Forum Moderators: webwork

Message Too Old, No Replies

Study: GDPR Cookie Consent Undermining E.U. Privacy Rules

         

engine

3:34 pm on Jan 13, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



A short while back i'd mentioned about the bad implementation of the cookie consent, required in the E.U..
In a new study published at Cornell University, it discovered that only 11.8% of the top 10,000 sites it evaluated actually meet just the absolute minimum, based upon GDPR.
we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. We found that notification style (banner or barrier) has no effect; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points.

Dark Patterns after the GDPR: Scraping Consent pop-ups and Demonstrating their influence.
PDF [arxiv.org...]

tangor

7:25 am on Jan 16, 2020 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Yet another example of bureaucrats failing as technocrats.

News at Eleven or Twelve or two centuries...

DixonJones

2:01 pm on Jan 17, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



Yet another example of bureaucrats failing as technocrats.


Well, that depends on your standpoint. This also demonstrates 80% of technocrats failing to understand human values and rights. It is not at all unreasonable for people to have a right to their personal data only being handed over EXPLICITLY. It is not that difficult to do, if you accept the premise and get on with it. I now:

- Delete the last three digits of a visitors' IP address in logging systems, (Google analytics offers this, as does Matomo)
- Our online chat also masks the last 3 digits of the user's IP address. If they want to be emailed a response, they have to explicitly enter their email address, which is a much more targeted way of collecting data anyway.
- Only when the user signs up to a free account do they end up having to have some personal data collected, so again, the consent moves from explicit to required. Only at this stage are they asked about mailing preferences.

So - we do not require a GDPR banner... because our cookies are not personally identifiable until and the user actively signs up - at which point the terms of service come into effect. I am also not spending resources spamming or tracking users that never have any intention of materially engaging with the business. So - Win-Win.

RhinoFish

8:00 pm on Jan 17, 2020 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Well, that depends on your standpoint.

See "Do Not Call" list... :-)

DixonJones

8:54 am on Jan 18, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



See "Do Not Call" list... :-
)

I’m lost there.

DixonJones

9:01 am on Jan 18, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



[See "Do Not Call"... :-)


I suppose you mean that in order to know someone does not want to be contacted, you need to store information about them. True. But that is fundamentally different to not storing information about a person until they request or require it.

RhinoFish

9:28 pm on Jan 21, 2020 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I meant that bureaucrats do have the power to actually make the Do Not Call idea a reality, and it certainly is not a technical issue stopping them from being effective.

And if we let bureaucrats off the hook, regarding their responsibility to protect our privacy (on Do Not Call and GDPR / CCPA), by stating that technical issues were even remotely the cause of their ineffectiveness, then we're the ones to blame.

bill

2:01 am on Jan 22, 2020 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



So - we do not require a GDPR banner... because our cookies are not personally identifiable until and the user actively signs up - at which point the terms of service come into effect.

I'm doing this with all my sites in the hope that I really don't have to implement those silly banners/pop-ups. I have been asked a few times to implement banners/pop-ups and they seem to stop asking when I describe the complexity of the issue and request a budget.

As the article says, it would probably just be a lot easier if sites were legally required to honor Do Not Track.

tangor

2:04 am on Jan 22, 2020 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



it would probably just be a lot easier if sites were legally required to honor Do Not Track.


Heh heh! As if that will happen!