moreover, the culture that people grow up in affects their perspective greatly. Not surprisingly, having grown in an Anglosaxon country seems to have shaped your perspective too.

Fire-Dragon-DoL 4y ago

I have a question around this. So if the website doesn't collect any data at all, except for what is needed for running the website and preventing malicious users (so, collecting ips for a week in the logs to use fail2ban), do they need a "privacy" section? I ask because a privacy section requires a lawyer, and that is a big cost for a simple static website with no earning goals

unity1001 4y ago
> So if the website doesn't collect any data at all, except for what is needed for running the website and preventing malicious users (so, collecting ips for a week in the logs to use fail2ban), do they need a "privacy" section? I dont think they do. There are such sites indeed and I havent seen any prompts in them. > so, collecting ips for a week in the logs to use fail2ban IP by solely itself wouldnt constitute 'Personally identifiable information' as far as I know. But Im not sure. > I ask because a privacy section requires a lawyer Not really. Website privacy legal templates already exist and they are pretty standard at this point.
- Fire-Dragon-DoL 4y ago
  Well the prompt is required only if you have to accept stuff, otherwise a privacy section would be sufficient. IP is considered identifiable information if it's used for some purpose (e.g. statistics for website visits). I'm pretty sure it's considered "legit use" if it's for filtering malicious users. Could you point to some of those standards? I had a customers reaching out and found myself without any idea how to handle that privacy section.
  - unity1001 4y ago
    Prompt is necessary to accept/reject in case there is any potential of collecting data. Since you cant collect data if someone does not have an accept button. if you dont collect data, I believe you dont need to disclose it. > IP is considered identifiable information Not at all. IP by itself is meaningless and it just points to a computer or a proxy. Only if you have other information then it starts becoming identifiable. Even in court cases that involve IPs its not enough - the ISP gives the IP to the court, but then the court must find who was the person using that IP at that given point in time in that house, even the person using the computer. > Could you point to some of those standards? You can just google privacy section templates with GDPR keyword. There are a lot of templates as such. WordPress itself provides an easy way to create such templates and it already has GDPR tools built in.