Hacker News new | past | comments | ask | show | jobs | submit login

Well, I personally choose not to provide it as a matter of principle, but regarding those who do click "agree" the position (both legal and moral) is that they don't really choose to consent.

GDPR permits multiple legal basis of processing data (e.g. the need for data to fulfil a specific contract), but they generally don't apply to processing all kinds of semi-relevant data for targeting advertising. Consent is a legal basis under GDPR if and only if it's truly voluntary; one of the key criteria is consent being feely given. You can't "trade" something for that permission (give me consent and I'll give you X, refuse consent and I'll refuse X), it must be freely given because the user wants to give that data, because they believe that it's good for them for the service provider to have and use that data. I.e. you can voluntarily choose to allow tracking for advertising purposes because in that case the ads are more relevant to you, or you can refuse that tracking if you think that this is not what you want.

So the idea is that privacy and consent to violations of privacy is not something that I can trade away (e.g. by choosing to visit a site) - it's not for sale, they can't buy it, I can't sell it. Offering something in return (e.g. the ability to visit the site) can not be a way to obtain consent. If refusing consent will result in access being revoked or some other bad consequences (e.g. losing discounts) then it's not considered a free choice. (GDPR recital 42 "... Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.)

They can deny people access to the site. But if they extract a click on "I agree" by forcing to choose to click there or go away, then that click does not and should not be counted as a consent to violate people's privacy; these rights are fundamental and they can't be given away with a click or sold for some money or traded away as a point in, for example, an employment contract. Revoking access (or threatening to revoke access) to a site is not a legally (and morally) valid way to gain permission to violate the privacy all their users.

And that is the intended point of GDPR - there should be no way for web companies to structure their legal or technical mechanisms in a way where they somehow obtain a permission to abuse the data of all their users. They can use some data of everyone for specific limited purposes (e.g. the legitimate need clause). They can use data for whatever purposes specific people choose to volunteer. But they do not, and should not have a way to "extract permission" to simply sell all their users privacy to third parties; nothing they can do in their privacy policy or terms and conditions or web click-throughs can provide that - the intended result is that they can't get the permission from everyone to do everything, and they actually have to stop doing many of the things they currently list in their privacy policy.

And that's what I want Verizon Media to do - it's not that they haven't done some ritual to legitimize their tracking, it's that their current tracking is fundamentally illegitimate no matter what legalese they write in their terms and conditions, and they should stop the mass invasive tracking of all their users except the minority who might intentionally opt-in for whatever reason. And if they don't stop it, they need to be forced to stop.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: