Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

101–110 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#101

Post by Nextgrid »

shadowgovt wrote: post #98
vanviegen wrote: post #74

Earlier quoted context omitted.

Enslaving people used to be wildly popular behavior as well... So do you propose we stop trying to bend society into something less bad?

In my country, we didn't end that practice without a civil war. I think that story is an excellent example of the limits of the coersive power of law. Even though the goal is righteous, the law may be the wrong tool to achieve it. What alternative tools can be deployed on this topic?

The law has yet to be enforced properly and consistently. Enforcing the law would be a good start before considering alternative options.

Re: Automating cookie consent and GDPR violation detection

#102

Post by lp0_on_fire »

Teever wrote: post #76
lp0_on_fire wrote: post #59

Earlier quoted context omitted.

> developers misunderstand it. Then maybe the law needs some adjusting to make compliance more manageable.

Why? maybe developers beed some adjusting to make compliance numbers higher.

Because GDPR has been around for a few years and its still unmanageable. Laws need to be realistic to make compliance easy and widespread. Maybe there needs to be resources for training or something. There are lots of things you can tweak while still getting the benefits.

Re: Automating cookie consent and GDPR violation detection

#103

Post by Nextgrid »

robin_reala wrote: post #78
Nextgrid wrote: post #54

Earlier quoted context omitted.

To be fair, the GDPR does outlaw all the things we find annoying with the cookie banners (or rather, data processing consent flows, as they cover more than just cookies). The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead peop…

Billion-dollar fines can only happen if the company in question had a revenue of €25B per year and was hit with the maximum fine. But either way, enforcement is absolutely happening: https://www.enforcementtracker.com/ has over a 1,000 rulings in its DB.

It's not enough. That link gets posted all the time but it just shows that over 4 years, across all companies, the total fine amount is just over 1Bn. How much does Google or Facebook profit from non-consensual data processing in just a single year?

Re: Automating cookie consent and GDPR violation detection

#104

Post by gyulai »

Nextgrid wrote: post #100
gyulai wrote: post #80

Earlier quoted context omitted.

> Could you explain? > Keeping the information for a reasonable amount of time for security or fraud- > detection purposes would definitely fall under legitimate interest. Yes, but not being allowed to collect the data at all is not the only way you can fall foul of GDPR compliance. E.g. you also have to give the data subjects processes for getting info about what data you have on them, getting it corrected if they w…

> you also have to give the data subjects processes for getting info about what data you have on them Nobody is going to do that for web server logs unless you associate them with user accounts. If it happens once because someone wants to joke around, you can handle it as a one-off. You could also decline unless they can provide a letter from their ISP certifying that the provided IP address is static and has been as…

I quite agree with you that it would be highly unpractical to set up that kind of system around access logs. For that reason, the sensible thing to do is to not have IP addresses in your access log.

Re: Automating cookie consent and GDPR violation detection

#105

Post by Nextgrid »

mpweiher wrote: post #81
jjoonathan wrote: post #4

Right, as with the cookie laws companies seem to have collectively come to the idea that "they can't catch us all!" So far they seem to be correct. I would really like to see the courts deal a few black eyes over this, I hope this tool can help.

> So far they seem to be correct. Not really. Just recently: GDPR enforcer rules that IAB Europe’s consent popups are unlawful https://news.ycombinator.com/item?id=30176712 This is going to require some time, and thus some patience.

I don't agree with the approach for obvious reasons, but he's not entirely wrong either. Even that ruling doesn't change anything - the IAB was fined a token amount, the others get off scot-free and can keep the profits earned over 4 years of illicit data processing.

Re: Automating cookie consent and GDPR violation detection

#106

Post by Nextgrid »

FreeHugs wrote: post #92
slig wrote: post #88

Earlier quoted context omitted.

Most of your users are from EU? If not, just do what big publishers are doing.

What do you mean? Can you give an example?

He's saying to deny access to EU-based users, which will make it very unlikely that any EU-based user will complain, thus (in practice) removing the need for GDPR compliance.

Re: Automating cookie consent and GDPR violation detection

#107

Post by systemvoltage »

Nextgrid wrote: post #77
olalonde wrote: post #43

Given the amount of confusion and conflicting interpretations of GDPR we get on HN, I'm not really surprised. Then there's always the vocal minority that is fully convinced that GDPR is very simple and clear.

There's a huge amount of misinformation spread around it, and not to mention existing online information about the earlier and completely stupid "cookie law" is sometimes mistaken for the GDPR. It doesn't help that the GDPR is only really simple if you don't abuse personal data. It will obviously become very complex when you're hoping to find loopholes do something that the GDPR was fundamentally designed to outlaw,…

> completely stupid "cookie law"

It doesn't take a genius to figure out:

  Before GDPR: No cookie banners
  After GDPR: Cookie banners
Who's to blame is irrelevant. Users don't care and the effects are real whether it is put on directly by companies as an indirect result of GDPR.

Re: Automating cookie consent and GDPR violation detection

#108

Post by systemvoltage »

oneplane wrote: post #14
systemvoltage wrote: post #6

I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.

I wonder what is the GDP cost of millions if not billions of people flushing the toilet every day, often multiple times a day. We can all make silly arguments, just because something requires you to take action, and it might cost money, doesn't mean we therefore have to just let late stage capitalism run wild.

If we didn't flush toilets but all of a sudden because of some law (directly or indirectly), we started flushing toilets; we should be concerned about it. But that's clearly not the case here and your analogy doesn't hold up.

Re: Automating cookie consent and GDPR violation detection

#109

Post by Nextgrid »

systemvoltage wrote: post #107
Nextgrid wrote: post #77

Earlier quoted context omitted.

There's a huge amount of misinformation spread around it, and not to mention existing online information about the earlier and completely stupid "cookie law" is sometimes mistaken for the GDPR. It doesn't help that the GDPR is only really simple if you don't abuse personal data. It will obviously become very complex when you're hoping to find loopholes do something that the GDPR was fundamentally designed to outlaw,…

> completely stupid "cookie law" It doesn't take a genius to figure out: Before GDPR: No cookie banners After GDPR: Cookie banners Who's to blame is irrelevant. Users don't care and the effects are real whether it is put on directly by companies as an indirect result of GDPR.

Cookie banners were a thing before the GDPR - the stupid "cookie law" aka ePrivacy Directive was a thing much earlier on.

The main problem however is the lack of enforcement though. None of these "cookie banners" comply with the GDPR, yet are allowed to proliferate because nobody is cracking down on them, so they're a form of pseudo-compliance that is very effective at swaying public opinion against the GDPR.

Re: Automating cookie consent and GDPR violation detection

#110

Post by andai »

Nextgrid wrote: post #64
andai wrote: post #46

Earlier quoted context omitted.

TrustArc's consent popup disappears instantly on Accept All but shows a loading spinner for "up to several minutes" if you reject cookies. I emailed them about this (because in my experience it's only their software that implements such a dark pattern), they replied "customer misconfigured our software, not our fault" lol.

I wonder if it's a really lazy and terrible attempt at accounting for how long the opt-out request would take. Let's imagine it has no way to know (because of cross-domain restrictions?) whether an opt-out request to a third-party succeeds - in which case it simply waits a reasonable amount of time for the request to complete. Of course, a reasonable time should be a handful of seconds, but I guess at least it makes…

It's entirely possible that it is the result of incompetence rather than malice. Either way, it strongly discourages users from rejecting cookies by wasting their time for 20-30 seconds every time.

Whatever it's doing can simply be done in the background, it doesn't even require UI.

Post reply on HN