> Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law..
Because the law obviously didn't help stopping companies from doing shady shit and made the user experience of the web worse?
Because the law obviously didn't help stopping companies from doing shady shit and made the user experience of the web worse?
The user experience is made shit by the companies doing shady things. If they didn't do shady shit, they wouldn't have to display any banner.
I'd rather be informed, at least I can make a decision that way.
Why shoot the messenger?
The part that is missing is making rejecting as easy as accepting. So far there are a lot of dark patterns, but there are sites that make it very clear and easy, and I appreciate it.
The law could have been much better if it simply asked browser makers to provide a single place to configure your preference, and then forced companies to abide by that setting.
The problem is that Google Analytics isn't _just_ collecting data for you, it's collecting a trove of other data that it's using to track and link users accross other websites.
Just because it's free and somewhat nice looking, doesn't mean it isn't shady shit. Maybe all you care about is counting unique visitors, but by doing that with Google Analytics, you're exposing your visitors to a complex surveillance product that collects data for its own purposes, and it sees much more than what's needed to just count unique visits.
It has a wider lifecycle: "this is YOUR data, and we collect, maintain, process, sell these data to a myriad other sources for a myriad other purposes". GA just feeds these monsters.
Most GA users just don't care about their clients/readers privacy. Or they care 'a little' but they care 'a lot more' in monetizing.
We externalize the costs, or find shady revenue streams. As long as people think "it's free therefore it is good and I like it" we are not progressing.
I would love to have a technical solution for browser-wide consent management, but it wouldn’t solve the issue of granular, informed consent for all the shady things that are possible in adtech.
Also, the law certainly doesn’t prohibit a technical solution, but that really is something that the industry should work out.
Truly open culture does not accept tracking, for example there is no way to count Linux users. And people would not be kin to those who track physical news papers.
Meanwhile I use uMatrix and uBlock Origin.
What happened was entirely predictable to anyone who understands how the market works: there were some volunteers who honored DNT while it was opt-in, but that mostly ended when one of the browsers decided to make sending DNT enabled by default.
The industry wasn't, isn't, and is never going to self-regulate itself out of a significant revenue stream. That's why we ended up with GDPR - a proper solution with legal backing - which almost works. It would be working, if EU member states were more eager to pursue violations and issue fines.
The purpose of the tracking matters, though. Truly open culture also doesn't attempt fraud, DoS attacks, data breaches, and all the other nasty things that some people who are hoping not to get caught and punished do online. Unless you can prevent all such threats, it's unreasonable to expect websites whose operators might be held responsible for the consequences not to monitor how their own systems are being used and who is using them.
The fact that a question can be phrased like this really illuminates how much society has changed in 20 years.
Not so long ago sharing data between sites was definitively shady. Then Google somehow institutionalized it, and now it is completely mainstream.
> I would think counting unique visitors is a legitimate business interest
Yes, that's not it. Identifying people are, and collecting their personal data is.
Setting a cookie is not in itself a GDPR violation. Collecting personally identifiable information is. You can collect unique visitors by setting a cookie but without collecting personally identifiable information, so no consent popup would be required for that:
1. Set a "site last visited: <date>, <serial-of-the-day>" cookie if it is not set.
2. Count hits as appropriate by examining the cookie - without collecting IP addresses.
Since no personally identifiable information is being collected with this scheme, consent is not required.
The cookie stuff, yes, it's annoying for us end users. I get it.
But take how H&M were fined for violating the privacy of their employees. That they had to stop doing that is a Good Thing, right?
GDPR is a highly complex piece of legislation that is very hard to navigate and therefore only established companies with big bucks to spend on lawyers and extra engineering can profit from the ecosystem while everybody else is put at risk.
Complex legislation and regulations is the best way to keep monopolies in place. Same goes for the financial sector, telecoms, etc. It's nearly impossible for new players to emerge.
This complex frameworks are put it place so that big companies that do nasty things can get away with it because they will be able to demonstrate that they have complied with the regulations while emerging players will break their teeth on it.
Instead of regulating _how_ data collection and processing should be done, we should penalise _what_ is done with the data in simple clear terms, and make _people_ (CEOs, etc.) responsible not just giving fines to companies. Basically, reintroduce skin in the game.
If anything, it was the big players getting work to do. Thousands of people on mailing lists with no control of how they got there. Asked and kept insane amounts of not necessary data. Data floating in hundreds of database tables spread over various services and third party vendors and data centers with no control. Cleaning up that was a huge job.
Of course, they are unlikely to come after a startup for an infringement like that, but the point is that they could if they wanted to.
I highly doubt you as a non shady actor will be punished because of your server logs as such.
Start selling or otherwise sharing them with ad companies, directly or indirectly and you deserve and should expect a GDPR fine as soon as they can if you are in a jurisdiction where GDPR applies.
Same if you involuntary leak data because of gross negligence: passwords in cleartext, unnecessary data collected and stored and later leaked etc etc
In many cases I understand authorities will even contact companies first and try to guide them toward a compliant solution first instead of fining tjem right away.
That said I wish there were some clarifications given wrt to server logs and IP addresses; running without is in many cases gross negligence in itself.
Basic logging is first year defense against black arts curriculum.
If you were storing IP addresses to track and market to users, you need consent.
If you’re using them for logging and security purposes, I think that falls under legitimate interest.
My point is: it's really not that easy. It should be easy to get clear guidance on something straightforward like this, and not have to resort to Stack overflow answers.
Where and how was that established? There are obvious operational and security reasons why the operator of a website might reasonably log access information, and there are lawful bases for processing data under the GDPR other than having the subject's explicit consent.
I can see how it’s a though pill to swallow that that was exactly the point.
Clearly we're not going to ask for consent to track someone who is systematically probing our site for vulnerabilities, or someone who is attempting to use us to validate presumably stolen credit card details, or a group who are obviously sharing a password to gain unauthorised access in violation of our terms of service.
Also, the purpose(s) of data processing matter, not just the data itself. It's not as simple as only gathering what you need. You also have to ensure that what you gather is used appropriately, and that you have the means to respond to the various rights that subjects have by law.
Thousands of people on mailing lists with no control of how they got there.
Actually, that was one of the tricky areas when the GDPR came in, and something almost no-one got right despite good intentions. Specifically, the widely accepted best practice for managing a mailing list had long been to use double opt-in, thus verifying that the subscriber really did intend to receive the messages, and to provide a simple, automated unsubscribe facility. However, unless you had kept all the confirmation replies, under the GDPR you might not have met the required standard for evidence of each list subscriber actively opting in to receive your mails.
That led to a wave of messages being sent out to mailing lists asking subscribers to confirm they still wanted to receive the mails. This was particularly ironic because if those subscribers hadn't already intended to consent then those messages were probably themselves in violation of existing law in much of the EU even before the GDPR came in. The difference was that before, no-one was seriously worried that a legitimately operated mailing list with double opt-in was going to be targetted for business-crippling penalties, but with all the ambiguity around the GDPR and the uncertainty around how it was going to be enforced, a lot of people panicked.
[] keep me informed about products
checkbox hidden somewhere in a purchase form, often pre-checked even though that's illegal. Recently I was somehow added to the mailing list of a car dealership after getting my car checked up there, and can't even unsubscribe without creating an account on their website.
I'm sure there are some legitimate mailing lists out there, but there are so many others that are scummy and in flagrant violation of the law. It's hard to shake the feeling that making things harder for mailing lists in general is going to be a net win for consumers.
More recently, it's more about web forms and hosted services and so on, but typically you can't add subscribers on popular mailing list management services without either having the service run that kind of double opt-in check automatically or going through some kind of alternative process that involves explicitly confirming to the service that you have the required consent from somewhere else when adding the addresses directly.
There are loads of legitimate mailing lists, and the software and services running them have worked reasonably for decades, you just apparently haven't come across them. Not that I disagree with you that there are plenty of scummy ones as well, sadly.
It helped immensely. I work in the financial sector in an EU country, and most institutions in my country are terrified about the GDPR.
The fact that some people will happily operate on the border or even closely beyond the border of law, applies to any other regulation as well.
Running a website without a popup is easy. Just stop any processing that is not necessary for you to provide the service.
"But I want to track what users are doing!" - Well, then you have to show them a popup about that.
The GDPR holds that data protection is a fundamental right. Consequently, the user's interests generally trump a website owner's interest.
I think most website owners don't care about that, but they do care about earning money to actually run the website.
>The GDPR holds that data protection is a fundamental right.
The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay for it or not. You cannot not show content to users who refuse to share the data. Effectively, everyone else has to subsidize them.
And that's why you have a labyrinth of pop ups - GDPR breaks the normal monetization methods of the web. Suddenly they're surprised that this led to dark patterns.
Again -- the GDPR recognizes the right to data as a a fundamental right, and thus the ability to earn money with a website comes second to user's rights.
Argumenting against this is a bit like Big Tobacco complaining that they're not allowed to sell cigarettes to children.
> The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay for it or not. You cannot not show content to users who refuse to share the data. Effectively, everyone else has to subsidize them.
Sure you can. All you have to do is offer two models: (a) a model where the user pays for the service, and (b) a model were the user receives the service in exchange for a agreeing to tracking etc.
In the case above, a newspaper offered access to paywalled content for a small monthly subscription fee, and readers would consume it with zero ads, zero tracking.
Alternatively, they offered access with no monetary cost, but instead in exchange for tracking.
The DPA ruled this as fair because readers had a choice, and because the paid model was reasonable for a newspaper subscription (€6/month).
The key here is that starting with alternative (a) makes it a paywalled service, which is clearly legal (think Netflix). Also offering (b) just offers another mode of payment.
You wrote earlier: "GDPR breaks the normal monetization methods of the web." Well, smoking regulation broke (some of the) monetization methods of Big Tobacco.
Arguing against the GDPR here is besides the point. The GDPR is not an end, it is a means. The end is recognition of right to data as a fundamental right.
Re-writing your statement in light of this, the point becomes "Data as a fundamental right breaks the normal monetization methods of the web." Opinions will differ here.
You say normal. Others say pernicious.
And if every alternative charges money, then that means you're shutting out a large portion of people. For example, I can't pay for anything online right now. It doesn't matter whether it costs $5 or just a single cent - I have no way to pay. It'll be sorted eventually, but even then paying for anything online for me will be a 5-10 minute process. Not exactly something I'm willing to do for almost anything. And a lot of people in the world are in a similar position - credit cards aren't as accessible in most of the world compared to the US. If services like paypal don't accept bank transfers from your country, then they don't help either.