Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

171–180 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#171

Post by legitster »

andyjansson wrote: post #160
legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

> some services are literally impossible to provide without a cookie of some form. You seem to be under a misapprehension about what GDPR is about. It is not about cookies, it's about PII.

At this point it's largely semantics. The ePrivacy directives were included in the same piece of GDPR legislation. And when people talk about GDPR they are talking about both.

Re: Automating cookie consent and GDPR violation detection

#172

Post by legitster »

oblio wrote: post #158
legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

Growing pains. Like Neo being unplugged out of the Matrix. It takes a while to learn to respect privacy when all you knew was information = ads = $$$.

Our company didn't engage in any ad or ad networks. But the cost of compliance is the same.

Re: Automating cookie consent and GDPR violation detection

#173

Post by ratww »

cge wrote: post #127
Nextgrid wrote: post #64

Earlier quoted context omitted.

I wonder if it's a really lazy and terrible attempt at accounting for how long the opt-out request would take. Let's imagine it has no way to know (because of cross-domain restrictions?) whether an opt-out request to a third-party succeeds - in which case it simply waits a reasonable amount of time for the request to complete. Of course, a reasonable time should be a handful of seconds, but I guess at least it makes…

My understanding is that the preferences should not be an opt-out of a default setting per the GPDR, they should be preferences that requested and then saved. So surely the opt-in setting would take just as long as the opt-out setting, wouldn't it?

The opt-in should technically take more time, since you shouldn't be sending PII data before the consent.

In the case of opt-out the only single thing that has to happen is setting a local cookie and closing the modal window, which are things that also happen when you accept.

Re: Automating cookie consent and GDPR violation detection

#174

Post by privacylawthrow »

M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no longer valid under GDPR, which is why GDPR is about cookies, and every other processing of personal data.

Re: Automating cookie consent and GDPR violation detection

#175

Post by tobr »

tacone wrote: post #163

I really think we should reject the law and make another one that requires the browser vendors to provide the appropriate notices (think of what currently happens with non-https connections) and (browser enforced) choices. No added work for website developers, no lawyers required, no dark patterns. Common icons and warnings the user can recognize easily because they would be the same for every website.

That makes no sense. How is the browser supposed to inform the user what they are consenting to? The point of the law is, among other things, that you need to have informed consent when you process personal information. That’s not a technical problem that you can solve with a new API. It requires organizations to work differently. Unfortunately it seems that very few orgs have been willing to put the necessary thought and care into this, instead they just slap these cargo cult consent dialogs across everything.

Re: Automating cookie consent and GDPR violation detection

#176

Post by andai »

throwaway_sb666 wrote: post #126
andai wrote: post #113

Earlier quoted context omitted.

I was just asserting out that a law that banned spyware-based advertising would harm the current website ecomomy which is largely based around spyware. I would like to see an end to mass spying, and therefore the creation of a different kind of funding mechanism. That could indeed be brought about by law, but that seems a bit too violent to me. I think what we're missing is a better alternative. I read an interesting…

> I was just asserting out that a law that banned spyware-based advertising would harm the current website ecomomy which is largely based around spyware. I think that largely, the website economy is based around advertising. I honestly doubt the advertising-centered business model would disappear even if large-scale tracking did. Would it be less targeted and less efficient on a micro-level - yes probably. But less a…

>Would it be less targeted and less efficient on a micro-level - yes probably.

I remember reading not too long ago that tracking did not increase profits! I find that hard to believe because once the tracking gets good enough, they actually start showing me ads for things I actually might want to buy! (Imagine that!) In my experience, Facebook's ads (at least on Instagram) show me really cool things, while Google (who should know way more about me) shows me complete garbage on all its platforms (YouTube being worst of all).

Re: less abusive advertising

I'm considering making some (hopefully!) profitable web games but I'm averse to putting ads on them. After giving it some thought I realized my main objection wasn't aesthetics / UX (though that is certainly a concern when it comes to "art" -- I want my games to be beautiful and ads sort of kill the vibe there) -- my main concern was actually running strange 3rd party fingerprinting / zombie-tracker / god-knows-what. If it was just a clearly labeled affiliate link, eg. , that would do away with most of my concerns! (And simplify my GDPR compliance by just.. not storing anything.. and eliminate the need for those horrible banners :)

In general I'm averse to government regulations, but this might be a rare case where the alternative (rampant spying) is worse... After that, all that remains is to get the governments to ban themselves from spying too ;)

Re: Automating cookie consent and GDPR violation detection

#177

Post by speedgoose »

privacylawthrow wrote: post #174
M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

You don’t need consent to use cookies. You need consent to use cookies to track.

Re: Automating cookie consent and GDPR violation detection

#178

Post by swores »

privacylawthrow wrote: post #174
M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

By that logic the GDPR is "about" fridge magnets because any business storing personal data using letter magnets arranged on a fridge is subject to GDPR. Sure, often cookies constitute/contain personal data, but when they don't they are not regulated by GDPR.

Re: Automating cookie consent and GDPR violation detection

#179

Post by oblio »

legitster wrote: post #172
oblio wrote: post #158

Earlier quoted context omitted.

Growing pains. Like Neo being unplugged out of the Matrix. It takes a while to learn to respect privacy when all you knew was information = ads = $$$.

Our company didn't engage in any ad or ad networks. But the cost of compliance is the same.

I understand, my point is that nobody has really thought about this in detail, so you can't just plug in libgdrp to avoid the legwork, like you do with libjpeg or libffmpeg.

Re: Automating cookie consent and GDPR violation detection

#180

Post by tempnow987 »

legitster wrote: post #169
tempnow987 wrote: post #168

Earlier quoted context omitted.

Yeah, anyone who says GDPR is "easy" is just lying through their teeth. It really is folks who have not actually had to implement or try to implement anything. The best is they claim (falsely) that you don't actually have to pop-up the consent dialogs. Not really true on almost any actual website that does anything anyone wants.

I think it's easy to comply with GDPR if you run a website that doesn't offer any services or generate any income. I have to believe this is where a lot of these type of HN comments come from.

Even then it's actually not easy. You embed a youtube video? You host a font on a US CDN? There are TONs of gotchas even for the "free" sites. And then if you actually are running a business online - and want to let folks do almost anything, better get the pop-ups popping!
Post reply on HN