5 ms·

On one hand, this was required from the beginning (this is just a clarification of original intent, not a change or addition) However it's deeper since the pop

On one hand, this was required from the beginning (this is just a clarification of original intent, not a change or addition) However it's deeper since the popups we see today were never recommended nor required by the original regs. The laborious nonsense we endure was invented by websites as a workaround for the regs. So it wasn't obvious that consent parity would ever need to be clarified like this because it wasn't even obvious that the industry would come up with such an awful popup pattern to begin with (though in retrospect we should've known I guess). The fact the popups were never even compliant anyway is just a combination of wilful ignorance, dark patterns, consulting companies wanting to sell something and - yes - an added set of people innocently misinterpreting regulation.

phendrenad2 4y ago
This is nonsense talk. How do you differentiate between compliance with the regulation, and a "workaround" to the regulation? I guess it's at each of our discretion, right? It's subjective? Or are they the same thing? You can keep calling them "workarounds" but that distinction only exists in your own mind.
- unaindz 4y ago
  It's a workaround if a website manages to make users accept cookies that would otherwise refuse just by making it so inconvenient UI wise to refuse them. The limits and edge cases on this may be subjective but then again so are most laws.
- ncallaway 4y ago
  Why do you consider something nonsense just because it’s a subjective judgement call? Lots of things are subjective judgement calls. They are not all nonsense.
  - Defletter 4y ago
    Many people sadly have this mindset that if something is not explicitly and comprehensively spelt out then anything goes, therefore any complaints for bad implementations is purely on the regulations for not being explicit and comprehensive enough. Now, obviously, there's SOME truth to this, but too often people think in black and white.
    - ncallaway 4y ago
      I often think it usually goes the other way. If a regulation is too specifically defined, it often ends up having gaping holes and other issues. Most of our longest standing torts and crimes have subjectivity right at their core, and I'd argue that's not a coincidence but survivorship bias. The world just isn't black and white, and attempts to legislatively render it so inevitably cause problems (though, obviously too much subjectivity and something because uselessly vague; it's a tricky balancing act for sure).
      - Defletter 4y ago
        Depends on the legislative culture. For example, from the Copywrongs talk from now Felix Reda: > The other legal tradition underlying the EU copyright system which is the continental European tradition of droit d’auteur (or Author's Rights). In this system, the authors of cultural works have certain inalienable rights that they cannot sell to a right holder. And, importantly, the exceptions to copyright, the interests of the public are written into the law. [...] The problem with the continental system is that it is quite inflexible because every time a new technological development comes about, you have to change the law to allow this type of use without a copyright infringement. So every new way of dealing with culture is fobidden by default. - https://www.youtube.com/watch?v=wL_Wxu6x1HU https://www.youtube.com/watch?v=wL_Wxu6x1HU Whereas other legislative cultures prefer to set a general framework, then leave the details to the Courts and or to Government ministers.
- atoav 4y ago
  The rules are very clear: if you collect personal data¹ for other purposes than legitimate interest you need to give people an easy choice to deny that collection and the service should not be worse because of it. I mean the EU published a guideline on what it calls deceptive design patterns. They are quite clear there with what is unacceptable (link to PDF): https://edpb.europa.eu/system/files/2023-02/edpb_03-2022_guidelines_on_deceptive_design_patterns_in_social_media_platform_interfaces_v2_en_0.pdf https://edpb.europa.eu/system/files/2023-02/edpb_03-2022_gui... When even Google felt they had to make "reject all" equally big and not hise it in a sub menu, you know that everything else is likely not legal. ¹: whether you use cookies for it or not doesn't matter
  - phendrenad2 4y ago
    I think you're misunderstanding what the poster was talking about. You're taking "the popups we see today were never recommended nor required by the original regs" to mean that the popups have become something that wasn't intended by the regulation (but the regulation did require popups). I think that the poster was saying that the popups themselves as a concept were never recommended nor required by the regulations.
    - lucideer 4y ago
      > but the regulation did require popups Yeah I guess the word "require" has a few interpretations. The regulation didn't explicitly require popups, it required user consent IFF a company wants to collect/process/sell data the company doesn't need, but the intent was that companies would not do this, with consent being the exception, and the mechanism of consent was neither prescribed nor a focus: it certainly wasn't annoying popups per reg.
    - atoav 4y ago
      The regularion required informed consent. Nobody ever said it has to be done with popups. This is what people ended up doing afterwards. Only when deceptive patterns became clear the EU made clear that allowing one simple "ok" option and a million convoluted ways to say "no" is not resulting in informed consent. Wheter you us a popup or hide it in a menu with the default of not tracking does not matter.
webworker 4y ago
This should have always had been implemented by the user agent, not by web authors.
- lucideer 4y ago
  You're still thinking of it exclusively in terms of frontend web development (consent popups) whereas the original regulation was largely concerned with reducing data collection by the business in general, at a backend/database level & even things like manual in-person/on-paper collection. The frontend content screen component of the whole topic was something that emerged afterward as businesses' attempt to get away with continuing rampant unfettered data collection.
  - Vinnl 4y ago
    To add to this, the law allows for data collection for a bunch of reasons. However, it intended to put a stop to a lot of data collection practices that were not to the benefit of the user, and informed consent is an exception to still allow for that, but only in the case that the user is actually actively OK with it. But of course, companies then started harassing users to make them agree, and the narrative arose that the EU "forced" them to do it.

phendrenad2 4y ago

This is nonsense talk. How do you differentiate between compliance with the regulation, and a "workaround" to the regulation? I guess it's at each of our discretion, right? It's subjective? Or are they the same thing? You can keep calling them "workarounds" but that distinction only exists in your own mind.

unaindz 4y ago
It's a workaround if a website manages to make users accept cookies that would otherwise refuse just by making it so inconvenient UI wise to refuse them. The limits and edge cases on this may be subjective but then again so are most laws.
ncallaway 4y ago
Why do you consider something nonsense just because it’s a subjective judgement call? Lots of things are subjective judgement calls. They are not all nonsense.
- Defletter 4y ago
  Many people sadly have this mindset that if something is not explicitly and comprehensively spelt out then anything goes, therefore any complaints for bad implementations is purely on the regulations for not being explicit and comprehensive enough. Now, obviously, there's SOME truth to this, but too often people think in black and white.
  - ncallaway 4y ago
    I often think it usually goes the other way. If a regulation is too specifically defined, it often ends up having gaping holes and other issues. Most of our longest standing torts and crimes have subjectivity right at their core, and I'd argue that's not a coincidence but survivorship bias. The world just isn't black and white, and attempts to legislatively render it so inevitably cause problems (though, obviously too much subjectivity and something because uselessly vague; it's a tricky balancing act for sure).
    - Defletter 4y ago
      Depends on the legislative culture. For example, from the Copywrongs talk from now Felix Reda: > The other legal tradition underlying the EU copyright system which is the continental European tradition of droit d’auteur (or Author's Rights). In this system, the authors of cultural works have certain inalienable rights that they cannot sell to a right holder. And, importantly, the exceptions to copyright, the interests of the public are written into the law. [...] The problem with the continental system is that it is quite inflexible because every time a new technological development comes about, you have to change the law to allow this type of use without a copyright infringement. So every new way of dealing with culture is fobidden by default. - https://www.youtube.com/watch?v=wL_Wxu6x1HU https://www.youtube.com/watch?v=wL_Wxu6x1HU Whereas other legislative cultures prefer to set a general framework, then leave the details to the Courts and or to Government ministers.
atoav 4y ago
The rules are very clear: if you collect personal data¹ for other purposes than legitimate interest you need to give people an easy choice to deny that collection and the service should not be worse because of it. I mean the EU published a guideline on what it calls deceptive design patterns. They are quite clear there with what is unacceptable (link to PDF): https://edpb.europa.eu/system/files/2023-02/edpb_03-2022_guidelines_on_deceptive_design_patterns_in_social_media_platform_interfaces_v2_en_0.pdf https://edpb.europa.eu/system/files/2023-02/edpb_03-2022_gui... When even Google felt they had to make "reject all" equally big and not hise it in a sub menu, you know that everything else is likely not legal. ¹: whether you use cookies for it or not doesn't matter
- phendrenad2 4y ago
  I think you're misunderstanding what the poster was talking about. You're taking "the popups we see today were never recommended nor required by the original regs" to mean that the popups have become something that wasn't intended by the regulation (but the regulation did require popups). I think that the poster was saying that the popups themselves as a concept were never recommended nor required by the regulations.
  - lucideer 4y ago
    > but the regulation did require popups Yeah I guess the word "require" has a few interpretations. The regulation didn't explicitly require popups, it required user consent IFF a company wants to collect/process/sell data the company doesn't need, but the intent was that companies would not do this, with consent being the exception, and the mechanism of consent was neither prescribed nor a focus: it certainly wasn't annoying popups per reg.
  - atoav 4y ago
    The regularion required informed consent. Nobody ever said it has to be done with popups. This is what people ended up doing afterwards. Only when deceptive patterns became clear the EU made clear that allowing one simple "ok" option and a million convoluted ways to say "no" is not resulting in informed consent. Wheter you us a popup or hide it in a menu with the default of not tracking does not matter.

webworker 4y ago

This should have always had been implemented by the user agent, not by web authors.

lucideer 4y ago
You're still thinking of it exclusively in terms of frontend web development (consent popups) whereas the original regulation was largely concerned with reducing data collection by the business in general, at a backend/database level & even things like manual in-person/on-paper collection. The frontend content screen component of the whole topic was something that emerged afterward as businesses' attempt to get away with continuing rampant unfettered data collection.
- Vinnl 4y ago
  To add to this, the law allows for data collection for a bunch of reasons. However, it intended to put a stop to a lot of data collection practices that were not to the benefit of the user, and informed consent is an exception to still allow for that, but only in the case that the user is actually actively OK with it. But of course, companies then started harassing users to make them agree, and the narrative arose that the EU "forced" them to do it.