Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two years in, GDPR defined by mixed signals, unbalanced enforcement

complianceweek.com

Post reply on HN
Print view View original

71–80 of 216 posts

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#71

Post by ratww »

morelisp wrote: post #62
ratww wrote: post #41

Earlier quoted context omitted.

I believe his point is that if the user disabled cookies, there's no point in showing the banner. If you don't show the banner you can't track the user, of course. It's not hard. It's just a matter of checking for navigator.cookieEnabled .

cookieEnabled is not reliable for handling third-party cookies, unless you also load a third-party frame running JS. (And even then it doesn't work like you'd want in many browsers.)

Sorry if I missed something, but AFAIK grandparent wasn't talking about third party cookies, only about having cookies disabled and being unable to store the consent flag, so I don't see how this applies to this specific discussion.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#72

Post by justignoregdpr »

Guys, we have a lot of European customers and we completely ignored GDPR rules. After it was introduced, only 2 potential customers asked us about it and we just moved their emails to trash. Not worth the hassle! There is nothing they can do anyway to force it if you are not living within the EU (unless there is a special agreement between your country and EU). I even know some startups who are located within the EU, but still don't care about GDPR :D

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#73

Post by scrollaway »

microcolonel wrote: post #43
legitster wrote: post #32

Earlier quoted context omitted.

You are allowed a cookie that tracks their opt in to your other cookies, so long as it is anonymous (or so our lawyer tells us). On our site, we ping whether that cookie is set before we load the rest of the cookies.

Is it acceptable to store a cookie that defaults to "false" provided it is generic? That would solve the problem of not being able to detect if cookies are enabled in the browser until you try to store them. added: person down thread indicated that there's an API for determining if cookies are enabled for the host on your page's origin called navigator.cookieEnabled which I am shocked I've not seen nor heard of even…

It is acceptable to use cookies in general as long as they are required for the functionality of the site. This includes logging in, shopping carts, gdpr cookiewalls, ...

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#74

Post by rpastuszak »

MattGaiser wrote: post #65
Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> The rules are very clear once you look past the fear-mongering. Hence the massive debate to this day over the rules.

Sarcastic comments aside, I'd blame adtech for that.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#75

Post by clarry »

Nextgrid wrote: post #18
ashton314 wrote: post #5

We value your privacy. Like, it's valuable. We sell it for money. We're going to nag you until you click this button so we can't get in trouble for profiting off the data you give us. Good legislation is important to let us penalize bad actors—does any one know of any accounts of some bad actors getting stopped by the GDPR? What do you guys think: are there laws that should be in place to incentivize privacy-preservi…

> We're going to nag you until you click this button so we can't get in trouble for profiting off the data you give us. That is explicitly against the regulation. Consent should be freely given otherwise it's invalid. The problem is that there is no enforcement around this (despite it being very easy to detect this behavior at scale by running a web scraper) so they keep doing it and profiting off it.

> Consent should be freely given otherwise it's invalid.

I tried to figure out what this actually means but it's very hazy. A naggy news website isn't performing a contract. Are they provisioning a service (assuming you did not buy or order or subscribe to anything)?

"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

https://gdpr-info.eu/art-7-gdpr/

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#76

Post by bonoboTP »

flemhans wrote: post #52
volak wrote: post #24

I would pay a subscription to a news site if they spent all their time evaluating 2-5 year old events and determining which side was right. 2 years ago comments of "this will only benefit the lawyers" would be -50 points. Turns out... actually yeah.

I thought that’s what everyone thought back then. At least all my friends were like, the lawyers will have a good time and be the only ones benefiting from this

That's a pretty default thing that most educated people know though. Regulation and bureaucracy usually benefit the established behemoths with enough lawyers, while gray zones, sluggish laws or easy processes benefit new players or small ones without all the legal armor.

No wonder that Facebook is lobbying for getting regulated and Microsoft proposed regulating some computer vision uses (faces) etc. Some people of course eat it up and think it's because they are just mature now and understand their responsibility and want to benefit the public etc. In reality it's because they have armies of lawyers who can follow all the legal minutiae, have the internal processes for compliance and documentation, audits etc. Which allow them to do whatever they did before (obviously they lobby for laws that allow their use cases) but make it difficult for others to enter. It's the "kicking the ladder" idea.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#77

Post by Nextgrid »

MattGaiser wrote: post #65
Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> The rules are very clear once you look past the fear-mongering. Hence the massive debate to this day over the rules.

The massive debate is either because of people misunderstanding the rules despite them seeming very clear (functional cookies are allowed and don't require consent/disclosure, and the GDPR is more about just cookies so local storage or browser fingerprinting is also covered so you can't just stalk users without consent because you don't use cookies) or because these people's livelihood depends on being in breach of the GDPR so they try to justify their behavior or spread misinformation.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#78

Post by HissingMachine »

luckylion wrote: post #21
HissingMachine wrote: post #14

This has been a constant headache, not the rules or how to apply it, but our customers still act like there isn't such a thing like GDPR, and actively demand, DEMAND that we put in place functionality that is in clear violation of GDPR, and when you try to inform and explain to them who things work they get mad at me and threaten that they will get a more professional shop to do things for them shrugs

Given that enforcement would have to be stepped up considerably to even be called selective, compliance means your competition has a large advantage.

I'm not going to lie, if one of them switches shop and they make what they asked us, I'm going to report, in Finland law isn't selective even if it isn't enforced.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#79

Post by p_l »

cameronbrown wrote: post #61
lmkg wrote: post #36

Earlier quoted context omitted.

Under PECR, a cookie being essential means necessary to provide the requested service , not necessary to stay in business. If the user wants to view a news article, and you can serve the article without using analytics cookies, then PECR doesn't allow the cookie. (The situation for paywalls is complicated.)

Providing the service assumes staying in business, no?

No, there's no protection for failed business models, as there should not be.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#80

Post by Barrin92 »

ThePhysicist wrote: post #28
moksly wrote: post #6

I work as a developer in the European public sector, we already took privacy and security rather serious because the laws governing it had always been and are still tougher than the GDPR. I actually like that the EU is doing something, and I guess this is the best you get from a bureaucracy, but what it’s changed is that we document everything. Whenever I build anything that moves privacy data, even if it’s just hook…

Not sure why this is getting downvoted, seems to be a perfectly reasonable point?

because there's a rabid anti-regulation and anti-EU bias on this site. Well thought out answers get frequently downvoted while free market platitudes get upvoted.
Post reply on HN