Two years in, GDPR defined by mixed signals, unbalanced enforcement • Hacker News Board

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#31

Post by ratww » Fri, May 29, 2020, 5:31 PM UTC

microcolonel wrote: post #27

tjoff wrote: post #17

Earlier quoted context omitted.

Again, only because of incompetent and/or immoral developers.

How else can you even store a consent for cookies/localStorage? You can go around calling people immoral and incompetent, but what is the actual way to ask for permission to store data? If your contention is that it is immoral or incompetent to store any data except through some specific user interaction related to those data, sure that's an opinion. But if your job is literally "tell me which other pages users go to…

> How else can you even store a consent for cookies/localStorage?

You said "the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog".

But if cookies are disabled, then there's no point in asking for consent. There should be no cookie banner in this case.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#32

Post by legitster » Fri, May 29, 2020, 5:32 PM UTC

microcolonel wrote: post #16

tjoff wrote: post #11

Earlier quoted context omitted.

Disrespectful web developers have become the bane of my life. Be thankful that GDPR exposes them, and look for alternatives.

Setting aside GDPR for a moment, the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog.

You are allowed a cookie that tracks their opt in to your other cookies, so long as it is anonymous (or so our lawyer tells us).

On our site, we ping whether that cookie is set before we load the rest of the cookies.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#33

Post by hadrien01 » Fri, May 29, 2020, 5:32 PM UTC

umvi wrote: post #22

Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

Your site can be ad-supported, without GDPR popup, as long as you don't track your users to display those ads. You could even have relevant ads by using keywords instead of user data.

That's what the NYT has done, and they've seen their revenue grow: https://news.ycombinator.com/item?id=18920079

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#34

Post by Tomte » Fri, May 29, 2020, 5:33 PM UTC

SpicyLemonZest wrote: post #23

Nextgrid wrote: post #9

Earlier quoted context omitted.

The majority of these aren't actually compliant. Tracking should be opt- in and consent should be freely given . If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach. A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either. These websites can be detected very easily…

I've seen a lot of people say this, but I'm just not convinced it's actually the law. It's not obvious to me that analytics cookies categorically can't be essential or that "freely given" implies strict UI neutrality between accepting and declining.

Yesterday the highest German court (BGH) ruled that "default accept" in cookie dialog boxes is illegal.

It was a pre-GDPR case, but the court said it interpreted the them-in-force law in a GDPR-friendly way.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#35

Post by joering2 » Fri, May 29, 2020, 5:33 PM UTC

Nextgrid wrote: post #13

stevenbruce569 wrote: post #8

I'm happy to see this as the top post on Hacker News, though would wonder if anyone would be able to provide me with a summary of the article since $399 is a bit steep for me (as in, I can afford it, but it's obviously WAY too much for what's promised by the title). I'd also be interested in case anyone has any thoughts on what the short or long-term outcome of the situation would be. Come to think of it, I'd like it…

At the moment, lawyers and all the scummy industry around the GDPR (whether it's advice/consulting or "consent management") are indeed the only ones making the money. There is very little enforcement and flawed solutions from the aforementioned industry are allowed to proliferate despite not actually being compliant (the majority of "consent management" solutions are in breach, so they are making money while not even…

Another good page with stats [1] including this:

$63 million in fines issued

$57 million of that issued to Google

[1] https://www.varonis.com/blog/gdpr-effect-review/

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#36

Post by lmkg » Fri, May 29, 2020, 5:33 PM UTC

shadowgovt wrote: post #26

Nextgrid wrote: post #9

Earlier quoted context omitted.

The majority of these aren't actually compliant. Tracking should be opt- in and consent should be freely given . If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach. A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either. These websites can be detected very easily…

> A lot of websites also consider analytics cookies as essential For a lot of websites, they are.

Under PECR, a cookie being essential means necessary to provide the requested service, not necessary to stay in business. If the user wants to view a news article, and you can serve the article without using analytics cookies, then PECR doesn't allow the cookie. (The situation for paywalls is complicated.)

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#37

Post by av501 » Fri, May 29, 2020, 5:33 PM UTC

Nothing says GDPR is something that can't be improved upon. Better enforcement, refinement of laws, everything is possible. It has to begin somewhere and that beginning is rarely perfect. Every failure is also an opportunity to learn what to do better. As some other people have commented, the intent is right, the execution has to be improved. Edit: Fixed grammar and some words

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#38

Post by [deleted] » Fri, May 29, 2020, 5:34 PM UTC

umvi wrote: post #22

Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

[deleted]

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#39

Post by lucassen » Fri, May 29, 2020, 5:34 PM UTC

tjoff wrote: post #17

microcolonel wrote: post #16

Earlier quoted context omitted.

Setting aside GDPR for a moment, the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog.

Again, only because of incompetent and/or immoral developers.

what are you referring to? I fear I am one of these incompetent devs since I don’t understand the implied transgression.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#40

Post by microcolonel » Fri, May 29, 2020, 5:34 PM UTC

ratww wrote: post #31

microcolonel wrote: post #27

Earlier quoted context omitted.

How else can you even store a consent for cookies/localStorage? You can go around calling people immoral and incompetent, but what is the actual way to ask for permission to store data? If your contention is that it is immoral or incompetent to store any data except through some specific user interaction related to those data, sure that's an opinion. But if your job is literally "tell me which other pages users go to…

> How else can you even store a consent for cookies/localStorage? You said "the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog" . But if cookies are disabled, then there's no point in asking for consent. There should be no cookie banner in this case.

> But if cookies are disabled, then there's no point in asking for consent.

But the only way to determine if cookies are actually disabled in the browser is to attempt to store cookies, which is the thing you're asking consent for.