Re:No cookie consent walls, scrolling isn’t consent, says EU...
by PeterisP on Wednesday May 06, 2020 @07:59PM
(#23097977)
"And there's no reason for customers to opt-in when you're not allowed to offer anything in exchange." is kind of the point - the goal of GDPR is to stop the unwanted invasions of privacy, not extract some additional compensation from companies in exchange for being permitted to continue all these things. It's designed so that it would not be possible for a standard privacy-violating website to become GDPR compliant by writing some legalese or showing some popups or offering some discounts in exchange, the only way for the industry to become compliant should be by actual change in behavior so that there's much less tracking and violating the user's privacy.
The valid reasons for customers to opt-in are in scenarios where they desire the result to be customised according to that private data - where the customer wants you to use that data because that actual use benefits them. E.g. a dating site user might want you to use all kinds of private data for the purposes of finding better date matches. And the same user might not want you to use that same data for any other purposes or share it with third parties. And the intended result of GDPR (as the enforcement slowly changes the common practices) is a world where these user's privacy preferences are actually respected.
So the consent question comes down to essentially "are the users gifting you this data because they want you to have it?" - if so, knock yourself out, everyone's happy. But any selling or trading that consent is not binding or enforceable.
The most effective analogy that I can think of is sexual consent.
Like, if I sign a contract saying "You can fuck my arse and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my arse fucked unless I really want to (or there's some other legal basis, IDK, a warrant for a cavity search), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be rape no matter what I signed in the contract.
In the exact same manner, under GDPR if I sign a contract saying "You can violate my privacy and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my privacy violated unless I want to (or there's some other legal basis), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be a privacy rights violation despite the contract.
The valid reasons for customers to opt-in are in scenarios where they desire the result to be customised according to that private data - where the customer wants you to use that data because that actual use benefits them. E.g. a dating site user might want you to use all kinds of private data for the purposes of finding better date matches. And the same user might not want you to use that same data for any other purposes or share it with third parties. And the intended result of GDPR (as the enforcement slowly changes the common practices) is a world where these user's privacy preferences are actually respected.
So the consent question comes down to essentially "are the users gifting you this data because they want you to have it?" - if so, knock yourself out, everyone's happy. But any selling or trading that consent is not binding or enforceable.
The most effective analogy that I can think of is sexual consent.
Like, if I sign a contract saying "You can fuck my arse and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my arse fucked unless I really want to (or there's some other legal basis, IDK, a warrant for a cavity search), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be rape no matter what I signed in the contract.
In the exact same manner, under GDPR if I sign a contract saying "You can violate my privacy and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my privacy violated unless I want to (or there's some other legal basis), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be a privacy rights violation despite the contract.