Isn't every webserver that uses the standard access.log format (thus including IP address) already non-compliant?
Automating cookie consent and GDPR violation detection
21–30 of 252 posts
Re: Automating cookie consent and GDPR violation detection
#22I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.
My guess is that it is not a cost. It is a small annoyance, and I would be delighted for it to be gone. But... I really can't support any argument that inflates the cost of it.
Re: Automating cookie consent and GDPR violation detection
#23Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?
> Did we consider that if everyone is breaking the law, the law itself might need a rework?
Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?
Re: Automating cookie consent and GDPR violation detection
#24Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?
> Did we consider that if everyone is breaking the law, the law itself might need a rework?
No, GDPR is doing tons of good works.
The whole web is a privacy and security nightmare and we've been tolerating this mess long enough.
Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR.
The reality is that 99% of websites need zero cookies, zero popups and no logging of IP addresses. The ones requiring login can set a login cookie without pestering the user.
Re: Automating cookie consent and GDPR violation detection
#25Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?
> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?
What's the definition of minimum cookies?
Re: Automating cookie consent and GDPR violation detection
#26I doubt that very much. A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. I know I don't.
> A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR.
Not true.
I've spent far too much time with expensive lawyers going through the painful details of GDPR compliance and edge cases. If you keep logs at all, anywhere, then technically you could be at risk of crossing the GDPR. Don't assume that you're free and clear because you haven't gone out of your way to add any analytics.
Re: Automating cookie consent and GDPR violation detection
#27Right, as with the cookie laws companies seem to have collectively come to the idea that "they can't catch us all!" So far they seem to be correct. I would really like to see the courts deal a few black eyes over this, I hope this tool can help.
I'm not sure what lessons the rest of the world should have taken from the US's "war on drugs" (or, for that matter, the US's prohibition before it). ... but "If you pass the law that outlaws a wildly-popular behavior, most people will stop that behavior" probably wasn't it. Law can bend behavior on the margins. It just encourages rule-breaking when you try to drive it like a spike through the middle.
Wait, they criminalized it? I thought it was just fines for shitty behavior. Fines for shitty behavior I can get behind. "We were used to getting away with it" is a poor excuse that gets poorer every day. But yeah, making it criminal is too far too fast. Assuming they've actually done that.
EDIT: they haven't, "shadowgovt" just overstated the comparison. No, I do not believe that getting away scot-free with shitty behavior today entitles anyone to get away scot-free with shitty behavior tomorrow.
Re: Automating cookie consent and GDPR violation detection
#28Handy guide to GDPR for web developers: * You can't set all your cookies first, then ask permission. * You can't set all your cookies whether the user accepts them or not. * You can't tell users to stop using the website if they don't want cookies. * You can't convince any business owner to follow the above rules.
GDPR is about far more than just cookies.
Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.
Re: Automating cookie consent and GDPR violation detection
#29I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.
That cost should be paid by the companies forcing pop-ups onto users.
Popups in no way GDPR's fault. The law does not mandates them.
Instead, it's a form of malicious compliance. Companies pester visitors with popup banners that are almost always unnecessary.
E.g. GDPR allows essential cookies e.g. a login cookie containing an encrypted token without any popup. If you want to notify users about it for extra safety you can show a little privacy notice on the login form. No need for popups.
Re: Automating cookie consent and GDPR violation detection
#30The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies.
It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR.
If you can't get that right, frankly I question whether anything you write on the subject is correct.
[0] Directive 2002/58/processing of personal data and the protection of privacy in the electronic communications sector - https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A...