3 ms·

Thanks for the tip. The opt out is supposed to be as easy as the opt in, so I'd bet it crosses the line. Edit: furthermore, even after opting out, you neverth

Thanks for the tip. The opt out is supposed to be as easy as the opt in, so I'd bet it crosses the line. Edit: furthermore, even after opting out, you nevertheless "agree" that (that is to say, you cannot opt out of): Certain information (like an IP address or device capabilities) is used to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device. Match and combine data from other data sources Link different devices Identify devices based on information transmitted automatically

sokoloff 3y ago
The first of those is surely a valid technical requirement, right? (I'm not a GDPR expert, by any means.) In order to send you bits via IP, the server needs your IP address. In order to know the type of bits to send, it needs to understand the content-type, encoding, etc that your device supports.
- rendall 3y ago
  From what I understand, GDPR applies only to retention of data, and not such technical requirements. It does not require operators to inform users unless the server will be retaining the IP address.
  - sokoloff 3y ago
    In any distributed system, what "retention" means is unclear* and, in the face of that lack of clarity, a company deciding to play it safe and require consent for things that GDPR says needs consent seems reasonable. * If I put your content-type and IP address onto a queue for processing by another system, that's arguably retaining the data, even if that length of retention is typically measured in seconds. Given that, the safest thing for me to do is to require your consent for the retention of IP address and related data.
    - rendall 3y ago
      I suppose? The GDPR is very clear: if you serve European residents, you cannot collect their identifiable data without their informed consent, nor can you make consent the price of viewing your content. If you are found to do so, you are liable to huge fines. The language of the law itself is not very far from that clarity. Check it out for yourself: https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en https://commission.europa.eu/law/law-topic/data-protection/d... I find it not credible that a company would read that second part, think "My goodness that sounds awful! Out of an abundance of caution, we better include language around arcane technical edge cases!" but then go on to violate the very, very clearly stated core intent of the law regarding consent and actual data retention and brokering. So... it is confusing. Probably intentionally so. Perhaps their legal strategy would be to somehow conflate these edge cases? Try to baffle judges?

sokoloff 3y ago

The first of those is surely a valid technical requirement, right? (I'm not a GDPR expert, by any means.) In order to send you bits via IP, the server needs your IP address. In order to know the type of bits to send, it needs to understand the content-type, encoding, etc that your device supports.

rendall 3y ago
From what I understand, GDPR applies only to retention of data, and not such technical requirements. It does not require operators to inform users unless the server will be retaining the IP address.
- sokoloff 3y ago
  In any distributed system, what "retention" means is unclear* and, in the face of that lack of clarity, a company deciding to play it safe and require consent for things that GDPR says needs consent seems reasonable. * If I put your content-type and IP address onto a queue for processing by another system, that's arguably retaining the data, even if that length of retention is typically measured in seconds. Given that, the safest thing for me to do is to require your consent for the retention of IP address and related data.
  - rendall 3y ago
    I suppose? The GDPR is very clear: if you serve European residents, you cannot collect their identifiable data without their informed consent, nor can you make consent the price of viewing your content. If you are found to do so, you are liable to huge fines. The language of the law itself is not very far from that clarity. Check it out for yourself: https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en https://commission.europa.eu/law/law-topic/data-protection/d... I find it not credible that a company would read that second part, think "My goodness that sounds awful! Out of an abundance of caution, we better include language around arcane technical edge cases!" but then go on to violate the very, very clearly stated core intent of the law regarding consent and actual data retention and brokering. So... it is confusing. Probably intentionally so. Perhaps their legal strategy would be to somehow conflate these edge cases? Try to baffle judges?