Hacker News Reader

Comment by Nextgrid | Hacker News Reader

The majority of these aren't actually compliant.

Tracking should be opt-in and consent should be freely given. If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach.

A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either.

These websites can be detected very easily by running a web scraper and looking for one of these non-compliant "consent management" solutions (looking at you TrustArc) and fining every single company that uses it.

View on HN

Here's an example of a broken site:

https://www.europarl.europa.eu/privacy-policy/en

The only two cookie options are "Accept" or "More". But the More option is broken and just brings up the same cookie notice again and again on my browser. It drops cookies on the browser regardless of whether you choose to accept or not (search your cookies in the browser for europarl.europa.eu, you'll find the unique "atuserid" and "atidvisitor" analytics identifiers it has set to identify you).

If that's the result on the EU Parliament's own website, on their privacy policy page, it's safe to say the EU doesn't actually care about privacy.

Maybe all these websites are simply taking the EU Parliament's site as an example on how you should do it? They made the regulation, surely you should follow their example.

That's incredible and just shows how stupid this directive was. In my opinion it destroyed the user privacy and user experience: the average user now clicks "accept" as soon as he visits a site. This made it easy to fool non-technical users to subscribe to push notifications, give access to location and other privacy-invading features. I used the phone of my sister for a few minutes and her notification center was bombarded with random push notifications froms sites he visited and to which she unknowingly subscribed to.

I agree that the current lack of enforcement is bad for the intent of the law and its long-term impact.

Currently the lack of enforcement allows non-compliant solutions (where accepting is easier than declining) to thrive so people get used to accepting everything.

Down the line, even when enforcement catches up and compliant solutions start appearing, users will still be clicking accept because they've been trained to do so.

This is unfortunately good for adtech/martech not just now but in the future, so all of those currently making your money on stalking users, don't cry, it's all gonna be okay.

> The majority of these aren't actually compliant

There is insufficient evidence attempting to comply with GDPR is worth the cost.

Absolutely, given the current lack of enforcement. However, if you're going to be in breach, you might as well improve UX and not bother with the whole "consent management" thing, not to mention that the TrustArc garbage solution doesn't seem cheap.

But then it's much more apparent that you are in breach. If you pretend to care then the chance of being caught is much lower.

Do you mean the direct cost of implementing the compliance, or the indirect cost of no longer getting extra ad revenue in an illegal way?

In most cases I bet the former isn't all that much. The latter is a harder nut to crack, with everyone trying to toe the line and referencing what other companies are able to get away with. Lack of good faith is a big obstacle.

> I bet the former isn't all that much

One of the fundamental problems with GDPR is it contains a federated complain-investigate enforcement model. So your bet would have to apply to each of the EU’s twenty-eight members, now and in the future.

In that context, throwing up notices and calling a day makes sense. One can argue one tried. But not go so far as to potentially create new liabilities by interpreting these enforcers’ current and future preferences too strongly.

> There is insufficient evidence attempting to comply with GDPR is worth the cost.

The number of people working at the respective national privacy regulators is appalling. All of them have an extremely scarce amount of privacy auditors that are qualified to extensively investigate privacy breaches. Even Ireland, which has a huge tech hub with the social media companies especially, has a scarce amount of them.

The Financial Times wrote an article about this awhile back, which tends to have good reporting on tech and privacy issues.

On mobile, some of the opt-out toggle switches don't even function. You literally cannot disable the toggle in iOS Safari.

Yeah but that says more about the clumsiness of iOS. Since upgrading to 13, a ton of stuff is broken, like tap to zoom, and significant ability to edit text fields. Web pages randomly freeze, forcing a kill and reopen, which I rarely saw before.

> A lot of websites also consider analytics cookies as essential

For a lot of websites, they are.

Under PECR, a cookie being essential means necessary to provide the requested service, not necessary to stay in business. If the user wants to view a news article, and you can serve the article without using analytics cookies, then PECR doesn't allow the cookie. (The situation for paywalls is complicated.)

Providing the service assumes staying in business, no?

No, there's no protection for failed business models, as there should not be.

The business model of Google isn't a failed business model.

What the GDPR does do, quite successfully, is build a moat around Google so wide and deep as to minimize competition with them, because they're one of the few firms that can both (a) afford the engineers with the technical expertise to comply with the law while accomplishing their goals and (b) afford the lawyers to address the issue when they fail at the former.

> afford the engineers with the technical expertise to comply with the law while accomplishing their goals

Google is in breach of the GDPR as it stands, so no.

> afford the lawyers to address the issue when they fail at the former

Potentially, though again a clear-cut breach like theirs should result in a fine regardless of how much money they throw at the problem.

As far as building a moat, I'm not sure. Whether it's Google or a one-man shop, neither can accurately track users without being in breach. There is no moat that I can see, you either break the law or you don't.

> Google is in breach of the GDPR as it stands, so no.

I don't believe that is true. What is your source?

They were fined in Jan 2019, but are they still out of compliance? If yes, why are they not being continuously fined?

> you either break the law or you don't.

That's the result on the other side of a trial, sure.

Which is why good lawyers are so important.

> They were fined in Jan 2019, but are they still out of compliance?

They were fined on one specific thing and they maybe fixed it (or silently replaced with an equivalent, non-compliant thing once they went out of the spotlight), however they are plenty of other things they do that are in breach and those are not being investigated nor fined which is why we're discussing the lack of enforcement.

> Which is why good lawyers are so important.

True, but a good law should be one that you can't lawyer your way out of and so far the GDPR outcome of that is inconclusive given there is barely any enforcement at all.

They are a giant and those can be hard to topple in one go, but the fact that a giant can continue a failed business model for a longer time does not make it a not failed model.

Hell, at least around 2017, there were voices from Google that they considered ads to be unsustainable long term and sought to diversificate income streams.

The fun thing is, GDPR didn't actually introduce much change in law. It just gave, for the first time in history, existing laws a real set of teeth, even if they are still baby teeth.

So yeah, all that data companies had been vacuuming for no sensible purpose? It was always illegal

A business model that fails because you explicitly make them illegal isn't exactly a failed business model. The lawmakers made them fail and they either knew it was going to happen or were incompetent.

> A business model that fails because you explicitly make them illegal isn't exactly a failed business model.

It literally is, by definition. Any business success has to happen within the legal context it exists in.

> The lawmakers made them fail and they either knew it was going to happen or were incompetent.

I could reword this as "the elected representatives of the people decided that certain business models were undesirable and anti-consumer, so legislated against them".

>It literally is, by definition. Any business success has to happen within the legal context it exists in.

Yes, and they had business success until the rules were changed from under them.

>I could reword this as "the elected representatives of the people decided that certain business models were undesirable and anti-consumer, so legislated against them".

And I could reword this as "lobbying groups have bought our politicians and use them to enact laws to put our competitors out of business".

I'd say my rewording is closer to reality, because of course the two biggest ad networks increased in size while the smaller ones decreased as a result of this regulation.

A goal of the GDPR was to make these business models illegal, because they are considered bad. It has not been successfull at this, mostly due to lack of enforcement.

Or maybe that's what the voters are told. Why do so many people suddenly believe politicians? Do you think European politicians don't constantly lie through their teeth?

Not for this regulation. Business considerations do not matter, only technical ones.

The true hallmark of an ill-conceived law.

Letting companies opt-out of a regulation purely because it hurts their business model sounds much more ill-conceived to me.

Good law doesn't "let companies opt-out;" it is crafted with consideration for what is already happening and the consequences of the law.

it doesn't appear, 2 years in, GDPR passes that test. If the goal was to minimize "privacy violation" by FB and Google, it's failing. FB and Google are stronger than ever, but their competitors are starved out of the market trying to comply with an onerous suite of policies.

It's such a ladder-pulling set of laws it's surprising Google and Facebook didn't craft it.

Did we read the same article? Most fines are tiny. It hasn't fixed everything (yet) but that doesn't mean it's hurting competition.

> Good law doesn't "let companies opt-out;" it is crafted with consideration for what is already happening and the consequences of the law.

And sometimes the outcome of that consideration is "stop doing that".

In this case you could say anti-drug-trafficking laws are ill-conceived because they go against the cartels' business models.

You may want to choose another example. US drug law is a case-study in how law divorced from consideration of ramifications to existing businesses and societal norms is a disastrous way to craft law.

https://www.aclu.org/other/american-drug-laws-new-jim-crow

Drugs by themselves are indeed a bad example (I am personally in favor of legalizing drugs), but let's substitute them with violence:

Would you say that anti-violence laws are ill-conceived because they go against cartels/mobs' business models of extorting money from people under threat of violence?

You'd have a hard time arguing that breaking GDPR is the only way to stay in business. There are enough compliant news websites to undermine that argument.

Internet Explorer was absolutely essential for Microsoft Windows to provide the requested service.

> The majority of these aren't actually compliant.

The title of the article is "Two years in, GDPR defined by mixed signals, unbalanced enforcement".

So sure, maybe they're not complaint, but nobody is enforcing anyway.

EDIT: removed unnecessary pejorative statement from last paragraph

I've seen a lot of people say this, but I'm just not convinced it's actually the law. It's not obvious to me that analytics cookies categorically can't be essential or that "freely given" implies strict UI neutrality between accepting and declining.

Yesterday the highest German court (BGH) ruled that "default accept" in cookie dialog boxes is illegal.

It was a pre-GDPR case, but the court said it interpreted the them-in-force law in a GDPR-friendly way.

The majority of websites use third-party analytics that collect way more information than necessary and may use it for their own purposes (surprisingly a lot of these companies' main business is ad-tech). The problem here is that not only do you get analytics but the third-party (with whom the user has no relationship and their interests might be against the user's) is now able to track that user across other websites.

Well, essential means that a web service cannot technically work without it. For example, a session cookie.

The law explicitly has exemptions around purely functional cookies so you are free to set session cookies without requiring consent/disclosure.

Reply on news.ycombinator.com