Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Consent-O-Matic: Automatic handling of GDPR consent forms

github.com

Post reply on HN
Print view View original

51–60 of 137 posts

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#51

Post by pydry »

pmontra wrote: post #36
pydry wrote: post #25

Earlier quoted context omitted.

If you program a browser to consent for you that is no different to consenting yourself. Just as writing and running an install script with --accept-tos is valid.

That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of "surprises". So yes, a browser could come with an "Accept all" setting, probably disabled by default, but which browser vendor is going to go through the trouble of implementing that, proposing an API and above all getting every Privacy Agency of the world to…

Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent.

A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent.

Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could.

Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#52

Post by reportgunner »

radicalbyte wrote: post #29
sdoering wrote: post #22

Earlier quoted context omitted.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

It should literally be a setting in the browser - auto decline. That would make everyone's life a lot easier.

Everybody would just leave that enabled and advertisers would find a different way to make money from tracking our browsing.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#53

Post by ginko »

sdoering wrote: post #23
asah wrote: post #20

Related q: is there anyone choosing to accept all ? (Knowingly)

As my hosts-file and ad/script blocker are configured to block tracking and advertising I always click: Accept all. This is by default the quickest way to get to the content. Without compromising privacy by using addons.

Wouldn't that still allow advertisers to track you through your IP or other means?

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#54

Post by akie »

radicalbyte wrote: post #29
sdoering wrote: post #22

Earlier quoted context omitted.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

It should literally be a setting in the browser - auto decline. That would make everyone's life a lot easier.

I wonder what the advertising company in charge of the world's most popular browser would have to say about that.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#55

Post by josteink »

I've tried this, and on its own, it works really, really well. It does what I want, and gets me less distraction on websites. All in all great.

Where it started not working so well was in conjunction with NoScript (which I've started using recently).

Then on some pages, it stalls, showing a notification while waiting for a consent-dialog to show up, before eventually giving up. But because of NoScript the dialog itself is blocked and will never show up.

In these cases Consent-O-Matic is actually creating a bigger distraction than it needs to.

Would be nice to see that addressed somehow :)

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#56

Post by chriswarbo »

gyulai wrote: post #4

I wish people would stop confusing cookie-consent laws and GDPR. They are quite distinct laws and are giving GDPR a bad rap for wholly the wrong reasons.

> I wish people would stop confusing cookie-consent laws and GDPR

I wish (computer-savvy) people would stop talking about "cookie laws" altogether, since there's no such thing.

When people say "the cookie law", they're usually referring to two EU regulations:

- PECD: https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...

- GDPR: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

However, neither of these is a "cookie law". In particular:

- The laws cover much more than "cookies"; e.g. they're just as applicable to browser fingerprinting, Flash "supercookies", etc.

- Cookies which perform a requested job have implied consent: users visit an online store because they want to use the shopping cart functionality; if they don't agree to having a shopping cart cookie, they can leave the online store. (In contrast, users don't visit online stores in order to be tracked by advertisers; so separate, explicit consent is required)

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#57

Post by chriswarbo »

wiz21c wrote: post #19
megapolitics wrote: post #13

Earlier quoted context omitted.

The consent form situation did not get this bad until GDPR was passed. Prior to GDPR cookie-consent forms were simple "Yes" or "No" buttons without all the insane pages of toggles.

Dead simple solution: provide a GDPR consent form with "yes, I accept being tracked" or "no I refuse being tracked in any way". Or even better, make the form automatically recognizable by your browser and a setting in the browser so that it says yes or no for you. Have you ever notices that the "yes I agree" button is most of the time MUCH easier to click on than to tell "no I don't" ?

> Have you ever notices that the "yes I agree" button is most of the time MUCH easier to click on than to tell "no I don't"?

That's illegal under GDPR. Yet here we are.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#58

Post by FreeHugs »

sdoering wrote: post #22
eternityforest wrote: post #17

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

    "Accept all" and the "Deny all" must be both
    be the same level of "easy-ness"
I think this is not clear until it has been tested in court.

Many websites now have two offers: Free with 3rd part ads and paid.

Surely paying is much less easy than clicking "Ok, show me the content with 3rd party ads".

It will be very interesting, how courts see this.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#59

Post by oneeyedpigeon »

brodo wrote: post #42

I wish more people would just use self-hosted analysis tools and stop tracking people across sites. I think github does this and they wrote a blog post detailing their reasoning.

Unfortunately, the default for many is Google Analytics. It would be very nice to have a client-side analytics provider with a default position of total anonymity.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#60

Post by ratww »

Cthulhu_ wrote: post #21
eternityforest wrote: post #17

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.

That's the main issue here; the EU mandated consent and gave guidelines on what that consent might look like, but they left implementation down to the industry, which decided to do it themselves (often using dark patterns, for which some companies already got fined) instead of integrating it in browsers. I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened t…

> I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it?

There was Do-Not-Track, but the industry decided it shouldn't be respected.

Post reply on HN