Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Am I logged in or not? GDPR case study on the example of Chrome browser change

blog.lukaszolejnik.com

Post reply on HN
Print view View original

61–70 of 507 posts

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#61

Post by wnevets »

RandallBrown wrote: post #54
Maarten88 wrote: post #44

Earlier quoted context omitted.

Yes, every website now asks for consent to "use cookies" because GDPR "requires us to to ask this". These are weasel words, there is absolutely NO NEED to ask for this. The word "cookie" occurs only once in the GDPR directive text, in a list of examples of personally identifiable data, next to "IP address". Yet no site ever asks me for permission to use my ip address, somehow. The GDPR does have a requirement to ask…

The cookie law predates GDPR by quite a bit doesn't it?

they certainly started popping up everywhere long before the GDPR

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#62

Post by bad_user »

TekMol wrote: post #6

I think that currently pretty much every service, device and website violates the GDPR. The GDPR requires consent or some other legitimate reason to store data about a person. I see dark patterns everywhere. I never give consent. But I get tracked to death everywhere all the time. Even before I touch anything on a website, it plants dozens of cookies on my machine. But cookies are not even the problem. Fingerprinting…

> I think that currently pretty much every service, device and website violates the GDPR.

Not really, my website doesn't :-)

In case you're using Google Analytics, it's easy to make it compliant, you just activate IP anonymization, which you had to do anyway, out of common sense and because tracking by IP without consent was illegal anyway in countries like Germany.

[1] https://support.google.com/analytics/answer/2763052

[2] https://developers.google.com/analytics/devguides/collection...

> When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads.

Yes, I saw this behavior too, but I like to think that many businesses are not as unscrupulous. But I do take care of my privacy as an ongoing investment ... I'm Google free, I sandbox Facebook, I use privacy blockers, VPN, the works.

GDPR is IMO a godsend. I'm sure the cost will be high for many companies, but that's just karma.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#63

Post by frenchy »

ljm wrote: post #20
tedivm wrote: post #3

I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilit…

Not that I want to advocate for Google, but I imagine you could create a Firefox extension that works something like that into Firefox's sync mechanism. It sounds like they're scanning a cookie and then using that to change some other aspect of the browser; unless they've also added some stuff that only Chrome could recognise and work with. Now I've done making an excuse for it, I think it's a shame that Microsoft fu…

> I imagine you could create a Firefox extension that works something like that into Firefox's sync mechanism.

Being able to make something with an extension have having a behavior turned on by default in the browser are very different things.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#64

Post by nicolaslem »

RandallBrown wrote: post #54
Maarten88 wrote: post #44

Earlier quoted context omitted.

Yes, every website now asks for consent to "use cookies" because GDPR "requires us to to ask this". These are weasel words, there is absolutely NO NEED to ask for this. The word "cookie" occurs only once in the GDPR directive text, in a list of examples of personally identifiable data, next to "IP address". Yet no site ever asks me for permission to use my ip address, somehow. The GDPR does have a requirement to ask…

The cookie law predates GDPR by quite a bit doesn't it?

Yes but there is a work in progress to replace the cookie law with the more GDPR aware ePrivacy regulation.

https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#65

Post by gruez »

tedivm wrote: post #3

I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on. I really expect this change to push a lot of people away from Chrome, and frankly I wouldn't be surprised if it started opening up more antitrust possibilit…

>I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on.

link to said threads?

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#66

Post by jonbronson »

kowdermeister wrote: post #57
faragon wrote: post #5

Please, Google, fix those mistakes soon, and avoid a PR fiasco.

Nobody really cares outside this tech bubble. There won't be a PR fiasco, because it's hard to explain why it's bad for a non techie end user. "Google simplifies the login experience in Chrome", is essentially what's happening here and it's far from obvious how to sell it as a doomsday scenario as I read the mood correctly of many HN users.

For people already logging into Chrome, perhaps. For people who have chosen to not sign into chrome, this is a breach of privacy and of trust. Without warning, we've been force-signed-in with no clear way to disable this setting.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#67

Post by deadmetheny »

xxpor wrote: post #55
deadmetheny wrote: post #51

Earlier quoted context omitted.

Guess what - the old Internet created plenty of content for free, without incentive of monetization, yet people still did it. The Web has suffered greatly as a result of the bullshit mindset that just because you put something online, you are entitled to make money for it.

I think you need to rethink who's entitled here.

Information wants to be free.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#69

Post by feanaro »

rando444 wrote: post #43
sp332 wrote: post #2

So, it's bad because it doesn't sync your history by default? Even if the UI is confusing, the worst case here is thinking that your data is being synced when it's not. It's like the opposite of a privacy problem.

It's bad because it's by default signing you into a service you didn't ask to be signed into, and don't have an easy option of turning this off. Sure, it doesn't automatically sync your browsing history now , but we all know change happens gradually. It's just a "feature" to be enabled later. I've never once signed into chrome in my life (on purpose). I don't want anything synced between browsers, I like to try and l…

I'm not sure you're in the minority. People like to say that but sometimes that just seems like a currently popular rhetoric.

Re: Am I logged in or not? GDPR case study on the example of Chrome browser change

#70

Post by icebraining »

Xcelerate wrote: post #56
deadmetheny wrote: post #51

Earlier quoted context omitted.

Guess what - the old Internet created plenty of content for free, without incentive of monetization, yet people still did it. The Web has suffered greatly as a result of the bullshit mindset that just because you put something online, you are entitled to make money for it.

Right, that’s why I specifically said “monetary incentive”. There will always be non-monetary reasons to create content. Are you proposing that trying to make money using the internet is morally wrong? Or just that collecting user data is wrong? Or that collecting data without consent and a clear explanation is wrong? Because if the line is drawn at the latter, then that’s what GDPR is for, and so I don’t understand…

The problem is that there's no actual consent, just simulacra. The GDPR doesn't say that you just have to "make it clear how user data is being used", it says the user must freely give consent, which means they must not only explicitly do so, as not giving consent must not mean the user loses access to services or content (see Recital 43).
Post reply on HN