Hacker News Reader

Comment by snowwolf | Hacker News Reader

The dark patterns in play now to get explicit consent are pretty bad now though. Take Mashable for example.

On first visiting the site you are presented with the option to "Consent" or view more Options (where you can Opt Out of all - except you can't really because some require Opting Out on the specific Advertisers site). But if you do choose to Opt Out all, they will then show you the initial Option box on every visit to the site, where you have to go through the More Options route every time. And if you ever accidentally click I Consent, then they opt you back in to everything again and then never show you that option box ever again.

Note: I just picked on Mashable, but there are many, many sites following this same dark pattern.

View on HN

Article 7 of the GDPR specifically states that "It shall be as easy to withdraw as to give consent."

> And if you ever accidentally click I Consent, then they opt you back in to everything again and then never show you that option box ever again.

If this is accurate, then this is another violation of the same article, which also states that "The data subject shall have the right to withdraw his or her consent at any time."

This. I also found the Daily Mail decided that if you ignored the banner asking for consent and scrolled far enough down the page, it assumed consent for everything. Definitely shady, probably illegal.

GDPR requires affirmative action for consent. This was specifically touched upon in the recital 32:

> Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

I had an interesting encounter recently:

https://imgur.com/a/i1hm1TQ

I'm not sure what conclusion you're drawing, the final two screenshots didn't have any explanation.

As far as I can tell, you've observed that if you force your browser to stop displaying the cookie preferences overlay, the hidden page becomes visible again.

Does this reveal something controversial that I haven't inferred?

The same thing happens on Forbes. Trying to opt out fails after "applying preferences" a few minutes.

It's of course bullshit.

Dark patterns like that are explicitly not allowed and hopefully these sites will learn that if they aren’t going to be compliant then they might as well not show anything and just ignore the GDPR.

Enter Brave. And uBlock Origin. And DuckDuckGo privacy essentials.

Swap DDG Privacy Essentials for uMatrix and you won't get the cookie pop-ups _nor_ the tracker cookies, which is pretty swell in my book.

It breaks some sites, but after saving settings for your more commonly visited ones, you really don't notice it all that much.

Reply on news.ycombinator.com