The most frustrating thing about the cookie banner is that the solution was always obvious: just use the DNT setting on your browser (Do Not Track). It already existed. However, powerful interest groups like ad companies that profit from your attention (which hysterically virtually powers the Internet today) were able to stop it from happening. It was debated way back in 2009 when the GDPR was being developed. Iirc t…
Do Not Track cannot satisfy the GDPR, it requires that you obtain informed and specific consent so even if a user had the DNT bit set to consenting you would still need to show the banner.
It depends on what is to be analyzed. How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask. Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side.
Of course, recognizing users across days requires consent. But is that really necessary?
I find the cookie banner always ironically wrongly labeled. Everyone claims to "respect your privacy" while actually disrespecting the privacy. If they did actually respect the privacy they would not use non functional tracking cookies and there would be no need to display the banner.
One possibility you failed to enumerate was that you are wrong. But anyway. What exactly do you mean by “buried or obscured”? As I said above, if the parties cannot be said to have an agreement because the terms of the agreement itself are inscrutable, then that would probably result in no contract being formed, or the terms at issue interpreted in the light most favorable to the non-drafting party. Like if the terms…
A more concrete example may be useful to explain what I’m thinking. A company has you click to agree to their TOS. They link a doc, which is of course quite long. That doc has a footnote which links to another doc. You do not read the secondary doc, and it is the contents of that doc that allows the company to sell you data/prevent you from suing them/harvest your organs/abduct your family/whatever. My point is that…
Incorporations by reference are not unusual in contracts. A contract is unlikely to be voided merely because the contract has references and the counterparty didn't read them.
The cookie banner is a significant accessibility problem, for blind and low vision users, among others. I would like to see a stronger push to attack it from that angle.
I am a builder in the same space(tracking analytics) and I agree with killing the cookie banner. It is really annoying and most of the time, sites don't even respect the decision, they just track it nonetheless. Setting up a consent stance once per browser is way better, also I think there should be fines for the websites that don't follow the same.
This is indeed a rather good implementation of ehat GDPR requires: clear unambiguous language, an opt-out available immediately. This is the definition of informed consent
The GDPR doesn’t allow opt-out consent to count as consent. The only consent it recognizes as valid consent is opt-in. However, since we are discussing the banner that The Guardian website shows to US viewers, I assume they’re trying to comply with California privacy law, which does allow opt-out regarding the sale of personal information.
> The GDPR doesn’t allow opt-out consent to count as consent.
wat
GDPR says that opt-out is the default, and if you are asking for consent, it had to be clear, unambiguous, and with both chouces clearly present.
> but it might also be "you can have this content for free". ads don't require invasve and pervasive tracking
Effective ads absolutely require knowing more about the user than the context on the page it's a 1-2 orders of magnitude revenue difference for the publisher per-impression.
> Effective ads absolutely require knowing more about the user than the context on the page
That's what the tracking industry keeps telling you with zero evidence it's true.