Hacker News Reader

Comment by pixelpoet | Hacker News Reader

What absolutely infuriates me is this "legitimate interest" crap that is almost always hidden away, and often you have to scroll through literally hundreds of opt-outs with no way to disable them all in a single click.

If I'm so damn "legimately interested", why is it on by default and basically impossible to turn off? Find me one person on this earth who is legitimately interested in being tracked by marketing companies who sell their information on to whatever giant collections. This should be illegal.

View on HN

While I agree it's often bullshit, "legitimate interest" is not trying to argue it to be your interest, but the sites.

It's usually a good hint that it really isn't a legitimate intrest case if they allow you to turn it off.

A legitimate intrest does not require an opt in (or an opt out). Consent does. If the page mixes those two up they're either clueless or trying to walk in the gray area and don't really understand(or don't want to understand) what either of those terms mean.

Legitimate Interest has a legal definition as a Legal Basis. It's a list of Purposes and Special Features that a Vendor declares to the IAB that they claim to need [0]. A User absoultely has the right to Object to Consent and Legitimate Interest.

Any CMP that does not allow you to opt-out is on shaky GDPR legal ground.

[0] https://vendor-list.consensu.org/v2/vendor-list.json (see 'vendors' object)

What's an IAB or CMP?

Internet Advertising Bureau, Consent Management Platform

"legitimate interest" is a legal term with specific definitions in the GDPR. (And indeed it refers to the interest of the site, not yours)

IANAL, but as I understand, it refers to data collection that is inherently needed to perform a service.

E.g., a pizza delivery service has a legitimate interest to know the address of the place where it should deliver the pizza to - because, well, otherwise they can't deliver the pizza.

In such a case, the GDPR wouldn't require the pizza place to get consent. (the GDPR requires that a service is performed even if consent is denied, so without the legitimate interest exception, the pizza place could end up in a legal catch-22 if someone ordered a pizza but denied consent to collect the address.)

The basic idea seems perfectly reasonable to me, but of course sites always tried to stretch the "legitimate interest" definition as wide as they could get away with, and this seems to be the latest iteration of that.

I have no idea where the latest fad of claiming all kinds of ridiculous things as legitimate interest as long as there is an "object" button comes from, but I imagine there was some court case that decided this was borderline legal. If anyone else knows more about this, I'd really like to know as well.

But at least I think this is why many consent popups ask the exact same questions twice, once as "consent", off by default and once as "legitimate interest", on by default: They are simply trying their luck on two separate legal avenues. (Not that this would make any sense from a UX point of view or from the intent of the law. But I guess it does make sense from a "scummy lawyer" point of view)

> because, well, otherwise they can't deliver the pizza.

This is covered by one of the five other GDPR principles for lawfully processing data ("to fulfil contractual obligations..."), so it wouldn't be considered a legitimate interest.

An example of legitimate interest would be the Pizza Place keeping your address on their phone system, so that when you call from the same number on a future date, they can confirm your address without having to ask for it again.

It can also be for advertising. It's very unclear where the line is: of course Facebook has an interest in tracking you, it legitimately makes them money. Afaik that's what this purpose is for. But it should also be weighed how reasonable versus invasive it is. The data protection authorities are clear on how they see it (namely as mostly a dummy clause that rarely lets you do anything) but it has yet to be seen how this holds up in court.

The attitude of the UK's ICO seems to be quite lax - it gives as an example "you do not want to give the individual full upfront control (ie consent)" with the implication that if you don't want to ask for consent, it's a legitimate interest.

I expect the first point of divergence between UK GDPR and EU GDPR might be here (since they are now separate), in how 'legitimate interest' is interpreted in the law.

"Find me one person on this earth who is legitimately interested in being tracked by marketing companies who sell their information on to whatever giant collections"

Sure. I'm legitimately interested in that.

I prefer being marketed to by people who have a good idea about what I would like, rather than getting phone calls at dinner time from people trying to refinance my non-existent mortgage.

And no, I'm not scared about Google knowing details about my life. If a dangerous entity such as a rogue government wants to do me harm, they will be able to find out whatever they want about me whether or not I use a 'secure' browser and search engine.

As the paper states, the GDPR is comically unenforced. I doubt these 'legitimate interest' cookies are compliant with the law. In practical terms, they don't need to be. Nothing happens to websites that break the rules.

> The processing must be necessary.

https://ico.org.uk/for-organisations/guide-to-data-protectio...

Reply on news.ycombinator.com