Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

231–240 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#231

Post by dmitriid »

alfiedotwtf wrote: post #230
dmitriid wrote: post #209

Earlier quoted context omitted.

> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course. basically, you created those problems for yourslef, and now blame the law. > For people who claim GDPR compliance is clear and…

And what if you need third-parties like a payment gateway? How do you do this without sharing PII?

Payment gateways are covered by laws that supersede GDPR. So you share the strictly necessary info with them.

Re: Automating cookie consent and GDPR violation detection

#232

Post by krageon »

alkonaut wrote: post #190
krageon wrote: post #122

Earlier quoted context omitted.

If you as a developer are tasked with understanding this, you take the time to read the actual rules and then you misunderstand it, you are incompetent. But this is not what generally happens. Folks don't read, just yolo some terrible explanation off of SO and then complain when someone tells them they are not compliant. That's laziness. Those are the only reasons for noncompliance, outside of actual malice.

It can be cheaper to misunderstand it. So long as risk of getting fined is low, and the fines aren't higher than they are, you aren't really tasked with being compliant. You are given a task to implement something in compliance but what that means is as compliant as possible while still making sure the business survives, possibly even on the same business model . That latter part isn't explicitly given to a developer…

Terrible take. If breaking the law to make money is how you operate, you're not a company. You're a criminal cartel.

Re: Automating cookie consent and GDPR violation detection

#233

Post by Thiez »

judge2020 wrote: post #156
Thiez wrote: post #143

Earlier quoted context omitted.

But does that button also reject "legitimate" interests?

Most likely everything with a toggle except 'Required Cookies', which are required to make the site work between pages (if you want to turn those off you can disable cookies for the domain in your browser, at risk of the site breaking).

I'm asking because many of these "consent" dialogs allow you to "reject all" for cookies, but require an "object to all" for "legitimate interest" purposes. It wouldn't surprise me if these dialogs considered the "reject all" to apply only to cookies.

Re: Automating cookie consent and GDPR violation detection

#234

Post by d1sxeyes »

the_gipsy wrote: post #211
ratww wrote: post #173

Earlier quoted context omitted.

The opt-in should technically take more time, since you shouldn't be sending PII data before the consent. In the case of opt-out the only single thing that has to happen is setting a local cookie and closing the modal window, which are things that also happen when you accept.

You are right that technically opt-in should always take longer. No cookies should have been set until the user accepts. But opt-out should not set anything. I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP. If you mean saving to LocalStorage, then I don't think that's allowed either.

> You are right that technically opt-in should always take longer.

Hm... I suppose so, but negligibly. Setting cookies takes milliseconds, so there shouldn't be a significant difference from a user's perspective.

> No cookies should have been set until the user accepts.

That's not accurate. A number of different types of cookies can be set without consent, generally described as 'strictly necessary' cookies - these include cookies that are required for core functionality of the site, or those required to perform a service expressly requested by the user.

> But opt-out should not set anything.

It's a good practice to record the opt-out (or, that user has not opted in). This can be done as a cookie or using Local Storage. This allows you to do things such as only load third party embeds if the user has opted in, giving the 'opted out' user the option to conditionally opt-in for specific embeds without inconveniencing the 'opted in' user. As far as I understand, current thinking is that this type of preference being recorded falls within the scope of 'strictly necessary'.

> I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP.

That's not necessarily true. It is possible to use JavaScript to set and read cookies as a sort of local storage. It's definitely not what cookies were invented for, but technically it can be done.

> If you mean saving to LocalStorage, then I don't think that's allowed either.

GDPR does not care about the method of storage, so if you're allowed to store a cookie, you're allowed to set something in Local Storage (and vice versa).

Re: Automating cookie consent and GDPR violation detection

#235

Post by tinus_hn »

M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

It would be ineffective to have a law against cookies because everyone would just switch to localstorage or another persistent storage.

Re: Automating cookie consent and GDPR violation detection

#236

Post by M2Ys4U »

1vuio0pswjnm7 wrote: post #229
M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

"There is nothing in the GDPR about cookies." (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers,…

That's a recital, it's not part of the operative text. Recitals are the justification for the legal instrument (here, a Regulation), and are used as an aid to interpretation but they're not legally binding.

Re: Automating cookie consent and GDPR violation detection

#237

Post by M2Ys4U »

tinus_hn wrote: post #235
M2Ys4U wrote: post #30

The GDPR does not require websites to inform users that a website sets cookies. There is nothing in the GDPR about cookies. It's the ePrivacy Directive[0] that deals with cookies (or, rather, "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user"). This is a law that pre-dates the GDPR. If you can't get that right, frankly I question whether anything you…

It would be ineffective to have a law against cookies because everyone would just switch to localstorage or another persistent storage.

Quite, that's why the ePrivacy Directive is more generic with it's language of "[storing] information or to gain[ing] access to information stored in the terminal equipment of a subscriber or user".

Re: Automating cookie consent and GDPR violation detection

#238

Post by alkonaut »

krageon wrote: post #232
alkonaut wrote: post #190

Earlier quoted context omitted.

It can be cheaper to misunderstand it. So long as risk of getting fined is low, and the fines aren't higher than they are, you aren't really tasked with being compliant. You are given a task to implement something in compliance but what that means is as compliant as possible while still making sure the business survives, possibly even on the same business model . That latter part isn't explicitly given to a developer…

Terrible take. If breaking the law to make money is how you operate, you're not a company. You're a criminal cartel.

That’s how all these sites operate now. It’s cheaper to keep operating in violation than shutting down. That’s what should change.

Re: Automating cookie consent and GDPR violation detection

#239

Post by M2Ys4U »

legitster wrote: post #171
andyjansson wrote: post #160

Earlier quoted context omitted.

> some services are literally impossible to provide without a cookie of some form. You seem to be under a misapprehension about what GDPR is about. It is not about cookies, it's about PII.

At this point it's largely semantics. The ePrivacy directives were included in the same piece of GDPR legislation. And when people talk about GDPR they are talking about both.

>At this point it's largely semantics. The ePrivacy directives were included in the same piece of GDPR legislation.

What? No. That's backwards.

The ePrivacy Directive referenced the Data Protection Directive. The GDPR replaced the DPD, and references to the DPD are now references to the GDPR.

That's really not the same as saying the ePD is "included in the same piece of GDPR legislation".

>And when people talk about GDPR they are talking about both.

And those people are wrong.

Re: Automating cookie consent and GDPR violation detection

#240

Post by M2Ys4U »

alfiedotwtf wrote: post #230
dmitriid wrote: post #209

Earlier quoted context omitted.

> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course. basically, you created those problems for yourslef, and now blame the law. > For people who claim GDPR compliance is clear and…

And what if you need third-parties like a payment gateway? How do you do this without sharing PII?

Are you under the assumption that the GDPR requires consent for all processing of personal data?

Because it doesn't.

There are six legal bases for processing personal data in in Article 6 of the GDPR.

Consent is the first one, but the second one listed (paragraph (b)) is that the "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract".

That covers your payment case.

Post reply on HN