Comment by nostrademons | Hacker News Reader

Comment by nostrademons | Hacker News Reader

Parent Full thread

The GPC spec does not say "no cookies will be set" [1], and does not mention cookies at all. It merely provides a way for the user to indicate their preference that their information not be shared or tracked. The spec even says:

> In the absence of regulatory, legal, or other requirements, websites can interpret an expressed Global Privacy Control preference as they find most appropriate for the given person, particularly as considered in light of the person's privacy expectations, context, and cultural circumstances.

The CCPA [2] also never explicitly mentions cookies or forbids them from being set. The relevant passages about opting out on the sale of personal information are:

> a) A business shall provide two or more designated methods for submitting requests to opt-out, including an interactive form accessible via a clear and conspicuous link titled “Do Not Sell My Personal Information,” on the business’s website or mobile application. Other acceptable methods for submitting these requests include, but are not limited to, a toll-free phone number, a designated email address, a form submitted in person, a form submitted through the mail, and user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information

How would you respond to their claim that you are fundamentally misunderstanding GPC, and that the spec and the law do not mean you never set cookies, they mean that you must honor the preferences expressed by the header in backend processes that involve tracking or sale of personal information?

[1] https://w3c.github.io/gpc/

[2] https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oa...?

To quote our report: At webXray we are experts in tracking technologies, and we work closely with in-house counsel, defense, plaintiff firms, and regulators. However, we are not lawyers ourselves, thus nothing in this report represents a legal conclusion. webXray was not founded to supplant the role of lawyers, courts, or judges. We were founded to provide clear, accurate, forensic data, without fear or favor. We believe that by filling this gap we can enhance outcomes for all consumers, businesses, and regulators.

---

We are filing the gap related to reliable facts not existing. We did a scientifically controlled test with GPC on and off. We presented the results as technical findings along with general background.

We are not lawyers, and we are happy to help others perform their own audits: https://webxray.ai - we have no desire to be lawyers.

We are a hard-tech engineering outfit, we deliver scientific clarity on complex topics.

So you agree that you have no way to confirm whether those websites honor or do not honor the do-not-sell-my-info choice. You are simply checking whether they set cookies or not, without knowing whether the data is sold or not on the backend.

We run scientific audits that provide evidence of specific data transfers under specific network conditions.

Your marketing should specifically say "We track cookies" (or if you wanna get punchy about it, "We track cookies so cookies don't track you") so potential customers know exactly what they're getting. For the purposes of legal compliance, this is pretty irrelevant. There may be people that want to know that the existing laws and company's compliance to them doesn't actually stop the cookies from being sent, but your privacy report says the companies are "Our findings reveal major technology companies simply ignore globally defined opt-out signals, raising the spectre of industrial-scale non-compliance with California requirements", which is untrue and potentially opens you up to libel claims. They are not ignoring the laws, they are complying with the laws in a way that may or may not be what the consumer actually cares about.

Do you have any legal experience, evidence, or case history to support your perspective? You assert that the statement "Our findings reveal major technology companies simply ignore globally defined opt-out signals, raising the spectre of industrial-scale non-compliance with California requirements" is untrue -- how do you know? Do you think everything found in the discovery process would agree? Do you think a company with a history of privacy violations would actually go through with a lawsuit where they'd have to definitively prove they don't? What about proving malice, that webXray knew their statements were false or acted with reckless disregard for their truth? What about the risk of filing a suit where California's anti-SLAPP statue would probably apply?

Reply on news.ycombinator.com