Microsoft fined $64M by France over cookies used in Bing searches

https://www.scmagazine.com/analysis/compliance/microsoft-fined-64-million-by-france-over-cookies-used-in-bing-searches

by LinuxBender • 4 years ago

127 85 4 years ago

scmagazine.com

jefftk3• 4 years ago

Earlier discussion: https://news.ycombinator.com/item?id=34095258

jvdvegt• 4 years ago

Ironic that scmagazine.com has the exact same issue with their cookie banner as what Microsoft is now being fined for.

wongarsu• 4 years ago

GDPR enforcement so far is one of these rare examples where the bigger fish are fined and prosecuted first. (Yes, fines against smaller players happen, but are less likely on a per-company basis).

wmeredith• 4 years ago

It would be nice if everything worked that way. When it works the opposite way, it's a vicious cycle of letting the biggest fish grow and making them even harder to go after.

johndhi8• 4 years ago

Agreed.

Jfyi if curious, cookie law technically isn't part of GDPR. It's from an older law that was ignored for many years called the e-privacy directive.

Semaphor• 4 years ago

The (very small) company I work at got a warning from our DPA (Germany, SH, so the relevant one is the ULD). I had a nice discussion with our caseworker there, where he also said that for small companies, they are extremely lenient and very happy to work with them to improve things.

slowwriter• 4 years ago

GDPR is not the EU regulation on cookies. GDPR only has a single direct mention of cookies. The ePrivacy Directive is what's known as the "cookie law" (https://gdpr.eu/cookies/)

johndhi8• 4 years ago

I interpret cookie law for a tech co.

Imo the law should be structured such that people who care can opt out of cookies programmatically, but every day people who don't care don't need to see a pop up on every site. That causes psychic load and makes us hate the internet.

Also, people should get together and vote on what constitutes "strictly necessary" cookies that don't require consent and "non-essential" cookies that do. It's currently up to some nerds in EU.

Why can't we have people make these calls?

shadowgovt7• 4 years ago

Because behavioral psychology tests reveal that the public is both super-paranoid about being spied on and will sell their PII to anyone who asks in exchange for a $5 discount at a store.

It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide.

johndhi8• 4 years ago

Well put. We were given Facebook for free on the basis that they can advertise to us. We voted for behavioral advertising with our feet.

Yet, we consume documentaries about how evil zuck is and love to hate him.

But shouldn't we take both into account or just think about it hard once and then be done with it? We're wasting a lot of time and energy.

dybber• 4 years ago

It shouldn't be by law, it should just be part of web standards that you can set your cookies preferences once and for all and all websites should respect that setting. I guess browser vendors and whoever else sits in these W3 consortiums like their cookies too much.

nonrandomstring4• 4 years ago

that the public is both super-paranoid about being spied on and will sell their PII to anyone who asks in exchange for a $5 discount

You raise an interesting point about this apparent disconnect.

Because behavioural psychology tests reveal

What do you know abot these "psychology tests"? Isn't the reality that both things you assert are really inferences based on anecdotal tales on forums like this one?

Do you know of any large-scale cross cultural, long term studies that show who will part with sensitive private data for small compensation? How are these studies controlled for situation, perceived reward, time pressure, trust levels?

What do we really know about widespread beliefs regarding the misuse of data? What are people's threat models? How do they assess harm?

I'm not disputing the truth of what you say - both ring true.

I think we instinctively know all rational people are strongly anti-surveillance. For complex social reasons we humans dislike creeps and snoops and treat them as social outcasts. But we also know that many people will sell their grandmother for a slight convenience or advantage. Do these two facets really clash, and if so why?

It's hard to craft good law when the mismatch between public stated desire and public behaviour is so wide.

Is is though?

Aren't both positions reconcilable if people make no causal link between the two? What if people just don't have the capacity to make that connection? Could good laws still protect them in the way that laws about asbestos protect people from harms related to chemistry and disease they cannot possibly understand?

hackernewds• 4 years ago

Additionally there's also a mismatch between what is good for the public versus what the public will end up choosing (due to ignorance or carelessness). This is illustrated in your first example.

Good laws will protect the public from themselves, even at the cost of supposed freedoms (think schedule A drugs, production, revenge porn, tobacco).

chickenimprint• 4 years ago

My carrier literally bugs me about giving away more and more personal info for 5 bucks every 2 months. They must have heard of the same research. They also ask for consent to receive "advice" and term it "our gift to you". I wonder how many people must fall for it.

Matumio• 4 years ago

It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide.

Some people would also sell their right to vote for $5 if that was legal. It's not hard to make such a law. You simply could make it illegal e.g. to offer money for PII during a purchase that doesn't strictly require it. Or to not respect the automatically transmitted cookie choice. Those who oppose such laws are the lobbyists of the big companies, not "the people".

jokoon• 4 years ago

If an user is not logged in, there should be zero cookie, there is no need to differentiate cookies.

johndhi8• 4 years ago

What if you want to support shopping carts or chat bots for anonymous users? Or what about ddos prevention?

Isn't a cookie (or local or session storage) needed in those cases?

ajross• 4 years ago

What is a "cookie" if not a generalized abstraction for "logged in"?

You seem to be calling for some kind of regulation that defines how identities are stored and managed on the internet. And that sounds really interesting to discuss.

But it's absolutely a much bigger problem than one "should" clause on HN

TechBro8615• 4 years ago

The Do-Not-Track header is a perfect solution to this, but unfortunately the largest browser vendor is also the largest advertising network, so the implementation of DNT devolved into a farce.

johndhi8• 4 years ago

Yeah.

astrange• 4 years ago

DNT, like all other configurable browser features (including script blockers), can be used to fingerprint you too.

lern_too_spel• 4 years ago

It has nothing to do with the browser vendor being in the ads industry. It's up to the website operator to respect it. If a website operator doesn't like a browser vendor's DNT defaults, it won't respect it, and that is why DNT failed. Regulatory backing could fix it.

jnky• 4 years ago

I disagree that the "Do-Not-Track header is a perfect solution to this", because it implies that the default (i.e. the header being absent) should allow sites to track you. I (and apparently EU legislators) think opting in to privacy is wrong. You should have privacy by default. If anything, there should be a "Creepily-Track-My-Activity-Over-The-Entire-Internet" header, that, when present, allows tracking.

There also used to be another standard called "P3P" that tried to integrate privacy into browser UIs with a more or less standardized interface and that, too, failed. Among other reasons because companies wanting to track people subverted it.

danhor• 4 years ago

GDPR doesn't require popups, it also allows for programmatic solutions. For some reason (lookin' at you DNT) online advertisement companies, publishers and browser vendors never came together to specify one after GDPR was passed.

Some sites like geizhals.de respond to DNT and only use the bare minimum, but that's the exception, not the norm (for some reason hint hint).

Usually laws don't prescribe some specific technical implementation unless absolutely necessary because they're often not optimal and go out of date quickly.

chpatrick2• 4 years ago

It's intentionally annoying so that companies that want to track people have to live with inconveniencing their users.

SquareWheel• 4 years ago

Well that's every company. So now every website is annoying.

layer8• 4 years ago

This is incorrect. Companies choose to make it annoying in order to trick people into accepting cookies who otherwise wouldn’t.

pyrale2• 4 years ago

Imo the law should be structured such that people who care can opt out of cookies programmatically, but every day people who don't care don't need to see a pop up on every site. That causes psychic load and makes us hate the internet.

Make it opt-in programatically rather than opt-out and we may agree.

somat• 4 years ago

This may be a stupid question. but I have not seen it discussed so I will ask it.

Cookies are already under the control of the end-user, why does the site operator need to ask/worry at all? if the user does not like the cookies can't they just delete them?

frenchy• 4 years ago

Because 'cookie law' isn't just about cookies. This is an intentional confusion on behave of the advertisers. It's really about using cookies for the specific purpose of tracking. There's alotof uses for cookies and it's not obvious to users what cookies are for what.

martinald3• 4 years ago

I think despite the goals of GDPR/cookie law being laudable, it really has turned into a complete trainwreck for the European tech sector IMO.

I work with tech product companies in both the EU and US. EU companies are completely stymed by GDPR/privacy implications. Features are often delayed for weeks/months as it goes through endless cycles of GDPR etc compliance discussion, which often doesn't have a concrete answer in the end!

Smaller tech companies in the US are in the whole not doing this. They are moving far, far, faster because of it. It really is night and day.

Sidenote: EU tech companies tend to be much more risk averse than US ones in general. This means GDPR really scares leadership there and the often lose the bigger picture.

The worst thing about these laws are that the regional/national courts are all interpreting them differently, often with major implications.

I think we will actually get to the point where many tech products just block the EU from using them. It is impossible to comply with the law IMO with so many conflicting interperations from regional courts and if the fines keep ratcheting up it will become uneconomic to serve the EU market.

RajT883• 4 years ago

I think despite the goals of GDPR/cookie law being laudable, it really has turned into a complete trainwreck for the European tech sector IMO.

It's a giant pain for my work for sure. Anything which could potentially have some intersection at some point with European customers has to fully comply with all of these EU privacy regulations.

Usually that means taking an already clunky internal system and adding a bunch of restrictions to it to make it even more clunky. Also banning some useful practices and tooling that me and people like me use for our day-to-day.

Yes, some of this is due to internal dysfunction.

snowpid3• 4 years ago

Could you specify which "useful practices and tooling" do you mean?

Zanfa• 4 years ago

It seems to be more a case of companies not actually wanting to follow the the law and do the straightforward thing - not collect personally identifiable information unless absolutely necessary for the functionality of the product / service. Instead they want to continue business as usual, trying to work around the law with as many dark patterns as they can possibly fit into a cookie popup.

martinald3• 4 years ago

I wasn't really meaning this exact case. But, so much time and effort being spent on _cookie popup windows_! I imagine 99%+ of users click accept regardless (even if reject is just as easy to click).

monsieurcanard• 4 years ago

From the article:

The website also lacked a button for users to reject cookies as simply as accepting them, CNIL said, where two clicks were required to refuse all cookies while only one was needed to accept them.

No need for FUD and fear mongering, "oh no it's so complicated, every town in Europe has different laws, what can we doooooo we are doomed someone please help us"

And it's not even difficult. We do it every day. When I go to the shop I take products in my basket, and then I extend cash (or a card) to the cashier. I don't ask them if they are sure they want to accept payment, or offer them to take the money only in the form of 10,000 coins of 2 cents, or throw the money in the air and ask them to catch it, etc.

If American corporations were not run by psychopaths this would not even be a debate. Dark patterns are evil and I hope corporations using them cynically will continue to get punished to the tune of millions of dollars.

bootsmann2• 4 years ago

I work for an EU tech startup and our experience is entirely the opposite. The trick here is to think about how you use the data before you collect it and not just collect whatever you get by default because thats how you speedrun ending up in the courts.

martinald3• 4 years ago

But when you are quickly iterating on products you don't know every permutation ahead of time on how you are going to use data?

jgalt212• 4 years ago

This story has been up for while, but no one has made a joke about the crumb-sized fine for Microsoft's bad cookies.

Microsoft fined $64M by France over cookies used in Bing searches

Related Stories