Hacker News Reader

Comment by NelsonMinar | Hacker News Reader

I've noticed when I go to configure my cookies on European sites, most of them default to all the tracking stuff turned off. Is that typical? Is it required by the law? They still do everything they can in the UI to encourage you to "accept all", but there's generally a single button to click to "reject all" and it'd be more work to pick and choose.

View on HN

Yeah, it's a requirement by law, tracking must be disabled unless explicitly allowed. Accepting all must be as easy as denying. However a lot of sites offer an easy one-click accept all and the deny all is behind a two step "configure" + "confirm selection", sometimes even with a fake save timer.

Thanks! I looked for info on this and failed; is there some reference I can share with people about how this part of the law works? Maybe it's not completely obvious, apparently Google had failed to comply with it.

Gdpr article 7 says it should be as easy to withdraw consent as to give it.

The rules are pretty straightforward, really, it's just Google banking on the fines for not doing it correctly would be less than the profit made.

Article 7 is pretty non-specific and does not discuss defaults. Recital 32, however, is quite specific and gives me the answer I was looking for https://gdpr.eu/recital-32-conditions-for-consent/

"Consent should be given by a clear affirmative act ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

Reply on news.ycombinator.com