4 ms·

If it only were that simple. When the GDPR came out, a lot of confusion and misunderstanding ensued. Not only regarding the damn cookie banner. Even totally

by lynx23 3y ago

If it only were that simple. When the GDPR came out, a lot of confusion and misunderstanding ensued. Not only regarding the damn cookie banner. Even totally legitimate health-care providers started to collect signatures to be on the safe side. I still rememeber receiving a basic GDPR training where we were told that opt-out/signing is only necessary if the entity is planning to do weird stuff with your data. IOW, if someone wants you to sign, they plan a bad move. Then my bank wanted a signature. And a month later, one of my healthcare providers wanted a signature. After a chat with him, I learnt that his lawyer told him to collect the signatures just in case, and made him believe that if someone doesn't sign, that is a problem. So now we have this situation where providers were trained to play the GDPR in such a way that they will never have a problem, no matter what they actually do with the data. And consumers are pissed because they are made to sign things which essentially reduce their rights... And if someone (like me) thinks the EU did a half-assed job there, the downvotes rain in.

soco 3y ago
The same people also complain they cannot use by default said websites unless they share all their personal data with them. Half-assed, indeed the measure is. But it also reflects the majority thinking, unfortunately. So unless there's some popular pressure to full-ass the measure, we will still have banners and misused personal data.
orwin 3y ago
I kinda hate saying this, but Microsoft (or at least github) got it right in a week. Some OSS publishers also got it right, like nexedi, and some i'm sightly upset with (gitlab) but it is true that for the commercial internet it seems to be invasive. I do not use the commercial internet much, and like any person with greasemonkey, i took a rainy afternoon to remove the most annoying banners (i think now i use a plugin that does it for me).
- lynx23 3y ago
  The fact that you have to use a plugin or other thecnical remedies to fix the cookie banner situation is all the proof we need to see that the EU totally fucked up. It is easy to declare that you just need to install this or that to get a obstruction-free internet again. But it is also very very elitist. Not even 1% of the population is truly capable of handling that.
  - orwin 3y ago
    I use a plugin to block ads. That it also block most cookie consent banner is a positive side effect. It does not block all of them. It doesn't block gitlab banner, or EU website banners, because i think it automagically block cross domain js injection, which, you know, is good because less attack surface, and every browser should do the same without plugin (CORS do not go far enough imho).
HelloNurse 3y ago
Incompetent lawyers and managers did a half-assed job, and some exemplary fines will motivate them with respect to the other half.
- lynx23 3y ago
  That is so wonderfully naiv that I had to laugh out loud. The fairytale of the manager who suddenly is fined big-time for his/her decisions is just that, a fairytale to pacify critics.
wizzwizz4 3y ago
> they are made to sign things which essentially reduce their rights... But not as much as you might think. Consent under GDPR only applies to what you were informed of when you consented, and you're allowed to revoke consent (with prospective effect) at any time.
- lynx23 3y ago
  Yeah, but these are rather theoretical practicalities. In the majority of cases, consent is coaxed out of the consumer. If you show up for a MRI, and you get a piece of paper with the comment "It is for data protection", almost nobody has the time or nerve to actually read the text, and even less people have the inclination to decline to sign. After all, they (sometimes desperately) need the service. Let alone that the accompanying comment is deliberately phrased such that some people will believe they need to sign in order for their data to be protected. Dark patterns all over the place. My bank implemented the consent (for a while) as a reoccuring pop-up after login. Yes, you get the popup as long as you decline to sign it, over and over again. I think they gave up on that practice, and it was partly a dark pattern (IOW, there were two buttons to decline to sign, and one would result in the popup reoccuring). Examples are all over the place if you walk an EU country with open eyes.
  - wizzwizz4 3y ago
    Under GDPR, your MRI example and your bank example do not qualify as consent. (For the MRI example, they might be able to claim basis b, but only if they're doing stuff that you could actually have requested.)
    - lynx23 3y ago
      I don't feel confident a complaint would be easy to get through. After all, my MRI example is standard procedure, good luck making a case against that. Besides, layers cost money.
ambichook 3y ago
would an adjustment of GDPR that forces websites to respect DNT solve the problem? am i missing something obvious? (aside from the pain in the ass that is amending laws) /gen

by lynx23 3y ago

soco 3y ago

The same people also complain they cannot use by default said websites unless they share all their personal data with them. Half-assed, indeed the measure is. But it also reflects the majority thinking, unfortunately. So unless there's some popular pressure to full-ass the measure, we will still have banners and misused personal data.

orwin 3y ago

I kinda hate saying this, but Microsoft (or at least github) got it right in a week. Some OSS publishers also got it right, like nexedi, and some i'm sightly upset with (gitlab) but it is true that for the commercial internet it seems to be invasive. I do not use the commercial internet much, and like any person with greasemonkey, i took a rainy afternoon to remove the most annoying banners (i think now i use a plugin that does it for me).

lynx23 3y ago
The fact that you have to use a plugin or other thecnical remedies to fix the cookie banner situation is all the proof we need to see that the EU totally fucked up. It is easy to declare that you just need to install this or that to get a obstruction-free internet again. But it is also very very elitist. Not even 1% of the population is truly capable of handling that.
- orwin 3y ago
  I use a plugin to block ads. That it also block most cookie consent banner is a positive side effect. It does not block all of them. It doesn't block gitlab banner, or EU website banners, because i think it automagically block cross domain js injection, which, you know, is good because less attack surface, and every browser should do the same without plugin (CORS do not go far enough imho).

HelloNurse 3y ago

Incompetent lawyers and managers did a half-assed job, and some exemplary fines will motivate them with respect to the other half.

lynx23 3y ago
That is so wonderfully naiv that I had to laugh out loud. The fairytale of the manager who suddenly is fined big-time for his/her decisions is just that, a fairytale to pacify critics.

wizzwizz4 3y ago

> they are made to sign things which essentially reduce their rights... But not as much as you might think. Consent under GDPR only applies to what you were informed of when you consented, and you're allowed to revoke consent (with prospective effect) at any time.

lynx23 3y ago
Yeah, but these are rather theoretical practicalities. In the majority of cases, consent is coaxed out of the consumer. If you show up for a MRI, and you get a piece of paper with the comment "It is for data protection", almost nobody has the time or nerve to actually read the text, and even less people have the inclination to decline to sign. After all, they (sometimes desperately) need the service. Let alone that the accompanying comment is deliberately phrased such that some people will believe they need to sign in order for their data to be protected. Dark patterns all over the place. My bank implemented the consent (for a while) as a reoccuring pop-up after login. Yes, you get the popup as long as you decline to sign it, over and over again. I think they gave up on that practice, and it was partly a dark pattern (IOW, there were two buttons to decline to sign, and one would result in the popup reoccuring). Examples are all over the place if you walk an EU country with open eyes.
- wizzwizz4 3y ago
  Under GDPR, your MRI example and your bank example do not qualify as consent. (For the MRI example, they might be able to claim basis b, but only if they're doing stuff that you could actually have requested.)
  - lynx23 3y ago
    I don't feel confident a complaint would be easy to get through. After all, my MRI example is standard procedure, good luck making a case against that. Besides, layers cost money.

ambichook 3y ago

would an adjustment of GDPR that forces websites to respect DNT solve the problem? am i missing something obvious? (aside from the pain in the ass that is amending laws) /gen