Did we consider that if everyone is breaking the law, the law itself might need a rework?
It is just that most websites don’t comply and developers misunderstand it.
You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality.
You can not use them to track users on third party sites, or store personally identifiable info without explicit consent, and in that case, denying consent should be as easy, and not affect other functionality, such as blocking content.
I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.
Same with sharing personal data - maybe not a bad parallel :)
I'll default to skepticism but keep my mind open to proposals that are concrete and specific.
If you were able to sue for GDPR violations, either on your own or in a class lawsuit, you would have an incentive to prove that the violation has indeed occurred. As long as your lawyer was working on commission, they would share that incentive.
As it stands, all you can do is file a complaint with your GDPR office and hope it makes a difference. You don't get any money from that, so hiring a lawyer to get such a complaint right is an expense you will not get reimbursed for. More importantly, the person investigating your complaint is probably on a salary, not a commission, so they don't personally care about how successful they are.
Compare that to the ADA[1], for example, where you literally get legal firms looking for disabled Americans, finding places that don't comply with the law and suing them. Enforcement was partially privatized, and the free market, as it often does, found a better and more efficient way of enforcing the law than the government could dream of.
I'm not a fan of this. You're replacing one kind of dark-pattern wielding, stain-on-underpants-of-society, predator with another!
You will spawn industries of failed lawyers going after the easy money, i.e. clueless everyday people who inadvertently misconfigured wordpress and can't afford a lawyer when they get threatened with court cases if they don't pay the extortion fees.
Just like asshole copyright lawyers under Germany's shitty jurisdiction extending their disgusting and threatening attacks on everyday citizens around Europe who dare to have a personal webpage without being experts in copyright law. As with ad-tech, also not the kind of enterprises we need to have in our society. Also wouldn't shed a tear for that industry to just die.
If you do this kind of thing you need to directly target the companies enabling the illegal behavior, not the website owners.
Article 79 explicitly gives data subjects "the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation"
Article 82 states that if someone has "suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered".
Then maybe the law needs some adjusting to make compliance more manageable.
maybe developers beed some adjusting to make compliance numbers higher.
This is why we need a law that people actually fear to the point where they would rather switch off the lights and take down the sign, than try to put up an off the shelf cookie wall that can be configured to have an "Accept all" button.
The consent provision ruins everything. The fact of its existence reframes otherwise unlawful processing as "you need to get consent" instead of "you shouldn't be doing this", which is how it should be framed. It turns the whole regulation into a farce, restricting data processing to necessary uses except if you have the ability to document and semi-coerce consent (subtly enough to not invalidate the content you've obtained, but empirically that's clearly not closely examined).
And lo, a parasite industry dedicated to coercing and documenting "consent"!
†Just talking article 6 here, I don't really want to get into the weeds of chapter 3.
Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?
Edit: by law I mean the GDPR.
Edit2: Get rid of the "cookie banner law" entirely, actually make it illegal, but require easily found links to privacy statement
This made me think of the Ukraine war, and how the sanctions may turn out to be a bigger help to climate crisis than any political entity could muster on the basis of the impeding climate snafu. Sometimes radical action is the right course of action; for democracy-(pre)serving reasons our governance systems often inhibit change unless most of the population is rallied around a specific cause as we see with Ukraine. That is the time for radical change to happen, or democracies would never progress. End of sidetrack :)
EDIT: I mean, Strong agree with "Necessary site functionality, without the spyware. ", but disagree with last part
I read an interesting article (from the mid 2000s? Will update if I can find it) arguing that microtransactions will never work due to the cognitive burden of paying for hundreds (or thousands!) of tiny things a day.
Brave's BAT seems to solve this part of the problem by automating the payments based on how much time the user spends on each site. It would require everyone to switch to Brave and use their crypto thing to make it work, so it's obviously "suboptimal".
I think that largely, the website economy is based around advertising. I honestly doubt the advertising-centered business model would disappear even if large-scale tracking did. Would it be less targeted and less efficient on a micro-level - yes probably.
But less abusive advertising would also have upsides for website owners: Privacy conscious people are increasingly blocking all ads, losing them eyeballs. Privacy friendly ads may be given a pass.
Right now it's mostly impossible for privacy-conscious people to support a website the like by looking at their ads. The adtech industry is to blame for this for data-raping people. Website owners would benefit from a sustainable advertising model, where users don't have to make the choice between not contributing financially, vs sacrificing their privacy to data leeches. All the websites crying over ad-blockers would instead be forced to use legal ad networks that don't rely on illegal tracking, and people might again be willing to look at ads for content.
Brave is an interesting take, but I think the more optimal solution is to just ban the practice of tracking and shadow-profile building. Problem solved, and I don't need to encourage people to install ad-blockers anymore.
I remember reading not too long ago that tracking did not increase profits! I find that hard to believe because once the tracking gets good enough, they actually start showing me ads for things I actually might want to buy! (Imagine that!) In my experience, Facebook's ads (at least on Instagram) show me really cool things, while Google (who should know way more about me) shows me complete garbage on all its platforms (YouTube being worst of all).
Re: less abusive advertising
I'm considering making some (hopefully!) profitable web games but I'm averse to putting ads on them. After giving it some thought I realized my main objection wasn't aesthetics / UX (though that is certainly a concern when it comes to "art" -- I want my games to be beautiful and ads sort of kill the vibe there) -- my main concern was actually running strange 3rd party fingerprinting / zombie-tracker / god-knows-what. If it was just a clearly labeled affiliate link, eg. <a><img>, that would do away with most of my concerns! (And simplify my GDPR compliance by just.. not storing anything.. and eliminate the need for those horrible banners :)
In general I'm averse to government regulations, but this might be a rare case where the alternative (rampant spying) is worse... After that, all that remains is to get the governments to ban themselves from spying too ;)
Exactly - i briefly looked into https://www.ethicalads.io/ but mostly IT related ads it seems.
> Facebook's ads (at least on Instagram) show me really cool things, while Google (who should know way more about me) shows me complete garbage
I personally remember being pretty shocked at how the Facebook like button & social login spread to everywhere and they could track you all around. Long time ago. Facebook probably knows a lot more about you than you think.
Huh? Here in germany there is talk by politicians that climate policies have to stand back now and we need to rely more on the coal plants and not close them, as it was planned.
I really hope, that the actual solutions will be more renewables and nuclear, but I am a bit pessimistic about it.
But for medium-term, a lot of infrastructure investment will be needed. Times are such that the public will be quick to condemn investment in fossil energy, so there will be pressure to find green solutions where feasible.
The other day I saw a headline that France had stopped subsidizing gas heating installations. I don't get why it took a Russian war to do that, but apparently it did.
There have been many other such headlines. Will it matter? Probably some, maybe a lot... one can hope.
Edit: or maybe the opposite. who knows
This means, that be default, I don't need any cookies, because I don't want to log in to most websites I visit. Only if I want to log in, I have need for such cookies.
There are many businesses trying to be compliant whilst maintaining access to metrics their business depends on.
Compliance is very difficult at this time as the legal advice is shifting in different territories and there is conflicting guidance when you start to dig into it.
Id rather see a selection of activities and tactics entirely banned/regulated rather than this directive which is clearly too open to interpretation.
In this case it's even simpler since a software company would like be able to develop a new product with hopefully more value to society than the vast majority of data collecting companies provide. I'm also not too afraid for tech workers being able to find other jobs, although I'm sorry for any other collateral damage.
No, if you show a cookie banner your users do not opt-in. So a cookie banner is pointless since it doesn't actually give you permission to store cookies you couldn't store before. So we already have the law, we just don't enforce it.
My thinking goes like this:
1. The law explicitly talks of requesting consent.
2. Incentives will drive actors to request additional permissions if possible (you always get some legal, can claim ignorance, etc)
3. People get constant intrusions wasting our collective time and attention on an enormous scale.
The current law is encouraging this type of user-hostile behavior. This is stating an objective fact, since the current situation is clearly a result of the current law.
If any type of consent-banner or opt-in method is allowed, industry groups will lobby for loopholes they can use to trick users using whatever mechanism the law leaves at their disposal.
Just outright ban the use of cross-site tracking and user profiling. We don't have a societal need for this to be legal.
Other examples of where cross-site tracking is useful is for preventing online payments fraud. You have a similar IRL version of this where your bank will freeze your card if it sees purchases being made in different countries simultaneously.
Somewhere along the line, counting views or helping reduce fraud for customers turned into “store full demographic information about someone who never signed up for our service”, which is where everything went wrong in my mind. The cookies themselves aren’t the problem, it’s how they’re being used.
Sure, and I don't remember if this is currently legal without need to notify/ask, but I think it should be.
As long as the tracking data is legally and technically isolated to only domains/apps/devices controlled by the same entity... Most people have the expectation that a website/business will be able to remember them across visits from the same browser.
But people will not necessarily have this expectation of being recognized across domains or different devices - indeed most people won't know it's even possible - so anything facilitating such identify/profile correlation should be considered illegal tracking by default. The specific technical method of creating the correlation should not matter. Honestly this could extend to non-web profile building as well.
The exception, of course, is if the user has self-identified by logging in.
> Other examples of where cross-site tracking is useful is for preventing online payments fraud. You have a similar IRL version of this where your bank will freeze your card if it sees purchases being made in different countries simultaneously.
True, completely agree. There are already blanket exemptions for certain uses in the GDPR and those should be extended as needed for use cases that have legitimate value. Cookie law should be changed so no need to ask/inform the user about these use cases other than in the website's privacy statement, where such tracking should be stated.
Industries handling such tracking data should be regulated and audited to ensure proper handling and use of the data. Again I think this should be applied as a broader principle, and I think for example loyalty programs should be also audited to ensure compliance with legal uses of the collected data.
Could you give some examples please? I checked all the government websites I could think of and didn't see any.
https://european-union.europa.eu/
https://www.securite-sociale.fr/
4 out of 4 in my case. May I ask which ones you checked, I'm genuinely curious, cause I really don't remember seeing any official website in the EU without cookie banner in many years.
The other two are trickier to judge, but contain (user?) identifiers, which could certainly be used for tracking, so I'll have to concede your point.
Edit: I had to recheck some of the sites I'd previously checked, as your examples helped me realize that my browser does a lot of blocking. It turns out that just one of my examples was actually a good one: https://finlex.fi/en/
Edit2: Found others: https://www.suomi.fi/frontpage and https://vnk.fi/en/frontpage
Both actually do set cookies, but apparently nothing requiring consent.
I think the default is that most people, professionals included, don't understand the law and throw in the banner-spam to be on the safe side or because of outdated checklists.
I have zero problem with (edit: first-party) cookies, only with the web being a horrible UX for 95% of people, so hope more official websites can lead the way, so that pop-ups can slowly be de-normalized in peoples minds.
Edit:
Nice find. Also:
https://oikeusministerio.fi/en/frontpage
Can they inform Denmark?
I think GDPR assumed companies would like to do right by their visitors. I guess the only way to do that is to increase the severity of the consequences for violating user trust. GDPR itself offers a guideline that many seem to misunderstand... you don't need a popup for every kind of cookie.
I'm not against enforcing minimal tracking as default, and opting into cookies should be similar to going through a purchase flow... because it is one, just using "data" as a currency. So yes, convince me to click the "Buy cookies" button.
Cookie banners predate the GDPR, most of them are from the "cookie law"[1] that predates it. They're two entirely separate laws that don't supercede each other.
[1] https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
No, GDPR is doing tons of good works.
The whole web is a privacy and security nightmare and we've been tolerating this mess long enough.
Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR.
The reality is that 99% of websites need zero cookies, zero popups and no logging of IP addresses. The ones requiring login can set a login cookie without pestering the user.
The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead people into hating the GDPR.
This problem would be resolved overnight (and everyone's privacy increased by orders of magnitude, since spyware would become illegal again) if those fines actually started coming down.
Internet privacy has been a laissez-faire dystopian wasteland for decades.
Even with the current very gentle enforcement, GDPR has received a lot of push back and called draconian (by those who benefit from corporate surveillance).
Yeah, but it's hard to enforce a law at scale when the difference between legal and illegal behavior is not obvious to a layperson. The law is too technical.
It also has shouldn't have options where a user can simply allow further data collection, since this makes it hard clearly say whether a certain practice is legal or not, since it "will depend".
This creates more friction to enforcement. If things were more clear-cut, enforcement could be automated, and you would probably see those fines roll out.
It is harder to say "this software library is illegal to use in the EU" if there are certain circumstances where it's not.
GDPR and cookie law is not hard to understand, so that excuse is a little bit lame to be honest. Besides, if you really need to understand what you must do by law, you should hire a lawyer. That's the same as with any other law.
What I meant to say was that pressure to enforce laws only happen if there is public pressure to see the law implemented, and when the concepts are too abstract/intangible, the public disengages more easily from the issue.
Political will for improvements and funding is more likely to happen with more public support as counter to the influence of industry lobbists.
Public support is easier to rally when people can personally relate, or ideally share a pain point. A good candidate would be the annoying pop-up boxes. Frame them as dangerous because increasing the risk of online data and identity leaks. Solution to this threat to public security is to eliminate them by default answer. Simple law proposal.
And no, privacy actually is improving.
And enforcement is ramping up.
We still have a way to go, but we're moving in the right direction.
The law is fine, the enforcement is not. If the enforcement had any teeth, then people wouldn't be breaking it. So long as managers try to get away with dark patterns rather than just take their business off the internet, the penalties are clearly not stiff enough. But I'm fine with this taking a few years to get in place. It's better to ramp up penalties once the law has matured a bit, than to have the kind of business-ending penalties I'd like to see, for a very new law.
Three years later, randomly enforced and generally ignored: should GDPR-for-anonymous-browsing be regarded as obsolete by the EU's courts?