4 ms·

For the GDPR, that argument would fail immediately. Since the GDPR requires consent to be explicitly granted, and neither conscious rejection nor automatic rej

For the GDPR, that argument would fail immediately. Since the GDPR requires consent to be explicitly granted, and neither conscious rejection nor automatic rejection would constitute an explicit granting of consent, the site would not have a consent to track.

paulryanrogers 2y ago
DNT could be mandated as a prompt instead of ever included by default. Or does the GDPR require explicit consent prompt and selection per domain?
- troupo 2y ago
  GDPR requires explicit informed consent for data not strictly required for the working of a <website|app|store|organization|anything> A user giving consent to <site|app...> A does not translate into consent for <site|app...>. And yes, the default for such consent questions must be "no"
  - paulryanrogers 2y ago
    Perhaps I was unclear. IMO someone picking "sure fine everyone track me" when setting up browser (DNT preference) first time should count as explicit consent for every site. And similarly choosing DNT for all should legally count as telling site not to track and not to ever prompt.
    - MereInterest 2y ago
      In addition to being explicit, consent must also be informed in order to be valid under the GDPR. This is not a blanket understanding of "I may be tracked on the internet." but a specific "X information may be used by Y data processors for Z purposes." If somebody is not informed of X, Y, and Z prior to giving consent, then it doesn't count. A browser-wide preference from years ago is not informed consent. There is one and only one legal default under the GDPR: Do not track.
      - anticorporate 2y ago
        > There is one and only one legal default under the GDPR: Do not track. This is immediately followed by every head of marketing (at least for US-based companies) asking "Okay, so how do we track those people?" I'm not saying this is right. But it is reality. We normalized for two decades marketing leadership having the expectation that they can track every interaction, and prying that data away has been painful, especially for folks who really want to do the right thing but are told otherwise by their managers.
        MereInterest 2y ago
        I agree, and that's why I try to avoid any prevarication on the point. Because the head of marketing will at some point ask developers to break the law. Treating privacy law as a grey area gives the marketers more room to pressure developers, and more room to throw developers under the bus afterward.

paulryanrogers 2y ago

DNT could be mandated as a prompt instead of ever included by default. Or does the GDPR require explicit consent prompt and selection per domain?

troupo 2y ago
GDPR requires explicit informed consent for data not strictly required for the working of a <website|app|store|organization|anything> A user giving consent to <site|app...> A does not translate into consent for <site|app...>. And yes, the default for such consent questions must be "no"
- paulryanrogers 2y ago
  Perhaps I was unclear. IMO someone picking "sure fine everyone track me" when setting up browser (DNT preference) first time should count as explicit consent for every site. And similarly choosing DNT for all should legally count as telling site not to track and not to ever prompt.
  - MereInterest 2y ago
    In addition to being explicit, consent must also be informed in order to be valid under the GDPR. This is not a blanket understanding of "I may be tracked on the internet." but a specific "X information may be used by Y data processors for Z purposes." If somebody is not informed of X, Y, and Z prior to giving consent, then it doesn't count. A browser-wide preference from years ago is not informed consent. There is one and only one legal default under the GDPR: Do not track.
    - anticorporate 2y ago
      > There is one and only one legal default under the GDPR: Do not track. This is immediately followed by every head of marketing (at least for US-based companies) asking "Okay, so how do we track those people?" I'm not saying this is right. But it is reality. We normalized for two decades marketing leadership having the expectation that they can track every interaction, and prying that data away has been painful, especially for folks who really want to do the right thing but are told otherwise by their managers.
      - MereInterest 2y ago
        I agree, and that's why I try to avoid any prevarication on the point. Because the head of marketing will at some point ask developers to break the law. Treating privacy law as a grey area gives the marketers more room to pressure developers, and more room to throw developers under the bus afterward.