Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

91–100 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#91

Post by jjoonathan »

throwaway_sb666 wrote: post #75
TomasEkeli wrote: post #50

Earlier quoted context omitted.

very much this. I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.

If the law is right, but not possible to enforce, some fixing may be needed

Everyone and their dog who has been getting away with bad behavior is going to take that stance as a stalling tactic. It might be true, but either way it's going to have a lot of bad-faith weight behind it, so we need to make our strategy robust to that inevitability.

I'll default to skepticism but keep my mind open to proposals that are concrete and specific.

Re: Automating cookie consent and GDPR violation detection

#92

Post by FreeHugs »

slig wrote: post #88
FreeHugs wrote: post #42

I run a website with a few hundred thousand monthly active users. I get tons of mails from users telling me how much they love it. One unintrusive, smallish Adsense banner pays for everything. For years now, everyone was happy. Now Google sent me an email that they want me to gather user consent before showing Adsense. They offer an automatic consent modal. But the problem with that one is that it not only displays t…

Most of your users are from EU? If not, just do what big publishers are doing.

What do you mean? Can you give an example?

Re: Automating cookie consent and GDPR violation detection

#93

Post by throwaway_sb666 »

litgab wrote: post #83
throwaway_sb666 wrote: post #75

Earlier quoted context omitted.

If the law is right, but not possible to enforce, some fixing may be needed

Like with drug dealers?

Yeah like instead of having them on the street, they could have a shop and you could tax them a lot and make sure people know what they are getting into.

Same with sharing personal data - maybe not a bad parallel :)

Re: Automating cookie consent and GDPR violation detection

#94

Post by miki123211 »

throwaway_sb666 wrote: post #75
TomasEkeli wrote: post #50

Earlier quoted context omitted.

very much this. I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.

If the law is right, but not possible to enforce, some fixing may be needed

IMO, the problem with GDPR is the same problem we have with a lot of European laws. There's nobody who's incentivized to enforce compliance.

If you were able to sue for GDPR violations, either on your own or in a class lawsuit, you would have an incentive to prove that the violation has indeed occurred. As long as your lawyer was working on commission, they would share that incentive.

As it stands, all you can do is file a complaint with your GDPR office and hope it makes a difference. You don't get any money from that, so hiring a lawyer to get such a complaint right is an expense you will not get reimbursed for. More importantly, the person investigating your complaint is probably on a salary, not a commission, so they don't personally care about how successful they are.

Compare that to the ADA[1], for example, where you literally get legal firms looking for disabled Americans, finding places that don't comply with the law and suing them. Enforcement was partially privatized, and the free market, as it often does, found a better and more efficient way of enforcing the law than the government could dream of.

Re: Automating cookie consent and GDPR violation detection

#95

Post by jjoonathan »

mpweiher wrote: post #81
jjoonathan wrote: post #4

Right, as with the cookie laws companies seem to have collectively come to the idea that "they can't catch us all!" So far they seem to be correct. I would really like to see the courts deal a few black eyes over this, I hope this tool can help.

> So far they seem to be correct. Not really. Just recently: GDPR enforcer rules that IAB Europe’s consent popups are unlawful https://news.ycombinator.com/item?id=30176712 This is going to require some time, and thus some patience.

Nice! Hopefully they keep up the pressure.

Re: Automating cookie consent and GDPR violation detection

#96

Post by shadowgovt »

UnpossibleJim wrote: post #31
shadowgovt wrote: post #20

Earlier quoted context omitted.

if your site is running on apache with default logging, or a shared host like DreamHost, you are probably not fully in compliance with the letter of the GDPR since you're logging IP addresses and aren't using them for necessary site operations. ... especially if the log just grows and grows and never rotates. The GDPR is a very wide-reaching law. Of course, there's no real need to worry since, practically speaking, i…

The problem is, they can enforce it on you at any time of their choosing should you do something deemed unpopular or troublesome. While the cudgel was intended for FAANG, the dagger still hangs to stab any indie that gets out of line. Why would I rely on the kindness of government not to enforce a poorly written law?

Your position is mine, which is why I'm surprised at how broad the support for GDPR seems to be around here.

"Broad government power is okay as long as they're clubbing the right people" is certainly a mood.

Re: Automating cookie consent and GDPR violation detection

#97

Post by throwaway_sb666 »

jjoonathan wrote: post #91
throwaway_sb666 wrote: post #75

Earlier quoted context omitted.

If the law is right, but not possible to enforce, some fixing may be needed

Everyone and their dog who has been getting away with bad behavior is going to take that stance as a stalling tactic. It might be true, but either way it's going to have a lot of bad-faith weight behind it, so we need to make our strategy robust to that inevitability. I'll default to skepticism but keep my mind open to proposals that are concrete and specific.

Check my other comment: https://news.ycombinator.com/item?id=30755527

Re: Automating cookie consent and GDPR violation detection

#98

Post by shadowgovt »

vanviegen wrote: post #74
shadowgovt wrote: post #7

Earlier quoted context omitted.

I'm not sure what lessons the rest of the world should have taken from the US's "war on drugs" (or, for that matter, the US's prohibition before it). ... but "If you pass the law that outlaws a wildly-popular behavior, most people will stop that behavior" probably wasn't it. Law can bend behavior on the margins. It just encourages rule-breaking when you try to drive it like a spike through the middle.

Enslaving people used to be wildly popular behavior as well... So do you propose we stop trying to bend society into something less bad?

In my country, we didn't end that practice without a civil war.

I think that story is an excellent example of the limits of the coersive power of law. Even though the goal is righteous, the law may be the wrong tool to achieve it.

What alternative tools can be deployed on this topic?

Re: Automating cookie consent and GDPR violation detection

#99

Post by zelphirkalt »

tschellenbach wrote: post #15

Government regulation that outsources/hides the cost on consumers and businesses needs additional scrutiny. Did anyone analyze the full cost of these regulations? It must be insanely high.

If those businesses had thought of actual consent to their practices before and had acted accordingly, they would not sit on a mountain of tech debt now and their costs of becoming conform with GDPR would be minimal.

Re: Automating cookie consent and GDPR violation detection

#100

Post by Nextgrid »

gyulai wrote: post #80
gyulai wrote: post #62

Earlier quoted context omitted.

It's not true that you don't need to worry about GDPR if you're only going to use this information for a limited time to analyze attacks. It's a lot more complicated than that.

> Could you explain? > Keeping the information for a reasonable amount of time for security or fraud- > detection purposes would definitely fall under legitimate interest. Yes, but not being allowed to collect the data at all is not the only way you can fall foul of GDPR compliance. E.g. you also have to give the data subjects processes for getting info about what data you have on them, getting it corrected if they w…

> you also have to give the data subjects processes for getting info about what data you have on them

Nobody is going to do that for web server logs unless you associate them with user accounts. If it happens once because someone wants to joke around, you can handle it as a one-off. You could also decline unless they can provide a letter from their ISP certifying that the provided IP address is static and has been assigned to them for the requested timeframe, both as a way to verify the legitimacy of the requestor as well as to deter such obviously-malicious requests.

> getting it corrected if they want to

It's web server logs - those are generated automatically based on incoming request data; there's nothing to "correct" there.

> getting it deleted if they want to

Up to you how you want to handle this (this depends on whether you need those logs). If you're keeping them for legitimate interest for a certain period of time, you can just refuse, and you can obviously refuse as above until they go through a (admin-intensive) process of actually proving they have owned this IP address for the requested timeframe.

Post reply on HN