Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear Email Industry, We’ve Got a GDPR Problem

jacquescorbytuech.com

Post reply on HN
Print view View original

191–200 of 215 posts

Re: Dear Email Industry, We’ve Got a GDPR Problem

#191

Post by webbie917 »

seszett wrote: post #22
jmarbach wrote: post #10

Browsing the web in Europe is like experiencing the rebirth of the pop-up ads era. It has lead to compulsory acceptance. This too shall pass. There is a reasonable expectation that when you submit your email to a company in exchange for their service, they will email you communications relating to their products and services.

> There is a reasonable expectation that when you submit your email to a company in exchange for their service, they will email you communications relating to their products and services Certainly not. If I didn't check a box saying "I want to receive commercial emails related to your products and services" I expect not to receive those. I might unsubscribe from the whole thing if I don't have any other means of avoi…

The issue here is "relating to their products and services". Per GDPR, the consent can not be "bundled". When you signup for an account you consent to communications about your account only and things like product updates or tips for using product should be under their own explicit consent.

Most email marketing service providers don't even support multi-interest opt-out page, or charge a lot for configuring your unsubscribe page this way (like a multiple of list size for each option gasp), so this makes it impossible for email recipients to choose what emails types to opt-out of so marketers in turn don't bother to collect unbundled consent.

Comparison of some market leading ESPs (see multi interest opt out row): https://www.bigmailer.io/bulk-email-marketing-services/

Re: Dear Email Industry, We’ve Got a GDPR Problem

#192

Post by iamacyborg »

barrkel wrote: post #118
pteraspidomorph wrote: post #38

Earlier quoted context omitted.

It's very pleasant on QHD. I agree that they probably should have a different sheet for lower resolutions.

In principle, using resolution-independent units like points should be fine; it's using px instead of pt that leads to problems. (And the site is using px; it shouldn't.)

Hey man, I work in email dev, I'm at least a decade behind current web dev standards.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#193

Post by iamacyborg »

rypskar wrote: post #73
arielm wrote: post #41

Earlier quoted context omitted.

Gmail doesn’t (kind of), and that’s a big enough slice of email users these days...

Doesn't gmail load images when the email get to the server and not when the email is opened? (That is at least what some who know more about email than I do say) So the only thing tracking pixel really have shown is if the user uses gmail or not

Nope, the image loads when the email is opened by the unique recipient.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#194

Post by chrismorgan »

snowwrestler wrote: post #176
Nextgrid wrote: post #162

Earlier quoted context omitted.

Incorrect. I guess this must be a lie pushed by bad actors who are inconvenienced by the regulation and want the public to perceive the regulation negatively. You do not need consent for cookies that power basic website functionality or a feature the user is trying to use. So setting a cookie when someone logs in or adds an item to their shopping cart.

See for example this site, which is the privacy regulator in the UK: https://ico.org.uk/ Note that they provide notification of necessary cookies, and default opt-out of analytics cookies. > You do not need consent for cookies that power basic website functionality or a feature the user is trying to use. This is correct, you do not need consent for necessary cookies. You do, however, have to provide notification that…

You do not actually need to provide notification for necessary cookies. See https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... and the following few sections. Most clearly, this paragraph on the ICO’s recommendations (quite unreasonable, in my opinion—if all you’re storing is a necessary session cookie, notifying the user in a non-actionable way is just being foolishly annoying):

> Although the exemption applies to both the provision of information and the gaining of consent, it is good practice to continue to provide clear information about all cookies including those that are strictly necessary, and if personal data is involved then you will be required to do this under the fairness and transparency requirements of data protection law.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#195

Post by icebraining »

iamacyborg wrote: post #185
lmkg wrote: post #181

Earlier quoted context omitted.

You can tracking pixels to track per-user engagement. You can also use tracking links to connect the email address to website activity. As you say, it's possible to use these to track in the aggregate, but many platforms allow tracking by individual. You are correct that the email was already personal data. But, GDPR requires that each new use of data be transparently communicated and legally justified (which may or…

Not some, all email marketers do. There's nothing stopping them either, they're entitled to do so, given they obtain consent for that data processing.

Do they? Remember that under the GDPR, a five-page ToS with a "I consent" button at the end is not considered valid. In particular, the user must consent for each use of the PI separately. I don't remember ever seeing a specific consent box for building an engagement profile.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#196

Post by Qwertious »

giancarlostoro wrote: post #64
isostatic wrote: post #6

"This stressed out a lot of email marketers, who quite rightly realised that the new regulations would have a significant effect on their ability to acquire and market to customers via their email address" "The overwhelming majority of commercial email sent today contains tracking pixels and tracking links, these are used to uniquely identify individuals so that opens and clicks can be correctly attributed to them" G…

> While spammers may have a problem, people don't. Marketing spammers maybe, but now scammers and malware spammers have the floor instead. Laws only stop the law abiding citizens from doing their thing, it sure doesn't stop the criminals from.... being criminals.

Laws don't stop criminals from being criminals (except when they do of course), but it isolates them so they can't easily blend into the crowd of non-abusive individuals.

Plus, if something is illegal there's less likely to be an industry driving down the price of that activity. If something is more expensive and less convenient, then people (including criminals) are less likely to do it.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#197

Post by iicc »

jmarbach wrote: post #10

Browsing the web in Europe is like experiencing the rebirth of the pop-up ads era. It has lead to compulsory acceptance. This too shall pass. There is a reasonable expectation that when you submit your email to a company in exchange for their service, they will email you communications relating to their products and services.

> There is a reasonable expectation that when you submit your email to a company in exchange for their service

By banning consent bundling GDPR is designed to make this exchange of value illegal.

And no, it's not "reasonable" because it leads to situations where the only way to pay for a service is with your PII.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#198

Post by chrismorgan »

barrkel wrote: post #118
pteraspidomorph wrote: post #38

Earlier quoted context omitted.

It's very pleasant on QHD. I agree that they probably should have a different sheet for lower resolutions.

In principle, using resolution-independent units like points should be fine; it's using px instead of pt that leads to problems. (And the site is using px; it shouldn't.)

You are incorrect. All CSS units are defined in a resolution-dependent way. (I think there has only every been one exception to this, an experimental unit `mozmm`, now discontinued, that attempted to be resolution-independent, representing one physical millimetre.) On screen, the px unit is king, being defined however the device chooses to define it—most commonly one or two device pixels. All other units are defined in terms of it: 1in = 96px = 72pt, &c. On print, the ratios are the same, but physical length units actually have meaning now, corresponding to physical measurements—well, maybe they do; in practice browsers play fast and loose with it all, second-guessing the website’s stylesheets all over the place, which is normally a good thing for users because few websites take care for print stylesheets, but is utterly debilitating if you actually care and want precision.

Now the question of what the root font-size is (a unit I like to call “browser em” or “bem”—I’ve never heard anyone else give it a proper name)—that’s a much more interesting question. It’s almost always 16px (I have no stats ready to hand, but I’d suggest >99% of page views), but there are devices out there that have other values, mostly between 13px and 19px, and you can change the value in some browsers also. However, website layouts commonly break if the value is not 16px, if the font sizes are based in bems and media queries in px, or font sizes in px and media queries in bems, and the developers have assumed 16px (which is completely normal). The ideal situation is to use either px everywhere or bem everywhere.

In theory, using relative units everywhere is potentially nicer. In practice, you’re fine using pixel units everywhere.

But 24px is still way too big.

Re: Dear Email Industry, We’ve Got a GDPR Problem

#200

Post by icebraining »

buboard wrote: post #186
TeMPOraL wrote: post #146

Earlier quoted context omitted.

GDPR wants 0 tracking without explicit, informed consent . That's the key thing in this regulation: informed consent. Dealing with people fairly. > EU wants advertising to go back to the popup / animated gifs & flash / interstitial era to maximize clickthroughs in the off-chance one of them is actually interested in your ads. Not true, unfortunately. EU wants the ads to not track people without their explicit, inform…

- users could always install an adblocker if they dont consent. - users could consent once for each tracker if thats what the law cared for. Consenting for each tracker x for each website is purposeful obstruction in order to make advertising optional

> - users could always install an adblocker if they dont consent.

- To consent, one must be informed, so the sites would have to advertise adblockers, why they exist and how can they be used.

- Current adblockers rely on volunteers compiling lists of ads, and sites trying to evade those lists. That's not a reasonable way to ensure a legal right, so sites / networks would have to publish those lists themselves.

- The GDPR is about way more than website access tracking, so you'd still need all the same rules about the rest of the use of personal information. Seems like a duplication of effort and complexity.

> - users could consent once for each tracker if thats what the law cared for.

Just because I'm OK with a network knowing I visit nytimes.com doesn't mean I'm OK with them knowing (and using the information) that I visit pornhub.com. Consent per site is crucial.

Post reply on HN