Hacker News Reader

Comment by kuschku | Hacker News Reader

I'm wondering if this might not be illegal under several countries' data privacy laws.

Users need to be directly and visibly be informed, if and when data of theirs will be transmitted to third parties.

As Google's ReCaptcha is based on tracking what websites you visit, what search terms you enter, correlating this data, and comparing this tracking profile of yours, it's quite problematic that the user doesn't even see any captcha anymore. With the previous captchas, site owners could keep pushing the legal problems to Google, partially.

But this new solution doesn't fit with the EU Data Privacy Directive in neither intention nor letter of the law.

IANAL, this is not legal advice. You can not use this in court.

View on HN

To use the reCAPTCHA service you must agree to its Terms of Service agreement that clearly specifies that you must inform users on the collection and use of the data collected by reCAPTCHA + get consent from EU users [1]:

> You acknowledge and understand that the reCAPTCHA API works by collecting hardware and software information, such as device and application data and the results of integrity checks, and sending that data to Google for analysis. Pursuant to Section 3(d) of the Google APIs Terms of Service, you agree that if you use the APIs that it is your responsibility to provide any necessary notices or consents for the collection and sharing of this data with Google. For users in the European Union, you and your API Client(s) must comply with the EU User Consent Policy [...]

The "EU consent policy" from Google is here:

https://www.google.com/about/company/user-consent-policy.htm...

[1] https://termsfeed.com/blog/privacy-policy-recaptcha/

I can see this easily addressed by a TOS. Even the subtle ones like "clicking that button means you agree to [link to TOS]" covers it, no?

Nope, not at all. ToS terms and EULA terms are basically null and void for such things under EU law.

You actually have to make a separate, opt-in checkbox, directly informing the user what will happen.

I think you are raising a valid point but this is outside my expertise. Could a site owner satisfy the EU Data Privacy Directive by simply notifying users that their activity is being provided to Google to prevent abuse on the site? I imagine something similar to the cookie warning.

The spirit of the EU directive is that you must get consent from your users before you attach third party cookies to their browsers. The setting in the browser is not enough because most people don't even know about it (not that they care about the cookie law banner). So I guess it will be the same with the captcha, if the information sent to Google can be used to track people. But I'm not a lawyer.

CDN also make requests to this party sites and that is never disclosed anywhere.

Why resort to flimsy legal methods when you can just use uMatrix and block those requests directly? It's your computer, after all.

Reply on news.ycombinator.com