24 ms·

German court prohibits LinkedIn from ignoring "Do Not Track" signals

1216 points by isodev 3y ago

vachina 3y ago
Cool now DNT becomes another bit in user entropy to track us even better.
- ezfe 3y ago
  Safari actually removed DNT for this exact reason, it's no longer an option
bobmaxup 3y ago
If only this could translate to a person.
isodev 3y ago
Rough translation from German for relevant parts: "The social network LinkedIn is no longer allowed to announce on its website that it does not respond to "do-not-track" signals with which users object to the tracking of their surfing behavior via browser settings. This was decided by the Berlin Regional Court after a lawsuit by the Verbraucherzentrale Bundesverband (vzbv). The court also prohibited the company from setting a preset, according to which the member's profile is also visible on other websites and applications." ... "If consumers activate the "Do Not Track" function of their browser, this is a clear message: They do not want their surfing behaviour to be spied on for advertising and other purposes," says Rosemarie Rodden, legal lecturer at vzbv. "Website operators must respect this signal." ... "The District Court of Berlin agreed with the opinion of the vzbv that the company's communication was misleading. It suggests that the use of the DNT signal was legally irrelevant and that the defendant does not have to pay attention to such a signal. That's not true. According to the General Data Protection Regulation, the right to object to the processing of personal data can also be exercised by automated procedures. A DNT signal is an effective contradiction."
extraduder_ire 3y ago
Would this include browsers which have the DNT header enabled by default? I remember early edge/late internet explorer defaulting to sending the header, and claimed as much in advertising. The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled.
- jacquesm 3y ago
  Courts are not necessarily bound by such a spec, but it doesn't look as if that question was addressed here and in my view it would have to be established by another case because for sure the companies that ignore do not track right now will be more than happy to pretend that they have an excuse to continue to do so. This is a long drawn out rearguard fight.
- amelius 3y ago
  > The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled. Why?
  - noirscape 3y ago
    IIRC the people who wrote the spec did it in co-operation with the larger ad networks and this was the only way they could get the ad networks to comply with it. Then Microsoft enabled it by default in Explorer 10 and the ad networks took it as carte blanche to ignore the DNT header forever, claiming Microsoft had violated the agreement. Nowadays it's usually not set even by the overly privacy conscious out of fingerprinting concerns, since its another unique way to identify your traffic.
    - wkat4242 3y ago
      What didn't help was that the EFF was actively campaigning against it instead of lobbying to elevate the flag to legal status so it would become useful. The same way they campaigned against adblockers but had their own petty little voluntary pledge thing. That's what you get when your NGO gets so big your leaders end up playing on the same golf courses and waiting in the same netjets lounges as the enemy.
amelius 3y ago
"your browser has do not track enabled and therefore we cannot serve you this content"
- isodev 3y ago
  As someone who lives in the EU, I see this very often with US based websites - the ones that absolutely need the tracking cookies and the data suckage.
  - m463 3y ago
    define "need"? is this "need for my business model" or "need because we can't send a package without your address"?
    - adhesive_wombat 3y ago
      EU law makes that distinction, as I understand it. If the cookie is absolutely required to do something the user explicitly (not implicitly) requested, then you don't need consent. If you can get the user to explicitly request your business model including the use of these specific cookies then you're good to go.
    - resonious 3y ago
      I think a lot of it is really just pure incompetence. Some product person was just like "we need analytics" and so a dev just put it in. Probably neither party put any thought into it. The product person was trained to want analytics and the dev just does what they're told.
  - mrweasel 3y ago
    For the longest time I noticed that many of those websites, typically small-town newspapers, all ran the same CMS, developed by a former employer of mine. Part of the problem, at least back then, could have been that the CMS simply didn't have the ability to disable the tracking cookie based on visitor settings, and development had pretty much stopped years earlier.
jauntywundrkind 3y ago
That would be a major upheaval. This one feels legit; DNT has been around (and ignored by everyone) for a long long time. But the summary here is saying, oh, the consumer signalled something so sites have to obey. It feels like fools could make up all kinds of arbitrary signalling systems packaging all manners of data handling directives to sites. So, what if any limits does the court see or allow? If DNT is something sites have to obey, what's something sites wouldn't have to obey? And how do sites become aware of all the different mechanized ways consumers might send processing directives to them?
- krageon 3y ago
  This legal proceeding is about do not track. It is not about anything else which you're pulling in. This is an appeal to ridicule and these are generally not very interesting.
- fxtentacle 3y ago
  I'd say website should be required to honour any signal that more than 1 mio potential users know about. That seems like a fair trade-off between pushing work onto companies while simultaneously closing laziness as a loophole.
- wirrbel 3y ago
  I assume you are asking in good faith. I could configure my browser to add some custom headers to my HTTP requests, like `DONTDOTHISTHINGTHATISIMPORTANTTOME` or something. I don't think courts would accept that, as it's not an established interface / protocol, and furthermore GDPR does in fact allow for data-processing if it's needed / required to offer the service. By providing an interface standard, however, the browser vendors have kind of set the stage for the courts accepting DNT as a valid communication medium for the service consumer to state intent to the service provider. This is akin to the courts taking into account how the card-payment terminal works when ruling on matters of card-payment in stores, etc.
  - nvm0n2 3y ago
    You don't think courts would accept that, but you don't know, because EU privacy law is so vague and badly written that the courts regularly "discover" new things about it that nobody had previously considered possible. For example the fact that everyone had a right to remove stuff from search engines if it was about yourself was never written into law by any elected body or even any non-elected body. It was a right that a court simply invented. Ditto for not being able to use Google Fonts. The EU has had problems with this kind of activist lawmaking for a long time. It's one of the factors behind Brexit. Some Leave campaigners argued that it was impossible to make any kind of deal or compromise with the EU if it meant staying in, because no matter how clearly written it appeared to be and no matter how watertight the international treaty encoding it was, the European courts would simply ignore it and/or rule it invalid. This criticism landed because there was precedent for that, where the courts had previously done exactly the same thing with other agreements. The same debate is now playing out around the ECHR as well, which the UK stayed in because it's not technically an EU court, just a European court. Same cultural issues though.
mschild 3y ago
Excellent decision. But with most things GDPR, enforcement is key. I doubt any other website will actually change their behavior because of this. There's a single website that I have encountered that publicly respects Do Not Track: Geizhals.de No other website, that I know of at least, actually checks this.
- isodev 3y ago
  I hope tech companies see this as an incentive to get rid of the cookie prompts - a DNT clearly means "reject all tracking and non-essential cookies".
  - mschild 3y ago
    I do too, but I doubt it. They have shown plenty of times theyll fight it as much as they can.
  - romanovcode 3y ago
    It would be nice if DNT = deny all except mandatory. So browser would have one pop-up after installation and no more banners on websites. One could dream.
- jacquesm 3y ago
  This ruling opens up the door to enforcement, it is general enough that German companies and companies active in Germany will take notice and it might inspire other EU countries to follow suit.
- dantyti 3y ago
  The company I'm currently at has changed its behavior after court/regulatory decisions regarding google analytics. We are now using a cookieless solution that respects DNT. I have no doubt that this would not have happened otherwise. Still sad that our legal counsel didn't like the idea of self hosting web analytics (since then we'd become a data processor).
  - arlcode 3y ago
myspy 3y ago
I still don't get why websites are not able to find in-house ad solutions that are not provided by third parties. Major sites look like shit due to ads placed without thought or care. This should be handled like magazine or newspaper ads. People selecting and placing them in the page with care. Would result in a better experience and wouldn't require any tracking. I think that tracking to get "good ads" is a wish that never came true and it needs people with taste to choose products people would like to buy.
- jacquesm 3y ago
  That's because of the silo formation in the advertising market. Agencies want to have an easy time to spend a large budget and they don't want to negotiate individually with thousands of parties. So they do a bulk buy from some large provider which then provides a centralized way to return the statistics. These serve to - somewhat - keep property owners honest because both click fraud and placement fraud would probably be rampant. Not every kind of advertising is that suspect to fraud but for every budget out there there is some way to siphon it off without giving the advertiser what they were looking for. It's been an arms race between fraudsters and marketeers with the end-users caught in the middle, and between the marketeers and the users with respect to privacy issues. This ruling injects some sanity for those that have declared themselves to be non-combatants.
  - hanniabu 3y ago
    Youtubers get paid way more for custom in-video ads than they do for the automated ads that Youtube runs before and throughout their videos. If what you said was true then content creators wouldn't be going through the work getting these sponsors and sponsors wouldn't be bothering with the hassle of working with individual content creators.
    - jacquesm 3y ago
      some youtubers. But compared to overall ad spend on the internet that's a rounding error.
jacquesm 3y ago
Excellent news. Now let's see this taken up by the EU courts as well if they are challenged on this. But my guess is that the advertising world would rather do this on a country-by-country basis rather than to risk losing in all of the EU at once.
- arlcode 3y ago
  you can go only up so far the country court chain before you either lose or EU courts get involved. If this goes to the Federal Court (BGH) in Germany they will "ask" the European Court of Justice for their interpretation of the applicable Union law (in this case the GDPR) and other national courts will take this precedent into account. If LinkedIn does not appeal they will be required to follow the ruling. Even in this case it's not uncommon that national courts will look across the border.
- reddalo 3y ago
  I'd love if this became a EU-wide law. If you send the DNT header, then you can't get cookie consent alerts since you already do not consent being tracked.
  - nvm0n2 3y ago
    Alternative reading: if mechanized expression of consent is now possible, then if you send a different header "Tracking-OK: True" all the cookie consent banners should now disappear. It could be a great thing. 99%+ of all people would quickly learn to opt in to tracking to get rid of the annoying popups.
    - la_oveja 3y ago
      Or to apt out.
    - dns_snek 3y ago
      That's an impossible reading, tracking requires informed consent. Blanket "do whatever" consent can never be informed. Besides, if you gave users a free choice, as intended by the law, no one would consent to it.
baz00 3y ago
It will be funny watching the entire planet continue to ignore this. Edit: to clarify, a specification based on asking for something is a recipe for everyone to ignore you. It's a design flaw. And if they fix that with a legal patch then it will just be moved out of the jurisdiction that the legal patch applies to.
- esarbe 3y ago
  It's just the same as "Keine Werbung" stickers on German letter boxes; you can ignore it, but it will get you fined. Most large companies would like to continue making business in Germany, so I expect this to have some impact.
- literalAardvark 3y ago
  There is no jurisdiction that the legal patch doesn't apply to. If you allow any citizens of the EU you're forced to fully comply with the gdpr or face legal action. It's illegal to cherry pick. You can require a checkbox with "I'm not a citizen of the EU and I'm not in the EU at the moment" to sign up, but that's going to cost you. If anything, a technological solution would be inferior. We're a rule of law world these days, not a motte and bailey world, and that's benefitted everyone except the moat diggers.
  - tick_tock_tick 3y ago
    I think they are calling out how no one besides the really big multination's actually cares what the EU does and will just continue to ignore whatever rulings they make. Enforcement is always the biggest issue with these kind of laws and the EU has been taking a slow approach so people barely care.
    - Barrin92 3y ago
      >how no one besides the really big multination's actually cares the big multinationals are (by definition) the companies that predominantly serve the European market so the gains for the consumer and liability for the companies go hand in hand. Sure the Oklahoma Gazette isn't going to care but like three Europeans visit their homepage every ten years so it's not like it matters much in the first place. The actors you want to discipline are, like in this case, LinkedIn, Meta, Google, what have you. The sites that account for the overwhelming majority of traffic.
dalbasal 3y ago
Most of the pseudo-contract BS that defines consumer-company relations is trash legal theory. It should have never held water in the first place. The fact that our legal systems have tolerated and supported it, mostly demonstrates how intellectually weak the legal profession's philosophy and ethic is. Companies, especially interacting digitally, use TCs, EULAs and other such nonsense like an incantation. Those are not agreements. They are stupid little rituals that strip users/consumers/whoever of all rights. Any right that can be stripped by TCs... doesn't exist. The whole concept of "by agreement" in these circumstances is bogus but... If it must be this way... Stack the deck in the other direction. "By serving this browser a webpage, you agree to the following..." By dripping a cookie, by recording this person's data. Pro user, pseudo-legal defaults. Make "you must agree to X, before you use the product you bought" invalid. Give consumers the full right to unlimited time refunds, if divulging data or agreeing to terms (old or new) is a condition for using the product This ridiculous deck can be stacked either way. If I have to agree to a coercive contract intended not to be read, in order to use a device... Give me the right to say no and get a full refund at any time. At least invalidate the agreement. Where TF are our judges, judicial philosophies, law professors? I want to ask "How could they let this happen' but the correct question might be "Why did they do this to us."
- expertentipp 3y ago
  > Where TF are our judges, judicial philosophies, law professors? They are writing law in MS Word and negotiating any changes in law by sending paragraphs over email, which they check once a day at most.
  - Muromec 3y ago
    Checking email only once a day is a new privilege. Like long fancy sleeves were in the time before.
  - augustk 3y ago
    Eben Moglen is a unicorn.
  - dalbasal 3y ago
charcircuit 3y ago
Sites can still ask you if you consent to overwrite this, so it is no different than what already exists.
expertentipp 3y ago
Do Not Track is a silly nuance in Germany because the IP address is fully identifying there and the ISP contract owner takes full responsibility for anything happening behind it. Nothing to be excited about legal trolls burning public money on fighting LinkedIn in courts. XING is not going to happen, stop trying. Every "privacy" fart coming out of Germany is their predatory media publishers and copyright trolls unable to accept that internet exists.
- snordgren 3y ago
  The good news is that over 10 million largely tech illiterate Germans over the age of 55 will retire in the next decade. Not only will the Germany of the 2030s be less technophobic, it will be significantly less relevant in the EU and on the global stage. And by and large, Europeans won’t miss their stewardship.
- throwaway447 3y ago
  Trust me, I could not care less about the German boneheads. But you are right, as always, the judge has little understanding how tracking works. I have a heavily modified web surfing browser that offers me some amount of privacy and ad free experience. Pay walls I circumvent with "Pass paywalls clean" or with a bookmarklet that looks up the site on an archive. In the end, it makes it harder for an average website to track me but not impossible. Dont believe me? Try this website: https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint By the way, ghostery, the ad blocking software, is (was?) owned by a German media company. Hubert Burda Media. You can't make this stuff up. And no, you should not use it.
- rsynnott 3y ago
  > Do Not Track is a silly nuance in Germany because the IP address is fully identifying there I flatly do not believe that CGNAT is not used in Germany. Do you have a reference for this? > the ISP contract owner takes full responsibility for anything happening behind it What's that got to do with anything? The issue here is the bad behaviour of the website, not the client.
  - 3y ago
agilob 3y ago
Does it set a precedent that I can send a header "do-not-show-ads" and they can't send me ads?
- dist-epoch 3y ago
  Tracking is considered a negative action, so there are stronger protections around that. It's not a crime to put an advertising truck outside a house, but it can be to put a (private company) surveillance truck.
- Rygian 3y ago
  I've been having the same thoughts. Pragmatically, the main roadblock is that the DNSA flag would need to go through some legitimate standardization process. It would be really fun* if the headers of an HTTP request were to be considered part of a legally binding agreement between client and server. *In a "mentally deranged fun" sense, of course.
- JanSt 3y ago
  No, ads are okay in terms of GDPR. The tracking requires consent.
  - agilob 3y ago
    Ads are highly regulated in the EU and individually in member countries. Eg. in Poland it's illegal to show ads using TV shows for children, the ads before and after a show have to be child safe, eg. no medications. Yet same rules don't apply to YouTube or Facebook. Why wouldn't I indicate using a header that this device is used by a child and ads must be appropriate?
    - gpderetta 3y ago
      Standardizing a "child-safe-content-only" flag would be definitely appropriate.
      - hnbad 3y ago
pptr 3y ago
How is DNT different from simply not giving consent in this case?
- reddalo 3y ago
  In other words: why is it legal to show me annoying cookie consent banners if I already chose to send a Do Not Track header? Asking again for consent after being rejected is forbidden.
  - eilefsen 3y ago
    Exactly, any form of consent requires respecting "No" as a final answer. After that, consent is opt-in.
  - bobmaxup 3y ago
    Yeah, many articles and people here raising this point in 2017-2018
- openplatypus 3y ago
  It is just legalise. There was always a problem in defining what DNT actually means and what it implies. Just check how confusing and ambiguous the whole header is across various references https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
okr 3y ago
Nice! So announcing "Keine Werbung" on my letter box becomes now also a legal binding? I also wonder about all the announcement on t-shirts. Hmm.
- throwbadubadu 3y ago
  It always has been already for a long time.. (a "Keine Werbung" sticker is enough to indicate you don't want it)?! https://dejure.org/gesetze/UWG/7.html https://dejure.org/gesetze/UWG/7.html Sure, theory and practice and sueing offenders are all different things, however most obey that here I'd say?
  - worklaptopacct 3y ago
    In practice, "Keine Werbung" means "No advertisements except for moving services". These are the only ones that don't give a shit.
    - tommiegannert 3y ago
      Outside Zürich, I see small-time car dealers, small-time precious metals dealers, delivered pizza and kebab from neighboring villages. Perhaps advertisement is only something big companies do? /s
    - mr_mitm 3y ago
      In my experience, it's food delivery services.
    - nicbou 3y ago
      I wonder if there is a way to make them give a shit. A pizza place in my area is a serial offender, and I'm wondering if an Abmahnung and the threat of a fine would get them to stop.
- isodev 3y ago
  It should … the “no ads” mailbox stickers are legally binding in Belgium. In fact, you can’t send mail spam to people without opt-in consent.
openplatypus 3y ago
If you use Wide Angle Analytics, you get DNT support enabled by default :) https://wideangle.co/documentation/data-do-not-track-handling https://wideangle.co/documentation/data-do-not-track-handlin... (but you can disable it if it does not apply to your situation)
reddalo 3y ago
Please: let's get rid of cookie banners. Force websites not to show cookie consent banners if I already chose not to be tracked by enabling the Do Not Track (DNT) header.
- dspillett 3y ago
  The danger there is that people who consider adding a second check for “legitimate interest” (otherwise known as “we see your preference, but fuck you and your preferences we want to anyway”) to be valid will consider that their legitimate interest pushes the tracking into required-cookies territory so not covered by DNT.
  - hnbad 3y ago
    There's no such thing as "consenting to legitimate interest" in the GDPR. Those are two different mechanisms. Legitimate interest does not require consent. If it requires consent or can simply be opted out to, it's not legitimate interest and therefore requires consent. Those two-stage "legitimate interest" opt-out toggles are pseudo-legal nonsense dreamt up by (mostly non-EU?) companies trying to shoehorn their business model into the new legislation, just like the "consent pop-ups" that don't provide a single-click "disagree with all". Those are actually explicitly forbidden by the ePrivacy directive btw: there must be a first-level "disagree with all" button and it must be as visible as the "accept all" button if there is one. I actually see nothing in this ruling about DNT that makes DNT do anything that isn't already the default under the GDPR. As far as I can tell, the ruling just supported the claim that LinkedIn was demonstrating deliberate intent in its violation of the GDPR by saying it does not consider DNT to be relevant. It was likely already violating the GDPR based on what the article describes, this just establishes a justification to issue a serious fine rather than just a warning.
  - glitchcrab 3y ago
    'legitimate interest' is such a load of horseshit. I will go out of my way to reject those too purely on principal.
looopTools 3y ago
I think this is really, really good. I hope other European countries follows suite
- Kwastie 3y ago
  I am not sure this is even required. A (German) legal court order could also be used across the EU as a case law.
  - rambambram 3y ago
    Care to explain? In my legal career - which is now years behind me - I've never heard of, say, a Dutch court picking case law from Germany and make it applicable to a Dutch case.
    - K5EiS 3y ago
      Not sure if this is applicable, but it looks like it may be possible? https://commission.europa.eu/law/cross-border-cases/judicial-cooperation/types-judicial-cooperation/mutual-recognition-judgments_en https://commission.europa.eu/law/cross-border-cases/judicial...
      - 1116574 3y ago
        This talks about foreign countries applying & enforcing your countries court orders (within EU). I don't think it can be stretched to include case law in your new case. You could try that in court since the base gdpr is the same, but EU law implementations still differ.
    - HelloNurse 3y ago
      GDPR is a different law per country, not one law for the whole Union. A lawyer could argue that the law in their country is supposed to work like the law of another country because both are GDPR, not directly appeal to the authority of a foreign court.
      - 3y ago
frereubu 3y ago
This is fantastic, and I hope it stands up on the presumably inevitable appeal. It's the most obvious way of eventually getting rid of per-site cookie notices - make DNT legally enforceable and cookie notices become irrelevant for people who have it switched on. I run an agency that builds websites for non-profits and we respect DNT by not tracking and not even displaying the cookie notice. The only thing I've wondered about is whether we show a one-off notice saying "we note your DNT setting and we've disabled tracking" just because I wonder if users become suspicious that we're tracking them by default if they don't see a cookie notice!
- mdiesel 3y ago
  It's a sad state of affairs that if I saw that message I would think positively of the website... Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor
  - littlestymaar 3y ago
    As long as you use the cookie for nothing else, this counts as a technical cookie that's allowed by GDPR.
    - M2Ys4U 3y ago
      This is nothing to do with the GDPR. It's the ePrivacy Directive that deals with cookies.
  - louis-lau 3y ago
    That's not really what anyone means when they say tracking...
    - youngtaff 3y ago
      The recent case against Criteo in the Netherlands has some interesting definitions of cookie types: This case revolves around (third party) tracking cookies. The Dutch Data Protection Authority (AP) defines 2 cookies as follows: “Cookies are small files that a website owner places on a visitor’s device. For example on a computer, laptop, smartphone or tablet. For example, the owner can collect or store information about the website visit or about (the device of) the visitor. Bottom of form There are 3 types of cookies: - functional cookies; - analytical cookies; - tracking cookies.” The AP says about tracking cookies 3 : “If cookies can also be read when you visit another website, we call these tracking cookies. These cookies allow organizations to track people’s internet behavior over time. Tracking cookies make it possible to draw up profiles of people ( profiling ) and treat them differently. Tracking cookies usually process personal data. Personal interests can be derived from the information about visited websites. This allows organizations to, for example, show their website visitors targeted advertisements. (…) Do you process personal data of visitors to your website with tracking cookies? Then you must comply with the rules of the General Data Protection Regulation (GDPR).” https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp&_x_tr_hist=true#!/details?id=ECLI:NL:RBAMS:2023:6530 https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=a...
n_ary 3y ago
This is an excellent step towards more control for consumers/users. Next step should be DNT disable all cookie popups and assume that only essential cookies are acceptable. Speaking of, I am expecting DNT to reset to disabled silently on next release of chrome. So people forget about it and tracking is allowed.
guywhocodes 3y ago
If this is the direction things are going sadly I think it will be norm to just not serve anything if you have it on.
- tjpnz 3y ago
  Or tech will have to find a way to make money which doesn't involve stalking their users.
- bobmaxup 3y ago
  Sadly? For whomever is monetizing the data, possibly. I doubt anyone else will care (outside of secondary+ effects).
  - guywhocodes 3y ago
    Yes it's sad if DNT becomes useless because you can't access the web with it.
- aembleton 3y ago
  I think that would go against the GDPR.
  - guywhocodes 3y ago
    There are already companies that do not serve EU because of GDPR...
joelthelion 3y ago
Are they allowed not to serve you if you have DNT enabled?
- Xelbair 3y ago
  Of course not. That's the point of GDPR.
  - 9dev 3y ago
    Not true. Every business has freedom to choose its customers. Nobody can force you to service them for free, and nobody can force you to serve your website without tracking enabled if that drives your revenue. However, you’ll have to live with the consequences. Maybe it’s time to reduce reliance on tracking after all?
    - markus92 3y ago
      GDPR does not allow for negative consequences for refusing consent - it must be freely given and if there is a negative consequence it is not considered to be given freely.
    - kuschku 3y ago
      There are many protected categories. You cannot discriminate based on race, for example. A major point of GDPR is that it basically made "do you agree to tracking? yes/no" a protected category as well. Specifically, it requires freely given consent to allow tracking. Freely given consent is defined by the GDPR as consent that was given without any discrimination, rejection of service, or extortion in any way influencing your choice. So no, you absolutely cannot discriminate based on whether users agreed to tracking or not.
    - hnbad 3y ago
      Yes true. If the service can be provided without collecting and processing certain data you can not coerce the user to "consent" to you doing so in order to access your service. E.g. the good old growth hack of collecting newsletter subscriptions by email-gating a "free e-book" behind a newsletter signup form. There does seem to be a loophole for enforcing tracking ads as "legitimate interest" (i.e. not seeking consent) if you also offer a paid subscription without them, which is what a lot of German news sites seem to have shifted to. There was a recent court case in Germany however because a company got sued for not providing an option to not consent to everything that wasn't related to ads (e.g. analytics, third-party widgets and so on) and most sites seem to now provide granular controls even when they force ads if you don't want to pay. Note that they still have to lazy load the ads after consent is given in order to be compliant. I'm not sure if this way of forcing ads is compliant throughout the EU as it feels more of a gray area given that the site usually sends the full article and then gates it behind a consent modal on the client, i.e. there's no technical requirement to show the ads, just a sustainability one.
buro9 3y ago
This is definitely how the Cookie prompts should be eradicated... if the browser indicates DNT, then don't try and track via cookies.
botanical 3y ago
I see no one's commented on Global Privacy Control. It's essentially an HTTP header that's supposed to be legally binding with the California Consumer Protection Act (CCPA); unlike DNT. There's a setting on Firefox (Beta at least) that enables it. See: https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ https://global-privacy-control.glitch.me/ https://global-privacy-control.glitch.me/ https://privacycg.github.io/gpc-spec/ https://privacycg.github.io/gpc-spec/
- fmajid 3y ago
  GPC is already the law in California, but it seems the EU has yet to catch up, possibly because of how enforcement failed by being delegated to national DPAs, some of which like the Irish ones are clearly captured by the surveillance-industrial complex. https://www.huntonprivacyblog.com/2021/07/15/california-attorney-general-updates-ccpa-faqs-indicating-mandatory-compliance-with-global-privacy-control/ https://www.huntonprivacyblog.com/2021/07/15/california-atto...
  - LelouBil 3y ago
    Yeah, that's the unfortunate part of the GDPR. Enforcement is very slow.
    - fmajid 3y ago
      The EU learned its lesson. DSA and DMA enforcement is not left to national authorities. The Irish DPC clearly thinks it is a subsidiary of the IDA, the agency charged with attracting multinational headquarters to Ireland.
d3w4s9 3y ago
Completely irrelevant... Will they recognize robots.txt as a legal contract?
jakub_g 3y ago
When GDPR took effect in Europe, a bunch of (mostly US) websites started serving "451 Unavailable For Legal Reasons" responses [1] to EU users. I wonder if there'll be another spike after this announcement. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/451 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/451
deleted 3y ago
[deleted]
TheFuzzball 3y ago
A potentially interesting aside is that Do Not Track was removed from Safari some time ago. Why? Because nobody respected it, and since it was a user setting that needed to be explicitly enabled, it proved to be a useful additional dimension for browser fingerprinting. So the irony is that, "do not track" ended up being used... to track.
GorkaE 3y ago
Little by little, news is coming in that makes me more optimistic about privacy on the Internet. 1.-Users/associations denounce more in court. 2.-Large corporations receive more convictions against them. 3.-Lawmakers legislate more on this issue. GDPR, CCPA, LGPD, PIPEDA,... 4.-Small/medium companies are taking note and are taking steps towards greater privacy for their customers, if only to differentiate themselves in some way. Maybe I am too naive
qwertox 3y ago
I'd have zero problems with ads embedded in the page where the topic is inferred from the content of the page. But as long as these companies unneccessarily track my browsing habits in order to serve ads, I'll continue using a tracker blocker like uBlock Origin with the sad side-effect that the ads disappear from the page.
yread 3y ago
Kind of ironic that it was Microsoft pushing this header and Microsoft's property LinkedIn is the first hit by it
- password4321 3y ago
  I thought Microsoft hosed things by enabling DNT by default, but apparently they changed course after 2 years back in 2015: https://blogs.microsoft.com/on-the-issues/2015/04/03/an-update-on-microsofts-approach-to-do-not-track/ https://blogs.microsoft.com/on-the-issues/2015/04/03/an-upda...
wkat4242 3y ago
Wow, this is a huge thing. It is how GDPR should have worked from the start. The end of cookiewalls and tracking forever.
Voultapher 3y ago
Finally! I've been waiting for this. This is great news, let's hope it doesn't get appealed. Imagine someone asking you if you want to have sex with them, you say no. And then asking again, and again and again. In what world does that constitute informed consent and not harassment? And don't get me started on the yes or maybe later bullshit.
iandanforth 3y ago
The other ruling in this case is a bit concerning. The judge ruled that LinkedIn can't make profiles public by default. 1. I hate that LinkedIn ever makes me log in to see a profile and 2. It's pretty much the purpose of LinkedIn to share your information publicly The idea that you have to obtain explicit consent to do what your website advertises itself to do is idiocy. If I make a website called 'publishmypii.com' is a German court going to force me to add a click through agreement that says I will publish user's PII? Total nonsense.
Mrirazak1 3y ago
we need more of this!
lisper 3y ago
I would never try to run a business that depends on tracking (I want to be able to look at myself in the mirror) but if I did I would respond to this by putting up a notice like this: "Our business depends on tracking. That's how we make our money. We cannot provide this service for free to someone who has activated do-not-track. We do offer a paid version of the service at $X per month. If you want to subscribe, click here. Otherwise, if you want to continue to use our service for free, you will have to disable DNT."
- TheCoelacanth 3y ago
  Not allowed. Under GDPR, consent for tracking must be freely given and not a condition of service.
  - lisper 3y ago
    Wow, really? That seems deeply wrong. That's effectively saying that certain classes of products have to be given away for free. I know that the EU regulatory regime is broken, but can it really be that badly broken?
    - LelouBil 3y ago
      No, certain classes of products don't have to be given away for free. But you can't take tracking as payment. You can still show ads without tracking, or only have paid users.
      - lisper 3y ago
        Then tracking info has to be given away for free. Your info is valuable, but you aren't allowed to trade it for something else of value, you are only allowed to "voluntarily" give it away for free. That is even more deeply wrong IMHO.
        LelouBil 3y ago
        I can't sell my organs, but I'm sure they are valuable to someone. That's the same idea.
Pesthuf 3y ago
Every time DNT comes up, advertisers are like "but, but, 15 years or so ago, Microsoft enabled it by default for a few months! Hence we can't honor it! Booyah!"
kibwen 3y ago
As long as companies can use EULAs to assume our consent implicitly (and change their terms at any time, without warning), that also means that I can send them headers alongside my HTTP request containing legal terms that they must also accept implicitly.
- LelouBil 3y ago
  > As long as companies can use EULAs to assume our consent implicitly (and change their terms at any time, without warning) Well, they can't.
mihaic 3y ago
One problem I've always seen when debating tracking was the broad scope of the word. Take for instance three examples: 1. A shopkeeper that watches his customers for shoplifting and observes their flow in the store to know where to place products. 2. An online store that tracks what products people are looking at and what carts are abandoned the most. 3. A global ad-network that gets fed most of your browsing activity across the internet and creates an advertising profile for you. Don't you agree that a difference in scale brings on a difference in kind somewhere on this axis? The way I personally see it is that what a user does on your website is fine to observe, but when data is being shared to third parties is must explicitly have your agreement.
- skybrian 3y ago
  Even the term “advertising profile” is a very broad statement that leaves much to the imagination. They’re not all the same. You can view and modify the ad profiles Google has for you [1] [2]. I leave it running because I’m vaguely curious what it will find. So far, the ad topics are extremely generic and not anything I worry about. [1] https://myadcenter.google.com/ https://myadcenter.google.com/ [2] chrome://settings/adPrivacy/interests (if using Chrome on desktop)
  - chefandy 3y ago
    I'm not so sure those advertising profiles are "the data" as much as a simplified representation of the data for users to manage. I don't know about Google specifically but there's no way in hell the limit of Facebook's marketing profile is what they show you in their analogous interface.
    - skybrian 3y ago
      Yes, lack of transparency and lack of trust are big problems. I'm hopeful that the ad topics code in Chromium will improve this situation somewhat. Maybe someday we will see reproducible builds for Chrome?
      - 3y ago
snappyc 3y ago
[flagged]
fossislife 3y ago
I can not wait to read Google's reasoning why they suddenly have to remove the Do Not Track feature from Google Chrome.
- preciousoo 3y ago
  “Too much engineering effort to maintain”
drcongo 3y ago
I hope this becomes global law, and I hope Safari brings back the DNT setting.
jll29 3y ago
LI = Microsoft
boringg 3y ago
I wish we could go to a world that Linkedin only existed in its infancy and not what it is now. That product has devolved into 100% spam.
dse1982 3y ago
As far as I understand it, they were not forced to respect the DNT header in their processes. They were only forbidden to claim that the DNT header would not be legally binding and therefore not respected. The court did not force LinkedIn in any way to actually respect or at least consider the DNT-header in their processes. This is how I (being a German native-speaker) understood this article by the usually very reliable heise online: https://www.heise.de/news/Do-Not-Track-LinkedIn-darf-nicht-mehr-erklaeren-Browserfunktion-zu-ignorieren-9348171.html https://www.heise.de/news/Do-Not-Track-LinkedIn-darf-nicht-m...
- wobfan 3y ago
  While that's true, the court also said, that DNT is legally binding. That's also in the article from heise that you linked, in the second to last paragraph. But you're right. It sounds like the court interpreted it that way, but anyways, the ruling is only about the claim, not about whether they respect DNT or not.
- Aachen 3y ago
  To read that article, you need to pay or "freely consent" to personalised tracking. Sometimes I wonder if the people writing for that site, who no doubt have an IP whitelist or are logged in all the time, even realise the irony anymore
- suyjuris 3y ago
  The full decision can be found here [1]. The consumer protection agency did also seek that LinkedIn be forced to respect DNT, but the court did not grant this relief, reasoning that it was overly broad in two ways. First, it did not specify precisely enough what is meant by DNT — in particular, the suit did not limit itself to the DNT header, but referred to any kind of configured signals sent by the browser. Second, it described the behaviour that LinkedIn is supposed to cease when encountering such a signal in an overly broad manner. If upheld, the judgement certainly seems to open the door for future litigation, and one might even hope for potential targets to adjust their behaviour in anticipation of it, but I would not hold my breath there. [1] https://www.vzbv.de/sites/default/files/2023-10/23-10-10_Stn_vzbv_HKNRV_Gas_W%C3%A4rme_und_K%C3%A4lte_final_0.pdf https://www.vzbv.de/sites/default/files/2023-10/23-10-10_Stn...
miked85 3y ago
DNT has always seemed pointless to me, you really don't know if they are even abiding by it.
truegoric 3y ago
I wonder if that sets a precedent in terms of what type of electronic signals could be regarded as a legally binding form of agreement between two parties in EU, especially given the fact that DnT is not a standardized HTTP header.
queuebert 3y ago
That LinkedIn ignores DNT does not surprise me in the least. They also make it practically impossible to unsubscribe from their email spam without deleting your account.
udev4096 3y ago
That's a good start. I hope it becomes mandatory for websites to acknowledge "Do not track" header. Does HN acknowledge it? I'm assuming not. Because after all, it's run by YC who is a for profit organization who couldn't care less about the privacy of it's users
- jve 3y ago
  I checked with incognito - HN sets 0 cookies. When logged in I do get 4 cookies - user (technical) - _ga (Google analytics? Source doesn't include any) - ajs_anonymous_id (Dunno. Searching around brings up atlassian jira cookie...) - ph_phc_.................._posthog (PostHog?) Anyways, the site is superlean and hn.js is such a short script. I think other 3 could be related to parent site. user cookie only scoped to news.
notorandit 3y ago
LinkedIn ... Which is Microsoft, right? Good luck, then!
matheusmoreira 3y ago
Finally! The Do Not Track header is the ultimate consent negation. It's an explicit "no". It's part of the request header which the server cannot claim ignorance of. That the web turned into this mess of consent popups despite the existence of Do Not Track is evidence of the bad faith of these corporations. They were clearly attempting to circumvent the manifest will of users. Worse: they turned it into an additional bit for tracking. So good to see legal precedent for it!
- cowl 3y ago
  it can not be the ultimate negation though because it does not provide for a way to allow specific sites and the meaning of what to not track is not defined anyway. (see https://www.eff.org/deeplinks/2011/02/what-does-track-do-not-track-mean https://www.eff.org/deeplinks/2011/02/what-does-track-do-not...) I would love for a codified way to specify this in the browser but that also makes way for the inevitable exclusions. for example taken to the extreme, compliance with the DNT means that you can not use any site that even requires a login.
  - matheusmoreira 3y ago
    > it does not provide for a way to allow specific sites That's a browser limitation. They currently implement it as a global setting. They could also allow the user to configure a whitelist of websites. The lack of that feature doesn't invalidate it though. It's not a problem. > the meaning of what to not track is not defined anyway At a minimum, it means denying consent to everything you can deny consent to. > taken to the extreme All this complication and confusion just isn't necessary in my opinion. Tracking is the collection of any information the user did not explicitly provide for any purpose other than what the user wanted. If I log into a website, I'm explicitly providing my username and password. The site didn't fingerprint me and automatically log me in based on that unique identifier, I did it myself. If I give a store my address so it can ship an order to me, I'm the one providing that information and only for that exact purpose. I certainly don't expect the store to sell my address to some marketing company which then starts spamming my physical inbox with advertisement garbage. These corporations need to learn to do exactly what's asked of them and nothing else. We don't want them exploiting the information we trusted them with for unknown purposes. This is the spirit of the GDPR: inform users of the data you collect and what it's used for, and anything not absolutely essential to the transaction may be denied. It is obvious to me that a Do Not Track header represents that blanket denial of any non-essential data collection and processing.
ern 3y ago
This is your regular reminder that anyone can create a LinkedIn account and see your profile, regardless of your privacy settings.
temptemptemp111 3y ago
[dead]
neycoda 3y ago
Good, sites that ignore it should be legally punished. You can't make money without it? You have a crap business model that relies on exploitation.
1vuio0pswjnm7 3y ago
In the past, commenters on HN would claim that use of DNT is somehow a privacy loss because the presence of the header would make a fingerprint more unique, or something to that effect. Wonder if they will continue to make this ridiculous argument now.
amai 3y ago
From GDPR, article 21, paragraph 5 „ the data subject may exercise his or her right to object by automated means using technical specifications. “ https://www.privacy-regulation.eu/en/article-21-right-to-object-GDPR.htm https://www.privacy-regulation.eu/en/article-21-right-to-obj... From that it seems pretty clear, that automated signals like „do not track“ are allowed and legally binding.

1216 points by isodev 3y ago

vachina 3y ago

Cool now DNT becomes another bit in user entropy to track us even better.

ezfe 3y ago
Safari actually removed DNT for this exact reason, it's no longer an option

bobmaxup 3y ago

If only this could translate to a person.

isodev 3y ago

Rough translation from German for relevant parts: "The social network LinkedIn is no longer allowed to announce on its website that it does not respond to "do-not-track" signals with which users object to the tracking of their surfing behavior via browser settings. This was decided by the Berlin Regional Court after a lawsuit by the Verbraucherzentrale Bundesverband (vzbv). The court also prohibited the company from setting a preset, according to which the member's profile is also visible on other websites and applications." ... "If consumers activate the "Do Not Track" function of their browser, this is a clear message: They do not want their surfing behaviour to be spied on for advertising and other purposes," says Rosemarie Rodden, legal lecturer at vzbv. "Website operators must respect this signal." ... "The District Court of Berlin agreed with the opinion of the vzbv that the company's communication was misleading. It suggests that the use of the DNT signal was legally irrelevant and that the defendant does not have to pay attention to such a signal. That's not true. According to the General Data Protection Regulation, the right to object to the processing of personal data can also be exercised by automated procedures. A DNT signal is an effective contradiction."

extraduder_ire 3y ago

Would this include browsers which have the DNT header enabled by default? I remember early edge/late internet explorer defaulting to sending the header, and claimed as much in advertising. The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled.

jacquesm 3y ago
Courts are not necessarily bound by such a spec, but it doesn't look as if that question was addressed here and in my view it would have to be established by another case because for sure the companies that ignore do not track right now will be more than happy to pretend that they have an excuse to continue to do so. This is a long drawn out rearguard fight.
amelius 3y ago
> The spec itself (at the time, at least) said that it could be ignored if the header was always sent/not user-enabled. Why?
- noirscape 3y ago
  IIRC the people who wrote the spec did it in co-operation with the larger ad networks and this was the only way they could get the ad networks to comply with it. Then Microsoft enabled it by default in Explorer 10 and the ad networks took it as carte blanche to ignore the DNT header forever, claiming Microsoft had violated the agreement. Nowadays it's usually not set even by the overly privacy conscious out of fingerprinting concerns, since its another unique way to identify your traffic.
  - wkat4242 3y ago
    What didn't help was that the EFF was actively campaigning against it instead of lobbying to elevate the flag to legal status so it would become useful. The same way they campaigned against adblockers but had their own petty little voluntary pledge thing. That's what you get when your NGO gets so big your leaders end up playing on the same golf courses and waiting in the same netjets lounges as the enemy.

amelius 3y ago

"your browser has do not track enabled and therefore we cannot serve you this content"

isodev 3y ago
As someone who lives in the EU, I see this very often with US based websites - the ones that absolutely need the tracking cookies and the data suckage.
- m463 3y ago
  define "need"? is this "need for my business model" or "need because we can't send a package without your address"?
  - adhesive_wombat 3y ago
    EU law makes that distinction, as I understand it. If the cookie is absolutely required to do something the user explicitly (not implicitly) requested, then you don't need consent. If you can get the user to explicitly request your business model including the use of these specific cookies then you're good to go.
  - resonious 3y ago
    I think a lot of it is really just pure incompetence. Some product person was just like "we need analytics" and so a dev just put it in. Probably neither party put any thought into it. The product person was trained to want analytics and the dev just does what they're told.
- mrweasel 3y ago
  For the longest time I noticed that many of those websites, typically small-town newspapers, all ran the same CMS, developed by a former employer of mine. Part of the problem, at least back then, could have been that the CMS simply didn't have the ability to disable the tracking cookie based on visitor settings, and development had pretty much stopped years earlier.

jauntywundrkind 3y ago

That would be a major upheaval. This one feels legit; DNT has been around (and ignored by everyone) for a long long time. But the summary here is saying, oh, the consumer signalled something so sites have to obey. It feels like fools could make up all kinds of arbitrary signalling systems packaging all manners of data handling directives to sites. So, what if any limits does the court see or allow? If DNT is something sites have to obey, what's something sites wouldn't have to obey? And how do sites become aware of all the different mechanized ways consumers might send processing directives to them?

krageon 3y ago
This legal proceeding is about do not track. It is not about anything else which you're pulling in. This is an appeal to ridicule and these are generally not very interesting.
fxtentacle 3y ago
I'd say website should be required to honour any signal that more than 1 mio potential users know about. That seems like a fair trade-off between pushing work onto companies while simultaneously closing laziness as a loophole.
wirrbel 3y ago
I assume you are asking in good faith. I could configure my browser to add some custom headers to my HTTP requests, like `DONTDOTHISTHINGTHATISIMPORTANTTOME` or something. I don't think courts would accept that, as it's not an established interface / protocol, and furthermore GDPR does in fact allow for data-processing if it's needed / required to offer the service. By providing an interface standard, however, the browser vendors have kind of set the stage for the courts accepting DNT as a valid communication medium for the service consumer to state intent to the service provider. This is akin to the courts taking into account how the card-payment terminal works when ruling on matters of card-payment in stores, etc.
- nvm0n2 3y ago
  You don't think courts would accept that, but you don't know, because EU privacy law is so vague and badly written that the courts regularly "discover" new things about it that nobody had previously considered possible. For example the fact that everyone had a right to remove stuff from search engines if it was about yourself was never written into law by any elected body or even any non-elected body. It was a right that a court simply invented. Ditto for not being able to use Google Fonts. The EU has had problems with this kind of activist lawmaking for a long time. It's one of the factors behind Brexit. Some Leave campaigners argued that it was impossible to make any kind of deal or compromise with the EU if it meant staying in, because no matter how clearly written it appeared to be and no matter how watertight the international treaty encoding it was, the European courts would simply ignore it and/or rule it invalid. This criticism landed because there was precedent for that, where the courts had previously done exactly the same thing with other agreements. The same debate is now playing out around the ECHR as well, which the UK stayed in because it's not technically an EU court, just a European court. Same cultural issues though.

mschild 3y ago

Excellent decision. But with most things GDPR, enforcement is key. I doubt any other website will actually change their behavior because of this. There's a single website that I have encountered that publicly respects Do Not Track: Geizhals.de No other website, that I know of at least, actually checks this.

isodev 3y ago
I hope tech companies see this as an incentive to get rid of the cookie prompts - a DNT clearly means "reject all tracking and non-essential cookies".
- mschild 3y ago
  I do too, but I doubt it. They have shown plenty of times theyll fight it as much as they can.
- romanovcode 3y ago
  It would be nice if DNT = deny all except mandatory. So browser would have one pop-up after installation and no more banners on websites. One could dream.
jacquesm 3y ago
This ruling opens up the door to enforcement, it is general enough that German companies and companies active in Germany will take notice and it might inspire other EU countries to follow suit.
dantyti 3y ago
The company I'm currently at has changed its behavior after court/regulatory decisions regarding google analytics. We are now using a cookieless solution that respects DNT. I have no doubt that this would not have happened otherwise. Still sad that our legal counsel didn't like the idea of self hosting web analytics (since then we'd become a data processor).
- arlcode 3y ago

myspy 3y ago

I still don't get why websites are not able to find in-house ad solutions that are not provided by third parties. Major sites look like shit due to ads placed without thought or care. This should be handled like magazine or newspaper ads. People selecting and placing them in the page with care. Would result in a better experience and wouldn't require any tracking. I think that tracking to get "good ads" is a wish that never came true and it needs people with taste to choose products people would like to buy.

jacquesm 3y ago
That's because of the silo formation in the advertising market. Agencies want to have an easy time to spend a large budget and they don't want to negotiate individually with thousands of parties. So they do a bulk buy from some large provider which then provides a centralized way to return the statistics. These serve to - somewhat - keep property owners honest because both click fraud and placement fraud would probably be rampant. Not every kind of advertising is that suspect to fraud but for every budget out there there is some way to siphon it off without giving the advertiser what they were looking for. It's been an arms race between fraudsters and marketeers with the end-users caught in the middle, and between the marketeers and the users with respect to privacy issues. This ruling injects some sanity for those that have declared themselves to be non-combatants.
- hanniabu 3y ago
  Youtubers get paid way more for custom in-video ads than they do for the automated ads that Youtube runs before and throughout their videos. If what you said was true then content creators wouldn't be going through the work getting these sponsors and sponsors wouldn't be bothering with the hassle of working with individual content creators.
  - jacquesm 3y ago
    some youtubers. But compared to overall ad spend on the internet that's a rounding error.

jacquesm 3y ago

Excellent news. Now let's see this taken up by the EU courts as well if they are challenged on this. But my guess is that the advertising world would rather do this on a country-by-country basis rather than to risk losing in all of the EU at once.

arlcode 3y ago
you can go only up so far the country court chain before you either lose or EU courts get involved. If this goes to the Federal Court (BGH) in Germany they will "ask" the European Court of Justice for their interpretation of the applicable Union law (in this case the GDPR) and other national courts will take this precedent into account. If LinkedIn does not appeal they will be required to follow the ruling. Even in this case it's not uncommon that national courts will look across the border.
reddalo 3y ago
I'd love if this became a EU-wide law. If you send the DNT header, then you can't get cookie consent alerts since you already do not consent being tracked.
- nvm0n2 3y ago
  Alternative reading: if mechanized expression of consent is now possible, then if you send a different header "Tracking-OK: True" all the cookie consent banners should now disappear. It could be a great thing. 99%+ of all people would quickly learn to opt in to tracking to get rid of the annoying popups.
  - la_oveja 3y ago
    Or to apt out.
  - dns_snek 3y ago
    That's an impossible reading, tracking requires informed consent. Blanket "do whatever" consent can never be informed. Besides, if you gave users a free choice, as intended by the law, no one would consent to it.

baz00 3y ago

It will be funny watching the entire planet continue to ignore this. Edit: to clarify, a specification based on asking for something is a recipe for everyone to ignore you. It's a design flaw. And if they fix that with a legal patch then it will just be moved out of the jurisdiction that the legal patch applies to.

esarbe 3y ago
It's just the same as "Keine Werbung" stickers on German letter boxes; you can ignore it, but it will get you fined. Most large companies would like to continue making business in Germany, so I expect this to have some impact.
literalAardvark 3y ago
There is no jurisdiction that the legal patch doesn't apply to. If you allow any citizens of the EU you're forced to fully comply with the gdpr or face legal action. It's illegal to cherry pick. You can require a checkbox with "I'm not a citizen of the EU and I'm not in the EU at the moment" to sign up, but that's going to cost you. If anything, a technological solution would be inferior. We're a rule of law world these days, not a motte and bailey world, and that's benefitted everyone except the moat diggers.
- tick_tock_tick 3y ago
  I think they are calling out how no one besides the really big multination's actually cares what the EU does and will just continue to ignore whatever rulings they make. Enforcement is always the biggest issue with these kind of laws and the EU has been taking a slow approach so people barely care.
  - Barrin92 3y ago
    >how no one besides the really big multination's actually cares the big multinationals are (by definition) the companies that predominantly serve the European market so the gains for the consumer and liability for the companies go hand in hand. Sure the Oklahoma Gazette isn't going to care but like three Europeans visit their homepage every ten years so it's not like it matters much in the first place. The actors you want to discipline are, like in this case, LinkedIn, Meta, Google, what have you. The sites that account for the overwhelming majority of traffic.

dalbasal 3y ago

Most of the pseudo-contract BS that defines consumer-company relations is trash legal theory. It should have never held water in the first place. The fact that our legal systems have tolerated and supported it, mostly demonstrates how intellectually weak the legal profession's philosophy and ethic is. Companies, especially interacting digitally, use TCs, EULAs and other such nonsense like an incantation. Those are not agreements. They are stupid little rituals that strip users/consumers/whoever of all rights. Any right that can be stripped by TCs... doesn't exist. The whole concept of "by agreement" in these circumstances is bogus but... If it must be this way... Stack the deck in the other direction. "By serving this browser a webpage, you agree to the following..." By dripping a cookie, by recording this person's data. Pro user, pseudo-legal defaults. Make "you must agree to X, before you use the product you bought" invalid. Give consumers the full right to unlimited time refunds, if divulging data or agreeing to terms (old or new) is a condition for using the product This ridiculous deck can be stacked either way. If I have to agree to a coercive contract intended not to be read, in order to use a device... Give me the right to say no and get a full refund at any time. At least invalidate the agreement. Where TF are our judges, judicial philosophies, law professors? I want to ask "How could they let this happen' but the correct question might be "Why did they do this to us."

expertentipp 3y ago
> Where TF are our judges, judicial philosophies, law professors? They are writing law in MS Word and negotiating any changes in law by sending paragraphs over email, which they check once a day at most.
- Muromec 3y ago
  Checking email only once a day is a new privilege. Like long fancy sleeves were in the time before.
- augustk 3y ago
  Eben Moglen is a unicorn.
- dalbasal 3y ago

charcircuit 3y ago

Sites can still ask you if you consent to overwrite this, so it is no different than what already exists.

expertentipp 3y ago

Do Not Track is a silly nuance in Germany because the IP address is fully identifying there and the ISP contract owner takes full responsibility for anything happening behind it. Nothing to be excited about legal trolls burning public money on fighting LinkedIn in courts. XING is not going to happen, stop trying. Every "privacy" fart coming out of Germany is their predatory media publishers and copyright trolls unable to accept that internet exists.

snordgren 3y ago
The good news is that over 10 million largely tech illiterate Germans over the age of 55 will retire in the next decade. Not only will the Germany of the 2030s be less technophobic, it will be significantly less relevant in the EU and on the global stage. And by and large, Europeans won’t miss their stewardship.
throwaway447 3y ago
Trust me, I could not care less about the German boneheads. But you are right, as always, the judge has little understanding how tracking works. I have a heavily modified web surfing browser that offers me some amount of privacy and ad free experience. Pay walls I circumvent with "Pass paywalls clean" or with a bookmarklet that looks up the site on an archive. In the end, it makes it harder for an average website to track me but not impossible. Dont believe me? Try this website: https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint By the way, ghostery, the ad blocking software, is (was?) owned by a German media company. Hubert Burda Media. You can't make this stuff up. And no, you should not use it.
rsynnott 3y ago
> Do Not Track is a silly nuance in Germany because the IP address is fully identifying there I flatly do not believe that CGNAT is not used in Germany. Do you have a reference for this? > the ISP contract owner takes full responsibility for anything happening behind it What's that got to do with anything? The issue here is the bad behaviour of the website, not the client.
- 3y ago

agilob 3y ago

Does it set a precedent that I can send a header "do-not-show-ads" and they can't send me ads?

dist-epoch 3y ago
Tracking is considered a negative action, so there are stronger protections around that. It's not a crime to put an advertising truck outside a house, but it can be to put a (private company) surveillance truck.
Rygian 3y ago
I've been having the same thoughts. Pragmatically, the main roadblock is that the DNSA flag would need to go through some legitimate standardization process. It would be really fun* if the headers of an HTTP request were to be considered part of a legally binding agreement between client and server. *In a "mentally deranged fun" sense, of course.
JanSt 3y ago
No, ads are okay in terms of GDPR. The tracking requires consent.
- agilob 3y ago
  Ads are highly regulated in the EU and individually in member countries. Eg. in Poland it's illegal to show ads using TV shows for children, the ads before and after a show have to be child safe, eg. no medications. Yet same rules don't apply to YouTube or Facebook. Why wouldn't I indicate using a header that this device is used by a child and ads must be appropriate?
  - gpderetta 3y ago
    Standardizing a "child-safe-content-only" flag would be definitely appropriate.
    - hnbad 3y ago

pptr 3y ago

How is DNT different from simply not giving consent in this case?

reddalo 3y ago
In other words: why is it legal to show me annoying cookie consent banners if I already chose to send a Do Not Track header? Asking again for consent after being rejected is forbidden.
- eilefsen 3y ago
  Exactly, any form of consent requires respecting "No" as a final answer. After that, consent is opt-in.
- bobmaxup 3y ago
  Yeah, many articles and people here raising this point in 2017-2018
openplatypus 3y ago
It is just legalise. There was always a problem in defining what DNT actually means and what it implies. Just check how confusing and ambiguous the whole header is across various references https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...

okr 3y ago

Nice! So announcing "Keine Werbung" on my letter box becomes now also a legal binding? I also wonder about all the announcement on t-shirts. Hmm.

throwbadubadu 3y ago
It always has been already for a long time.. (a "Keine Werbung" sticker is enough to indicate you don't want it)?! https://dejure.org/gesetze/UWG/7.html https://dejure.org/gesetze/UWG/7.html Sure, theory and practice and sueing offenders are all different things, however most obey that here I'd say?
- worklaptopacct 3y ago
  In practice, "Keine Werbung" means "No advertisements except for moving services". These are the only ones that don't give a shit.
  - tommiegannert 3y ago
    Outside Zürich, I see small-time car dealers, small-time precious metals dealers, delivered pizza and kebab from neighboring villages. Perhaps advertisement is only something big companies do? /s
  - mr_mitm 3y ago
    In my experience, it's food delivery services.
  - nicbou 3y ago
    I wonder if there is a way to make them give a shit. A pizza place in my area is a serial offender, and I'm wondering if an Abmahnung and the threat of a fine would get them to stop.
isodev 3y ago
It should … the “no ads” mailbox stickers are legally binding in Belgium. In fact, you can’t send mail spam to people without opt-in consent.

openplatypus 3y ago

If you use Wide Angle Analytics, you get DNT support enabled by default :) https://wideangle.co/documentation/data-do-not-track-handling https://wideangle.co/documentation/data-do-not-track-handlin... (but you can disable it if it does not apply to your situation)

reddalo 3y ago

Please: let's get rid of cookie banners. Force websites not to show cookie consent banners if I already chose not to be tracked by enabling the Do Not Track (DNT) header.

dspillett 3y ago
The danger there is that people who consider adding a second check for “legitimate interest” (otherwise known as “we see your preference, but fuck you and your preferences we want to anyway”) to be valid will consider that their legitimate interest pushes the tracking into required-cookies territory so not covered by DNT.
- hnbad 3y ago
  There's no such thing as "consenting to legitimate interest" in the GDPR. Those are two different mechanisms. Legitimate interest does not require consent. If it requires consent or can simply be opted out to, it's not legitimate interest and therefore requires consent. Those two-stage "legitimate interest" opt-out toggles are pseudo-legal nonsense dreamt up by (mostly non-EU?) companies trying to shoehorn their business model into the new legislation, just like the "consent pop-ups" that don't provide a single-click "disagree with all". Those are actually explicitly forbidden by the ePrivacy directive btw: there must be a first-level "disagree with all" button and it must be as visible as the "accept all" button if there is one. I actually see nothing in this ruling about DNT that makes DNT do anything that isn't already the default under the GDPR. As far as I can tell, the ruling just supported the claim that LinkedIn was demonstrating deliberate intent in its violation of the GDPR by saying it does not consider DNT to be relevant. It was likely already violating the GDPR based on what the article describes, this just establishes a justification to issue a serious fine rather than just a warning.
- glitchcrab 3y ago
  'legitimate interest' is such a load of horseshit. I will go out of my way to reject those too purely on principal.

looopTools 3y ago

I think this is really, really good. I hope other European countries follows suite

Kwastie 3y ago
I am not sure this is even required. A (German) legal court order could also be used across the EU as a case law.
- rambambram 3y ago
  Care to explain? In my legal career - which is now years behind me - I've never heard of, say, a Dutch court picking case law from Germany and make it applicable to a Dutch case.
  - K5EiS 3y ago
    Not sure if this is applicable, but it looks like it may be possible? https://commission.europa.eu/law/cross-border-cases/judicial-cooperation/types-judicial-cooperation/mutual-recognition-judgments_en https://commission.europa.eu/law/cross-border-cases/judicial...
    - 1116574 3y ago
      This talks about foreign countries applying & enforcing your countries court orders (within EU). I don't think it can be stretched to include case law in your new case. You could try that in court since the base gdpr is the same, but EU law implementations still differ.
  - HelloNurse 3y ago
    GDPR is a different law per country, not one law for the whole Union. A lawyer could argue that the law in their country is supposed to work like the law of another country because both are GDPR, not directly appeal to the authority of a foreign court.
    - 3y ago

frereubu 3y ago

This is fantastic, and I hope it stands up on the presumably inevitable appeal. It's the most obvious way of eventually getting rid of per-site cookie notices - make DNT legally enforceable and cookie notices become irrelevant for people who have it switched on. I run an agency that builds websites for non-profits and we respect DNT by not tracking and not even displaying the cookie notice. The only thing I've wondered about is whether we show a one-off notice saying "we note your DNT setting and we've disabled tracking" just because I wonder if users become suspicious that we're tracking them by default if they don't see a cookie notice!

mdiesel 3y ago
It's a sad state of affairs that if I saw that message I would think positively of the website... Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor
- littlestymaar 3y ago
  As long as you use the cookie for nothing else, this counts as a technical cookie that's allowed by GDPR.
  - M2Ys4U 3y ago
    This is nothing to do with the GDPR. It's the ePrivacy Directive that deals with cookies.
- louis-lau 3y ago
  That's not really what anyone means when they say tracking...
  - youngtaff 3y ago
    The recent case against Criteo in the Netherlands has some interesting definitions of cookie types: This case revolves around (third party) tracking cookies. The Dutch Data Protection Authority (AP) defines 2 cookies as follows: “Cookies are small files that a website owner places on a visitor’s device. For example on a computer, laptop, smartphone or tablet. For example, the owner can collect or store information about the website visit or about (the device of) the visitor. Bottom of form There are 3 types of cookies: - functional cookies; - analytical cookies; - tracking cookies.” The AP says about tracking cookies 3 : “If cookies can also be read when you visit another website, we call these tracking cookies. These cookies allow organizations to track people’s internet behavior over time. Tracking cookies make it possible to draw up profiles of people ( profiling ) and treat them differently. Tracking cookies usually process personal data. Personal interests can be derived from the information about visited websites. This allows organizations to, for example, show their website visitors targeted advertisements. (…) Do you process personal data of visitors to your website with tracking cookies? Then you must comply with the rules of the General Data Protection Regulation (GDPR).” https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp&_x_tr_hist=true#!/details?id=ECLI:NL:RBAMS:2023:6530 https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=a...

n_ary 3y ago

This is an excellent step towards more control for consumers/users. Next step should be DNT disable all cookie popups and assume that only essential cookies are acceptable. Speaking of, I am expecting DNT to reset to disabled silently on next release of chrome. So people forget about it and tracking is allowed.

guywhocodes 3y ago

If this is the direction things are going sadly I think it will be norm to just not serve anything if you have it on.

tjpnz 3y ago
Or tech will have to find a way to make money which doesn't involve stalking their users.
bobmaxup 3y ago
Sadly? For whomever is monetizing the data, possibly. I doubt anyone else will care (outside of secondary+ effects).
- guywhocodes 3y ago
  Yes it's sad if DNT becomes useless because you can't access the web with it.
aembleton 3y ago
I think that would go against the GDPR.
- guywhocodes 3y ago
  There are already companies that do not serve EU because of GDPR...

joelthelion 3y ago

Are they allowed not to serve you if you have DNT enabled?

Xelbair 3y ago
Of course not. That's the point of GDPR.
- 9dev 3y ago
  Not true. Every business has freedom to choose its customers. Nobody can force you to service them for free, and nobody can force you to serve your website without tracking enabled if that drives your revenue. However, you’ll have to live with the consequences. Maybe it’s time to reduce reliance on tracking after all?
  - markus92 3y ago
    GDPR does not allow for negative consequences for refusing consent - it must be freely given and if there is a negative consequence it is not considered to be given freely.
  - kuschku 3y ago
    There are many protected categories. You cannot discriminate based on race, for example. A major point of GDPR is that it basically made "do you agree to tracking? yes/no" a protected category as well. Specifically, it requires freely given consent to allow tracking. Freely given consent is defined by the GDPR as consent that was given without any discrimination, rejection of service, or extortion in any way influencing your choice. So no, you absolutely cannot discriminate based on whether users agreed to tracking or not.
  - hnbad 3y ago
    Yes true. If the service can be provided without collecting and processing certain data you can not coerce the user to "consent" to you doing so in order to access your service. E.g. the good old growth hack of collecting newsletter subscriptions by email-gating a "free e-book" behind a newsletter signup form. There does seem to be a loophole for enforcing tracking ads as "legitimate interest" (i.e. not seeking consent) if you also offer a paid subscription without them, which is what a lot of German news sites seem to have shifted to. There was a recent court case in Germany however because a company got sued for not providing an option to not consent to everything that wasn't related to ads (e.g. analytics, third-party widgets and so on) and most sites seem to now provide granular controls even when they force ads if you don't want to pay. Note that they still have to lazy load the ads after consent is given in order to be compliant. I'm not sure if this way of forcing ads is compliant throughout the EU as it feels more of a gray area given that the site usually sends the full article and then gates it behind a consent modal on the client, i.e. there's no technical requirement to show the ads, just a sustainability one.

buro9 3y ago

This is definitely how the Cookie prompts should be eradicated... if the browser indicates DNT, then don't try and track via cookies.

botanical 3y ago

I see no one's commented on Global Privacy Control. It's essentially an HTTP header that's supposed to be legally binding with the California Consumer Protection Act (CCPA); unlike DNT. There's a setting on Firefox (Beta at least) that enables it. See: https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ https://global-privacy-control.glitch.me/ https://global-privacy-control.glitch.me/ https://privacycg.github.io/gpc-spec/ https://privacycg.github.io/gpc-spec/

fmajid 3y ago
GPC is already the law in California, but it seems the EU has yet to catch up, possibly because of how enforcement failed by being delegated to national DPAs, some of which like the Irish ones are clearly captured by the surveillance-industrial complex. https://www.huntonprivacyblog.com/2021/07/15/california-attorney-general-updates-ccpa-faqs-indicating-mandatory-compliance-with-global-privacy-control/ https://www.huntonprivacyblog.com/2021/07/15/california-atto...
- LelouBil 3y ago
  Yeah, that's the unfortunate part of the GDPR. Enforcement is very slow.
  - fmajid 3y ago
    The EU learned its lesson. DSA and DMA enforcement is not left to national authorities. The Irish DPC clearly thinks it is a subsidiary of the IDA, the agency charged with attracting multinational headquarters to Ireland.

d3w4s9 3y ago

Completely irrelevant... Will they recognize robots.txt as a legal contract?

jakub_g 3y ago

When GDPR took effect in Europe, a bunch of (mostly US) websites started serving "451 Unavailable For Legal Reasons" responses [1] to EU users. I wonder if there'll be another spike after this announcement. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/451 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/451

deleted 3y ago

[deleted]

TheFuzzball 3y ago

A potentially interesting aside is that Do Not Track was removed from Safari some time ago. Why? Because nobody respected it, and since it was a user setting that needed to be explicitly enabled, it proved to be a useful additional dimension for browser fingerprinting. So the irony is that, "do not track" ended up being used... to track.

GorkaE 3y ago

Little by little, news is coming in that makes me more optimistic about privacy on the Internet. 1.-Users/associations denounce more in court. 2.-Large corporations receive more convictions against them. 3.-Lawmakers legislate more on this issue. GDPR, CCPA, LGPD, PIPEDA,... 4.-Small/medium companies are taking note and are taking steps towards greater privacy for their customers, if only to differentiate themselves in some way. Maybe I am too naive

qwertox 3y ago

I'd have zero problems with ads embedded in the page where the topic is inferred from the content of the page. But as long as these companies unneccessarily track my browsing habits in order to serve ads, I'll continue using a tracker blocker like uBlock Origin with the sad side-effect that the ads disappear from the page.

yread 3y ago

Kind of ironic that it was Microsoft pushing this header and Microsoft's property LinkedIn is the first hit by it

password4321 3y ago
I thought Microsoft hosed things by enabling DNT by default, but apparently they changed course after 2 years back in 2015: https://blogs.microsoft.com/on-the-issues/2015/04/03/an-update-on-microsofts-approach-to-do-not-track/ https://blogs.microsoft.com/on-the-issues/2015/04/03/an-upda...

wkat4242 3y ago

Wow, this is a huge thing. It is how GDPR should have worked from the start. The end of cookiewalls and tracking forever.

Voultapher 3y ago

Finally! I've been waiting for this. This is great news, let's hope it doesn't get appealed. Imagine someone asking you if you want to have sex with them, you say no. And then asking again, and again and again. In what world does that constitute informed consent and not harassment? And don't get me started on the yes or maybe later bullshit.

iandanforth 3y ago

The other ruling in this case is a bit concerning. The judge ruled that LinkedIn can't make profiles public by default. 1. I hate that LinkedIn ever makes me log in to see a profile and 2. It's pretty much the purpose of LinkedIn to share your information publicly The idea that you have to obtain explicit consent to do what your website advertises itself to do is idiocy. If I make a website called 'publishmypii.com' is a German court going to force me to add a click through agreement that says I will publish user's PII? Total nonsense.

Mrirazak1 3y ago

we need more of this!

lisper 3y ago

I would never try to run a business that depends on tracking (I want to be able to look at myself in the mirror) but if I did I would respond to this by putting up a notice like this: "Our business depends on tracking. That's how we make our money. We cannot provide this service for free to someone who has activated do-not-track. We do offer a paid version of the service at $X per month. If you want to subscribe, click here. Otherwise, if you want to continue to use our service for free, you will have to disable DNT."

TheCoelacanth 3y ago
Not allowed. Under GDPR, consent for tracking must be freely given and not a condition of service.
- lisper 3y ago
  Wow, really? That seems deeply wrong. That's effectively saying that certain classes of products have to be given away for free. I know that the EU regulatory regime is broken, but can it really be that badly broken?
  - LelouBil 3y ago
    No, certain classes of products don't have to be given away for free. But you can't take tracking as payment. You can still show ads without tracking, or only have paid users.
    - lisper 3y ago
      Then tracking info has to be given away for free. Your info is valuable, but you aren't allowed to trade it for something else of value, you are only allowed to "voluntarily" give it away for free. That is even more deeply wrong IMHO.
      - LelouBil 3y ago
        I can't sell my organs, but I'm sure they are valuable to someone. That's the same idea.

Pesthuf 3y ago

Every time DNT comes up, advertisers are like "but, but, 15 years or so ago, Microsoft enabled it by default for a few months! Hence we can't honor it! Booyah!"

kibwen 3y ago

As long as companies can use EULAs to assume our consent implicitly (and change their terms at any time, without warning), that also means that I can send them headers alongside my HTTP request containing legal terms that they must also accept implicitly.

LelouBil 3y ago
> As long as companies can use EULAs to assume our consent implicitly (and change their terms at any time, without warning) Well, they can't.

mihaic 3y ago

One problem I've always seen when debating tracking was the broad scope of the word. Take for instance three examples: 1. A shopkeeper that watches his customers for shoplifting and observes their flow in the store to know where to place products. 2. An online store that tracks what products people are looking at and what carts are abandoned the most. 3. A global ad-network that gets fed most of your browsing activity across the internet and creates an advertising profile for you. Don't you agree that a difference in scale brings on a difference in kind somewhere on this axis? The way I personally see it is that what a user does on your website is fine to observe, but when data is being shared to third parties is must explicitly have your agreement.

skybrian 3y ago
Even the term “advertising profile” is a very broad statement that leaves much to the imagination. They’re not all the same. You can view and modify the ad profiles Google has for you [1] [2]. I leave it running because I’m vaguely curious what it will find. So far, the ad topics are extremely generic and not anything I worry about. [1] https://myadcenter.google.com/ https://myadcenter.google.com/ [2] chrome://settings/adPrivacy/interests (if using Chrome on desktop)
- chefandy 3y ago
  I'm not so sure those advertising profiles are "the data" as much as a simplified representation of the data for users to manage. I don't know about Google specifically but there's no way in hell the limit of Facebook's marketing profile is what they show you in their analogous interface.
  - skybrian 3y ago
    Yes, lack of transparency and lack of trust are big problems. I'm hopeful that the ad topics code in Chromium will improve this situation somewhat. Maybe someday we will see reproducible builds for Chrome?
    - 3y ago

snappyc 3y ago

[flagged]

fossislife 3y ago

I can not wait to read Google's reasoning why they suddenly have to remove the Do Not Track feature from Google Chrome.

preciousoo 3y ago
“Too much engineering effort to maintain”

drcongo 3y ago

I hope this becomes global law, and I hope Safari brings back the DNT setting.

jll29 3y ago

LI = Microsoft

boringg 3y ago

I wish we could go to a world that Linkedin only existed in its infancy and not what it is now. That product has devolved into 100% spam.

dse1982 3y ago

As far as I understand it, they were not forced to respect the DNT header in their processes. They were only forbidden to claim that the DNT header would not be legally binding and therefore not respected. The court did not force LinkedIn in any way to actually respect or at least consider the DNT-header in their processes. This is how I (being a German native-speaker) understood this article by the usually very reliable heise online: https://www.heise.de/news/Do-Not-Track-LinkedIn-darf-nicht-mehr-erklaeren-Browserfunktion-zu-ignorieren-9348171.html https://www.heise.de/news/Do-Not-Track-LinkedIn-darf-nicht-m...

wobfan 3y ago
While that's true, the court also said, that DNT is legally binding. That's also in the article from heise that you linked, in the second to last paragraph. But you're right. It sounds like the court interpreted it that way, but anyways, the ruling is only about the claim, not about whether they respect DNT or not.
Aachen 3y ago
To read that article, you need to pay or "freely consent" to personalised tracking. Sometimes I wonder if the people writing for that site, who no doubt have an IP whitelist or are logged in all the time, even realise the irony anymore
suyjuris 3y ago
The full decision can be found here [1]. The consumer protection agency did also seek that LinkedIn be forced to respect DNT, but the court did not grant this relief, reasoning that it was overly broad in two ways. First, it did not specify precisely enough what is meant by DNT — in particular, the suit did not limit itself to the DNT header, but referred to any kind of configured signals sent by the browser. Second, it described the behaviour that LinkedIn is supposed to cease when encountering such a signal in an overly broad manner. If upheld, the judgement certainly seems to open the door for future litigation, and one might even hope for potential targets to adjust their behaviour in anticipation of it, but I would not hold my breath there. [1] https://www.vzbv.de/sites/default/files/2023-10/23-10-10_Stn_vzbv_HKNRV_Gas_W%C3%A4rme_und_K%C3%A4lte_final_0.pdf https://www.vzbv.de/sites/default/files/2023-10/23-10-10_Stn...

miked85 3y ago

DNT has always seemed pointless to me, you really don't know if they are even abiding by it.

truegoric 3y ago

I wonder if that sets a precedent in terms of what type of electronic signals could be regarded as a legally binding form of agreement between two parties in EU, especially given the fact that DnT is not a standardized HTTP header.

queuebert 3y ago

That LinkedIn ignores DNT does not surprise me in the least. They also make it practically impossible to unsubscribe from their email spam without deleting your account.

udev4096 3y ago

That's a good start. I hope it becomes mandatory for websites to acknowledge "Do not track" header. Does HN acknowledge it? I'm assuming not. Because after all, it's run by YC who is a for profit organization who couldn't care less about the privacy of it's users

jve 3y ago
I checked with incognito - HN sets 0 cookies. When logged in I do get 4 cookies - user (technical) - _ga (Google analytics? Source doesn't include any) - ajs_anonymous_id (Dunno. Searching around brings up atlassian jira cookie...) - ph_phc_.................._posthog (PostHog?) Anyways, the site is superlean and hn.js is such a short script. I think other 3 could be related to parent site. user cookie only scoped to news.

notorandit 3y ago

LinkedIn ... Which is Microsoft, right? Good luck, then!

matheusmoreira 3y ago

Finally! The Do Not Track header is the ultimate consent negation. It's an explicit "no". It's part of the request header which the server cannot claim ignorance of. That the web turned into this mess of consent popups despite the existence of Do Not Track is evidence of the bad faith of these corporations. They were clearly attempting to circumvent the manifest will of users. Worse: they turned it into an additional bit for tracking. So good to see legal precedent for it!

cowl 3y ago
it can not be the ultimate negation though because it does not provide for a way to allow specific sites and the meaning of what to not track is not defined anyway. (see https://www.eff.org/deeplinks/2011/02/what-does-track-do-not-track-mean https://www.eff.org/deeplinks/2011/02/what-does-track-do-not...) I would love for a codified way to specify this in the browser but that also makes way for the inevitable exclusions. for example taken to the extreme, compliance with the DNT means that you can not use any site that even requires a login.
- matheusmoreira 3y ago
  > it does not provide for a way to allow specific sites That's a browser limitation. They currently implement it as a global setting. They could also allow the user to configure a whitelist of websites. The lack of that feature doesn't invalidate it though. It's not a problem. > the meaning of what to not track is not defined anyway At a minimum, it means denying consent to everything you can deny consent to. > taken to the extreme All this complication and confusion just isn't necessary in my opinion. Tracking is the collection of any information the user did not explicitly provide for any purpose other than what the user wanted. If I log into a website, I'm explicitly providing my username and password. The site didn't fingerprint me and automatically log me in based on that unique identifier, I did it myself. If I give a store my address so it can ship an order to me, I'm the one providing that information and only for that exact purpose. I certainly don't expect the store to sell my address to some marketing company which then starts spamming my physical inbox with advertisement garbage. These corporations need to learn to do exactly what's asked of them and nothing else. We don't want them exploiting the information we trusted them with for unknown purposes. This is the spirit of the GDPR: inform users of the data you collect and what it's used for, and anything not absolutely essential to the transaction may be denied. It is obvious to me that a Do Not Track header represents that blanket denial of any non-essential data collection and processing.

ern 3y ago

This is your regular reminder that anyone can create a LinkedIn account and see your profile, regardless of your privacy settings.

temptemptemp111 3y ago

[dead]

neycoda 3y ago

Good, sites that ignore it should be legally punished. You can't make money without it? You have a crap business model that relies on exploitation.

1vuio0pswjnm7 3y ago

In the past, commenters on HN would claim that use of DNT is somehow a privacy loss because the presence of the header would make a fingerprint more unique, or something to that effect. Wonder if they will continue to make this ridiculous argument now.

amai 3y ago

From GDPR, article 21, paragraph 5 „ the data subject may exercise his or her right to object by automated means using technical specifications. “ https://www.privacy-regulation.eu/en/article-21-right-to-object-GDPR.htm https://www.privacy-regulation.eu/en/article-21-right-to-obj... From that it seems pretty clear, that automated signals like „do not track“ are allowed and legally binding.