Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

201–210 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#201

Post by tick_tock_tick »

mpweiher wrote: post #81
jjoonathan wrote: post #4

Right, as with the cookie laws companies seem to have collectively come to the idea that "they can't catch us all!" So far they seem to be correct. I would really like to see the courts deal a few black eyes over this, I hope this tool can help.

> So far they seem to be correct. Not really. Just recently: GDPR enforcer rules that IAB Europe’s consent popups are unlawful https://news.ycombinator.com/item?id=30176712 This is going to require some time, and thus some patience.

I mean this clearly is still being worked out as consent popups are a requirement of the law but the enforcers and courts don't seem to like that fact and are getting very creative in there interpretations to avoid the explicit requirements of the law.

Re: Automating cookie consent and GDPR violation detection

#202

Post by elevatortrim »

tempnow987 wrote: post #168
legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

Yeah, anyone who says GDPR is "easy" is just lying through their teeth. It really is folks who have not actually had to implement or try to implement anything. The best is they claim (falsely) that you don't actually have to pop-up the consent dialogs. Not really true on almost any actual website that does anything anyone wants.

GDPR is easy when your only income is what your users pay you and you are not interested in their personal data. My company barely changed some internal documents and that was it.

Re: Automating cookie consent and GDPR violation detection

#203

Post by goto11 »

PragmaticPulp wrote: post #28
karaterobot wrote: post #16

Handy guide to GDPR for web developers: * You can't set all your cookies first, then ask permission. * You can't set all your cookies whether the user accepts them or not. * You can't tell users to stop using the website if they don't want cookies. * You can't convince any business owner to follow the above rules.

GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.

> You can easily interpret common server-side logging operations as GDPR violations if you're not careful.

Indeed - if you log client IP, it is subject to GDPR.

Re: Automating cookie consent and GDPR violation detection

#204

Post by atoav »

hugoroy wrote: post #187
atoav wrote: post #153

Earlier quoted context omitted.

(25) However, such devices, for instance so-called "cookies", can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be…

You're quoting the 2002 adopted text's recital. This is outdated. The relevant bit about consent and cookies was added in 2009, with directive 2009/136 modifying article 5(3) of directive 2002/58. So all you're saying about legitimate interests etc. is wrong since 2011 (2009+2 years allowing for Member States implementation in national law)

Thanks for the correction

Re: Automating cookie consent and GDPR violation detection

#205

Post by dmitriid »

judge2020 wrote: post #138
FreeHugs wrote: post #42

I run a website with a few hundred thousand monthly active users. I get tons of mails from users telling me how much they love it. One unintrusive, smallish Adsense banner pays for everything. For years now, everyone was happy. Now Google sent me an email that they want me to gather user consent before showing Adsense. They offer an automatic consent modal. But the problem with that one is that it not only displays t…

> And of course loading the consent script from Google before getting consent is not in line with GDPR in the first place. Only if Google uses that information whatsoever. They'd be on the hook if they run afoul of GDPR by collecting information when it's obtained before consent happens, and I'm sure the enforcement agency isn't going to fault the web admin for taking Google's word on compliance.

Web admin is the first person responsible for keeping that data safe. If they use a non-compliant tracker, well, they are liable as well.

That said, EU is now finally going after the trackers: https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...

Re: Automating cookie consent and GDPR violation detection

#206

Post by dmitriid »

throwaway_sb666 wrote: post #152
andai wrote: post #46

Earlier quoted context omitted.

TrustArc's consent popup disappears instantly on Accept All but shows a loading spinner for "up to several minutes" if you reject cookies. I emailed them about this (because in my experience it's only their software that implements such a dark pattern), they replied "customer misconfigured our software, not our fault" lol.

Honestly I think the GDPR/cookie consent providers should be held equally liable as the website owner for the collective violations facilitated by their product. I think being able to go after the enablers and profiteers would make enforcement much easier. An officially maintained list of legal/illegal libraries and services could help website owners to chose a known legal solution. Right now it's hard to expect webs…

> Honestly I think the GDPR/cookie consent providers should be held equally liable as the website owner for the collective violations facilitated by their product.

The EU is finally going after them: https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...

I do hope they get sued out of existence

Re: Automating cookie consent and GDPR violation detection

#207

Post by dmitriid »

tacone wrote: post #163

I really think we should reject the law and make another one that requires the browser vendors to provide the appropriate notices (think of what currently happens with non-https connections) and (browser enforced) choices. No added work for website developers, no lawyers required, no dark patterns. Common icons and warnings the user can recognize easily because they would be the same for every website.

> I really think we should reject the law and make another one that requires the browser vendors

1. GDPR isn't just about browsers

2. Those "consent" popups are mostly illegal under GDPR. They are often provided by companies whose entire business is dark patterns. Thankfully, the EU is going after them, too: https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...

Re: Automating cookie consent and GDPR violation detection

#208

Post by 3np »

privacylawthrow wrote: post #193
belorn wrote: post #182

Earlier quoted context omitted.

Before GDP, the legal consensus among lawyers I asked was that consent could be a 30 pages long legal document hidden through a 6 pixel text link at the bottom of a page that can only be accessed by trawling the website. It wasn't really what the politicians that wrote the ePrivacy Directive intended , which is why the word informed consent was added. Now if a hidden 30 page long legal document that no one can read i…

You asked the wrong lawyers, at least for the US. The FTC's case against Sears in 2009 made it clear that consent to a privacy notice isn't valid if the privacy notice is buried deep in a licensing agreement, even if the notice is correct.

They are referring to GDPR. I do not see how any US ruling applies to that.

Re: Automating cookie consent and GDPR violation detection

#209

Post by dmitriid »

legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies.

You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course.

basically, you created those problems for yourslef, and now blame the law.

> For people who claim GDPR compliance is clear and straightforward - I can't believe they actually have much experience working in Privacy.

It is very straightforward when it comes to the use cases you described.

> Actual implementation gets... very opaque.

That's your problem, not the law's problem. Ask only for data you strictly need. Keep safe. Do not share with/sell to third parties.

This was true for years before GDPR, and the only reason everyone found it "so hard" is that everyone, including you and your corporate sites, didn't give two craps about users' privacy.

Re: Automating cookie consent and GDPR violation detection

#210

Post by throwaway_sb666 »

mnw21cam wrote: post #183
throwaway_sb666 wrote: post #118

Earlier quoted context omitted.

> The problem is continuous lack of enforcement Yeah, but it's hard to enforce a law at scale when the difference between legal and illegal behavior is not obvious to a layperson. The law is too technical. It also has shouldn't have options where a user can simply allow further data collection, since this makes it hard clearly say whether a certain practice is legal or not, since it "will depend". This creates more f…

> ...the difference between legal and illegal behavior is not obvious to a layperson. GDPR and cookie law is not hard to understand, so that excuse is a little bit lame to be honest. Besides, if you really need to understand what you must do by law, you should hire a lawyer. That's the same as with any other law.

Ok fair enough.

What I meant to say was that pressure to enforce laws only happen if there is public pressure to see the law implemented, and when the concepts are too abstract/intangible, the public disengages more easily from the issue.

Political will for improvements and funding is more likely to happen with more public support as counter to the influence of industry lobbists.

Public support is easier to rally when people can personally relate, or ideally share a pain point. A good candidate would be the annoying pop-up boxes. Frame them as dangerous because increasing the risk of online data and identity leaks. Solution to this threat to public security is to eliminate them by default answer. Simple law proposal.

Post reply on HN