GDPR – No reject option – what to do? • Hacker News Board

Re: GDPR – No reject option – what to do?

#21

Post by stefanfisk » Mon, Mar 01, 2021, 5:45 PM UTC

gcatalfamo wrote: post #11

Most websites, made by low budget webdevs which are thriving thanks to companies asking for low budget websites[1], do not consider - even in the EU - the reject option. In the large majority of websites, Google Analytics fires even before the cookie banner, and the banner is only used to inform you that by continuing navigation you are accepting to be tracked. Yes, this is illegal. But not enforceable. [1]: there ar…

My experience is that customers don't even want a reject option, and that pricing is not really part of the question.

Re: GDPR – No reject option – what to do?

#22

Post by notimetorelax » Mon, Mar 01, 2021, 5:45 PM UTC

anotheryou wrote: post #20

It's not illegal to just cookie-wall your whole site without options, or is it? This site here e.g. does it: https://www.spiegel.de/ imprint is still reachable, but if you want to read this news site you'll have to allow all the tracking crap.

It is illegal, they cannot offer free but tracked vs paid and untracked service. I guess GDPR enforcement didn't reach them yet.

Re: GDPR – No reject option – what to do?

#23

Post by cj » Mon, Mar 01, 2021, 5:46 PM UTC

agd wrote: post #19

Checking whether cookie banners are compliant should be mostly straightforward for regulatory bodies. In 90% of cases it’s clear if there’s opt in or not. Why can’t regulatory bodies set up automated flows and tools to handle this at scale? Don’t need to catch every case but they should be able to massively scale the complaints process for this.

If the regulatory bodies have a list of people actively breaking the law, and the public knows that, it would require them to make a decision “do we do anything about this or not”

Based on the lack of any real regulatory action under GDPR, I’m guessing regulators would prefer not knowing who’s breaking the law since they aren’t actively enforcing GDPR (for better or worse).

Re: GDPR – No reject option – what to do?

#24

Post by ezzato » Mon, Mar 01, 2021, 5:49 PM UTC

anotheryou wrote: post #20

It's not illegal to just cookie-wall your whole site without options, or is it? This site here e.g. does it: https://www.spiegel.de/ imprint is still reachable, but if you want to read this news site you'll have to allow all the tracking crap.

The DPA (Lower Saxony) says it's not. German link: https://lfd.niedersachsen.de/startseite/themen/internet/date...

They call it Nudging.

I might translate this to a proper blog post in English.

Re: GDPR – No reject option – what to do?

#25

Post by amelius » Mon, Mar 01, 2021, 5:49 PM UTC

ezzato wrote: post #17

SilasX wrote: post #13

Earlier quoted context omitted.

I thought there was an official governmental point of contact that handled such complaints, and had teeth?

I filled 2 years ago a few complaints. It took over 1 year for an answer. Basically nothing happened. The Data Protection Authority are underfunded and understaffed. They try the best with their resources.

Can't we fund these authorities with the fines they generate?

Not the best way, I know, but better than nothing.

Re: GDPR – No reject option – what to do?

#26

Post by mfontani » Mon, Mar 01, 2021, 5:53 PM UTC

> Google Analytics fires even before the cookie banner

That might well not be a problem, depending on how the configuration and setup of Google Analytics was done in that case.

From https://www.cookiebot.com/en/google-analytics-gdpr/

- turn on IP anonymisation

- don't send personal data

- don't send pseudonymous identifiers

- I add: tell GA to not set cookies and to not track the user (IIRC it's "storage" set to "none" and "storeGac" set to false)

If one does that when the user's not opted-in to "analytics" or "tracking", that ought to be enough to satisfy informed consent, no? The site is then just tracking page views, with no personal information or cookies to fly around.

If the user then opts-in to analytics then the site's code could well send more pseudonymous data to Google Analytics, with the user's consent, as well as tell GA it's fine to track the user around the site using a cookie or whatever other means.

Same goes for the setup for Adwords or similar: it's all in the hands of the website, and so long as things are configured to not track the user, it might be fine.

If a site's livelihood depends on showing ads to users, it doesn't mean that the user has to opt-in to ads. They ought to opt-in to being tracked by the ad provider.

So, configure _that_ -- no opt in? No tracking. Opt in? Tracking, remarketing, retargeting, what-have-you.

It's all about "playing safe" and _not_ tracking when the user's not opted in.

Many sites instead do it the other way around, and do it all until/unless the user's opted-out.

And even then, I wouldn't hold my breath that they're really doing it.

Some are, or at least try hard to.

Re: GDPR – No reject option – what to do?

#27

Post by ezzato » Mon, Mar 01, 2021, 5:54 PM UTC

stefanfisk wrote: post #21

gcatalfamo wrote: post #11

Most websites, made by low budget webdevs which are thriving thanks to companies asking for low budget websites[1], do not consider - even in the EU - the reject option. In the large majority of websites, Google Analytics fires even before the cookie banner, and the banner is only used to inform you that by continuing navigation you are accepting to be tracked. Yes, this is illegal. But not enforceable. [1]: there ar…

My experience is that customers don't even want a reject option, and that pricing is not really part of the question.

That's true. As long as they have not to bear the external cost it's cheap to pollute. But the market is two sided. We can bring the cost to the polluter if we choose to.

Re: GDPR – No reject option – what to do?

#28

Post by anotheryou » Mon, Mar 01, 2021, 5:54 PM UTC

notimetorelax wrote: post #22

anotheryou wrote: post #20

It's not illegal to just cookie-wall your whole site without options, or is it? This site here e.g. does it: https://www.spiegel.de/ imprint is still reachable, but if you want to read this news site you'll have to allow all the tracking crap.

It is illegal, they cannot offer free but tracked vs paid and untracked service. I guess GDPR enforcement didn't reach them yet.

weird. they are well known in germany

Re: GDPR – No reject option – what to do?

#29

Post by Drakim » Mon, Mar 01, 2021, 5:55 PM UTC

anotheryou wrote: post #20

It's not illegal to just cookie-wall your whole site without options, or is it? This site here e.g. does it: https://www.spiegel.de/ imprint is still reachable, but if you want to read this news site you'll have to allow all the tracking crap.

A big part of GDPR is that you can't just say "by using our site you agree to forgo your GDPR rights" or "click here to agree not to invoke your GDPR rights" or anything like that.

Re: GDPR – No reject option – what to do?

#30

Post by gcatalfamo » Mon, Mar 01, 2021, 5:57 PM UTC

stefanfisk wrote: post #21

gcatalfamo wrote: post #11

Most websites, made by low budget webdevs which are thriving thanks to companies asking for low budget websites[1], do not consider - even in the EU - the reject option. In the large majority of websites, Google Analytics fires even before the cookie banner, and the banner is only used to inform you that by continuing navigation you are accepting to be tracked. Yes, this is illegal. But not enforceable. [1]: there ar…

My experience is that customers don't even want a reject option, and that pricing is not really part of the question.

pricing correlates to 0.95 with poorly managed cookies in my anecdotal experience. Customers don't even know what all that means, they just want a cheap, functioning website.