Hacker News Reader

Hacker News

Comment by user-the-name | Hacker News Reader

Parent Full thread

user-the-name

It has always been user-controlled, but it was previously opt-out, while the change will make it opt-in.

View on HN

It's not user controlled if it is on by default.

if the user can opt-out, how it isn't user controlled?

default passwords, that can be changed, aren't under the user control?

GDPR effectively prohibits ANY opt-out. A an informed consent via affirmative action must be freely given.

Apple is so much in the wrong here.

>GDPR effectively prohibits ANY opt-out.

This isn't true. I don't understand how people continue to make GDPR into this grandiose thing that does everything under the sun.

I did mention the need for consent quite explicitly. Which part of it 'isn't true'.

It's true though that you need explicit consent for sending PII under GDPR. Whether IDFA is considered PII (I think there are strong hints it is) is up to the jury. More surprising is that Apple is hellbent to defend this when they've only their pro-privacy stance to loose.

IPs alone are considered part of GDPR consent (when collected/tracked).

Maybe one day we can get a law like this around opt-out autoupdates that hands control of your device over to a remote party that can execute arbitrary code on it without your involvement.

This is becoming the norm even in security/cryptography software like iOS and Signal and it’s terrifying.

> GDPR effectively prohibits ANY opt-out.

This is absolutely not in any way a true statement. The GDPR applies to very specific things, and I don't think you could find a reading of it where it applied to maintaining the IDFA on a phone.

I interpreted the statement as if something is invisible to the user (without knowing to look for it), the (average) user has not had a hand in it, and are thus not controlling it.

Pedantic, granted, but relevant in practice.

You're right. This is why "defaults" need to be part of the conversation.

https://www.fastcompany.com/40403706/the-subtle-power-of-def...

GDPR isn't interested in control, it's interested in informed consent. You can't give informed consent if you were never asked for consent in the first place.

Reply on news.ycombinator.com