Hacker News new | ask | show | jobs
by Braunbart 2174 days ago
It's important to note that most of these consent boxes are not GDPR compliant.
3 comments

Yes, the most "funny" ones are the ones which pretend you can decline/configure the tracking but only sets you on a long chain of "configure here" links until you end up in a dead end. Or they let you configure non-essential tracking but the essential tracking you can not switch off contains all the worst tracking sites and is definitely not essential for the technical operation of the site... Also this site tend to have over 100 different trackers which is totally insane.
... and once you are through with it they need a few minutes to "save" the choices.
And at the end "saving" fails "for technical reasons. Try again later."
I see that we are talking about Oath... what they are doing is so blatantly illegal.
Any site giving me the Oath popup i just instaclose. Even if it's linked from a site i regularly check, like HN.
And flag the HN article.
Me, too.
And they probably don't handle the case where you have instructed your browser to not accept any cookies - that is at least an option lynx gives me and an option I seem to remember from my youth in Netscape.
I wish there was a browser extension that would file a complaint with the Information Commissioner's Office for me whenever I encounter one!
The ICO is the UK's regulator. Complaints can be made online: https://ico.org.uk/make-a-complaint/cookies/
is this a real possibility? can you file a complaint online?
> can you file a complaint online?

Via email, yes.

I just saw that that's UK, I guess one would have to file per country, or in multiple countries? There is no EU-wide point to file complaints?
There is: https://edps.europa.eu/data-protection/our-role-supervisor/c...

There is also an online dispute resolution center: https://ec.europa.eu/consumers/odr/

This allows you to complain about a European company if you deal with it from another EU country.

The first one isn't what you think it is. It is, AFAIK, only for complaints against EU institutions. For everything else (national, local, private and non profit entities) you need to contact the relevant national data protection authority
You only need to know who your own regulator is for the country you live in. You file complaints to your regulator, and they collaborate with the regulator for the country where the company is established. This is called the "One-Stop Shop Mechanism" for GDPR: both consumers and companies only have one regulator to contact.
Exactly, the issue is enforcement.

GDPR is actually quite clear and logical on the notion of consent. Implicit consent is implied for anything essential for a service, everything else has to be opt-in.

And while "dark patterns" (making it difficult to opt-out of tracking) might frustrate some, this practice won't help offenders before a court. GDPR isn't tied to any one mechanism (such as cookies) but for collecting PII of any kind; required. free consent can legally only be given if the instructions and consequences are clear.