Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dark patterns after the GDPR: consent pop-ups and their influence

dl.acm.org

Post reply on HN
Print view View original

201–210 of 234 posts

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#201

Post by xyst »

I can't read the paper beyond the summary. But for what it's worth, I agree that GDPR is a good thing in general. However the implementation and execution of it is sloppy (as seen with these "dark patterns")

GDPR should have been aimed at the browser and then force websites to comply with the settings defined in the browser. Non-compliant sites would be immediately flagged by the user's browser instead of hiding behind numerous dark UI patterns.

Perhaps it was easier to force thousands of EU sites rather than trying to coerce Google, Apple, Microsoft.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#202

Post by belorn »

dotancohen wrote: post #177
belorn wrote: post #135

Earlier quoted context omitted.

On this point GDPR is pretty simple. In general security do not require consent, nor does cookies that are used for functional aspects of the sites. A simple guideline is to imagine if someone breaks into your server and steal data. If that data can come to harm real people somewhere then you likely have something which you needed to have gained consent in order to handle. On top of that there is an additional except…

This is completely wrong. I don't want to pick your comment apart, but I suggest actually reading the GDPR. It is available in every European language.

I suggest you read the Recitals 47 to 49 of the GDPR, especially 49. It is liked here https://gdpr-info.eu/recitals/no-49/ but it is short enough to fit a HN comment. It is called Network and Information Security as Overriding Legitimate Interest, a name which has the word overriding in it. Pretty clear language.

The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.

GDPR is compatible with information security and do not interfere with it. The section is technology neutral in that you can use cookies, logs, firewalls, blacklists, oracles or any other methods that include data processing and as long the purpose is strictly necessary and proportionate to ensure network and information security than that is acceptable as according to Recital 49.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#203

Post by that_guy_iain »

satellite2 wrote: post #126
that_guy_iain wrote: post #121

Earlier quoted context omitted.

One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but no…

It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.

There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#204

Post by cyphar »

intricatedetail wrote: post #178
Griffinsauce wrote: post #167

Earlier quoted context omitted.

This is an interesting idea. In the end this option still hampers genuine users of those websites. That is the point and instead of people taking issue with the website tracking them, they'll complain about the banners instead. Just look at this entire comment section... No guys, the problem is not that the law is bad, it's that the state of the internet is absolutely fucking terrible. "Why do I have to click so many…

They law was aimed at the big guys and they are in my opinion still not compliant, but have not heard of them being fined, some small guys on the other hand... This law feels more like it was a bribe fishing and checkbox exercise rather than genuine attempt at solving the issue.

Google was fined 50 million euros in 2019 because Android didn't provide enough transparency or informed consent for advertising-related tracking[1].

For a company the size of Google, it's a slap on the wrist (especially when compared to the 5 billion euro fine from 2018 over antitrust violations) but they have been going after the big players. In fact most stories I've heard related to GDPR actions have exclusively been about big players getting fined.

[1]: https://www.bbc.com/news/technology-46944696

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#205

Post by Bakary »

robgibbons wrote: post #150
Bakary wrote: post #138

Earlier quoted context omitted.

>It's just a really disingenuous and dismissive comparison. Nobody is complaining about flashlights. I don't make that comparison lightly. I'm not dismissing the issue: it is a serious problem that is widespread over the internet. It's not disingenuous: it describes a series of institutionalized behaviors that are directly parasitic on the user. Now the reaction is to be angry at GDPR because of the pop-ups, which ar…

First, thank you for explaining your point. But, nobody here is complaining about GDPR. They are complaining about the terrible UX, and wasted time, and attention, which the non-compliant implementations have caused. That is not an absurd reaction, it's perfectly reasonable. That's why your comment comes off as dismissive. If anything, it's more akin to complaining about the shitty, half-rate pest control person your…

At the time of writing, the parent comment I replied to ended with "Thanks GDPR". To me, there can be no clearer indictment of the law instead of the shitty practices. Reading through the thread has been frustrating. There are many users coming so close to the realization contained in the analogy but stopping just short of it. I understand that it is confirmation bias to some extent: many other users have made no such complaints. But I see it often in other places as well, and even have had those arguments in real life. I am willing to consider those perspectives, but I simply disagree with them.

>If anything, it's more akin to complaining about the shitty, half-rate pest control person your landlord calls to get rid of the rats. They do a bad job, poison your house, waste your time, and the rats never go away.

I don't want to stretch the analogy further than it can work, but a more apt comparison in my view would be this: a person discovers that every inch of their floorboard and walls are filled with highly intelligent rats. The pest control comes, creates some measures that have a small effect but does not enforce everything at the outset. It's likely they will come back for another round since they are still learning the ropes for such an enormous job. The rats have been there for decades and it is the only pest control service even trying to fix the problem in the entire city. The rats scurry around in a panic, but keep infesting the apartment. In this scenario, would the person try to get the pest control to enforce the measures and get better at it over time, or would they simply carry on as usual and feel comfortable with the infestation?

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#206

Post by cdrx »

that_guy_iain wrote: post #203
satellite2 wrote: post #126

Earlier quoted context omitted.

It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.

There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.

To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence.

GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#207

Post by dotancohen »

belorn wrote: post #202
dotancohen wrote: post #177

Earlier quoted context omitted.

This is completely wrong. I don't want to pick your comment apart, but I suggest actually reading the GDPR. It is available in every European language.

I suggest you read the Recitals 47 to 49 of the GDPR, especially 49. It is liked here https://gdpr-info.eu/recitals/no-49/ but it is short enough to fit a HN comment. It is called Network and Information Security as Overriding Legitimate Interest , a name which has the word overriding in it. Pretty clear language. The processing of personal data to the extent strictly necessary and proportionate for the purposes of e…

Thank you. I was referring to this:

  > A simple guideline is to imagine if someone breaks into
  > your server and steal data. If that data can come to harm
  > real people somewhere then you likely have something which
  > you needed to have gained consent in order to handle.
The website admins and developers are not those who decide what data is covered, based on any idea we might have as to what may be likely to cause harm. Rather, the GDPR defines personal data and the rules for handling it differ between controllers and processors. I should have typed up a more thorough answer.

In any case, there are always more and more nuances to be discovered about the GDPR depending on field. I'm not a lawyer and I'm glad to always be corrected and updated.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#208

Post by cdrx »

ketzu wrote: post #193
mtm7 wrote: post #146

Ideally, we'd be able to control opt-outs at the browser level. The second best thing would be a law to prevent consent popups from making it harder to opt-out than it is to opt-in: [Accept] / [Decline] / [Manage preferences]

> Ideally, we'd be able to control opt-outs at the browser level. We tried it at the protocol level with do-not-track and it just gave them an additional bit of info to track. But I agree: It would be awesome to have this as a browser option. Just send a list of all the optional things to my browser which responds with the accepted results. > The second best thing would be a law to prevent consent popups from making…

> Isn't this what's written in the GDPR?

I wish it was this explicit, but it isn't. EU member states have all interpreted the regulation differently.

Making it harder to opt out than in is explicitly prohibited in the UK and Germany. It is perfectly legal in Italy. In Spain, it is legal to bury the opt out buttons at the end of a 50 page cookie policy.

Full compliance, across the whole of the EU, is exceptionally difficult.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#209

Post by belorn »

dotancohen wrote: post #207
belorn wrote: post #202

Earlier quoted context omitted.

I suggest you read the Recitals 47 to 49 of the GDPR, especially 49. It is liked here https://gdpr-info.eu/recitals/no-49/ but it is short enough to fit a HN comment. It is called Network and Information Security as Overriding Legitimate Interest , a name which has the word overriding in it. Pretty clear language. The processing of personal data to the extent strictly necessary and proportionate for the purposes of e…

Thank you. I was referring to this: > A simple guideline is to imagine if someone breaks into > your server and steal data. If that data can come to harm > real people somewhere then you likely have something which > you needed to have gained consent in order to handle. The website admins and developers are not those who decide what data is covered, based on any idea we might have as to what may be likely to cause ha…

> what may be likely to cause harm

Never said that the information needed to be likely to cause harm, but simply can. The exact phrase that GDPR use is "Any information that relates to an identified or identifiable living individual".

An example where any information that related to an identified or identifiable living individual would be harmful would be in a court. Any information about juries, judges, accused or defendant is potentially harmful if abused. All legal systems depend on the presumption of privacy in this regard, and all legal system that I know have processes in places to replace individuals when that harm can be actualized.

A similar situation is possible when it comes to information being distributed to a very large audience. Unimportant "harmless" information can be perfectly safe in a small group, but if millions of people see it in a harmful context then such harmless information can turn harmful. Any person operating a forum, a voice chat group, or a place where any two people meet should treat any logs with the threat model of it being leaked and the information harming real people.

I should have clarified in the above comment that information that related to an identified or identifiable living individual should always be assumed as potentially harmful, and thus involving a risk to the identified person. This is the problem GDPR is mostly attempting to solve, and thus the situation for which the operator need to act on. Similar, if the information is of such nature that it can't be harmful, it is also very unlikely to be information that relate to an identified or identifiable living individual.

When GDPR came it a lot of people asked similar questions as the parent post. What about Apache logs? What about login credentials and sessions. What about CRM and customer registers? The collective answer from that conversation, as I remember (and much of those discussion can be found archived), was that the question depend on the context. If its purely for security then the operator can likely continue on as before per the above quoted section, with some caveats to proportionality. For most everything else, look to the purpose of the GDPR.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#210

Post by that_guy_iain »

cdrx wrote: post #206
that_guy_iain wrote: post #203

Earlier quoted context omitted.

There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.

To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.

Honestly, considering the state of play at the moment the law is pretty much unenforcable. They literally can't fine everyone who is breaching it, they don't have the manpower.

And considering the ICO, the UK org that enforces these laws and where you have to go to find out the UK laws on it, literally just tell you that they use cookies to make their website work and don't ask for consent makes me think this is so much more complicate than any of us truly understand.

If they're setting cookies without consent with a user tracking id, I am going to guess that my session cookie falls under the same thing theirs does.

https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...'. - Check developer tools and cookies.

Post reply on HN