I do get that this type of regulation is very disruptive to many companies, but if they cannot survive with informed consent, then perhaps they should not have been so successful without it in the first place.
IMO it would be fine to say "we were tracking you but when you followed the link we deleted those cookies and won't now set them". "Reject all", or default off ("no cookies are set, cock here to enable the committee types you wish") is better.
What's far worse is the admission that they still use ad networks even when those networks are clearly breaking the law (ie they offer no settings to disable tracking). Indeed BBC should be going further and not allowing advertisers on their network to drop cookies if a user has disabled first-party cookies. Instead they say "go to these networks and disable it yourself", good luck with that!
This from an org funded in [minor] part by taxation and whose rausin d'etre is supposed to be serving the public interest.
It's sneaky, immoral, unethical and illegal. It also works.
*"stupid" is relative term. Laws are made for particular society, if almost a half of that society disagrees with the rule then it shouldn't be a rule.
And I don't think it's a fair statement that any large percentage of _people_ oppose this particular law; in my experience, most people don't seem to have a strong opinion about it, and those that do have a strong negative opinion very often don't really understand it (and are mostly reacting to the irritation that the various stakeholders are deliberately putting them through). Sampling the opinion of companies that live off ads is a bit like asking printer companies how they feel about toner prices.
So great laws actually even if gets 100% of those.
These dark patterns we keep seeing shows that the sites didn't do their homework and is trying the usual weazel way of getting past on "you clicked accept so now you are stuck.". Consent can only be given knowingly, if you hide it in the fineprint (or behind a "show more" button) it's not valid according to GDPR. To invent things like selling customer data to third party and call it fair usage of private data is not ok either.
The agreement has to be easy to understand and very short. And it has to be presented close to the actual entering of data or the accept button. No hiding, no shenanigans, no trying to fool with colors or design. It's that simple.
I completely agree. People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy. If a “pitiful” fine of $200,000 fixes the behavior, why fine the living daylights out of them?
I’m just wondering why the fines have been so “slow” to happen. Enforcement Tracker[0] lists only 533 of which the majority appear to be against individuals (such as “Doctor”, “Private person”, etc.) I just figured there would be more by this point.
As a person who calls for these, my reasoning isn't that they should dismantle the entire web because of it[0] - but that destroying a few small businesses and seriously hurting some big ones would set an example for all the rest to fall in line. Right now, companies seem to correctly reason that they're statistically unlikely to be noticed and fined.
--
[0] - Even though my belief is that advertising industry in particular is a social cancer and absolutely needs to be torched down to the ground.
Constantly applying fines is not sustainable. You eventually want to get to the point where privacy "just happens".
It’s as if they used decades of HCI research precisely to make the user experience as horrible as possible. No wait, I’m sure they did exactly that.
For all the hate that Yahoo gets for theirs (shown above), at least it does have a mostly functional reject all function, even if it requires two button presses (the end of the footer does tell you to go manually opt out of facebook/twitter).
It's honestly absurd the amount of different dark patterns they're using to try to trick users.
“TrustArc” is a funny name considering it and its pals have obliterated any trust I had in this stuff.
No one likes to be blatantly manipulated.
There need to be fines for this. They're clearly violating the spirit of the law, if not the exact letter (and I think much of Europe has legal systems that follow the spirit more than the letter, don't they?)
Article 7 (3) 4. https://gdpr-info.eu/art-7-gdpr/
I'm in favor of a lot more fines, and substantial fines. Few companies need to be made example of. The current situation does further damage to how EU citizens perceive GDPR and EU itself - companies do their best to make the consent control experience as bad and tiresome as possible, and then they tell people to blame GDPR for how web browsing just got more annoying.
A few more GDPR fines and that hole will also be plugged. :)
These fake progress spinners are only there to deter you from opting out (hint: if you just accept all, the modal closes instantly).
I wish the EU would throw massive fines at these companies, and ban the persons in charge from over working in the business again.
That example doesn't have the long loading times for me any more, but I'm almost certain it was the TrustArc pop-up.
The opt out cookie is set by the advertiser, not the publisher, and the contents of the cookie have generic text like "OPT OUT".
Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal.
It's purely a dark pattern.
If you did that, users wouldn't be able to see whether their opt out was successful.
Like the sibling poster said, the default should be opt-out.
It's not as if this TrustArc modal is some old product that was repurposed for GDPR. This is all planned and done in bad faith, period. It's a dark pattern.
That seems really wrong.
They'd need to queue those things and process them async later, or find a solution that doesn't need those requests at all.
So as long as you didn't interact with the banner, _every_ page load should take ~60s?
An acceptable option is to pop up a consent form as needed, and set a cookie recording whether user made a consent decision. That can be classified as essential cookie to fulfill a legal obligation.
Right now companies just keep doing what they always did and hope for the best. As long as they're convinced they can just try not to get too much attention this data sharing problem will persist with barely a dent.
It should be required by law that there be a simple to access “opt out to everything” option that should be as easy to access as an “opt in to everything” option.
Also, I would not be opposed if some browser standard were developed under governmental oversight that sends a blanket “opt out to everything” that websites would be required to respect by law.
It arguably is already required with the language of article 7.2 and recital 32, especially this part
> If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
But we will see how it gets interpreted as more cases works their way through the system.
The phrasing “The-opt-out-to-everything option must be as easily accessible as the opt-in-to-everything option.” is far less arguable and hiding one behind a further menu, but one not, is a clear violation of this rule.
That's pretty awful, how are you even supposed to interpret that? I'm guessing it's something like "first || !second", because that would be the sleaziest.
Some have an "accept all" button that could perhaps reveal which is "on" and which is "off", since when you press it all the buttons go to "on". But this happens so quickly and the modal is closed immediately afterwards, that there's no time to tell. And of course by then you've already accepted so it doesn't matter.
It reminds me of "reasonable" wording in English law.
Taking a page from the RealNetworks playbook from twenty years ago, I see. Put the shit you don't care about up top and unchecked, keeping the interesting stuff checked but below the fold.
This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options to opt in to specific forms of tracking which. Most of those are now off by default, as it should be, except that if you scroll down you still see a number of "legitimate interest" ones enabled, even though you can turn them off manually.
Edit: And worst of all is this very confusing pattern with two columns of toggle buttons, one of which concerns "legitimate interest": https://toot.cafe/@peter/105367185171860458