Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

Post reply on HN
Print view View original

241–250 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#241

Post by M2Ys4U »

ratww wrote: post #222
UnpossibleJim wrote: post #128

Earlier quoted context omitted.

It's "squishy" terms in law, like "usually" that I find bothersome. Granted, I haven't read the complete specifics of all of the minutia when it comes to the GDPR, I'll admit. I do keep cookies by default though, as a habit, which seems to be in violation of GDPR rules. Should I start publishing a blog or some such which was antithetical to the prevailing party doctrine, that happened to gain traction with the public…

> I do keep cookies by default though, as a habit, which seems to be in violation of GDPR rules. Which cookies do you keep? That matters. GDPR doesn't care about cookies, it cares about PII and some other stuff. For example, setting a cookie called "hello" with the value "world" on the browser of every user does not require consent, as long as this is not used to identify specific user, of course.

>For example, setting a cookie called "hello" with the value "world" on the browser of every user does not require consent, as long as this is not used to identify specific user, of course.

No, that needs consent because that cookie is not strictly necessary for the provision of the service.

(But the reason that requires consent is not the GDPR, it's the ePrivacy Directive)

Re: Automating cookie consent and GDPR violation detection

#242

Post by mpweiher »

tick_tock_tick wrote: post #201
mpweiher wrote: post #81

Earlier quoted context omitted.

> So far they seem to be correct. Not really. Just recently: GDPR enforcer rules that IAB Europe’s consent popups are unlawful https://news.ycombinator.com/item?id=30176712 This is going to require some time, and thus some patience.

I mean this clearly is still being worked out as consent popups are a requirement of the law but the enforcers and courts don't seem to like that fact and are getting very creative in there interpretations to avoid the explicit requirements of the law.

Consent popups are not a requirement.

Not needlessly processing personal data is a requirement.

Re: Automating cookie consent and GDPR violation detection

#243

Post by the_gipsy »

ratww wrote: post #220
the_gipsy wrote: post #211

Earlier quoted context omitted.

You are right that technically opt-in should always take longer. No cookies should have been set until the user accepts. But opt-out should not set anything. I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP. If you mean saving to LocalStorage, then I don't think that's allowed either.

> But opt-out should not set anything. I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP. If you mean saving to LocalStorage, then I don't think that's allowed either. It is allowed for this case. You must save a cookie (or a localStorage value) with the user preferences to avoid showing the cookie banner again. Simplifying: cookies are fine under GDPR as long as they don't c…

Thank you, I didn't know that you can set a cookie if it's deanonymized. It does make a lot of sense.

Re: Automating cookie consent and GDPR violation detection

#244

Post by goodpoint »

Nextgrid wrote: post #103
robin_reala wrote: post #78

Earlier quoted context omitted.

Billion-dollar fines can only happen if the company in question had a revenue of €25B per year and was hit with the maximum fine. But either way, enforcement is absolutely happening: https://www.enforcementtracker.com/ has over a 1,000 rulings in its DB.

It's not enough. That link gets posted all the time but it just shows that over 4 years, across all companies, the total fine amount is just over 1Bn. How much does Google or Facebook profit from non-consensual data processing in just a single year?

Clearly the EU wants to give companies the time to adapt.

Internet privacy has been a laissez-faire dystopian wasteland for decades.

Even with the current very gentle enforcement, GDPR has received a lot of push back and called draconian (by those who benefit from corporate surveillance).

Re: Automating cookie consent and GDPR violation detection

#245

Post by shadowgovt »

Jensson wrote: post #227
UnpossibleJim wrote: post #162

Earlier quoted context omitted.

I think everyone seems to be missing the point of what I'm saying, and maybe it's my fault. In the defense of the law that people have given to me, so far, the terms "Usually" and "Unlikely" have come up. Neither of those terms are very satisfactory if I write a critical piece critical of the government and am taken to the full extent of the GDPR's breadth, with little ability to fight it, being a small, independent,…

> In such a case, a massive fine would not only bankrupt that person At worst you are fined for 4% of your annual income, it wont bankrupt you. No government is going to go through all that hassle just to fine an independent journalist for a paltry sum. If they really wanted that power they would add defamation laws like UK where they can put you in jail for speaking negatively about public figures. And until the thi…

The fine is up to up to €20 million or 4 percent of worldwide turnover for the preceding financial year—whichever is higher.

In terms of limits, €20 million is the floor of the upper bound of what the regulator can choose to levy as fine.

> And until the thing you fear happens at least once to a small business we can assume it will never happen

Yes. This is how we hand power to governments and then end up shocked when they are deployed for political ends. All it will take is one politically-inconvenient blogger to cross the wrong person with ties to the regulators, and then there's no structural back-stop to that person getting dragged through a €20 million fine process.

Remember, Aaron Swartz was facing "only" six months in jail...

Re: Automating cookie consent and GDPR violation detection

#246

Post by ratww »

d1sxeyes wrote: post #234
the_gipsy wrote: post #211

Earlier quoted context omitted.

You are right that technically opt-in should always take longer. No cookies should have been set until the user accepts. But opt-out should not set anything. I don't know what you mean by "local cookie", a cookie is always sent over the wire by HTTP. If you mean saving to LocalStorage, then I don't think that's allowed either.

> You are right that technically opt-in should always take longer. Hm... I suppose so, but negligibly. Setting cookies takes milliseconds, so there shouldn't be a significant difference from a user's perspective. > No cookies should have been set until the user accepts. That's not accurate. A number of different types of cookies can be set without consent, generally described as 'strictly necessary' cookies - these i…

> Hm... I suppose so, but negligibly. Setting cookies takes milliseconds, so there shouldn't be a significant difference from a user's perspective.

When you accept third-party cookies in a website, additional scripts can be loaded and additional data can be sent to their backends. In the case of providers like TrustArc, etc, consent data is often sent to those third-party after consent is given.

It is of course possible to defer this in the name of user friendliness, which is what TrustArc, etc, tend to do, but only when there is consent.

Re: Automating cookie consent and GDPR violation detection

#247

Post by 1vuio0pswjnm7 »

M2Ys4U wrote: post #236
1vuio0pswjnm7 wrote: post #229

Earlier quoted context omitted.

"There is nothing in the GDPR about cookies." (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers,…

That's a recital, it's not part of the operative text. Recitals are the justification for the legal instrument (here, a Regulation), and are used as an aid to interpretation but they're not legally binding.

Yes, but that does not change the incorrectness of the statement: "There is nothing in the GDPR about cookies."

GDPR regulates collection and storage of personal data. Cookies are a means of collection and storage of such data. GDPR does not need to mention cookies specifically.

The ePrivacy Directive regulates public networks (cf. publicly accessible networks) and public electronic comminications services, e.g., e-mail, telephone, messaging. Many "tech" companies arguably fall outside that scope because their primary purpose is arguably not communications. GDPR, OTOH, is much more broad in scope and most would agree it regulates websites and "tech" companies.

The ePrivacy Directive addresses cookies specifically in Article 5(3). This "cookie rule" was not in the original regulation. It was added in 2009. The sudden increase in cookie consent requests on websites recently, and the subject of this Usenix presentation abstract, are probably not a response to the ePrivacy Directive.

The ePrivacy Directive is soon going to be replaced with something more up-to-date, with broader scope. Until that new regulation comes into force, there are obvious reasons why the Usenix authors would cite GDPR and not the ePrivacy Directive.

Re: Automating cookie consent and GDPR violation detection

#248

Post by [deleted] »

M2Ys4U wrote: post #236
1vuio0pswjnm7 wrote: post #229

Earlier quoted context omitted.

"There is nothing in the GDPR about cookies." (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers,…

That's a recital, it's not part of the operative text. Recitals are the justification for the legal instrument (here, a Regulation), and are used as an aid to interpretation but they're not legally binding.

[deleted]

Re: Automating cookie consent and GDPR violation detection

#249

Post by [deleted] »

M2Ys4U wrote: post #236
1vuio0pswjnm7 wrote: post #229

Earlier quoted context omitted.

"There is nothing in the GDPR about cookies." (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers,…

That's a recital, it's not part of the operative text. Recitals are the justification for the legal instrument (here, a Regulation), and are used as an aid to interpretation but they're not legally binding.

[deleted]

Re: Automating cookie consent and GDPR violation detection

#250

Post by M2Ys4U »

1vuio0pswjnm7 wrote: post #247
M2Ys4U wrote: post #236

Earlier quoted context omitted.

That's a recital, it's not part of the operative text. Recitals are the justification for the legal instrument (here, a Regulation), and are used as an aid to interpretation but they're not legally binding.

Yes, but that does not change the incorrectness of the statement: "There is nothing in the GDPR about cookies." GDPR regulates collection and storage of personal data. Cookies are a means of collection and storage of such data. GDPR does not need to mention cookies specifically. The ePrivacy Directive regulates public networks (cf. publicly accessible networks) and public electronic comminications services, e.g., e-m…

> Yes, but that does not change the incorrectness of the statement: "There is nothing in the GDPR about cookies."

I disagree, but it's a matter of semantics. I think we can agree that the operational part of the GDPR, the part that has legal force, doesn't mention cookies. Or storing/accessing information on the the terminal equipment of a user if you want to use that definition.

>GDPR regulates collection and storage of personal data. Cookies are a means of collection and storage of such data. GDPR does not need to mention cookies specifically.

But cookies can contain data that are not personal data, and those cookies require consent under the ePrivacy Directive.

And absent the ePD cookies wouldn't need consent (unless that was the legal basis being relied upon under the GDPR).

>The ePrivacy Directive addresses cookies specifically in Article 5(3). This "cookie rule" was not in the original regulation. It was added in 2009. The sudden increase in cookie consent requests on websites recently, and the subject of this Usenix presentation abstract, are probably not a response to the ePrivacy Directive.

No argument from me that the ePD has been (and is constantly being) ignored. And yes, the reason for the sudden increase in consent banners is because of the GDPR, for two reasons:

1) The ePD (as amended) referenced the Data Protection Directive which was replaced by the GDPR, and hence the definition of consent changed. But that still doesn't make violation of the ePD a violation of the GDPR.

2) The GDPR was very well publicised. That meant that people who had no idea what the hell all of this meant, and they first saw the requirements of the ePD at the same time as the GDPR (even though they should have been well aware of it already).

>The ePrivacy Directive is soon going to be replaced with something more up-to-date, with broader scope.

For some value of "soon". They've been promising that for six(!) years now. Hopefully the next round of trialogue (on the 31st March) will get it across the line.

Post reply on HN