Hacker News Reader

Comment by atoav | Hacker News Reader

No. The law does not allow it.

To quote Article 4(11) – Definition of Consent

> ‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Meaning if you force users into pressing a button or let them scroll through 1000 no options, with one easy yes option, you have not collected their free consent. Congrats you broke the law.

Meaning if you just have them click yes, but not informed them about the harmful data collection you did not collect free consent.

The law is pretty clear on that.

View on HN

I may be missing something, but I don't see how this clearly precludes that behavior.

Which descriptor do you think is unambiguously violated by making it easier to provide consent than withhold it? To my eyes, both 'freely' and 'informed' are plausibly upheld.

It would be very straightforward to specify that consent and withholding must be equally accessible in the interface, instead of splitting hairs about definitions of "freely given". This is what people refer to when they say the law is poorly written

> Which descriptor do you think is unambiguously violated by making it easier to provide consent than withhold it?

> Art 7(3) It shall be as easy to withdraw as to give consent. [0]

But legal interpretation of GP I believe is reaching the consensus that that phrasing too is broken by that implementation:

> Free and informed consent (Art. 7 GDPR): Consent is valid only if it is freely given. When the option to decline is hidden or unnecessarily cumbersome, the user's choice is affected and consent is no longer "free." [1]

[0] https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...

[1] https://www.ictrechtswijzer.be/en/complaint-about-cookies-wi...

Ah appreciated, that is indeed exactly what I was asking about!

Now I'm left wondering why enforcement was supposedly so hard. Seems like shooting fish in a barrel, especially given that some very large websites were in clear violation of this article

Subjective take: Huge amount of small actors, and the big actors have a financial interest in shifting the conversation to blaming the EU for their annoying dark patterns over protecting customers from privacy violations and tracking to the detriment of their financials.

Wouldn't this also mean that if a user was using one of those browser extensions that automatically click "yes" to close the pop, then the site would not have informed consent, and therefore would not be allowed to collect the data?

Yes. Who the hell uses such a browser extension, though? I use an extension, that always clicks no, but why would anyone want to always be tracked?

Be careful with just clicking the big “decline” button. That skips past your opportunity to “object to legitimate interests”¹ in many cases.

--------

[1] Here “legitimate interest” essentially means “we see your preference not to be stalked, but we want to so we are going to make it that bit more faf to opt out, because fuck you and the privacy we lie about caring about”.

And that is breaking the law. The decline button means decline all.

> And that is breaking the law.

Definitely the spirit of it, though some claim not the letter or it due to loopholes.

> The decline button means decline all.

It certainly should, but I never trust it does (with other dark patterns on show I'm all out of benefit-of-the-doubt) and go into to "details" to look for objection toggles. Not that I particularly trust those anyway, but that is a different niggle!

Decline all means decline everything the law says you need consent for. The Google dialog kind of describes it perfectly: "Decline all cookies for this additional purposes".

> Decline all means decline everything the law says you need consent for.

I agree, it should do. But many sites don't consider the “legitimate interest” crap (“we see your preference not to be stalked, but we want to anyway so you'll have to object separately”) to not be something that they have to get consent for, hence the option is to object/not rather than to consent/not. If you hit decline all without objecting to “legitimate interests” [sic], in at least some case, I suspect many, much tracking will still happen.

> The Google dialog kind of describes it perfectly: "Decline all cookies for this additional purposes".

IIRC Google's preferences don't include any legitimate interest gubbins at all, so that isn't really relevant. And just because one tracking nag screen does things a certain way, does not mean that many others work differently.

There are websites that let you opt out of legitimate interests? That is a term of the law which means that you don't need user content.

The extension I use is called Ghostery and it also claims to block other tracking.

That seems too clever. If you set up a browser extension that automatically writes your signature on any contract people email to you and returns it, I'm pretty sure you're bound by those contracts.

If a child wearing stilts and a long coat walks into a movie theater where children can enter for free, and buys an adult ticket, then watches the movie, is he entitled to sue the theater and claim a refund?

Programming your computer to automatically click "yes" sounds like affirmatively giving consent to all popups to me. The standard for consent here is lower than for things like sex.

Reply on news.ycombinator.com