161–170 of 193 posts
Earlier quoted context omitted.
What's wrong with parsing your own log files locally?
Whether you parse log files locally, or in the cloud, or use a cookie really doesn't matter to the GDPR. They only mention the word "cookie" once in the entire law, it's independent of technology, as it should be. If you store personal information (like IP address) in your log files, you still need consent.
Honestly, I think it is our job as the creators/hackers to come up with a better solution. The problem is very real, and needs to be fixed. But no good solution has ever been created by lawyers. Ever. So here we are, left with a forest of cookie warnings that perfectly break the internet. So here is a proposal: What if a user could declare her/his consent settings _before_ opening the website? There would no longer b…
Earlier quoted context omitted.
> Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for trackin…
> I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law. There's two sides for this. For one, this is the infrastructure that already exists and that is out there in the wild. If you start selling 500V electric appliances, people can of course buy transformers or the state could upgrade its grid, but in…
And this is not even just at a systems level that I think is problematic - for those working with it, it's also with what it enables and what it doesn't.
I'm not a genius but I can see many ways of solving these cookie/privacy issues and I'm sure the smart folks back at these companies (browser, ads, etc) could too, they just choose not to.
Earlier quoted context omitted.
> Because the law obviously didn't help stopping companies from doing shady shit It helped immensely . I work in the financial sector in an EU country, and most institutions in my country are terrified about the GDPR. The fact that some people will happily operate on the border or even closely beyond the border of law, applies to any other regulation as well.
How is it helpful if most institutions are terrified ? Doesn't it indicate that the regulation is unreasonable instead? If the EU commission can't run a website without a popup, then why would you expect anyone else to be able to?
Running a website without a popup is easy. Just stop any processing that is not necessary for you to provide the service.
"But I want to track what users are doing!" - Well, then you have to show them a popup about that.
The GDPR holds that data protection is a fundamental right. Consequently, the user's interests generally trump a website owner's interest.
Earlier quoted context omitted.
The law forced the companies to be explicit about what they do, and ask for consent. The user experience is made shit by the companies doing shady things. If they didn't do shady shit, they wouldn't have to display any banner. I'd rather be informed, at least I can make a decision that way. Why shoot the messenger? The part that is missing is making rejecting as easy as accepting. So far there are a lot of dark patte…
How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info). The law could have been much better if it simply asked browser makers to provide a single place to configure your preferen…
Setting a cookie is not in itself a GDPR violation. Collecting personally identifiable information is. You can collect unique visitors by setting a cookie but without collecting personally identifiable information, so no consent popup would be required for that:
1. Set a "site last visited: , " cookie if it is not set.
2. Count hits as appropriate by examining the cookie - without collecting IP addresses.
Since no personally identifiable information is being collected with this scheme, consent is not required.
Earlier quoted context omitted.
Beautiful technical solution. Wouldn’t it depend on all website creators and all browser makers to pretty much commit to changes in their code at the same time, before the first consent banner would actually go away? How do you get them to do that?
You could do user agent sniffing and skip showing the banner if you know the browser supports cookie purposes. Of course user agent sniffing tends to cause a lot of problems, so this probably isn't a good idea.
Earlier quoted context omitted.
Surely there's an easier way: Standardize an extension to the Set-Cookie header for a "Purpose" field. This field if unset means the cookie is essential (local laws now still apply so if a website misrepresents a non-essential cookie as essential then that's illegal just the same way as implementing a fake cookie banner or not implementing one (if you need it) is illegal). Now in my browser I can set my cookie prefer…
Beautiful technical solution. Wouldn’t it depend on all website creators and all browser makers to pretty much commit to changes in their code at the same time, before the first consent banner would actually go away? How do you get them to do that?
Earlier quoted context omitted.
Whether you parse log files locally, or in the cloud, or use a cookie really doesn't matter to the GDPR. They only mention the word "cookie" once in the entire law, it's independent of technology, as it should be. If you store personal information (like IP address) in your log files, you still need consent.
The 'cookie law' under discussion here predates GDPR by seven years, and mentions cookies repeatedly...
Earlier quoted context omitted.
How is it helpful if most institutions are terrified ? Doesn't it indicate that the regulation is unreasonable instead? If the EU commission can't run a website without a popup, then why would you expect anyone else to be able to?
I meant terrified of doing shady stuff (as I was responding to the assertion that it didn't stop doing shady stuff), not terrified in general. Running a website without a popup is easy . Just stop any processing that is not necessary for you to provide the service. "But I want to track what users are doing!" - Well, then you have to show them a popup about that. The GDPR holds that data protection is a fundamental ri…
I think most website owners don't care about that, but they do care about earning money to actually run the website.
>The GDPR holds that data protection is a fundamental right.
The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay for it or not. You cannot not show content to users who refuse to share the data. Effectively, everyone else has to subsidize them.
And that's why you have a labyrinth of pop ups - GDPR breaks the normal monetization methods of the web. Suddenly they're surprised that this led to dark patterns.
Earlier quoted context omitted.
I meant terrified of doing shady stuff (as I was responding to the assertion that it didn't stop doing shady stuff), not terrified in general. Running a website without a popup is easy . Just stop any processing that is not necessary for you to provide the service. "But I want to track what users are doing!" - Well, then you have to show them a popup about that. The GDPR holds that data protection is a fundamental ri…
> "But I want to track what users are doing!" - Well, then you have to show them a popup about that. I think most website owners don't care about that, but they do care about earning money to actually run the website. > The GDPR holds that data protection is a fundamental right. The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay fo…