News for hackers. Stuff that matters.
Re:Automating cookie consent and GDPR violation detection by belorn on Monday March 21, 2022 @05:27PM (#30759916)
Before GDP, the legal consensus among lawyers I asked was that consent could be a 30 pages long legal document hidden through a 6 pixel text link at the bottom of a page that can only be accessed by trawling the website. It wasn't really what the politicians that wrote the ePrivacy Directive intended, which is why the word informed consent was added.

Now if a hidden 30 page long legal document that no one can read is consent then I have this bridge I want to sell. It is totally legit.

Re:Automating cookie consent and GDPR violation detection by hugoroy on Monday March 21, 2022 @05:54PM (#30760207)
I doubt you actually asked any lawyers who know this stuff.

While GDPR did raise the threshold of valid consent, the interpretation before the GDPR was nowhere near what you describe here.

There are authority guidelines and sanctions predating the GDPR on this.

Re:Automating cookie consent and GDPR violation detection by belorn on Monday March 21, 2022 @06:11PM (#30760374)
I asked a lawyers during a conference that discussed privacy and law. I initially asked if a 50 page document was fine, which they said was not, but then lowered it to 30 and they said "sometimes" without any irony in sight. After an additional discussion they said that even if people did not read the document or had the ability to understand it, it would still count as consent.

I have also talked personally with politicians who was involved with the work of writing GDPR, and the people who wrote the ePrivacy Directive has reportedly said that lawyers interpretation of consent was beyond the imagination of the original intent of the directive, which is why GDPR now require freely given informed consent in contrast to the old consent.

Re:Automating cookie consent and GDPR violation detection by privacylawthrow on Monday March 21, 2022 @05:58PM (#30760256)
You asked the wrong lawyers, at least for the US. The FTC's case against Sears in 2009 made it clear that consent to a privacy notice isn't valid if the privacy notice is buried deep in a licensing agreement, even if the notice is correct.
Re:Automating cookie consent and GDPR violation detection by 3np on Monday March 21, 2022 @07:06PM (#30760895)
They are referring to GDPR. I do not see how any US ruling applies to that.