Automating cookie consent and GDPR violation detection • Hacker News Board

Re: Automating cookie consent and GDPR violation detection

#71

Post by mpweiher » Mon, Mar 21, 2022, 4:18 PM UTC

aidos wrote: post #38

goodpoint wrote: post #24

Earlier quoted context omitted.

> Did we consider that if everyone is breaking the law, the law itself might need a rework? No, GDPR is doing tons of good works. The whole web is a privacy and security nightmare and we've been tolerating this mess long enough. Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR. The reality is that 99% of websites need zero cookies, zero popups and no loggi…

Sure, but you have to also accept that there are aspects that have made the internet a worse experience without actually improving the situation from a privacy point of view.

Yes, there are aspects that have gotten worse, but all those aspects are companies breaking the law in question.

And no, privacy actually is improving.

And enforcement is ramping up.

We still have a way to go, but we're moving in the right direction.

Re: Automating cookie consent and GDPR violation detection

#72

Post by dmitriid » Mon, Mar 21, 2022, 4:18 PM UTC

FreeHugs wrote: post #42

I run a website with a few hundred thousand monthly active users. I get tons of mails from users telling me how much they love it. One unintrusive, smallish Adsense banner pays for everything. For years now, everyone was happy. Now Google sent me an email that they want me to gather user consent before showing Adsense. They offer an automatic consent modal. But the problem with that one is that it not only displays t…

Ah yes. It's the GDPR that's the end, and not the non-compliant and law-breaking implementations from Google and other parasites.

Re: Automating cookie consent and GDPR violation detection

#73

Post by M2Ys4U » Mon, Mar 21, 2022, 4:18 PM UTC

PragmaticPulp wrote: post #28

karaterobot wrote: post #16

Handy guide to GDPR for web developers: * You can't set all your cookies first, then ask permission. * You can't set all your cookies whether the user accepts them or not. * You can't tell users to stop using the website if they don't want cookies. * You can't convince any business owner to follow the above rules.

GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.

The clue's in the name, it's the General Data Protection Regulation.

The idea is to provide a high level of data protection in general.

It's not just an internet/engineering law. It applies exactly the same in an offline setting as it does on the web.

Re: Automating cookie consent and GDPR violation detection

#74

Post by vanviegen » Mon, Mar 21, 2022, 4:18 PM UTC

shadowgovt wrote: post #7

jjoonathan wrote: post #4

Right, as with the cookie laws companies seem to have collectively come to the idea that "they can't catch us all!" So far they seem to be correct. I would really like to see the courts deal a few black eyes over this, I hope this tool can help.

I'm not sure what lessons the rest of the world should have taken from the US's "war on drugs" (or, for that matter, the US's prohibition before it). ... but "If you pass the law that outlaws a wildly-popular behavior, most people will stop that behavior" probably wasn't it. Law can bend behavior on the margins. It just encourages rule-breaking when you try to drive it like a spike through the middle.

Enslaving people used to be wildly popular behavior as well... So do you propose we stop trying to bend society into something less bad?

Re: Automating cookie consent and GDPR violation detection

#75

Post by throwaway_sb666 » Mon, Mar 21, 2022, 4:19 PM UTC

TomasEkeli wrote: post #50

geon wrote: post #39

Earlier quoted context omitted.

The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality. You can not use them to track users on third party sites, or store personally iden…

very much this. I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.

If the law is right, but not possible to enforce, some fixing may be needed

Re: Automating cookie consent and GDPR violation detection

#76

Post by Teever » Mon, Mar 21, 2022, 4:19 PM UTC

lp0_on_fire wrote: post #59

geon wrote: post #39

Earlier quoted context omitted.

The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality. You can not use them to track users on third party sites, or store personally iden…

> developers misunderstand it. Then maybe the law needs some adjusting to make compliance more manageable.

Why?

maybe developers beed some adjusting to make compliance numbers higher.

Re: Automating cookie consent and GDPR violation detection

#77

Post by Nextgrid » Mon, Mar 21, 2022, 4:19 PM UTC

olalonde wrote: post #43

Given the amount of confusion and conflicting interpretations of GDPR we get on HN, I'm not really surprised. Then there's always the vocal minority that is fully convinced that GDPR is very simple and clear.

There's a huge amount of misinformation spread around it, and not to mention existing online information about the earlier and completely stupid "cookie law" is sometimes mistaken for the GDPR.

It doesn't help that the GDPR is only really simple if you don't abuse personal data. It will obviously become very complex when you're hoping to find loopholes do something that the GDPR was fundamentally designed to outlaw, and it just so happens that a large chunk of this site makes their money from this.

Re: Automating cookie consent and GDPR violation detection

#78

Post by robin_reala » Mon, Mar 21, 2022, 4:20 PM UTC

Nextgrid wrote: post #54

aidos wrote: post #38

Earlier quoted context omitted.

Sure, but you have to also accept that there are aspects that have made the internet a worse experience without actually improving the situation from a privacy point of view.

To be fair, the GDPR does outlaw all the things we find annoying with the cookie banners (or rather, data processing consent flows, as they cover more than just cookies). The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead peop…

Billion-dollar fines can only happen if the company in question had a revenue of €25B per year and was hit with the maximum fine. But either way, enforcement is absolutely happening: https://www.enforcementtracker.com/ has over a 1,000 rulings in its DB.

Re: Automating cookie consent and GDPR violation detection

#79

Post by mpweiher » Mon, Mar 21, 2022, 4:20 PM UTC

deugtniet wrote: post #19

It's pretty well known that cookie-walls are rife with anti-consumer patterns. Going to something like formula1.com requires me to click more than a 100 times to object to the 'legitimate interests' of as many companies. Which is a pretty terrible anti-pattern when I don't want to be tracked at all... After reading the abstract, it seems the authors try to classify cookies using a special browser extension called "Co…

> It's pretty well known that cookie-walls are rife with anti-consumer patterns.

Which are all illegal.

The wheels of justice turn slowly, but grind exceedingly fine.

And you can help: if you find an annoying pop up, file a complaint with your local data protection agency.

Re: Automating cookie consent and GDPR violation detection

#80

Post by gyulai » Mon, Mar 21, 2022, 4:21 PM UTC

gyulai wrote: post #62

layer8 wrote: post #47

Earlier quoted context omitted.

No. You are allowed to keep such logs for a limited time in order to be able to analyze attacks on your web server.

It's not true that you don't need to worry about GDPR if you're only going to use this information for a limited time to analyze attacks. It's a lot more complicated than that.

> Could you explain?

> Keeping the information for a reasonable amount of time for security or fraud-

> detection purposes would definitely fall under legitimate interest.

Yes, but not being allowed to collect the data at all is not the only way you can fall foul of GDPR compliance.

E.g. you also have to give the data subjects processes for getting info about what data you have on them, getting it corrected if they want to, getting it deleted if they want to. Those are tied to mandatory maximum response times. You have to have a data processing register that the regulator can ask you to show them. You have to have co-controller or subcontractor agreements in place if third parties get to see the data in any way. -- There's a host of things you have to do.