Does anyone have any idea how to actually do that? How do I prove that a given user actively checked a box?
a) been willfully unclear about what it means to subscribe to a list
b) changed what our mailings are like over time.
We can stop doing (a), with effort, but I don't see how (b) will ever go away. So this is going to be continuous, active effort with subscribers. I would like to think that very easy, reliable, one-click unsubscribe will be sufficient.
In reality, I doubt there will be a practical difference to how it has been handled in the past here in Germany, where similar law has long been practice.
That means: your sign-up page needs a checkbox, that cannot be pre-checked, and that clearly states that it's an opt-in to receive these mails. This needs to be separate from any acceptance of ToS or anything else that is necessary for the transaction in question.
To verify the form submitter's identity, send a verification to their e-mail address (if you haven't already). Make sure the verification email does not already contain any advertisement itself.
Even if you've been building up your mailing list for years, following generally accepted good practices, and only signing up genuinely interested recipients, it seems you could now to be in a position where either:
(a) when you signed people up, you provided sufficient information about what you would be sending to them and you can still produce evidence of that today;
(b) you need to contact everyone on your list to obtain explicit, specific consent for whatever you actually send to your list; or
(c) you have to remove anyone who isn't covered by (a) or (b) above (or delete your whole list).
As with so much about the GDPR, what will be accepted as reasonable evidence of informed consent for earlier subscribers to a mailing list is ambiguous, and the consequences of either doing too much or not doing enough are undesirable.
Like T&Cs, everybody knows that most people don't read them. Nobody's going to start quizzing their user, so what's a reasonable compromise? Forcing the user to at least scroll through some (or all) of it before agreeing. You make it clear that the intention is for you to read it, and that you're agreeing to something you should have read.
Obviously make sure to otherwise comply with the GDPR as you do this.
All you have to do to comply with it is be clear and direct when collecting personal data, and make a record of the permission granted.
Things like proper confirmed opt-in help.
It appears that you also need to have been all of those things, as far back as you've been collecting personal data, even if no such requirements existed at the time. Organisations might not be in that position even if they followed accepted good practices when signing people up to their lists, so the GDPR may have unintended consequences here.
In particular, the consent requirements are significantly stronger under GDPR than under either the 1995 directive itself (95/46/EC) or the implementations of that directive in various member states.
Organisations that followed reasonable and honest practices at the time of collecting personal data, for example when setting up a mailing list, could still find themselves out of compliance under the new rules.
Neither do I. It's the organisations who were complying with the letter of the law, the spirit of the law, and generally accepted good practices at the time and still won't be compliant under GDPR that I'm worried about.
As a concrete example, every single charity that I support regularly has written to me at some point over the past few months, in order to get the kind of explicit consent they apparently believe they need to continue communicating with their supporters exactly as they have been for years before.
Now, there are really only two possibilities here. One is that all of those charities have this wrong, despite their resources and surely having taken professional legal advice on their particular situations. The other is that the usual HN suspects who maintain that the GDPR isn't a big deal and doesn't change much in practice are underestimating the concerns the GDPR raises for these legitimate organisations wanting to send legitimate communications to people who have previously been happy to receive them.
Since those exercises mean my donations are being wasted on red tape instead of their intended purposes like literally helping to cure cancer, I think it's fair that I have a problem with that.
But equally, you're leaving out the possibility that charities really were clear and honest about what they would like to send and really did provide a genuine choice, yet would fall foul of one of the technical requirements under GDPR that wasn't in force at the time. This is probably the case for most if not all of the charities I support myself, so absent evidence to the contrary I have to assume it was widespread practice.
People keep talking about the "spirit of the law", but there's a danger that this becomes a euphemism for "what I wish the law had said, even though it didn't". Usually when people contrast the spirit of the law with the letter of the law, they are making a point about avoiding the obvious purpose of legislation by relying on legal technicalities or subtle implications that most people wouldn't pick up.
In this sort of case, I don't see how it's against even the spirit of previous data protection law if a charity clearly and honestly stated that it would like to send information to donors about how their money was being used, which probably many donors would indeed like to receive, but for example they checked the box by default. There was an explicit provision for businesses to send marketing mail to previous customers or prospects without requiring consent at all, as long as it related to products or services similar to what the recipient had been interested in before and as long as some reasonable requirements about opting out were met, so clearly this isn't some absurd idea just dreamed up by charity fundraisers.
There was no trickery involved. Not even slightly, not in even one case where I was choosing to be a supporter. The indications of what would or wouldn't be sent were invariably perfectly clear, and the only things that ever have been sent were in line with what was stated.
Again, "dark pattern" is too often used as a euphemism for "something I don't like". If you have a genuine option that is clearly shown, that's not a dark pattern. And if most of the people filling in the form are going to choose to turn on that option, I fail to see how having it turned on as the default is unreasonable either.
We're not talking about something presented deceptively in the middle of a long and complicated page full of other options to add some unwanted but chargeable extra on your holiday booking here. We're talking about charities doing important work wanting to show their supporters that the money they're donating is making a difference, and showing an immediately clear and readily understood option that is part of a short, simple form for supporters to fill in. They did ask for real consent. You just don't like how they did it, and I'm not sure why your personal opinion should outweigh widely established practice that was doing no real harm.
There are going to be organisations wasting time and money on reconfirmation exercises for mailing lists they've been building up for a long time because despite using double opt-ins, only sending relevant messages to people who genuinely want to receive them, and providing readily accessible options to opt out again, they didn't record exactly what the wording said on their web site on 13 April 2008 when someone signed up to that list.
Clearly the GDPR sets out different requirements now, but my original comment stands: things are changing, and this is going to introduce significant burdens even on a lot of organisations that were following reasonable and honest practices when they collected personal data before.
The fact that they're all contacting people saying "We need to re-gain permission under GDPR" just means that a bunch of organisations were, and still are, clueless about data protection. This, combined with the lack of fines, should be somewhat reassuring to the GDPR sceptics. The laws are widely broken; the regulator hasn't been seeking fines; this is unlikely to change in future under GDPR.
As someone supporting these charities and whose personal data is being used to send the updates on what they're doing, I (and others in a similar position) am the person who is supposedly being exploited undesirably and in need of protection here. And yet, as I wrote before, I was quite clear about what I was expecting to happen when I filled in each form, and none of the charities I deal with regularly has ever done anything I would consider abusive or beyond what I knowingly agreed to. I really would prefer it if they didn't have to waste their resources on this and instead spent them on whatever good work they would normally do, but since every single one of them has contacted me anyway, I have to assume that something about the GDPR-related changes is preventing that from happening.
Of course, from a security standpoint where the attacker is assumed to be totally untrustworthy, this is all nonsense since it would be trivial to fake. It does require a certain amount of trust that the company that will not stoop to faking documents.
I guess you could continue the charade by putting timestamped screenshots on a blockchain :-)