Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

161–170 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#161

Post by LinAGKar »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

The GDPR isn't about cookies, it's about personal data. You can still use cookies for functional stuff, like keeping track of the shopping cart on the client.

The problem here is that companies have an ingrained culture of taking the easy route and just grabbing all the data they can without regard to privacy, which now comes back to bite them.

Re: Automating cookie consent and GDPR violation detection

#162

Post by UnpossibleJim »

M2Ys4U wrote: post #137
UnpossibleJim wrote: post #128

Earlier quoted context omitted.

It's "squishy" terms in law, like "usually" that I find bothersome. Granted, I haven't read the complete specifics of all of the minutia when it comes to the GDPR, I'll admit. I do keep cookies by default though, as a habit, which seems to be in violation of GDPR rules. Should I start publishing a blog or some such which was antithetical to the prevailing party doctrine, that happened to gain traction with the public…

Enforcement action must be "proportionate", so even if you are pulled up by a supervisory authority it's unlikely they're going to give you a massive fine straight off the bat - especially if you are trying to comply and can demonstrate that.

I think everyone seems to be missing the point of what I'm saying, and maybe it's my fault. In the defense of the law that people have given to me, so far, the terms "Usually" and "Unlikely" have come up. Neither of those terms are very satisfactory if I write a critical piece critical of the government and am taken to the full extent of the GDPR's breadth, with little ability to fight it, being a small, independent, self published journalist who had a friend set up a server using the default Apache settings(this is an example - I am not).

In such a case, a massive fine would not only bankrupt that person but would silence such critical dissension from occurring in a much needed vocal minority. Investigative journalism from non-corporate outlets, through non-corporate outlets is a wonderful thing, which has become a rarity, and has the potentiality of becoming illegal due to clerical mishaps.

While I do understand the necessity of a user's privacy, I also understand the necessity of "removing the tumor and saving the leg", to borrow a colloquialism. Broad-brush approaches have quite a few down-stream consequences, which are seldom realized until it's too late. We've only to look at "the war on terror" and the domestic surveillance that came about in the name of "safety" to understand that =/

Re: Automating cookie consent and GDPR violation detection

#163

Post by tacone »

I really think we should reject the law and make another one that requires the browser vendors to provide the appropriate notices (think of what currently happens with non-https connections) and (browser enforced) choices.

No added work for website developers, no lawyers required, no dark patterns. Common icons and warnings the user can recognize easily because they would be the same for every website.

Re: Automating cookie consent and GDPR violation detection

#164

Post by Nextgrid »

Matticus_Rex wrote: post #159
throwaway_sb666 wrote: post #152

Earlier quoted context omitted.

Honestly I think the GDPR/cookie consent providers should be held equally liable as the website owner for the collective violations facilitated by their product. I think being able to go after the enablers and profiteers would make enforcement much easier. An officially maintained list of legal/illegal libraries and services could help website owners to chose a known legal solution. Right now it's hard to expect webs…

If you did that, no one would be in that business lol

Is that a big loss? I can't picture anyone, outside of their employees and shareholders who would be negatively affected by TrustArc disappearing overnight. I just checked their website and it seems like their entire business is GDPR pseudo-compliance targeted at businesses who can't legitimately comply with the GDPR.

Re: Automating cookie consent and GDPR violation detection

#165

Post by privacylawthrow »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

I'm a privacy lawyer that has worked on cookie consents for a number of commercial websites. Everything you said here is all too true. The real legal answer in a lot of cases is "Do what everyone else is doing. Don't be an outlier. Use industry tools because if there's a problem with an industry tool, they'll go after the tool and not its users."

The comments about cookies not being part of GDPR are grossly wrong. One of the early discussions in the privacy law community was how to handle the collision of the new consent requirements under GDPR with the fact that the ePrivacy Directive requires consent for cookies. Prior to GDPR, a large number of EU jurisdictions allowed for implicit consent through a variety of actions, like scrolling a page, or non-actions, like seeing a banner and not clicking "no". GDPR redefined consent and that's why cookie banners pop up.

Re: Automating cookie consent and GDPR violation detection

#166

Post by bryanrasmussen »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

> Especially when the law says it's illegal to deny service based on their cookie preference, but some services are literally impossible to provide without a cookie of some form.

To clarify what others are saying here - it is illegal under GDPR to deny service based on people opting out of providing PII in the cases where that PII is not needed for providing the service, not for refusing to accept cookies (although, sure, there can be some relation between these things).

If for example you were providing a service where you sent someone emails on their birthday with autogenerated Love from your AI Momma messages it would not be illegal for you to refuse to provide them access to your service if they opted out of you storing their email and birthday, because those two pieces of PII are needed for the service to work.

That said, most services do not need to store any PII for any length of time to work. Thus if a service says you can't read our medical advice column unless you allow us to store all this stuff we just hoovered up from your browser forever, that would be illegal. Because they don't need any of that stuff to show you the article they already have written and ready to go.

Re: Automating cookie consent and GDPR violation detection

#167

Post by trh0awayman »

The cookie consent stuff has always seemed straight forward to me, but maybe I've had it wrong this whole time. It does really say a lot that 95% of websites had a violation. I wish that we could make the GDPR entirely client-side.

Semi-related: my understanding is that it's impossible for American hosting companies to comply with GDPR (due to the CLOUD act).

If that's the case, and you're American/using an American host, is there any point in even trying to comply?

Re: Automating cookie consent and GDPR violation detection

#168

Post by tempnow987 »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

Yeah, anyone who says GDPR is "easy" is just lying through their teeth. It really is folks who have not actually had to implement or try to implement anything.

The best is they claim (falsely) that you don't actually have to pop-up the consent dialogs. Not really true on almost any actual website that does anything anyone wants.

Re: Automating cookie consent and GDPR violation detection

#169

Post by legitster »

tempnow987 wrote: post #168
legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

Yeah, anyone who says GDPR is "easy" is just lying through their teeth. It really is folks who have not actually had to implement or try to implement anything. The best is they claim (falsely) that you don't actually have to pop-up the consent dialogs. Not really true on almost any actual website that does anything anyone wants.

I think it's easy to comply with GDPR if you run a website that doesn't offer any services or generate any income. I have to believe this is where a lot of these type of HN comments come from.

Re: Automating cookie consent and GDPR violation detection

#170

Post by notRobot »

trh0awayman wrote: post #167

The cookie consent stuff has always seemed straight forward to me, but maybe I've had it wrong this whole time. It does really say a lot that 95% of websites had a violation. I wish that we could make the GDPR entirely client-side. Semi-related: my understanding is that it's impossible for American hosting companies to comply with GDPR (due to the CLOUD act). If that's the case, and you're American/using an American…

> If that's the case, and you're American/using an American host, is there any point in even trying to comply?

It's the user-friendly option. Respect your users. Get consent for tracking.

Post reply on HN