The question is not whether one is compelled to provide their content, the question is what is required for the content to be provided.

It probably wouldn't surprise you that it is unlawful to require visitors to sacrifice a kitten to access a site, would it?

Sure, but killing a kitten is illegal, and accepting cookies isn't. They aren't asking for someone to commit a crime.

I assume it would be legal to charge money for reading the content... could they require that you create an account?

The whole point of the article (and of GDPR) is that accepting non-essential tracking cookies without user consent is illegal.

Determining whether a user has "consented" is impossible, as evidenced by this thread, so the law is folly.

In a highly technical sense, it is maybe not. In a legal sense, which applies human common sense when necessary, it absolutely is.

it is easy to determine if a user has consented. but if you go out of your way to mix in “i consented” and “i want this box to stop annoying me as quickly as possible” into one bucket, the fact that you have trouble separating them is a problem you created

Yeah, some other comments made that point more clearly. I think I understand better (it seems to be similar to anti-prostitution laws, where it is illegal to trade something you can give for free)

It does seem to lead to some strange loopholes though, like requiring an account for access.

> It does seem to lead to some strange loopholes though, like requiring an account for access.

That's false.

Requiring an account or even payment for access does not replace or imply consent of any kind, and all rules still apply even if the user is still logged in or paying.

In fact, it's probably more complicated for logged-in users since you have to comply to requirements of data-scrubbing, removing/anonymising logins/emails/passwords from your database upon request, etc.

How could you anonymize an email address for an account? You are going to need it to reset passwords

You have to do it upon request.

Meaning: more code that you have to write and time you have to spend.

Let's say I have a club, you have to do certain things to gain membership to my club if you don't do those things you can't get in. How is that any different? The club should be able to set the rules as it deems fit.

> The club should be able to set the rules as it deems fit.

That's only true under ideological assumptions that are far from universal. I think most people would be OK with society putting reasonably-justified restrictions on the kinds of rules the club can set.

Sure, I'm not a psychopath, I understand the usefulness of laws. I just don't think the restriction in question is reasonable. To me, it seems like a choice an individual should make for themselves: access or data?

That would create perverse incentives and make the web a worse place.

The point of the law is quite clear: allowing people to use the web without having anyone force them into giving away personal information.

Sure, some companies won't be able to be creepy to users, but that was an acceptable tradeoff to the law.

In theory, in practice users consent and move on. You’ve just added an annoying extra step on every site. Victory?

Or users decline and move on, since decline is supposed to be just as easy as consent.

They could, I just don't personally see that as a clear cut win for the web.

If UX is important, then don't track users. There's no consent required if you're not tracking.

Collecting data and being annoying are entirely optional and a choice made by companies. The law is a still a partial victory for privacy.

It may be optional but it seems to be the standard rather than the exception.

I just don't see people really caring about their privacy. When given the choice between convenience and privacy people generally choose convenience. As someone who doesn't have a dog in this fight, I just end up annoyed.

Just because something is a standard doesn't mean it's right. It also doesn't mean the law shouldn't discourage it.

And just because people don't care doesn't mean a company is automatically allowed to track people.

If the law were followed by the letter and companies weren't using dark patterns or ambiguous marketing-speak to convince people to allow cookies, only people with pro-tracking stances would allow it.

Only if they're _legal_ rules. Otherwise you get into unconscionable contract land.

The club still has to follow the law. You can't have a "murder club" and you can't have a "I don't follow the GDPR club".

My point was about meeting requirements to gain access. Not about following the law. However, would it be against the law to have a club that is only open to ex-cons?

I understand that the GDPR makes it illegal to make it necessary to consent to give up your data before gaining entry. I was just questioning that portion of the law. It would be a pointless conversation to question points of a law and have someone respond back "but that is the law".

> However, would it be against the law to have a club that is only open to ex-cons?

Actually, in some countries, outside narrow restricted cases like support groups, yes; criminal record is a protected class in some cases.

However, being an ex-con isn't illegal. Having a club where you required members to consent to a crime being committed against them, which is more analogous here, wouldn't be legal.

It's only analogous because this law makes that act illegal if you change the law then it's magically legal again.

... Well, yes. If you legalise murder, murder is legal. I’m not really sure what your point is.

The law in question is the GPDR. I’m not sure what your point is. If you change the law to allow people to choose to consent or not see content then it is no longer illegal. If we can’t have that discussion because it is currently illegal then I guess it’s pointless.

I mean, that change _could_ be made, but why on earth _would_ it be made? It would largely defeat this portion of the GDPR. Who actually wants that change beyond advertising companies?

Why would it not be made? Each person has agency in the decision to share their data. If it is indeed _my_ data then _I_ should be able to choose to sell it or move on. Forcing a companies hand, I predict, will just move more content behind a paywall, decrease access to legitimate information and further fringe conspiracies.

You can sell your data for cash.

But this thing where big sites say "data or else" isn't a proper negotiation. It's a contract of adhesion, and those get regulated for good reason.

If things get moved behind expensive paywalls, that's a shame. But if there is more truely free access, or content behind paywalls that charge as much as an ad is worth, that can be a net benefit.

I may be mistaken, but I think it falls under some sort of discrimination ruling? I.e.: you can't discriminate against those users who don't want to give consent.

That seems like a weird choice. I mean, it makes sense to ban discrimination based on traits that people have no control of (e.g. all the protected classes in the US), but a refusal of consent is a behavior choice, not an unavoidable trait.

I wonder where things are heading.

All regulation against corporations limits the corporation’s rights, but it’s necessary as it keeps them in check.

So all regulations are necessary because it keeps corporations in check? I guess that means there is no room for bad regulations with that tautological definition.

That’s not what I said. There’s good and bad regulation. Things aren’t black and white; a truly free market with no government intervention at all will harm consumers, and governments with a hand in everything will harm consumers too.

"All regulation against corporations limits the corporation’s rights, but it’s necessary as it keeps them in check."

Your original statement made it sound as if you were saying all regulation is justified. Thanks for the primer on free-market/regulatory trade-offs though I never realized there was room for nuance.

I could see why you would think that; I could’ve worded it better.

Data protection laws would be meaningless if you made consent a condition of visiting the site.

But we've built a world where a large fraction of the population has [apparently] willingly traded their privacy for free product. I completely support making this trade transparent, so people can make an explicit choice, but what's the justification in making it one-sided and requiring companies to provide their service for free?

But is there any company that survives solely by collecting and trafficking personal data? Facebook and Google don't count, they make money selling ads.

If there is such a company I'm completely ok with them not being viable anymore.

i guess we'll find out if they really are willing, given a proper choice, and not just forced to click "accept" like in some perverse skinner box.

i don't know where all the misinformation comes from, but companies don't need to provide their services for free. they can still show ads - just untargeted ones. or is ads = tracking nowadays?

>forced to click "accept" like in some perverse skinner box.

Or you can just leave the website. It's not like you lose anything by not going to techcrunch, let alone lose your job or anything serious.

Targeted ads make the website a lot more money.

They can even show ads that are related to the content on the web page! Are you on a page that is about breeds of dogs you might want to adopt? Why not buy a Halti collar, and a package of dog training sessions, and donate to the RSPCA?

This is what Google's advertising product started out as, basically automated magazine advertising at scale; it turned into this perverse tracking system once everyone was hooked onto free web content and nobody could get away from it.

Why? If a company is transparent about what they're collecting and how it's used, I don't see how there is anything wrong with them refusing you service if you refuse to accept their terms. Websites and the businesses that run them aren't public property that you have a right to use. The problem comes when they secretly gather and exploit your information.

Data protection laws would still limit what companies could do with the data after they obtained it, even if they required that data to access the site.

It's not really that weird - it's almost the whole point!

The idea of GDPR generally is to prevent some undesirable behaviour (i.e. indiscriminately vacuuming up all the personal data you can and being careless with it), in part by establishing a regulation that says "you need to have good reasons if you want to process personal data". This means we have to define, among other things, what "good reasons" are.

In GDPR terms this would be the "lawful basis" for processing data. There are a bunch of these, including "you gave explicit consent", "it is a legal requirement", and "we have a legitimate interest in doing so".

The thing is, if "consent" is the basis on which you are processing data, then you cannot reasonably refuse service to someone who witholds consent – because that action would itself demonstrate that consent is not the lawful basis you are using. It's not a ban on discrimination, but the fact that your argument for why you need to process personal data would no longer be valid.

> The thing is, if "consent" is the basis on which you are processing data, then you cannot reasonably refuse service to someone who witholds consent – because that action would itself demonstrate that consent is not the lawful basis you are using. It's not a ban on discrimination, but the fact that your argument for why you need to process personal data would no longer be valid.

This seems backward to me - by allowing access to users who don't consent, you are implying that consent to track is not at all necessary to your functioning, and thus doing the tracking at all is now for invalid reasons... yea?

This is all obviously simplified, but “consent” and “necessary to functioning” are two different justifications for processing data. The GDPR does not require consent; it requires some kind of justification—a “lawful basis”— for processing, and “consent” is just one of those.

Think of it like this - if you want to process some personal data, regulations now oblige you to have a justification for doing so. That’s what GDPR calls a “lawful basis”, and there are six of them that can be used:

- Contract – "processing your data is required to offer or fulfil a contract with you"

- Consent – "we asked to process your data and you explicitly said it was okay"

- Legal obligation – "we need to process your data to comply with the law"

- Vital interest – "you were likely to die unless we processed this data"

- Public task – "we need to process your data to perform some kind of officially sanctioned public service"

- Legitimate interest – "we need to process this data for some other legitimate reason and promise that we won't do anything unexpected or unreasonable with it"

So, if you're running a website and you want to collect visitor data, you now need to justify why you are doing so, using one of these reasons. Each of these reasons outlines when they can be used, and what conditions apply to their use as a justification.

If you were running e.g. an insurance comparison site, you'd use the "contract" basis – processing a subject's data is necessary to fulfil some kind of service. A separate "consent" is not required. If you wanted to log requests to your site so you can detect intrusion attempts, you have a "legitimate interest" basis and again "consent" is not required – instead, you need to ensure you have evaluated the data you collect and demonstrated why it is required to fulfil that function.

To the specific point you raised – if your website legitimately needs to process data for reasons that are "necessary to your functioning", then you do not need consent to do so. You do need to document why this is the case, communicate it to users, provide adequate safeguards etc. but don't need to obtain an explicit consent. If you aren't able to use this approach, you still need a justification for your processing; if you want to use "explicit consent" as your reason, then that comes with the requirement that the consent is freely-given, explicitly opt-in, and is not a precondition for accessing the service.

If you decided to make "consent" a requirement to access a service, you would inherently be demonstrating that you did not meet the requirements for making that your "lawful basis" for processing.

Sorry that came out quite long, but I think it's important that anybody working with personal data understands these ideas!

I appreciate this response! I know I'm super late, but I learned a lot here, and it helped me out. :-)

Thanks!

In the US, "discrimination" only applies to protected classes. This includes sex. race, religion, nationality, skin color, age, or disability status. Unless one's stance on accepting cookies is enshrined in a widely acknowledged and mainstream religious text I'm not sure it would apply.

Even sexual orientation isn't really protected in that way FWIW, which is why a lot of anti-discrimination rulings surrounding LGBT rights can often feel a bit convoluted.

They maintain the right to refuse service but my uneducated opinion is that it could be penned as discrimination given the circumstances

Surely they can require an account for all users. Of course then no one would register because who has time for that.

The idea is that if this is how it is presented, you can tell them you agree and they still have no permission.

You can charge money, you can have special rules outside of the scope of the GDPR... what you cannot do is make people’s personal data the price for content. Under the GDPR personal data is non negotiable.

Thanks, this makes sense.

Edit: I'm surprised that elondaits's explanation isn't at the top of my thread. It makes clear that "exchanging your data as payment for 'free' services" is the target of GDPR and seems to me that's the only sensible explanation. Is someone willing to refute their explanation?

Yeah, I guess it could be thought of like laws against prostitution... you can give your data away for free, but you can't give it in return for something.

Sure, GDPR lets you give your data away in return for something. But, according to elondaits, that can't be the only price for something.

That seems like a tricky rule.. what if I said “you can access this with either your data or $1000”

What makes that "tricky"? If it costs somewhere near $1,000 to provide the service, why not offer that price as the alternative?

Price for a service isn't guided by how expensive the service is to offer, but by what the market will pay.

In this case, however, I was using it as an example of setting a price you don't expect to be paid... you want everyone to pay with their data, but you are required by law to offer an alternative payment form... so you set the price for the alternative to so high no one pays it.

I suppose this will mean the end of free content in the EU.