Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

61–70 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#61

Post by throwaway_sb666 »

andai wrote: post #35
whatshisface wrote: post #25

Earlier quoted context omitted.

What's the definition of minimum cookies?

Necessary site functionality, without the spyware. Unfortunately, most websites sites are funded by spyware, so the minimum cookies to keep the internet economy running would have to include the spyware.

Disagree. Let it burn, it's the only way. (change my mind?)

This made me think of the Ukraine war, and how the sanctions may turn out to be a bigger help to climate crisis than any political entity could muster on the basis of the impeding climate snafu. Sometimes radical action is the right course of action; for democracy-(pre)serving reasons our governance systems often inhibit change unless most of the population is rallied around a specific cause as we see with Ukraine. That is the time for radical change to happen, or democracies would never progress. End of sidetrack :)

EDIT: I mean, Strong agree with "Necessary site functionality, without the spyware. ", but disagree with last part

Re: Automating cookie consent and GDPR violation detection

#62

Post by gyulai »

layer8 wrote: post #47
spiderfarmer wrote: post #21

Isn't every webserver that uses the standard access.log format (thus including IP address) already non-compliant?

No. You are allowed to keep such logs for a limited time in order to be able to analyze attacks on your web server.

It's not true that you don't need to worry about GDPR if you're only going to use this information for a limited time to analyze attacks. It's a lot more complicated than that.

Re: Automating cookie consent and GDPR violation detection

#63

Post by rcgs »

throwaway_sb666 wrote: post #23
akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?

As much as this may really damage the sector I work in, I’d cherish the clarity a stance like this could provide.

There are many businesses trying to be compliant whilst maintaining access to metrics their business depends on.

Compliance is very difficult at this time as the legal advice is shifting in different territories and there is conflicting guidance when you start to dig into it.

Id rather see a selection of activities and tactics entirely banned/regulated rather than this directive which is clearly too open to interpretation.

Re: Automating cookie consent and GDPR violation detection

#64

Post by Nextgrid »

andai wrote: post #46
deugtniet wrote: post #19

It's pretty well known that cookie-walls are rife with anti-consumer patterns. Going to something like formula1.com requires me to click more than a 100 times to object to the 'legitimate interests' of as many companies. Which is a pretty terrible anti-pattern when I don't want to be tracked at all... After reading the abstract, it seems the authors try to classify cookies using a special browser extension called "Co…

TrustArc's consent popup disappears instantly on Accept All but shows a loading spinner for "up to several minutes" if you reject cookies. I emailed them about this (because in my experience it's only their software that implements such a dark pattern), they replied "customer misconfigured our software, not our fault" lol.

I wonder if it's a really lazy and terrible attempt at accounting for how long the opt-out request would take. Let's imagine it has no way to know (because of cross-domain restrictions?) whether an opt-out request to a third-party succeeds - in which case it simply waits a reasonable amount of time for the request to complete. Of course, a reasonable time should be a handful of seconds, but I guess at least it makes sense that this is configurable and could explain the problem.

That's about the only non-malicious reason I can think of.

Re: Automating cookie consent and GDPR violation detection

#65

Post by martin_a »

lbriner wrote: post #48
martin_a wrote: post #12

Earlier quoted context omitted.

Dismissing cookie notices is just a sign of companies outsourcing the cost of being privacy friendly. They could just run their own analytics tool and you wouldn't need any notice at all for basic visitor counting. But everybody is craving for that shiny numbers from Google Analytics (for mysterious reasons _perfectly_ integrated into all other Google tools), easy ad money and whatever metric marketing wants to see t…

Please don't make glib statements about what people do and don't want. If you don't want the metrics that you get from something like Google then that's fine but a lot of companies, ourselves included, find the insight massively valuable when we are trying to work out which parts of our product are or aren't working properly. Sure, we could roll our own but that creates its own problems and doesn't exempt you from co…

> doesn't exempt you from cookies notices at all.

Sorry to tell you, but it actually does.

Cookie notices are only necessary when you are transferring data to third-parties and there's no technical reason for that.

Selling my personal data to some analytics company, and you have chosen to do exactly that, is not technically neccessary but a very deliberately made decision by someone.

Re: Automating cookie consent and GDPR violation detection

#67

Post by kmeisthax »

PragmaticPulp wrote: post #28
karaterobot wrote: post #16

Handy guide to GDPR for web developers: * You can't set all your cookies first, then ask permission. * You can't set all your cookies whether the user accepts them or not. * You can't tell users to stop using the website if they don't want cookies. * You can't convince any business owner to follow the above rules.

GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.

As it should be. The G stands for "General", after all.

If engineers wrote the law, it would have no effect, because it would specify the means by which tracking happens (e.g. cookies, HTML5 localstorage) but not the act of tracking itself; and it would be easy to circumvent. Legal documents cannot be precisely specified bundles of English-language-shaped computer code; they need flexibility so that the judge can actually rule things that make sense.

For example... why shouldn't server-side logging be treated as in GDPR scope? It does not matter if cookies weren't used to collect it; an IP address and time pair is already enough information to identify an ISP account and that's usually enough for lawyers to sue you with.

Re: Automating cookie consent and GDPR violation detection

#69

Post by Nextgrid »

gyulai wrote: post #62
layer8 wrote: post #47

Earlier quoted context omitted.

No. You are allowed to keep such logs for a limited time in order to be able to analyze attacks on your web server.

It's not true that you don't need to worry about GDPR if you're only going to use this information for a limited time to analyze attacks. It's a lot more complicated than that.

Could you explain?

Keeping the information for a reasonable amount of time for security or fraud-detection purposes would definitely fall under legitimate interest.

I really don't see any bad outcome happening from doing the reasonable thing. Enforcement is near non-existent (Google and Facebook are still around after all), and when it does happen it still very much skews towards assuming good faith (even when it shouldn't) so you'll definitely be fine even if you get it wrong in which case you'll just be given guidance on how to do better.

Re: Automating cookie consent and GDPR violation detection

#70

Post by layer8 »

gyulai wrote: post #62
layer8 wrote: post #47

Earlier quoted context omitted.

No. You are allowed to keep such logs for a limited time in order to be able to analyze attacks on your web server.

It's not true that you don't need to worry about GDPR if you're only going to use this information for a limited time to analyze attacks. It's a lot more complicated than that.

I didn’t say you don’t need to worry about GDPR, I said that GDPR doesn’t prohibit keeping such logs.
Post reply on HN