Hacker News Reader

While all the 'yes I consent' buttons might be annoying (maybe even on a similar level to the inane cookie warnings) the real value of the GDPR lies in the granting people the right to recall that consent later and the companies being forced to comply. Facebook certainly wouldn't have an 'actually delete my profile' feature if they hadn't been forced to make it.

My only gripe is with the sea of meaningless "i consent" buttons that gets increasingly diluted.

Profile delete buttons, user data overview pages and the rest of GDPR i think is very welcome.

> It's an extension of the already existing kafkaesque "press yes to allow cookies" that everyday has to be pressed multiple times with no real benefits other than wasting peoples time (at least in the EU).

It'd be less kafkaesque if the fucking ad industry could use a cookie to store my consent once I have given it.

99% of people don't read anything before they push yes. Most people get increasingly annoyed at the mountain of e-mails, and the hundreds of pages they in principle has to read through.

No offense, but this feels like a “99%” and “most” that is something less than rigorous. I don’t think sound arguments for or against GDPR can come from the “Ah Reckon” space. Throwing out made-up numbers that just represent personal assumptions and anecdote is an impediment to real discussion of these issues.

I’d add that GDPR explicitly forbids just the kind of “press yes to forfeit all of your rights” crap we’ve seen before. I realize that some sites are still trying to get away with it, it it’s non-compliant.

>No offense, but this feels like a “99%” and “most” that is something less than rigorous.

I've read the contracts I have to sign, and generally this throws people off drastically. When I ask, they tell me I'm the first to read them. Things like leases at a place that has been around decades and I'm the first to sit down and read before signing. While it isn't rigorous, from my experience with wet ink legal documents, saying 1% do read EULAs and privacy policies is a very optimistic over estimation by magnitudes.

I think that indicates that the legal documents weren't written to be read, more than people are too lazy to read them. They were written for a lawyer and for use in court, and it's not realistic to bring in a lawyer for every EULA and contract we encounter.

And just as honestly, what are we going to do - say no? Saying no is more and more simply not allowed if you want to use a service. I've had job offers who would rather have me walk than change the terms of employment. There's not a website out there which allows you to use it if you do not consent to their EULA. Hell, I've encountered a EULA when starting my (purchased, not leased) car.

You can't even post on Hacker News without consenting to 39 pages worth of privacy policy and TOS.

And that is why I think the core of the issue is consent. The power difference between the lawyers who understand the legal system and write these documents and the users who are forced to agree to use the service is so great that consent cannot exist between the two parties. We legally allow it, much like some countries will legally let a 9 year old sign some document and then hold them to it, but that is a legal fiction that needs to be done away with. Of course this would be a massive shock to how we do things (how would you sign up for a loan), but that alone doesn't justify allowing such abuse of consent to continue.

> I’d add that GDPR explicitly forbids just the kind of “press yes to forfeit all of your rights” crap we’ve seen before. I realize that some sites are still trying to get away with it, it it’s non-compliant.

I have yet to see a non-terrible GDPR screen, and I'm an American. Every single one so far has been either a giant box of doom, or a giant modal of doom with a dozen checkboxes and a freakin' contract on it.

Nope, don't care, I just want to read the one paragraph of your blog - that's it.

The Atlantic has a great system, and it’s all opt-in as required by GDPR.

Thought it was pretty common knowledge that people don't read anything contractual.

Anecdotally i have never personally witnessed any other than the most academically inclined legal nerds be interested in any terms of service or legal docs. Family, university peers, user analysis from my own services - all i have ever seen is frantic clicking until people get to where they want.

Just googled and it seems i am on point:

http://www.businessinsider.com/deloitte-study-91-percent-agr...

91 percent!

Also my point is not that the GDPR is stupid. I think most of the new protections are fair. I am just pointing out that the "one button click to consent" is completely meaningless because people have no idea what they are doing, are tired, are stressed out, or just don't care (most people).

Here's an overview of reading on the web in general: https://www.nngroup.com/articles/how-little-do-users-read/

> 99% of people don't read anything before they push yes

Unfortunately the option of reading something isn't always reasonable. Check out Ultimate Guitar [0]. Clicking "Manage my choices" gives a list of just shy of 250 vendors, and no explanation as to what or where they're sharing with those vendors. Other websites have longer lists, and have an opt-out per vendor!! These websites are deliberately making it as difficult as possible to reasonable manage your data.

[0] https://www.ultimate-guitar.com/

If you have a dialog where the only option is to consent then either that is not real consent according to the GDPR or the consent was not really needed.

In the first, you may just end up with a database for full of data that you may have to throw out when somebody complains. In the second case, why bother your users?

If there is a real request to consent, then it is easy enough to decline. But so far, real requests for consent are quite rare. Most dialogs are basically: we are going to feed you cookies and violate your privacy; do you want to agree now or later?

> 99% of people don't read anything before they push yes.

Which is why defaulting to 'Accept cookies' is against the principle of the GDPR, other that for cookies vital to the running of the service.

But now you also have. "No I do not consent" buttons. If people are tired of it, they should just stick with 'No'.

No, you have "Click Here to manage your settings" with 10 different pop ups and laundry lists of people you can opt out of having your data shared with. Some of those require you to disable cookies to opt out of their collection too, rather than allowing you to opt out via them.