3 ms·

Observing the do not track would have fulfilled the EU requirement. You are falling into the trap that Americans normally do that think that the directive have

Observing the do not track would have fulfilled the EU requirement. You are falling into the trap that Americans normally do that think that the directive have anything to do with cookies or that the cookie banner was requested by the EU. The requirement is simply > You may not collect personal information without consent. If they have an obnoxious advertising and data harvesting cookie banner then that was a design decision to make you opt in.

janosd 4y ago
IANAL, but this is not entirely correct. For example, if you have server logs, that's processing personal information, most likely under GDPR Art. 6 lit 1f (legitimate interest). Under Art 13 the user must be informed of this. Because of the information requirement the Do-Not-Track is not enough unless you really, truly do not track any PII (which includes the IP address). Equally, this is incorrect: > You may not collect personal information without consent. There are a whole host of reasons listed in Art. 6 when you do not need consent.
- happymellon 4y ago
  I was answering in the context of the statement that the EU made this cookie banner mess and that the do not track header died because of the GDPR. I didn't feel that logs would be relevant in this case because you would log that the Do Not Track header was present. As a distilled version of the GDPR I still feel it hits the point.
  - illiarian 4y ago
    > that the EU made this cookie banner mess It didn't. Companies not willing to comply with GDPR did. As they didn't want to comply with Do Not Track header and used it for fingerprinting.
    - happymellon 4y ago
      Exactly this.
  - janosd 4y ago
    DNT died the moment Microsoft decided to enable it by default in IE10. That was more than half a decade before the GDPR.
Fraaaank 4y ago
I don't think it does. Consent as a basis for data processing requires explicit opt-in. A 'do-not-track' header is opt-out.
- happymellon 4y ago
  Yes, it would need to be a header saying "I authorise". A technicality on linguistics in this case as a header would still satisfy the requirement.
- wkat4242 4y ago
  Yes but if the header is present you already know the user will not consent so there is no need to even ask.
  - zo1 4y ago
    Exactly. So if the header is present, don't ask because it's a no. If the header is not present then ask the users consent. Easy as pie
- octacat 4y ago
  EU should've mandate that providing the header is enough. And no window should be shown in this case (you can still ask to allow on top of a page, but it should not be overlay). And yea, it should _never_ be an overlay, because overlays is a predatory design practice (EU, please, could you be useful one more time?). Except after GDPR web designers gone mad and we have modal overlay windows for cookies, for newsletter, for ads (always had these), for paid subscription, for go follow us on Twitter.
- ajsnigrutin 4y ago
  But you can ask a user at browser install, if they want to be trackd or not, so it's one opt-in/opt-out for all pages.
skrause 4y ago
Cookie banners exist not because of the GDPR, but because of Article 5(3) of the ePrivacy Directive (https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...): Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. It has been planned for a long time to replace the ePrivacy Directive with the ePrivacy Regulation (https://en.wikipedia.org/wiki/EPrivacy_Regulation https://en.wikipedia.org/wiki/EPrivacy_Regulation) which was actually going to replace the cookie banners with browser settings, but so far the ePrivacy Regulation is kind of stuck because of successfull lobbying by ad companies.
- Lorkki 4y ago
  Banners are in no way mandated, though. As the quoted text states, you need to have a policy easily available - the same as you'd have any other legal information on your website. Typically it isn't served on banners or popups, but e.g. in the page footer. You also need to have the right to refuse, which is a non-issue if tracking is opt-in, or only happens in a necessary context like user login, where you can inform the user that it's about to happen. It's a more or less deliberate misunderstanding to claim that you need popup banners because of EU regulation, and it seems to be said mainly in order to mask the fact that applications are designed to be hostile to privacy in the first place.
wilde 4y ago
You’re falling into the trap Europeans normally do that imagine that companies want to do the right thing. You want something to stop? Ban it. American companies are adversarial actors who always do the least effort to continue on.

janosd 4y ago

IANAL, but this is not entirely correct. For example, if you have server logs, that's processing personal information, most likely under GDPR Art. 6 lit 1f (legitimate interest). Under Art 13 the user must be informed of this. Because of the information requirement the Do-Not-Track is not enough unless you really, truly do not track any PII (which includes the IP address). Equally, this is incorrect: > You may not collect personal information without consent. There are a whole host of reasons listed in Art. 6 when you do not need consent.

happymellon 4y ago
I was answering in the context of the statement that the EU made this cookie banner mess and that the do not track header died because of the GDPR. I didn't feel that logs would be relevant in this case because you would log that the Do Not Track header was present. As a distilled version of the GDPR I still feel it hits the point.
- illiarian 4y ago
  > that the EU made this cookie banner mess It didn't. Companies not willing to comply with GDPR did. As they didn't want to comply with Do Not Track header and used it for fingerprinting.
  - happymellon 4y ago
    Exactly this.
- janosd 4y ago
  DNT died the moment Microsoft decided to enable it by default in IE10. That was more than half a decade before the GDPR.

Fraaaank 4y ago

I don't think it does. Consent as a basis for data processing requires explicit opt-in. A 'do-not-track' header is opt-out.

happymellon 4y ago
Yes, it would need to be a header saying "I authorise". A technicality on linguistics in this case as a header would still satisfy the requirement.
wkat4242 4y ago
Yes but if the header is present you already know the user will not consent so there is no need to even ask.
- zo1 4y ago
  Exactly. So if the header is present, don't ask because it's a no. If the header is not present then ask the users consent. Easy as pie
octacat 4y ago
EU should've mandate that providing the header is enough. And no window should be shown in this case (you can still ask to allow on top of a page, but it should not be overlay). And yea, it should _never_ be an overlay, because overlays is a predatory design practice (EU, please, could you be useful one more time?). Except after GDPR web designers gone mad and we have modal overlay windows for cookies, for newsletter, for ads (always had these), for paid subscription, for go follow us on Twitter.
ajsnigrutin 4y ago
But you can ask a user at browser install, if they want to be trackd or not, so it's one opt-in/opt-out for all pages.

skrause 4y ago

Cookie banners exist not because of the GDPR, but because of Article 5(3) of the ePrivacy Directive (https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...): Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. It has been planned for a long time to replace the ePrivacy Directive with the ePrivacy Regulation (https://en.wikipedia.org/wiki/EPrivacy_Regulation https://en.wikipedia.org/wiki/EPrivacy_Regulation) which was actually going to replace the cookie banners with browser settings, but so far the ePrivacy Regulation is kind of stuck because of successfull lobbying by ad companies.

Lorkki 4y ago
Banners are in no way mandated, though. As the quoted text states, you need to have a policy easily available - the same as you'd have any other legal information on your website. Typically it isn't served on banners or popups, but e.g. in the page footer. You also need to have the right to refuse, which is a non-issue if tracking is opt-in, or only happens in a necessary context like user login, where you can inform the user that it's about to happen. It's a more or less deliberate misunderstanding to claim that you need popup banners because of EU regulation, and it seems to be said mainly in order to mask the fact that applications are designed to be hostile to privacy in the first place.

wilde 4y ago

You’re falling into the trap Europeans normally do that imagine that companies want to do the right thing. You want something to stop? Ban it. American companies are adversarial actors who always do the least effort to continue on.