Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Consent-O-Matic: Automatic handling of GDPR consent forms

github.com

Post reply on HN
Print view View original

31–40 of 137 posts

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#31

Post by danuker »

Cthulhu_ wrote: post #21
eternityforest wrote: post #17

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.

That's the main issue here; the EU mandated consent and gave guidelines on what that consent might look like, but they left implementation down to the industry, which decided to do it themselves (often using dark patterns, for which some companies already got fined) instead of integrating it in browsers. I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened t…

I suppose they're making us suffer so we pressure politicians.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#32

Post by hnbad »

megapolitics wrote: post #13
gyulai wrote: post #4

I wish people would stop confusing cookie-consent laws and GDPR. They are quite distinct laws and are giving GDPR a bad rap for wholly the wrong reasons.

The consent form situation did not get this bad until GDPR was passed. Prior to GDPR cookie-consent forms were simple "Yes" or "No" buttons without all the insane pages of toggles.

GDPR did mandate defaulting all of those toggles to "decline" though, even though some are trying to get clever and add additional toggles for "legitimate interest" (which isn't how that works legally but AFAIK nobody has been sued over that yet).

The follow-up privacy legislation also bans the current dark pattern of making the "accept all" button more prominent and obvious than "decline all" at least requiring both to be equally prominent. The flow of having to go through "manage" or "see options" or other shenanigans as links in order to decline all has always been in violation of the GDPR and could theoretically open you up to the fines as it demonstrates intent.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#33

Post by secondcoming »

sdoering wrote: post #22
eternityforest wrote: post #17

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

How do sites abuse Legitimate Interest? LI is something vendors declare to the IAB, not the sites. These CMPs just present that information to the user (in complicated ways) so they can Accept/Decline/Object.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#34

Post by Nextgrid »

radicalbyte wrote: post #29
sdoering wrote: post #22

Earlier quoted context omitted.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

It should literally be a setting in the browser - auto decline. That would make everyone's life a lot easier.

We had something like that called DNT, and not only did nobody honor it, but it was used as an extra fingerprinting vector, totally defeating its purpose.

According to the GDPR, all non-essential tracking should be off by default, so "decline" is already the default if companies were compliant with the regulation (which is a big "if").

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#35

Post by secondcoming »

hnbad wrote: post #32
megapolitics wrote: post #13

Earlier quoted context omitted.

The consent form situation did not get this bad until GDPR was passed. Prior to GDPR cookie-consent forms were simple "Yes" or "No" buttons without all the insane pages of toggles.

GDPR did mandate defaulting all of those toggles to "decline" though, even though some are trying to get clever and add additional toggles for "legitimate interest" (which isn't how that works legally but AFAIK nobody has been sued over that yet). The follow-up privacy legislation also bans the current dark pattern of making the "accept all" button more prominent and obvious than "decline all" at least requiring both…

Legitimate Interest is a separate Legal Basis.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#36

Post by pmontra »

pydry wrote: post #25
sdoering wrote: post #22

Earlier quoted context omitted.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

If you program a browser to consent for you that is no different to consenting yourself. Just as writing and running an install script with --accept-tos is valid.

That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of "surprises". So yes, a browser could come with an "Accept all" setting, probably disabled by default, but which browser vendor is going to go through the trouble of implementing that, proposing an API and above all getting every Privacy Agency of the world to accept that?

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#37

Post by [deleted] »

dmitriid wrote: post #12
gyulai wrote: post #4

I wish people would stop confusing cookie-consent laws and GDPR. They are quite distinct laws and are giving GDPR a bad rap for wholly the wrong reasons.

And GDPR largely superseded cookie consent IMO. As in: you don't even have to ask consent if the cookies are strictly necessary: https://gdpr.eu/cookies/

[deleted]

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#38

Post by denton-scratch »

pydry wrote: post #25
sdoering wrote: post #22

Earlier quoted context omitted.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

If you program a browser to consent for you that is no different to consenting yourself. Just as writing and running an install script with --accept-tos is valid.

If you program a browser to auto-consent, then that isn't informed consent, even if your browser can read and parse a TOS (which I can't).

Install scripts run with --accept-tos have nothing to do with personal data or privacy, and are outside the scope of GDPR.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#39

Post by jokoon »

I just block them using ublock origin, right click -> block element.

One problem is that often, those forms insert a "overflow: hidden" into either or , meaning the page cannot scroll anymore. Twitter does this too.

It's possible to just remove it with the dev tools, but it's quite annoying.

I've asked ublock for a way to fix this, like:

##body,html:matches-css(overflow: hidden):style(overflow:auto !important)

But it doesn't really work.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#40

Post by gyulai »

megapolitics wrote: post #13
gyulai wrote: post #4

I wish people would stop confusing cookie-consent laws and GDPR. They are quite distinct laws and are giving GDPR a bad rap for wholly the wrong reasons.

The consent form situation did not get this bad until GDPR was passed. Prior to GDPR cookie-consent forms were simple "Yes" or "No" buttons without all the insane pages of toggles.

Just because that correlated in time doesn't mean it's what the law actually implies.

Informed consent about cookies was a law that predated the GDPR.

The consent boxes only got worse because, with GDPR, you suddenly have regulators who care about these things and are empowered to impose hefty fines. So people stopped ignoring the whole space of privacy, as they had been before.

One of the declared goals of GDPR is to reign in "profiling". So the industry started trying to desparately weave a narrative on the grounds of consent: they wanted to create an electronic paper trail that would somehow support their claim that people were consenting under the rules of the GDPR to being profiled.

But consent under the definition of the old cookie directive does not meet the standard required under the GDPR for consenting to profiling [1]. People like Max Schrems are actively engaged in trying to get the industry to turn away from their noncompliant ways [2]. Especially the use of certain UI dark patterns has already lead to hefty fines [3].

My hope is that, when this has all played out through the legal system, it will become clear to the industry that the stuff they are trying to get you to consent for them to do, is just outlawed altogether, thus scoring a victory for privacy on the web and rendering that consent-stuff moot.

If not, regulators may need to get involved to make it more clear, that this is the intended outcome, which I have no doubt they eventually will.

I also have high hopes that, eventually, GPC will become enshrined in law [4]

[1] https://academic.oup.com/idpl/article/5/3/163/730611?login=f...

[2] https://www.dataprotectionreport.com/2021/06/max-schrems-pri...

[3] https://www.cnil.fr/en/cookies-cnil-fines-google-total-150-m...

[4] https://globalprivacycontrol.org/

Post reply on HN