Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grindr to be fined almost €10M over GDPR complaint

noyb.eu

Post reply on HN
Print view View original

211–220 of 297 posts

Re: Grindr to be fined almost €10M over GDPR complaint

#211

Post by anticristi »

colejohnson66 wrote: post #159
danielbarla wrote: post #74

Earlier quoted context omitted.

The various dark patterns employed by these consent systems are fairly opaque to anyone who bothers to open them, and are clearly deliberate attempts at maintaining the old status quo of "opt-in by default". Frankly, I am surprised at how few of these fines are flying around, though I am quite happy to hear they _are_ happening. I do get that this type of regulation is very disruptive to many companies, but if they c…

I’ve also wondered why there aren’t “enough” fines. Are the countries just being cautious because they want to establish precedent before going after the “big fish” like Facebook or Google? Or is it something else?

GDPR is pretty recent (2018) and legal opinions on how to apply it (e.g. marketing tracking) are still in the making. I think fines are still applied "slowly" so that the industry has time to change.

Constantly applying fines is not sustainable. You eventually want to get to the point where privacy "just happens".

Re: Grindr to be fined almost €10M over GDPR complaint

#212

Post by Blikkentrekker »

yarcob wrote: post #205
Blikkentrekker wrote: post #186

Earlier quoted context omitted.

That is quite silly if it truly be so — are we moving to the Anglo-Saxon “protected classes” model now? If I understand this correctly, it is not a problem, or a lesser or different problem if such a company share that a client finds being stroked on his earlobes to be highly arousing, or is a big aficionado of the “big black cock”, as those are not “sexual orientations”? That seems like a rather arbitrary distinctio…

I just looked up the relevant section in the GDPR, and it's actually pretty clear: It's section 9 "Processing of special categories of personal data" https://gdpr-info.eu/art-9-gdpr/ > 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identif…

So any data that does not fall under that blacklist is free game?

I still find that quite arbitrary to make that distinction, not to mention the wiggle room it leaves with many of those categories being rather ill-defined.

At what point does an opinion become “political”? what is “racial” an “ethnic origin” is quite open to interpretation; when is a belief “philosophical”?

The way I understand this paragraph, it could conceivably be so that an opinion that, say, consoles are not suited for f.p.s. games could freely be processed, but an opinion that U.K. roads are unsuitable for cycling could not, as the latter would be more easily classified as “political” even though the former could too, and the later could conceivably not as well?

I find that very arbitrary.

Re: Grindr to be fined almost €10M over GDPR complaint

#213

Post by anticristi »

sseneca wrote: post #92
Vinnl wrote: post #16

> Grindr is now relying on a new consent system and alleged "legitimate interest" to use data without user consent. This is in conflict with the decision of the Norwegian DPA, as it explicitly held that "any extensive disclosure ... for marketing purposes should be based on the data subject’s consent". This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options…

It’s almost impressive what these people have created. Now, when I stumble across the rare “Reject All” button on one of those pop ups, I don’t know if they even really mean “all” or if it keeps the trackers under “legitimate interests” enabled because they’re... “legitimate”. So the only safe option ends up being disabling all of them manually, which is absurd when these websites list hundreds and hundreds of tracke…

"I will invade your privacy for the legitimate interest of my AdTech network."

A few more GDPR fines and that hole will also be plugged. :)

Re: Grindr to be fined almost €10M over GDPR complaint

#214

Post by kristofferR »

Majestic121 wrote: post #34
thefounder wrote: post #13

Earlier quoted context omitted.

They have some "special rights" on natural resources. i.e oil, fishery. I think the EU will close that loophole soon.

Is there any reason for the EU to close that loophole now ? It seems to be a pretty good partnership so far, and I did not read anything about a will from either side to change anything about it yet, but I might be misinformed

It's pretty stupid to call it a loophole at all. It's like calling the Xbox Series S a next-gen gaming loophole.

Re: Grindr to be fined almost €10M over GDPR complaint

#215

Post by Vinnl »

ardy42 wrote: post #181
Vinnl wrote: post #16

> Grindr is now relying on a new consent system and alleged "legitimate interest" to use data without user consent. This is in conflict with the decision of the Norwegian DPA, as it explicitly held that "any extensive disclosure ... for marketing purposes should be based on the data subject’s consent". This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options…

> Edit: And worst of all is this very confusing pattern with two columns of toggle buttons, one of which concerns "legitimate interest": https://toot.cafe/@peter/105367185171860458 That's pretty awful, how are you even supposed to interpret that? I'm guessing it's something like "first || !second", because that would be the sleaziest.

I think the left column is the "legitimate interest" version of the cookie type, and the right column the "consent" version (whatever that means). So you can enable and disable either independently, but the former is enabled by default.

Re: Grindr to be fined almost €10M over GDPR complaint

#216

Post by mikestew »

Vinnl wrote: post #16

> Grindr is now relying on a new consent system and alleged "legitimate interest" to use data without user consent. This is in conflict with the decision of the Norwegian DPA, as it explicitly held that "any extensive disclosure ... for marketing purposes should be based on the data subject’s consent". This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options…

Most of those are now off by default, as it should be, except that if you scroll down you still see a number of "legitimate interest" ones enabled, even though you can turn them off manually.

Taking a page from the RealNetworks playbook from twenty years ago, I see. Put the shit you don't care about up top and unchecked, keeping the interesting stuff checked but below the fold.

Re: Grindr to be fined almost €10M over GDPR complaint

#217

Post by rkachowski »

privacylawthrow wrote: post #155
ratww wrote: post #135

Earlier quoted context omitted.

TrustArc's doesn't, or at least didn't the last two times I inspected it deeply. It is possible to reproduce this claim by checking the browser inspector Network tab and by debugging trough the source code: it's just a bunch of setTimeouts. Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal. It's purely a dark pattern.

>Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal. If you did that, users wouldn't be able to see whether their opt out was successful.

users can't see if their opt-out is successful in any case, only that their preference was submitted

Re: Grindr to be fined almost €10M over GDPR complaint

#218

Post by kristofferR »

thefounder wrote: post #13
that_guy_iain wrote: post #10

Earlier quoted context omitted.

Sorry, I meant benefit of EEA over EU membership.

They have some "special rights" on natural resources. i.e oil, fishery. I think the EU will close that loophole soon.

Not having to adopt the Euro is also a "special right".

It's not well known, but all EU countries are required to adopt the Euro (except for Denmark who have a real opt-out). The countries who haven't are using a loophole to bypass the requirement of Euro adoption, by purposefully failing to fulfill some standards.

https://en.wikipedia.org/wiki/Enlargement_of_the_eurozone

Re: Grindr to be fined almost €10M over GDPR complaint

#219

Post by cuu508 »

privacylawthrow wrote: post #155
ratww wrote: post #135

Earlier quoted context omitted.

TrustArc's doesn't, or at least didn't the last two times I inspected it deeply. It is possible to reproduce this claim by checking the browser inspector Network tab and by debugging trough the source code: it's just a bunch of setTimeouts. Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal. It's purely a dark pattern.

>Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal. If you did that, users wouldn't be able to see whether their opt out was successful.

You should be opted out by default. The "Allow All" is the one that could in theory need to make N separate opt-in requests.

Re: Grindr to be fined almost €10M over GDPR complaint

#220

Post by TheCoelacanth »

eplanit wrote: post #190
kristofferR wrote: post #3

GDPR contains special protections for LGBT people, but Grindr shared their users private information with third parties anyway, since they argued that Grindr users might be straight... Pretty shocking and absurd.

Why should one group have special protection relative to another?

They don't. Tracking that someone is straight would be subject to the same rule.
Post reply on HN