Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear Email Industry, We’ve Got a GDPR Problem

jacquescorbytuech.com

Post reply on HN
Print view View original

111–120 of 215 posts

Re: Dear Email Industry, We’ve Got a GDPR Problem

#111

Post by martin_a »

tiborsaas wrote: post #61
jakobegger wrote: post #16

I think the GDPR is a good opportunity to reflect how much tracking we really need. Tracking has become so ubiquitous, it's become the default to put Google Analytics on a site, to put a tracking pixel into every email, to personalize every link we send out... But so much of that tracking isn't really necessary. I've stopped tracking website visitors and stopped including tracking pixels in emails a few years ago, an…

> But so much of that tracking isn't really necessary. I've just launched my e-commerce platform and I see 34 unique visitors and no sales. Analytics is key to figure out if something is wrong and I'm not talking about the code. > I'd rather focus on making my product better. How do you make it better? Having numbers without analyzing user engagement is shooting in the dark with a shotgun.

> How do you make it better?

How about asking? What about some live chat to gather information?

We have found this to be highly valuable for our shop(s). It automatically pops up after 30 seconds on a product page, on other pages the badge is always present. Lot of good chats, lots of "I'm looking for XY"-feedback that helped us improve.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#112

Post by microcolonel »

iamacyborg wrote: post #85
microcolonel wrote: post #78

Earlier quoted context omitted.

I guess I'm just not that familiar with HTML email anymore in general, and when I do read it I generally do not have images regardless. I always assumed that disabling 1x1px images would be first on the list of mitigations against this technique. I was under the impression that email clients, in addition to an option to block images in general (usually on by default for an address or origin), generally prevented the…

Depending on the platform used to send the email, it's trivial to change that pixel to any other image, ie a brand logo in the template. On the whole, disabling images entirely is the only real defence against email tracking.

Or I guess the mail server could just always precache all images at the time of receipt. Then nothing new happens when the mail is read. I think somebody here is describing GMail's approach that way.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#113

Post by iamacyborg »

Angostura wrote: post #30
Nazzareno wrote: post #20

True that the European user should be able to opt-out just from tracking. Our platform MailUp (ESP) is handling this in the preference center (that can be customized). Here is a sample: https://updates.mailup.com/frontend/preferencecenter/363734/...

By default the European user should be opted out of tracking

Bingo.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#114

Post by mobjack »

microcolonel wrote: post #78
giancarlostoro wrote: post #66

Earlier quoted context omitted.

Do any email clients block tracking pixels? My understanding is that they block images by default but if you choose to view them you will load all the tracking pixels.

I guess I'm just not that familiar with HTML email anymore in general, and when I do read it I generally do not have images regardless. I always assumed that disabling 1x1px images would be first on the list of mitigations against this technique. I was under the impression that email clients, in addition to an option to block images in general (usually on by default for an address or origin), generally prevented the…

You can't tell if an image is a 1x1 pixel until you load it from the server. At that point, the pixel has already done its job.

Most email clients these days don't block images by default unless it ends up in the spam mailbox.

They never embed images directly into emails either.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#115

Post by clinta »

pteraspidomorph wrote: post #35
FeepingCreature wrote: post #12

Earlier quoted context omitted.

I've been very satisfied to the extent to which these popups allow you to not opt in to everything and still use the site. I think the previous popups have trained us to assume that the popups are meaningless and we just have to click yes on everything. This is not so!

As an european who rejects ad trackers on every website, I can confirm that a good 95% of them are correctly implemented and will let you keep browsing. Some of them (usually americans with a poor understanding of why they even implemented that) will kick you out or ask you again on every page load until you accept. We need a standard for managing these controls on the browser side, which major browsers can then impl…

How does that work anyway? If you decline to allow the site to store a cookie on your machine, how does the site know that you already rejected the popup to avoid showing it to you on your next action?

Re: Dear Email Industry, We’ve Got a GDPR Problem

#116

Post by cptskippy »

giancarlostoro wrote: post #71
pteraspidomorph wrote: post #38

Earlier quoted context omitted.

It's very pleasant on QHD. I agree that they probably should have a different sheet for lower resolutions.

This is what kills me about web developers of 2017-2019 (maybe farther back to 2015 or 2016?). We had this awesome hype about supporting mobile resolutions with CSS years ago but now it seems like nobody accounts for the various screen form factors available when designing websites. Like those sites with the overly huge logos that look ridiculous and annoying on 1080p but I'm sure on 2k and higher they look fine. I d…

Everything is mobile first these days

We had to write a line of business app used by office staff opening mail to feed high speed scanners to support mobile first with a responsive design.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#117

Post by iamacyborg »

tiborsaas wrote: post #61
jakobegger wrote: post #16

I think the GDPR is a good opportunity to reflect how much tracking we really need. Tracking has become so ubiquitous, it's become the default to put Google Analytics on a site, to put a tracking pixel into every email, to personalize every link we send out... But so much of that tracking isn't really necessary. I've stopped tracking website visitors and stopped including tracking pixels in emails a few years ago, an…

> But so much of that tracking isn't really necessary. I've just launched my e-commerce platform and I see 34 unique visitors and no sales. Analytics is key to figure out if something is wrong and I'm not talking about the code. > I'd rather focus on making my product better. How do you make it better? Having numbers without analyzing user engagement is shooting in the dark with a shotgun.

Do you need to know that they were 34 unique visitors or would properly anonymised data be enough?

I suspect it would be. The GDPR doesn't say you can't have analytics, but it quite rightly tries to prevent the kind of tracking you're talking about without explicit consent from the user being tracked.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#118

Post by barrkel »

pteraspidomorph wrote: post #38
srbby wrote: post #7

Earlier quoted context omitted.

Font is too big.

It's very pleasant on QHD. I agree that they probably should have a different sheet for lower resolutions.

In principle, using resolution-independent units like points should be fine; it's using px instead of pt that leads to problems.

(And the site is using px; it shouldn't.)

Re: Dear Email Industry, We’ve Got a GDPR Problem

#119

Post by [deleted] »

giancarlostoro wrote: post #74
satanspastaroll wrote: post #69

Earlier quoted context omitted.

Not having marketing spammers is still better than having spammers and scammers

There's usually an unsubscribe button for marketing spam, and if there isn't I usually block their email. You can't do that with scammers / illegal spam.

[deleted]

Re: Dear Email Industry, We’ve Got a GDPR Problem

#120

Post by alkonaut »

maccard wrote: post #70
Angostura wrote: post #26

Earlier quoted context omitted.

> It has lead to compulsory acceptance. No. It leads to non-acceptance by default. If you are seeing forms where you are opted in to data capture by default that isn't a core part of the service, that's a breach.

Great, so how do we fix that and stop them doing it?

Wait for a small number of companies practicing the “by using this service you agree to” thing to be fined a large part of their turnover. After that companies will adapt.

Now we are in a sort of transition phase where laws are written but companies interpret them themselves (badly) and there are few guiding cases.

I look forward to the next phase when the notices will be gone or say “did you know you can enable tracking so we show more relevant ads that we get more money for showing?”. I’ll say no regardless of how much I enjoy that content.

Post reply on HN