Live data from Hacker News

Largest GDPR fines surpass $1.3B

transcend.io

11–20 of 45 posts

Re: Largest GDPR fines surpass $1.3B

#11

Earlier quoted context omitted.

Maybe web devs should more carefully consider how much crap third party scripts and resources inject into their sites, rather than caring about a tiny bit of convenience.

Maybe users should be responsible for what they intentionally run on their machines.

That’s absurd. That’s like saying car owners should be held responsible for how safe their car is to drive. It makes unrealistic assumptions about the competency of the end user to judge such things.

Re: Largest GDPR fines surpass $1.3B

#12
post #7
post #6

Earlier quoted context omitted.

just embedding a tweet from Twitter's official embed code makes you violate GDPR (e.g. if you have a blog and want to reference a tweet). Twitter injects a ton of cookies and there's not much you can do about it

Using Google fonts is a violation now. It's a nightmare for web developers.

Note that fonts from Google Fonts can be self-hosted which resolves that problem. It's a little bit more work to set up, but it does resolve this issue well, while also being slightly more efficient for the end-user (assuming that you've got a decent CDN setup).

Re: Largest GDPR fines surpass $1.3B

#13
post #6
post #2

The section on “ How to avoid GDPR fines in 2022” is naïve to a fault. My personal opinion is that after recent rulings startups need to be very careful. GDPR compliance is practically a nightmare for any entity that even so much implements visitor counter with default http logging turned on. It will be interesting to see how solutions and landscape evolves once GDPR fines come to smaller companies and startups.

just embedding a tweet from Twitter's official embed code makes you violate GDPR (e.g. if you have a blog and want to reference a tweet). Twitter injects a ton of cookies and there's not much you can do about it

Can someone explain to me how GDPR makes you responsible for twitter collecting data? It's not your faukt if twitter has their own cookies... What matters is whi stores the data who in this case is not the person embedding twitter

Re: Largest GDPR fines surpass $1.3B

#14
post #4
post #3

"According to France’s privacy watchdog CNIL, Youtube users only had to click once to accept cookies, whereas refusing cookies took multiple clicks. CNIL’s complaint stated that Google purposefully made the consent mechanisms more complex to push consumers to accept cookies––a clear violation of the GDPR’s requirement that companies provide equally simple ways to opt into or out of data collection." So these dark pat…

They were from the start and this was abundantly clear, but given the complete lack of enforcement, people just did whatever the big websites were doing. If these don't get caught, why would they go for random cooking blogs?

What if they could go for the companies building these standardized GDPR cookie consent dialogs instead...

Re: Largest GDPR fines surpass $1.3B

#15
post #7
post #6

Earlier quoted context omitted.

just embedding a tweet from Twitter's official embed code makes you violate GDPR (e.g. if you have a blog and want to reference a tweet). Twitter injects a ton of cookies and there's not much you can do about it

Using Google fonts is a violation now. It's a nightmare for web developers.

How could that possibly be a nightmare? Download the fonts and host them yourself.

Re: Largest GDPR fines surpass $1.3B

#16
post #13
post #6

Earlier quoted context omitted.

just embedding a tweet from Twitter's official embed code makes you violate GDPR (e.g. if you have a blog and want to reference a tweet). Twitter injects a ton of cookies and there's not much you can do about it

Can someone explain to me how GDPR makes you responsible for twitter collecting data? It's not your faukt if twitter has their own cookies... What matters is whi stores the data who in this case is not the person embedding twitter

Quite simple. You just facilitated Twitter's data collection. Without you it would not have happened.

Even worse, the user loading your page could probably not have known you embedded a Tweet (and sent their data to Twitter) before actually loading the page (if you didn't implement a consent dialog with a reject option).

Re: Largest GDPR fines surpass $1.3B

#17

Earlier quoted context omitted.

Maybe web devs should more carefully consider how much crap third party scripts and resources inject into their sites, rather than caring about a tiny bit of convenience.

Maybe users should be responsible for what they intentionally run on their machines.

Your right. The best way is to filter at the firewall level everything Google, Microsoft, Cloudfare, Facebook, Twitter etc. The world would be a better place. Now try to do this on Windows 10 :)

Re: Largest GDPR fines surpass $1.3B

#18

Earlier quoted context omitted.

Maybe users should be responsible for what they intentionally run on their machines.

Nobody in their right mind is going to carefully peruse the cookies and injected JS scripts of every page they visit. No, the onus is clearly on the developers, who are the ones with the professional responsibility to make software that abides by the laws.

When the law is not enforced, there is no hope.

Re: Largest GDPR fines surpass $1.3B

#19
post #6
post #2

The section on “ How to avoid GDPR fines in 2022” is naïve to a fault. My personal opinion is that after recent rulings startups need to be very careful. GDPR compliance is practically a nightmare for any entity that even so much implements visitor counter with default http logging turned on. It will be interesting to see how solutions and landscape evolves once GDPR fines come to smaller companies and startups.

just embedding a tweet from Twitter's official embed code makes you violate GDPR (e.g. if you have a blog and want to reference a tweet). Twitter injects a ton of cookies and there's not much you can do about it

You should not do any tracking (in which case you do not need any pop-up and approval dialog) and if you put things like twitter feeds, Google analytics and Adsense, you need to have a choice for the user which, if they do not want this, will not put them on your site.

The thing is; most sites do not honour your choices or make them as hard as possible as analytics and Adsense are required for monetising. Analytics can be replaced by friendly versions that are gdpr compliant without personal info storage or cookie tracking, but then your monetising (Adsense) or internet marketing (AdWords and landing pages) are not integrated into funnels and a lot harder.

I have tested it with some of our assets (most of which do no tracking at all and only have 1 necessary cookie for login without SaaS cannot work) but a few have Adsense and analytics; we have a small and simply bar; accept or not accept; both is one click. ~90% (not exact as we try to compare the Google analytics which means they did say Accept vs the none cookie analytics which means both accept and not accept) clicks Accept which is enough. We use [0] by the way.

[0] https://plausible.io

Re: Largest GDPR fines surpass $1.3B

#20
post #7
post #6

Earlier quoted context omitted.

just embedding a tweet from Twitter's official embed code makes you violate GDPR (e.g. if you have a blog and want to reference a tweet). Twitter injects a ton of cookies and there's not much you can do about it

Using Google fonts is a violation now. It's a nightmare for web developers.

You can put this in your build steps that it downloads everything; I have that and prefer it anyway; companies ‘tend’ to suddenly remove, change or switch things off or get hacked.
Post reply on HN