Hacker News Reader

Comment by Vinnl | Hacker News Reader

> Grindr is now relying on a new consent system and alleged "legitimate interest" to use data without user consent. This is in conflict with the decision of the Norwegian DPA, as it explicitly held that "any extensive disclosure ... for marketing purposes should be based on the data subject’s consent".

This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options to opt in to specific forms of tracking which. Most of those are now off by default, as it should be, except that if you scroll down you still see a number of "legitimate interest" ones enabled, even though you can turn them off manually.

Edit: And worst of all is this very confusing pattern with two columns of toggle buttons, one of which concerns "legitimate interest": https://toot.cafe/@peter/105367185171860458

View on HN

The various dark patterns employed by these consent systems are fairly opaque to anyone who bothers to open them, and are clearly deliberate attempts at maintaining the old status quo of "opt-in by default". Frankly, I am surprised at how few of these fines are flying around, though I am quite happy to hear they _are_ happening.

I do get that this type of regulation is very disruptive to many companies, but if they cannot survive with informed consent, then perhaps they should not have been so successful without it in the first place.

I’ve also wondered why there aren’t “enough” fines. Are the countries just being cautious because they want to establish precedent before going after the “big fish” like Facebook or Google? Or is it something else?

It sounds like a fear of backlash - essentially if you find like 3% of the population with parking tickets it is fine. If you fine 40% to 60% then you get a large contingent pissed off at you - regardless of validity of the laws and enforcement unpopularity is perilous to laws and officials.

If 40% to 60% of population gets fined then that means the law is stupid* and should be abolished. Backlash on law enforcement is totaly understandable.

*"stupid" is relative term. Laws are made for particular society, if almost a half of that society disagrees with the rule then it shouldn't be a rule.

With this logic, there's essentially no regulatory way out of local minima, lemon markets and such. And, the freemium for personal data mining model is very much such a situation.

And I don't think it's a fair statement that any large percentage of _people_ oppose this particular law; in my experience, most people don't seem to have a strong opinion about it, and those that do have a strong negative opinion very often don't really understand it (and are mostly reacting to the irritation that the various stakeholders are deliberately putting them through). Sampling the opinion of companies that live off ads is a bit like asking printer companies how they feel about toner prices.

Not half of society, half of profit at any cost companies that doesn't care about ethics ever.

So great laws actually even if gets 100% of those.

GDPR is pretty recent (2018) and legal opinions on how to apply it (e.g. marketing tracking) are still in the making. I think fines are still applied "slowly" so that the industry has time to change.

Constantly applying fines is not sustainable. You eventually want to get to the point where privacy "just happens".

Data protection officials are generally understaffed and underfunded. GDPR has increased public awareness, scope and thereby caseload. The rest of the normal justice system isn't responsible to handle data protection cases and will just refer you to the data protection officials. So while fines are happening, things move very slowly if at all.

The way of things in EU is a bit different than some other areas. The goal is to change the industry slowly. You don't change industry by killing them quickly so these things are first made into law, then there is usually a number of warnings, then the fines starts showing up small and then the gets ramped up if the industry doesn't change.

These dark patterns we keep seeing shows that the sites didn't do their homework and is trying the usual weazel way of getting past on "you clicked accept so now you are stuck.". Consent can only be given knowingly, if you hide it in the fineprint (or behind a "show more" button) it's not valid according to GDPR. To invent things like selling customer data to third party and call it fair usage of private data is not ok either.

The agreement has to be easy to understand and very short. And it has to be presented close to the actual entering of data or the accept button. No hiding, no shenanigans, no trying to fool with colors or design. It's that simple.

> The goal is to change the industry slowly. You don't change industry by killing them quickly...

I completely agree. People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy. If a “pitiful” fine of $200,000 fixes the behavior, why fine the living daylights out of them?

I’m just wondering why the fines have been so “slow” to happen. Enforcement Tracker[0] lists only 533 of which the majority appear to be against individuals (such as “Doctor”, “Private person”, etc.) I just figured there would be more by this point.

[0]: https://www.enforcementtracker.com/

> People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy.

As a person who calls for these, my reasoning isn't that they should dismantle the entire web because of it[0] - but that destroying a few small businesses and seriously hurting some big ones would set an example for all the rest to fall in line. Right now, companies seem to correctly reason that they're statistically unlikely to be noticed and fined.

[0] - Even though my belief is that advertising industry in particular is a social cancer and absolutely needs to be torched down to the ground.

I'm baffled by the number of companies that should not have any need for third-party cookies and still go full-on dark pattern. In particular online shops: I'm already on their site, why would they loudly advertise "we're shady and want to trick you into selecting all cookies"? I've cancelled more than one purchase because I didn't want to bother with this.

It's certainly down to bad legal advice. Lawyers are trained to take everything they can get. If it turns out that was too much, then they frame it as a bargaining chip, as leverage to at least recover some fraction of what they previously took.

It's sneaky, immoral, unethical and illegal. It also works.

Taking everything one can get is not exclusive to lawyers. Many engineers would rather have more information/data than not enough. Better yet get all the data up front and then decide what you need later.

One expects it of many companies. But the BBC seemingly have a dark pattern here - if you follow the cookie link it shows all cookies are turned off already, so there's nothing to do, no confirmation, nada. If you don't follow the link they of course have set tracking cookies ... so the cake^w link is a lie.

IMO it would be fine to say "we were tracking you but when you followed the link we deleted those cookies and won't now set them". "Reject all", or default off ("no cookies are set, cock here to enable the committee types you wish") is better.

What's far worse is the admission that they still use ad networks even when those networks are clearly breaking the law (ie they offer no settings to disable tracking). Indeed BBC should be going further and not allowing advertisers on their network to drop cookies if a user has disabled first-party cookies. Instead they say "go to these networks and disable it yourself", good luck with that!

This from an org funded in [minor] part by taxation and whose rausin d'etre is supposed to be serving the public interest.

They use ad networks only outside the UK, so the taxpayers are not tracked by these networks. They're very explicit about it in their cookies explanation: 'Set your cookie preferences for performance cookies. And if you’re outside the UK you can set your preferences for personalised advertising.'

It’s almost impressive what these people have created. Now, when I stumble across the rare “Reject All” button on one of those pop ups, I don’t know if they even really mean “all” or if it keeps the trackers under “legitimate interests” enabled because they’re... “legitimate”. So the only safe option ends up being disabling all of them manually, which is absurd when these websites list hundreds and hundreds of trackers.

It’s as if they used decades of HCI research precisely to make the user experience as horrible as possible. No wait, I’m sure they did exactly that.

With that they win the public's opinion. I make an effort to always explain to people I hear complaining about those pop-ups why they've been made to be annoying. Usually it helps to turn their opinion against GDPR towards the companies employing the dark patterns.

No one likes to be blatantly manipulated.

I think that's a long lost battle and they know it. They're going for attrition. People don't want to be tracked, and clicking all the don't track buttons 78 times a day is annoying, so eventually they say fuck it and just start clicking Accept All.

There need to be fines for this. They're clearly violating the spirit of the law, if not the exact letter (and I think much of Europe has legal systems that follow the spirit more than the letter, don't they?)

They're often violating the letter too.

I'm in favor of a lot more fines, and substantial fines. Few companies need to be made example of. The current situation does further damage to how EU citizens perceive GDPR and EU itself - companies do their best to make the consent control experience as bad and tiresome as possible, and then they tell people to blame GDPR for how web browsing just got more annoying.

In practically all cases it is against the exact letter of the law: "It shall be as easy to withdraw as to give consent."

Article 7 (3) 4. https://gdpr-info.eu/art-7-gdpr/

"I will invade your privacy for the legitimate interest of my AdTech network."

A few more GDPR fines and that hole will also be plugged. :)

I've found the Reject All button _more common_ in the last few months, but due to a lot of sites that have added it also adding a legitimate interests section which is seperate, to the point I'm less trusting of sites that have recently added reject all.

For all the hate that Yahoo gets for theirs (shown above), at least it does have a mostly functional reject all function, even if it requires two button presses (the end of the footer does tell you to go manually opt out of facebook/twitter).

Also the 'reject all' button is often drawn in a greyed out style to make people assume you can't interact with it. The 'accept the status quo' button is always brightly coloured and may as well have blinking arrows pointing at it...

It's honestly absurd the amount of different dark patterns they're using to try to trick users.

I’ve already seen websites which I (cynically) assume exploit this new-found aversion I and many others have to green buttons in cookie pop-ups by using differing colour schemes, e.g. https://hltv.org, whose “Allow all cookies” button is actually blue, whilst “Allow selection” is green.

“TrustArc” is a funny name considering it and its pals have obliterated any trust I had in this stuff.

On some websites I get a tracking / cookie consent popup which, if I choose not to consent to everything, leaves me hanging for a _very_ long time while "saving my settings". I am talking about 30-60 seconds here. That must be deliberate to keep you from denying consent. I forgot which company it was but I immediately recognize those popups.

Oracle does this. I've had this happen the other day while trying to access some documentation.

Is it TrustArc? I remember having a similar experience with their pop-up, for example on Oracle's website when I'm looking for Java docs: https://docs.oracle.com/en/java/

That example doesn't have the long loading times for me any more, but I'm almost certain it was the TrustArc pop-up.

Yes, I believe it was TrustArc.

Some tools call APIs from a whole bunch of ad networks. That 60 seconds is likely spent getting opt out cookies from dozens of different ad network domains.

TrustArc's doesn't, or at least didn't the last two times I inspected it deeply. It is possible to reproduce this claim by checking the browser inspector Network tab and by debugging trough the source code: it's just a bunch of setTimeouts.

Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal.

It's purely a dark pattern.

>Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal.

If you did that, users wouldn't be able to see whether their opt out was successful.

users can't see if their opt-out is successful in any case, only that their preference was submitted

You should be opted out by default. The "Allow All" is the one that could in theory need to make N separate opt-in requests.

It should not matter if they're following the law. Failure to access some API doesn't mean the user consented.

Like the sibling poster said, the default should be opt-out.

It's not as if this TrustArc modal is some old product that was repurposed for GDPR. This is all planned and done in bad faith, period. It's a dark pattern.

I thought so as well but if I recall correctly someone explicitly disproved that. Should be fairly easy to confirm by checking the traffic in the network tab - unless the ad networks themselves take 60 seconds to respond there should be no reason for that much delay.

Why is the “opt out cookie” necessary? Why can’t they just assume that anyone who doesn’t have an opt in cookie hasn’t opted in and can’t be tracked? Isn’t the opt out cookie itself a form of tracking? If you have the cookie I know you’ve been to a site I advertise on/track/am affiliated with.

The opt out cookie was created by ad networks prior to GDPR when many EU countries allowed for opt in by default. The opt out cookie was the tool to allow users to opt out. It still has value today as it allows an ad network to remember a user's choice not to be tracked.

The opt out cookie is set by the advertiser, not the publisher, and the contents of the cookie have generic text like "OPT OUT".

I agree with your point here, it's in spirit of GDPR, unless expressly permitted the sites must assume that the user has opted out. The ad agencies with their cookies have it backwards.

Doesn't GDPR require opt-in for tracking?

So as long as you didn't interact with the banner, _every_ page load should take ~60s?

Of course they have to track that they aren’t tracking you, or else you would get the consent banner repeatedly on every page load.

The actual way this should be implemented, if they wanted to be morally irreproachable, would be this: a consent popup always available, tucked down somewhere in the corner of the site. It defaults to opt-out from everything, you can click on it to expand it if you want to opt into something.

An acceptable option is to pop up a consent form as needed, and set a cookie recording whether user made a consent decision. That can be classified as essential cookie to fulfill a legal obligation.

Still not acceptable to make a worse experience when the consent is rejected.

They'd need to queue those things and process them async later, or find a solution that doesn't need those requests at all.

So (in this hypothetical), it's sharing your data with ad networks, in order to not share your data with ad networks?

That seems really wrong.

Ziff Davis sites do this. Very aggravating.

Clearly a violation too, since the experience is now worse when not giving consent. That its clearly deliberate doesn't help either.

Yep, that's TrustArc

These fake progress spinners are only there to deter you from opting out (hint: if you just accept all, the modal closes instantly).

I wish the EU would throw massive fines at these companies, and ban the persons in charge from over working in the business again.

At least in some cases I've seen, the progress seems to be tied to a staggering number of network requests happening in the background. I've heard this explained as being necessary to communicate your opt-out to all the relevant parties, but honestly, that smells like bullshit. More likely it's designed like this on purpose, to have plausible deniability for the dark pattern.

If the default is to be opted-out, why would they even need to communicate at all with third parties? I'd say that it is bullshit.

Once again proof that what we need is the opposite approach; companies need to actively get explicit permission not just from the end user, but also from authorities to collect and share data, and the full report should be publicly accessible. Also I wouldn't mind a general ban on using personal data for marketing purposes, I don't know a scenario where this would be necessary and beneficial for the user.

Right now companies just keep doing what they always did and hope for the best. As long as they're convinced they can just try not to get too much attention this data sharing problem will persist with barely a dent.

Most of these data consent forms are purposefully complicated so that many opt in to all to save time. The “advanced options” menu even loads suspiciously slowly at times.

It should be required by law that there be a simple to access “opt out to everything” option that should be as easy to access as an “opt in to everything” option.

Also, I would not be opposed if some browser standard were developed under governmental oversight that sends a blanket “opt out to everything” that websites would be required to respect by law.

> It should be required by law that there be a simple to access “opt out to everything” option that should be as easy to access as an “opt in to everything” option.

It arguably is already required with the language of article 7.2 and recital 32, especially this part

> If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

But we will see how it gets interpreted as more cases works their way through the system.

Yes, that is very arguable.

The phrasing “The-opt-out-to-everything option must be as easily accessible as the opt-in-to-everything option.” is far less arguable and hiding one behind a further menu, but one not, is a clear violation of this rule.

> Edit: And worst of all is this very confusing pattern with two columns of toggle buttons, one of which concerns "legitimate interest": https://toot.cafe/@peter/105367185171860458

That's pretty awful, how are you even supposed to interpret that? I'm guessing it's something like "first || !second", because that would be the sleaziest.

I think the left column is the "legitimate interest" version of the cookie type, and the right column the "consent" version (whatever that means). So you can enable and disable either independently, but the former is enabled by default.

My biggest bugbear with these multi-modals is that much of the time the buttons that turn consent on or off are not labelled. You're supposed to guess from their colour and default position what is on and what is off, so when I make a choice I never know for sure how the website interpreted my choice.

Some have an "accept all" button that could perhaps reveal which is "on" and which is "off", since when you press it all the buttons go to "on". But this happens so quickly and the modal is closed immediately afterwards, that there's no time to tell. And of course by then you've already accepted so it doesn't matter.

I've seen this also in a separate tab: https://twitter.com/dmitriid/status/1347577262682607616

I've also had "legitimate interest" used as a catch-all reply when you raise any concerns internally.

It reminds me of "reasonable" wording in English law.

Most of those are now off by default, as it should be, except that if you scroll down you still see a number of "legitimate interest" ones enabled, even though you can turn them off manually.

Taking a page from the RealNetworks playbook from twenty years ago, I see. Put the shit you don't care about up top and unchecked, keeping the interesting stuff checked but below the fold.

I have met few websites where you cannot uncheck the "legitimate interest" fields.

That is how it should be. Legitimate interest means they don't need your consent. They actually shouldn't be prompting for it at all. Adding it to the consent box is a kind of cargo culting going on.

This is a great example, that I intend to hang on to. I've run into a few people online with some severe willful ignorance about the GDPR. The worst was somebody arguing that since targeted advertising was their business model, that in itself constituted a "legitimate interest". So, pretty much exactly the sort of thing that GDPR forbids.

Reply on news.ycombinator.com