Hacker News Reader

Comment by christkv | Hacker News Reader

There should be zero negotiation between the EU and the tech giants when it comes to privacy from my perspective.

There should be a no track law that disallows any company to hold private data without an explicit direct customer relationship. Data would have to deleted completely at end of any business relationship with a short grace period.

There should also be a digital fast track process to report and receive damages when companies are fast tracked with similar legal penalties to illegally harboring medical information.

The acceptance of data trading should end yesterday.

View on HN

Yes and:

Laws must be technically possible to implement.

Sadly, the USA has gutted scientific and technical review. Which makes policy makers more dependent on industry funded think tanks and lobbyists.

https://en.wikipedia.org/wiki/Office_of_Science_and_Technolo...

https://en.wikipedia.org/wiki/Office_of_Technology_Assessmen...

I think consulting tech companies should be something they need to do, otherwise we end up with crap like that cookie banner.

Why can't they just hire expert advisors themselves? That way they don't need to consult companies who have conflicts of interest.

Imagine the number of ex-bigcorp applicants for those positions that coincidentally left their previous employee on exactly the date the job offers went up ;)

Just exclude anyone with any relation to corporations.

Filling corruption-sensitive positions is a really difficult problem. On one hand it's near impossible to trust the purity of anyone with ties to the opponent, whilst on the other it is precisely and pretty much only those people that have expertise, experience, and inside knowledge that one requires to achieve meaningful success.

Also, if you were chief evil at bigco, wouldn't you keep some people without any backlink around precisely for situations like these?

They do. I know software engineers who work for the government on regulations etc. Then those experts consults with the company experts to talk about what regulations should look like.

That cookie banner is mostly corporations trying to be sneaky and trying to trick people into giving consent, or just flat-out misunderstanding the regulation.

You need no cookie banner if you only use cookies as required by the service you provide to the user.

For instance if a user is trying to log in, you don't need to ask for permission to set a cookie for that. The consent is implicit.

If you want to set tracking cookies on the other hand...

> That cookie banner is mostly corporations trying to be sneaky and trying to trick people into giving consent, or just flat-out misunderstanding the regulation.

If the cookie banner satisfies the regulations and is the path of least resistance, then companies are going to use it.

If the EU doesn’t want the cookie banner everywhere then the regulations need to not allow it.

It is much, much easier to put a banner up than to audit every application and technology used to ensure nothing tracks the user.

> If the cookie banner satisfies the regulations

That's joke though. Most of them don't. And upon getting called out and/or fined, corporations right now just edge a bit further towards an actually compliant implementation - rinse and repeat. Currently we're in the state of "what if we made it really sloooow and convoluted to opt out?" - which is also not compliant because that makes not giving consent harder than giving consent.

At some point we're going to be there, but right now we're not.

The cookie banners as they are implemented right now are mostly wishful thinking by adtech: "Hopefully this will be enough?"

It's not. But nobody wants to be the first to stop widely tracking people and going back to good old contextual ads. They're going to wait until the EU turns the heat up to 100 and maybe even then wait for a competitor to blink first.

Max Schrems' (of the SchremsI and SchremsII court decisions) noyb group is now aiming for sites with non-compliant banners[1], having filed a first round of over 400 GDPR complaints. It will take years before the regulators come up with rulings and those decisions have been litigated, like it usually does, but it's good to see that somebody at least started the process as the regulators themselves have been - as usual - dragging their feet.

[1] https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner...

Regulators are massively understaffed. Except maybe the DPA in Ireland, that office seems to have enough resources to rubber stamp whatever comes their way from outside the EU.

> It is much, much easier to put a banner up than to audit every application and technology used to ensure nothing tracks the user.

It is REQUIRED to audit every application and technology to determine what tracks the user. That isn't negotiable, it's the law: you must know where, when and for what purposes you are handling personal data.

After that audit, you can either show a cookie banner etc, or remove the problem applications/technologies.

https://gdpr-info.eu/art-30-gdpr/

You still need to audit every application and technology so that you can create a cookie banner that lets you disable them, if necessary.

At this point, I don’t think they misunderstand. They try to be sneaky.

Thought experiment: if the cookie consent banner was a payment form, things would be A LOT easier to understand. They are ambiguous on purpose. From a UX perspective, most of them don’t make sense at all.

They make perfect sense as dark patterns.

They should consult organizations that aren't out to invade privacy for monetary gain. For example, EFF.

There's plenty of EFFs out there in Europe. Most of them are country-specific, but they also have an EU-wide... coalition, for the lack of a better word: https://edri.org/about-us/our-network/

The banner is not because of the law, it's because of the sites. You don't have to put that banner: just don't track people.

When you see such banner, don't get angry at the law, get angry at all those websites that are tracking you.

> explicit direct customer relationship

Be careful what you wish for.

Which is better?

Cookies "without consent" (which you can trivially clear with the click of a button, or have the browser clear automatically) every time you visit YouTube or Google search.

Or no YT or Search for you unless you make a Google account tied to your real email (no 10minutemail) and real phone number.

GDPR is privacy snakeoil.

They are way beyond tracking by cookies or account, they just fingerprint your device. And cookie consent questions are better because you can sue them if they still track you with them. It is not only about technology and possibilities but also about laws and rights.

GDPR is leverage.

So then they'll just make signup mandatory and circumvent the legislation that way.

Device fingerprinting is still something you (or the browser vendor) can mitigate.

Mandatory signup doesn't get them rid of the GDPR. You still aren't simply allowed to store data that isn't necessary to deal with your customer or user or the service you are providing.

Reply on news.ycombinator.com