5 ms·
Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fi
by izacus 4y ago
Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting?
EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.
- siquick 4y agoBecause like the climate crisis, it’s easier to make the individual clean up the mess and make the changes than hold large organisations accountable.
- masklinn 4y ago> Because like the climate crisis, it’s easier to blame the individual than clean up the mess and make the changes. FTFY?
- mcherm 4y agoBecause some browser-makers (Firefox at least) believe that the identity of those browsing the web should be protected. Legislators do not believe that. (At least, a majority of legislators do not.)
- giancarlostoro 4y agoWhat kills me is the cookie consent stuff, they should of enforced that Do Not Track is honored, and have fees that make sites ensure compliance or be sued over not honoring DNT which iirc was sent as a HTTP header, it would of actually been a meaningful solve.
- dgroshev 4y agoWould you consider the entire European Union a minority of the legislators? Because that's what GDPR is designed to do, make identifying customers well controlled and expensive whatever the method. Granted, the enforcement should be stepped up.
- giancarlostoro 4y agoThey should enforce that Do Not Track is honored. Its the easiest way, and websites dont need silly cookie consent dialogs if set.
- dgroshev 4y agoDNT is ~useless because it's opt-out, whereas "auxiliary", non-essential tracking is opt-in under GDPR. Websites don't need cookie consent dialogs if they only use cookies to do things that don't need to be consented to, like providing the service they are offering. Look at Apple's website, they don't have any.
- mnw21cam 4y agoDNT may be opt-out. But it should certainly be treated as "Don't even bother asking for consent to track, because I already told you the answer is no, and you'll be harrassing me by asking."
- giancarlostoro 4y agoMy argument is current laws did nothing to give teeth to DNT. I'm not worried about what the technological defaults are, but I would argue that without DNT being legitimized, it was dead on arrival. We have had it in browsers for ages, and we've dropped the ball on enforcing it for ages. My other argument is, if you detect DNT, the cookie consent dialog shouldn't be shown at all.
- TheCoelacanth 4y agoThe EU has about 1/18th of the world's population, so certainly that would be a rather small minority.
- mcherm 4y ago> Would you consider the entire European Union a minority of the legislators? No, I was referring only to my own legislators (in the US, and not specifically California). Many other places in the world are doing better.
- dismalpedigree 4y agoWhat a legislator believes is irrelevant. Only what the lobbyist is paid to believe is relevant.
- Arnt 4y agoA law needs a justification and needs to apply equally to everyone. Writing that about fingerprinting would not be trivial. Some site operators can make a believable argument that they use it in ways that are good for society.
- hutzlibu 4y ago"Some site operators can make a believable argument that they use it in ways that are good for society." Example please
- Wrhector 4y agoCredit Card Fraud, Spam, etc
- bigfudge 4y agoEven if this were the case - which I don’t actually believe, but… - it would be straightforward for that law to also constrain these purposes and prevent data sharing with non-worthy operations. At present it’s basically a free for all.
- dgroshev 4y agoThat is literally what GDPR is. Somehow it got reduced to cookie banners in HN psyche, but the whole idea of GDPR is to make sure that the data can be collected and used for well defined purposes that are either necessary to provide a service (preventing CC fraud would qualify), or are explicitly consented to.
- Arnt 4y agoI think the misunderstandings about the GDPR (even many smart people don't get it) prove that designing and writing such a law is difficult and the result has to be complex. IMO the GDPR is good. But… it is poorly understood by many affected people . IMO if a law is poorly understood by the people it affects, then one should assume the law to be at fault, not the people. IMO it's good but I'm not happy. 4×IMO! Wow.
- mschuster91 4y agoBecause bad actors have an easy time on an actually global network. It's disturbingly hard to hold bad actors accountable, particularly if they have zero legal presence (e.g. a corporation's subsidiary) in one's jurisdiction.
- bigfudge 4y agoBut we’re talking here about major corporations who would (largely) follow the law if there was a law with teeth commensurate with the potential rewards form abuse of privacy.
- izacus 4y agoIs it really that hard? I haven't seen anyone from US actually attempt any accountability - zero punishments for spam callers, zero punishments for data collectors, not even a semblance of attempt to punish data traffickers?
- mschuster91 4y agoThe thing is, there are so many layers upon layers between the end user and the bad actor that it's hard to pin down blame, and even if one succeeds to identify a bad actor, it's a shell company somewhere overseas and the money is long gone, moved off via a dozen other shell companies - and to make it worse, what may be a crime in the US/EU is perfectly legal in wherever these shell companies are set up. The solution would be dedicated laws that hold the company at the top directly accountable for the actions of all sub-contractor layers, but these laws are rare and often hotly contested (e.g. with a German law mandating responsibility of the top-layer company for wage theft and other labor law violations [1]). [1] https://www.ihk.de/regensburg/fachthemen/recht/arbeitsrecht/verguetung-und-tarife/mindestlohn-auftraggeberhaftung-1735270 https://www.ihk.de/regensburg/fachthemen/recht/arbeitsrecht/...
- than3 4y agoThe short answer which should be obvious... regulatory doesn't work, legal doesn't currently work. The burden of proof is on the claimant, and with proper information control you can't ever meet that burden of proof. It becomes an ant versus a gorilla instead of David vs. Goliath. Tell me, how do you differentiate a simple random alpha-numeric string from another random string that may have been generated as a fingerprint. Mathematically do you think there's any way to actually prove one way or the other? If not, how would that bias the system if the person is adversarial and lies. The only way to prevent this is to make sure the information is nonsensical. Preventing collection would identify you in a way that they can prevent access. Even though websites are public, you see this happening with any captcha service.
- izacus 4y agoCan you provide any proof that "regulatory doesn't work"? Might be my European outlook, but consumer law has been stupidly effective at curbing abuses from companies here and was much more effective than playing the technology race USA is trying to fight. There's always a next side-step, the next abuse a company can invent - and you keep trying to push the responsibility of avoiding it to users (by adding more and more onerous technology) instead of punishing the abusers.
- sneak 4y agoLaws only apply in some countries. The internet is global. Technical measures are faster, more effective, and can be applied in all places.
- account42 4y agoLaws can be as global as those in power want them to be. See e.g. copyright.
- kuschku 4y agoThat law already exists. It's called the GDPR. That's what it's for, and what you’re giving permission for when clicking "accept all".