Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Consent-O-Matic: Automatic handling of GDPR consent forms

github.com

Post reply on HN
Print view View original

101–110 of 137 posts

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#101

Post by lmkg »

secondcoming wrote: post #35
hnbad wrote: post #32

Earlier quoted context omitted.

GDPR did mandate defaulting all of those toggles to "decline" though, even though some are trying to get clever and add additional toggles for "legitimate interest" (which isn't how that works legally but AFAIK nobody has been sued over that yet). The follow-up privacy legislation also bans the current dark pattern of making the "accept all" button more prominent and obvious than "decline all" at least requiring both…

Legitimate Interest is a separate Legal Basis.

This gets back to GP's point about GDPR vs ePrivacy Directive. Legitimate Interest is a separate Legal Basis under GDPR (and does in fact allow opt-out). But the ePrivacy Directive does not recognize Legitimate Interest. You cannot use Legitimate Interest as a basis for making a cookie opt-out.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#103

Post by mproud »

I run a site that’s 6 years old and has about 1,000 active users in a week, and 100,000 lifetime users. Maybe that’s considered small? People create images on it, and I store those images. But how many GDPR data requests have I had this entire time?

0.

Not a single one.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#106

Post by jtbayly »

esperent wrote: post #77
brodo wrote: post #42

I wish more people would just use self-hosted analysis tools and stop tracking people across sites. I think github does this and they wrote a blog post detailing their reasoning.

If you're collecting analytics data yourself you still need to comply with GDPR so you still need a cookie banner for anything but extremely basic analytics.

Or you can just ignore GDPR if you're outside the EU.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#107

Post by jtbayly »

clemensnk wrote: post #102
nerdjon wrote: post #97

I am very excited to use this, but I can't find the safari version for Mac or iOS even though it says it exists.

We are currently testing it through testflight. Should be ready for a release soon.

Is there any way to sign up to be notified when it's released?

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#108

Post by coffeeblack »

sdoering wrote: post #22
eternityforest wrote: post #17

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

Just like a robots.txt you could have a privacy.txt or so at the root of the site.

Then the browser could take care of displaying it in a uniform way together with the “accept” and “reject” buttons in a uniform way.

Would be much easier for the website and it would make it impossible to use dark patterns.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#109

Post by chriswarbo »

pornel wrote: post #81
chriswarbo wrote: post #49

Earlier quoted context omitted.

> I wish there was a standard browser API for this. There was: https://en.wikipedia.org/wiki/P3P

And Google was caught exploiting a weakness in the P3P implementation to bypass it entirely. Google was also caught exploiting a loophole in Safari when it added 3rd party cookie blocking: https://www.zdnet.com/article/google-pays-17m-to-settle-safa... AdTech companies want to track you, and it's naive to think they will ever honestly and voluntarily use any APIs that blocks it. Current deliberately-awful cookie cons…

Oh absolutely! I just like to bring up P3P whenever someone inevitably says there should be a standard for 'cookie popups'. AFAIK, P3P actually goes further than all/nothing: it distinguishes between 1st-party/3rd-party, required/optional, which details are involved (IP, email address, etc.), data retention periods, etc. Plus, this was all implemented, in the most popular browser (at the time), a full two decades ago!

The context has obviously changed: there used to be no consequences for lying/bypassing (I didn't actually know about the Google case you mention; although it doesn't surprise me!), and most importantly: there were no consequences for not bothering to put it on a site at all. Hence the low adoption, and hence it died away. That's now changed, there's a chance some "non evil" sites might bring it back.

> Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws.

Yep. That's why machine-readable requests, with default-deny responses from user agents, won't appear any time soon; especially in browsers made/sponsored by adtech giants! The inconvenient, manual-effort is a feature of consent popups (at least, for those who came up with the idea; most sites just jumped on the band-wagon)

Post reply on HN