4 ms·

(author here) I'm a fan of second-order thinking and unintended consequences, so I'm with you there. How would you frame a "don't track people without consent"

(author here) I'm a fan of second-order thinking and unintended consequences, so I'm with you there. How would you frame a "don't track people without consent" without unintended consequences? The article tries to make the point (perhaps fails), that companies do this intentionally to get the "consent" of people against their will, therefor running the tight line of breaking the law without breaking it.

gizmo 3y ago
The problems with the current law are: - no fines for non-compliance (or malicious compliance) - no legal liability for data leaks of PPI When businesses believe (correctly or incorrectly) that the benefit of tracking outweighs the cost (annoying users, regulatory noncompliance) they will do it. The fix is to make tracking too costly for businesses.
- pella 3y ago
  > - no fines for non-compliance (or malicious compliance) "The Biggest GDPR Fines of 2023" 1. Meta – €1.2 billion (Ireland) 2. Meta – €390 million (Ireland) 3. TikTok – €345 million (Ireland) 4. Criteo – €40 million (France) 5. TikTok – €14.5 million (UK) 6. Axpo Italia Spa – €10 million (Italy) 7. Tim S.p.A. – €7.6 million (Italy) 8. WhatsApp – €5.5 million (Ireland) 9. EOS Matrix – €5.5 million (Croatia) 10. Clearview AI – €5.2 million (France) "GDPR fines are designed to make non-compliance around data security a costly mistake and they can be separated into two tiers. Less severe infringements can result in a fine of €10 million or 2% of a firm’s annual revenue from the preceding financial year, depending on which amount is higher. More serious violations can result in a fine of up to €20 million or 4% of a firm’s annual revenue from the preceding year, depending on what is higher." via https://www.eqs.com/compliance-blog/biggest-gdpr-fines/ https://www.eqs.com/compliance-blog/biggest-gdpr-fines/
  - gizmo 3y ago
    Which ones of those fines were because of inappropriate use of cookie consent popups? You just copy-pasted a list of GDPR fines.
    - pella 3y ago
      > fines were because of inappropriate use of cookie consent popups? see: "8 companies that faced cookie consent fines" https://www.cookieyes.com/blog/cookie-consent-fines/ https://www.cookieyes.com/blog/cookie-consent-fines/ "In January 2023, France’s data protection watchdog, CNIL, fined TikTok €5 million ($5.4 million) for making it difficult to refuse cookies on its website. The CNIL found that TikTok manipulated consent by discouraging users from rejecting cookies. They required multiple clicks to refuse cookies, but only one click to accept them. TikTok resolved the issue by adding a “Refuse all” button to its site."
kevmo314 3y ago
Fines for data breaches is one idea? If we want to disincentivize data hoarding, the main cost to data hoarding is data breaches, so we could perhaps penalize that. This would have a different issue, specifically companies would no longer self-report data breaches, but it's just an idea. There are alternative approaches to getting to "don't track people without consent" that aren't a toothless stick by making it more expensive to track.
- falcor84 3y ago
  Here's my idea - no data collection without compensation. For example, you must pay me in advance 1 cent for the permission to access 1 byte of my personally identifiable information for the following month, whether that's stored in a cookie or in your own database or you access it via a third party (e.g. Meta). So instead of a "cookie consent" pop-up, I want a "cookie payment" pop up where the site will ask me for my payment details and say how much they'll pay me (again, in advance) for each of the options I can toggle.
- Sponge5 3y ago
  > the main cost to data hoarding is data breaches ... the main cost at the moment. I think we as a society are very close to a tracking/data tax.
mlrtime 3y ago
Probably the same way most laws end up. We see the unintended consequences, then revise the law to counter the consequences. Thus the cat/mouse game continues. An idea could be that the tracking has to be opt-in AND the webpage cannot stop critical use of the page as part of the opt-in process. Then another round of consequences.. rinse repeat...
- denton-scratch 3y ago
  > An idea could be that the tracking has to be opt-in Why would anyone opt-in? Tracking provides zero benefits to the site visitor.
  - ImPostingOnHN 3y ago
    Why does there need a reason for them to opt-in? Maybe they just don't. That's okay. Like you say, zero direct benefits.
denton-scratch 3y ago
> How would you frame a "don't track people without consent" without unintended consequences? Drop the consent requirement? I.e. just don't track people. No third-party cookies, first-party only, and only for the correct operation of the site. It's not the cookies that people object to, it's the tracking. Tracking provides no benefits to visitors. If there were no tracking risk, there would be no need to require consent.
- caskstrength 3y ago
  > It's not the cookies that people object to, it's the tracking. Tracking provides no benefits to visitors Sure it does. Visitors get to use all those great sites and apps without paying for the services directly.
  - danaris 3y ago
    That's not a benefit of the tracking. That's a benefit of the advertising dollars. I have yet to see any kind of meaningful study showing that tracking improves the ROI on advertising by anything remotely resembling enough to justify it.
  - account42 3y ago
    "directly" does the heavy lifting here. Users (on average) still end up paying for the services in the end.
- mercenario 3y ago
  > Drop the consent requirement? Don't ask users what they want. Let me, denton-scratch, decide for all of them. Wow, what a brilliant idea!
deleted 3y ago
[deleted]
caskstrength 3y ago
> The article tries to make the point (perhaps fails), that companies do this intentionally to get the "consent" of people against their will, therefor running the tight line of breaking the law without breaking it. That X button is right there at the top near the tab name. Not sure how a user could be forced against their will into staying on the site presenting them with a cookie banner.

gizmo 3y ago

The problems with the current law are: - no fines for non-compliance (or malicious compliance) - no legal liability for data leaks of PPI When businesses believe (correctly or incorrectly) that the benefit of tracking outweighs the cost (annoying users, regulatory noncompliance) they will do it. The fix is to make tracking too costly for businesses.

pella 3y ago
> - no fines for non-compliance (or malicious compliance) "The Biggest GDPR Fines of 2023" 1. Meta – €1.2 billion (Ireland) 2. Meta – €390 million (Ireland) 3. TikTok – €345 million (Ireland) 4. Criteo – €40 million (France) 5. TikTok – €14.5 million (UK) 6. Axpo Italia Spa – €10 million (Italy) 7. Tim S.p.A. – €7.6 million (Italy) 8. WhatsApp – €5.5 million (Ireland) 9. EOS Matrix – €5.5 million (Croatia) 10. Clearview AI – €5.2 million (France) "GDPR fines are designed to make non-compliance around data security a costly mistake and they can be separated into two tiers. Less severe infringements can result in a fine of €10 million or 2% of a firm’s annual revenue from the preceding financial year, depending on which amount is higher. More serious violations can result in a fine of up to €20 million or 4% of a firm’s annual revenue from the preceding year, depending on what is higher." via https://www.eqs.com/compliance-blog/biggest-gdpr-fines/ https://www.eqs.com/compliance-blog/biggest-gdpr-fines/
- gizmo 3y ago
  Which ones of those fines were because of inappropriate use of cookie consent popups? You just copy-pasted a list of GDPR fines.
  - pella 3y ago
    > fines were because of inappropriate use of cookie consent popups? see: "8 companies that faced cookie consent fines" https://www.cookieyes.com/blog/cookie-consent-fines/ https://www.cookieyes.com/blog/cookie-consent-fines/ "In January 2023, France’s data protection watchdog, CNIL, fined TikTok €5 million ($5.4 million) for making it difficult to refuse cookies on its website. The CNIL found that TikTok manipulated consent by discouraging users from rejecting cookies. They required multiple clicks to refuse cookies, but only one click to accept them. TikTok resolved the issue by adding a “Refuse all” button to its site."

kevmo314 3y ago

Fines for data breaches is one idea? If we want to disincentivize data hoarding, the main cost to data hoarding is data breaches, so we could perhaps penalize that. This would have a different issue, specifically companies would no longer self-report data breaches, but it's just an idea. There are alternative approaches to getting to "don't track people without consent" that aren't a toothless stick by making it more expensive to track.

falcor84 3y ago
Here's my idea - no data collection without compensation. For example, you must pay me in advance 1 cent for the permission to access 1 byte of my personally identifiable information for the following month, whether that's stored in a cookie or in your own database or you access it via a third party (e.g. Meta). So instead of a "cookie consent" pop-up, I want a "cookie payment" pop up where the site will ask me for my payment details and say how much they'll pay me (again, in advance) for each of the options I can toggle.
Sponge5 3y ago
> the main cost to data hoarding is data breaches ... the main cost at the moment. I think we as a society are very close to a tracking/data tax.

mlrtime 3y ago

Probably the same way most laws end up. We see the unintended consequences, then revise the law to counter the consequences. Thus the cat/mouse game continues. An idea could be that the tracking has to be opt-in AND the webpage cannot stop critical use of the page as part of the opt-in process. Then another round of consequences.. rinse repeat...

denton-scratch 3y ago
> An idea could be that the tracking has to be opt-in Why would anyone opt-in? Tracking provides zero benefits to the site visitor.
- ImPostingOnHN 3y ago
  Why does there need a reason for them to opt-in? Maybe they just don't. That's okay. Like you say, zero direct benefits.

denton-scratch 3y ago

> How would you frame a "don't track people without consent" without unintended consequences? Drop the consent requirement? I.e. just don't track people. No third-party cookies, first-party only, and only for the correct operation of the site. It's not the cookies that people object to, it's the tracking. Tracking provides no benefits to visitors. If there were no tracking risk, there would be no need to require consent.

caskstrength 3y ago
> It's not the cookies that people object to, it's the tracking. Tracking provides no benefits to visitors Sure it does. Visitors get to use all those great sites and apps without paying for the services directly.
- danaris 3y ago
  That's not a benefit of the tracking. That's a benefit of the advertising dollars. I have yet to see any kind of meaningful study showing that tracking improves the ROI on advertising by anything remotely resembling enough to justify it.
- account42 3y ago
  "directly" does the heavy lifting here. Users (on average) still end up paying for the services in the end.
mercenario 3y ago
> Drop the consent requirement? Don't ask users what they want. Let me, denton-scratch, decide for all of them. Wow, what a brilliant idea!

deleted 3y ago

[deleted]

caskstrength 3y ago

> The article tries to make the point (perhaps fails), that companies do this intentionally to get the "consent" of people against their will, therefor running the tight line of breaking the law without breaking it. That X button is right there at the top near the tab name. Not sure how a user could be forced against their will into staying on the site presenting them with a cookie banner.