4 ms·

EU regulations are not a monolith of good or bad. The cookie law is dumb beyond comprehension. On the other side GDPR is just great and I have yet to hear a goo

by Garvi 3y ago

EU regulations are not a monolith of good or bad. The cookie law is dumb beyond comprehension. On the other side GDPR is just great and I have yet to hear a good argument against it. The criticisms usually sound like listening to creationists talk about how silly evolution is (by that I mean they don't understand it). The only way I see Europe develop it's own internet tech and big businesses, is to copy what China did by simply blocking the foreign competition. Today there would be no Weibo, Baidu, Alibaba or Aliexpress without it. And I don't see a problem in that approach, but wouldn't mind being educated otherwise. Edit: I wish at least some of the people downvoting would have the intellect to form a paragraph of counter arguments, so I could understand why. It's like a sports event in here.

jkaplowitz 3y ago
The cookie law is partly dumb, but also frequently implemented in a way that violates the law and rarely subject to meaningful enforcement or significant penalties. So mostly the same practical problem as the GDPR.
- Garvi 3y ago
  Blaming cookies for tracking people is like blaming a bullet for a murder. It's the trackers installed on pretty much every single website that are the thing that tracks people, using cookies of course. The Google analytics or Facebook pixels, to name the top two offenders. I don't see how this relates to GDPR. Please explain.
  - jkaplowitz 3y ago
    > Blaming cookies for tracking people is like blaming a bullet for a murder. It's the trackers installed on pretty much every single website that are the thing that tracks people, using cookies of course. The Google analytics or Facebook pixels, to name the top two offenders. Yes. I agreed that the cookie law is partly dumb. The part of the cookie law that’s dumb is that it’s too narrowly scoped and should apply to all tracking technologies and techniques, for whichever purposes and vendors are or aren’t okay with the user. And it needs a systematic way for user-specified defaults across all websites, instead of leaving that to browser extensions. Ideally this would be opt-in rather than opt-out for privacy reasons, but I do understand the valid argument that the subset of people who would explicitly opt in to tracking are not representative of the whole user population. Probably the best balance of hassle vs privacy vs statistical validity is to require the major browsers to force a one-time explicit choice per purpose and/or per vendor without dark patterns involved, save those as defaults that get sent to the sites in a way that is legally mandatory for sites to respect, and allow per-site overrides using the same mechanism - instead of the current mess of shady consent pop-ups. > I don’t see how this relates to GDPR. Please explain. Both have more user-friendly requirements than people expect, both are widely violated in user-hostile ways, both are rarely enforced by regulators, and what rare enforcement does exist is slow, often reluctant, and with inadequate fines to change industry norms and sometimes not even much of the behavior of the fined company. They’re separate laws but with the same practical enforcement / incentive problems.
    - Garvi 3y ago
      > Ideally this would be opt-in rather than opt-out for privacy reasons As long as it's about cookies, the law is nonsense. Asking laypeople to "opt-in to tracking" so they can log into a website would render most websites inoperable. > They’re separate laws but with the same practical enforcement / incentive problems. I disagree with this. The cookie law popups pretend to ask users whether they consent to being tracked or not. Which is entirely misleading. With GDPR the pressure is on the companies to disclose what data they are collecting on you and give you the option of deleting it. > Both have more user-friendly requirements than people expect, both are widely violated in user-hostile ways, both are rarely enforced by regulators, and what rare enforcement does exist is slow, often reluctant, and with inadequate fines to change industry behavior. If I understand you correctly, you're saying the main downside to GDPR is it's not properly enforced. I agree with that.
      - jkaplowitz 3y ago
        Neither the GDPR nor the ePrivacy Directive (cookie law) requires consent for cookies that are technically necessary to operate a website, including those to reflect a user-initiated login action. This is separate from consent to tracking for advertising, marketing, and analytics purposes. The cookie law doesn’t pretend to require consent for non-essential cookies placed on end user decides - it does require that consent. But, yeah many of the popups handle this in misleading ways where the verb “pretend” is quite accurate. This is exactly the same problem of under enforcement and misaligned incentives that limits the effectiveness of the GDPR, even though the two laws have different scopes and requirements. Yes, you correctly understood the GDPR downside I was describing.
    - sarnowski 3y ago
      > The part of the cookie law that’s dumb is that it’s too narrowly scoped and should apply to all tracking technologies and techniques, for whichever purposes and vendors are or aren’t okay with the user. A recent definition of the German authorities clarifies that with „cookies“, they don’t interpret it narrowly as the specific browser technology but any kind of beacon or mechanism for tracking[0]: > Gemeint ist damit beispielsweise der Einsatz von Cookies und anderen Technologien wie LocalStorage, Web Storage, das Auslesen von Werbe- und Geräte-IDs, Seriennummern, aber auch der Einsatz von ETags oder TLS-Session-IDs zum Zwecke des Trackings, Fingerprinting (z.B. durch das Auslesen von installierten Schriften oder Anwendungen) und vieles mehr. Der Einfachheit halber wird das im Folgenden i.d.R. unter dem verkürzenden Begriff „Cookies“ zusammengefasst. They name as explicit examples not only cookies but LocalStorage, Web Storage, reading of any kind of serial numbers, ETags, TLS Session IDs (if used for tracking), and any other method for fingerprinting such as font profiling. [0] https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/ https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies...
johngladtj 3y ago
Can you provide me an example of a single EU regulation that is an unambiguous uncompromising good, that could not be accomplished in a better way on a national level? Just one.
- rightbyte 3y ago
  Unless the EU law is optimal you could always argue it could be better at a national level. So none?
- Garvi 3y ago
  This is a straw man fallacy. See: > EU regulations are not a monolith of good or bad.
- matthewmacleod 3y ago
  Can you provide me an example of a single national regulation that is an unambiguous uncompromising good, that could not be accomplished in a better way on an international level? Of course I'm being facetious and I'm sure you understand why this is a not a useful question for me to ask. In practice, there is no such thing as a regulation that is "an unambiguous uncompromising good" and each decision about regulation involves a series of tradeoffs. Don't create straw men.
- kergonath 3y ago
  Can you provide us with any single regulation that is an unambiguous uncompromising good? Hell, are you even sure that “unambiguous uncompromising good” is a thing that can actually exist in any group of humans?

by Garvi 3y ago

jkaplowitz 3y ago

The cookie law is partly dumb, but also frequently implemented in a way that violates the law and rarely subject to meaningful enforcement or significant penalties. So mostly the same practical problem as the GDPR.

Garvi 3y ago
Blaming cookies for tracking people is like blaming a bullet for a murder. It's the trackers installed on pretty much every single website that are the thing that tracks people, using cookies of course. The Google analytics or Facebook pixels, to name the top two offenders. I don't see how this relates to GDPR. Please explain.
- jkaplowitz 3y ago
  > Blaming cookies for tracking people is like blaming a bullet for a murder. It's the trackers installed on pretty much every single website that are the thing that tracks people, using cookies of course. The Google analytics or Facebook pixels, to name the top two offenders. Yes. I agreed that the cookie law is partly dumb. The part of the cookie law that’s dumb is that it’s too narrowly scoped and should apply to all tracking technologies and techniques, for whichever purposes and vendors are or aren’t okay with the user. And it needs a systematic way for user-specified defaults across all websites, instead of leaving that to browser extensions. Ideally this would be opt-in rather than opt-out for privacy reasons, but I do understand the valid argument that the subset of people who would explicitly opt in to tracking are not representative of the whole user population. Probably the best balance of hassle vs privacy vs statistical validity is to require the major browsers to force a one-time explicit choice per purpose and/or per vendor without dark patterns involved, save those as defaults that get sent to the sites in a way that is legally mandatory for sites to respect, and allow per-site overrides using the same mechanism - instead of the current mess of shady consent pop-ups. > I don’t see how this relates to GDPR. Please explain. Both have more user-friendly requirements than people expect, both are widely violated in user-hostile ways, both are rarely enforced by regulators, and what rare enforcement does exist is slow, often reluctant, and with inadequate fines to change industry norms and sometimes not even much of the behavior of the fined company. They’re separate laws but with the same practical enforcement / incentive problems.
  - Garvi 3y ago
    > Ideally this would be opt-in rather than opt-out for privacy reasons As long as it's about cookies, the law is nonsense. Asking laypeople to "opt-in to tracking" so they can log into a website would render most websites inoperable. > They’re separate laws but with the same practical enforcement / incentive problems. I disagree with this. The cookie law popups pretend to ask users whether they consent to being tracked or not. Which is entirely misleading. With GDPR the pressure is on the companies to disclose what data they are collecting on you and give you the option of deleting it. > Both have more user-friendly requirements than people expect, both are widely violated in user-hostile ways, both are rarely enforced by regulators, and what rare enforcement does exist is slow, often reluctant, and with inadequate fines to change industry behavior. If I understand you correctly, you're saying the main downside to GDPR is it's not properly enforced. I agree with that.
    - jkaplowitz 3y ago
      Neither the GDPR nor the ePrivacy Directive (cookie law) requires consent for cookies that are technically necessary to operate a website, including those to reflect a user-initiated login action. This is separate from consent to tracking for advertising, marketing, and analytics purposes. The cookie law doesn’t pretend to require consent for non-essential cookies placed on end user decides - it does require that consent. But, yeah many of the popups handle this in misleading ways where the verb “pretend” is quite accurate. This is exactly the same problem of under enforcement and misaligned incentives that limits the effectiveness of the GDPR, even though the two laws have different scopes and requirements. Yes, you correctly understood the GDPR downside I was describing.
  - sarnowski 3y ago
    > The part of the cookie law that’s dumb is that it’s too narrowly scoped and should apply to all tracking technologies and techniques, for whichever purposes and vendors are or aren’t okay with the user. A recent definition of the German authorities clarifies that with „cookies“, they don’t interpret it narrowly as the specific browser technology but any kind of beacon or mechanism for tracking[0]: > Gemeint ist damit beispielsweise der Einsatz von Cookies und anderen Technologien wie LocalStorage, Web Storage, das Auslesen von Werbe- und Geräte-IDs, Seriennummern, aber auch der Einsatz von ETags oder TLS-Session-IDs zum Zwecke des Trackings, Fingerprinting (z.B. durch das Auslesen von installierten Schriften oder Anwendungen) und vieles mehr. Der Einfachheit halber wird das im Folgenden i.d.R. unter dem verkürzenden Begriff „Cookies“ zusammengefasst. They name as explicit examples not only cookies but LocalStorage, Web Storage, reading of any kind of serial numbers, ETags, TLS Session IDs (if used for tracking), and any other method for fingerprinting such as font profiling. [0] https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/ https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies...

johngladtj 3y ago

Can you provide me an example of a single EU regulation that is an unambiguous uncompromising good, that could not be accomplished in a better way on a national level? Just one.

rightbyte 3y ago
Unless the EU law is optimal you could always argue it could be better at a national level. So none?
Garvi 3y ago
This is a straw man fallacy. See: > EU regulations are not a monolith of good or bad.
matthewmacleod 3y ago
Can you provide me an example of a single national regulation that is an unambiguous uncompromising good, that could not be accomplished in a better way on an international level? Of course I'm being facetious and I'm sure you understand why this is a not a useful question for me to ask. In practice, there is no such thing as a regulation that is "an unambiguous uncompromising good" and each decision about regulation involves a series of tradeoffs. Don't create straw men.
kergonath 3y ago
Can you provide us with any single regulation that is an unambiguous uncompromising good? Hell, are you even sure that “unambiguous uncompromising good” is a thing that can actually exist in any group of humans?