3 ms·

I encounter recaptcha a lot and often it violates the gdpr. I believe this to be one of the positives of the gdpr. Things usually go as follows: - something ge

I encounter recaptcha a lot and often it violates the gdpr. I believe this to be one of the positives of the gdpr. Things usually go as follows: - something gets abused - a solution is needed to stop the abuse - the 'techies' implement recaptcha and they are not aware of the regulatory implications - it's such a small thing that it often get's overlooked in internal audits Google fonts from their cdn is another. Landing page Youtube videos is another but a little bit more well known. The user should be warned so they can decide if they want to give Google everything; how else would they know?

sentientslug 2y ago
Can you elaborate on why these are violations of GDPR? I presume Google handles the data for EU customers in a manner compliant with GDPR (one would think).
- cess11 2y ago
  No, they can't, because they're covered by the CLOUD Act.
- aziaziazi 2y ago
  Wouldn’t GDPR compliance require to let user refuse third party cookies? If a user don’t accept cookies I guess reCaptcha won’t work. Do you either - block them access to your site - ask for recaptcha (use cookies so you just don’t give a poo of their choice - illegal) - open the doors without captcha resolution (don’t need captcha as it can be bypassed)
  - anonzzzies 2y ago
    Yes, but because recaptcha is often such a simple integration on 'some page somewhere' it is overlooked. Or people just think 'it is Google, they must have got it covered'.
  - stavros 2y ago
    Using reCaptcha to stop attacks might fall under legitimate concerns, as the site isn't using it to track visitors. If reCaptcha does track, that's Google breaking the law, not the website.
    - anonzzzies 2y ago
      The website has to inform its users that recaptcha does track and if they are ok with that. Many sites don't inform their users about this which is not Google's fault. You have to inform and ask consent. Same for analytics, google cdn fonts, embedded youtube videos etc. google sucks they track everything but they are not liable if you put this on your site; then it's you.
    - LocalH 2y ago
      The website chose to put reCaptcha on there. They don't get to pass the buck to Google.
- anonzzzies 2y ago
  The website has to inform its users that recaptcha does track and if they are ok with that. Many sites don't inform their users about this which is a violation. You have to inform and ask consent before you show the page with recaptcha on it.
jddj 2y ago
Another thing here is more and more creeping into the "legitimate purposes" category. I installed CalcNote on a new android phone today and had to untick "legitimate uses" for 3 vendors in several places, including Google and Bytedance. Felt like I needed a shower once I was finished setting it up with the minimal apps that I use
- yjftsjthsd-h 2y ago
  > Felt like I needed a shower once I was finished setting it up with the minimal apps that I use And this is a lot of why I've been gradually drifting over the years to getting nearly all my apps from F-Droid.
throwaway2037 2y ago
> often it violates the gdpr If this is true, why hasn't there been a huge fine against Google for it? At this point, the net of GDPR is so wide as to be useless to me. If I see one more fucking cookie disclaimer, I will snap. Is this really making us "safer" or "more secure/private"? I doubt it, but lots of small software consultancies in the EU made a bundle charging everyone to upgrade their websites to make them GDPR-compliant!
- colimbarna 2y ago
  Cookie disclaimers are not GDPR. They're also completely optional; you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Businesses make choices not to do that and we've become stuck at a local suboptimum.
  - anonzzzies 2y ago
    It depends what you store and what you use it for if it touches the gdpr. You can run entire SaaS products profitably (as we do) without gdpr violations while having no cookie or consent banners. Just don't track users or store information you do not strictly need for your saas. Sure there are many more considerations, but this is a basic consideration.
  - wizzwizz4 2y ago
    > you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Strictly-speaking, notification before cookies are set is required by the 2002 ePrivacy directive (article 5(3)), which includes cookies (and related technologies) under the banner of the 1995 Data Privacy Directive (later superseded by the GDPR). The intent of the ePrivacy law is clearly not "have a banner that yells about cookies". The intent is that you only set cookies when someone, say, clicks on the Dark Mode toggle, or does something else that sets a cookie, and that when they do that, they know the data privacy implications. Traditional uses of cookies aren't affected: "Add to basket? (this uses cookies: learn more)" isn't that onerous, nor annoying. It's a pain for our dark mode toggle, but the law was written back in the day, when the expectation was that we could actually customise our user agents.

sentientslug 2y ago

Can you elaborate on why these are violations of GDPR? I presume Google handles the data for EU customers in a manner compliant with GDPR (one would think).

cess11 2y ago
No, they can't, because they're covered by the CLOUD Act.
aziaziazi 2y ago
Wouldn’t GDPR compliance require to let user refuse third party cookies? If a user don’t accept cookies I guess reCaptcha won’t work. Do you either - block them access to your site - ask for recaptcha (use cookies so you just don’t give a poo of their choice - illegal) - open the doors without captcha resolution (don’t need captcha as it can be bypassed)
- anonzzzies 2y ago
  Yes, but because recaptcha is often such a simple integration on 'some page somewhere' it is overlooked. Or people just think 'it is Google, they must have got it covered'.
- stavros 2y ago
  Using reCaptcha to stop attacks might fall under legitimate concerns, as the site isn't using it to track visitors. If reCaptcha does track, that's Google breaking the law, not the website.
  - anonzzzies 2y ago
    The website has to inform its users that recaptcha does track and if they are ok with that. Many sites don't inform their users about this which is not Google's fault. You have to inform and ask consent. Same for analytics, google cdn fonts, embedded youtube videos etc. google sucks they track everything but they are not liable if you put this on your site; then it's you.
  - LocalH 2y ago
    The website chose to put reCaptcha on there. They don't get to pass the buck to Google.
anonzzzies 2y ago
The website has to inform its users that recaptcha does track and if they are ok with that. Many sites don't inform their users about this which is a violation. You have to inform and ask consent before you show the page with recaptcha on it.

jddj 2y ago

Another thing here is more and more creeping into the "legitimate purposes" category. I installed CalcNote on a new android phone today and had to untick "legitimate uses" for 3 vendors in several places, including Google and Bytedance. Felt like I needed a shower once I was finished setting it up with the minimal apps that I use

yjftsjthsd-h 2y ago
> Felt like I needed a shower once I was finished setting it up with the minimal apps that I use And this is a lot of why I've been gradually drifting over the years to getting nearly all my apps from F-Droid.

throwaway2037 2y ago

> often it violates the gdpr If this is true, why hasn't there been a huge fine against Google for it? At this point, the net of GDPR is so wide as to be useless to me. If I see one more fucking cookie disclaimer, I will snap. Is this really making us "safer" or "more secure/private"? I doubt it, but lots of small software consultancies in the EU made a bundle charging everyone to upgrade their websites to make them GDPR-compliant!

colimbarna 2y ago
Cookie disclaimers are not GDPR. They're also completely optional; you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Businesses make choices not to do that and we've become stuck at a local suboptimum.
- anonzzzies 2y ago
  It depends what you store and what you use it for if it touches the gdpr. You can run entire SaaS products profitably (as we do) without gdpr violations while having no cookie or consent banners. Just don't track users or store information you do not strictly need for your saas. Sure there are many more considerations, but this is a basic consideration.
- wizzwizz4 2y ago
  > you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Strictly-speaking, notification before cookies are set is required by the 2002 ePrivacy directive (article 5(3)), which includes cookies (and related technologies) under the banner of the 1995 Data Privacy Directive (later superseded by the GDPR). The intent of the ePrivacy law is clearly not "have a banner that yells about cookies". The intent is that you only set cookies when someone, say, clicks on the Dark Mode toggle, or does something else that sets a cookie, and that when they do that, they know the data privacy implications. Traditional uses of cookies aren't affected: "Add to basket? (this uses cookies: learn more)" isn't that onerous, nor annoying. It's a pain for our dark mode toggle, but the law was written back in the day, when the expectation was that we could actually customise our user agents.