3 ms·

You need a consent popup to embed YouTube or Twitter or any ad platform. And if you have the popup, you might as well throw in Google Analytics etc as well, rig

You need a consent popup to embed YouTube or Twitter or any ad platform. And if you have the popup, you might as well throw in Google Analytics etc as well, right? If sites use this because it's easy to set up, then Cloudflare has done something good for the internet. Compared to the alternative, which is where they choose a product that loads up dark patterns to get users to accept cookies.

cuu508 4y ago
> And if you have the popup, you might as well throw in Google Analytics etc as well, right? Google Analytics is problematic[1], consent or no consent, unless you send anonymized analytics events through your own proxy server. [1] Austria: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... France: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... Denmark: https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... Finland: https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-huomautuksen-kirjastojen-aineistohakutietojen-valittymisesta-yhdysvaltalaisyritys-googlelle?languageId=en_US https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-h... Norway: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/ https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va...
- deleted 4y ago
  [deleted]
PeterisP 4y ago
> You need a consent popup to embed YouTube or Twitter Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused (under GDPR consent inherently is opt-in, not opt-out; and consent is valid only if it is freely given, i.e. if you don't refuse service to those who refuse consent), and for that you don't necessarily need a popup, because you're free to assume that noone opts in to anything where a choice is provided - if you just treat everyone as if they clicked 'I refuse any optional consent', you don't need to ask that question.
- aruggirello 4y ago
  > Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused Should it? I mean, GDPR wise you're sending a subrequest by embedding eg. an iframe - which involves user data that might be used for tracking by yt/tt etc. Shouldn't it be better - to err on the safe side - to just replace eg. the embedded player with a placeholder (maybe featuring a link to youtube) unless user has given consent to the embedded player?
- kuba-orlik 4y ago
  I've seen DPOs requesting sites to not load YouTube without consent because of the cookies
hammyhavoc 4y ago
Does CloudFlare's Zaraz actually work on embedded YouTube and Twitter content? Not tried it, but just having a look in my CloudFlare dashboard at it, and not sure how this would be implemented.
- yoavm 4y ago
  Not yet, but it's something we're launching very soon. See this: https://github.com/managed-components/twitter/pull/2 https://github.com/managed-components/twitter/pull/2
  - hammyhavoc 4y ago
    That's a beaut! Looking forward to switching over to Zaraz. Keep up the excellent work.

cuu508 4y ago

> And if you have the popup, you might as well throw in Google Analytics etc as well, right? Google Analytics is problematic[1], consent or no consent, unless you send anonymized analytics events through your own proxy server. [1] Austria: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... France: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... Denmark: https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... Finland: https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-huomautuksen-kirjastojen-aineistohakutietojen-valittymisesta-yhdysvaltalaisyritys-googlelle?languageId=en_US https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-h... Norway: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/ https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va...

deleted 4y ago
[deleted]

PeterisP 4y ago

> You need a consent popup to embed YouTube or Twitter Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused (under GDPR consent inherently is opt-in, not opt-out; and consent is valid only if it is freely given, i.e. if you don't refuse service to those who refuse consent), and for that you don't necessarily need a popup, because you're free to assume that noone opts in to anything where a choice is provided - if you just treat everyone as if they clicked 'I refuse any optional consent', you don't need to ask that question.

aruggirello 4y ago
> Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused Should it? I mean, GDPR wise you're sending a subrequest by embedding eg. an iframe - which involves user data that might be used for tracking by yt/tt etc. Shouldn't it be better - to err on the safe side - to just replace eg. the embedded player with a placeholder (maybe featuring a link to youtube) unless user has given consent to the embedded player?
kuba-orlik 4y ago
I've seen DPOs requesting sites to not load YouTube without consent because of the cookies

hammyhavoc 4y ago

Does CloudFlare's Zaraz actually work on embedded YouTube and Twitter content? Not tried it, but just having a look in my CloudFlare dashboard at it, and not sure how this would be implemented.

yoavm 4y ago
Not yet, but it's something we're launching very soon. See this: https://github.com/managed-components/twitter/pull/2 https://github.com/managed-components/twitter/pull/2
- hammyhavoc 4y ago
  That's a beaut! Looking forward to switching over to Zaraz. Keep up the excellent work.