Live data from Hacker News

Consent-O-Matic: Automatic handling of GDPR consent forms

github.com

131–137 of 137 posts

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#131
post #60

Earlier quoted context omitted.

> I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? There was Do-Not-Track , but the industry decided it shouldn't be respected.

Do Not Track was always a joke. Without any legal teeth, why would people determined to spy on you stop spying on you because you say "Please"?

GDPR for example gives it teeth.

Grandparent post asked for a technical solution to hide cookie banners forever.

A websites don't have to show any cookie banner whatsoever if they honor Do-Not-Track.

If they don't show a banner but still track, they're breaking the law.

The problem of cookie banners is easy to solve. All that's lacking is honesty from adware vendors and website operators.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#132
post #60

Earlier quoted context omitted.

> I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? There was Do-Not-Track , but the industry decided it shouldn't be respected.

I would love for an update to GDPR, stating that any automated form of refusal for consent, including the Do-Not-Track header, must be treated as an explicit refusal and may not result in additional requests.

That's a great idea and would be an amazing next step.

Do-Not-Track can already be honoured by website operators. The issue is just that they choose not to do it.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#133

Earlier quoted context omitted.

I was in ad tech once. We obeyed it. Lots of traffic went through us. No one cared that we obeyed it and our competitors didn’t. Left the code in anyway but that’s the thing about these things: consumer behavior reveals that they don’t actually give a fuck about whether anyone obeys this or not except for the time when they want to be outraged.

The thing is that from a user's perspective there's no way to tell whether someone obeys it or not because lying is not punished, so the safe thing to do is to assume the worst in all cases.

Right. It's rational for the user not to care. The point is that it was designed to fail since there's no closed loop verification. i.e. DNT was a bad design.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#134

Earlier quoted context omitted.

If you're collecting analytics data yourself you still need to comply with GDPR so you still need a cookie banner for anything but extremely basic analytics.

Or you can just ignore GDPR if you're outside the EU.

If you don't want to do business in the EU, sure. Collecting the data of EU citizens and using it for advertising purposes means you're doing business in the EU though.

This applies whether it's you doing the collecting or Google's "free" analytics service.

Of course if you're a running a small website you'll probably get away with it. For now.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#135
post #112

Earlier quoted context omitted.

If you care about your data being harvested it's not the same though. This one actually declines tracking. I don't care about cookies often accepts all tracking for you.

"""In most cases, it just blocks or hides cookie related pop-ups. When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do). It doesn't delete cookies."""

Which basically rewards sites that intentionally make it hard to avoid clicking yes.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#136

I wish there was an open source project for developers to implement those darn consent forms. Adsense offers an automatic consent modal. But the problem with that one is that it not only displays the consent modal but also injects a smaller widget into the site. It looks like the widget only pops up when the user scrolls down to the bottom of the page. Unfortunately, that also makes it pop up when the page is not lon…

How about implementing the website or app as if all users only give consent to essential cookies and show no consent UI at all?

First of all, GDPR is not about cookies. It is about personal data. And so far, courts have considered the user's IP to be personal data.

Since advertisers need to know if you really show their ads, the ads need to send some signal back from the user to the advertiser. So ads always send the user's IP to a third party: The advertiser or a trusted intermediary.

Assuming no consent to that for everybody would mean that the revenue of my website goes to zero. And I would not be able to run it anymore. As the ones paying for the costs are the users who consent.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#137

Earlier quoted context omitted.

If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent for a surgery two weeks later if I hadn't been aware of the risks of the surgery at the time that I signed the form. Being informed of the specifics for a particular procedure is necessary, not just being informed of the general risks of medical procedures. In the same way, GDPR requires…

We cannot have a modern technological society if we treat tracking with the same concern we treat medical consent. That road leads to banning street photography and CCTV, and being able to get a gag order to stop people from saying "Yeah I saw Brian at the bar last night". When does it stop? There are no uses of cookies an average user cares about that aren't already illegal. They are basically all for the same thing…

This is a late reply, but I'd been thinking on what you said and wanted to figure out where my disagreement lay. I think the biggest issue is that scale must be considered, and not merely whether each individual action is justified.

* Asking if somebody saw Brian at the bar last night is acceptable. Asking everybody if they saw Brian somewhere is acceptable in limited circumstances, such as Brian having been kidnapped. Asking everybody to list out who they saw and when is an unacceptable violation of privacy.

* Street photography is acceptable. Taking a picture once every day of the same house may be acceptable, such as if it is a historically interesting building, or if it is your own house. Collecting millions of street photographs, along with the time they were taken and who was in each photograph, is an unacceptable violation of privacy.

* CCTV is acceptable. Maintaining records of CCTV indefinitely may be acceptable, depending on the type of building. (e.g. The Pentagon may be justified in keeping CCTV recordings indefinitely, but the local laundromat is not.) Linking CCTV cameras together into a centralized query-able network that tracks people between locations is an unacceptable violation of privacy.

There are two common features that I realized in these examples. First, even if an individual action is acceptable and justified, repetition and coordination of that action may not be. This is similar to how saying hello when crossing paths with somebody is a courtesy and a pleasantry, but saying hello to the same person every 30 seconds is stalking. The difference in scale produces a different in outcome.

Second, there exist gradations of privacy, rather than being a binary divide between public and private spaces. Between a completely private space, such as a person inside their own home with the windows drawn, and a completely public space, such as a person giving a speech on live TV, there are intermediate spaces. A person who is walking down the street has partial privacy, where their actions may be remembered by passersby for a day or two, but wouldn't be remembered a month or a year later. In the past, these gradations of privacy were maintained by the limits of human memory and the high cost of technological memory, but the cost of technological memory has fallen to a point where this social construct is breaking down.

Summing up, I would say that we cannot have a modern technological society if we *don't* treat tracking with the same concern we treat medical consent.

Post reply on HN