Hacker News Reader

Comment by endymi0n | Hacker News Reader

I‘m really curious how this will play along with GDPR, which will pretty much absolutely need forced modals in order to to legally capture tracking consent. It could also create interesting legal constellations: How do you prove you asked for user consent when your client side code was blocked or modified?

View on HN

I don't think GDPR is going to be easily dismissed with modals asking for permissions like cookie notifications were. Someone correct me if I'm wrong, but if the user doesn't give consent (whether explicitly, or via a browser blocking a modal) then unless that information was critical to the application function then you have to provide the service anyway without downgrading the functionality.

Its all explicit opt-in/implicit opt-out instead of implicit opt-in/explicit opt-out. There are no consequences for the user if they opt-out, and it is extra-territorial in its enforcement meaning it impacts any businesses in any region handling European citizen data. GDPR seems to mean business from a regulatory standpoint.

This is correct except for the cases where a company can show "legitimate interest" in which case it is in fact an opt-out rather than an opt-in [1].

And yeah, I agree - they mean business

[1] https://www.gdpreu.org/the-regulation/key-concepts/legitimat...

You can’t do anything without affirmative consent, so if your modal was blocked the user can’t give it. You don’t need modals though: you could have an in-process step for the action you want to collect data for, or just anonymise your tracking rather than collecting personally identifiable data.

GDPR doesn't force modals. They are just the easiest and most lazy way to implement GDPR compliance. So perhaps modals becoming unreliable will inspire web developers to explore other options... like not tracking absolutely everything about the user from first millisecond after the page was rendered.

Nah. We'll get the same thing we got on mobile phones (and still have); force redirect the user to a new page, then redirect back to the home page (not where you came from) or just reloading the entire page when consenting (or not).

This is an interesting interpretation of GDPR I have not heard before. Are you confusing it with the older cookie notification law? If not, can you explain what part of GDPR you see a popup as satisfying?

I am legitimately curious, because GDPR can be quite nuanced and I may be missing something myself.

Edit: I'm still trying to figure this one out. I just read a dozen articles about affirmative consent and almost every one recommends a clearly defined and unambiguous checkbox embedded in your form. I couldn't find any example that did a modal except for some mobile app examples but mobile apps would presumably not be effected by this change to how in-page popups work. The fact is, the browser does not passively collect enough PII without asking for it explicitly in a form so putting the consent also in the form is an easy choice.

Again, I could be missing something. I'm hoping someone more familiar with it can clarify.

You don't get consent if it was blocked.

Simple; don't trust your user's browser will use your website like you intend it to. Don't use an annoying modal dialog, use a landing page instead. Block access to the page until your server has received a positive "I agree" confirmation.

The lazy approach is to have a fully client-side modal dialog that is clicked away with an "I agree", fully client-side.

You ask "How do you prove you asked for user consent", but you don't need to - you need to prove the user gave consent. And if the user has a script that automates that process, then that's good enough for you and your company IMO.

Reply on news.ycombinator.com