Comment by tcd | Hacker News Reader

Comment by tcd | Hacker News Reader

Parent Full thread

As more time passes I begin to fundamentally believe the modern Internet isn't compatible with the GDPR or privacy as a whole.

Simply the act of enabling JS within the browser is enough to have your privacy violated in thousands of different ways and data sucked up by everyone who wants it.

Simply by installing an app on your smart phone you invite SDK's that are happy to report back all the information the OS freely allows access to because why not? Data storage is cheap and collecting that data is free of charge.

But yes, data about children is collected in the millions, and the truth is there is no possible law that can prevent this from happening because it will happen anyway. One example: If FB detects a baby photo you upload, should it be deleted? I mean that baby cannot possibly consent, and you'd have thought the GDPR or some law meant uploading baby photos is impossible, but that's not the case, FB/Google WILL perform facial recognition on that baby.

Your data will be processed, used, sold and manipulated for as long as you generate it.

The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites).

If the GDPR was serious, it wouldn't be possible to collect this data at the OS level, like, at all, JS would return nothing, Android apps would return nothing (or fake data, at least).

But the GDPR is not serious, at least in some ways.

Hmmmm, I think it's a bit of an unreasonable expectation to think technology should prevent companies from breaking the law.

Most meatspace laws are expected to be followed despite there being little to no physical barrier to breaking them (e.g. there's no physical barrier preventing me from throwing a brick through a window, but it would still be vandalism).

Why should we expect laws in software to be different? Why should the burden of compliance be shifted from the individual/company to the infrastructure?

Because enforcement is effectively impossible. When crime becomes automated, how are humans expected to keep up the pace of enforcement?

Crime isn't automated. Someone has to write the script that commits the crime (or I guess ultimately design the AI framework that generates criminal bots). At the end of the line there's still a human.

> The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites).

That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet.

It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for people who explicitly provide knowing consent to be tracked, but there are several big caveats—it must be opt in, you can't trick people to opting in, and you can't punish people who don't opt in. (And really, after all of those caveats, what percentage of your userbase will agree to be tracked?)

Unless there's some aspect of GDPR which I don't understand—and please educate me if there is!—95% of the "cookie notices" currently on the web are obvious GDPR violations.

(working in the field and away from my computer so using a throaway)

Basically you have two different laws that apply here. Eprivacy and the GDPR:

* Eprivacy has been updated in 2009 and says that you need consent of the user for any read/write operation in the user terminal, unless it has been specifically requested by the user. The wording is strange, but it has been interpreted mostly as being about cookies and any other sorts of tracers. That includes fingerprinting. The thing is, it is a directive, so each European country transcribed it slightly differently! Sometimes, the national DPA (data protection agency) does not even have the authority to apply this law. This is the infamous "cookie banner" law. Note that all login cookies, cart cookies, consent cookies are generally regarded as exempted since they are needed to provide the service asked for by the user.

* The GDPR that everybody knows.

The thing is, since the GDPR, the consensus among DPAs has been that the consent used in Eprivacy is in fact the "GDPR consent" (freely given, no negative consequence, easy to withdraw, requires a positive act, and so on). This is a major change, because most cookie banners used now don't have those characteristics. Keep on scrolling to consent won't fly. "I consent"/"more option" buttons won't fly. "Use you browser settings to block cookie if you don't like it" won't fly. Cookie walls won't fly.

This is the current interpretation of the law among most DPAs. And yes, most website are violating it, but in the sense of Eprivacy, not the GDPR. The non harmonization on the European level makes it harder to engage in repressive action but I have faith that this will soon change.

In the case described by the article, you would need a GDPR consent to carry on fingerprinting, so TikTok is in violation of EPrivacy. When DPAs will start repression, they could be targeted for that.

My two cents!

Thank you, but I'm a bit confused. You lost me here:

> And yes, most website are violating it, but in the sense of Eprivacy, not the GDPR.

From what I understand of your post, GDPR has basically superseded the old Eprivacy law, because it requires the same things and then more on top.

Sorry about that. They are violating Eprivacy, not the GDPR, because they are dropping tracers without proper consent. But they are violating it because the consent they are collecting is not valid in the definition given in the GDPR. The previous understanding of Eprivacy (before the GPDR) admitted a "soft consent", ie "keep reading and you consent". That is not longer the case because of GDPR.

What they do with the data they collect is subject to the GPDR, but the use of tracers without consent is subject to Eprivacy.

Hope it's more understandable!

That makes more sense, thanks!

Are cookies violating if they don't leave the website? It doesn't seem to be a problem as long as the cookie is only used within the context of your site. It's when they're used on other websites that the tracking capabilities exceed what you can otherwise glean from the server logs.

Plus, they're kind of important for sites that provide logins, or have shopping carts, or a variety of other legitimate uses for cookies.

By the same logic, are cookie violating if they are stored _somewhere else_ but the service provider are not selling those cookies to other people? what if the service provider have another service provider that provide analytic services to help with serving the website in question?

What's the difference of say, a dedicated cookie storage service company storing the cookie vs. an internal IT team that builds the wheel and store the cookie with analytic services? Especially when the usage of the cookie in both case being limited to the site in question?

This seem to negate the entire idea of programming - do one thing well, and have another thing to another thing well. Which applies to the business world at large.

Cookies aren't inherently against GDPR if they're used explicitly for necessary site functionality—you don't even need to tell users about them in that case.

What's not allowed is user tracking.

So why display the cookie warning? I assume it’s an attempt to obtain “consent” to something that would otherwise be prohibited by the GDPR, and in relation to consent the GDPR says:

“Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment ... Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.”

I agree with the grandparent that many cookie warnings seem at odds with the GDPR in this respect.

Arguably any programming language allows companies to break the law. It's not a JS thing, and I feel like there is no going back from the world of web applications.

I think it can only be fixed with legislation. There is too much attack surface to the point that avoiding tracking is hard even if you take extraordinary measures.

The GDPR IS the legislation, at least, I thought so.

If you're serious about this, the network shouldn't be making these requests unless you've explicitly allowed it (meaning the request is blocked at the network/OS level).

"Tracking" is not a property of any particular network connection, it the act of correlation in the back end.

Reply on news.ycombinator.com