News for hackers. Stuff that matters.
Re:No cookie consent walls, scrolling isn’t consent, says EU... by PeterisP on Wednesday May 06, 2020 @01:10PM (#23093574)
If a user complains, the data protection agency will evaluate your process and evidence. As you say in another comment, "Here are the logs, here is the dialogue they were shown." - that's it, if you're compliant, that's all you need to do. But you need to be able to make a convincing case that the dialogue is reasonable, fits the criteria ("the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language") and the choices a reasonable person would make on that dialogue would reflect their intent.

But this discussion is full of examples of "consent" dialogues that clearly are made to trick users into making a different choice than what they want. In such cases showing the logs and dialogues would demonstrate that a valid consent was not obtained.

It's not a novel thing - for example, I recall that many years ago website opt-in patterns were being reviewed in the Ryanair case where the consumer rights agencies analyzed their website order process where a bunch of 'dark patterns' were used so that people accidentally "opting in" to things they did not want to. There's an administrative process that determines whether your process is honest or tries to cheat users into "agreeing" to things they don't intend to agree. In the latter case, you'll be forced to change how your stuff works.

Re:No cookie consent walls, scrolling isn’t consent, says EU... by ferzul on Wednesday May 06, 2020 @03:17PM (#23095126)
if there's a process, why are dark patterns so prevalent? i might have seen a clear and straightforward choice once or twice; usually, it is hard to find the reject flow and hard to understand whether i am correctly triggering it.

i am sure there are many databases out there which i am marked as having consented it, although i did no such thing. the standard is to make it hard to express your desire to opt out despite the rules requiring entirely the opposite.

Re:No cookie consent walls, scrolling isn’t consent, says EU... by PeterisP on Wednesday May 06, 2020 @08:39PM (#23098295)
Mostly because enforcement has not gotten to them yet - lots of the really bad examples are from non-EU companies, and the priority of the enforcement has been mostly with local businesses, and most of that for all kinds of privacy issues with more real world impact.

E.g. at the launch of GDPR a local major supermarket chain tried to use a bunch of dark patterns for their loyalty card program (mostly offline) process so as to continue their tracking, they were forced to change last year. It's clear that issues like that have a much larger impact on privacy of people than some foreign news website, and that's prioritized accordingly.

For the major multinational social networks, the delays are (intentionally?) caused by the lack of capacity in the Ireland data protection agency, as many of these multinationals have their EU HQ in Ireland because of tax purposes, so all their cases are being handled there and that means that enforcement for them is going to take a long time. But if I look at random local websites today and compare it to what was happening a year ago, the dark patterns are not prevalent anymore. They appear occasionally, but they're really rare now locally.