Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

221–230 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#221

Post by ratww »

Nextgrid wrote: post #90
PragmaticPulp wrote: post #26

Earlier quoted context omitted.

> A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. Not true. I've spent far too much time with expensive lawyers going through the painful details of GDPR compliance and edge cases. If you keep logs at all, anywhere, then technically you could be at risk of crossing the GDPR. Don't assume that you're free and clear b…

If you keep logs forever, yes you'll be in trouble (though probably much less than plastering your website with analytics or ads). Keep logs for a reasonable amount of time (90 days) and you'll be fine. Well, given the current state of GDPR enforcement, you'll be fine whatever you do. But lawyers are going to lawyer and consent management platforms will be delighted to scare you into buying their "solution", even if…

Correct.

The intent for keeping IP addresses in logs also matters. To give two examples: if you're keeping logs for legal reasons, then it is perfectly fine. If you're keeping for anti-fraud reasons, this is also fine and can be considered "legitimate interest" (as long as the amount of time for storage is reasonable, as you said). If you intend to use this data for other reasons, then you need consent before doing so.

Re: Automating cookie consent and GDPR violation detection

#222

Post by ratww »

UnpossibleJim wrote: post #128
mariusor wrote: post #116

Earlier quoted context omitted.

I don't think "enforce" means what you think it means. If you are contacted about a GDPR matter usually you have time to fix it before it's "a violation" that incurs penalties.

It's "squishy" terms in law, like "usually" that I find bothersome. Granted, I haven't read the complete specifics of all of the minutia when it comes to the GDPR, I'll admit. I do keep cookies by default though, as a habit, which seems to be in violation of GDPR rules. Should I start publishing a blog or some such which was antithetical to the prevailing party doctrine, that happened to gain traction with the public…

> I do keep cookies by default though, as a habit, which seems to be in violation of GDPR rules.

Which cookies do you keep? That matters. GDPR doesn't care about cookies, it cares about PII and some other stuff.

For example, setting a cookie called "hello" with the value "world" on the browser of every user does not require consent, as long as this is not used to identify specific user, of course.

Re: Automating cookie consent and GDPR violation detection

#223

Post by ratww »

FreeHugs wrote: post #111
Nextgrid wrote: post #106

Earlier quoted context omitted.

He's saying to deny access to EU-based users, which will make it very unlikely that any EU-based user will complain, thus (in practice) removing the need for GDPR compliance.

I am not aware of any big publishers doing that. That is why I asked for an example.

Yeah. It is mostly small american city newspapers in my experience, haven't seen much other than that.

Re: Automating cookie consent and GDPR violation detection

#224

Post by ratww »

ffhhj wrote: post #124

Is the PHPSESSION cookie valid for GDPR? Or should we replace it with a token?

If you're using it only to make your website work, then you don't need a cookie banner.

However, if it's doing double-duty and is also being used to track users (or to speak technically: if it can be considered PII by GDPR), then you need consent before using it for the tracking part.

GDPR doesn't apply for cookies, btw, it applies for any personal data. Someone above used "information stored using fridge magnets" as an example.

Re: Automating cookie consent and GDPR violation detection

#225

Post by ratww »

lbriner wrote: post #52
goodpoint wrote: post #29

Earlier quoted context omitted.

That cost should be paid by the companies forcing pop-ups onto users. Popups in no way GDPR's fault. The law does not mandates them. Instead, it's a form of malicious compliance. Companies pester visitors with popup banners that are almost always unnecessary. E.g. GDPR allows essential cookies e.g. a login cookie containing an encrypted token without any popup. If you want to notify users about it for extra safety yo…

I'm not sure it's malicious compliance. When you are threatened with massive fines for non-compliance but you aren't told explicitly about how to solve it other than, "A cookie notice would be a way of complying", everyone will use a cookie notice.

Modern cookie banners definitely are malicious compliance and most certainly are also violations of the GDPR.

All those companies could use less invasive methods of asking for consent, such as optional checkboxes in signup forms. Or a non-intrusive "click here to opt-in to tracking". The reason they don't do it like this is because they prefer forcing users to click "Accept All" using dark patterns.

Anyone complaining about shitty cookie banners is actually complaining about companies breaking GDPR.

Re: Automating cookie consent and GDPR violation detection

#226

Post by guitarbill »

deugtniet wrote: post #19

It's pretty well known that cookie-walls are rife with anti-consumer patterns. Going to something like formula1.com requires me to click more than a 100 times to object to the 'legitimate interests' of as many companies. Which is a pretty terrible anti-pattern when I don't want to be tracked at all... After reading the abstract, it seems the authors try to classify cookies using a special browser extension called "Co…

Seems like perverting the meaning of "legitimate interest" is the ad industry's next move, now that the obviously illegal popups were officially decried as illegal.

Re: Automating cookie consent and GDPR violation detection

#227

Post by Jensson »

UnpossibleJim wrote: post #162
M2Ys4U wrote: post #137

Earlier quoted context omitted.

Enforcement action must be "proportionate", so even if you are pulled up by a supervisory authority it's unlikely they're going to give you a massive fine straight off the bat - especially if you are trying to comply and can demonstrate that.

I think everyone seems to be missing the point of what I'm saying, and maybe it's my fault. In the defense of the law that people have given to me, so far, the terms "Usually" and "Unlikely" have come up. Neither of those terms are very satisfactory if I write a critical piece critical of the government and am taken to the full extent of the GDPR's breadth, with little ability to fight it, being a small, independent,…

> In such a case, a massive fine would not only bankrupt that person

At worst you are fined for 4% of your annual income, it wont bankrupt you. No government is going to go through all that hassle just to fine an independent journalist for a paltry sum. If they really wanted that power they would add defamation laws like UK where they can put you in jail for speaking negatively about public figures.

And until the thing you fear happens at least once to a small business we can assume it will never happen. In the extremely unlikely event that it really happens you pay a 4% fee of your annual income, that hurts for sure but it isn't life altering.

Re: Automating cookie consent and GDPR violation detection

#229

Post by 1vuio0pswjnm7 »

M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

"There is nothing in the GDPR about cookies."

(30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

Re: Automating cookie consent and GDPR violation detection

#230

Post by alfiedotwtf »

dmitriid wrote: post #209
legitster wrote: post #150

Part of my job is to maintain GDPR compliance for corporate websites. Even for companies that legitimately want to exceed compliance, you would not believe how much of a pain in the ass it is. The first company wanted to do it "right". So we enabled opt-out by default for all cookies. Which requires setting an anonymized master cookie to check everytime we load a webpage to see if we are allowed to set other cookies.…

> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course. basically, you created those problems for yourslef, and now blame the law. > For people who claim GDPR compliance is clear and…

And what if you need third-parties like a payment gateway? How do you do this without sharing PII?
Post reply on HN