GDPR enforcer rules that IAB Europe’s consent popups are unlawful • Hacker News Board

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#331

Post by foepys » Wed, Feb 02, 2022, 5:08 PM UTC

native_samples wrote: post #327

cornedor wrote: post #281

Earlier quoted context omitted.

> Does this mean it will be a long term of conditions like apple does every time we use a website? I guess it is the opposite. GDRP requires clear and understandable text in privacy policies.

Ironically, nothing about GDPR itself is clear and understandable, as is evidenced by the fact that everyone keeps discovering years after implementation that some random country disagrees on their interpretation of it.

Let's be real here, IAB Europe knew exactly that what they were doing was borderline illegal. Now it's officially illegal.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#332

Post by Scarblac » Wed, Feb 02, 2022, 5:09 PM UTC

denton-scratch wrote: post #260

andylynch wrote: post #158

Earlier quoted context omitted.

Remember you have MEPs representing you as well. European elections too often play a distant second fiddle to domestic ones but this really should not be the case.

MEPs sit in the European Parliament, which is a talking shop, with very limited powers. It's hardly surprising that few Europeans know who their MEP is.

I don't really have a MEP that's "mine", it's proportional representation,not a district system.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#333

Post by native_samples » Wed, Feb 02, 2022, 5:09 PM UTC

Scarblac wrote: post #194

johannes1234321 wrote: post #96

Earlier quoted context omitted.

The "EU doing things" is not detached from your national government. In fact all EU legislation is being approved by your national government in the EU Council and the EU commission has to report there. (As well as the EU parliament, however the EU parliament is weak ...) Edit: maybe as addition in the last point in parentheses: The EU parliament is purposely weak, as the EU is a union of states and the member state…

I know that. What I consider "scary" is that the EU can only do this because they're aren't directly elected and so not as subject to the typical democratic pressures. It points at a clear weakness of democracy.

No it doesn't. Democracies don't do this because it's posturing designed to appeal to a particular kind of person (e.g. your kind of person).

Normal people don't care about cookies or consent popups and merely find them annoying/frustrating. I've never, ever heard anyone praise these popups outside of Europeans posting on Hacker News. That's a small community and it's a bubble convinced of its own purity.

Here's why democracies don't do this kind of thing: democratically elected governments are expected to generate economic growth and jobs by voters. Constantly levying massive fines on companies who aren't actually upsetting most citizens, via ultra-vague laws that create "tails we win, heads we also win" outcomes for the bureaucracy, is something that most mature democracies realized don't work out well in the long run. So they don't do it.

The EU has no such concerns because it's not accountable to anyone, for anything, despite what sometimes people like to try and claim. Result: a stagnant economy with an ever shrinking proportion of global GDP that tries to cover up its damningly consistent failure to produce successful tech firms by pretending it's too morally righteous to do so.

Signed,

A European. But not an "EU citizen".

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#334

Post by foxfluff » Wed, Feb 02, 2022, 5:13 PM UTC

stale2002 wrote: post #330

foxfluff wrote: post #278

Earlier quoted context omitted.

They cannot coerce you to sign away your fundamental rights in exchange for service. If they cannot offer service without violating your rights, then the service is illegal in Europe.

Then the result will be that those services simply stop serving EU customers.

If legal offering for a market with half a billion people is not worth it for them, then by all means they can and probably should pull their criminal enterprise out of Europe. That just creates an opportunity for Europeans to say good riddance and perhaps start something new and worthwhile that isn't funded by exploitation.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#335

Post by johannes1234321 » Wed, Feb 02, 2022, 5:19 PM UTC

Scarblac wrote: post #329

johannes1234321 wrote: post #216

Earlier quoted context omitted.

Pressure your government to vote "no" on policies you don't like or pressure your government to initiate other legislation. They have the power and responsibility. And yes, I personally would like to have a stronger EU Parliament relative to the Commission and Council. However there is no reason to let the national government escape with "it's EU law" after they approved it. (And yes, Council doesn't require unanimou…

I think you misunderstand. Almost all law coming out of the EU is really beneficial for the people, in my experience. Making a law like the GDPR and implementing it is hard work that doesn't grab headlines and first gives us a few years of annoying popups, but in the end it will actually improve privacy for EU citizens. And national politicians can't do this anymore , because they have to be in the news each day and…

> If we make the EU more democratic, will it become less effective too?

This is probably the first time I'm hearing somebody claiming EU was effective ;)

However you are right - the fact that there is less attention on EU legislation enables different dynamics.

However I think it is quite different between countries how well they do. Here in Germany I am quite optimistic that the new government will do quite a few good things ... but maybe I'm too optimistic, but lots of good signals from my pov

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#336

Post by pelorat » Wed, Feb 02, 2022, 5:21 PM UTC

phh wrote: post #257

msla wrote: post #195

Earlier quoted context omitted.

> How do you prove there is no PII in the ML model? Is "innocent until proven guilty" not a maxim in European justice?

It's not possible to discuss legality of something, until a judge said we are allowed to discuss it? What? So I can murder someone, and say "Innocent until proven guilty", and forbid anyone from discussing whether I'm a murderer, until I'm actually judged guilty? But ok, sounds like you're nitpicking on my words, so let me rephrase the comment you're replying to. "Considering that we have dozens of research papers sh…

> So I can murder someone, and say "Innocent until proven guilty", and forbid anyone from discussing whether I'm a murderer, until I'm actually judged guilty?

In many European countries it's in fact against the law to publish the name of a suspect until a court has found them guilty. And is some it's even illegal to publish the name at all.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#337

Post by wizzwizz4 » Wed, Feb 02, 2022, 5:27 PM UTC

tomjen3 wrote: post #308

Nextgrid wrote: post #230

Earlier quoted context omitted.

I'd argue that the data has already been integrated into ML models or mixed in such a way that there's no way to even tell where the data originated from. While the logical conclusion would be to just delete any data they can't prove a legitimate origin for, I very much doubt this is going to happen. Most importantly, tens of billions have already been made using this ill-gotten data.

The GDPR doesn't apply to data that can't be related to a natural person. Those models would therefore no longer be under the scope. Another example: You get consent from me, count your distinct visitors for January and I revoke my consent tomorrow. You do not have to change your visitor count retroactively.

> The GDPR doesn't apply to data that can't be related to a natural person. Those models would therefore no longer be under the scope.

Give me the models and a week, and I'll dox some people with them.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#338

Post by ATsch » Wed, Feb 02, 2022, 5:28 PM UTC

denton-scratch wrote: post #292

oezi wrote: post #175

Earlier quoted context omitted.

But the good part is you can just decline to consent. Because under GDPR if they need consent at all (that is they really don't need the data), then you can decline.

> then you can decline. Not if the consent form looks like this: [Register] [Accept]

For it to be informed consent declining must, by law, be as easy as accepting. Yes, this is being widely violated, but that's just a problem of enforcement.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#339

Post by Tomte » Wed, Feb 02, 2022, 5:28 PM UTC

donohoe wrote: post #157

Tomte wrote: post #114

Earlier quoted context omitted.

It's hard to start doing this when your competitors keep playing by the old rules. My hope is that ever more aggressive enforcement will finally lead us to the point where the dams break and everyone scrambles to get compliant at once. The sooner, the better. But I realize that the legal system needs to ramp up the pressure, they cannot start with company-destroying fines on day one. These rulings and fines keep me i…

True, but the months ahead of GDR directive coming in was one of those potential moments. Google kept promising us their own framework and consent system. They kept pushing the date to unveil it and as we ran out of time I had to build my own, and many others jumped into the IAB framework because of so few options (and it came down to the wire there too despite knowing for years this was in the works). >> they cannot…

> I think they can

Certainly not. The courts would take a very dim view of that. You need to show through a series of regulatory interventions and escalating fines that you afforded those companies due process and that the fines are reasonable.

The maximum allowed under a law is virtually never reasonable in a first-time enforcement.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#340

Post by Shoue » Wed, Feb 02, 2022, 5:29 PM UTC

Permit wrote: post #296

parkingrift wrote: post #113

Earlier quoted context omitted.

>According to who, you? Spyware is illegal. So it’s just a matter of defining the data collection practices of internet companies as spyware. >How is it spying when the people are freely giving away their data? It’s not “freely given away” when you need a team of attorneys to understand what you’ve agreed to and you have no audit rights. Point me to the public FB page where they clearly and easily define all points o…

> Spyware is illegal. So it’s just a matter of defining the data collection practices of internet companies as spyware. I’ve seen this phenomenon before but never so explicitly. When you can’t convince someone that something is bad, you re-define it as something they do consider bad. Some examples I’ve seen: - Some speech is so hateful and racist that its opponents wish to define it as “violence”. - Facebook offers a…

"Free speech" is not a good example in my opinion when we already have so many exceptions to it:

https://en.wikipedia.org/wiki/United_States_free_speech_exce...

I'll reconsider not defending free speech from getting a "hate speech" exception when so called "free speech" proponents start talking about getting rid of the copyright exception instead of just wanting to say racist stuff.

It makes complete sense to want to expand the scope of terms that are associated with laws if you don't believe the law is accurate enough. Language evolves through social changes, and so do laws.