Some frustrated publishers are sitting out Google’s GDPR meetings

"I guess they figured out everything correctly"

You guess wrong. The situation you described does not comply with the GDPR. Report them to the legislative agency that handles these things in your region - if they're a big target they will be high up on the list of companies being audited.

The "agree by closing this popup" tactic is, as far as I can tell, not allowed under GDPR. Here's hoping all the companies that do that get slapped with a fine.

I've had two companies do that to me. Today I've sent a request for all my data, and included a note that they appear not to be complying with the legislation. I add that I will check again in a week, and will consider reporting them to the appropriate authorities.

I doubt it will have much effect, and I'm only doing this to companies I don't mind being cut off from, but it's a start, and I hope more people start to take seriously their legitimate rights.

The only problem with this Polish news portal is that they will get warning and then got punished if they dont comply so this is not "fantastic idea".

What they are doing is direct violation of GDPR and a really bad idea. There was a complaint filled this morning agains Google, Facebook, Whatsapp and Instagram doing something similar but to lesser extent.

https://noyb.eu

I just cant understand why is everyone trying to push all its intelectual power into trying to workaround GDPR instead of trying to comply, for most website it is trivial as they are in breach of GDPR just becoase they collect the data they dont need.

I would be curious to hear how this pattern could be considered to conform to the GDPR. From what I understand it has to be opt-in.

I don't speak polish but I went on the website you're talking about using Google translate and indeed I can't see any way to refuse to give them my info. The "if you click X you agree" bit is probably the shadiest of them all.

They MUST give you an option to retire consent at anytime, even after you gave it willingly (or not), this is an explicit requirement of the GDPR

> apparently the regulation has a lot of loopholes and anyone with smart lawyers can overcome GDPR easily

I think time will tell on that one. It's hard to say how well currently attempted loopholes actually work until they've been tested in court.

As for wp dot pl nothing stopping you from avoiding the site altogether. Yes it's frustrating they insist on tracking you and selling your data as their only business model but at least they have to tell you up-front about it now so you can avoid the site (and have them delete all data they hold on you) if you do not want them doing this.

Edit: though from re-reading your post and the replies sounds like wp dot pl aren't doing things right and need to be more up-front about what you're agreeing to.

The GDPR specifically says that EULA provisions have no effect on the validity of the regulation. Quoting from article 7 [1]:

If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

[1] https://gdpr-info.eu/art-7-gdpr/

One of the nice things about the legislation is that it's quite specific about not allowing consent to be buried in legalese. While I imagine things will soften up a little as companies realise they're not going to immediately get slapped with a fine, most companies will at least be more careful since its simple for complaints to be made. Most do not want to bring the ICO's attention to themselves.

Mostly they won't be able to send mailings around.

Data portability and such are likely a much bigger hassle. Those are actual features you need to implement now if you stored PII.

The commission is appointed and subject to the elected bodies; but afaik it can only propose legislation - it's the elected bodies that vote them into effect.

The EU isn't particularly democratic or transparent - but it is nominally democratic.

https://en.m.wikipedia.org/wiki/European_Commission#Legitima...

Both the Council and Parliament had votes before adoption.

That opinion seems ill-considered, to say the least.

I'm sorry, but how is this relevant?

The government is not exempted from the GDPR, as it wasn't from the Data Protection Directive that already granted most of the rights contained in the new regulation.

While I think it may be easy to argue that use of Matomo is legitimate for the purposes of improving your service (and as a corollary, this can legitimately be outsourced), I think it is a stretch to conclude that it is legitimate for the third party to assemble a dossier of an individual by tracking them across multiple sites for which analytics are outsourced to the third party.

This seems obvious since the third party is not going to expose details about the data subjects use of the other sites so it cannot be of legitimate interest to the primary controller. If they did share such data with the primary controller, the privacy violation is so egregious it cannot hope to pass a balancing test to be considered legitimate.

So while something like piwik may be allowed to be opt out, I think google may be treading on thin ice.

I doubt that user tracking for personalized ads is a legitimate interest, especially in the case of Google search. Tracking users without consent also contradicts Google's own privavy policy. From https://policies.google.com/privacy?hl=en#enforcement

> For example, we ask for your consent to provide you with personalized services like ads.

No, they apparently don't.

> perhaps it's because the business is fundamentally incompatible?

After having read most of the GDPR, that's my conclusion: all advertising other than 1990's style bannering now needs per publisher, per user, opt-in for anything that does tracking or is personalized, where the default should be set to 'no', denying should be as easy as consenting, and refusing access is not a valid publisher response.

That means i.m.o. that using any form of modern advertising has become illegal under GDPR, unless you get users to consent in a compliant way, and I have seen just a few sites even try. I think Google is scrambling to understand that their business is now mostly illegal in EU.

Honestly I think it favors more companies who just didn't do any shadow things with user data or just had not a business model built around it. If you were not one of those and maybe were already respecting the old eu privacy directive, being gdpr compliant is extremly easy and fast

> I would like to have a non-advertisement internet, but it appears that people are just unwilling to do so. Also we may be facing very real cognitive limits, studies on microtransaction fatigue have demonstrated that is not likely to be a successful mechanism for funding webpages -- people just can't make that many monetary decisions every day.

There's no reason why users would need to take all those decisions individually. Just imagine adding user agents to the existing ad-placement system. By default, offer enough to win most bids. If some ad won, prompt the user to increase their bid. And by the way, page prices here would be more like $0.10 than $1.00 or more.

There are other known problems with the essay as well. For example, I mentioned storage costs but it turned out to be more complex than that. The point is not only to provide an overview though but more importantly to trace back the problems to Larry/Sergey, which is why it is so important. And yes I focus on ad tracking using cookies and nothing else. When I was writing the essay BTW, even tracing back when they began sharing the retargeting data took some time.