7 ms·
CNIL release: https://www.cnil.fr/fr/cookies-sanction-de-60-millions-deuros-lencontre-de-microsoft-ireland-operations-limited https://www.cnil.fr/fr/cookies-san
by jefftk 4y ago
CNIL release: https://www.cnil.fr/fr/cookies-sanction-de-60-millions-deuros-lencontre-de-microsoft-ireland-operations-limited https://www.cnil.fr/fr/cookies-sanction-de-60-millions-deuro..., and decision: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989 https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989
Reading it in translation, seems they identified the following as breaches:
1. When you visited bing.com they always dropped an ad fraud detection cookie.
2. After clicking around on bing.com, without clicking yes on any of the banners, it would drop an ads cookie.
3. On their cookie banner, rejecting took two clicks while accepting took one.
On 1, Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision).
On 2, Microsoft said it was an accident and had already stopped, though not before CNIL asking them about it
On 3, Microsoft argued that (a) rejecting was not actually required to be as easy as accepting and that (b) since the default was no cookies and it took a click to get cookies that rejecting was easier than accepting. The CNIL disagreed on both.
- Moissanite 4y ago> rejecting was not actually required to be as easy as accepting Nice of them to spell out "we don't actually care about the users, get fucked" in such a clear and succinct way.
- baeaz 4y agoThey don't care about users who don't pay the bills.
- Nextgrid 4y agoThis isn't about advertising - you can still advertise just fine, even more so on a search engine where the benefit of tracking is limited as the user explicitly tells you what they're searching for.
- tracker1 4y agoFor that matter, browser + ip fingerprinting can be server-tracked anyway, if less reliably overall. Especially with JS enabled. There are lots of tricks that can be used for this. Aside, wonder how good/bad ip+agent fingerprinting could be combined with a url that feeds a small randomly generated string with a VERY long cache expiration, with server/proxy no-cache headers (e-tag per agent/ip). Effectively similar to a cookie, without technically being a cookie.
- medbrane 4y agoBut serverside tracking without consent would still be illegal, right? GDPR does not make a difference between cookies and other mechanisms.
- tracker1 4y agoFair enough... didn't know, since I'm in the US and don't deal with EU on a business level.
- thaumasiotes 4y agoSetting cookies involves you telling all your visitors that you're tracking them. How would the server-side tracking be detected?
- ArmandTanzarian 4y ago*They don't care about users because users don't pay the bills.
- pmontra 4y agoThey do, because they operate a service to lure those users in so another set of people pay money to show ads to the first set.
- deleted 4y ago[deleted]
- unity1001 4y ago> Microsoft argued that (a) rejecting was not actually required to be as easy as accepting The regulation explicitly says so. Easy way to accept, reject and choose. A lot of companies seem to be violating the law in that one. By making it difficult for people to reject cookies.
- jefftk 4y ago> The regulation explicitly says so. Where do you see that in the ePrivacy Directive?
- Macha 4y agoReading the article, it's the French Data Protection Act, which is the french incorporation of various data privacy laws into french law. Where is your claim that it's based solely on the ePrivacy Directive coming from?
- jefftk 4y agoThe decision considers both, but the decision is combining two regulations: one that says you need to get consent before using storage for purposes that aren't 'strictly necessary' (ePrivacy) and another that says how consent for the processing of personal data must be collected (GDPR). This is not the same as a regulation that explicitly says how consent for storage must be gathered, and before this decision it was not clear how the two regulations interacted on this point.
- Hamuko 4y ago>since the default was no cookies Except for the cookies that they dropped on you by default (completely by accident, of course). Good to know that they're absolutely unshamed of it though.
- jefftk 4y agoWhy do you say unashamed of it?
- plastiquebeech 4y agoInteresting. One quirk of browsing sites with JS disabled is that the cookie banners rarely show up. Often, they are implemented as scripts loaded from a site like "cookielaw.org". I've long suspected that these sites default to dropping cookies when my consent is neither asked for nor received, as MS appears to have done here. It's good to hear that such behavior is probably illegal in the EU.
- thaumasiotes 4y ago> I've long suspected that these sites default to dropping cookies when my consent is neither asked for nor received, as MS appears to have done here. > It's good to hear that such behavior is probably illegal in the EU. Huh? What's the problem supposed to be?
- esperent 4y agoIt's in violation of various EU privacy laws like GDPR and the ePrivacy Directive. They get discussed a lot here on HN so it's easy to assume everyone's familiar with them, but if you're not then you should search up a summary on them.
- thaumasiotes 4y agoDefaulting to no cookies is a violation of privacy laws? How?
- ajdude 4y agoI read the comment "dropping cookies" Not as "defaulting to none" But rather "adding them , drop as in airdropping or dropping a payload. That's how I read it at least, which would mean they're defaulting to cookies when no consent is reached, but I could be wrong.
- thaumasiotes 4y agoThat would conflict with normal cookie terminology, where cookies are "set" and packets are "dropped". But much more importantly, it is completely impossible in the context of the thread: > [Accusation 3.] On their cookie banner, rejecting took two clicks while accepting took one. > On 3, Microsoft argued that (a) rejecting was not actually required to be as easy as accepting and that (b) since the default was no cookies and it took a click to get cookies that rejecting was easier than accepting. The CNIL disagreed on both.