*And I mean force, not request.
But beyond that, it won't delete your messages. I guess they just own my words forever now.
That's a pretty weird objection. Even if there was a button at the bottom of your profile page that you could push to delete your account, there's nothing stopping that button from notifying some real person behind HN who could peruse your posting history before deletion.
> Even less privacy in my opinion.
What "privacy" are you talking about? You've posted these comments to a public website, where any user can view your entire comment history.
> But beyond that, it won't delete your messages. I guess they just own my words forever now.
I haven't read HN's terms of use or privacy policy (I suspect you haven't either? Ironic, considering the tone of your post), but presumably, as a condition of signing up in the first place, you've elected to allow that practice.
As a fellow HN user, I think it would be really bad for the community if random bits of old discussions just disappeared, making it difficult or impossible to understand the conversation that was going on at the time. I certainly think there should be exceptions; say you accidentally (or regretfully) posted some personal information that should be deleted... I believe in that case the HN mods would do you a solid and delete it. And I know that in some (all?) cases of account deletion, they'll make up a new username to attribute your posts to, which would dilute any association the posts have with you (assuming you used a name that you've used in other places).
Regardless, there's nothing stopping someone from scraping HN (or using the HN API) to mirror the content of discussions elsewhere. And they might not be in a jurisdiction where you can expect to get your data deleted if you really want to.
To me, these privacy/deletion laws are most useful to force a corporation to delete any data it has on you that it holds privately, and could use to identify you or monetize you or whatever. Once user-generated content comes into play, it feels like a different beast to me.
Yet from a site dedicated to creating the modern web, I assume modern web practices are followed.
Even 20 years ago in forums you could go through and delete your posts and edit your comments to blank. Add in 20 years of "we should be able to delete our accounts!", I had figured HN follows this practice.
Whatever, I don't care, I just make a new username once every few months.
They are not forced to make those popups because they are not forced to collect that data in the first place.
I will take those annoying popups all day every day and happily in return for everything else that's getting better only because of them and the rest of the effects of gdpr.
And it's still weaksauce. It's merely a solid start. They should keep going and do even more.
MORE GDPR PLEASE.
I cheer them on. It's a shame I have to rely on some other countries governments to do their damned jobs that my own isn't.
It's also a shame some of those same governments are also trying to censor porn. But this comment is about the cookie consent popups.
Don't do shitty things to your users and you don't need a popup.
From https://gdpr.eu/cookies/ :
> To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:
> ...
> Receive users’ consent before you use any cookies except strictly necessary cookies.
Defined as:
> Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.
It's entirely possible to have a useful website without requiring a popup. It's just not how most companies prefer to have the web work.
i.e. you need to add a popup or a banner
Also, "should" be explained; I don't believe it's a violation of the law to not do so.
The pop-ups you see are the industries ham-fisted attempts to circumvent that legislation and carry on data harvesting.
A site that uses cookies for purposes intrinsic to the core functioning of the site doesn't have to show any popups at all.
You're using one now.
Every site chooses to uses a popup as a fig leaf to justify their unnecessarily intrusive data collection. Comply with GDPR rules by default and you don't need a popup or can defer it until necessary.
They regulate it without innovating it.
Just look at the amount of Americans that think that they have to request permission to use cookies. Disinformation is a powerful tool.
Governments have always lagged to regulate corporations, either because of conflicts of interest or plain incompetence, which is especially true for Big Tech.
But at least the EU is trying to some extent, which was GP's point.
> No they just made it peppered with useless popups.
The popups were a workaround the web adopted due to the lack of technical details in the law, but the law itself isn't to blame. There have been many fines handed out, which is a step in the right direction, at the very least. We should celebrate any step towards protecting citizens from corporations, not scoff that it's not perfect.
They could have gone with the do not track header, but they didn't although they still could and it would be okay within the concept of the law which just requires consent for tracking.
I'm hopeful that the laws will keep evolving in response to citizen needs, but I'm still glad I have some control over the data companies have on me, however limited that may be.
[1] In its current form, the GDPR massively helps entrench existing incumbents. Compliance is technically difficult and costly and can be difficult for new players just getting started. There should be more assistance given to startups and small companies, and pieces such as the right to access and export data should only apply to companies of 10 employees and larger (or some revenue threshold). These are costly and difficult to implement, and I know my startup is not in compliance. It would take a month just to build that functionality.
All those things are the default. It is hard to run into a situation where you risk violating the GDPR without actively making a decision to do so, with maybe the exception of the whole "users have a right to all their information/delete all their information" thing, which should be a straight-forward database operation unless you're doing something asinine.
The minute you have user accounts, you have to export everything associated with EU residents that invoke data export rights. Every table with a user foreign key.
This is a big scope.
Every upvote. Every comment. Every file upload. Even on your innocuous personal blog.
Any product imaginable quickly becomes a big GDPR data export problem.
As an example: assuming a standard RDBMS setup with a primary and replicas, I would expect that bulk operations would be done on particular replicas dedicated for that purpose. That way you aren't interfering with writes, or with the "normal" reads that come with regular website use.
If you are starting out now, and you want to avoid trouble, you just avoid collecting data about site visitors. And when you do need to collect data (perhaps you need customer accounts), then you spend some time thinking about what it means to furnish that data on request, or to delete that data. No, it's not zero work. But it's a hell of a lot easier to build these sorts of controls into a system from the start, than it is to build it in later. I don't really work with web/full-stack frameworks, but I would be surprised if there aren't built-in or third-party modules for the popular ones to help with this process.