Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two years in, GDPR defined by mixed signals, unbalanced enforcement

complianceweek.com

Post reply on HN
Print view View original

41–50 of 216 posts

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#41

Post by ratww »

shadowgovt wrote: post #30
tjoff wrote: post #17

Earlier quoted context omitted.

Again, only because of incompetent and/or immoral developers.

How, exactly, is a developer supposed to change state in a stateless protocol to denote that you've dismissed the cookie dialog if the user has disabled the feature that allows the developer to add state to the stateless protocol?

I believe his point is that if the user disabled cookies, there's no point in showing the banner. If you don't show the banner you can't track the user, of course.

It's not hard. It's just a matter of checking for navigator.cookieEnabled.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#42

Post by a_imho »

umvi wrote: post #22
Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

Because the EU says you have it backwards? Ignoring European users is perfectly fine, but if you want to monetize them, you better play by their rules, unless you are more powerful than the EU. In theory. In practice do whatever you want.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#43

Post by microcolonel »

legitster wrote: post #32
microcolonel wrote: post #16

Earlier quoted context omitted.

Setting aside GDPR for a moment, the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog.

You are allowed a cookie that tracks their opt in to your other cookies, so long as it is anonymous (or so our lawyer tells us). On our site, we ping whether that cookie is set before we load the rest of the cookies.

Is it acceptable to store a cookie that defaults to "false" provided it is generic? That would solve the problem of not being able to detect if cookies are enabled in the browser until you try to store them.

added: person down thread indicated that there's an API for determining if cookies are enabled for the host on your page's origin called navigator.cookieEnabled which I am shocked I've not seen nor heard of even once before today. Hallelujah. I now agree that everyone who doesn't check that before pestering people about cookies, when JavaScript is available, is literally satan.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#44

Post by JMTQp8lwXL »

Nextgrid wrote: post #9
barking wrote: post #2

We care about your privacy notices have become the bane of my life.

The majority of these aren't actually compliant. Tracking should be opt- in and consent should be freely given . If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach. A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either. These websites can be detected very easily…

On mobile, some of the opt-out toggle switches don't even function. You literally cannot disable the toggle in iOS Safari.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#46

Post by ratww »

microcolonel wrote: post #40
ratww wrote: post #31

Earlier quoted context omitted.

> How else can you even store a consent for cookies/localStorage? You said "the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog" . But if cookies are disabled, then there's no point in asking for consent. There should be no cookie banner in this case.

> But if cookies are disabled, then there's no point in asking for consent. But the only way to determine if cookies are actually disabled in the browser is to attempt to store cookies, which is the thing you're asking consent for.

Not really, there's also navigator.cookiesEnabled now.

And even if there wasn't, attempting to store a cookie with a dummy value just to check if cookies are enabled does not break the GDPR for three reasons: first, if it's a dummy value it's not really personally identifiable information. Second, it's a functional cookie required for the site to work. And third, the site can just delete it afterwards the checking. No consent required in this case.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#47

Post by Nextgrid »

umvi wrote: post #22
Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

> in the real world a lot of people/sites rely on ad revenue

I want to start a car rental business, however that requires upfront capital to buy the cars and I don't have that, so I'm gonna break the law and steal the cars to offer them up for rental. Is that what you're advocating for? Being in business is not a right; if your business model isn't sustainable without breaking the law then find a different one.

> ad revenue for the most part, requires tracking built in

Magazines are essentially full of ads and people actually pay for them and yet there's no tracking other than very generalized targeting (a car magazine will have car-related ads in it). Just because web advertising became the wild-west doesn't mean we should now legitimize it.

> and use my website/product for free

The biggest offenders (Google, Facebook, etc) don't even allow you the option to pay for it to decline tracking (and a lot of them track non-users as well; Google Analytics and the social media networks track people regardless of whether you're a user and agreed to their ToS/privacy policy).

> Why can't I say: "accept that my site is ad-supported or don't use my site?"

Because it's the law and the same reason why I can't walk into a store, start shoplifting and when caught say "sorry, should've read my ToS and not let me in if you disagreed with it".

You are welcome to vote and nag your local politicians to amend the law if you believe it's wrong but until then you need to respect it regardless whether you agree with it or not. The advertising and marketing industry has proven it is unable to self-regulate so the law has now stepped in. The industry had many chances to clean up their act (the do-not-track header was one of these chances) and they clearly told us all to fuck off so now the GDPR is a stronger solution.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#48

Post by Fargren »

shadowgovt wrote: post #30
tjoff wrote: post #17

Earlier quoted context omitted.

Again, only because of incompetent and/or immoral developers.

How, exactly, is a developer supposed to change state in a stateless protocol to denote that you've dismissed the cookie dialog if the user has disabled the feature that allows the developer to add state to the stateless protocol?

The law does not forbid you from storing any cookie, even if the user declined. The user can decline cookies that are not needed to provide what the user asked for. Even after the user declines, you are allowed to use cookies to keep track of what's in the user cart, whether the user has logged in or whether the user rejected cookies.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#49

Post by lmkg »

moksly wrote: post #6

I work as a developer in the European public sector, we already took privacy and security rather serious because the laws governing it had always been and are still tougher than the GDPR. I actually like that the EU is doing something, and I guess this is the best you get from a bureaucracy, but what it’s changed is that we document everything. Whenever I build anything that moves privacy data, even if it’s just hook…

There is a privacy benefit to adding friction to spreading personal data around everywhere. At the margin, some services will decide not to bother processing non-essential personal data just to avoid the paperwork. And really, that's one of the excesses that GDPR was a reaction to: that the "default" was "track everything in case the data magically becomes valuable," and now the it's become "perhaps not."

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#50

Post by smichel17 »

umvi wrote: post #22
Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

The argument goes, if the monetization model is unethical, then it shouldn't exist. I'll demonstrate this by taking your post and rewriting it about a different industry. I am NOT saying these are the same situation, because most people have different views on tracking vs child labor. I am demonstrating that the argument makes sense IF you think tracking is similarly immoral.

> Ok, that's nice in a fantasy world, but in the real world a lot of people/clothing companies rely on cheap manufacturing, and cheap manufacturing for for the most part, requires child labor. So now if you legally force clothing companies to allow consumers to decline "child labor" you are basically allowing consumers to reject clothing companies' monetization model and get their clothes at a loss to the company. And why should clothing companies allow that?

edit: maybe I've couched my argument a little too much. I think it's a pretty good comparison, actually: I think most (but not all!) people agree that tracking and child labor are bad, but turn a blind eye because they enable cheap/free stuff.

Post reply on HN