8 ms·

Does it not also apply to the service provider? Does the service provider also get the right to consent to show their content or services under certain conditi

Does it not also apply to the service provider? Does the service provider also get the right to consent to show their content or services under certain conditions? In a voluntary society, both parties must consent to the arrangement for a user to (freely) use a service.

PeterisP 3y ago
The core principle of how EU and GDPR treats privacy rights is that they're inalienable, they're not for sale, they can't be traded away in a contract or arrangement. So for use cases where you need the user's consent because you don't have a different GDPR-valid reason for processing data (many reasonable use cases don't need consent, but user tracking for advertising generally does), that processing is permitted only if that consent is freely given i.e. willingly 'gifted'. One way how it's implemented is that if some service if conditional upon 'consent' then there is literally no way to get 'GDPR-valid' consent - the user clicking 'I consent' to bypass a paywall doesn't count as the user consenting, and neither does signing a personalized pen&paper contract saying that the user consents to tracking in return for getting free use of some service, because that's not "freely given consent" and so it doesn't permit Meta to track that user. It's just like signing a contract where you get $10000 in return for agreeing to be enslaved for some time - your freedom is not something that can legally be sold, and so are the privacy rights. The other way how it's implemented in GDPR is that it must be possible to withdraw consent at any time (including 5 seconds after signing up to a service) without any adverse consequences such as the service being cancelled or increasing in price. Obviously that's not a problem if the consent is freely given, but if someone tries to figure out some roundabout way of buying or trading for consent, the consequence-free cancellation makes the point that it's not supposed to work that way. Of course, companies are not required to provide any service, and they can require a fee for some services - however what they can't do is buy 'consent' with discounts or free service; the GDPR limitations to tracking users are intended to apply to all tiers of users, no matter what Meta does or wants to do. Meta can gift users free service; users can 'gift' Meta consent to tracking, but they can't make a binding contract on that because under GDPR conditional consent is literally meaningless and worthless.
- dureuill 3y ago
  If that interpretation is correct, how can websites like lemonde.fr propose to either accept all cookies or get a paid subscription, under the GDPR? Is that actually illegal? Or am I missing a difference with what you're describing?
  - PeterisP 3y ago
    There are two main things. One is that the 'cookie law' is quite different in scope and terms (e.g. it also applies to various non-personalized cookies), and the consent conditions for accepting cookies in that law are substantially different than the ones in GDPR; and I it's quite likely (since I don't read French) that they're asserting that the particular usage of any privately indentifiable cookie data (if any) they are doing is permitted by one of the non-consent clauses of GDPR e.g. the legitimate need sections. The other is that GDPR is still 'enforcement-limited', and there are many organizations that simply violate GDPR - the fact that some organization has done something for years and has not yet been forced to change their ways does not imply that what they do is permitted by GDPR; it's just that the enforcement of GDPR for the trickier parts like online services (as opposed to the important services in physical world, employment, real estate and renting, banking, telecommunications, medicine, etc which were prioritized and are now highly compliant) is starting with the larger violators like Meta, other companies would be handled afterwards, and since news companies are 'politically sensitive' I'd expect that lemonde.fr would be among the very, very last on the regulator's list.

PeterisP 3y ago

The core principle of how EU and GDPR treats privacy rights is that they're inalienable, they're not for sale, they can't be traded away in a contract or arrangement. So for use cases where you need the user's consent because you don't have a different GDPR-valid reason for processing data (many reasonable use cases don't need consent, but user tracking for advertising generally does), that processing is permitted only if that consent is freely given i.e. willingly 'gifted'. One way how it's implemented is that if some service if conditional upon 'consent' then there is literally no way to get 'GDPR-valid' consent - the user clicking 'I consent' to bypass a paywall doesn't count as the user consenting, and neither does signing a personalized pen&paper contract saying that the user consents to tracking in return for getting free use of some service, because that's not "freely given consent" and so it doesn't permit Meta to track that user. It's just like signing a contract where you get $10000 in return for agreeing to be enslaved for some time - your freedom is not something that can legally be sold, and so are the privacy rights. The other way how it's implemented in GDPR is that it must be possible to withdraw consent at any time (including 5 seconds after signing up to a service) without any adverse consequences such as the service being cancelled or increasing in price. Obviously that's not a problem if the consent is freely given, but if someone tries to figure out some roundabout way of buying or trading for consent, the consequence-free cancellation makes the point that it's not supposed to work that way. Of course, companies are not required to provide any service, and they can require a fee for some services - however what they can't do is buy 'consent' with discounts or free service; the GDPR limitations to tracking users are intended to apply to all tiers of users, no matter what Meta does or wants to do. Meta can gift users free service; users can 'gift' Meta consent to tracking, but they can't make a binding contract on that because under GDPR conditional consent is literally meaningless and worthless.

dureuill 3y ago
If that interpretation is correct, how can websites like lemonde.fr propose to either accept all cookies or get a paid subscription, under the GDPR? Is that actually illegal? Or am I missing a difference with what you're describing?
- PeterisP 3y ago
  There are two main things. One is that the 'cookie law' is quite different in scope and terms (e.g. it also applies to various non-personalized cookies), and the consent conditions for accepting cookies in that law are substantially different than the ones in GDPR; and I it's quite likely (since I don't read French) that they're asserting that the particular usage of any privately indentifiable cookie data (if any) they are doing is permitted by one of the non-consent clauses of GDPR e.g. the legitimate need sections. The other is that GDPR is still 'enforcement-limited', and there are many organizations that simply violate GDPR - the fact that some organization has done something for years and has not yet been forced to change their ways does not imply that what they do is permitted by GDPR; it's just that the enforcement of GDPR for the trickier parts like online services (as opposed to the important services in physical world, employment, real estate and renting, banking, telecommunications, medicine, etc which were prioritized and are now highly compliant) is starting with the larger violators like Meta, other companies would be handled afterwards, and since news companies are 'politically sensitive' I'd expect that lemonde.fr would be among the very, very last on the regulator's list.