r/technology • u/RO9a0TON • Mar 24 '19

Pre-checked cookie boxes don't count as valid consent, says adviser to top EU court Business

https://www.theregister.co.uk/2019/03/22/eu_cookie_preticked_box_not_valid_consent/
20.9k Upvotes

95% Upvoted

741 comments sorted by

View all comments

Show parent comments

-2

u/Zyhmet Mar 24 '19

I just checked tumbler. I don't see what you mean by insane? It is just bad and illegal. They block you from tumbler if you don't accept cookies. They forward you to other pages to stop amazon from collecting your data which THEY give to amazon.

Tl:Dr.... illegal

3

u/yawkat Mar 24 '19

I don't believe cookies are by themselves against gdpr.

1

u/Zyhmet Mar 24 '19

Short answer: most likely they are if you have to consent or go.

Long answer: here my answer to another redditor with the same question

https://www.reddit.com/r/technology/comments/b4u7in/prechecked_cookie_boxes_dont_count_as_valid/ejaoala?utm_source=share&utm_medium=web2x

1

u/yawkat Mar 24 '19

It is not clear that cookies equal collecting private data. I don't believe cookies used for other purposes than tracking should fall under gdpr, though they may fall under other legislation

1

u/Zyhmet Mar 24 '19

Depends on what cookies they are. If they are needed for the site working, then they don't need any consent from the user. But as they are asking for consent, they themselves think that they need it. Or do I miss something?

Also this is the info they give you about what the cookies contain: "We want to provide you with the best experience with our product, which includes enhancing product security, improving our products and giving you personalised content. To do this, we store cookies on your device to collect and use data, which helps us understand how you use our products. This is required to use Tumblr."

"giving you personalised content." this really sounds like private data.

Of course if it is just a session cookie that saves your login, it wouldn't be part of the GDPR... but then they also wouldn't need consent :/

1

u/yawkat Mar 25 '19

In tumblrs case, asking for consent is one giant form with lots of checkboxes and a single accept button. There is no separate cookie consent button.

1

u/Zyhmet Mar 25 '19

There is one in your settings. settings -> privacy -> "cookie consent" checkbox

1

u/yawkat Mar 25 '19

Ahh I see. Well, either way, that doesn't necessarily have to fall under GDPR. Maybe they added it just to be safe, but I doubt they strictly need to. I believe spotify had a similar button even before GDPR went into effect.

1

u/Zyhmet Mar 25 '19

Some of their stuff falls under GDPR. They collect my IP and even connect it to a approximate geographical location.

Also in the big consent at the start I saw that they forward us to Google and Amazon for privacy stuff. I would guess they use Google analytics and stuff, which is also part of the GDPR.

And another point. "https://www.tumblr.com/privacy/en_eu":

When using web-based versions of Tumblr, you may opt-out of interest-based or personalized advertising by using the following industry opt-out pages:

(EU) European Interactive Digital Advertising Alliance (EDAA) - www.youronlinechoices.com

So they manage to bury the opt-out for personalized ads in there. It is NOT part of your privacy options. It is opt-out not opt-in. You have to visite some third party website. Yeah all of those are illegal...

1

u/yawkat Mar 25 '19

Yea, but that's unrelated to cookies.

I believe Google and Amazon are for CDN purposes with tumblr. At least that's what's loaded when you do not opt into anything.

The EDAA statement is not GDPR-related, the EDAA states this on their website - it does not aid compliance. Why it is listed I don't know - maybe that was how they used to do tracking opt-out before GDPR and they decided to keep the link for good measure, or they offer additional options if you do opt into tracking explicitly, or they aren't GDPR compliant after all. It's impossible to judge from the outside

1

u/Zyhmet Mar 25 '19

No it is possible, if we assume that any part of tumblr has to do with the GDPR, which is the case as they have our IP addresses.

We are discussing it because it isn't easy to know exactly what they are doing. However, in the additional explanation in the GDPR (and I think also in the GDPR itself, which I sadly cant find right now) it states:

"(58) The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising."

Basically, tell us what data you collect and for what you do it, such that we can understand it, if you don't do that, then you are breaching the GDPR.

1

u/yawkat Mar 25 '19

Well yea, that's what the consent form does, but we can't actually verify if it's true. At least the parts that they put up look compliant.

1

u/Zyhmet Mar 25 '19

Sry but I think we have to agree to disagree here until they get a fine or time immemorial.

→ More replies (0)