4 ms·

> "Privacy & Cookies: We and our 772 advertising partners store and/or access information on your device and also process personal data, like unique identifiers

> "Privacy & Cookies: We and our 772 advertising partners store and/or access information on your device and also process personal data, like unique identifiers, browsing activity, and other standard information sent by your device including your IP address..." There is no opt-out, which violates GDPR. If my data was collected on landing, I would like my data removed, please.

uxp8u61q 3y ago
Have you contacted the owners of the website to get your data removed?
- saagarjha 3y ago
  And give them more personal information?
- rendall 3y ago
  I assumed OP was the website owner. But while my request is serious and legally binding, it was somewhat rhetorical as I do not expect the owners of a site with such a data policy would really be conscientious about contacting me to sort out which data is mine and removing it.
  - eru 3y ago
    > But while my request is serious and legally binding, [...] Posting a comment on HN is somehow legally binding for a third party website whose operator likely never even heard of HN? Or what are you trying to say?
    - rendall 3y ago
      As I understand it, the request to have data removed is what's legally binding, not the format in which the user makes the request. If the site owners see it or otherwise become aware of it, they are obligated to remove my data even though it was a post on HN. Whether all of that actually happens is a different story. They could probably claim truthfully they don't know which data is mine. If I were determined, I'd contact them directly.
      - uxp8u61q 3y ago
        Don't be absurd. I'm a big proponent of GDPR but you seem to be under the impression that it's a magic spell. You seriously believe that, legally, if you post a comment on HN, you're putting an obligation on someone? I have a piece of the moon to sell you, then!
        rendall 3y ago
        That is a misapprehension of what I wrote.
    - rendall 3y ago
      Also, I threw that in there because, if the site operators were to see "I don't expect them to actually remove my data", I do not want them to interpret that as releasing them from the obligation. It does not. It's just my prediction of how things will go.
groby_b 3y ago
Yes, there is an opt out, see the fourth sentence: * Otherwise, you can get more information, customize your consent preferences, or decline consent by selecting "Learn More".* It's a dark pattern to only call it "Learn More", but I wouldn't bet it's a GDPR violation.
- rendall 3y ago
  Thanks for the tip. The opt out is supposed to be as easy as the opt in, so I'd bet it crosses the line. Edit: furthermore, even after opting out, you nevertheless "agree" that (that is to say, you cannot opt out of): Certain information (like an IP address or device capabilities) is used to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device. Match and combine data from other data sources Link different devices Identify devices based on information transmitted automatically
  - sokoloff 3y ago
    The first of those is surely a valid technical requirement, right? (I'm not a GDPR expert, by any means.) In order to send you bits via IP, the server needs your IP address. In order to know the type of bits to send, it needs to understand the content-type, encoding, etc that your device supports.
    - rendall 3y ago
      From what I understand, GDPR applies only to retention of data, and not such technical requirements. It does not require operators to inform users unless the server will be retaining the IP address.
      - sokoloff 3y ago
        In any distributed system, what "retention" means is unclear* and, in the face of that lack of clarity, a company deciding to play it safe and require consent for things that GDPR says needs consent seems reasonable. * If I put your content-type and IP address onto a queue for processing by another system, that's arguably retaining the data, even if that length of retention is typically measured in seconds. Given that, the safest thing for me to do is to require your consent for the retention of IP address and related data.
lm28469 3y ago
Just click on "disagree to all", no ?
- rendall 3y ago
  At the time i wrote that, I did not understand that was behind the "learn more" button. However, if their data retention policy is accurate, even clicking "disagree to all" means they will retain data that individually identifies their users and they exchange this data with other brokers. This is strictly against the letter and spirit of the GDPR, opening them up to the possibility of massive fines.

uxp8u61q 3y ago

Have you contacted the owners of the website to get your data removed?

saagarjha 3y ago
And give them more personal information?
rendall 3y ago
I assumed OP was the website owner. But while my request is serious and legally binding, it was somewhat rhetorical as I do not expect the owners of a site with such a data policy would really be conscientious about contacting me to sort out which data is mine and removing it.
- eru 3y ago
  > But while my request is serious and legally binding, [...] Posting a comment on HN is somehow legally binding for a third party website whose operator likely never even heard of HN? Or what are you trying to say?
  - rendall 3y ago
    As I understand it, the request to have data removed is what's legally binding, not the format in which the user makes the request. If the site owners see it or otherwise become aware of it, they are obligated to remove my data even though it was a post on HN. Whether all of that actually happens is a different story. They could probably claim truthfully they don't know which data is mine. If I were determined, I'd contact them directly.
    - uxp8u61q 3y ago
      Don't be absurd. I'm a big proponent of GDPR but you seem to be under the impression that it's a magic spell. You seriously believe that, legally, if you post a comment on HN, you're putting an obligation on someone? I have a piece of the moon to sell you, then!
      - rendall 3y ago
        That is a misapprehension of what I wrote.
  - rendall 3y ago
    Also, I threw that in there because, if the site operators were to see "I don't expect them to actually remove my data", I do not want them to interpret that as releasing them from the obligation. It does not. It's just my prediction of how things will go.

groby_b 3y ago

Yes, there is an opt out, see the fourth sentence: * Otherwise, you can get more information, customize your consent preferences, or decline consent by selecting "Learn More".* It's a dark pattern to only call it "Learn More", but I wouldn't bet it's a GDPR violation.

rendall 3y ago
Thanks for the tip. The opt out is supposed to be as easy as the opt in, so I'd bet it crosses the line. Edit: furthermore, even after opting out, you nevertheless "agree" that (that is to say, you cannot opt out of): Certain information (like an IP address or device capabilities) is used to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device. Match and combine data from other data sources Link different devices Identify devices based on information transmitted automatically
- sokoloff 3y ago
  The first of those is surely a valid technical requirement, right? (I'm not a GDPR expert, by any means.) In order to send you bits via IP, the server needs your IP address. In order to know the type of bits to send, it needs to understand the content-type, encoding, etc that your device supports.
  - rendall 3y ago
    From what I understand, GDPR applies only to retention of data, and not such technical requirements. It does not require operators to inform users unless the server will be retaining the IP address.
    - sokoloff 3y ago
      In any distributed system, what "retention" means is unclear* and, in the face of that lack of clarity, a company deciding to play it safe and require consent for things that GDPR says needs consent seems reasonable. * If I put your content-type and IP address onto a queue for processing by another system, that's arguably retaining the data, even if that length of retention is typically measured in seconds. Given that, the safest thing for me to do is to require your consent for the retention of IP address and related data.

lm28469 3y ago

Just click on "disagree to all", no ?

rendall 3y ago
At the time i wrote that, I did not understand that was behind the "learn more" button. However, if their data retention policy is accurate, even clicking "disagree to all" means they will retain data that individually identifies their users and they exchange this data with other brokers. This is strictly against the letter and spirit of the GDPR, opening them up to the possibility of massive fines.