Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA goes into effect January 1, but nobody’s sure how the new rules work

latimes.com

Post reply on HN
Print view View original

71–80 of 129 posts

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#71

Post by ailideex »

alkonaut wrote: post #69

Regarding the GDPR: > 95% of users choose to be tracked in exchange for access to websites and services The GDPR explicitly disallows the practice of conditioning access to a site or service on acceptance. Without that it would be rather useless. Once that bit is also enforced (current fines for violation sadly week focused on poor data safety measures and similar) I think the online ad landscape actually may start t…

So if I run an online shop - and someone does not accept cookies - I still have to make it work for them somehow without cookies (or any equivalent technology)? Or am I misreading this? And if I'm not misreading this - how would you approach it?

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#72

Post by throwaway2048 »

rudedogg wrote: post #45

> The CCPA only applies to companies with more than $25 million in revenue or access to the personal information of more than 50,000 people. This is refreshing, I wish GDPR had a revenue threshold like this.

It has an employee threshold, which is largely the same thing.

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#73

Post by lidHanteyk »

kaikai wrote: post #37
weaksauce wrote: post #32

Earlier quoted context omitted.

> This single state contains Silicon Valley and is 14% of the US economy california is the sixth largest economy in the world.

Those two statements aren't mutually exclusive

Yeah, but this is the statement that puts into sharp relief what's going on: This is a trade dispute between two of the Top 10 Economic Powers, more or less, and it can't really be adjudicated in a way that the USA can take advantage of. The USA's primary establishment of data abuse is institutionalized but not written into law, and no legislator would dare do such a thing. California is doing what they have always done in these situations; they are demanding a better quality of life for their citizens, and they know that the USA has no reason to object other than corruption and aristocracy.

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#74

Post by moomin »

erik_seaberg wrote: post #33
moomin wrote: post #25

Earlier quoted context omitted.

It’s just a passive-aggressive hissy fit. The cost of writing the middleware to write out your angsty nonsense is higher than the cost of writing the middleware to just remove all cookies from every request. The EU detection logic is the same in both cases.

GDPR has a lot of burdensome requirements, like hiring a commissar and multi-month government review periods before features launches. Do not bet 21M USD that merely deleting cookies and logs will get you anywhere near compliance.

I'm not sure how serving up a custom page to EU addresses solves that problem either, though, so we come back to equivalence.

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#75

Post by alkonaut »

ailideex wrote: post #71
alkonaut wrote: post #69

Regarding the GDPR: > 95% of users choose to be tracked in exchange for access to websites and services The GDPR explicitly disallows the practice of conditioning access to a site or service on acceptance. Without that it would be rather useless. Once that bit is also enforced (current fines for violation sadly week focused on poor data safety measures and similar) I think the online ad landscape actually may start t…

So if I run an online shop - and someone does not accept cookies - I still have to make it work for them somehow without cookies (or any equivalent technology)? Or am I misreading this? And if I'm not misreading this - how would you approach it?

No. Things you need to do to make the site/service function at all such as your login cookies or shopping carts don’t count. Non essential cookies is what it’s about.

Sadly, some sites seem to interpret that (incorrectly) as “well out business is to show news paid for by ads so the ad network cookies are essential”. These are the players I wish would be fined out of business.

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#76

Post by ailideex »

alkonaut wrote: post #75
ailideex wrote: post #71

Earlier quoted context omitted.

So if I run an online shop - and someone does not accept cookies - I still have to make it work for them somehow without cookies (or any equivalent technology)? Or am I misreading this? And if I'm not misreading this - how would you approach it?

No. Things you need to do to make the site/service function at all such as your login cookies or shopping carts don’t count. Non essential cookies is what it’s about. Sadly, some sites seem to interpret that (incorrectly) as “well out business is to show news paid for by ads so the ad network cookies are essential”. These are the players I wish would be fined out of business.

Just for interest sake, do you ever read news on the internet, and if so how do you pay for it?

I personally read a lot of news online, most of it is such utter trash that I would not want to pay for it. I have paid for some specific sites intermittently - currently I pay about $20 USD a month to one specific content creator that produces news content - but that is mostly because it is rather niche news that nobody else (that I know of) is reporting on. For the rest of the news I consume I feel that it is of such a low quality that the ad revenue is all they deserve.

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#77

Post by gojomo »

Which will win the crown for destroying more Californian livelihoods & wasting more citizen time in 2020, CCPA or AB5?

(AB5 is the anti-freelancing bill whose intended targets, Uber & Lyft, may escape its application, while many other California freelancers have their traditional contract work patterns made illegal.)

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#78

Post by lidHanteyk »

Rebelgecko wrote: post #70
lidHanteyk wrote: post #68

Earlier quoted context omitted.

Yeah, that's basically how it should happen. In California, there's ample precedent for taking products off of the market when they're shown to harm consumers, and if that happens to kill off manufacturers who aren't diversified, then so be it. Are you really going to be sad if Facebook can't survive CCPA?

On the other hand, we also have things like Prop 65 warnings that have become so commonplace that they don't really impart useful information. Any useful signal is totally overwhelmed by noise. Putting the same warning on a restaurant that serves french fries and a pack of cigarettes diminishes the usefulness of the warning (unless parking garages, coffee, and fried food are actually significant carcinogens?)

CCPA isn't just about warnings, though. CCPA also affects the data-harvesting abilities of businesses, and requires that a business be prepared to explain which personal information is stored and for what purpose.

I suppose that, to draw a better analogy with Prop 65, the requirements of Prop 65 did supposedly cause some manufacturing materials, certain dyes, rubbers, foams, and plastics, to be drastically removed from the marketplace. The story of lead alone is worth considering; as usual, lead was in the pipes. [0] We are not expecting a wave of cookie warnings, and indeed CCPA's language doesn't allow for it. Some businesses will have to alter their practices; some products may have to be withdrawn from the market entirely. The worry that children might get used to clicking through EULAs and giving away their data has already been shown true by the previous generation of Internet users; at this point, we are merely trying to curb the damage continuing to be dealt and done.

And remember: For every ingredient that needs a warning label, that ingredient also can't be dumped into streams or rivers. It's not just about a prettier warning label on the product, but about real improvements to the manufacturing process.

[0] https://digitalcommons.law.ggu.edu/cgi/viewcontent.cgi?artic...

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#79

Post by SpicyLemonZest »

alkonaut wrote: post #69

Regarding the GDPR: > 95% of users choose to be tracked in exchange for access to websites and services The GDPR explicitly disallows the practice of conditioning access to a site or service on acceptance. Without that it would be rather useless. Once that bit is also enforced (current fines for violation sadly week focused on poor data safety measures and similar) I think the online ad landscape actually may start t…

I dunno, man. As you mentioned, all of the people who implement or enforce GDPR compliance seem to think that "our business model relies on ads" is a sufficient reason to require tracking. Maybe the regulators are just biding their time before pouncing, but I'm not sure why they'd want to do that or what they're waiting for after a year and a half. It seems more likely that GDPR as an ad industry killer was just a piece of HN lore that didn't end up panning out.

Re: CCPA goes into effect January 1, but nobody’s sure how the new rules work

#80

Post by cyphar »

dependenttypes wrote: post #52
ailideex wrote: post #38

I'm not confident that this is a good thing after the mess that resulted me in having to navigate dozens of cookie popups on most days.

Never understood the cookie popups mess. I remember back in the ages of internet explorer it showed a popup when a site tried to use cookies, why do the sites need to implement the cookie popups rather than let the users configure it in their browsers?

It's a classic example of a legislative loophole. What the cookie law was actually trying to do was provide a way for users to opt-out of cookie-based tracking. But, someone figured out that if you just ask for permission to use cookies (for any reason) and refuse service if the opt-out, you'd still be following the letter of law (but not the intent).

Arguably, this is one of the reasons why the GDPR was necessary.

Post reply on HN