Hacker News Reader

Comment by hanoz | Hacker News Reader

Has anyone actually come across any sites that have gone properly GDPR compliant yet? 90% of the conversions I've seen have seen have gone with: we use cookies, click here to be fine with that (almost always after the cookies are already set), or click here to embark on some convoluted process to disable some in our spuriously derived non-essential categories.

It appears the positive opt in requirement of GDPR is being universally ignored by the industry.

View on HN

I've seen various sites in compliance, mostly smaller companies TBH. It seems to be mostly US companies who seem to be getting it completely wrong (maybe that's biased by the sites I frequent), which has perplexed me a little as it would have been cheaper to just do nothing about it at all.

I'm also wondering if the cookies thing is actually just the other law, but now we're all having to look at the old "we use cookies" notifications in a GDPR light.

The irony is that the rules about annoying cookie notifications were supposed to be fixed by some additional changes that came into effect with the GDPR, but those changes weren't ready in time.

Interesting, do you have a link where I can learn mire about the fix?

https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...

That Wikipedia page seems out of date, and there's only that one and a Dutch version of it, it seems. ePR should get in effect in 2019, correct?

ePR should get in effect in 2019, correct?

Yes, that seems to be what they're aiming for now. It was originally supposed to come into effect alongside the GDPR last month, repealing the analogous ePrivacy Directive that was (and for now remains) in force, and therefore allowing member states to update their national laws to remove the annoying cookie notification requirements. Sadly, it wasn't ready in time.

The cookie banners are required by the ePrivacy Directive, not the GDPR or its predecessor, the Data Protection Directive. ePrivacy has been around for years. Directives are EU-wide “directives” to each member state (country) to enact their own version of it. Therefore, both ePrivacy Directive and the old Data Protection Directive resulted in varied laws from country to country making compliance a challenge. Part of the purpose of the GDPR was to create consistency by replacing a directive with an EU-wide regulation. They have the same plan for ePrivacy and already have published an ePrivacy Regulation for review and comment. The ePrivacy Regulation was supposed to be passed at the same time as the GDPR, but they’re behind so people are expecting it in 2019. There is a recognition that the cookie banners have been a failure, and it is expected the ePrivacy Regulation will get rid of them (but there will still be TBD consent requirements around use of cookies).

Maybe this is a bit of a weird stance, but I don't think setting cookies counts as a violation of privacy. First of all the user has full control over the cookies and can arbitrarily deny, delete or even modify them (nobody uses this power, but they still have it), and fundamentally telling someone to remember some bit of information doesn't really tell you anything about them.

However reading cookies (and sending the content to a server) obviously is privacy sensitive, although even then it should be noted that users have full control over the cookies. This makes cookies better than e.g. a profile that's stored on Facebook's servers.

AFAIK,the 'cookie law' directive was even more relaxed than what you describe. It never mentioned cookies explicitly. It was talking about tracking. If you had a good technical reason like keeping login session open, you never had to place a pop up in the first place.

However, if you started to track people explicitly, even without a cookie, you needed to inform the user.

How that law got interpreted as a 'put a pop up on everything' is beyond me. Most sites managed to annoy the user with a pop up, and still were not on the legal side of the law as they did not inform which third parties exactly got the information.

Why didn't the EU step up and gave guidance to stop the madness? No idea. In general, they tend to bury you alive under folders when given half a chance.

I don't know what the cookie law status is today. It was supposed to be superseded by the GDPR, but i think it is still active, together with the GDPR.

You have to put the pop up if you want to count visitors with Google Analytics, or use Google AdSense, and that covers the vast majority of small / medium sites.

Yes, most online shops that I have an account with seems to do GDPR compliance correctly by simply adjusting their contract they have with the customer. In order to do the service which I customer has bought and send an item to a location they need the shipping location, so they changed the contract to say "we are storing the location for the purpose of sending you the item you bought". They can't go and sell that information to a third-party, but they can store it for the purpose that I as a customer requested of them.

There is much confusion. Cookies are governed by the ePrivacy Directive, not GDPR. ePrivacy regulates email, phone, text and other communications – not personal data per se. It prohibits setting a third party cookie on a device without first getting consent. It also requires consent for email marketing, which, when collected in the context of a sale to a customer (and some other restrictions) may be opt-out (this is often called a “soft opt-in”). Otherwise, the consent must be opt in. This is getting confused with the GDPR.

I know a lot of companies that I believe are compliant, but they also do not do anything where they'd need to process data with non-obvious reasons.

Many high-profile sites rely on advertising, and that makes things more complicated, since they have a clear business interest to get and share as much data as possible, instead of a "process only data strictly needed" approach others can take.

Reply on news.ycombinator.com