Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You Know GDPR Is Good Based on Who Hates It

matduggan.com

Post reply on HN
Print view View original

21–30 of 183 posts

Re: You Know GDPR Is Good Based on Who Hates It

#21

Post by brainwad »

maccard wrote: post #15
brainwad wrote: post #10

Earlier quoted context omitted.

The cookie banners come from the earlier ePrivacy Directive, and while it was possible to comply by not storing cookies at all, if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.

They do come from the ePrivacy directive but; > if you want to store data on the user's browser you do need to get their consent, hence the cookie banner. No - you need consent for storing cookies that are not “strictly necessary”. I can implement an offline app that stores data in cookies without consent. The current usage of the banner is overly litigious US focused simplification combined with malicious compliance…

No cookie is strictly necessary, you can encode it all into request tokens in the URL, so this is a meaningless exception.

Re: You Know GDPR Is Good Based on Who Hates It

#22

Post by petcat »

ChrisSD wrote: post #6

Note that GDPR did not mandate the cookie banners we see everywhere today. Those are a form of malicious compliance. Their goal is not to conform to regulation but to undermine the regulation itself in the eyes of the public.

Even the EU's own government websites are polluted with the same cookie banners. Are they "maliciously compliant" with their own regulations? Are they trying to "undermine the regulation itself"?

https://european-union.europa.eu/

Re: You Know GDPR Is Good Based on Who Hates It

#23

Post by jampekka »

brainwad wrote: post #10
ChrisSD wrote: post #6

Note that GDPR did not mandate the cookie banners we see everywhere today. Those are a form of malicious compliance. Their goal is not to conform to regulation but to undermine the regulation itself in the eyes of the public.

The cookie banners come from the earlier ePrivacy Directive, and while it was possible to comply by not storing cookies at all, if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.

The ePrivacy directive did/does not require the nag for "necessary cookies", i.e. most of the cookies that are serving the user's interests.

Re: You Know GDPR Is Good Based on Who Hates It

#24

Post by IanCal »

andai wrote: post #17
brainwad wrote: post #10

Earlier quoted context omitted.

The cookie banners come from the earlier ePrivacy Directive, and while it was possible to comply by not storing cookies at all, if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.

So I've seen some companies do it in a way that's not a pain in the ass. I'm wondering if that's legal. Because if it is, I also want to do it that way.

It is. It’s also often not necessary at all. You can’t do things with people’s data without either getting consent or basically having a good reason to. I like the ICO pages (uk regulator) for explaining a lot of things like this.

If I’m shipping an item to someone I don’t have to ask them if I can keep their address for long enough to send them the item. I do need their permission to use that data to send them marketing though, or sell it on. If you have to legally keep records for X years that’s fine.

Keep only what you need, for the time you need to keep it, in an appropriately secure way.

Re: You Know GDPR Is Good Based on Who Hates It

#25

Post by snackbroken »

brainwad wrote: post #10
ChrisSD wrote: post #6

Note that GDPR did not mandate the cookie banners we see everywhere today. Those are a form of malicious compliance. Their goal is not to conform to regulation but to undermine the regulation itself in the eyes of the public.

The cookie banners come from the earlier ePrivacy Directive, and while it was possible to comply by not storing cookies at all, if you want to store data on the user's browser you do need to get their consent, hence the cookie banner.

You don't need explicit consent for functional cookies, e.g. a session cookie or to store what preferences the user has selected on your settings page. It is implicitly given by the user telling you to treat them a certain way. For that you just need a notice somewhere on the page that reads along the lines of "this website uses cookies". It can be an unobtrusive note in your footer.

Re: You Know GDPR Is Good Based on Who Hates It

#26

Post by 9dev »

brainwad wrote: post #13
intothemild wrote: post #7

Earlier quoted context omitted.

The cookie banner isn't actually specified in gdpr, it was just how everyone else tried to build the solution to the problem at the last minute. I remember thinking "ok once this hits an actual web spec, we should see this built into browsers, and sent as headers or something" Nope

Browsers already had a way to consent to cookies, since the invention of cookies themselves. But the EU didn't consider that _real_ consent.

Treating the browser's "disable cookies" feature as a way to reject consent is not real consent. That cripples many legitimate use cases outright; it's neither accessible nor understandable by normal users; it's a technical defence measure, not a way to consciously reject contractual consent.

In contrast, the GDPR demands that you properly ask for consent if you want to process somebody's personal information, inform them why that is necessary, and only process the data if they agree to the processing.

There is clearly a difference here, and IMHO the EU is quite correct here.

Re: You Know GDPR Is Good Based on Who Hates It

#27

Post by maccard »

ChrisSD wrote: post #6

Note that GDPR did not mandate the cookie banners we see everywhere today. Those are a form of malicious compliance. Their goal is not to conform to regulation but to undermine the regulation itself in the eyes of the public.

I’ve posted this before. I was working on a website where we used a single cookie for an auth token, and we logged absolutely _everything_ on the server side (we didn’t sell it FWIW). When it came to publishing the site, we went to legal for our parent company and filled in their form. One question was “do you use cookies”, to which we answered truthfully. That site has a cookie banner, and absolutely 0 mention of the piles of telemetry we gathered.

The ePrivacy directive is a waste of time, money, attention and resources and I wish we spent that effort on complying with GDPR instead which is much much better.

Re: You Know GDPR Is Good Based on Who Hates It

#29

Post by roenxi »

Given the relatively recent European experience (Nazis and Communists, among others) there is a reasonable argument for data privacy even if it hampers economic growth. However...

> If the rules are so terrible, why did nobody choose market exit?

Because major players don't particularly mind such rules; the public doesn't care about their data all that much and everything will tick on as usual with some nag banners and compliance officers.

The problem is the major players aren't going to be European because it is no longer legal for EU companies to get started by doing what the US companies did to get started. There is a reason the EU is backseat driving US software companies - EU industrial policy killed off the EU ones in the crib (to be fair that wasn't the GDPR, the GDPR is just part of the same anti-growth regulatory pattern). They died so young we've never really even learned what their names would have been.

EDIT I'll point at companies like Uber. It looked pretty illegal for most of its early years, until it could afford enough lobbyists to legalise its business model. Never would have worked in the EU.

Re: You Know GDPR Is Good Based on Who Hates It

#30

Post by 9dev »

throw8484949ii wrote: post #9

US companies like Meta or Google __LOVE__ GDPR. It is quagmire of complicated rules, and small startups will get burried under this quick sand. Large corporations can maintain departments of lawyers, and navigate this legal minefield. Small fines are cost of doing business, bribe that goverment would not force monopolies to spkit! Try to do marketing ad campaign as small eshop owner in EU!

I'm responsible for GDPR in a small European company that processes fairly sensitive data. It's not that complicated as people like you make it out to be - if you're willing to actually try to do the right thing.
Post reply on HN