91–100 of 680 posts
What else can they do when they have this laundry list of tracking scripts on a front page: https://i.imgur.com/hKEItPS.png They obviously have NO idea what's being collected on every user and how it is being used.
That’s the whole point of GDPR, selectively kill the web businesses they want. BBC will never be concerned.
Earlier quoted context omitted.
"Click here to agree to everything we do" schemes are explicitly forbidden by the GDPR. You need to individually opt-in to every single use case, and you need to consent to every transfer to each individual third party as well.
IANAL No, coupling is forbidden. A 20 page, non-legalese EULA is allowed if you don't couple acceptance to using your site. "You need to individually opt-in to every single use case" No. But I would be happy for your source on that. You can't change the usage purpose after collecting, but if you declare what you do before (20 pages EULA) data collection, you're fine. "and you need to consent to every transfer to each…
You do need explicit consent if you're trying to sneak something in the user wouldn't expect. So if you sign up for cat pictures but the service sells off your data to a dating service, that's surprising and requires explicit consent because the user can't be expected to give informed consent to that by just skimming your privacy policy.
Earlier quoted context omitted.
For a site that shows text and images you have a simple solution change the code if(isUserInEU()) showBlobkingPopup();) else loadAllTrackingScripts(); into if(isUserInEU()) loadNonTrackingScripts(); else loadAllTrackingScripts();
Why not directly? solveAllGDPRIssues();
process.exit(1);Blocking access at geographic level across pretty clear signal they don't care about users/readers in those regions (I think it's hard to argue otherwise, the law has been coming for 2 years). Obviously they cater to people interested in local news in those regions. However, I hope they will rectify and allow access again for EU users at some point soon. It seems to go against the idea of a borderless internet, and I…
Too bad that they would actually have to block EU citizens not territories.
Earlier quoted context omitted.
I see this 'VPN' argument a lot, but it's wrong. If the Chicago Tribune tracks users accessing their site through a VPN, without informed consent, they are in violation. Art 3 para 2 in b makes the Regulation apply to them and doesn't make provisions about whether the controller or processor has a way to find out if the behaviour of the data subject takes place within the Union. I don't see any reason for a different…
The relevant language is in recital 24. “Factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.” If the Chicago Tribune doesn't envi…
So the question is - does the Chicago Tribune 'monitor user behavior'. The recitals say about that
In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.
If I look at the list of tracking scripts, it's rather obvious that this is what their 'data processors' are doing. Hence, the territorial scope extends to them.
Earlier quoted context omitted.
I see this 'VPN' argument a lot, but it's wrong. If the Chicago Tribune tracks users accessing their site through a VPN, without informed consent, they are in violation. Art 3 para 2 in b makes the Regulation apply to them and doesn't make provisions about whether the controller or processor has a way to find out if the behaviour of the data subject takes place within the Union. I don't see any reason for a different…
So you're saying that if I block my site to EU IPs, and someone uses a VPN to look like they're coming from the US and bypass that, they can then sue me under the GDPR? No way.
Alternatively there's this: https://eu.usatoday.com/ No ads, no tracking, no cookies, not even Javascript. Just plain HTML+CSS and JPEG images. The whole front page is around 650 KByte, and by far most of this is in the image files. As a result the page looks very clean and loads very fast. This is what all news web sites should look like, not just for EU readers (although I fear that this is just a temporary solutio…
Edit: There many other ads as well not just from taboola.
Well we still have HN, even if non-compliant.
They use Cloudflare which has gone out of their way to be compliant (to the point of offering US citizens and the rest of the world the same protections as EU citizens), and nothing else is included on the page that could track you (check it if you don't believe me).
You can anonymize your profile, you can edit it and you can use one of several services to get your data out. On the whole it is pretty good.