Europe's GDPR privacy law is headed for red tape bonfire within 'weeks' • Hacker News Board

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#131

Post by andrewla » Mon, Apr 07, 2025, 8:24 PM UTC

Muromec wrote: post #110

andrewla wrote: post #101

Earlier quoted context omitted.

Wait, are you implying that regulations are hard to comply with, poorly documented, and enforcement is extremely selective to the point where they no longer achieve their intended function? Big news if true. They should do something about that.

it's not that it's hard to comply, it's fighting malicious compliance which is hard. nevertheless, it's a good damn question why every single operator that has "accept all" and doesn't have "reject all" right there on the consent banner isn't fined on the spot. I think the commission noted this behavior and malicious compliance is already factored into the DMA act. The "deregulation" of GDPR could as well be retrofit…

That's cute.

Worth noting first that this is not really the GDPR (nobody here has said that it is directly, but in other threads people are making that assumption), this is the ePrivacy Directive (which is probably what the EU should be revising in light of these universally hated popups).

The EU hands out arbitrary fines to large companies that range in the hundreds of millions of dollars, and ask companies to comply with these "technology-neutral" guidelines [1] which are so opaque that it is impossible to decipher when you are and are not in compliance with them.

> The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible

This is wonderfully clear and explains exactly when you will and won't be the victim of extortion-level fines from the EU.

You call it malicious compliance; sure, but when this is what everyone else is doing, and you decide that you want to go against "industry norms" for your website, you are painting a giant target on your back.

[1] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#132

Post by awiesenhofer » Mon, Apr 07, 2025, 8:27 PM UTC

cbeach wrote: post #124

Gud wrote: post #86

Earlier quoted context omitted.

Are cookie banners really a requirement in that case? I think as long as you don’t share the data with a third party you’re in the clear?

Yes. For example, if you want to track unique users (for the most rudimentary analytics), you'll need to put a uuid in a cookie on their browser, and you'll need to damage your UX with a stupid cookie consent popup, thanks to EU Directives. This is not nefarious data collection, and it shouldn't need user consent - but it does, because EU lawmakers were overzealous and careless when designing their regulation.

No, you dont! Only if you use third party services to do that or collect data thats not essential to your business. Its just coloquially called a "Cookie Banner", but the laws DONT require you to put up one as soon as you set one cookie!

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#133

Post by const_cast » Mon, Apr 07, 2025, 8:31 PM UTC

cbeach wrote: post #124

Gud wrote: post #86

Earlier quoted context omitted.

Are cookie banners really a requirement in that case? I think as long as you don’t share the data with a third party you’re in the clear?

Yes. For example, if you want to track unique users (for the most rudimentary analytics), you'll need to put a uuid in a cookie on their browser, and you'll need to damage your UX with a stupid cookie consent popup, thanks to EU Directives. This is not nefarious data collection, and it shouldn't need user consent - but it does, because EU lawmakers were overzealous and careless when designing their regulation.

You don’t require any for cookies that facilitate necessary site functionality, like login or, in this case, a uuid.

There’s widespread misunderstanding of the law.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#134

Post by awiesenhofer » Mon, Apr 07, 2025, 8:33 PM UTC

cbeach wrote: post #121

alextingle wrote: post #105

Earlier quoted context omitted.

The EU didn't mandate that annoying UI. That's malicious compliance from businesses who are trying to undermine the law.

You're suggesting that companies ruin their own UX to "undermine a law?" That this is all a big conspiracy by nearly every company on the web against our precious overlords in the European Commission?

No need for any "big conspiracy" when nobody is reading the actual law and instead everyone just copies everyone else.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#135

Post by NikkiA » Mon, Apr 07, 2025, 8:35 PM UTC

aleph_minus_one wrote: post #69

bambax wrote: post #54

Earlier quoted context omitted.

And in the world of bureaucracy, "simplification" doesn't mean what you'd think it should mean. "Simplification" consists in adding exceptions, which are in effect additional rules and special cases. Simplification actually means everything gets more complex.

We live in an Orwellian world: War is peace. Freedom is slavery. Ignorance is strength. Simplification is complication.

"Si vis pacem, para bellum"

we have always lived in that world.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#136

Post by const_cast » Mon, Apr 07, 2025, 8:38 PM UTC

ivan_gammel wrote: post #113

diggan wrote: post #88

Earlier quoted context omitted.

> It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd…

Ok, let me try to explain once again: > if you have experience with it This must not be an expectation for any regulation that applies to business in general. Let’s say I just graduated from a college where I learned to be a plumber. I registered my firm and now want to acquire customers online, so I hire some local agency to build a website and an order form. You cannot realistically expect that I have any experienc…

[dead]

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#137

Post by const_cast » Mon, Apr 07, 2025, 8:40 PM UTC

cbeach wrote: post #122

vkou wrote: post #93

Earlier quoted context omitted.

You can eliminate friction in your UX by not collecting data you don't need. It's way less work to, you know, not collect that data. I'm not sure why the government is needed to solve a problem that you've gone out of the way to inflict on yourself.

Let's say I want to improve my site by recording basic user analytics like unique user counts, to produce actionable data. I'm not nefariously collecting their social security number. I'm just putting some uuid in a harmless cookie in their browser so I can track which requests are from a unique browser. Thanks to the GDPR I cannot do this without the stupid cookie warning popup. In this regard, the GDPR is clumsy la…

You don’t require the cookie popup for this.

Again, nobody is actually reading the law here. Tech is 99% followers who blindly do whatever without understanding the motivation behind it.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#138

Post by awiesenhofer » Mon, Apr 07, 2025, 8:41 PM UTC

cbeach wrote: post #122

vkou wrote: post #93

Earlier quoted context omitted.

You can eliminate friction in your UX by not collecting data you don't need. It's way less work to, you know, not collect that data. I'm not sure why the government is needed to solve a problem that you've gone out of the way to inflict on yourself.

Let's say I want to improve my site by recording basic user analytics like unique user counts, to produce actionable data. I'm not nefariously collecting their social security number. I'm just putting some uuid in a harmless cookie in their browser so I can track which requests are from a unique browser. Thanks to the GDPR I cannot do this without the stupid cookie warning popup. In this regard, the GDPR is clumsy la…

> I'm not nefariously collecting their social security number.

In which case, the GDPR doesnt even apply to you! Only if you collect/store PII the GDPR starts to apply!

> Thanks to the GDPR I cannot do this without the stupid cookie warning popup.

Again, the GDPR has nothing in it about cookie banners.

> the GDPR is clumsy lawmaking

It isnt, people are just complaining about it without ever actually reading it or doing much research.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#139

Post by SOLAR_FIELDS » Mon, Apr 07, 2025, 8:49 PM UTC

ivan_gammel wrote: post #113

diggan wrote: post #88

Earlier quoted context omitted.

> It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd…

Ok, let me try to explain once again: > if you have experience with it This must not be an expectation for any regulation that applies to business in general. Let’s say I just graduated from a college where I learned to be a plumber. I registered my firm and now want to acquire customers online, so I hire some local agency to build a website and an order form. You cannot realistically expect that I have any experienc…

This kind of line of thinking assumes a couple of things:

1. People are doing things the “wrong” way in the first place. It’s already been established that compliance isn’t hard if you are doing things the “right” way.

2. Compliance is hard. It really isn’t if you are doing things already the right way

Ultimately GDPR is not the problem, it’s people getting into tech that either have no understanding or respect for the data of others wanting to to do business. You wouldn’t expect me to be building bridges without complying to bridge building standards would you? Why is this any different? Lives are not directly on the line here, but the consequences of being sloppy with data are still very bad. This whole paragraph puts the cart before the horse because it assumes the most important thing is that the person in question is supposed to be able to transact business, not that the most important thing is to protect the personal information of people.

I’m not expecting the plumber to be a technologist. If the plumber wants to roll his or her own technology, fine, deal with the compliance headache. I expect the plumber to instead pay someone to figure out how to build the thing properly, just like how I don’t go building load bearing structures on my home myself because I’m not a structural engineer and don’t want to spend the time learning how to do that.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#140

Post by diggan » Mon, Apr 07, 2025, 8:54 PM UTC

ivan_gammel wrote: post #113

diggan wrote: post #88

Earlier quoted context omitted.

> It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd…

Ok, let me try to explain once again: > if you have experience with it This must not be an expectation for any regulation that applies to business in general. Let’s say I just graduated from a college where I learned to be a plumber. I registered my firm and now want to acquire customers online, so I hire some local agency to build a website and an order form. You cannot realistically expect that I have any experienc…

> This must not be an expectation for any regulation that applies to business in general

Why not? We have that for a bunch of professions already, and for good reasons. You can't just claim to be a doctor, run a hospital or work as a electrician, you need to prove you're able to, before you can do certain things.

Engineers should already be data-aware by default, regardless of what regulations, since we do have the expertise to understand it. Then I guess the expectation was initially kind of that businesses would self-regulate, but seemingly not, so here comes the end of the cowboy developer days, if you want to build large companies that handle people's personal data at least.

> You cannot realistically expect that I have any experience with GDPR or fully understand its requirements

If you build websites where the idea is that you store people's personal data, then yes you should understand what that means and how that works. Like if someone called a plumber for a pressure problem, and the plumber says "How am I expected to understand how that works in your specific house?!", of course I expect the plumber to know their shit around their profession. If you don't understand the technology nor what rules you have to follow, then don't go into that profession.

> Non-compliant businesses are not those who are malicious or ignorant, they can make mistakes because legislators did not help them.

In my experience, the companies who had a hard time becoming compliant with GDPR were companies that either made their revenue by selling user data, and now had to make a lot of changes, or companies that were careless with data in the first place, not thinking twice about where to store things or who has access to what.

I'd be happy to see any sort of counter example of a company that A) doesn't make their revenue based on selling personal data, B) have a thoughtful architecture/design for data in the first place, together with C) had a difficult time becoming compliant with GDPR.