Automating cookie consent and GDPR violation detection • Hacker News Board

Re: Automating cookie consent and GDPR violation detection

#31

Post by UnpossibleJim » Mon, Mar 21, 2022, 4:00 PM UTC

shadowgovt wrote: post #20

mariusor wrote: post #10

I doubt that very much. A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. I know I don't.

if your site is running on apache with default logging, or a shared host like DreamHost, you are probably not fully in compliance with the letter of the GDPR since you're logging IP addresses and aren't using them for necessary site operations. ... especially if the log just grows and grows and never rotates. The GDPR is a very wide-reaching law. Of course, there's no real need to worry since, practically speaking, i…

The problem is, they can enforce it on you at any time of their choosing should you do something deemed unpopular or troublesome. While the cudgel was intended for FAANG, the dagger still hangs to stab any indie that gets out of line.

Why would I rely on the kindness of government not to enforce a poorly written law?

Re: Automating cookie consent and GDPR violation detection

#32

Post by robin_reala » Mon, Mar 21, 2022, 4:02 PM UTC

whatshisface wrote: post #25

throwaway_sb666 wrote: post #23

Earlier quoted context omitted.

> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?

What's the definition of minimum cookies?

Obviously there’s no definition, but I’d say a reasonable baseline is when a user expects a stateful interaction on the stateless medium that is the web. So for example, a multistage checkout process.

Re: Automating cookie consent and GDPR violation detection

#33

Post by throwaway_sb666 » Mon, Mar 21, 2022, 4:02 PM UTC

whatshisface wrote: post #25

throwaway_sb666 wrote: post #23

Earlier quoted context omitted.

> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?

What's the definition of minimum cookies?

Those that don't require opt-out according to the law. Too lazy to look up the legal definition right now.

Edit: by law I mean the GDPR.

Edit2: Get rid of the "cookie banner law" entirely, actually make it illegal, but require easily found links to privacy statement

Re: Automating cookie consent and GDPR violation detection

#34

Post by oefrha » Mon, Mar 21, 2022, 4:03 PM UTC

akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

It’s a conference submission. It’s not like the authors are responsible for or affiliated with the usenix.org website. It wouldn’t be ironic if I published a GitHub UI dark patterns study on github.com.

Re: Automating cookie consent and GDPR violation detection

#35

Post by andai » Mon, Mar 21, 2022, 4:03 PM UTC

whatshisface wrote: post #25

throwaway_sb666 wrote: post #23

Earlier quoted context omitted.

> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?

What's the definition of minimum cookies?

Necessary site functionality, without the spyware. Unfortunately, most websites sites are funded by spyware, so the minimum cookies to keep the internet economy running would have to include the spyware.

Re: Automating cookie consent and GDPR violation detection

#36

Post by robin_reala » Mon, Mar 21, 2022, 4:03 PM UTC

goodpoint wrote: post #24

akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

> Did we consider that if everyone is breaking the law, the law itself might need a rework? No, GDPR is doing tons of good works. The whole web is a privacy and security nightmare and we've been tolerating this mess long enough. Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR. The reality is that 99% of websites need zero cookies, zero popups and no loggi…

Exactly, everyone’s still breaking the law, but it’s not a binary thing. They’re breaking the law much less now, and they’re being much better about documenting the ways in which they’re breaking it than they were previously.

Re: Automating cookie consent and GDPR violation detection

#37

Post by zeruch » Mon, Mar 21, 2022, 4:03 PM UTC

whatshisface wrote: post #25

throwaway_sb666 wrote: post #23

Earlier quoted context omitted.

> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?

What's the definition of minimum cookies?

As close to none as possible.

Re: Automating cookie consent and GDPR violation detection

#38

Post by aidos » Mon, Mar 21, 2022, 4:04 PM UTC

goodpoint wrote: post #24

akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

> Did we consider that if everyone is breaking the law, the law itself might need a rework? No, GDPR is doing tons of good works. The whole web is a privacy and security nightmare and we've been tolerating this mess long enough. Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR. The reality is that 99% of websites need zero cookies, zero popups and no loggi…

Sure, but you have to also accept that there are aspects that have made the internet a worse experience without actually improving the situation from a privacy point of view.

Re: Automating cookie consent and GDPR violation detection

#39

Post by geon » Mon, Mar 21, 2022, 4:04 PM UTC

akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

The law is fine. Great even.

It is just that most websites don’t comply and developers misunderstand it.

You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality.

You can not use them to track users on third party sites, or store personally identifiable info without explicit consent, and in that case, denying consent should be as easy, and not affect other functionality, such as blocking content.

Re: Automating cookie consent and GDPR violation detection

#40

Post by zeruch » Mon, Mar 21, 2022, 4:04 PM UTC

deugtniet wrote: post #19

It's pretty well known that cookie-walls are rife with anti-consumer patterns. Going to something like formula1.com requires me to click more than a 100 times to object to the 'legitimate interests' of as many companies. Which is a pretty terrible anti-pattern when I don't want to be tracked at all... After reading the abstract, it seems the authors try to classify cookies using a special browser extension called "Co…

I use UMatrix for this (and NoScript) for the granularity