Hacker News Reader

Comment by ushakov | Hacker News Reader

The most ridiculous are those “legitimate interest” checkboxes, which you have to uncheck manually one by one

And none of which have an actual legitimate interest.

Exactly: legitimate interested is an actual thing, but it doesn't cover > 500 third parties which is what I have found in these boxes (I selected all and processed them in Libre Office or something).

In the last 3 months some "innovative" CMPs have also added the feature to have to click into a more info box per purpose to find the legitimate interest checkbox to untick.

But of course there's a convenient button to accept all of them.

exactly... they should be opt-in and not opt-out

If they're actually legitimate they don't need to ask for consent, they are two separate lawful basis for processing data.

They're not.

The lawful bases for processing data are listed in Article 6. Subject consent is 6(1)(a) and legitimate interest is 6(1)(f).

Consent is used when processing is not required to provide the service, no other basis applies, the processor still wants the data anyway, and the subject agrees. Legitimate interest applies when data isn't needed to provide the service but is necessary for related business functions (like fraud detection) not covered by another basis.

No basis except 6(1)(a) requires the subject's consent because the rest all cover processing required for the service to work.

https://gdpr-info.eu/art-6-gdpr/

===

Edit: I read "They're not" as "the bases aren't separate." On rereading, it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not. I'll leave this up in case it's useful to someone.

> it could also be the interests aren't 6(1)(f) legitimate. Which, agreed, they're usually not.

That was the point. Then to force your users to consent adds insult to injury and is in contravention to the GDPR.

They are (according to GDPR.)

Legitimate interest being opt-out makes sense, for example for fraud prevention. I absolutely agree though that adtech often blatantly claims they would have a legitimate interest, whereas they should ask for (opt-in) consent.

No, it doesn't make sense, because if it would be legitimate interest then they wouldn't have to ask for consent. That's the very point of legitimate interest. You can may that they are being nice, but it's obviously not the case and also would make no sense. You either claim that you are collecting data because it's your legitimate interest or you ask for permission. What they are hiding here is what you say: make some of their cookies opt-out.

They dont need to ask for consent for legitimate interest, that is why they are opt-out (default on) as opposed to the consents which are opt in (default off)

An opt-out for legitimate interest makes no sense. You either need it for a purpose or you don't. A typical legitimate interest is fraud detection. Being able to opt-out of that would defeat the purpose.

they also should not lie about “legitimacy”

It's against the law to do so, [0] but the law is almost never enforced.

[0] https://news.ycombinator.com/item?id=27060609

Reply on news.ycombinator.com