Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

181–190 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#181

Post by privacylawthrow »

speedgoose wrote: post #177
privacylawthrow wrote: post #174

Earlier quoted context omitted.

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

You don’t need consent to use cookies. You need consent to use cookies to track.

No. You need consent to store data on an end user's machine, regardless of whether you later track that data or not, unless such storage is strictly necessary for the operation of service explicitly requested by the user.

Re: Automating cookie consent and GDPR violation detection

#182

Post by belorn »

privacylawthrow wrote: post #174
M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

Before GDP, the legal consensus among lawyers I asked was that consent could be a 30 pages long legal document hidden through a 6 pixel text link at the bottom of a page that can only be accessed by trawling the website. It wasn't really what the politicians that wrote the ePrivacy Directive intended, which is why the word informed consent was added.

Now if a hidden 30 page long legal document that no one can read is consent then I have this bridge I want to sell. It is totally legit.

Re: Automating cookie consent and GDPR violation detection

#183

Post by mnw21cam »

throwaway_sb666 wrote: post #118
Nextgrid wrote: post #54

Earlier quoted context omitted.

To be fair, the GDPR does outlaw all the things we find annoying with the cookie banners (or rather, data processing consent flows, as they cover more than just cookies). The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead peop…

> The problem is continuous lack of enforcement Yeah, but it's hard to enforce a law at scale when the difference between legal and illegal behavior is not obvious to a layperson. The law is too technical. It also has shouldn't have options where a user can simply allow further data collection, since this makes it hard clearly say whether a certain practice is legal or not, since it "will depend". This creates more f…

> ...the difference between legal and illegal behavior is not obvious to a layperson.

GDPR and cookie law is not hard to understand, so that excuse is a little bit lame to be honest. Besides, if you really need to understand what you must do by law, you should hire a lawyer. That's the same as with any other law.

Re: Automating cookie consent and GDPR violation detection

#184

Post by alkonaut »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies.

Yes? Are you saying that when people reject your cookie consent, you block the cookies that are fundamental to your product? Why would you do that?

Re: Automating cookie consent and GDPR violation detection

#185

Post by bduerst »

swores wrote: post #178
privacylawthrow wrote: post #174

Earlier quoted context omitted.

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

By that logic the GDPR is "about" fridge magnets because any business storing personal data using letter magnets arranged on a fridge is subject to GDPR. Sure, often cookies constitute/contain personal data, but when they don't they are not regulated by GDPR.

I mean, if you're storing user information that isn't pertinent to the business with fridge magnets on a slab of metal, and the user asks you to take them down, it's a GDPR violation if you don't remove/scramble said magnets after 30 days.

Method of data storage isn't really specified, but that's why it's General Data Protection Compliance.

Re: Automating cookie consent and GDPR violation detection

#186

Post by alkonaut »

akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

> Did we consider that if everyone is breaking the law, the law itself might need a rework?

The law is fine, the enforcement is not. If the enforcement had any teeth, then people wouldn't be breaking it. So long as managers try to get away with dark patterns rather than just take their business off the internet, the penalties are clearly not stiff enough. But I'm fine with this taking a few years to get in place. It's better to ramp up penalties once the law has matured a bit, than to have the kind of business-ending penalties I'd like to see, for a very new law.

Re: Automating cookie consent and GDPR violation detection

#187

Post by hugoroy »

atoav wrote: post #153
M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

(25) However, such devices, for instance so-called "cookies", can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be…

You're quoting the 2002 adopted text's recital.

This is outdated.

The relevant bit about consent and cookies was added in 2009, with directive 2009/136 modifying article 5(3) of directive 2002/58.

So all you're saying about legitimate interests etc. is wrong since 2011 (2009+2 years allowing for Member States implementation in national law)

Re: Automating cookie consent and GDPR violation detection

#188

Post by mpweiher »

Nextgrid wrote: post #105
mpweiher wrote: post #81

Earlier quoted context omitted.

> So far they seem to be correct. Not really. Just recently: GDPR enforcer rules that IAB Europe’s consent popups are unlawful https://news.ycombinator.com/item?id=30176712 This is going to require some time, and thus some patience.

I don't agree with the approach for obvious reasons, but he's not entirely wrong either. Even that ruling doesn't change anything - the IAB was fined a token amount, the others get off scot-free and can keep the profits earned over 4 years of illicit data processing.

Quite the opposite, the ruling made clear that trying to outsource the risk to a third party doesn't work.

"All data collected through the TCF must now be deleted by the more than 1,000 companies that pay IAB Europe to use the TCF. This includes Google’s, Amazon’s and Microsoft’s online advertising businesses."

And if they don't comply with that...

Re: Automating cookie consent and GDPR violation detection

#189

Post by bduerst »

oblio wrote: post #158
legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

Growing pains. Like Neo being unplugged out of the Matrix. It takes a while to learn to respect privacy when all you knew was information = ads = $$$.

Yeah this sounds more like change management issues with the tech rather than steady-state problems. Changing anything is hard, but what about after the change?

Re: Automating cookie consent and GDPR violation detection

#190

Post by alkonaut »

krageon wrote: post #122
lp0_on_fire wrote: post #59

Earlier quoted context omitted.

> developers misunderstand it. Then maybe the law needs some adjusting to make compliance more manageable.

If you as a developer are tasked with understanding this, you take the time to read the actual rules and then you misunderstand it, you are incompetent. But this is not what generally happens. Folks don't read, just yolo some terrible explanation off of SO and then complain when someone tells them they are not compliant. That's laziness. Those are the only reasons for noncompliance, outside of actual malice.

It can be cheaper to misunderstand it. So long as risk of getting fined is low, and the fines aren't higher than they are, you aren't really tasked with being compliant. You are given a task to implement something in compliance but what that means is as compliant as possible while still making sure the business survives, possibly even on the same business model. That latter part isn't explicitly given to a developer in the instructions - but it's going to be made clear that if you don't want to put up the minimum-effort cookie wall, there is someone else that can do that job.

This is why we need a law that people actually fear to the point where they would rather switch off the lights and take down the sign, than try to put up an off the shelf cookie wall that can be configured to have an "Accept all" button.

Post reply on HN