81–90 of 252 posts
Right, as with the cookie laws companies seem to have collectively come to the idea that "they can't catch us all!" So far they seem to be correct. I would really like to see the courts deal a few black eyes over this, I hope this tool can help.
Not really. Just recently: GDPR enforcer rules that IAB Europe’s consent popups are unlawful https://news.ycombinator.com/item?id=30176712
This is going to require some time, and thus some patience.
Handy guide to GDPR for web developers: * You can't set all your cookies first, then ask permission. * You can't set all your cookies whether the user accepts them or not. * You can't tell users to stop using the website if they don't want cookies. * You can't convince any business owner to follow the above rules.
GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.
It's designed to be vague because it covers intent and outcomes more than specific technical means of achieving them. This ensures the law doesn't need updating every time there's some new variant of local storage, new browser fingerprinting vector, etc and also to prevent offenders from trivially working around it using a technicality.
Similarly, enforcement will also be much more about intent and outcomes than any specific technical means (well that's the theory - in practice neither is being enforced right now). Nobody will enforce it based on some technicalities, they'll enforce it based on outcomes - if you collect personal data and use it to track a user without an appropriate legal basis (in this case, it should usually be consent), you'll be in trouble regardless of whether you use a cookie, a browser fingerprint, or even just save whatever search queries they type and use that as a way to reidentify them. Conversely, nobody is going to go after you if you set a session cookie to persist a login or shopping cart.
Earlier quoted context omitted.
very much this. I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.
If the law is right, but not possible to enforce, some fixing may be needed
Earlier quoted context omitted.
> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?
As much as this may really damage the sector I work in, I’d cherish the clarity a stance like this could provide. There are many businesses trying to be compliant whilst maintaining access to metrics their business depends on. Compliance is very difficult at this time as the legal advice is shifting in different territories and there is conflicting guidance when you start to dig into it. Id rather see a selection of…
In this case it's even simpler since a software company would like be able to develop a new product with hopefully more value to society than the vast majority of data collecting companies provide. I'm also not too afraid for tech workers being able to find other jobs, although I'm sorry for any other collateral damage.
Earlier quoted context omitted.
That cost should be paid by the companies forcing pop-ups onto users. Popups in no way GDPR's fault. The law does not mandates them. Instead, it's a form of malicious compliance. Companies pester visitors with popup banners that are almost always unnecessary. E.g. GDPR allows essential cookies e.g. a login cookie containing an encrypted token without any popup. If you want to notify users about it for extra safety yo…
I'm not sure it's malicious compliance. When you are threatened with massive fines for non-compliance but you aren't told explicitly about how to solve it other than, "A cookie notice would be a way of complying", everyone will use a cookie notice.
Good news (for the companies): GDPR enforcement has and continues being laughable, so you don't have to worry either way.
Earlier quoted context omitted.
It's not true that you don't need to worry about GDPR if you're only going to use this information for a limited time to analyze attacks. It's a lot more complicated than that.
I didn’t say you don’t need to worry about GDPR, I said that GDPR doesn’t prohibit keeping such logs.
Earlier quoted context omitted.
Dismissing cookie notices is just a sign of companies outsourcing the cost of being privacy friendly. They could just run their own analytics tool and you wouldn't need any notice at all for basic visitor counting. But everybody is craving for that shiny numbers from Google Analytics (for mysterious reasons _perfectly_ integrated into all other Google tools), easy ad money and whatever metric marketing wants to see t…
Please don't make glib statements about what people do and don't want. If you don't want the metrics that you get from something like Google then that's fine but a lot of companies, ourselves included, find the insight massively valuable when we are trying to work out which parts of our product are or aren't working properly. Sure, we could roll our own but that creates its own problems and doesn't exempt you from co…
As a user, I don't want to be spied on so that you can "improve" your product aka make it more addictive or refine your dark patterns. I definitely don't want Google spying on me to help you achieve that goal either.
The GDPR making it harder for you to do this means it's working as intended and I'm very glad to have it as a user.
I run a website with a few hundred thousand monthly active users. I get tons of mails from users telling me how much they love it. One unintrusive, smallish Adsense banner pays for everything. For years now, everyone was happy. Now Google sent me an email that they want me to gather user consent before showing Adsense. They offer an automatic consent modal. But the problem with that one is that it not only displays t…
Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?
> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?
No, if you show a cookie banner your users do not opt-in. So a cookie banner is pointless since it doesn't actually give you permission to store cookies you couldn't store before. So we already have the law, we just don't enforce it.
I doubt that very much. A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. I know I don't.
> A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. Not true. I've spent far too much time with expensive lawyers going through the painful details of GDPR compliance and edge cases. If you keep logs at all, anywhere, then technically you could be at risk of crossing the GDPR. Don't assume that you're free and clear b…
Keep logs for a reasonable amount of time (90 days) and you'll be fine.
Well, given the current state of GDPR enforcement, you'll be fine whatever you do. But lawyers are going to lawyer and consent management platforms will be delighted to scare you into buying their "solution", even if nitpicking by bringing up edge-cases that are unlikely to occur and for which no case law exists nor will ever exist.