Hacker News Reader

Comment by TekMol | Hacker News Reader

I think that currently pretty much every service, device and website violates the GDPR.

The GDPR requires consent or some other legitimate reason to store data about a person.

I see dark patterns everywhere. I never give consent. But I get tracked to death everywhere all the time. Even before I touch anything on a website, it plants dozens of cookies on my machine.

But cookies are not even the problem. Fingerprinting is. When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads. Even though I don't store cookies on any of them.

Additionally, the web turned into an arcade game. The user has to rapid fire click away 'OK', 'I AGREE', 'I CONSENT', 'I UNDESTAND' buttons. He is not giving consent. He is just trying to get through this pile of nonsense to reach the content.

View on HN

> I think that currently pretty much every service, device and website violates the GDPR.

Not really, my website doesn't :-)

In case you're using Google Analytics, it's easy to make it compliant, you just activate IP anonymization, which you had to do anyway, out of common sense and because tracking by IP without consent was illegal anyway in countries like Germany.

[1] https://support.google.com/analytics/answer/2763052

[2] https://developers.google.com/analytics/devguides/collection...

> When I visit a hifi store with my smartphone, next day my Desktop PC will show me nothing but hifi ads.

Yes, I saw this behavior too, but I like to think that many businesses are not as unscrupulous. But I do take care of my privacy as an ongoing investment ... I'm Google free, I sandbox Facebook, I use privacy blockers, VPN, the works.

GDPR is IMO a godsend. I'm sure the cost will be high for many companies, but that's just karma.

That GA feature does NOT provide any useful anonymity, and I doubt it meet the requirements of the GDPR.

re the aip=1 feature: https://news.ycombinator.com/item?id=17167346

why masking the least interesting byte isn't anonymous: https://news.ycombinator.com/item?id=17170468

> I'm sure the cost will be high for many companies, but that's just karma.

What about for companies that do handle user data responsibly, but have trouble with the formal compliance costs?

If the company handled user data responsibly already, it means the company was already respecting the privacy laws already in place in major European countries, Australia, etc and GDPR compliance shouldn't cost anything.

There's also no such thing as responsible data handling for services tracking users without their consent. If no explicit consent was given, consent obtained with a layman explanation and with no dark patterns, then it shouldn't be legal.

The problem often isn't how the data ends up being used, the problem is that the data is collected in the first place.

Not sure what your question is. If they handle data responsibly they're already compliant, no? In which case what compliance costs do such companies face?

Mostly, I think GDPR makes reasonable requests for how you obtain, handle, store and use personal data. I think that the compliance cost for a company already doing ‘the right thing’ should be relatively low.

(Argument hinges on the idea that GDPR does overreach in what it asks to be compliant, happy to be proven wrong)

If you want to "handle user data" in any way but can't afford the formal compliance costs, then one less company is hoovering up user data. I don't see the problem.

The differece is that now it is explicitly illegal. I suspect after some grace period the most severe violations will start to get prosecuted and then I expect respectable companies to reconsider their tracking.

Anecdotally, pretty much every developer I've talked to about GDPR says in one way or another, their company has some sort of GDPR violation.

It's pretty much the same story every time, there was a big scramble to fix any clear violations, but because GDPR was a bit vague, there are a lot of gray area violations that are still being cleaned up.

The user has the option to not get through the "pile of nonsense" and just close the website. The fact that the user does not should tell you something. Unless you think every website should force the user to go through a 15 minute webinar to help them specifically understand privacy policies before letting them browse the website?

If the website was not tracking your every move and then selling the relevant bits to ad exchanges, they wouldn't need to do the 15 minute webinars.

The lesson to companies should be, don't provide a Hobson's choice up front like this. Offer the webpage you meant to offer, and simply don't try to nickel and dime all the data out of your visitors.

It's not like content producing companies are these super profitable behemoths that are just greedy for $1 more. Not using ad trackers would your reduce your revenue by 50% at the minimum - it's how scaled advertisers spend money, if you're not doing it, you're not getting those advertisers. It is indeed a Hobson's choice - do it or stop providing whatever content it is the reader wants.

Am I the only person who liked the web a lot better before it encountered its own Eternal September?

I'm not trying to be snarky! It's just that I'm not actually sure I like the direction the web took, and I'm not sure these "content producing companies" are indeed a net positive.

Perhaps forcing a lot of (the more shady) commercial activity off of the web is actually the best thing that could happen. (Though they probably wouldn't leave quietly)

If you don't like the new direction the web took and don't think any of the content with ads is valuable, then by all means don't use. But don't force me to stop reading the NYT or Twitter.

No one is stopping you from reading the NYT or twitter.

But let them compete without the distortion of (ab)using quite so much Personally Identifying Information, and see if you'd still be happy to!

So just kill the free and open internet and bring back the walled garden model of the mid 90s where you paid for website packages like you did for cable TV? That's not a future I want to live in.

Europe is playing a dangerous game with the internet right now and I don't think they have enough tech-minded people in power to keep things sane and in check.

Free and open*

*conditions apply: everything you say and do is tracked by a multitude of companies and poorly secured.

Except, in today's internet that would mean pretty much not using the internet at all. Which - in today's society - would mean a greatly handicapped social life at least and would be plain impossible for many people who need to use those sites to do their job.

So yes, technically you're right. As Discworld's Vetinari said, you always have a choice, even if that choice is between agreeing to the deal or being thrown into a spiked pit.

I had some legitimately scary things that may or may not be tracking but I cannot explain it without tracking. I watch some youtube video where the audio mentions a historic place of battle and then seconds later it shows up in my Google Chrome autosuggestion because I wanted to google some more information on it. I dont see how that is possible, it was a very specific location. I only typed "battle of" and it showed me the exact battle that was just mentioned in the video. I dont see how that is possible unless Google has transcribed the audio of all the videos automatically and uses it for search suggestions. It was nothing I ever searched before, in fact I searched many many other battles and places before that one so it would make more sense for it to show me something I searched previously.

It's only creepy if you believe you're the only consumer. Say when others watch that video, they search for "battle of whatever-you're-talking-about". They do the hard work.

As for you watching a video and autocomplete coming in with the same topic, could it be that there was a surge of interest of that battle at the time? Otherwise it may be url analysis from other people searching through chrome.

Ummm, google does transcribe the audio of all the videos automatically. That’s how they have subtitles for all videos (sometimes with hilarious results).

Google may have data that a lot of users searched for "battle of X" right after watching this particular youtube.

Yes, every website now asks for consent to "use cookies" because GDPR "requires us to to ask this". These are weasel words, there is absolutely NO NEED to ask for this. The word "cookie" occurs only once in the GDPR directive text, in a list of examples of personally identifiable data, next to "IP address". Yet no site ever asks me for permission to use my ip address, somehow.

The GDPR does have a requirement to ask for consent to do things like tracking my interests/behavior on a site and sending it to marketing data companies for specificly named purposes. I have yet to find the first website that uses plain language when asking for consent, and I can't wait for the first fines to be handed out.

The cookie law predates GDPR by quite a bit doesn't it?

Yes but there is a work in progress to replace the cookie law with the more GDPR aware ePrivacy regulation.

https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...

they certainly started popping up everywhere long before the GDPR

> He is not giving consent. He is just trying to get through this pile of nonsense to reach the content.

Then don’t access the content? Why should the user get content that someone has worked to create without having to give anything in return (whether that’s in the form of payment or information). There would be no monetary incentive to create content anymore.

Super-simple answer: it's the law (GDPR). Kopplungsverbot. Art. 7 (4) GDPR. End of story.

It says: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. "

It's like a butcher shop saying "the meat could be free if we could only reduce our cost by not caring about hygiene".

Edit: oops, the methaphor doesn't work at all :-D

The GDPR law says, "I consent" buttons that link to detailed policies are fine.

Guess what - the old Internet created plenty of content for free, without incentive of monetization, yet people still did it. The Web has suffered greatly as a result of the bullshit mindset that just because you put something online, you are entitled to make money for it.

Right, that’s why I specifically said “monetary incentive”. There will always be non-monetary reasons to create content.

Are you proposing that trying to make money using the internet is morally wrong? Or just that collecting user data is wrong? Or that collecting data without consent and a clear explanation is wrong? Because if the line is drawn at the latter, then that’s what GDPR is for, and so I don’t understand why people would be upset about having to click through a bunch of notices that try to make it clear how user data is being used.

The problem is that there's no actual consent, just simulacra. The GDPR doesn't say that you just have to "make it clear how user data is being used", it says the user must freely give consent, which means they must not only explicitly do so, as not giving consent must not mean the user loses access to services or content (see Recital 43).

>Are you proposing that trying to make money using the internet is morally wrong?

Not inherently.

>Or just that collecting user data is wrong?

Yes, under any and all circumstances. The security implications alone are staggering.

I think you need to rethink who's entitled here.

Information wants to be free.

I'm not talking about ethics or business models.

I just say that pretty much every site, device and service out there violates the primary rule of the GDPR. They all store data about their users without the users consent.

One of the main points of the GDPR is that the user has to actively agree to storage of data. Making it very clear that storing can not be the default. Yet when you visit the New York Times today, they tell you:

    By clicking "I Accept" or "X" on this banner,
    or using our site, you consent to the use of
    cookies unless you have disabled them.

In one form or another every site, service and device out there is doing exactly this. Making it the default to store data about the user.

I'm not sure that is the interpretation the EU GDPR commission will use.

The faux-progressive modern perspective is to consider ostensibly true things as literally true.

Do you mind dumbing this down a bit for me? What you wrote has gone completely over my head here. What is "faux-progressive modern" and what is the thing being considered true even if it's only "ostensibly true"?

Yeah, I’m confused about what you’re trying to say as well. I can’t tell if you’re in favor of or against my argument.

Don't create the content if you have such poor ethics and imagination that violating people left right and center is the only way you can sustain yourself. How many people even realize the extent and repurcussions of the information you are taking from them?

Generally it isn't the content creators doing this. It's the ad companies, as content creators are busy creating content and not advertising schemes. What is needed is ethical ad monitization choices.

Reply on news.ycombinator.com