Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dark patterns after the GDPR: consent pop-ups and their influence

dl.acm.org

Post reply on HN
Print view View original

101–110 of 234 posts

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#101

Post by unix_fan »

ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

I feel like this is a point the HN crowd likes to ignore when it calls for governments to regulate certain aspects of tech. Do regulations like this really protect consumers, or just make their experience worse?

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#102

Post by Bakary »

dominotw wrote: post #81
Bakary wrote: post #62

Earlier quoted context omitted.

I sincerely doubt that much financial reward will come for any random individual doing this to any randomly selected website in that sample that does not meet the GDPR requirements. On one hand, you've technically got the right idea that I ought to put some skin in the game. On the other, it's a reasoning meant to shut down criticism on the same level as the infamous "yet you participate in society, curious!" comic

> I sincerely doubt that much financial reward will come for any random individual doing this to any randomly selected website in that sample that does not meet the GDPR requirements. Then whats the point of GDPR if its not worth taking them to court. Is the idea that only govt can bring them to justice?

This topic is above my paygrade since I lack the relevant legal knowledge. But some things I've noted so far:

- GDPR shone a light on these practices that is visible to the casual user. This highlights some examples long term counter-productive thinking: people blaming GDPR for showing those practices instead of the practices themselves. A symptom of the messed up ways in which all this has been developed over the years

- Even single governments alone aren't enough in some cases (see France's measly series of fines against Google that probably evoked laughter in the boardroom)

- As a user, the prospect of being able to download my data from FAANGs seemed so miraculous and unrealistic at first that it made me realize I complacent I had gotten to unequal practices and to these websites and companies just doing whatever they wanted whenever they wanted. That specific point alone is worth the entirety of GDPR to me

- Baby steps. GDPR is already a step in the right direction, they are still figuring these things out (especially enforcement) whereas the private sector has decades of experience in anti-user practices, honed by some of the finest minds. The next step is to get a better share of the deal for Europeans as a whole.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#103

Post by josefx »

Zak wrote: post #60
josefx wrote: post #48

Earlier quoted context omitted.

> We added one to OUR WEBSITE even though nothing is hosted in the EU Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it. > simple cargo-culting "everyone is doing it so we must do it also". If your site is cargo culting everything it probably also has a ton of third party trackers for the same reason.

> Serve pages to the EU? You get to follow it. What can the EU do about it if the company has no physical or legal presence in the EU? Have there been any serious attempts at such enforcement?

If it has no presence, no money, no sales, no partners, basically absolutely nothing in the EU then it may be in the clear. But that is a large difference to just not having hosts in the EU.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#104

Post by xg15 »

pixelpoet wrote: post #58

What absolutely infuriates me is this "legitimate interest" crap that is almost always hidden away, and often you have to scroll through literally hundreds of opt-outs with no way to disable them all in a single click. If I'm so damn "legimately interested", why is it on by default and basically impossible to turn off? Find me one person on this earth who is legitimately interested in being tracked by marketing compa…

"legitimate interest" is a legal term with specific definitions in the GDPR. (And indeed it refers to the interest of the site, not yours)

IANAL, but as I understand, it refers to data collection that is inherently needed to perform a service.

E.g., a pizza delivery service has a legitimate interest to know the address of the place where it should deliver the pizza to - because, well, otherwise they can't deliver the pizza.

In such a case, the GDPR wouldn't require the pizza place to get consent. (the GDPR requires that a service is performed even if consent is denied, so without the legitimate interest exception, the pizza place could end up in a legal catch-22 if someone ordered a pizza but denied consent to collect the address.)

The basic idea seems perfectly reasonable to me, but of course sites always tried to stretch the "legitimate interest" definition as wide as they could get away with, and this seems to be the latest iteration of that.

I have no idea where the latest fad of claiming all kinds of ridiculous things as legitimate interest as long as there is an "object" button comes from, but I imagine there was some court case that decided this was borderline legal. If anyone else knows more about this, I'd really like to know as well.

But at least I think this is why many consent popups ask the exact same questions twice, once as "consent", off by default and once as "legitimate interest", on by default: They are simply trying their luck on two separate legal avenues. (Not that this would make any sense from a UX point of view or from the intent of the law. But I guess it does make sense from a "scummy lawyer" point of view)

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#105

Post by Silhouette »

mLuby wrote: post #80

Whether something is "legal" is a fuzzy computation that runs in the minds of average citizens on a jury, though it's more commonly simulated by judges and lawyers. The text is not absolute. So what if an accept-only contract (like a ToS, EULA, or consent pop-up) did what average users think they agreed to, regardless of what the text says? This would shift the burden of understanding from the user, where it currentl…

FWIW, legal systems are sometimes closer to what you're describing there than you might realise. Obviously this varies with jurisdiction, but contracts of adhesion often do carry less weight in the event of litigation, for example automatically giving any benefit of the doubt to the party that didn't write the contract. Often there are relevant consumer protection rules as well, for example a general requirement that the terms of any B2C agreement must be reasonable or they will be unenforceable. More generally still, contract law is usually based on the basic idea of a meeting of minds, with an implication that all parties understand the contract they are entering into.

When we drew up the Ts & Cs for my first business that was selling online, we took advice from a lawyer who specialised in this kind of work, and one of the first points they made was that if there was anything at all surprising or unusual in what we wanted for our terms, it should be emphasized prominently and early, not buried in small print at the back, for exactly the kind of reasons above.

I once saw an anecdote (possibly apocryphal, I don't know) about a consumer rights lawyer who said they never bothered reading the small print in these situations. When someone expressed surprise that even a lawyer wouldn't check what they were signing up to, they replied that either the terms offered would be reasonable, in which case the lawyer would have no problem with them, or they wouldn't, in which case the unreasonable aspects would be unenforceable anyway.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#107

Post by Silhouette »

dominotw wrote: post #81
Bakary wrote: post #62

Earlier quoted context omitted.

I sincerely doubt that much financial reward will come for any random individual doing this to any randomly selected website in that sample that does not meet the GDPR requirements. On one hand, you've technically got the right idea that I ought to put some skin in the game. On the other, it's a reasoning meant to shut down criticism on the same level as the infamous "yet you participate in society, curious!" comic

> I sincerely doubt that much financial reward will come for any random individual doing this to any randomly selected website in that sample that does not meet the GDPR requirements. Then whats the point of GDPR if its not worth taking them to court. Is the idea that only govt can bring them to justice?

Is the idea that only govt can bring them to justice?

Mostly, yes. The main enforcement authority is the government regulator in each member state (and the UK, which retains the system post-Brexit).

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#108

Post by neltnerb »

shadowgovt wrote: post #35
dominotw wrote: post #17

Earlier quoted context omitted.

> fraud then take them to court and make a killing.

Precisely why the new term was devised: dark patterns are not, in general, technically fraud. They are playing completely within the rules but taking advantage of human psychology to tilt the outcome in the direction the website owner wants (and, it is assumed, against what the average user wants).

Well, an interpretation of the rules that their lawyers said was at least justifiable enough to make a legal argument out of. It's hard to write rules when the readers are incentivized strongly to use any ambiguity as a weak spot to attack and use as a workaround rather than following intent.

Following intent isn't a good legal framework either, of course, better to make the people with legal training work hard to write them correctly once rather than making them complicated to interpret.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#109

Post by josefx »

strictnein wrote: post #78
Zak wrote: post #60

Earlier quoted context omitted.

> Serve pages to the EU? You get to follow it. What can the EU do about it if the company has no physical or legal presence in the EU? Have there been any serious attempts at such enforcement?

It's weird how people keep claiming this. No one says that all sites should honor China's laws for visitors from China. No one claims that all sites should honor Saudi Arabia's laws for visitors from Saudi Arabia. But magically the GDPR must be followed by the entire world if a visitor shows up from France.

China has the great firewall, the EU tried something similar under the "think of the children" excuse, which promptly failed.

Also a lot of people speaking out against China had to find out the hard way what some western companies will do when you speak out against a cash cow that will happily kick them out if its rules are enforced.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#110

Post by xtracto »

planb wrote: post #69
ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

Why is this downvoted? This is exactly what happend. Speaking with non tech savvy users here in Germany, they feel safe and secure on Facebook and fear the „world wide west“ that the open Web has become, where you need to click 20 consent messages on every website without knowing what all that stuff means. This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.

I think the GDPR and other sites would have better results if they approached these in a similar manner as how the "nutrition warning labels" are done in Mexico ( https://mexiconewsdaily.com/news/new-warning-labels-now-requ... ):

Make it so every page that contains a tracking element MUST permanently display a large-ish (say, 1% of the screen for each) seal/label indicating that it is tracking you (like ESRB labels). That way, website will be pushed to remove the tracking elements so that they can remove the offending banners.

Post reply on HN