4 ms·

Well, it is informative to see to just how many entities they're going to sell my data. My big question with those banners is: what the hell does "legitimate i

by mcv 3y ago

Well, it is informative to see to just how many entities they're going to sell my data. My big question with those banners is: what the hell does "legitimate interest" mean? The toggle for normal cookies is generally off by default or easy to turn off, but then there's another tab, or other toggles, listed as "legitimate interest", and it lists all the same stuff I don't want: ad personalisation, tracking, etc. What's the difference? Why do they consider that legitimate interest?

mschuster91 3y ago
That's a GDPR term. "Legitimate interest" should only be what is necessary to provide the service to the user (e.g. load balancer cookies, session cookies for logins). Everything else is abusing the term and should be reported to the responsible data protection authority.
- p_l 3y ago
  And cookies that are necessary to perform service required by end user don't require consent.
piva00 3y ago
There's a pretty comprehensive answer in the official EU's Commission Q&A section [1]. [1] https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_en https://commission.europa.eu/law/law-topic/data-protection/r...
dspillett 3y ago
> My big question with those banners is: what the hell does "legitimate interest" mean? There is a definition in the regulation, which IIRC basically amounts to a rewording of "strictly necessary". This definition does not cover what companies use it to excuse. The way the phrase is actually used, for much wider tracking, what it has come to mean is "we see your preference not to be logged and stalked for the benefit of our business plan, but fuck you and your preference we want to do it anyway". This is why the legitimate interest check boxes are often hidden in nested concertinas or other UX nightmares, to make it extra difficult to opt out of what should be an opt in. Once a body has gone this far to try engineer an accidental opt-in they are _definitely_ not to be trusted IMO. Though it is likely too late if you really care: they may have already dropped their payload & sent at least some information back to base, and will "accidentally" not remove it later or find some other excuse as to why they shouldn't.
- mcv 3y ago
  > "we see your preference not to be logged and stalked for the benefit of our business plan, but fuck you and your preference we want to do it anyway". That's certainly how I've been reading it. What I really want is for my browser to automatically block all of it. I know Firefox blocks a bunch of stuff, and ad blockers probably do too, but I have no idea how thorough they are and whether there are ways of tracking they can't block at all. There probably are. (Except login and preference cookies; those are legitimate. And only relevant for sites where I actually login and set preferences. I'm pretty sure most sites I just visit to read some article, have no reason to set any cookies at all.)

by mcv 3y ago

mschuster91 3y ago

That's a GDPR term. "Legitimate interest" should only be what is necessary to provide the service to the user (e.g. load balancer cookies, session cookies for logins). Everything else is abusing the term and should be reported to the responsible data protection authority.

p_l 3y ago
And cookies that are necessary to perform service required by end user don't require consent.

piva00 3y ago

There's a pretty comprehensive answer in the official EU's Commission Q&A section [1]. [1] https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_en https://commission.europa.eu/law/law-topic/data-protection/r...

dspillett 3y ago

> My big question with those banners is: what the hell does "legitimate interest" mean? There is a definition in the regulation, which IIRC basically amounts to a rewording of "strictly necessary". This definition does not cover what companies use it to excuse. The way the phrase is actually used, for much wider tracking, what it has come to mean is "we see your preference not to be logged and stalked for the benefit of our business plan, but fuck you and your preference we want to do it anyway". This is why the legitimate interest check boxes are often hidden in nested concertinas or other UX nightmares, to make it extra difficult to opt out of what should be an opt in. Once a body has gone this far to try engineer an accidental opt-in they are _definitely_ not to be trusted IMO. Though it is likely too late if you really care: they may have already dropped their payload & sent at least some information back to base, and will "accidentally" not remove it later or find some other excuse as to why they shouldn't.

mcv 3y ago
> "we see your preference not to be logged and stalked for the benefit of our business plan, but fuck you and your preference we want to do it anyway". That's certainly how I've been reading it. What I really want is for my browser to automatically block all of it. I know Firefox blocks a bunch of stuff, and ad blockers probably do too, but I have no idea how thorough they are and whether there are ways of tracking they can't block at all. There probably are. (Except login and preference cookies; those are legitimate. And only relevant for sites where I actually login and set preferences. I'm pretty sure most sites I just visit to read some article, have no reason to set any cookies at all.)