Hacker News Reader

Comment by alkonaut | Hacker News Reader

It should be called Reject-O-matic or you might get the impression that it’s ever used to consent to anything…

While you aren't wrong, somebody might get the dumb idea that "If a tool instantly rejects the consent then the user hasn't truly consciously made a rejection."

This is the flimsy excuse made not to respect the Do Not Track header. By making it so that it's a tool for expressing the user's opinion, be it negative or positive, it becomes harder to spin it as being a tool that does not actually embody the user's view.

For the GDPR, that argument would fail immediately. Since the GDPR requires consent to be explicitly granted, and neither conscious rejection nor automatic rejection would constitute an explicit granting of consent, the site would not have a consent to track.

DNT could be mandated as a prompt instead of ever included by default. Or does the GDPR require explicit consent prompt and selection per domain?

GDPR requires explicit informed consent for data not strictly required for the working of a <website|app|store|organization|anything>

A user giving consent to <site|app...> A does not translate into consent for <site|app...>.

And yes, the default for such consent questions must be "no"

Perhaps I was unclear. IMO someone picking "sure fine everyone track me" when setting up browser (DNT preference) first time should count as explicit consent for every site. And similarly choosing DNT for all should legally count as telling site not to track and not to ever prompt.

In addition to being explicit, consent must also be informed in order to be valid under the GDPR. This is not a blanket understanding of "I may be tracked on the internet." but a specific "X information may be used by Y data processors for Z purposes." If somebody is not informed of X, Y, and Z prior to giving consent, then it doesn't count. A browser-wide preference from years ago is not informed consent.

There is one and only one legal default under the GDPR: Do not track.

> There is one and only one legal default under the GDPR: Do not track.

This is immediately followed by every head of marketing (at least for US-based companies) asking "Okay, so how do we track those people?"

I'm not saying this is right. But it is reality. We normalized for two decades marketing leadership having the expectation that they can track every interaction, and prying that data away has been painful, especially for folks who really want to do the right thing but are told otherwise by their managers.

I agree, and that's why I try to avoid any prevarication on the point. Because the head of marketing will at some point ask developers to break the law. Treating privacy law as a grey area gives the marketers more room to pressure developers, and more room to throw developers under the bus afterward.

>This is the flimsy excuse made not to respect the Do Not Track header.

Not exactly. The issue was that a specific version of IE enabled that header without giving the user a choice. If a user explicitly chooses to toggle the header, or install an add-on, then that argument would not hold up.

Reply on news.ycombinator.com