Forbes does this, too. It was the first site I noticed it on, years ago at this point. I don't know how it's not illegal.
You could argue that the artificial delay is implemented as a way to dissuade people from declining which would fail the idea that data processing consent should be freely given (you can’t force people to opt-in).
You could also argue that even if there was a legitimate technical reason for the delay then it wouldn't be compliant because it would prove that data processing is enabled by default before the user opts-in (otherwise the delay should be on opt-in and opt-out should be instant as it's essentially a no-op).
Here are the ICO’s guidelines on the subject - you’ll see that this TrustArc trash fails on multiple points: https://ico.org.uk/for-organisations/guide-to-data-protectio...
TrustArc essentially provides "breaching the GDPR as a service" and their continued existence proves the incompetence of the data/privacy regulators in all EU countries.
Or maybe it shows that they are underfunded relative to the task set them. Which is actually true of many government departments.
I suppose the counter-argument would be that passing legislation is cheap, but enforcing it costs money, and governments have other priorities, but, for example, in the UK there can be fines of up to £500,000 for breaches of the e-Privacy Directive[0], which should be more than enough to cover the cost of the investigation.
[0] https://www.pinsentmasons.com/out-law/news/gdpr-e-privacy-br...
Surely there is a way to get this "machine" started and use the money from previous fines to fund future enforcement?
I don't want to live in a world where the criminalization of everything that ever happened that you didn't like means that I'm always breaking the law.
How many people not liking gaslighting personal-data-theft dark patterns will it take to make it into a law?
We're transitioning from purely physical beings to having a more virtual presence. Virtual crimes are much less visible and have much greater impact at scale than their physical counterparts, identity theft by Equifax breach or a hack, VS physical force or pickpocketing, for example.
The impact of violating privacy is neither increased nor decreased by the impact of theft and/or murder. If we compare theft and murder, theft «in general» is less impactful than murder, as I'm deprived of property and potentially physically injured with theft, with murder I am deprived of life itself.
That murder is generally more impactful doesn't make theft more acceptable/less bad; we should have laws for both.
On the flip side, this particular dark pattern was caused by regulation. As usual, shades of gray
Regulation is a possible cure.
Call me crazy, but if some place would be weary of going straight up for the “let’s ban things with lawyers ” approach, I would think is HN.
You'll be fine as long as you're not in the habit of doing things like this that are clearly outwardly hostile to everyone you come into contact with.