Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

211–220 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#211

Post by the_gipsy »

ratww wrote: post #173
cge wrote: post #127

Earlier quoted context omitted.

My understanding is that the preferences should not be an opt-out of a default setting per the GPDR, they should be preferences that requested and then saved. So surely the opt-in setting would take just as long as the opt-out setting, wouldn't it?

The opt-in should technically take more time, since you shouldn't be sending PII data before the consent. In the case of opt-out the only single thing that has to happen is setting a local cookie and closing the modal window, which are things that also happen when you accept.

You are right that technically opt-in should always take longer. No cookies should have been set until the user accepts.

But opt-out should not set anything. I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP. If you mean saving to LocalStorage, then I don't think that's allowed either.

Re: Automating cookie consent and GDPR violation detection

#212

Post by throwaway_sb666 »

andai wrote: post #176
throwaway_sb666 wrote: post #126

Earlier quoted context omitted.

> I was just asserting out that a law that banned spyware-based advertising would harm the current website ecomomy which is largely based around spyware. I think that largely, the website economy is based around advertising. I honestly doubt the advertising-centered business model would disappear even if large-scale tracking did. Would it be less targeted and less efficient on a micro-level - yes probably. But less a…

>Would it be less targeted and less efficient on a micro-level - yes probably. I remember reading not too long ago that tracking did not increase profits! I find that hard to believe because once the tracking gets good enough, they actually start showing me ads for things I actually might want to buy! (Imagine that!) In my experience, Facebook's ads (at least on Instagram) show me really cool things, while Google (wh…

> my main concern was actually running strange 3rd party fingerprinting / zombie-tracker / god-knows-what

Exactly - i briefly looked into https://www.ethicalads.io/ but mostly IT related ads it seems.

> Facebook's ads (at least on Instagram) show me really cool things, while Google (who should know way more about me) shows me complete garbage

I personally remember being pretty shocked at how the Facebook like button & social login spread to everywhere and they could track you all around. Long time ago. Facebook probably knows a lot more about you than you think.

Re: Automating cookie consent and GDPR violation detection

#213

Post by MauranKilom »

tick_tock_tick wrote: post #201
mpweiher wrote: post #81

Earlier quoted context omitted.

> So far they seem to be correct. Not really. Just recently: GDPR enforcer rules that IAB Europe’s consent popups are unlawful https://news.ycombinator.com/item?id=30176712 This is going to require some time, and thus some patience.

I mean this clearly is still being worked out as consent popups are a requirement of the law but the enforcers and courts don't seem to like that fact and are getting very creative in there interpretations to avoid the explicit requirements of the law.

> consent popups are a requirement of the law but the enforcers and courts don't seem to like that fact

I don't think you could misrepresent the situation any more if you tried. IAB did not even have a data protection officer. As a massive advertising body.

How you go from the very specific and clear list of violations [1] to "the courts don't like consent popups" is entirely beyond me. That's like a car manufacturer stating the authorities don't like cars after failing a crash test for not having airbags.

[1]: https://www.iccl.ie/news/gdpr-enforcer-rules-that-iab-europe...

Re: Automating cookie consent and GDPR violation detection

#214

Post by MauranKilom »

timando wrote: post #198
tobr wrote: post #175

Earlier quoted context omitted.

That makes no sense. How is the browser supposed to inform the user what they are consenting to? The point of the law is, among other things, that you need to have informed consent when you process personal information. That’s not a technical problem that you can solve with a new API. It requires organizations to work differently. Unfortunately it seems that very few orgs have been willing to put the necessary though…

Put a cookies.txt (or json or xml or whatever) at the root of the website (or use a element) with the name of the cookie and what it does. If the cookie isn't listed, the browser rejects it.

The GDPR is not inherently about cookies, and it also does not stand in the way of the solution you describe.

What is standing in the way is corporations considering it more profitable to hassle their users with antipattern-laden popups than to follow the spirit (and, ostensibly, letter) of the law.

Re: Automating cookie consent and GDPR violation detection

#215

Post by throwaway_sb666 »

hutzlibu wrote: post #140
throwaway_sb666 wrote: post #61

Earlier quoted context omitted.

Disagree. Let it burn, it's the only way. (change my mind?) This made me think of the Ukraine war, and how the sanctions may turn out to be a bigger help to climate crisis than any political entity could muster on the basis of the impeding climate snafu. Sometimes radical action is the right course of action; for democracy-(pre)serving reasons our governance systems often inhibit change unless most of the population…

"This made me think of the Ukraine war, and how the sanctions may turn out to be a bigger help to climate crisis than any political entity could muster on the basis of the impeding climate snafu." Huh? Here in germany there is talk by politicians that climate policies have to stand back now and we need to rely more on the coal plants and not close them, as it was planned. I really hope, that the actual solutions will…

Germany is in a very tough spot energy-wise and is the most impacted by the Russian sanctions. A lot of house heating is gas and that isn't something you can change in 6 month. So in the very short term they probably need coal to replace the gas where possible so that stockpiles can meet next winters demand for heating.

But for medium-term, a lot of infrastructure investment will be needed. Times are such that the public will be quick to condemn investment in fossil energy, so there will be pressure to find green solutions where feasible.

The other day I saw a headline that France had stopped subsidizing gas heating installations. I don't get why it took a Russian war to do that, but apparently it did.

There have been many other such headlines. Will it matter? Probably some, maybe a lot... one can hope.

Edit: or maybe the opposite. who knows

Re: Automating cookie consent and GDPR violation detection

#216

Post by ElDomingo »

Honestly why can't browsers just implement a option in there settings? Let the users decide in one place if the want to consent to extra none essential cookies. And add a extra field to exclude certain sites in case you have a domain that you want to grant permission.

Re: Automating cookie consent and GDPR violation detection

#217

Post by antattack »

ElDomingo wrote: post #216

Honestly why can't browsers just implement a option in there settings? Let the users decide in one place if the want to consent to extra none essential cookies. And add a extra field to exclude certain sites in case you have a domain that you want to grant permission.

I use StarDust[0] extension in FireFox that clicks on cookie banners for you. Seems to be working but it's not a 'recommended' extension.

[0]https://addons.mozilla.org/en-US/firefox/addon/stardust-cook...

Re: Automating cookie consent and GDPR violation detection

#218

Post by ______-_-______ »

ElDomingo wrote: post #216

Honestly why can't browsers just implement a option in there settings? Let the users decide in one place if the want to consent to extra none essential cookies. And add a extra field to exclude certain sites in case you have a domain that you want to grant permission.

You mean the "do not track" header? Advertisers won't respect any setting that makes it that easy to opt out.

Re: Automating cookie consent and GDPR violation detection

#219

Post by naniwaduni »

geon wrote: post #39
akersten wrote: post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality. You can not use them to track users on third party sites, or store personally iden…

The law should not have had the consent provision. Without consent provisions, the law makes a fine general prohibition on unnecessary use of personal data,† albeit with a few kinks that I'm glossing over with "unnecessary". But it has the outlines of a sensible regulation, the corner cases could surely have been smoothed out in court.

The consent provision ruins everything. The fact of its existence reframes otherwise unlawful processing as "you need to get consent" instead of "you shouldn't be doing this", which is how it should be framed. It turns the whole regulation into a farce, restricting data processing to necessary uses except if you have the ability to document and semi-coerce consent (subtly enough to not invalidate the content you've obtained, but empirically that's clearly not closely examined).

And lo, a parasite industry dedicated to coercing and documenting "consent"!

†Just talking article 6 here, I don't really want to get into the weeds of chapter 3.

Re: Automating cookie consent and GDPR violation detection

#220

Post by ratww »

the_gipsy wrote: post #211
ratww wrote: post #173

Earlier quoted context omitted.

The opt-in should technically take more time, since you shouldn't be sending PII data before the consent. In the case of opt-out the only single thing that has to happen is setting a local cookie and closing the modal window, which are things that also happen when you accept.

You are right that technically opt-in should always take longer. No cookies should have been set until the user accepts. But opt-out should not set anything. I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP. If you mean saving to LocalStorage, then I don't think that's allowed either.

> But opt-out should not set anything. I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP. If you mean saving to LocalStorage, then I don't think that's allowed either.

It is allowed for this case.

You must save a cookie (or a localStorage value) with the user preferences to avoid showing the cookie banner again. Simplifying: cookies are fine under GDPR as long as they don't carry PII (Personal Identifiable Information). You don't have to ask for consent to store those. They're called "Strictly necessary cookies" in GDPR lingo. (And, of course you can't use any of those to track, though. Intent matters.)

And you can save cookies using a Javascript API. That doesn't involve HTTP requests. The cookie will be sent to the server in future requests, though.

Post reply on HN