5 ms·

> According to the EU law if you don’t click accept it’s equivalent to denying. The result is the same. Technically there's no such thing as denying, only prov

> According to the EU law if you don’t click accept it’s equivalent to denying. The result is the same. Technically there's no such thing as denying, only providing (explicit) consent. If consent is required and no consent is provided, then there is no ground for processing.

atoav 9mo ago
Also: the consent has to be informed consent. Me clicking away a nag banner, even if I click "accept" isn't informed consent by the definition of the law. You want to share my data with your 300+ "partners" legally? Good luck informing me about all the ways in which every of those single partners is using my data. If you are unable to inform me I can't give consent, even if I click "Accept all". That is however a you-problem, not a me-problem. If you share my data nontheless you are breaking the law.
- neodymiumphish 9mo ago
  Undoing whatever data collection and sharing, as well as seeking and obtaining restitution, is probably a much harder problem to solve (for you) if you select accept.
- JCattheATM 9mo ago
  A lot of the notices provide exactly the info you need to be informed, it's on you if you want to read it or not.
  - atoav 9mo ago
    Are you sure? Most notices provide a list of partners. What needs to be provided is a list of who gets to see which data for which purpose. Most lists I have ever seen are lists that are not informing me of that, especially the lengthy ones. The only ones that comply are very short lists by privacy conscious website owners.
    - JCattheATM 9mo ago
      I'm not 100% sure, no. I wonder if any studies have been done on this? At a minimum I would assume sites from big corps would be in compliance.
Rygian 9mo ago
How do you object to the site's legitimate interest use of your personal data? That is a legal grounds for processing, which can be enabled by default as long as you are provided with an option to actively object. https://noyb.eu/en/your-right-object-article-21 https://noyb.eu/en/your-right-object-article-21
- upofadown 9mo ago
  If it is an actual legitimate interest then you would likely be expected to contact the site out of band to object to the use of your data. Depending on the technical details you might not be able to continue using the site after a successful objection. In some cases the site might be able to reject your request. The cookie banner thing is intended to allow the user to explicitly provide consent, should they for some reason wish to do so.
  - Rygian 9mo ago
    The cookie banners are routinely used to object to "legitimate interest" uses and the corresponding sites continue to work normally, not sure what your alternate understanding is based on.
    - upofadown 9mo ago
      The cookie banners are for initial consent. You just consent to less stuff sometimes. A website might claim some sort of legitimate interest for the initial collection of data but might not think that they can claim that for the retention of data I suppose. That would seem kind of dodgy to me... Just because a website claims something doesn't mean it is valid. There isn't a lot that falls under legitimate interest for a website.
      - Rygian 9mo ago
        What you state is provably wrong. Consent and objection to legitimate interest are two different things, in the eyes of GDPR, and are managed separately in privacy banners: Navigate to a website of your choice [1]. Let's assume its privacy banner is served by onetrust. The text at the top of their "Privacy Center" says, verbatim, "We share this information with our partners on the basis of consent and legitimate interest. You may exercise your right to consent or object to a legitimate interest" If you then unfold the "Manage Consent Preferences" you will notice that you can, _separately_, provide your consent for a given purpose, by sliding the switch to the right to enable it, and also, _at the same time_, "Object to Legitimate Interests" by clicking on the button labeled so. Of course, this is a dark pattern to make it as cumbersome as possible to object to Legitimate Interest purposes. [1] (I took vox dot com as an example.)

atoav 9mo ago

Also: the consent has to be informed consent. Me clicking away a nag banner, even if I click "accept" isn't informed consent by the definition of the law. You want to share my data with your 300+ "partners" legally? Good luck informing me about all the ways in which every of those single partners is using my data. If you are unable to inform me I can't give consent, even if I click "Accept all". That is however a you-problem, not a me-problem. If you share my data nontheless you are breaking the law.

neodymiumphish 9mo ago
Undoing whatever data collection and sharing, as well as seeking and obtaining restitution, is probably a much harder problem to solve (for you) if you select accept.
JCattheATM 9mo ago
A lot of the notices provide exactly the info you need to be informed, it's on you if you want to read it or not.
- atoav 9mo ago
  Are you sure? Most notices provide a list of partners. What needs to be provided is a list of who gets to see which data for which purpose. Most lists I have ever seen are lists that are not informing me of that, especially the lengthy ones. The only ones that comply are very short lists by privacy conscious website owners.
  - JCattheATM 9mo ago
    I'm not 100% sure, no. I wonder if any studies have been done on this? At a minimum I would assume sites from big corps would be in compliance.

Rygian 9mo ago

How do you object to the site's legitimate interest use of your personal data? That is a legal grounds for processing, which can be enabled by default as long as you are provided with an option to actively object. https://noyb.eu/en/your-right-object-article-21 https://noyb.eu/en/your-right-object-article-21

upofadown 9mo ago
If it is an actual legitimate interest then you would likely be expected to contact the site out of band to object to the use of your data. Depending on the technical details you might not be able to continue using the site after a successful objection. In some cases the site might be able to reject your request. The cookie banner thing is intended to allow the user to explicitly provide consent, should they for some reason wish to do so.
- Rygian 9mo ago
  The cookie banners are routinely used to object to "legitimate interest" uses and the corresponding sites continue to work normally, not sure what your alternate understanding is based on.
  - upofadown 9mo ago
    The cookie banners are for initial consent. You just consent to less stuff sometimes. A website might claim some sort of legitimate interest for the initial collection of data but might not think that they can claim that for the retention of data I suppose. That would seem kind of dodgy to me... Just because a website claims something doesn't mean it is valid. There isn't a lot that falls under legitimate interest for a website.
    - Rygian 9mo ago
      What you state is provably wrong. Consent and objection to legitimate interest are two different things, in the eyes of GDPR, and are managed separately in privacy banners: Navigate to a website of your choice [1]. Let's assume its privacy banner is served by onetrust. The text at the top of their "Privacy Center" says, verbatim, "We share this information with our partners on the basis of consent and legitimate interest. You may exercise your right to consent or object to a legitimate interest" If you then unfold the "Manage Consent Preferences" you will notice that you can, _separately_, provide your consent for a given purpose, by sliding the switch to the right to enable it, and also, _at the same time_, "Object to Legitimate Interests" by clicking on the button labeled so. Of course, this is a dark pattern to make it as cumbersome as possible to object to Legitimate Interest purposes. [1] (I took vox dot com as an example.)