3 ms·

Medium supported it for ages. Tools like Matomo came with support for it by default. Firefox has implemented the replacement, Global Privacy Control. It has th

Medium supported it for ages. Tools like Matomo came with support for it by default. Firefox has implemented the replacement, Global Privacy Control. It has the exact same problems and isn't respected either, except even fewer websites have implementations that respect GPC. It's not a real solution to the normalised cyberstalking websites practice today, but it's also not entirely useless.

shortsunblack 2y ago
GPC does not meet GDPR's requirements and cannot be used for gaining consent under GDPR. There already has been a browser signal in design that meets GDPR requirements for consent, but it was ignored. The industry instead rallied behind GPC. See: https://www.dataprotectioncontrol.org/ https://www.dataprotectioncontrol.org/
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
ddtaylor 2y ago
Remove GPC too.
Sephr 2y ago
GPC is also a narrower signal implying a smaller subset of privacy choices.
- jeroenhd 2y ago
  There is only one choice being expressed by either protocol. One against data collection, the other against the sale of collected data. DNT has legal standing in the EU, GPC has theoretical legal standing in the USA, where laws are more geared towards protecting data brokers. Removing a protocol because it doesn't work in the USA despite it being a legal opt-out in the EU is foolish; just send both headers, let local jurisdiction pick the which one is legally binding and which one can be ignored. GPC has been standardised to never make it extendable beyond "Sec-GPC: 1" so there is no way for it to imply a set of choices in the future, without breaking backwards compatibility. The choices are limited by design.
Vinnl 2y ago
Doesn't GPC have at least the force of Californian law behind it?
- jeroenhd 2y ago
  Does it? All I've found is that it theoretically complies with California's decisions. I have yet to see that assumption make it through court. Meanwhile, DNT has the force of the GDPR behind it (https://gdprhub.eu/index.php?title=LG_Berlin_-_16_O_420/19 https://gdprhub.eu/index.php?title=LG_Berlin_-_16_O_420/19).
  - Vinnl 2y ago
    Huh. So does that mean that LinkedIn respects DNT in the EU nowadays?

shortsunblack 2y ago

GPC does not meet GDPR's requirements and cannot be used for gaining consent under GDPR. There already has been a browser signal in design that meets GDPR requirements for consent, but it was ignored. The industry instead rallied behind GPC. See: https://www.dataprotectioncontrol.org/ https://www.dataprotectioncontrol.org/

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

ddtaylor 2y ago

Remove GPC too.

Sephr 2y ago

GPC is also a narrower signal implying a smaller subset of privacy choices.

jeroenhd 2y ago
There is only one choice being expressed by either protocol. One against data collection, the other against the sale of collected data. DNT has legal standing in the EU, GPC has theoretical legal standing in the USA, where laws are more geared towards protecting data brokers. Removing a protocol because it doesn't work in the USA despite it being a legal opt-out in the EU is foolish; just send both headers, let local jurisdiction pick the which one is legally binding and which one can be ignored. GPC has been standardised to never make it extendable beyond "Sec-GPC: 1" so there is no way for it to imply a set of choices in the future, without breaking backwards compatibility. The choices are limited by design.

Vinnl 2y ago

Doesn't GPC have at least the force of Californian law behind it?

jeroenhd 2y ago
Does it? All I've found is that it theoretically complies with California's decisions. I have yet to see that assumption make it through court. Meanwhile, DNT has the force of the GDPR behind it (https://gdprhub.eu/index.php?title=LG_Berlin_-_16_O_420/19 https://gdprhub.eu/index.php?title=LG_Berlin_-_16_O_420/19).
- Vinnl 2y ago
  Huh. So does that mean that LinkedIn respects DNT in the EU nowadays?