Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dark patterns after the GDPR: consent pop-ups and their influence

dl.acm.org

Post reply on HN
Print view View original

221–230 of 234 posts

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#221

Post by cdrx »

that_guy_iain wrote: post #220
cdrx wrote: post #219

Earlier quoted context omitted.

Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie. You could a/b test based on even or odd numbered IP address and not require consent to store a cookie. You can pass the referrer around via q…

>Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie. No if a user clicks a button to see the prices at 10 euros but see the prices at 20 euros then that is an issue. That is a rather serious is…

> No if a user clicks a button to see the prices at 10 euros but see the prices at 20 euros then that is an issue.

I agree with you, that is a serious issue. But that issue is caused by your use of a/b testing, and if you solve that issue with a cookie then you need consent.

The ICO PECR guidance explicitly states that you can not rely on the strictly necessary exemption for analytics cookies.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#222

Post by anoncake »

Nextgrid wrote: post #29
vMPQonVtAjLWmr wrote: post #25

Earlier quoted context omitted.

Is the UK still subject to the GDPR now after Brexit?

I believe GDPR is supposed to be implemented in every participating country's legislation, so the GDPR was implemented in UK law and this remains the case even after Brexit. Nothing prevents them from amending that law and repealing the GDPR's effects on it though.

No, regulations are directly applicable. Directives have to be implemented by each country.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#223

Post by anoncake »

xtracto wrote: post #111
MaxBarraclough wrote: post #85

The paper is paywalled. Is it freely available anywhere? edit arxiv's preprint: https://arxiv.org/pdf/2001.02479.pdf Also, off-topic: it's annoying that acm.org has now added a horizontal progress bar, similar to QuantaMagazine.org. I already know how far through the article I am, my browser shows me a scrollbar.

> my browser shows me a scrollbar. It is useful for mobile browser users.

Apparently mobile browser makers disagree.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#224

Post by that_guy_iain »

cdrx wrote: post #221
that_guy_iain wrote: post #220

Earlier quoted context omitted.

>Your understanding of strictly necessary is incorrect. You do not need to a/b test a website for it to function. It is optional. It doesn’t become legal just because your tech stack makes it difficult, or because you engineer the site not to work without a non-essential cookie. No if a user clicks a button to see the prices at 10 euros but see the prices at 20 euros then that is an issue. That is a rather serious is…

> No if a user clicks a button to see the prices at 10 euros but see the prices at 20 euros then that is an issue. I agree with you, that is a serious issue. But that issue is caused by your use of a/b testing, and if you solve that issue with a cookie then you need consent. The ICO PECR guidance explicitly states that you can not rely on the strictly necessary exemption for analytics cookies.

A/b testing is not analytics. Analytics is how many people are using the site not market testing. And it says you can‘t use it for soley analytics, soley being a keyword. The analytics from market research which results in a legal requirement of having to charge the price advertised is not the same as Web Site analytics of how a user used the site. Just which version of the site they used and what legal requirements/contracts are in place.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#225

Post by anoncake »

runeks wrote: post #163

We should standardize the GDPR “pop up” by putting it inside the browser settings, and send a HTTP header that reflects user choice. I see no difference between websites adhering to a HTTP header versus what the visitor chooses in the website’s custom pop up. To start with, we should add to the GDPR regulations that a “Do Not Track” HTTP header requires the website to not display the pop up and interpret it as the vi…

That would be a step back. Not giving consent is the default as is.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#226

Post by anoncake »

slacktide wrote: post #5

GDPR consent buttons and statements are as worthless as the California Proposition 65 cancer warning that gets slapped on every consumer product. Any plugins to strip them out or automatically consent?

> Any plugins to strip them out or automatically consent?

No, that is literally impossible. If you only press the consent button because it's easier, you didn't consent.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#227

Post by anoncake »

josefx wrote: post #48
bombcar wrote: post #18

Earlier quoted context omitted.

EVERY WEBSITE I visit from my location in the USA seems to have these stupid cookie popups. We added one to OUR WEBSITE even though nothing is hosted in the EU - simple cargo-culting "everyone is doing it so we must do it also". I doubt it actually does a @#$@$ darn thing.

> We added one to OUR WEBSITE even though nothing is hosted in the EU Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it. > simple cargo-culting "everyone is doing it so we must do it also". If your site is cargo culting everything it probably also has a ton of third party trackers for the same reason.

> Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it.

No, merely serving pages to the world (that happens to include the EU) does not mean you have to follow the GDPR. That is only the case if you cater to EU residents specifically (e.g. by taking payments in Euros).

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#228

Post by EdwardDiego »

ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

I work in European adtech and the GDPR regulations have meant that a loooot of players had to scramble to remove all the information that was stored in datalakes that could be used to identify you.

So, from a privacy point of view, it's improved the situation. If some DMP has their S3 bucket hacked, then there's less of your personal information being leaked.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#229

Post by asdff »

tomjen3 wrote: post #174
asdff wrote: post #134

Earlier quoted context omitted.

I get some sick satisfaction whenever I mouse over these, right click, and hit "Block element"

I have had some luck just using reader mode. It is not important when I am on my ipad, because I use Safari in private mode and it doesn’t share cookies with other tabs, but this is even easier.

depends on the page, but reader mode can move around images strangely in my experience

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#230

Post by cdrx »

that_guy_iain wrote: post #224
cdrx wrote: post #221

Earlier quoted context omitted.

> No if a user clicks a button to see the prices at 10 euros but see the prices at 20 euros then that is an issue. I agree with you, that is a serious issue. But that issue is caused by your use of a/b testing, and if you solve that issue with a cookie then you need consent. The ICO PECR guidance explicitly states that you can not rely on the strictly necessary exemption for analytics cookies.

A/b testing is not analytics. Analytics is how many people are using the site not market testing. And it says you can‘t use it for soley analytics, soley being a keyword. The analytics from market research which results in a legal requirement of having to charge the price advertised is not the same as Web Site analytics of how a user used the site. Just which version of the site they used and what legal requirements/…

Your understanding of the regulation is wrong, but I’m not going to hammer the point.
Post reply on HN