Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

French watchdog fines Google, Amazon for breaching cookies rules

fr.reuters.com

Post reply on HN
Print view View original

71–80 of 144 posts

Re: French watchdog fines Google, Amazon for breaching cookies rules

#71

Post by Nextgrid »

jraph wrote: post #48
SiempreViernes wrote: post #10

""" When a user visited the page google.fr, an information banner displayed at the bottom of the page, with the following note “Privacy reminder from Google”, in front of which were two buttons: “Remind me later” and “Access now”. This banner did not provide the user with any information regarding cookies that had however already been placed on his or her computer when arriving on the site. The information was also n…

> Could someone try standing with a sign saying "A reminder from me" in the google offices reception for 2 minutes and then walk out with whatever wasn't bolted down to see if they themselves consider that an adequate way to ask for consent? That would be hilarious. But I think they know what they are doing (i.e. using dark patterns). I've seen this banner, knew it was related to the RGPD but haven't figured out how…

> haven't figured out how to opt out and to not accept

There doesn't seem to be an easy way. A lot of their proposed opt-outs rely on either disabling cookies browser-wide, installing an extension or creating/signing into an account and customizing your advertising preferences there (which means providing them even more info as part of the account creation and relying on their good faith to actually opt you out).

To the best of my knowledge none of these things are compliant with the GDPR:

* consent must be granular, so browser-wide cookie-blocking doesn't comply because disabling cookies entirely means you lose functionality (the GDPR mandates that you can opt-out of non-essential tracking but retain all other functionality)

* mandating that people register for an account might run afoul of the "data minimization" principle (among others), meaning that you must collect the minimum amount of data to fulfil the required purpose; asking people to register/sign into an account (thus providing even more information) just to opt-out of non-essential tracking seems non-compliant

* consent must be opt-in (seems like cookies were placed before the user explicitly agreed to it)

* it must be as easy to opt-out as it is to opt-in, yet in Google's case the opt-in is one-click away (though it doesn't matter since apparently they set cookies even before the user clicks that) but opt-out is way more involved (and relies on reconfiguring the browser)

Re: French watchdog fines Google, Amazon for breaching cookies rules

#72

Post by Bayart »

I've never managed to find the place where to refuse consent on Google's sites. Some try to make it particularly difficult, but Google is outright malevolent when it comes to this. Fortunately, that only happens when I'm on a machine that's not mine or on a browser I use specifically for bad actors. On my main machine uMatrix does all the heavy lifting of shutting the tracking down.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#73

Post by Nextgrid »

dalbasal wrote: post #63

I have mixed feelings. On one hand, the data harvesting targeted by cookie laws and associated privacy stuff is important and legislators/regulators are right to target it. OTOH, effectiveness is pretty marginal. There have been some (minor) gains on disclosure. Somewhat better progress on data selling/sharing/security. But, no real gains on consent, which is a big part of the regulatory effort and this specific case…

> no real gains on consent, which is a big part of the regulatory effort and this specific case

Consent is regulated under the GDPR and the majority of consent banners/popups you see today are not compliant. For example, the regulation explicitly mandates that pre-ticked checkboxes are not compliant and that it must be as easy to accept than to decline.

According to the article, this fine is for a breach of the ePrivacy rules (which is the earlier - and somewhat stupid - "cookie law") which exclusively cares about cookies as opposed to the broader goal of the GDPR. On the plus side, enforcement of ePrivacy might suggest that we'll see enforcement of the GDPR too, and that's great news.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#74

Post by gpderetta »

swebs wrote: post #64
gpderetta wrote: post #8

Earlier quoted context omitted.

I did set DNT but I'm still getting tracked. I do not want to disable all cookies, I'm perfectly happy to use credential cookies or a shopping cart, I do not want to disable everything indiscriminately. Also I shouldn't have to out out.

>Also I shouldn't have to opt out Actually, the law says the tracking cookies have to be opt in, which is why the pop ups are so aggressive and undismissable in the first place.

of course. I'm complaining about the practical implementations and the suggestion to just disable cookies.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#75

Post by Nextgrid »

swebs wrote: post #64
gpderetta wrote: post #8

Earlier quoted context omitted.

I did set DNT but I'm still getting tracked. I do not want to disable all cookies, I'm perfectly happy to use credential cookies or a shopping cart, I do not want to disable everything indiscriminately. Also I shouldn't have to out out.

>Also I shouldn't have to opt out Actually, the law says the tracking cookies have to be opt in, which is why the pop ups are so aggressive and undismissable in the first place.

Pop-ups being aggressive/undismissable is in breach of the GDPR, so given enough enforcement the problem will self-resolve. These fines are a great first step I'd say (though long overdue).

Re: French watchdog fines Google, Amazon for breaching cookies rules

#78

Post by SiempreViernes »

Bayart wrote: post #72

I've never managed to find the place where to refuse consent on Google's sites. Some try to make it particularly difficult, but Google is outright malevolent when it comes to this. Fortunately, that only happens when I'm on a machine that's not mine or on a browser I use specifically for bad actors. On my main machine uMatrix does all the heavy lifting of shutting the tracking down.

Untill they get fined into compliance, the way google wants you to do it is by making smurf accounts on their service and set the choices per account.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#79

Post by aenario »

y04nn wrote: post #53
aenario wrote: post #13

Earlier quoted context omitted.

Not quite sure if this is sarcasm ? The do not track header is about 10 years old, ans was promptly ignored by all websites DNT: 1 DNT: 0

DNT is too simple, there should be new better standard integrated in web browsers. The never ending popups with absolutely 0 constancy across sites is atrocious, moreover if I rejected a cookie for a domain on site A I will be prompted on site B if I want to reject it again. For every domain that wants to create cookies, I should be prompted by the browser (like I allow camera access) if I authorize it to do so, we c…

Ultimately the only cookie an users will willingly accept is the sessionid/rememberme. And the "remember me" checkbox is consent enough under the GDPR.

Behing all the legalese and marketing-speach, all the other purposes boils down to :

    - We are too lazy to setup a matomo, so we are giving google your browsing pattern. 

    - FB is forcing us, so we can pay ever so slightly less for ads

    - Google is offering to tell us your sex and age

    - If we dont track you, we will show you a viagra ad.

    - Through 4 intermediaries, we can pay this totaly-objective-blog which sent you here.
I'd love to hear from someone with a complex cookie consent pop-up, but i'd bet there is about 80% "accept all" (because the users have been trained to do it) 19% "reject all", and no-one is mixed.

So the do-not-track would have been accurate enough.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#80

Post by aweb »

sirk390 wrote: post #67

Unfortunately, the CINL here is not protecting users. Nobody wants those annoying Cookie reminders. I believe this is just a form of taxation that they are not able to get in another way.

It's CNIL.

Yes, it's about user protection because it was unclear that a popup was gathering consent to be tracked, and impossible to refuse to give it.

What more proof do you need that this is for users? Do you think the French government has to beg for its budget from private companies?

Post reply on HN