Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dark patterns after the GDPR: consent pop-ups and their influence

dl.acm.org

Post reply on HN
Print view View original

211–220 of 234 posts

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#211

Post by TheCoelacanth »

ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

The regulation is not about cookies. It is about tracking.

You do not need a consent popup if you are using cookies for core functionality instead of tracking and you do need a consent popup if you tracking without using cookies.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#212

Post by TheCoelacanth »

planb wrote: post #69
ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

Why is this downvoted? This is exactly what happend. Speaking with non tech savvy users here in Germany, they feel safe and secure on Facebook and fear the „world wide west“ that the open Web has become, where you need to click 20 consent messages on every website without knowing what all that stuff means. This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.

It's a non-sequitur.

GDPR is about data collection, not about cookies.

Using cookies for core functionality instead of tracking does not require consent. Tracking without cookies does require consent.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#213

Post by matthewheath »

cdrx wrote: post #206
that_guy_iain wrote: post #203

Earlier quoted context omitted.

There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.

To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.

> To be legal you need to get the user's consent, upfront, for that tracking.

No, that's just one basis for processing data. Another basis for server-side tracking like this could be legitimate interest. The site will need to provide evidence that they've weighed up the user's interest in this and be able to demonstrate a convincing case in favour of the site.

For example, it could be a legitimate interest to track A/B testing in order to increase shopping cart checkout rates - the legitimate interest is arguably that the site wants to increase its revenues and if it can demonstrate a convincing case for this, it will be allowed by the regulator.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#214

Post by missedthecue »

pixelpoet wrote: post #58

What absolutely infuriates me is this "legitimate interest" crap that is almost always hidden away, and often you have to scroll through literally hundreds of opt-outs with no way to disable them all in a single click. If I'm so damn "legimately interested", why is it on by default and basically impossible to turn off? Find me one person on this earth who is legitimately interested in being tracked by marketing compa…

"Find me one person on this earth who is legitimately interested in being tracked by marketing companies who sell their information on to whatever giant collections"

Sure. I'm legitimately interested in that.

I prefer being marketed to by people who have a good idea about what I would like, rather than getting phone calls at dinner time from people trying to refinance my non-existent mortgage.

And no, I'm not scared about Google knowing details about my life. If a dangerous entity such as a rogue government wants to do me harm, they will be able to find out whatever they want about me whether or not I use a 'secure' browser and search engine.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#215

Post by cdrx »

matthewheath wrote: post #213
cdrx wrote: post #206

Earlier quoted context omitted.

To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.

> To be legal you need to get the user's consent, upfront, for that tracking. No, that's just one basis for processing data. Another basis for server-side tracking like this could be legitimate interest. The site will need to provide evidence that they've weighed up the user's interest in this and be able to demonstrate a convincing case in favour of the site. For example, it could be a legitimate interest to track A…

Storing a cookie which is not strictly necessary to provide the service, requires explicit consent. This is a PECR requirement, not a GDPR one. Tracking the source and campaign of a user between pages is not required to deliver the page.

So you may rely on legitimate interest to process the data, but you need the consent to store the session cookie to collect the data in the first place.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#216

Post by strictnein »

iso1210 wrote: post #198
strictnein wrote: post #78

Earlier quoted context omitted.

It's weird how people keep claiming this. No one says that all sites should honor China's laws for visitors from China. No one claims that all sites should honor Saudi Arabia's laws for visitors from Saudi Arabia. But magically the GDPR must be followed by the entire world if a visitor shows up from France.

USA set the precedent when the FBI arrested Dmitry Sklyarov (a Russian Citizen) for working for a Russian company that apparently, while in Russia, broke US law. It would be like Wendys slagging off the Thai king on a billboard in Dakota, then an employee of Wendys went on holiday to Bangkok and was arrested.

That's actually a counter example to what you're trying to say.

In this case you are arguing that Russian law should follow a citizen, where as the US said it shouldn't. So the "precedent" that was set (if in fact there was one set) in a case from 20 years ago in which the case against the accused was dropped, was actually that your laws don't follow you around.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#217

Post by TeMPOraL »

auganov wrote: post #189
TeMPOraL wrote: post #122

Earlier quoted context omitted.

That point has been beaten to death here in case of GDPR, though. The problem isn't with regulation, but enforcement. The fines aren't applied nowhere near enough, so almost no site cares. The consumer experience being worse is, in a large way, purposeful UX degradation done by the sites themselves. The typical consent popup tries to simultaneously walk the line between "illegal under GDPR" and "just scummy" (often c…

Did I have to deal with these popups before GDPR? No. Was I blocked from accessing many US sites before GDPR? No. If EU cancels GDPR would everything go back to normal? Probably. As an unhappy consumer, that's all I need to know. The cause and effect is pretty obvious here. Sure, some people may be happy (I hope?!) with whatever privacy benefits GDPR is supposed to bring about. But blaming websites for responding to…

That's a bit like complaining about street lights, because thieves now have to accost you, where previously they'd just punch you in the dark and steal your money without you knowing what happened, or who did it.

GDPR forced bad actors on the Internet to document their bad behavior openly. If this made your overall Internet experience worse, it should reveal to you the magnitude of the problem of surveillance capitalism.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#218

Post by that_guy_iain »

cdrx wrote: post #215
matthewheath wrote: post #213

Earlier quoted context omitted.

> To be legal you need to get the user's consent, upfront, for that tracking. No, that's just one basis for processing data. Another basis for server-side tracking like this could be legitimate interest. The site will need to provide evidence that they've weighed up the user's interest in this and be able to demonstrate a convincing case in favour of the site. For example, it could be a legitimate interest to track A…

Storing a cookie which is not strictly necessary to provide the service, requires explicit consent. This is a PECR requirement, not a GDPR one. Tracking the source and campaign of a user between pages is not required to deliver the page. So you may rely on legitimate interest to process the data, but you need the consent to store the session cookie to collect the data in the first place.

If you have A/B testing in place it is strictly necessary to have a session cookie. Otherwise a user could end up in a case where they where in the A group on their first request but their second has them in the B group but the page they visited isn't enabled or displays different content than what they expected to see.

If you have special offers based on the URl they came from then it is strictly necessary to be able to remember where they came from so they get the special offer and don't fall victim to false adverstising.

Strictly necessary means if the website will break in anyway without it.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#219

Post by cdrx »

that_guy_iain wrote: post #218
cdrx wrote: post #215

Earlier quoted context omitted.

Storing a cookie which is not strictly necessary to provide the service, requires explicit consent. This is a PECR requirement, not a GDPR one. Tracking the source and campaign of a user between pages is not required to deliver the page. So you may rely on legitimate interest to process the data, but you need the consent to store the session cookie to collect the data in the first place.

If you have A/B testing in place it is strictly necessary to have a session cookie. Otherwise a user could end up in a case where they where in the A group on their first request but their second has them in the B group but the page they visited isn't enabled or displays different content than what they expected to see. If you have special offers based on the URl they came from then it is strictly necessary to be abl…

Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie.

You could a/b test based on even or odd numbered IP address and not require consent to store a cookie. You can pass the referrer around via query string and not require consent to store a cookie.

However, as you said, there is no enforcement of the regulation so the risk of non-compliance is basically zero :)

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#220

Post by that_guy_iain »

cdrx wrote: post #219
that_guy_iain wrote: post #218

Earlier quoted context omitted.

If you have A/B testing in place it is strictly necessary to have a session cookie. Otherwise a user could end up in a case where they where in the A group on their first request but their second has them in the B group but the page they visited isn't enabled or displays different content than what they expected to see. If you have special offers based on the URl they came from then it is strictly necessary to be abl…

Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie. You could a/b test based on even or odd numbered IP address and not require consent to store a cookie. You can pass the referrer around via q…

>Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie.

No if a user clicks a button to see the prices at 10 euros but see the prices at 20 euros then that is an issue. That is a rather serious issue, if I show you a price and then when it goes the payment processor on the second request that is illegal.

There are many ways of doing things but considering the ICO's list of strictly necessary this falls into it.

Also, I use the session id in my logs so I can debug issues such as the user saw x on page then did y so z happened. This is falls under it as well due to it being required for the operation of the website.

The fact there are other ways of doing things doesn't remove the fact for my way the cookie is strictly necessary. The system will fail. And yes, the tech stack and the way I built it does affect this. Look at the laws and you'll see a number of times where they say something along the lines of "if feasible". The recommendation from ICO is that you don't need to ask for permission for everything and they kinda make a point of saying that as it's annoying as hell for everyone.

Post reply on HN