Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

151–160 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#151

Post by jeroenhd »

PragmaticPulp wrote: post #28
karaterobot wrote: post #16

Handy guide to GDPR for web developers: * You can't set all your cookies first, then ask permission. * You can't set all your cookies whether the user accepts them or not. * You can't tell users to stop using the website if they don't want cookies. * You can't convince any business owner to follow the above rules.

GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.

The GDPR is far from vague, the complications come from the legalese that was used to write it. Engineers aren't lawyers and vice versa. You wouldn't want to develop software thrown together by lawyers, and lawyers wouldn't want to work on law written by engineers.

It's "vague" on purpose. Had the GDPR banned cookies, companies would have switched to fingerprinting. Had the GDPR banned JS tracking, Google would've pushed Dart to Chrome. It's written that way so that companies can't think of loopholes because of the language used.

Most (European) law is written quite vaguely. The vagueness allows judges to make the right call rather than become law robots. Instead of specifying concrete limits, the law refers to the current state of the art. If you let the law decide what safeguards are or aren't appropriate, we'd be using 3DES and MD5 to this day, because that's what the law says.

We've seen what the EU does when it tries to lay down more concrete rules: they're trying to force the EU to manage certificate authorities for browsers, which is obviously a terrible idea. Crap like that is why we need vague laws.

Re: Automating cookie consent and GDPR violation detection

#152

Post by throwaway_sb666 »

andai wrote: post #46
deugtniet wrote: post #19

It's pretty well known that cookie-walls are rife with anti-consumer patterns. Going to something like formula1.com requires me to click more than a 100 times to object to the 'legitimate interests' of as many companies. Which is a pretty terrible anti-pattern when I don't want to be tracked at all... After reading the abstract, it seems the authors try to classify cookies using a special browser extension called "Co…

TrustArc's consent popup disappears instantly on Accept All but shows a loading spinner for "up to several minutes" if you reject cookies. I emailed them about this (because in my experience it's only their software that implements such a dark pattern), they replied "customer misconfigured our software, not our fault" lol.

Honestly I think the GDPR/cookie consent providers should be held equally liable as the website owner for the collective violations facilitated by their product.

I think being able to go after the enablers and profiteers would make enforcement much easier.

An officially maintained list of legal/illegal libraries and services could help website owners to chose a known legal solution. Right now it's hard to expect website owners 'do the right thing' when there's so much contradictory information out there.

Re: Automating cookie consent and GDPR violation detection

#153

Post by atoav »

M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

   (25) However, such devices, for instance so-called "cookies", can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose.
The rest of the GDPR makes it extremely clear that the goal of the whole thing is not to mandate some specific solution but to force people who run services to allow tracking only with informed consent and to offer options that do not track.

If you are not storing data on your users machines or just do so for legitimate purposes, you should not have a need to ask for a users consent and thus don't have any need a cookie banner.

The issue here is, that many people running websites just don't know what they are storing and how. Just slapping a cookie banner on that bad boy and calling it a day won't work either, because you have to list the purposes of these cookies. If you don't know why your weird wordpress template loads a cookie, maybe it is time to change it (or alternatively: change your profession).

Re: Automating cookie consent and GDPR violation detection

#154

Post by Ekaros »

isodev wrote: post #51
akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

> Did we consider that if everyone is breaking the law, the law itself might need a rework? I think GDPR assumed companies would like to do right by their visitors. I guess the only way to do that is to increase the severity of the consequences for violating user trust. GDPR itself offers a guideline that many seem to misunderstand... you don't need a popup for every kind of cookie. I'm not against enforcing minimal…

The possible consequences are already sever enough. It is just that enforcement is either underfunded or not taking active enough action.

Re: Automating cookie consent and GDPR violation detection

#155

Post by throwaway_sb666 »

msl wrote: post #144
throwaway_sb666 wrote: post #141

Earlier quoted context omitted.

https://gdpr.eu/cookies/ lol ;-) https://european-union.europa.eu/ https://www.sundhed.dk/ https://www.securite-sociale.fr/ 4 out of 4 in my case. May I ask which ones you checked, I'm genuinely curious, cause I really don't remember seeing any official website in the EU without cookie banner in many years.

Okay, the first two are pretty hilarious, but as far as I can tell, the first one doesn't actually set any cookies if you don't react to the banner, and the second one sets just this: "{"cm":false,"all1st":false,"closed":false}", which seems acceptable. The other two are trickier to judge, but contain (user?) identifiers, which could certainly be used for tracking, so I'll have to concede your point. Edit: I had to r…

Terve! Not surprised to see Finland slightly ahead of the curve.

I think the default is that most people, professionals included, don't understand the law and throw in the banner-spam to be on the safe side or because of outdated checklists.

I have zero problem with (edit: first-party) cookies, only with the web being a horrible UX for 95% of people, so hope more official websites can lead the way, so that pop-ups can slowly be de-normalized in peoples minds.

Edit:

> https://finlex.fi/en/

Nice find. Also:

https://oikeusministerio.fi/en/frontpage

Can they inform Denmark?

https://www.justitsministeriet.dk/

Re: Automating cookie consent and GDPR violation detection

#156

Post by judge2020 »

Thiez wrote: post #143
judge2020 wrote: post #135

Earlier quoted context omitted.

> Going to something like formula1.com r Not sure if this is because i'm in the states, but 'manage settings' has a 'reject all' button for me[0] and it seems to work. 0: https://i.judge.sh/0vCJB/q_nQ34wtjO.png

But does that button also reject "legitimate" interests?

Most likely everything with a toggle except 'Required Cookies', which are required to make the site work between pages (if you want to turn those off you can disable cookies for the domain in your browser, at risk of the site breaking).

Re: Automating cookie consent and GDPR violation detection

#157

Post by Ekaros »

delusional wrote: post #125
M2Ys4U wrote: post #56

Earlier quoted context omitted.

> I don't think you really "sue" anyone for breaching GDPR. I think you report it to the local authorities, and then they pursue a case. You can. Article 79 explicitly states that data subjects have a "right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Reg…

As to the theory, I stand corrected! As to the practicality of suing for violations, how would you quantify "damaged suffered" from saving a cookie in my browser?

Specially in EU where largely we do not go for punitive awards. Fines yes, but not punitive awards...

Re: Automating cookie consent and GDPR violation detection

#158

Post by oblio »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

Growing pains.

Like Neo being unplugged out of the Matrix.

It takes a while to learn to respect privacy when all you knew was information = ads = $$$.

Re: Automating cookie consent and GDPR violation detection

#159

Post by Matticus_Rex »

throwaway_sb666 wrote: post #152
andai wrote: post #46

Earlier quoted context omitted.

TrustArc's consent popup disappears instantly on Accept All but shows a loading spinner for "up to several minutes" if you reject cookies. I emailed them about this (because in my experience it's only their software that implements such a dark pattern), they replied "customer misconfigured our software, not our fault" lol.

Honestly I think the GDPR/cookie consent providers should be held equally liable as the website owner for the collective violations facilitated by their product. I think being able to go after the enablers and profiteers would make enforcement much easier. An officially maintained list of legal/illegal libraries and services could help website owners to chose a known legal solution. Right now it's hard to expect webs…

If you did that, no one would be in that business lol

Re: Automating cookie consent and GDPR violation detection

#160

Post by andyjansson »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

> some services are literally impossible to provide without a cookie of some form.

You seem to be under a misapprehension about what GDPR is about. It is not about cookies, it's about PII.

Post reply on HN