Statement on 4 Years of GDPR

https://noyb.eu/en/statement-4-years-gdpr

by starsep • 4 years ago

127 185 4 years ago

Ygg24• 4 years ago

Honestly, never saw the point of GDPR. You add additional expenses for something big abusers will just bypass, ignore or even worse just retract from the market.

varispeed2• 4 years ago

The purpose of GDPR is to help abusers legitimise the data they collect. Before GDPR it was a grey area, because users didn't explicitly consent to anything - GDPR fixes that. Ubiquitous pop ups where you agree for your data to be collected and processed, trained users to consent to anything that comes their way and corporations now have legal basis to use, process and sell that data.

It was quite clever - make people believe the legislation is for their benefit, whereas in reality it has been created to help with data abuse and make money off of it.

MattPalmer1086• 4 years ago

That's an unduly cynical take in my opinion. GDPR isn't about web sites and cookie preferences, although that is the most visible effect to users.

I'd happily replace that whole cookie mess.

withinboredom2• 4 years ago

trained users to consent to anything that comes their way and corporations now have legal basis to use, process and sell that data.

Sorta? I don't consent to much when I get the pop-up. You can revoke consent at any time as well and you're entitled to the data the company has on you.

Nextgrid10• 4 years ago

The GDPR has strict regulations on what counts as valid data processing consent. 90% of the consent popups you see out there do not fit that criteria and any "consent" obtained via them doesn't count.

kreeben• 4 years ago

The point of GDPR is to smack companies that fail to meet it hard on the nose, so hard, in fact, that it might break. The maximum penalty is 2% of yearly turnover. That's hurtful even to megacorps. No one, not even them, needs a broken nose.

retSava2• 4 years ago

In theory yes, but so far they haven't brought the hammer onto anyone of formidable size.

Nextgrid10• 4 years ago

Well the idea is that with proper enforcement the big abusers shouldn't be able to bypass it. The legislation itself is sane, it's just that enforcement is lacking.

even worse just retract from the market

I disagree that this is worse - if privacy-violating monopolies retract from the market then it opens the doors for privacy-respecting competition to take its place.

Ygg24• 4 years ago

The legislation itself is sane

On paper yes, great intentions[1], in practice no. E.g. Right to be forgotten.

Implement RTBF in context of IPFS.

[1] Second order effects like prevent rats/snakes by awarding award for rat/snake heads, lead to rat/snake farms.

if privacy-violating monopolies retract from the market

You get Splinternet. Several independent Internets, walled from each other.

arky527• 4 years ago

GDPR also opened the door for the eprivacy directive that brought us cookie law

Nextgrid10• 4 years ago

ePrivacy was there way before the GDPR.

diffeomorphism• 4 years ago

Different order. That is also why the gdpr addresses some of the abuse of the cookie law.

PartiallyTyped• 4 years ago

GDPR prevents companies like "safe"graph [1] from selling mined data:

The GDPR (European Law)
As of May 25, 2018, a new data privacy law known as the EU General Data Protection Regulation (or the "GDPR") went into effect through the EEA countries. SafeGraph does not offer products or services involving the collection or sale of “personal data” in EEA countries. We likewise seek not to collect such personal data from our data providers. Should any of the foregoing change, we will update this section of our Privacy Policy.

If this is not a net win, I don't know what is.

[1] https://www.safegraph.com/privacy-policy

piva00• 4 years ago

even worse just retract from the market

This is like saying that regulating damage to the environment is bad because would make businesses that can't exist without doing said damage would retract from the market. Good riddance, if a business can't or isn't willing to protect EU's citizens data they should go away, like many polluting industries that had to adapt or die.

Ygg24• 4 years ago

This is like saying that regulating damage to the environment is bad because

Sure if a global problem is only taken by a small subset of states. It's not solving a problem just essentially grandstanding. See climate change.

But GDPR and related laws have been a mixed bag and a combination of neat and "why the hell do you think that will work?".

maccard2• 4 years ago

Can you give any examples of abusers that have retracted from the market that actually provided a useful product?

smitty1e• 4 years ago

Companies realize that competitors do not comply and that acting legally does not pay off. The wider non-compliance spreads, the harder it will get for authorities to gain back control with limited resources.

This is what makes writing good/effective law a non-trivial undertaking.

If the words on paper don't make positive sense, and negative behavior toward the words isn't backed up with punishment, then the effort corrodes and collapses.

ckastner2• 4 years ago

This is an excellent quote that reflects a notable share of opinions that I see in the comments here on HN whenever the GDPR is discussed:

Hardly any other area of law is politicized to that extent – at least I have never heard that building or tax codes were openly ignored with the argument that compliance would “undermine the business model” of a company. The privacy bubble accepts such narratives as a legitimate argument.

solarkraft8• 4 years ago

Nah, this type of argument is often brought up once someone (with a lobby) actually has to change their ways to comply. Safety features would make cars 3x as expensive, nobody in the world could feasibly implement such radical emissions standards ...

All the time. It's just important to recognize this type of argument as pointless.

JumpCrisscross4• 4 years ago

compliance would “undermine the business model” of a company

This is a disingenuous framing of the argument as it commonly appears on HN, sometimes by me.

The complaint isn't with respect to what the rules permit and prohibit. (Some people complain about that, but it's not the common mode.) It's the enforcement mechanism. Complaint initiated. Multi-forum and portable. Imprecise on implementation details. Those factors make compliance, even for someone looking to do everything right, expensive. Which raises barriers to entry. (And creates room for mischief.)

The closest similar thing in the U.S. is our approach to securities regulation. Complaint initiated. Each state has its own forum. Each side can complain and defend in different forums and then expensively argue over arcane rules for forum selection. Details hashed out through enforcement actions versus ex ante published rules. Now imagine there was no SEC corralling the mess. That's GDPR.

MichaelZuo• 4 years ago

When you put it that way, it does sound pretty onerous...

ckastner2• 4 years ago

I have to disagree with that. I'd wager that even if with a hypothetical perfect GDPR, you'd still have the major advertisers fighting it tooth and nail.

Because when "you're the not the customer, you're the product" applies, then the GDPR does effectively undermine the business model. Targeted advertising appears to be immensely profitable; raising boundaries on how you process subject's data, and how/to what extent you profile them, cuts into those profits.

The GDPR recognized the protection of PII as a fundamental right. The way I read the argument I quoted, the problem is not that e.g. Facebook would like to comply with the GDPR but cannot do so for e.g. imprecise implementation details. The problem is the GDPR significantly impairs Facebook's ability to generate revenue. And to that end, it appears that Facebook is indeed "openly ignoring" the GDPR to some extent, at least from what I recall from the ongoing complaints by NOYB and others.

[To clarify, I don't disagree with your particular argument; on the contrary, the flaws you pointed out are evident. I just don't think that is was the argument being made here.]

InfiniteRand2• 4 years ago

That's a very strange argument by the OP, there are massive arguments about whether/how building codes and zoning laws undermine the ability of developers to build new housing.

franga2000• 4 years ago

Arguments yes, but companies still comply at the end of the day. With GDPR, they simply don't, with no punishment.

largbae• 4 years ago

GDPR is a good idea, but it seems to be top-down and pushing against megacorp and user alike. As it stands, the law is only making it more expensive to be in the data harvesting business. These extra risks and requirements raise the barrier to entry for new firms and so just ends up cementing the market position of existing players.

If people start caring enough to actually cancel services that harvest their data, then the harvesting would stop. But it is very easy to underestimate the power of machine learning and correlation, especially when the data being correlated is gently sipped over years.

AndrewDucker• 4 years ago

"As it stands, the law is only making it more expensive to be in the data harvesting business"

That's at least partially the intention, and I'm entirely in favour of it.

maccard2• 4 years ago

Agreed. At my 25 person company it gives me a lever to pull in conversations about data - when someone asks can I have X, I can pull the GDPR card as a reason not to do it.

rendall• 4 years ago

the law is only making it more expensive to be in the data harvesting business

Great. "Data harvesting" without explicit consent should not be a thing.

If people start caring enough to actually cancel services that harvest their data, then the harvesting would stop.

I think that's quite naive. Much harvesting comes from websites that share data with each other about individual user behavior. There is no service to cancel unless you mean "browsing the web".

NOYB has more information, it seems: https://noyb.eu/en/projects

adhesive_wombat3• 4 years ago

pushing against megacorp and user alike

No, it's pushing against megacorps (and corps) and they're trying to gaslight everyone into thinking it's pushing against users by annoying the users on purpose and telling them the GDPR forced them do it (while also breaking the law and still hovering up as much data as they can while they think they can get away with it).

PaulKeeble• 4 years ago

The data protection act before it was not enforced and wildly broken by businesses as well. The law is always in at least two parts, the text as written and the enforcement. If the enforcement is mostly via government funded bodies then one way a government can undermine that aspect of law is simply to under fund the public organisation and that has been happening throughout Europe with strongly right wing governments. Many of these organisations have not been effective since the data protection act was introduced. The law is reasonable but the enforcement doesn't function and never has.

TekMol5• 4 years ago

GDPR broke one of my websites that had tens of thousands of happy users.

Users loved it and expressed their delight that the website exists on a daily basis.

But when I tried to monetize it without ads and via Patreon instead, nobody paid. Nobody.

Recently, Google said they don't think my cookie banner is GDPR conform. But gave no info why and how I could fix it. And turned off Adsense.

So I finally took the plunge and turned the site off.

My feeling is that the GDPR plays into the hands of the big web players. They have the resources to deal with it. While small one-man shows don't.

lars512• 4 years ago

GDPR aside, I had similar shock after getting a few million users for a viral language game, but finding that basically nobody was willing to sponsor it on Patreon, even to a level to cover the basic hosting costs. It was a little hard to process at the time.

raverbashing• 4 years ago

Yeah Patreon won't cut for those cases (unless there are good perks).

Maybe it's easier to sell merch.

TekMol5• 4 years ago

What did you ultimately do with it?

corrral2• 4 years ago

Casual games are a tough market, because there's a shitload of competition and a lot of it's free.

I play Wordle most days. I do enjoy it. The amount I'd pay for it is $0, because there are a thousand other free options that would entertain me just as much. Maybe not even word games. Maybe just Microsoft Solitaire. Apple's Texas Hold 'Em. Minesweeper. Nokia Snake Game. Whatever. Despite playing Wordle so much, if you told me I had to pay $1/month for it or else it'd disappear completely, I wouldn't do it. Its competition includes free stuff like watching the clouds go by, or flicking little paper wads at the trash can.

ad404b8a372f2b9• 4 years ago

Google broke your website, to be clear, not the GDPR. They themselves don't comply with it. And they also regularly shut people out of Adsense for seemingly arbitrary reasons with no recourse. Bad practices from a company that treats its users like garbage is not an argument against the GDPR.

It's also not all that hard to comply with the GDPR as a small website.

ZeroGravitas2• 4 years ago

Is there really no way to monitise an audience with ads without collecting their personal info?

That seems more of a problem than GDPR exposing that underlying issue.

edit: seems like Google have a non-personalised ad option, but it still uses cookies:

A Non-Personalized Ads solution (Ad Manager Help Center, AdSense Help Center) allows you to present EEA and UK users with a choice between personalized ads and non-personalized ads (or to choose to serve only non-personalized ads to all users in the EEA and the UK). Non-Personalized Ads only use contextual information, including coarse general (city-level) location. Although these ads don’t use cookies for ads personalization, they do use cookies to allow for frequency capping, aggregated ad reporting, and to combat fraud and abuse. Consent is therefore required to use cookies for those purposes from users in countries to which the ePrivacy Directive’s cookie provisions apply.

muro• 4 years ago

There is a reason why personalised ads are everywhere. They save advertisers money and bring higher revenues to sites hosting them.

solarkraft8• 4 years ago

Is there really no way to monetise an audience with ads without collecting their personal info?

There sure is: Contextual ads. DuckDuckGo does it, various documentation sites do it (https://www.ethicalads.io/), a dutch broadcaster does it (https://archive.ph/Zk4Pv). It's how newspapers used to work and TV channels still do, as well as YouTube sponsorships (and probably many more).

It improves the UX over personalized ads because

a) you don't have to invade your users' privacy (including asking them for permission to do it, obviously) and

b) the ad is actually relevant to the context the user is thinking about, instead of something completely unrelated from some other part of their life (or, more often than not, something completely random).

makomk• 4 years ago

Not unless you're a NYT-level big player, and even those don't seem terribly keen on the idea. The fundamental problem is that advertisers want to know that their ads are being shown to actual people who are actually interested in what they're selling rather than bots run by fraudsters with fake websites full of fake traffic, which means tracking and attributing clickthrough, and that alone is enough to count as personally identifiable information for the purposes of laws like the GDPR. Contextual ads and not tracking users in order to select the ads doesn't solve this issue, it just reduces the profitability of advertising.

solarkraft8• 4 years ago

It sounds like you encountered a small hurdle and chose to give up. Hundreds of thousands (millions?) of websites are GDPR compliant while running ads.

TekMol5• 4 years ago

I have thrown quite a lot of work at it.

Reading into it, looking up the legalese, building a solution that shows a cookie banner and prevents ads to load before users agreed to it etc.

I only gave up after all of that failed.

It just became unjustifiable to throw more time at it.

InfiniteRand2• 4 years ago

With side businesses/projects there's always a matter of balancing the hassle of maintenance with the potential for profit / happy users. GDPR does change this equation somewhat

fbn79• 4 years ago

Cookie banner has ruined the whole web. - Does not protect people (99% are just fake. If you reject cookies you keep get them) - Cost money to company (so cost to customers). A simpler browser extension where you manage your preference once far all (default) with the possibility to personilize x site (think like you do for camera permission) would have solved the problem in a real way and without all the hussle.

Radim2• 4 years ago

That's something the article should have mentioned:

4 years on, and people still think GDPR is about cookies – and even responsible for the intrusive consent pop-ups!

It is a testament to the power of the adtech giants and all the other shitty shady businesses, how they managed to twist the narrative.

And that's on HN, a presumably tech savvy audience. What chance does the "normal" population stand?

jacquesm2• 4 years ago

Lots of people on HN work for advertising companies such as Google, Facebook etc, tech savvy or not has little to do with it.

titaniczero• 4 years ago

GDPR is about personal data, not just cookies.

I agree they should have thought better of that cookie law, which is a different one. But GDPR really was and is on point.

happymellon4• 4 years ago

And if they did that it would also make them GDPR compliant.

They chose to put up cookie banners as a way of making to seem like the people making the laws told them to do it.

99% are just fake. If you reject cookies you keep get them

This is silly. The rule is that people are allowed to opt 𝚘̶𝚞̶𝚝̶ in to tracking. Just because some companies use cookies for this doesn't mean that cookies are banned.

If you are using cookies to store your website's settings then that is perfectly fine.

TamDenholm• 4 years ago

The rule is that people are allowed to opt out of tracking

Sorry to correct you, but the rule is that people are allowed to opt-in to tracking. This fundamental misunderstanding is kinda the problem...

ajsnigrutin• 4 years ago

Opting-in should be a client feature, not a website feature... make browsers block cookies by default, and then add a button next to the title bar to accept cookies for this webpage (for them to remember the login).

croon• 4 years ago

Cookie banner has ruined the whole web.

No, all websites that have cookie banners do so because they were already ruining the web, the only thing you can blame GDPR for in that regard is visualizing it.

martin_a• 4 years ago

Cookie banners just make visible how hard you and your private data have been fucked all over the internet in all the years.

It creates visibility where there was none.

ChuckNorris89• 4 years ago

Indeed, kind of like the graphic disease labels on cigarette packs. It doesn't directly stop people smoking, but it does raise awareness of what can happen.

gspr2• 4 years ago

Does not protect people (99% are just fake. If you reject cookies you keep get them)

Fake cookie banners are illegal under the GDPR. Seriously, in what other aspects of life do people respond to terrible enforcement by saying the law is the problem? (Of course there exists a bunch of stupid laws that are also terribly enforced, but here the objective of the GDPR is not stupid – it's merely a matter of terrible enforcement)

Cost money to company (so cost to customers)

Most regulation comes with a cost. The fact that this does, too, is kinda meaningless on its own. Food safety regulation comes at a cost – that, in itself, is not an argument against such regulation.

A simpler browser extension where you manage your preference once far all (default) with the possibility to personilize x site (think like you do for camera permission) would have solved the problem in a real way and without all the hussle.

Are you seriously arguing that legislation to enforce such privacy standardization would be easier to enforce than the current GDPR? By all means, what you're proposing sounds great – better than the GDPR even – but massively harder to do.

JumpCrisscross4• 4 years ago

in what other aspects of life do people respond to terrible enforcement by saying the law is the problem?

Every other case where the law is widely broken and selectively enforced? From low-level traffic offenses to drug legalization.

nikeee• 4 years ago

99% are just fake. If you reject cookies you keep get them

Note that cookies that are technically required to serve the site don't need a cookie banner. This is something many people get wrong. Other people shift to LocalStorage instead. But the actual legislation does not distinguish between cookies and local storage (and similar techniques).

Also, there must be a "reject all" button which should appear visually equivalent to the "accept all" button. Rejecting all has to be as easy as accepting all. Additional clicks are not legal.

karaterobot• 4 years ago

Another thing that is often ignored is that you have to wait for someone to consent before you give them cookies. Many sites just create the cookies when you open the page, then throw the banner, then whether you accept or reject, it makes no difference. Talk about compliance theater.

solarkraft8• 4 years ago

99% are just fake. If you reject cookies you keep get them

That's illegal, then.

gpderetta2• 4 years ago

GDPR notices are obnoxious, but they are not the only source of popups, not even the most annoying (most of them are converging to standard patterns, so you can dismiss them quickly). These days many sites have a constant barrage of all kind of popups, browser notifications requests, registration nags, adverts and so on, often on a delayed trigger.

adhesive_wombat3• 4 years ago

GDPR notices are obnoxious,

They're not obnoxious because GDPR made them that way, they're obnoxious because companies who think they have a right to unfettered and undisclosed abuse of people's data (because that's what they were used to) are trying to pretend that the law is the problem and not their malfeasance.

A fully compliant GDPR banner has two buttons, of equal prominence: reject all, and accept all. That's it. Any obnoxiousness is on thy implementor, and it's likely illegal.

Another fully compliant solution is to only collect the data you actual need and then you don't even need a banner at all.

corrral2• 4 years ago

Cost money to company (so cost to customers)

You can't necessarily raise prices just because your costs go up.

solarkraft8• 4 years ago

Background info: Noyb is the GDPR fan club (run by Max Schrems), trying to get governments to do their jobs to get proper enforcement. And you can join them! https://support.noyb.eu/join

bjelkeman-again• 4 years ago

Any opinions on how they are working as an organisation? Good, bad, indifferent?

paol• 4 years ago

This article is excessively negative on the effectiveness of the law.

I would say the biggest issue is inconsistent enforcement by DPAs. The other problems are overstated.

Believe me, as someone who sees things from the inside of european companies, compliance is still taken very seriously.

lupire• 4 years ago

Note that is this an activist website, not an EU government web site.

vesinisa4• 4 years ago

I hear you. These so-called "privacy activists" seem to have no clue how much European corporations are spending on data management, privacy controls, legal due diligence and finally serving the customers' GDPR requests. The last one is the publicly visible part, but it really is just the tip of an iceberg in investment on compliance.

This is made even more frustrating by that at least I find GDPR to be not very precise. There are lots of corner cases where it's not clear if some data is covered or not. The strictest interpretations would easily obsolete / criminalize vast majority of ALL software that people today absolutely depend on for their daily lives - like various financial backbone systems - and which largely predate the GDPR.

It's hard to not find the regulation a joke - sadly. While GDPR is not precise, I won't even go into the details about the ridiculous cookie law and the braindead portions of the new 2019 digital copyright directive (that French publishers lobbied in to hurt Google News). If GDPR left you in doubt, that idiocy really showed that these EU bureaucrats are completely out of touch with the reality in the field of technology they want to control.

matthewmacleod2• 4 years ago

If GDPR left you in doubt, that idiocy really showed that these EU bureaucrats are completely out of touch with the reality in the field of technology they want to control.

Honestly, the main thing it revealed is how little value a particular segment of the technology community places on protection of individuals' data. It's actually hard for me to think of any better example of regulation that is designed and written to be in-tune with the technology involved.

dmitriid3• 4 years ago

You're the prime example of what's written in the article: belittling the effort, pretending it's hard to comply with etc. etc.

riedel3• 4 years ago

I think the GDPR is pretty clear: it is illegal to process personal data if you cannot apply an exception listed in the regulation. Also all data that might be deanonymized by some means is personal data. The message is clear: if you put others at risk, you are at risk to get fined.

Yes, this makes many, sometimes ideotic things, illegal. But not I also cross a red light on foot from time to time and I do not think it should be made legal. Regulations that leave a freedom what to prosecute are not bad by design.

bee_rider• 4 years ago

One option would be to collect less data on users, which should make it easier to manage.

JumpCrisscross4• 4 years ago

the biggest issue is inconsistent enforcement by DPAs. The other problems are overstated.

Wasn't this called out repeatedly over the years and obvious from the start? That a double forum shopping model will produce paperwork and voluntary compliance, in cases where the offender literally didn't know they were misbehaving, but little real action?

riedel3• 4 years ago

Just want to point out that this not an issue only between European countries but also a problem e.g. inside Germany. [1]: a major information breach at a car rental company went with literary no consequences, while other cases get fined so high that they can easily fight decisions in court. I understand people if they complain about GDPR because it produces paperwork but in the end nobody cares about it. A central European regulation might sound nice at first, but if you even can receive not even a symbolic fine for a clear breach because a DPA has pitty with you something is fishy...

[1] https://www.heise.de/news/Kein-Bussgeld-fuer-die-Datenpanne-...

pmontra• 4 years ago

There are signs that it's getting better. I started seeing cookie dialogs with a Reject all button. Sometimes it's a big one, sometimes it's almost white on white, but it's there. Anyway the vast majority of those dialogs is still misleading. The usual We care about your privacy, accept all, settings thing.

CaptainZapp• 4 years ago

Even YouTube now has a REJECT ALL button.

Which is quite nice for folks like me, who always clear browsing data upon exit.

jaywalk• 4 years ago

If you always clear browsing data on exit, then what difference does having a reject all button make?

Terry_Roll• 4 years ago

But do you check your cookies have been wiped and not just blanked in MS Edge?

I have noticed that despite having all the settings to wipe data, not just cookies, cookies are still left.

These are my start page tabs in this order.

edge://settings/clearBrowserData tab all I have to do is click "Choose What to Clear", get the popup window, Time Range - All Time, all options ticked. Once completed but this can hang the browser for upto several minutes once done I switch to the second tab.

edge://settings/siteData tab hit refresh (F5) to see what cookies get left behind and thats when I see sometimes, cookies get left behind, usually youtube.com cookies, they will be blank but loads of youtube cookies.

edge://favorites/ tab, positioned to Favourites bar and have nothing on there because the browser pulls down site icons so you can identify people (browser fingerprinting) from the icon combination that gets pulled down.

edge://application-guard-internals/#status tab can see if its working properly, noticed when its on, youtube video's dont work its always trying to get get data, the stats for nerds show nothing comes downs or minimal 1kb amounts.

edge://policy/ tab because I like to switch these around to create a different fingerprint from the devices that are accessible.

csunbird• 4 years ago

The malicious actors moved everything to "Legitimate Interest", which needs to be toggled off manually for each provider and very well hidden.

Nextgrid10• 4 years ago

That's still not compliant so this problem should be resolved eventually.

coffeeblack3• 4 years ago

Wasn’t there recently some ruling against the use of dark patterns in cookie banners?

thayne• 4 years ago

The big players can afford to pay the fine, and the small ones probably won't be taken to court, so it might not have enough impact.

icedchai4• 4 years ago

"Better" would mean not seeing cookie dialogs at all.

jka2• 4 years ago

The EU's ePrivacy Regulation[1] has (or had - it seems to fluctuate) a goal to move cookie consent into the user's browser settings.

There has (perhaps predictably) been significant lobbying against that by entrenched industry players, so we'll see what emerges as a result.

(I have to admit I'm not up-to-date on the latest happenings regarding this regulation)

[1] https://en.wikipedia.org/wiki/EPrivacy_Regulation

buttscicles• 4 years ago

This seems to be a very common misconception, but the cookie consent dialogues are not part of GDPR.

latchkey2• 4 years ago

https://gdpr.eu/cookies/

Cookie compliance

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

Receive users’ consent before you use any cookies except strictly necessary cookies.

Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.

Document and store consent received from users.

Allow users to access your service even if they refuse to allow the use of certain cookies

Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

remram• 4 years ago

They are not required for cookies, but they are required for tracking cookies. If you are only using cookies for e.g. shopping cart or CSRF protection, you don't need a consent dialog, but that is not the case for those websites showing the dialog.

fsflover• 4 years ago

https://www.enforcementtracker.com/

aidanhs• 4 years ago

In the context of the GDPR, I just want to remind people of this thread where a HN user invokes their rights in order to make Spotify back down on a change that would have locked user playlists into their service for no good reason - https://news.ycombinator.com/item?id=24764371

(can't be 100% sure this is what made Spotify change direction, but it seems likely)

sethammons• 4 years ago

That was a great thread, thanks for surfacing it. My gut reaction was that there was no way the thread could be involved in changing spotify's mind. Color me convinced

superkuh• 4 years ago

Yikes, what an enlightening demonstration of how bad GDPR and it's users really are. Instead of taking control of their own music by having it on disk this user decided to rely a third party service and then became so upset when the service changed they threatened legal attacks. Services like this should probably block all nation states that support GDPR.

criddell• 4 years ago

Spotify is based out of Sweden.

l33t2328• 4 years ago

They paid a service and expect that service to follow the law.

That’s not bad at all.

Reubachi• 4 years ago

Gatekeeping music availability is weird. In most places, the idea of having all this music locally on a disk is impossible. How can someone in mongolia get a lossless, flac based discography of their favorite band from the 80s?

The music industry purposelessly makes it harder and harder to get lossless file based music for the first world, save for indie bands on bandcamp and the occasional release by a triple A band/label.And again, this is next to impossible in developing nations.

I don't have hundreds of hours and thousands of dollars to dedicate t getting every song I want to listen to on a whim in the above mentioned format, and I have much less time and money to manage those across my devices in a format that is anything short of maddening.

anovikov• 4 years ago

GDPR is just about one more annoying popup you need to click away on each site you visit, and that some U.S. website became inaccessible without VPN at all. Good job.

elisbce• 4 years ago

Cookie banner alone has probably done more harm in terms of wasted human life than anything else combined. 4.66 billion active internet users, 92% of which are web users, spending 5 secs per day on clicking all cookies allowed. That's 680 human years wasted per DAY on these banners.

SiempreViernes2• 4 years ago

Sure you're not actually thinking of preroll ads?

oblio• 4 years ago

Ummm.. you know why?

Because big companies with deeply unethical business practices are basically saying: "if we annoy you to death, maybe you get governments off our backs and let us make even more money".

They're like Big Tobacco when tobacco ad regulations were introduced.

parasense• 4 years ago

I completely reject the premise of this, that one is somehow EU citizens are not personally responsible for the information they themselves put online.

The most hilarious thing is cookies!

For example, cookies exist, and they work a certain way... and despite not liking how they work.. they are here, and not going away, and imposing some kind of contract-law of cookies being accepted or rejected totally ignores that the user has, and always had, the ability to reject cookies at the browser level, unilaterally or with policies, without any contract laws.

avmich3• 4 years ago

The idea of cookies was to establish sessions - something which can be done by other means, so cookies aren't needed. It would be good to have browsers which would clean all cookies every browser restart. Not enough though, some browser sessions can last months, so a better solution is needed.

red_trumpet• 4 years ago

something which can be done by other means, so cookies aren't needed

How does one actually do that? Embed a session id in every request/response?

kall• 4 years ago

I don't know of another way that reaches the same security model as secure httpOnly cookies, which are the recommended way to do session cookies.

throwaway182754• 4 years ago

As someone working in ad tech but not rooting for it to win at all costs: the biggest positive I see from GDPR is the fact that many ad tech data vendors have left Europe. I'm talking about vendors that aggregate personal data, track your location and the places you visit, the web sites you visit across multiple devices, etc.

i.e.

https://www.adexchanger.com/data-exchanges/tapad-is-shutting...

nullbytesmatter• 4 years ago

I don't think the law has done much at all. I operate a business that serves as a data broker / processor under GDPR.

I have had a total of 66 data requests in 4 years. I handle data requests and follow the laws, but I also understand the EU/UK has zero grounds to enforce anything against my business if I were to flat out reject all requests.

They can't fine me, I don't have a physical or business presence in Europe, though I do have European customers.

The only reason I handle requests is to protect my customers, not myself.

pc864• 4 years ago

This is an admirable position, and one of my biggest problems with GDPR. Honestly, my only problem with it.

The EU does not have the legal jurisdiction to tell any company based outside of the EU what to do with its data, whether that data is about EU citizens or not.

If I ran a SaaS I would probably do the same thing as you (out of respect for my customers) but I certainly wouldn't feel any legal compulsion to do so.

stevenjgarner3• 4 years ago

Is that really true? My understanding for example in the USA is that if you violate the laws in another country, you automatically violate the laws in the USA (under the Foreign Corrupt Practices Act - https://www.justice.gov/criminal-fraud/foreign-corrupt-pract...) - or is that really just limited to bribery? AFAIK some other countries have similar provisions.

blip543212• 4 years ago

Jurisdiction issues are complex. In this case, the jurisdiction is defined by the location of the customer, not the business.

If your business ignores EU courts, that might not have an immediate impact, but in the longer-term, you have a liability if you ever do business in Europe, want to be acquired by someone with a business presence in Europe, and potentially in the future, travel to Europe.

GDPR is framed as a human rights law, and that has long-reaching claws.

It is currently not well-enforced, but there are many examples of clawbacks coming in. For US slavery, those clawbacks are coming 160 years later: buildings, businesses, and schools are being renamed. Statues are being torn down. In some cases, you're starting to see reparations (see Harvard). Milder versions of racism are subject to cancellations; things acceptable in 1980 are having repercussions on people's careers in 2020.

Then you've got issues of when you're persecuted for an unrelated reason, and the government is looking for an excuse or pretext to take you down. A famous mobster was taken down a century ago for tax evasion.

Rygian• 4 years ago

The one in GDPR trouble wouldn't be your company anyway, since you're a data processor. The data controller is the one who needs to make good on the data requests.

mmarq2• 4 years ago

We should get to a point where tracking requires users to install an app or a browser extension, I’m thinking of something similar to the ads toolbars of the 90s.

I shouldn’t have to tell people I don’t want to be spied, nor I should have to install privacy extensions and PiHoles and whatever.

axg11• 4 years ago

Isn't this a matter of someone developing a browser that implements this? There are a few privacy focused browsers out there. As long as the most popular browser is developed by the company that benefits the most from tracking, there will always be browser-based tracking.

none_to_remain• 4 years ago

Is anyone maintaining some custom NoScript or anything like that I could use to block GDPR/cookie law popups and such EU nonsense? I'm not even a subject of Brussels

slock83• 4 years ago

In my experience, the annoyances list in ublock orogin (and possibly others), which is disabled by default, drastically reduces the amount of such pop-ups. The only remaining ones are unfortunately among the worst, which is to be expected since they went through the trouble to setup anti-adblock measures ...

stevenjgarner3• 4 years ago

What I do not understand about GDPR is analytics. If you are operating a website outside the US and EU citizens access that website, my understanding is that applicability of GDPR is limited to only uses where the site is capturing data from EU citizens. If the server statistics include standard analytics (e.g. client IP address, client browser, client screen size, etc), are not those analytics the capture of personal data from EU citizens? In this regard, don't EU visits to all non-EU non-GDPR-compliant websites involve a violation of GDPR simply through accumulation of server analytics? Is there an exclusion for this? Or can any website operator anywhere in the world be fined for non-compliance on this basis?

XCSme• 4 years ago

I think the law is not well-defined because, as you mentioned, any visit to a country that doesn't provide that same data protection rules should be blocked based on the current law.

Also, I still find it weird that the EU (GDPR) laws apply at the client (visitor) rather than at the source (server). The question is: is the server providing a service in EU (sending a webpage) or is the client "going" to a server in the US?

Statement on 4 Years of GDPR

Related Stories