Dark patterns after the GDPR: consent pop-ups and their influence • Hacker News Board

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#191

Post by stiray » Sat, Mar 06, 2021, 12:31 PM UTC

MereInterest wrote: post #2

Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no indication as to whether the "Got it" button is taken as consent for tracking, nor is there a "Reject all non-essential tracking" option on the main banner. Whether or not this site is compliant depends on whether the "Got it" button is taken as affirmative conse…

What I have seen everywhere is that all the consent is based on violating one of fundamentals of GDPR Art. 7(4):

"It shall be as easy to withdraw as to give consent."

All those dark patterns to hide the rejection, keep some things ticked etc. are a complete waste of time. They all violate GDPR and are just another case for: no one has read the GDPR and is just copying everyone else.

It is just a waste of developers time, hiding rejection of consent, making it less understandable, etc. is just violating the GDPR. Google is violating it, Facebook is violating it,... but they have money for lawsuits, if you have it too, no problem, just copy them, if not, reconsider your tactics.

Bottom line, you are wasting time and effort to implement it, you are trolling the users with popups and at the end even the consents that you got is invalid and void. So why doing it?

Imagine the scenario, your beautiful website, your beautiful android application is being checked for a GDPR compliance based on lawsuit.

And you bring in your dark-patterned consent dialog (whoever the provider is, it doesn't matter, YOU are the controller, YOU are the one who needs to care for your visitors/users privacy and you will be fined if google ads are violating privacy by their scripts run from your application/site).

What do you think will happen, you will get pat on your back and someone one will say "you poor thing, you didn't understand, let me pardon you" or you will get an "Tommy Lee Jones" implicit facepalm [1]?

Same goes for all the sites that stuff the user id into the "consent/no consent" cookie where just setting "consent=yes" or "consent=no" would be enough. Again, just same thing, for avoiding storing one PII you create another PII (by GDPR, anything that is unique to a person is PII) and violate it by doing that. Just why. Dont bother. Wait for a law suit and that is it. Dont just waste more money with same result as not wasting it, rather label a jar with "GDPR Lawsuit" label and stuff the money wasted for illegal consent methods into the jar.

[1] https://me.me/i/implied-facepalm-when-something-is-so-ridicu...

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#192

Post by ketzu » Sat, Mar 06, 2021, 12:52 PM UTC

xtracto wrote: post #110

planb wrote: post #69

Earlier quoted context omitted.

Why is this downvoted? This is exactly what happend. Speaking with non tech savvy users here in Germany, they feel safe and secure on Facebook and fear the „world wide west“ that the open Web has become, where you need to click 20 consent messages on every website without knowing what all that stuff means. This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.

I think the GDPR and other sites would have better results if they approached these in a similar manner as how the "nutrition warning labels" are done in Mexico ( https://mexiconewsdaily.com/news/new-warning-labels-now-requ... ): Make it so every page that contains a tracking element MUST permanently display a large-ish (say, 1% of the screen for each) seal/label indicating that it is tracking you (like ESRB labels).…

> That way, website will be pushed to remove the tracking elements so that they can remove the offending banners.

Don't they currently have the same incentive? (And mostly don't act on it.)

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#193

Post by ketzu » Sat, Mar 06, 2021, 1:05 PM UTC

mtm7 wrote: post #146

Ideally, we'd be able to control opt-outs at the browser level. The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in: [Accept] / [Decline] / [Manage preferences]

> Ideally, we'd be able to control opt-outs at the browser level.

We tried it at the protocol level with do-not-track and it just gave them an additional bit of info to track.

But I agree: It would be awesome to have this as a browser option. Just send a list of all the optional things to my browser which responds with the accepted results.

> The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in

Isn't this what's written in the GDPR?

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#194

Post by ketzu » Sat, Mar 06, 2021, 1:07 PM UTC

Macha wrote: post #130

butz wrote: post #98

How about introducing a standard way to declare and categorize cookies and let browser take care of consent? On first start set your default cookie preferences for all websites and adjust per website, when needed. It could be quickly build as an extension first and later moved to browser core.

This was P3P. Without legal backing, advertiser's will weasel out of any technical measure. You can even see this in the common practice of showing a app specific permission prompt ahead of browser/OS level prompts because they no that being rejected at the OS level removes their ability to prompt again later. Legal systems are not so willing to prescribe specific technical solutions to avoid the "oh, you had very sp…

> Legal systems are not so willing to prescribe specific technical solutions

Also, when they do that, it is often critizised that the technical solution is out of date, inappropriate, prevents competition in the space and many more. (Often rightfully so.)

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#195

Post by MaxBarraclough » Sat, Mar 06, 2021, 1:13 PM UTC

ketzu wrote: post #193

mtm7 wrote: post #146

Ideally, we'd be able to control opt-outs at the browser level. The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in: [Accept] / [Decline] / [Manage preferences]

> Ideally, we'd be able to control opt-outs at the browser level. We tried it at the protocol level with do-not-track and it just gave them an additional bit of info to track. But I agree: It would be awesome to have this as a browser option. Just send a list of all the optional things to my browser which responds with the accepted results. > The second best thing would be a law to prevent consent popups from making…

> Isn't this what's written in the GDPR?

Yes. A pity it's almost never enforced. From [0]:

> Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent.

> Explicit consent requires a very clear and specific statement of consent.

> Make it easy for people to withdraw consent and tell them how.

[0] https://ico.org.uk/for-organisations/guide-to-data-protectio...

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#196

Post by iso1210 » Sat, Mar 06, 2021, 1:16 PM UTC

robgibbons wrote: post #112

Bakary wrote: post #53

Earlier quoted context omitted.

That's like accusing the flashlight of making rats scurry under the floorboard

You keep using this when people complain about GDPR consent banners. We get it, cookies are bad and privacy needs to be protected. It's just a really disingenuous and dismissive comparison. Nobody is complaining about flashlights. GDPR may have been necessary, but the complete garbage heap of an experience the popups have turned the web into is worth lamenting.

The companies that want to track you have turned the web into a "complete garbage heap of an experience" (apparently, sites I visit don't seem to have this problem). That's not the GDPR.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#197

Post by iso1210 » Sat, Mar 06, 2021, 1:17 PM UTC

rwcarlsen wrote: post #71

ratww wrote: post #45

Earlier quoted context omitted.

The modals don't exist to protect the user. Their goal is merely to annoy users to the point they just give up and blindly click "Accept". They only exist for the benefit of companies, and most of them violate GDPR.

Right. I'm not saying the intent of GDPR was to provoke them. But empirically, they are an effect of the GDPR. An undesirable one - that does not fulfill its intent. I'd say we are in agreement here.

The banners tell me what websites are shitty and that I shouldn't visit them. That's a tangible benefit.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#198

Post by iso1210 » Sat, Mar 06, 2021, 1:21 PM UTC

strictnein wrote: post #78

Zak wrote: post #60

Earlier quoted context omitted.

> Serve pages to the EU? You get to follow it. What can the EU do about it if the company has no physical or legal presence in the EU? Have there been any serious attempts at such enforcement?

It's weird how people keep claiming this. No one says that all sites should honor China's laws for visitors from China. No one claims that all sites should honor Saudi Arabia's laws for visitors from Saudi Arabia. But magically the GDPR must be followed by the entire world if a visitor shows up from France.

USA set the precedent when the FBI arrested Dmitry Sklyarov (a Russian Citizen) for working for a Russian company that apparently, while in Russia, broke US law.

It would be like Wendys slagging off the Thai king on a billboard in Dakota, then an employee of Wendys went on holiday to Bangkok and was arrested.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#199

Post by [deleted] » Sat, Mar 06, 2021, 1:23 PM UTC

ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

[deleted]

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#200

Post by permo-w » Sat, Mar 06, 2021, 1:45 PM UTC

planb wrote: post #69

ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

Why is this downvoted? This is exactly what happend. Speaking with non tech savvy users here in Germany, they feel safe and secure on Facebook and fear the „world wide west“ that the open Web has become, where you need to click 20 consent messages on every website without knowing what all that stuff means. This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.

Why is it downvoted? Because it’s implying that selling your information to advertising companies is a good thing, because it increases competition, and regulations making that harder are bad

The problem is that you could frame almost anything like that

Take an extreme example: Let’s imagine gold traders were allowed to go around taking people’s jewellery at gunpoint. Gold would be cheaper to buy. Traders make more profit. More jobs! Surely this is a win all round? Of course not, for obvious reasons.

Competition is not a an excuse for damaging your rights

And your example of clicking through 20 scary messages is because the websites, as is pointed out in the article, are not complying with GDPR