Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

191–200 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#191

Post by alkonaut »

andai wrote: post #35
whatshisface wrote: post #25

Earlier quoted context omitted.

What's the definition of minimum cookies?

Necessary site functionality, without the spyware. Unfortunately, most websites sites are funded by spyware, so the minimum cookies to keep the internet economy running would have to include the spyware.

Showing an ad next to a news article is not fundamental to the function of a news site, even if it's how the bills are paid. You can't degrade the experience because visitors reject cookies. So you can't do a "we'll show you the article but only if you agree to ads". And you have to make the reject-all-cookies the default choice and easier than accepting. It's pretty simple.

Re: Automating cookie consent and GDPR violation detection

#192

Post by hugoroy »

belorn wrote: post #182
privacylawthrow wrote: post #174

Earlier quoted context omitted.

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

Before GDP, the legal consensus among lawyers I asked was that consent could be a 30 pages long legal document hidden through a 6 pixel text link at the bottom of a page that can only be accessed by trawling the website. It wasn't really what the politicians that wrote the ePrivacy Directive intended , which is why the word informed consent was added. Now if a hidden 30 page long legal document that no one can read i…

I doubt you actually asked any lawyers who know this stuff.

While GDPR did raise the threshold of valid consent, the interpretation before the GDPR was nowhere near what you describe here.

There are authority guidelines and sanctions predating the GDPR on this.

Re: Automating cookie consent and GDPR violation detection

#193

Post by privacylawthrow »

belorn wrote: post #182
privacylawthrow wrote: post #174

Earlier quoted context omitted.

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

Before GDP, the legal consensus among lawyers I asked was that consent could be a 30 pages long legal document hidden through a 6 pixel text link at the bottom of a page that can only be accessed by trawling the website. It wasn't really what the politicians that wrote the ePrivacy Directive intended , which is why the word informed consent was added. Now if a hidden 30 page long legal document that no one can read i…

You asked the wrong lawyers, at least for the US. The FTC's case against Sears in 2009 made it clear that consent to a privacy notice isn't valid if the privacy notice is buried deep in a licensing agreement, even if the notice is correct.

Re: Automating cookie consent and GDPR violation detection

#194

Post by belorn »

privacylawthrow wrote: post #165
legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

I'm a privacy lawyer that has worked on cookie consents for a number of commercial websites. Everything you said here is all too true. The real legal answer in a lot of cases is "Do what everyone else is doing. Don't be an outlier. Use industry tools because if there's a problem with an industry tool, they'll go after the tool and not its users." The comments about cookies not being part of GDPR are grossly wrong. On…

As lawyer, could you make an argument how consent can be given by a person if they haven't read the legal document, the other party know that the person has not read the document, and even if the person had read the document they would not understand it because of its language, complexity and size.

To put it in other words, if we used the same definition of consent in any other legal contexts that also require freely given informed consent, would the legal system still function?

Re: Automating cookie consent and GDPR violation detection

#195

Post by alkonaut »

gyulai wrote: post #80
gyulai wrote: post #62

Earlier quoted context omitted.

It's not true that you don't need to worry about GDPR if you're only going to use this information for a limited time to analyze attacks. It's a lot more complicated than that.

> Could you explain? > Keeping the information for a reasonable amount of time for security or fraud- > detection purposes would definitely fall under legitimate interest. Yes, but not being allowed to collect the data at all is not the only way you can fall foul of GDPR compliance. E.g. you also have to give the data subjects processes for getting info about what data you have on them, getting it corrected if they w…

> E.g. you also have to give the data subjects processes for getting info about what data you have on them, getting it corrected if they want to, getting it deleted if they want to.

A Policy note is standard for most sites. An email address or form where users can request their data isn't possible for web logs storing IP alone. So long as the analysis window for the logs is shorter than the max response time to data requests, you can always autorespond at the end of the response time window saying "Thanks for your request on date D. We have no data stored for you from date D and earlier". Which would be true since the logs are then already flushed out. The paperwork if there is zero real per-user data, zero third parties/subcontractors etc. will be pretty minimal (thankfully).

This is of course assuming 2 things: 1) that you can do all your log analysis in a very short window and 2) that you can do it in house and won't send it to a third party.

Re: Automating cookie consent and GDPR violation detection

#196

Post by Nextgrid »

mpweiher wrote: post #188
Nextgrid wrote: post #105

Earlier quoted context omitted.

I don't agree with the approach for obvious reasons, but he's not entirely wrong either. Even that ruling doesn't change anything - the IAB was fined a token amount, the others get off scot-free and can keep the profits earned over 4 years of illicit data processing.

Quite the opposite, the ruling made clear that trying to outsource the risk to a third party doesn't work. "All data collected through the TCF must now be deleted by the more than 1,000 companies that pay IAB Europe to use the TCF. This includes Google’s, Amazon’s and Microsoft’s online advertising businesses." And if they don't comply with that...

> And if they don't comply with that...

How are they going to find out? Are they mandating source code & database audits?

If it took them 4 years to take action on something that was pushed in every web user's face several times per day, you're probably looking for a few millennia for them to take action on something only a few hundred company insiders are aware of.

Re: Automating cookie consent and GDPR violation detection

#197

Post by belorn »

hugoroy wrote: post #192
belorn wrote: post #182

Earlier quoted context omitted.

Before GDP, the legal consensus among lawyers I asked was that consent could be a 30 pages long legal document hidden through a 6 pixel text link at the bottom of a page that can only be accessed by trawling the website. It wasn't really what the politicians that wrote the ePrivacy Directive intended , which is why the word informed consent was added. Now if a hidden 30 page long legal document that no one can read i…

I doubt you actually asked any lawyers who know this stuff. While GDPR did raise the threshold of valid consent, the interpretation before the GDPR was nowhere near what you describe here. There are authority guidelines and sanctions predating the GDPR on this.

I asked a lawyers during a conference that discussed privacy and law. I initially asked if a 50 page document was fine, which they said was not, but then lowered it to 30 and they said "sometimes" without any irony in sight. After an additional discussion they said that even if people did not read the document or had the ability to understand it, it would still count as consent.

I have also talked personally with politicians who was involved with the work of writing GDPR, and the people who wrote the ePrivacy Directive has reportedly said that lawyers interpretation of consent was beyond the imagination of the original intent of the directive, which is why GDPR now require freely given informed consent in contrast to the old consent.

Re: Automating cookie consent and GDPR violation detection

#198

Post by timando »

tobr wrote: post #175
tacone wrote: post #163

I really think we should reject the law and make another one that requires the browser vendors to provide the appropriate notices (think of what currently happens with non-https connections) and (browser enforced) choices. No added work for website developers, no lawyers required, no dark patterns. Common icons and warnings the user can recognize easily because they would be the same for every website.

That makes no sense. How is the browser supposed to inform the user what they are consenting to? The point of the law is, among other things, that you need to have informed consent when you process personal information. That’s not a technical problem that you can solve with a new API. It requires organizations to work differently. Unfortunately it seems that very few orgs have been willing to put the necessary though…

Put a cookies.txt (or json or xml or whatever) at the root of the website (or use a element) with the name of the cookie and what it does. If the cookie isn't listed, the browser rejects it.

Re: Automating cookie consent and GDPR violation detection

#200

Post by tick_tock_tick »

swores wrote: post #178
privacylawthrow wrote: post #174

Earlier quoted context omitted.

You're wrong. The ePrivacy Directive does require that a website get consent before storing information on the end-user's device. Prior to GDPR, the local country implementations of the ePD allowed for implicit consent in some EU countries, and opt-out consent in other EU countries. GDPR redefined what constitutes legitimate consent to process personal data. Consent that was previously valid under the ePD was no long…

By that logic the GDPR is "about" fridge magnets because any business storing personal data using letter magnets arranged on a fridge is subject to GDPR. Sure, often cookies constitute/contain personal data, but when they don't they are not regulated by GDPR.

Yes, that is correct GDPR as written and as being interpreted by the courts covers every aspect of commerce, any interaction with another entity no matter how far removed, and any observable side effects of said interactions even if neither party knows of the third parties.
Post reply on HN