4 ms·

While I love the idea of GDPR, and especially local versions like CCPA that benefit me directly, I loathe much about the GDPR. 1. Cookie popups. Enough said.

While I love the idea of GDPR, and especially local versions like CCPA that benefit me directly, I loathe much about the GDPR. 1. Cookie popups. Enough said. 2. Its extraterratoriality claims. Yes, I know you also want it to apply to companies in, say, Japan. Bummer. Unless they signed a treaty agreeing to abide by it, their they're own sovereign entities and their businesses don't have to comply with remote EU laws. 3. The annual moderation report. I've lost an aggregate of several weeks of my life filling out reports where 99.9% of our moderation actions were to delete link farms, fake drug sales, phishing portals, and cockfighting fliers. 4. The misperception that GDPR means you have to delete everything. Uh, no. If we suspend joe.scammer@gmail.com's account for phishing, we're not obligated to purge every instance of that email address from our systems, especially not the one that gets to decide whether a new user is allowed to register for another account. And if "joe.scammer" deletes his account, we don't have to return "joe.scammer" into circulation so another user can register it, and simply saying that "joe.scammer is not available" is not disclosing sensitive data. And in any case, a company entirely outside the EU isn't compleleled to do it anyway (see #2). Love the idea, strongly dislike the implementation.

qkeast 9mo ago
As far as cookie popups go (and recognizing you probably know this so it’s more a general comment), GDPR doesn’t encode cookie popups into law, but the entire industry follows the pattern of cookie popups in response to the underlying requirement of informed consent. Companies could choose to not collect as much info, or take other approaches, but cookie popups are the default.
- causal 9mo ago
  Yeah it's wild we blame GDPR instead of the companies that decide tracking us is worth our inconvenience
- SpicyLemonZest 9mo ago
  GDPR does not formally require cookie popups (and the cookie stuff predates GDPR as such anyway). But it's challenging to the point of impracticality to run a website with so few cookies that a popup is not required. The EU's official resources on data protection, for example, have a popup. (https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r...)
  - latexr 9mo ago
    > But it's challenging to the point of impracticality to run a website with so few cookies that a popup is not required. It is not. They even list more types of cookies which do not need consent than the ones which do. https://commission.europa.eu/resources/europa-web-guide/design-content-and-development/privacy-security-and-legal-notices/cookies-and-similar-technologies_en https://commission.europa.eu/resources/europa-web-guide/desi... > The EU's official resources on data protection, for example, have a popup. Because it’s mandatory for them, not because the cookies are invasive. See the top of the page of the link above: > Use of the cookie consent kit is mandatory on each page of the DGs and executive agencies-owned websites, regardless of the cookies used.
  - bruce511 9mo ago
    >> But it's challenging to the point of impracticality to run a website with so few cookies that a popup is not required. Nonsense. It's easy to create a site that doesn't need a cookie pop-up. Indeed the mere existance of a cookie pop-up screams "we are tracking you and selling your info".
  - dathinab 9mo ago
    > point of impracticality to run a website only if your site insist to use any of the widely used Ad networks through there are Ad Networks which base ads on what is on your site instead of who visits and the popup you link is _not_ a GDPR popup but is related to some other older and very misguided law(s). (Not EU wide laws, but EU sites want to be compliant with every member countries laws.) Having a EU decision which requires countries to remove this older misguided laws has been on the agenda for years. It's just given that most sites anyway will have popups (e.g. for Google Ads) things move way way way to slow :(
- kstrauser 9mo ago
  You're right, for sure. It'd be nice if the law included an explicit exception for local cookies for routine site operation purposes. I haven't put any time into nailing down the wording, but something that communicates "sites are allowed use 'authentication cookies' to validate a user's ability to make server requests" would be most welcome. Then you could actually have an incentive to remove the cookie banner on sites that only use cookies for session authentication. You don't also use them to integrate with your marketing analytics kraken? Sweet! You don't have to have a banner or other notice!
  - mhitza 9mo ago
    If you use cookies only for authentication it can be a single note on the login form.
    - latexr 9mo ago
      You don’t even need that. https://commission.europa.eu/resources/europa-web-guide/design-content-and-development/privacy-security-and-legal-notices/cookies-and-similar-technologies_en https://commission.europa.eu/resources/europa-web-guide/desi... > Cookies and similar technologies that generally do NOT need consent > (…) > Authentication cookies, for the duration of a session
      - dathinab 9mo ago
        needing consent and informing the user are two distinct concepts I think you did need to explicitly tell the user about it. But I think (not fully sure) they did relax that recently so just listing it in you Privacy Policy or similar should be enough by now. But also due to how enforcement is designed it's not that you really had to worry about anything if you only have non-censent requiring cookies and list them clearly in the privacy policy. Worst case a privacy agency tell you to "improve on it" without penalty. It's just which site (or app) today doesn't use something like Google Ad Network, or Metas Ad Network, or Apples Ad network. All of which do not support ads without tracking (which still are very viable, e.g. select ads based on what the side/ad is about).
piva00 9mo ago
Cookie pop-ups are not part of the GDPR. Every time I read this point on Hacker News I got to point this out because it's an extremely common misconception. Read the GDPR, at least the outline, it's not there.
- matkoniecz 9mo ago
  Also, cookie pop-ups appeared before GDPR.
Topfi 9mo ago
> Unless they signed a treaty agreeing to abide by it, their they're own sovereign entities and their businesses don't have to comply with remote EU laws. What is your opinion concerning laws such as FATCA and other such laws that apply to non-US entities when working with US citizens abroad?
- kstrauser 9mo ago
  Other laws that apply to the US's own citizens abroad, I can kind of get in line with. Like even if you go to a country where murder and mayhem are legal, you can't go there on vacation, rack up a body count, then come back to Wyoming and go back to work on Monday. Other laws that apply to non-citizens abroad, I'm against, of course. We don't have the moral right to legislate what someone in China can and can't do. However, prosecuting them for that should they enter the US is a different animal. If you run a scam farm and defraud a million Americans, then go to Disneyland on vacation, you should plan on having a bad time. Similarly with GDPR and other EU-local laws: violate them outside the EU, but it'd be wise to skip Barcelona on your next world tour.
  - Topfi 9mo ago
    But neither of your described scenarios applies to either of the two. Both FATCA and GDPR apply to entities/companies that deal with citizens from their respective jurisdiction. FATCA applies e.g. to foreign banks handling US customers, GDPR to foreign data processors handling EU user data. If you don't want either to apply to you, easy, just don't handle US customers money/process EU user data.
    - kstrauser 9mo ago
      The penalty for non-compliance comes down to: you can't do business with the US government anymore, which is a huge bummer for any financial institution. If you don't care about that, say because you're a credit union servicing a small town in Brazil and you had a single American move there, I imagine you'd also ignore it.
dathinab 9mo ago
> Cookie popups. Enough said. except a lot of the things related to cookie popups isn't GDPR but other (misguided older) laws furthermore setting a (proper 1st party and HTTP only) cookie to remember you opted out of tracking doesn't require your explicit consent and as such any side which ask you again and again makes it extra hard to opt out in a way _not legally compliant with GDPR_. also the do not track flag in a browser is a very clear unmistakable signal from the user that they don't want to be tracked, ignoring it and harassing the user with tracking dialogs is also not GDPR compliant > 2. Its extraterratoriality claims. It's based on your citizens data being owned by your citizens. Extraterritorial claims about your citizens is pretty normal. And only enforced things matter so basically it only matters if they do business in the EU. And requiring someone who does business in another country to comply with that countries laws is the norm. Just because you do it "through a website" doesn't mean you can doge responsibility. That would be absurd. > 3. The annual moderation report. if it's moderation deletion then that isn't GDPR but other laws, and the reports which are needed for GDPR can be trivially automatized. > 4. The misperception that GDPR any half way serious source is pretty clear about that and there isn't much law makers can do if people are to dump to read and then insist they know better The main issues is still enforcement, or the systematic lack of it in all kinds of ways. Due to that bad companies don't try comply with GDPR but with "what level of systematic intentional GDPR violation can we get away with" and that in turn leads to legal unreliability/unclear-ness. Oh and that some business models are inherently incompatible with it and instead of judges being like "bad luck you had years to adapt" they are often hesitant to do much about it (like "pure abos" which deceive the end-user (and judges) with a false dichotomy about ads vs. no ads when the laws is about tracking vs. no tracking and you can have ads without tracking, just not google ads but that is a googles made problem not a fundamentally one).

qkeast 9mo ago

As far as cookie popups go (and recognizing you probably know this so it’s more a general comment), GDPR doesn’t encode cookie popups into law, but the entire industry follows the pattern of cookie popups in response to the underlying requirement of informed consent. Companies could choose to not collect as much info, or take other approaches, but cookie popups are the default.

causal 9mo ago
Yeah it's wild we blame GDPR instead of the companies that decide tracking us is worth our inconvenience
SpicyLemonZest 9mo ago
GDPR does not formally require cookie popups (and the cookie stuff predates GDPR as such anyway). But it's challenging to the point of impracticality to run a website with so few cookies that a popup is not required. The EU's official resources on data protection, for example, have a popup. (https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r...)
- latexr 9mo ago
  > But it's challenging to the point of impracticality to run a website with so few cookies that a popup is not required. It is not. They even list more types of cookies which do not need consent than the ones which do. https://commission.europa.eu/resources/europa-web-guide/design-content-and-development/privacy-security-and-legal-notices/cookies-and-similar-technologies_en https://commission.europa.eu/resources/europa-web-guide/desi... > The EU's official resources on data protection, for example, have a popup. Because it’s mandatory for them, not because the cookies are invasive. See the top of the page of the link above: > Use of the cookie consent kit is mandatory on each page of the DGs and executive agencies-owned websites, regardless of the cookies used.
- bruce511 9mo ago
  >> But it's challenging to the point of impracticality to run a website with so few cookies that a popup is not required. Nonsense. It's easy to create a site that doesn't need a cookie pop-up. Indeed the mere existance of a cookie pop-up screams "we are tracking you and selling your info".
- dathinab 9mo ago
  > point of impracticality to run a website only if your site insist to use any of the widely used Ad networks through there are Ad Networks which base ads on what is on your site instead of who visits and the popup you link is _not_ a GDPR popup but is related to some other older and very misguided law(s). (Not EU wide laws, but EU sites want to be compliant with every member countries laws.) Having a EU decision which requires countries to remove this older misguided laws has been on the agenda for years. It's just given that most sites anyway will have popups (e.g. for Google Ads) things move way way way to slow :(
kstrauser 9mo ago
You're right, for sure. It'd be nice if the law included an explicit exception for local cookies for routine site operation purposes. I haven't put any time into nailing down the wording, but something that communicates "sites are allowed use 'authentication cookies' to validate a user's ability to make server requests" would be most welcome. Then you could actually have an incentive to remove the cookie banner on sites that only use cookies for session authentication. You don't also use them to integrate with your marketing analytics kraken? Sweet! You don't have to have a banner or other notice!
- mhitza 9mo ago
  If you use cookies only for authentication it can be a single note on the login form.
  - latexr 9mo ago
    You don’t even need that. https://commission.europa.eu/resources/europa-web-guide/design-content-and-development/privacy-security-and-legal-notices/cookies-and-similar-technologies_en https://commission.europa.eu/resources/europa-web-guide/desi... > Cookies and similar technologies that generally do NOT need consent > (…) > Authentication cookies, for the duration of a session
    - dathinab 9mo ago
      needing consent and informing the user are two distinct concepts I think you did need to explicitly tell the user about it. But I think (not fully sure) they did relax that recently so just listing it in you Privacy Policy or similar should be enough by now. But also due to how enforcement is designed it's not that you really had to worry about anything if you only have non-censent requiring cookies and list them clearly in the privacy policy. Worst case a privacy agency tell you to "improve on it" without penalty. It's just which site (or app) today doesn't use something like Google Ad Network, or Metas Ad Network, or Apples Ad network. All of which do not support ads without tracking (which still are very viable, e.g. select ads based on what the side/ad is about).

piva00 9mo ago

Cookie pop-ups are not part of the GDPR. Every time I read this point on Hacker News I got to point this out because it's an extremely common misconception. Read the GDPR, at least the outline, it's not there.

matkoniecz 9mo ago
Also, cookie pop-ups appeared before GDPR.

Topfi 9mo ago

> Unless they signed a treaty agreeing to abide by it, their they're own sovereign entities and their businesses don't have to comply with remote EU laws. What is your opinion concerning laws such as FATCA and other such laws that apply to non-US entities when working with US citizens abroad?

kstrauser 9mo ago
Other laws that apply to the US's own citizens abroad, I can kind of get in line with. Like even if you go to a country where murder and mayhem are legal, you can't go there on vacation, rack up a body count, then come back to Wyoming and go back to work on Monday. Other laws that apply to non-citizens abroad, I'm against, of course. We don't have the moral right to legislate what someone in China can and can't do. However, prosecuting them for that should they enter the US is a different animal. If you run a scam farm and defraud a million Americans, then go to Disneyland on vacation, you should plan on having a bad time. Similarly with GDPR and other EU-local laws: violate them outside the EU, but it'd be wise to skip Barcelona on your next world tour.
- Topfi 9mo ago
  But neither of your described scenarios applies to either of the two. Both FATCA and GDPR apply to entities/companies that deal with citizens from their respective jurisdiction. FATCA applies e.g. to foreign banks handling US customers, GDPR to foreign data processors handling EU user data. If you don't want either to apply to you, easy, just don't handle US customers money/process EU user data.
  - kstrauser 9mo ago
    The penalty for non-compliance comes down to: you can't do business with the US government anymore, which is a huge bummer for any financial institution. If you don't care about that, say because you're a credit union servicing a small town in Brazil and you had a single American move there, I imagine you'd also ignore it.

dathinab 9mo ago

> Cookie popups. Enough said. except a lot of the things related to cookie popups isn't GDPR but other (misguided older) laws furthermore setting a (proper 1st party and HTTP only) cookie to remember you opted out of tracking doesn't require your explicit consent and as such any side which ask you again and again makes it extra hard to opt out in a way _not legally compliant with GDPR_. also the do not track flag in a browser is a very clear unmistakable signal from the user that they don't want to be tracked, ignoring it and harassing the user with tracking dialogs is also not GDPR compliant > 2. Its extraterratoriality claims. It's based on your citizens data being owned by your citizens. Extraterritorial claims about your citizens is pretty normal. And only enforced things matter so basically it only matters if they do business in the EU. And requiring someone who does business in another country to comply with that countries laws is the norm. Just because you do it "through a website" doesn't mean you can doge responsibility. That would be absurd. > 3. The annual moderation report. if it's moderation deletion then that isn't GDPR but other laws, and the reports which are needed for GDPR can be trivially automatized. > 4. The misperception that GDPR any half way serious source is pretty clear about that and there isn't much law makers can do if people are to dump to read and then insist they know better The main issues is still enforcement, or the systematic lack of it in all kinds of ways. Due to that bad companies don't try comply with GDPR but with "what level of systematic intentional GDPR violation can we get away with" and that in turn leads to legal unreliability/unclear-ness. Oh and that some business models are inherently incompatible with it and instead of judges being like "bad luck you had years to adapt" they are often hesitant to do much about it (like "pure abos" which deceive the end-user (and judges) with a false dichotomy about ads vs. no ads when the laws is about tracking vs. no tracking and you can have ads without tracking, just not google ads but that is a googles made problem not a fundamentally one).