Hacker News Reader

Comment by rendall | Hacker News Reader

> "Privacy & Cookies: We and our 772 advertising partners store and/or access information on your device and also process personal data, like unique identifiers, browsing activity, and other standard information sent by your device including your IP address..."

There is no opt-out, which violates GDPR. If my data was collected on landing, I would like my data removed, please.

View on HN

Just click on "disagree to all", no ?

At the time i wrote that, I did not understand that was behind the "learn more" button. However, if their data retention policy is accurate, even clicking "disagree to all" means they will retain data that individually identifies their users and they exchange this data with other brokers. This is strictly against the letter and spirit of the GDPR, opening them up to the possibility of massive fines.

Have you contacted the owners of the website to get your data removed?

And give them more personal information?

I assumed OP was the website owner. But while my request is serious and legally binding, it was somewhat rhetorical as I do not expect the owners of a site with such a data policy would really be conscientious about contacting me to sort out which data is mine and removing it.

> But while my request is serious and legally binding, [...]

Posting a comment on HN is somehow legally binding for a third party website whose operator likely never even heard of HN? Or what are you trying to say?

As I understand it, the request to have data removed is what's legally binding, not the format in which the user makes the request. If the site owners see it or otherwise become aware of it, they are obligated to remove my data even though it was a post on HN. Whether all of that actually happens is a different story. They could probably claim truthfully they don't know which data is mine. If I were determined, I'd contact them directly.

Don't be absurd. I'm a big proponent of GDPR but you seem to be under the impression that it's a magic spell. You seriously believe that, legally, if you post a comment on HN, you're putting an obligation on someone? I have a piece of the moon to sell you, then!

That is a misapprehension of what I wrote.

Also, I threw that in there because, if the site operators were to see "I don't expect them to actually remove my data", I do not want them to interpret that as releasing them from the obligation. It does not. It's just my prediction of how things will go.

Yes, there is an opt out, see the fourth sentence: * Otherwise, you can get more information, customize your consent preferences, or decline consent by selecting "Learn More".*

It's a dark pattern to only call it "Learn More", but I wouldn't bet it's a GDPR violation.

Thanks for the tip.

The opt out is supposed to be as easy as the opt in, so I'd bet it crosses the line.

Edit: furthermore, even after opting out, you nevertheless "agree" that (that is to say, you cannot opt out of):

  Certain information (like an IP address or device capabilities) is used to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device.

  Match and combine data from other data sources

  Link different devices

  Identify devices based on information transmitted automatically

The first of those is surely a valid technical requirement, right? (I'm not a GDPR expert, by any means.)

In order to send you bits via IP, the server needs your IP address. In order to know the type of bits to send, it needs to understand the content-type, encoding, etc that your device supports.

From what I understand, GDPR applies only to retention of data, and not such technical requirements. It does not require operators to inform users unless the server will be retaining the IP address.

In any distributed system, what "retention" means is unclear* and, in the face of that lack of clarity, a company deciding to play it safe and require consent for things that GDPR says needs consent seems reasonable.

* If I put your content-type and IP address onto a queue for processing by another system, that's arguably retaining the data, even if that length of retention is typically measured in seconds. Given that, the safest thing for me to do is to require your consent for the retention of IP address and related data.

I suppose? The GDPR is very clear: if you serve European residents, you cannot collect their identifiable data without their informed consent, nor can you make consent the price of viewing your content. If you are found to do so, you are liable to huge fines.

The language of the law itself is not very far from that clarity. Check it out for yourself: https://commission.europa.eu/law/law-topic/data-protection/d...

I find it not credible that a company would read that second part, think "My goodness that sounds awful! Out of an abundance of caution, we better include language around arcane technical edge cases!" but then go on to violate the very, very clearly stated core intent of the law regarding consent and actual data retention and brokering.

So... it is confusing. Probably intentionally so. Perhaps their legal strategy would be to somehow conflate these edge cases? Try to baffle judges?

> The EDPB adopted Guidelines on dark patterns in social media platform interfaces[2]. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.[1]

There calling it "deceptive design patterns". In short, tricking people is not consent.

[1] - https://edpb.europa.eu/news/news/2022/edpb-adopts-guidelines...

[2] - https://edpb.europa.eu/system/files/2023-02/edpb_03-2022_gui...

Reply on news.ycombinator.com