6 ms·

You can read more about the cookie law here: https://www.cookielaw.org/the-cookie-law/ https://www.cookielaw.org/the-cookie-law/ Basically EU wanted sites to o

by mziel 9y ago

You can read more about the cookie law here: https://www.cookielaw.org/the-cookie-law/ https://www.cookielaw.org/the-cookie-law/ Basically EU wanted sites to obtain consent to use users' cookies (and for the users to give/take away that consent). However, pretty much all the sites just decided to provide you with a banner saying something like "if you're using this site you agree to our cookie policy". Therefore the law became ineffective and just a nuisance to the users. This notion of "implied consent" is being actively fought with GDPR. You have to provide explicit consent to the usage of your data. And more importantly you can revoke it (at any point) and the site can't deny or degrade the service (unless the data is strictly necessary for a specific action related to the service). With ePrivacy this will go one step further. Right now you only need to provide opt-out, which means most people will likely leave it as it. Going forward those additional services (marketing purposes, ad tracking) will need to be strictly opt-in (and there's already internal research done in some companies showing that marketing/ad opt-in rates will be 10-12% at best).

iagovar 9y ago
But op-int for what? For being tracked? Using you data? Just showing you an ad?
- mziel 9y ago
  You're supposed to enumerate all uses of the data (and they need to be sufficiently detailed and specific). The user has a choice to opt-in/out of each of them separately. There is currently no detailed description as to what the definition of "sufficiently" is. For example: - can I use your data to build a targeting machine learning model? - can I use it to target you? - do I need specific opt-in for every model? Most things in GDPR are not specified in order to both give flexibility to the sites and to reduce the number of loopholes (which are technically legal but against the spirit of the law). You need to decide on the implementation and be ready to defend it in case of an audit.
  - TomMarius 9y ago
    Defend it? What happened with "innocent until proven guilty"?
    - xxs 9y ago
      This isn't a criminal case.
      - TomMarius 9y ago
        Most of European constitutions don't limit this principle to criminal cases - actually most of the time it specifically says that it especially applies to interaction with government on top of criminal cases.
    - zaarn 9y ago
      The GDPR does somewhat turn handling private data into "guilty until proven innocent". Until you prove otherwise, by means of contract, legitimate business interest, law or consent, assume private data is meant to remain private.
    - cyphar 9y ago
      This is a corporate regulation, not a criminal case. When a company gets audited by the tax office of a country, they similarly have to defend their finances and prove that they were following relevant tax laws. I don't see why auditing for GDPR compliance should be different to auditing for VAT compliance.
      - TomMarius 9y ago
        > When a company gets audited by the tax office of a country, they similarly have to defend their finances and prove that they were following relevant tax laws Not true. There are some countries where it works like this, but also countries where it's the opposite. In some EU countries this got ruled as unconstitutional. In some other countries, this got ruled by the highest court of law as unlawful. > This is a corporate regulation, not a criminal case. That doesn't matter in most EU countries.
askvictor 9y ago
But what's the alternative approach to the cookie law? A yes/no consent page before your site, and if you click no, the user doesn't get to access it? Because that's basically the same thing, but even more annoying.
- haeffin 9y ago
  Which is why there is the "And more importantly you can revoke it (at any point) and the site can't deny or degrade the service (unless the data is strictly necessary for a specific action related to the service)." point - you're not allowed to deny access to a newspaper article if somebody does not consent.
  - akvadrako 9y ago
    Unless you are charging for the content, I suppose.
- whyever 9y ago
  No, you could outlaw degrading functionality, which is what they are doing in the new law.
  - askvictor 9y ago
    How do you do this for services where functionality is reliant on tracking etc? E.g. some of Google's services.
    - tobylane 9y ago
      You can only degrade when the users denial exactly relates to the function of the service. I have history turned off in google maps. I can’t name the points I make, it tells me I need to turn history and tracking back on. I hope that becomes an unjustifiable degrade.
      - emiliobumachar 9y ago
a_imho 9y ago
IMO the cookie law was good and (ianal) but a banner in your face is not consent, not in an opt-in way at least.
- vageli 9y ago
  If you're made aware of the terms and can choose to leave, that's pretty much consent. Do you sign a paper agreeing to all the terms when you enter a car park? Of course not! It's a class of contracts called contracts of adhesion. [0] [0]: https://en.m.wikipedia.org/wiki/Standard_form_contract https://en.m.wikipedia.org/wiki/Standard_form_contract
  - PeterisP 9y ago
    EU consumer rights specify many (types of) terms that are considered unfair in various common contracts, so if they're included in a standard form contract offered to consumers, they're automatically considered null and void. I.e. it's a general legal principle that because such contracts aren't negotiated, there's one-sided leverage, and certain classes of terms are inherently abusive to consumers, therefore even if a consumer "agrees" to them and signs a contract including these terms, they shall not be considered binding. GDPR extends this concept also to consent for processing private data - there are some ways how that consent can be granted and received, but contracts of adhesion are not (will not be when GDPR comes in force) one of them. In particular, GDPR specifies that anything included in such a "take it or leave it" contract is not considered "freely given" consent and thus such a contract does not and can not give you any rights to use that data, no matter what is written there.
  - boomlinde 9y ago
    The cookie banner does not put me in a "take it or leave it" position. By the time I get to learn of the terms—by any reasonable definition a prerequisite for consent—the other party has already set a bunch of cookies.
  - s73v3r_ 9y ago
    Contracts of adhesion are almost universally derided as being quite one sided and shitty to people.

by mziel 9y ago

iagovar 9y ago

But op-int for what? For being tracked? Using you data? Just showing you an ad?

mziel 9y ago
You're supposed to enumerate all uses of the data (and they need to be sufficiently detailed and specific). The user has a choice to opt-in/out of each of them separately. There is currently no detailed description as to what the definition of "sufficiently" is. For example: - can I use your data to build a targeting machine learning model? - can I use it to target you? - do I need specific opt-in for every model? Most things in GDPR are not specified in order to both give flexibility to the sites and to reduce the number of loopholes (which are technically legal but against the spirit of the law). You need to decide on the implementation and be ready to defend it in case of an audit.
- TomMarius 9y ago
  Defend it? What happened with "innocent until proven guilty"?
  - xxs 9y ago
    This isn't a criminal case.
    - TomMarius 9y ago
      Most of European constitutions don't limit this principle to criminal cases - actually most of the time it specifically says that it especially applies to interaction with government on top of criminal cases.
  - zaarn 9y ago
    The GDPR does somewhat turn handling private data into "guilty until proven innocent". Until you prove otherwise, by means of contract, legitimate business interest, law or consent, assume private data is meant to remain private.
  - cyphar 9y ago
    This is a corporate regulation, not a criminal case. When a company gets audited by the tax office of a country, they similarly have to defend their finances and prove that they were following relevant tax laws. I don't see why auditing for GDPR compliance should be different to auditing for VAT compliance.
    - TomMarius 9y ago
      > When a company gets audited by the tax office of a country, they similarly have to defend their finances and prove that they were following relevant tax laws Not true. There are some countries where it works like this, but also countries where it's the opposite. In some EU countries this got ruled as unconstitutional. In some other countries, this got ruled by the highest court of law as unlawful. > This is a corporate regulation, not a criminal case. That doesn't matter in most EU countries.

askvictor 9y ago

But what's the alternative approach to the cookie law? A yes/no consent page before your site, and if you click no, the user doesn't get to access it? Because that's basically the same thing, but even more annoying.

haeffin 9y ago
Which is why there is the "And more importantly you can revoke it (at any point) and the site can't deny or degrade the service (unless the data is strictly necessary for a specific action related to the service)." point - you're not allowed to deny access to a newspaper article if somebody does not consent.
- akvadrako 9y ago
  Unless you are charging for the content, I suppose.
whyever 9y ago
No, you could outlaw degrading functionality, which is what they are doing in the new law.
- askvictor 9y ago
  How do you do this for services where functionality is reliant on tracking etc? E.g. some of Google's services.
  - tobylane 9y ago
    You can only degrade when the users denial exactly relates to the function of the service. I have history turned off in google maps. I can’t name the points I make, it tells me I need to turn history and tracking back on. I hope that becomes an unjustifiable degrade.
    - emiliobumachar 9y ago

a_imho 9y ago

IMO the cookie law was good and (ianal) but a banner in your face is not consent, not in an opt-in way at least.

vageli 9y ago
If you're made aware of the terms and can choose to leave, that's pretty much consent. Do you sign a paper agreeing to all the terms when you enter a car park? Of course not! It's a class of contracts called contracts of adhesion. [0] [0]: https://en.m.wikipedia.org/wiki/Standard_form_contract https://en.m.wikipedia.org/wiki/Standard_form_contract
- PeterisP 9y ago
  EU consumer rights specify many (types of) terms that are considered unfair in various common contracts, so if they're included in a standard form contract offered to consumers, they're automatically considered null and void. I.e. it's a general legal principle that because such contracts aren't negotiated, there's one-sided leverage, and certain classes of terms are inherently abusive to consumers, therefore even if a consumer "agrees" to them and signs a contract including these terms, they shall not be considered binding. GDPR extends this concept also to consent for processing private data - there are some ways how that consent can be granted and received, but contracts of adhesion are not (will not be when GDPR comes in force) one of them. In particular, GDPR specifies that anything included in such a "take it or leave it" contract is not considered "freely given" consent and thus such a contract does not and can not give you any rights to use that data, no matter what is written there.
- boomlinde 9y ago
  The cookie banner does not put me in a "take it or leave it" position. By the time I get to learn of the terms—by any reasonable definition a prerequisite for consent—the other party has already set a bunch of cookies.
- s73v3r_ 9y ago
  Contracts of adhesion are almost universally derided as being quite one sided and shitty to people.