This is a very well written article. I’ve got to say, regarding cookie banners: most of them are not even legal! This is probably well known in this site already, but accepting needs to be as easy as rejecting, and exactly as prominent. That is incredibly rare. Google does it right, probably because they’ve been sued a bunch of times by the EU and don’t want another 3 billion euro fine, Apple does it as well in the third party tracking screen (once again, see who hates it and you know it’s good).
But then you see a new horrible thing which is sites which let you reject tracking only if you pay. This seems to be most common in news sites and is OBVIOUSLY, BLATANTLY illegal. The issue is that the data authorities of most EU countries don’t work that well, and you’re reliant on them to get any enforcement. It seems to be getting better at least, but it would be good if there was also some central enforcement for these violations which span multiple countries.
there are also similar local initiatives such as Panoptykon Foundation in Poland (they often cooperate with NOYB - worth checking out how you can help/get involved)
accepting needs to be as easy as rejecting, and exactly as prominent. That is incredibly rare.
Five years ago I’d have agreed, probably wouldn’t have remembered encountering a single one; but now I feel like it’s merely uncommon.
Mind you, I’m not a representative user. Annoyance lists in uBlock Origin ensure that I rarely see them on my own devices.
Enforcement of these things has been utterly disappointing. Businesses maliciously faux-complied and blamed GDPR for the inconvenience, and the lack of enforcement has let them get away with it so that people think cookie banners are GDPR’s fault, rather than that these businesses are continuing to do bad things. (And we won’t even get into how it was actually mostly about the e-Privacy Directive amendment from 2009, which people had been ignoring until GDPR came along…)
But then you see a new horrible thing which is sites which let you reject tracking only if you pay. This seems to be most common in news sites and is OBVIOUSLY, BLATANTLY illegal.
Can you elaborate on why this is illegal?
I’m not trying to protect this practice, mind you! I don’t like it. But aren’t they free as a business to set a barrier of service? This is an obvious opt-in and people are not subject of tracking until they agree to it.
I don’t know the exact letter of the law, but roughly it requires that there be no downside to opting out of tracking, and payment is a downside. Another way it’s not allowed is that opt out must be as easy as opt in, and obviously a payment is not as easy as accepting.
My experience with the GDPR is that my US suppliers were compliant well ahead of time, while Europeans went on a last-minute rush. This is unsurprising, US companies are actually quite good at regulatory compliance - they are used to hefty fines for breaking regulation.
And that's an aspect of the GDPR that tends to be ignored: the GDPR put more enforcement and especially fines around laws that were already in effect. E.g. double-opt-in for newsletters - all those emails your got "just for due diligence, did you really opt in to our newsletter?" right before enforcement came into effect was a lot of marketing companies having to admit that they did not keep proper records (or... didn't actually practice double-opt-in properly, e.g. by buying address lists).
GDPR is much more than just the banner - it also requires companies to know what data they're collecting, use the data only for the stated purposes, let users view/update/delete their data, store the data securely, notify users and regulators about breaches. This is a basic level of competence, but without the regulation most companies wouldn't even care to do that, and would stick to the classic strategy of "grab everything, sell everything, act stupid when asked".
I think this represents a coherent view, and it's well stated.
I'd note the total absence of any mention of state private-sector general privacy legislation in the United States, either California's CPPA/CPRA or the more industry-friendly laws based on Virginia's Consumer Data Protection Act. They aren't perfect analogs to GDPR in the EU, but omitting them could create a misleading picture of US politics, which in turn sets up an appealing but false absolute dichotomy with the EU.
Good article!
The only concern that I have are the stories that I've heard from doctors about patients dying because they could not access the files that other hospitals have on these patients. This is mostly something that happens when someone has an emergency while not being near their usual hospital. The GDPR (and other bureaucracy) makes it difficult for hospitals to set up a complete network to share this data.
Unfortunately in a lot of places even without GDPR that kind of availability wasn’t a thing anyway. The solution here is probably a government-run health record registry, which in practice already exists in most countries in their respective national health services, and figuring out some way to give private hospitals and clinics a way to access that (in Portugal at least you’d never get taken to a private hospital in an ambulance or other emergency, so that wouldn’t necessarily be an issue, but you could still have data that’s only on the hospital and not on the national record, so it’s very much still an issue). I’m curious, did this kind of thing exist in other countries, but got shut down due to GDPR? This sounds like something that should very much be regulated separately.
pta2002 | 12 hours ago
This is a very well written article. I’ve got to say, regarding cookie banners: most of them are not even legal! This is probably well known in this site already, but accepting needs to be as easy as rejecting, and exactly as prominent. That is incredibly rare. Google does it right, probably because they’ve been sued a bunch of times by the EU and don’t want another 3 billion euro fine, Apple does it as well in the third party tracking screen (once again, see who hates it and you know it’s good).
But then you see a new horrible thing which is sites which let you reject tracking only if you pay. This seems to be most common in news sites and is OBVIOUSLY, BLATANTLY illegal. The issue is that the data authorities of most EU countries don’t work that well, and you’re reliant on them to get any enforcement. It seems to be getting better at least, but it would be good if there was also some central enforcement for these violations which span multiple countries.
patryk | 10 hours ago
NOYB makes a lot of effort to fix cookie issues & co
cases about cookies: https://noyb.eu/en/project/cookie-banners More of their work: https://noyb.eu/en/projects
there are also similar local initiatives such as Panoptykon Foundation in Poland (they often cooperate with NOYB - worth checking out how you can help/get involved)
pta2002 | 10 hours ago
Thanks for the link! Seems that as usual my government is dragging its feet, but this is a very good resource.
jmc | 9 hours ago
Online newspapers and similar publications are some of the most annoying. They often present the two choices:
🙄
patryk | 8 hours ago
That's not compliant as well! Please report such cases to your local data protection authority
chrismorgan | 9 hours ago
Five years ago I’d have agreed, probably wouldn’t have remembered encountering a single one; but now I feel like it’s merely uncommon.
Mind you, I’m not a representative user. Annoyance lists in uBlock Origin ensure that I rarely see them on my own devices.
Enforcement of these things has been utterly disappointing. Businesses maliciously faux-complied and blamed GDPR for the inconvenience, and the lack of enforcement has let them get away with it so that people think cookie banners are GDPR’s fault, rather than that these businesses are continuing to do bad things. (And we won’t even get into how it was actually mostly about the e-Privacy Directive amendment from 2009, which people had been ignoring until GDPR came along…)
thisalex | 3 hours ago
Can you elaborate on why this is illegal? I’m not trying to protect this practice, mind you! I don’t like it. But aren’t they free as a business to set a barrier of service? This is an obvious opt-in and people are not subject of tracking until they agree to it.
patryk | 3 hours ago
Points 4, 7, 12 and 13
https://noyb.eu/en/frequently-asked-questions-about-pay-or-okay
pta2002 | 28 minutes ago
I don’t know the exact letter of the law, but roughly it requires that there be no downside to opting out of tracking, and payment is a downside. Another way it’s not allowed is that opt out must be as easy as opt in, and obviously a payment is not as easy as accepting.
stephenr | 3 hours ago
Keep in mind: you don't need permission for functional cookies like session auth.
So anywhere that has a cookie banner wants to be able to track your activity.
Or to put it another way: if your employer has one of these banners, maybe watch that "Are we the baddies" clip from Mitchell and Webb.
skade | 9 hours ago
Good article!
My experience with the GDPR is that my US suppliers were compliant well ahead of time, while Europeans went on a last-minute rush. This is unsurprising, US companies are actually quite good at regulatory compliance - they are used to hefty fines for breaking regulation.
And that's an aspect of the GDPR that tends to be ignored: the GDPR put more enforcement and especially fines around laws that were already in effect. E.g. double-opt-in for newsletters - all those emails your got "just for due diligence, did you really opt in to our newsletter?" right before enforcement came into effect was a lot of marketing companies having to admit that they did not keep proper records (or... didn't actually practice double-opt-in properly, e.g. by buying address lists).
kornel | 3 hours ago
GDPR is much more than just the banner - it also requires companies to know what data they're collecting, use the data only for the stated purposes, let users view/update/delete their data, store the data securely, notify users and regulators about breaches. This is a basic level of competence, but without the regulation most companies wouldn't even care to do that, and would stick to the classic strategy of "grab everything, sell everything, act stupid when asked".
kemitchell | 2 hours ago
I think this represents a coherent view, and it's well stated.
I'd note the total absence of any mention of state private-sector general privacy legislation in the United States, either California's CPPA/CPRA or the more industry-friendly laws based on Virginia's Consumer Data Protection Act. They aren't perfect analogs to GDPR in the EU, but omitting them could create a misleading picture of US politics, which in turn sets up an appealing but false absolute dichotomy with the EU.
atmosx | 2 hours ago
Heh: https://www.buchodi.com/chatgpt-now-knows-what-you-do-on-other-websites-via-ad-collector/
TimoNotThy | 2 hours ago
Good article! The only concern that I have are the stories that I've heard from doctors about patients dying because they could not access the files that other hospitals have on these patients. This is mostly something that happens when someone has an emergency while not being near their usual hospital. The GDPR (and other bureaucracy) makes it difficult for hospitals to set up a complete network to share this data.
pta2002 | 21 minutes ago
Unfortunately in a lot of places even without GDPR that kind of availability wasn’t a thing anyway. The solution here is probably a government-run health record registry, which in practice already exists in most countries in their respective national health services, and figuring out some way to give private hospitals and clinics a way to access that (in Portugal at least you’d never get taken to a private hospital in an ambulance or other emergency, so that wouldn’t necessarily be an issue, but you could still have data that’s only on the hospital and not on the national record, so it’s very much still an issue). I’m curious, did this kind of thing exist in other countries, but got shut down due to GDPR? This sounds like something that should very much be regulated separately.