I very much hope not, for the sake of future historians. Orwell put it best:

"He who controls the past controls the future. He who controls the present controls the past."

Did you really just compare private companies data retention to totalitarian censorship, and in a good way?

Indeed, for future historians it is critical that every company store the address, id, and private info of all their customers, for all time, regardless of risk. Without which we may forget that I lived on Paeroa St for two years while at uni, information that will be crucial in a discussion of the habits of early 2000s university students in New Zealand, and the impact that had on the fall of western civilization and the rise of our new fish-centric ethno-religion in the year 1200 AT (After Tilapia).

Let's not forget that all this personal data should also enter public domain for historians of the world to process.

How else will future generations be able to put your residence on Paeroa St in connection with the consumption of fish in that area during that time, to reveal the political stance of you and your offspring against the ruling party of the Tilapia...

Hail and Bless Our Lord ./makes gill flapping gestures

I will admit, for as much as I dislike Amazon now, on multiple occasions I’ve found it useful that I can log in and find my old addresses.

Which reminds me, I really should just write those down somewhere safe.

History isn't private data

For example you don't need to know exactly who voted for Trump or Biden in the last election, you just need to know the result

GDPR is a huge step in the right direction and has made a big difference. But yes, it needs much more time.

Hopefully it makes a real difference to compensate us for the never-ending, dark pattern cookie notices we have to endure as a result. Who wants a choice of 'Accept all' or 'Manage your settings' on every second webpage they land on?

They are not GDPR compliant anyway, they just try to fight it by making GDPR look bad. Look for alternatives for such pathetic sites.

Even Google of all places "respects" it now (after pressure). It becomes noticeably better every year.

These companies comply with GDPR as much as alcoholics comply with drinking driving laws by keeping a bottle on the trunk and stopping to take a swig once in a while

Big centralized sites want that.

Your beef is with the companies that do this, not with the GDPR.

A law which causes the whole web to be worse for no reason deserves criticism. Managing cookies belongs in the browser, a place auditable and adjustable by the user. Not on every website in the world.

GDPR may have had good outcomes too, and I am neutral on all other aspects, but whatever part of EU and California regulation led directly to cookie banners is a colossal failure which has benefitted no one (except possibly the dozens of snake oil cookie banner products which pretend to comply).

It's unfortunate that the attempt by companies to make people associate cookie popups with GDPR has worked.

Understanding the data you collect, why you are collecting it, what you are using it for and what the risks are if the data is leaked is unsurprisingly a useful thing to do as a business.

Especially since the old cookie banner law was abolished with GDPR. The whole cookie banner thing has technically nothing to do with GDPR and is the industries own perverted invention for "getting consent".

This is not true. The national implementation of the ePrivacy Directive are still law. You are correct that GDPR does not require cookie banners, but the law that does was not replaced by GDPR and remains in effect.

I would argue it's not useful to the business, which is why, ignoring the societal problems caused by business is often the default and why we need the regulation.

In the UK, current news cycle is about sewage being dumped on our beaches by water companies that were previously privitised.

It's useful to the business as soon as they're forced to be responsible.

> attempt by companies to make people associate cookie popups with GDPR

I think GDPR is generally good for individuals and the internet but if someone hates cookie banners, isn’t it fair to place the blame on GDPR?

Why can’t websites accept a special header which automatically accepts all cookies? I would enable it and handle clearing/retaining cookies myself through a browser feature/extension.

> but if someone hates cookie banners, isn’t it fair to place the blame on GDPR?

No, blame companies that set cookies for merely reading a website and then bothering users about it. They have a choice, they choose to make it obnoxious.

Your plan is what what maybe 3% of the population wants. It's a good idea, but it's not a solution to the issue. You can already handle this yourself with a browser extension to click the consent buttons.

I use those. They work on about 10% of sites, because there are about 1,000 vendors of "cookie consent modals" so nothing about them is standardized. Also, none of them that I've seen actually do anything, since "blocking all cookies set by 72 different adtech scripts loaded before and after you init" is not a real thing that Javascript snippets can even do. While most adtech snippets do have APIs to carefully pass in the user's GDPR prefs, most people don't wire them up, or even knows what order the various scripts load.

> isn’t it fair to place the blame on GDPR?

I could be wrong but IIRC cookie banners predate gdpr.

There’s a lot of conflation between the 2003 EU Cookie Directive, and the GDPR. The cookie directives specified a technical means (“cookies”) and actions that needed to be taken in order to use them. The GDPR specifies the ends (collecting and/or processing personal information) and the conditions (explicit and freely given consent), stating that anything achieving those ends must meet the conditions. It’s a much better written law than the 2003 Cookie Directive, because it avoids the need to irritate users for legitimate use cases, while also preventing legal loopholes (e.g. “We didn’t use a cookie, just the browser’s localStorage feature.”)

This is factually incorrect. The "Cookie Directive" wasn't from 2003, it was an amendment to the ePrivacy Directive. The ePrivacy Directive came into effect in 2002, and it was amendend in 2009. That amendment is what people generally call the "Cookie Directive" because it required consent for storage of information on end user devices.

It did not specify cookies, and did not actually specify any technical means. The ePrivacy Directive requires that companies get consent from users before storing information or gaining access to information stored on end user devices. This includes every kind of cookie you can think of, including LocalStorage. There is an exception for cookies necessary for the service requested, which typically includes things like auth cookies or shopping cart cookies, so long as that data is not used for anything else.

Because the GDPR already has a perfectly reasonable way to avoid the requirement for cookie banners. If you don’t collect information beyond what is strictly necessary to perform the task you are offering to users, and do not use that information other than in the performance of that task, then you don’t need a cookie banner. So Strava would not need a separate permission in order to collect location data for comparing your biking routes, but Strava would need a separate permission in order to use that location data for advertising, and Facebook would need a separate permission in order to collect the location data in the first place.

The GDPR doesn’t specify the technical means, only that permission must be explicit and freely given, with the default assumption being “no permission granted”. I think these conditions are entirely reasonable, and a header that could be set by somebody other than the user, then sent by the browser on behalf of the user, does not satisfy these conditions.

I appreciate your thoughtful comment.

Most entrepreneurs believe that visibility over how your visitors are using your website is “strictly necessary” for running a functional/secure/performant website and surviving as a business, but GDPR disagrees. Hence, cookie banners everywhere.

Not deemed “strictly necessary” > “Statistics cookies — Also known as “performance cookies,” these cookies collect information about how you use a website, like which pages you visited and which links you clicked on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized. Their sole purpose is to improve website functions.”

The DNT header already exists. Go figure out why it is ignored (is it too user friendly?) And since the GDPR has a large reach (it covers PII in all form, not only stored digitally), it is not the place to mandate it.

(not OP but) we want the opposite. I'm not naïve enough to think that those cookie banners will change much about what is being stored anyway, and browsers are more than capable of dropping cookies on the ground either instantly or at end of session.

So much could have been simplified if the GDPR rules, instead of imposing burdens on a million websites, required the 3-4 browser vendors to have a toggle for preserving first-party cookies on sites where the user submits a form with a password field, and simply cleared all others at session end or periodically.

Not sure why we should want to make companies less responsible in the first place. Anyway, as I said earlier, GDPR does not imposes burdens specifically on websites, but on any kind of PII processing. It is not the place to add provisions specifically for web browsers. I understand that the next ePrivacy regulation wants to make it more user friendly, but negotiations for this bill have stalled for years.

I don't want companies to be less responsible. I just think it's a fool's errand to ever expect every single webstore that runs a Shopify shop to understand how to add their 38 different adtech "tags" in a way that truly ensures that cookie consent is captured, stored, and conveyed to each entity that could come into contact with that data.

But by regulating browser vendors, they could have made it so that it doesn't matter what cookies they sent you. If the user hadn't consented in a browser UI, the browser would forget the cookies. Easy to verify compliance.

It's just like the ol' pathetic "Do Not Track" header. Same flaw. Asking "please don't give me a cookie that I'll have to keep and send back to you anytime you see me" instead of saying nothing, and just dropping the cookies you don't need on the ground.

There seems to be some serious misunderstanding here. For one, why do you think this is about cookies at all?

This is not something that can be solved client-side other than obfuscation etc. They can track you with other means than cookies. Even worse, you might have an account on their site. Having an account and using the site (and logged in) makes it trivial to follow you, but that does not give them the right to abuse that information for other purposes.

GDPR covers all of that.

"Just delete your cookies/session" is not relevant.

GDPR requires you to request consent for any cookies the “could” be used to identify you, which makes them personal information.

So if you want to use cookies to link a user’s sessions on your own website together (without actually identifying them) so every request doesn’t look like a totally anonymous, opaque request, then you must show a cookie banner.

You could (presumably) do this through browser fingerprinting and not require consent (since you don’t actually enrich/link the browser fingerprint to be become user data) but you need a cookie banner if you do it with a cookie.

> GDPR requires you to request consent for any cookies the “could” be used to identify you, which makes them personal information.

> So if you want to use cookies to link a user’s sessions on your own website together (without actually identifying them) so every request doesn’t look like a totally anonymous, opaque request, then you must show a cookie banner.

Wrong. The ePrivacy directive has an exception for strictly necessary cookies (Article 5.3), which is applicable for user sessions.

The ePrivacy directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Search for “strictly necessary”. More details in this opinion from WP29, see section 3.2: https://ec.europa.eu/justice/article-29/documentation/opinio...

> You could (presumably) do this through browser fingerprinting and not require consent (since you don’t actually enrich/link the browser fingerprint to be become user data) but you need a cookie banner if you do it with a cookie.

Are you able to identify someone from the fingerprint of their browser? Then the fingerprint is PII. Consent (or any other legal basis from GDPR Article 6) is therefore required if the exemption from the ePrivacy directive is not applicable.

GDPR Article 6: https://www.privacy-regulation.eu/en/6.htm

I’m thinking of the opposite of a DNT header. Websites would be very happy to respect it because it’s like auto-accepting a cookie banner. You would need to manage your own cookies.

Does GDPR remove the legal requirement for financial institutions to hold data for 7 yrs? if not then it's mostly irrelevant in this case.

No. On the contrary, GDPR explicitly allows data to be stored if retention is required for law, such as all financial data for 10+ years. However, there is absolutely no need to hold all this data "hot" in the production system and not in a "cold" archive without automated connection.

And GDPR forbids holding the data for longer than necessary, except in some very restricted cases (cf. art. 5(1)e.)

Thats the whole point of the initial comment. It is necessary to store some potential PII for long periods of time due to regulations from the same people that want you to get rid of all PII.

It depends on the data and it depends on the way that you store it. Nobody tells you to store all your data in plaintext for seven years in the live environment on an internet accessible service, there is simply no such requirement.

It also isn't necessarily a requirement that such permanent records are digital, this depends on the country.

Yes - GPDR very much changed the narrative from ‘keep all the things’ to ‘this stuff is a potential liability’.

More like "It's a liability until proven it isn't". We've been able to finally throw away so much of old useless "WE MIGHT USE IT SOMEDAY" stuff coz of it...

Yes it will be a long time if it ever happens.

Deleting data is hard work that requires a lot of preparation and has to be done without the safety net of backups. In many cases it will require changes to proprietary software. Keeping data happens automatically.

Not having data that you're supposed to have becomes obvious as soon as someone asks for it. Holding on to data for longer than necessary only becomes a problem if there's a data breach (that cannot be covered up).

Came here to say this.

The added complexity is regulation saying you need to keep data on your customers. In a way the early somewhat anonymous internet was better in this regard.

An edit to add, if you encrypt user data at rest (big ask currently). You can destroy the keys past a point and then the data in backups is safe etc.

Anyway it'll take a while for this view of the world to shake through.

Encrypting data at rest was table stakes 10 years ago Bitcoin and then ransomware became practical.

This will never happen. For a long time I thought there is a an USP in treating data as toxic substance, but with the rise of LLMs I think data is the new oil.

Company A that leverages data will outcompete company B.

> data is the new oil

Lots of layers to this analogy, given the damage our use of oil is causing.

Companies are going to learn that using LLMs without paying proper consideration to data governance is a recipe for large fines and worse (such as being required to throw out entire models because their provenance violates data subjects' privacy rights).

excellent reading for today: The Secret History of Lead, The Nation Magazine March 2000 ..

many direct analogies indeed

They're only subject to large fines if those laws are in place and actually being enforced, though. Companies keep getting away with these huge data breaches in the United States with almost no real consequences.

It's getting harder and harder to ignore these laws unless you're willing to stay out of some major markets (such as Europe and California).

I think we'll see a national privacy law in the United States at some point in the next five years. There's appetite for it in both major parties (Democrats to protect bodily autonomy, Republicans to stick it to Big Tech), and I think the targets of the regulations themselves will at some point lobby for a consistent national law rather than the patchwork of state laws that we have now.

The RESTRICT Act suggests that there's political will in the US to solve the same problems that the GDPR solves. If the RESTRICT Act fails, the US might get federal-level privacy protection (subject to the PATRIOT Act, of course).

The RESTRICT act isn’t GDPR and actually contains everything they couldn’t pass in the PATRIOT act, right?

At least at my employer, we've gone the route of global GDPR compliance.

I find it helpful to think of data as uranium instead of oil. Both are valuable, but one is also a liability if you mishandle it. What you want to do is only have as little as you possibly need to make your business go toot, and dispose of it as promptly and safely as possible when you no longer need it.

Not from the US government they won't. Fines here are inconveniences to rich corporations, not obstacles. Maybe the EU will show some teeth.

I think you're paraphrasing from Maciej Ceglowski amazing "Haunted by Data" talk from seven years ago.

Everyone should watch it https://www.youtube.com/watch?v=GAXLHM-1Psk

I was about to say, they’ve been told for years how toxic it is! Just not by enough people I think. Great talk indeed.

It is impossible to make a person understand a thing which their livelihood depends on them not understanding.

That’s kind of a false dichotomy; lots of things are both assets and liabilities.

I work at a megacorp, and we have an entire group that goes around auditing projects to ensure compliance with data rentention policies, which include mandatory deletion of different types of data at different timeframes.

Financial transaction records have a very long mandatory retention, IP addresses for logins have a fairly short mandatory deletion. Product telemetry has strict rules about avoiding PII and very very quick deletion (aggregate data can be kept longer).

I’m sure the policies could be improved, but I suspect every large company is intensely aware of the importance of data deletion, even if competing priorities sometimes lead to longer than technically/legally required retention.

I work on the Privacy Engineering team for one such company. Data retention is a huge topic and while there are often good guidelines, there usually aren't hard-and-fast rules. It's an exciting specialty for anyone that enjoys ambiguity (I like to joke that I enjoy the space since my dad was a philosophy professor). It also pays well and is recession-resistant.

> very very quick deletion

What is very, very quick? And why?

14 days in many cases, 24 hours in some. That quick because it is very hard to ensure that app telemetry doesn't have any confidential / sensitive information. And if the purpose is troubleshooting, there's no value in old data.

When finding the proximate cause, it's pretty important to know whether a problem started today or went unnoticed for a month.

isn't it both? It's valuable fuel and radioactive waste? I see 2 immediate problems though: 1. you don't know when the fuel is exhausted or if you can reuse it in the future so you stockpile it; 2. the contamination is much worse than the local radioactivity, so it's hard to manage correctly.