Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Consent-O-Matic: Automatic handling of GDPR consent forms

github.com

Post reply on HN
Print view View original

91–100 of 137 posts

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#91

Post by MereInterest »

ratww wrote: post #60
Cthulhu_ wrote: post #21

Earlier quoted context omitted.

That's the main issue here; the EU mandated consent and gave guidelines on what that consent might look like, but they left implementation down to the industry, which decided to do it themselves (often using dark patterns, for which some companies already got fined) instead of integrating it in browsers. I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened t…

> I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? There was Do-Not-Track , but the industry decided it shouldn't be respected.

I would love for an update to GDPR, stating that any automated form of refusal for consent, including the Do-Not-Track header, must be treated as an explicit refusal and may not result in additional requests.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#92

Post by aahortwwy »

sdoering wrote: post #22
eternityforest wrote: post #17

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it wou…

The banners are inherently dark patterns.

Non-essential cookies could be enabled via a configuration menu opened by the user at a time of their choosing. But everybody knows no user is going to do that, particularly unprompted. So they create a pop-up banner to do both the prompting and the configuration.

And everybody knows most users, when they see a pop-up, are just looking for the sequence of button presses needed to remove the pop-up. So they make sure that that's "enable all cookies" because they know if it's "only enable essential cookies" vanishingly few users will enable non-essentials. Why would they?

If everything non-essential were required to be inactive by default I think the pop-ups would disappear entirely. There'd be no point to them because vanishingly few users would ever change the defaults.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#93

Post by clemensnk »

FreeHugs wrote: post #89
clemensnk wrote: post #88

I'm part of the team working on consent-o-matic at Aarhus University, and it's great to see the project getting some attention here. We've been running the project on a bit of a shoestring budget, but we are currently working on improving detection and adding more CMPs. We are also testing the plugin for Safari on both MacOS and iOS, and hopefully have it released soon. I can attest that it is very nice to have on th…

What does it actually do? Does it automatically "accept everything"? Or reject everything? Or just supress the consent forms?

You can configure what categories of tracking you will allow, and then there's custom rules for a wide range of CMPs to apply those preferences automatically.

See screenshot from config here: https://imgur.com/a/fHfuZ0O

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#94

Post by MereInterest »

JimWestergren wrote: post #5

Or just activate the filter in uBlock Origin: Filter Lists -> Annoyances -> EasyList Cookie

To add to this, blocking the GDPR pop-ups is legally equivalent to declining all but the essential cookies. This is because GDPR establishes a default that users may not be tracked, and explicit, freely given, informed consent is an exception to that general rule. If the pop-up is ignored, blocked, or contains insufficient information, then the exception is not granted, and the site may not track you.

Granted, whether or not sites are following the law is another matter altogether.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#95

Post by MiddleEndian »

ratww wrote: post #60
Cthulhu_ wrote: post #21

Earlier quoted context omitted.

That's the main issue here; the EU mandated consent and gave guidelines on what that consent might look like, but they left implementation down to the industry, which decided to do it themselves (often using dark patterns, for which some companies already got fined) instead of integrating it in browsers. I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened t…

> I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? There was Do-Not-Track , but the industry decided it shouldn't be respected.

Do Not Track was always a joke. Without any legal teeth, why would people determined to spy on you stop spying on you because you say "Please"?

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#96

Post by pydry »

MereInterest wrote: post #90
pydry wrote: post #51

Earlier quoted context omitted.

Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent. Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could. Whether there's any point is…

If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent for a surgery two weeks later if I hadn't been aware of the risks of the surgery at the time that I signed the form. Being informed of the specifics for a particular procedure is necessary, not just being informed of the general risks of medical procedures. In the same way, GDPR requires…

>If I sign a form that says "I accept all medical procedures being done to me in the next month.", that wouldn't be informed consent

Medical consent is a whole different kettle of fish and I may be off base here but I am pretty sure you can preauthorize consent for, e.g. theres a risk you may become unconscious and need follow up treatment.

>The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent

It's absolutely possible to have all of this information sent in an API to software acting on behalf of the user. The user has been informed and the obligations of the website will have been discharged. What the users browser does with this is the users business.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#98

Post by throwaway2016a »

Correct me if I'm wrong but isn't the cookie law different than GDPR?

My understanding is that GDPR concerns how you use PII and contact information and the requirement that you be able to request your data be deleted. So I expected a data removal request form and/or a contact consent form.

Re: Consent-O-Matic: Automatic handling of GDPR consent forms

#100

Post by renewiltord »

Nextgrid wrote: post #34
radicalbyte wrote: post #29

Earlier quoted context omitted.

It should literally be a setting in the browser - auto decline. That would make everyone's life a lot easier.

We had something like that called DNT, and not only did nobody honor it, but it was used as an extra fingerprinting vector, totally defeating its purpose. According to the GDPR, all non-essential tracking should be off by default, so "decline" is already the default if companies were compliant with the regulation (which is a big "if").

I was in ad tech once. We obeyed it. Lots of traffic went through us. No one cared that we obeyed it and our competitors didn’t.

Left the code in anyway but that’s the thing about these things: consumer behavior reveals that they don’t actually give a fuck about whether anyone obeys this or not except for the time when they want to be outraged.

Post reply on HN