https://kotlinlang.org logo
Join Slack
Powered by
<https://www.drupal.org/project/gin/issues/3475773...
# random
s
y
Ultimately, I'm happier having to deal with bureaucracy than with the widespread loss of privacy. This case seems really annoying, though. I can see an argument that we can't allow local storage of even a binary option like that because then you can store a ludicrous amount of binary options to still encode a user cookie lol! Choosing dark-mode is user-triggered, but one can argue "user-triggered" about anything, including that interacting with any button on the website is a trigger for cookies to be stored.
👍 2
s
GDRP is about to be reevaluated and might get more relaxed. Some aspects definitely are hell. I'm hoping that cases like these will be exempt because localstorage/cookies are a very standard practice and users should expect that basic browser functions will be used while visiting websites. pretty much the same argumentation they needed in order to make any modern car with cameras legal
👍 1
s
Yeah, I try to do it properly, but that's hard. I avoided any cookies (as they are send to the server on each request), but I use local storage. I was thinking hitting the dark mode button could be considered a consent, but it can't. https://github.com/themesberg/flowbite-react/issues/546
The issue with GPRD is that Facebook was meant, but it hit everyone else.
s
didn't hit facebook though. either don't use facebook or accept their tos including loss of your life
s
Indeed. It didn't hit them, but made life for everyone else harder.
s
also not even sure if they paid for any of their lawsuits yet
➕ 1
s
Today I learned that basically every website needs a privacy policy, because an IP address is considered personal data and you can't avoid this data being recorded in hosting providers access logs.
y
GDPR has been nice, personally, in forcing companies to let me access and delete my data.
s
If they do GDPR right they exclude technical data that you can't avoid and don't store on purpose and allow local-only data like dark mode preference. I'd expect only needing a privacy policy if I actively collect data (like in a contact form or offering a user signup)… or if I send data somewhere (like the cookie would send users preference to the server)
➕ 1
In Germany we have the issue that small errors (like forgetting to mention storage duration for example) can trigger lawyers to send you cease and desist letters and charge 3000€ for it. This is a nasty business model in Germany. Running a webpage is risky.
s
ah no those are not really valid anymore. some even lost their license. I wouldn't be afraid of that personally. worst case a court forces you to employ proper gdpr measures but a fine is rather unlikely
s
Of course GDPR has its uses, but ultimately big companies can afford lawyers and do what they want. They just have to declare it all properly. Some pages have multiple screens of privacy policy. Very scary. I think a good service has a short privacy policy.
@S. when did that change?
s
it never changed, such practices like making a business model from suing people have always been unlawful
also there are no damages to compensate, it's up to the data protection authority to impose fines, not some bored lawyer via threat letters
s
The lawyer doesn't do the fine. He charges for the time he invested, his worktime. There's a German loophole that they can charge for that. AFAIK it’s only possible in Germany.
If the warning is legally justified, the recipient normally must reimburse the sender for reasonable legal costs connected with the letter, including standard attorney fees calculated under the German Lawyers’ Remuneration Act (RVG). Those fees grow with the assessed “value in dispute.”
That means a lawyer earns a fee for drafting/sending the letter and can have those costs paid by the recipient if the claim is valid.
ChatGPT. That's how I understand the system.
Netzpolitik says that this is only possible in Germany.
I didn't hear anything that the risk is gone.
s
https://t3n.de/news/google-fonts-abmahnanwalt-drohungen-schlaegertypen-1537577/ one of those was a german lawyer but not sure what the endresult was
for the austrian case I know that the decision was against the lawyer
s
Haha, well deserved. Those lawyers that wanted to get rich quickly by basically stealing money from others are absolutely miserable people. They shouldn't be surprised by such a response of their victims. They didn't do it because they care for privacy. Thry don't care. They only did it to get rich. Otherwise they would send a free hint first and only go after people not reacting.
👆🏻 1
I like the writing style a lot. https://www.krone.at/3090563 So great if justice is served.
s
Yep. Still a good idea to be as compliant as possible ofc but I'm not really afraid of such cases, especially if you're a private individual and not some data hungry US company. And just a heads up, that's a very nonserious tabloid, comparable to axel springers Bild.
👍 1
c
I don't think that ticket is accurate? • First, if you don't send the light/dark setting to the server, then it's not information that can be stolen, and therefore isn't relevant to GDPR • Second, I don't think a light/dark setting counts as personal information, and if it doesn't, then GDPR doesn't apply to it IANAL tho
s
From what I understand the tickets have a point. GPRD is really that bad.
GDPR is not about sending things to the server, it's about storing it at all. And light/dark mode setting saving is not strictly necessary functionality. So you'd need to ask the user for consent or just don't store it. As the discussion goes on it turns out that many people to it this way. But every time someone asks a lawyer the answer is mostly the same: > Both the toggle button and the sidebar (in the purchased template) write directly to local storage without the user having to agree to the storage of data beforehand. However, according to the German Telemedia Act, only the necessary storage without consent is permitted. I have contacted my lawyer and asked for legal advice. He confirmed that this would be a violation of the GDPR because both the theme and the sidebar are not necessary for transmitting the data.
I'm confused that so many see cookies & local storage as the same thing here. The big difference is that cookies are send to the server with each request (which makes them problematic) and local storage stays on the device only.
➕ 1
The main issue in my view is that GDPR is just not a well-made law.
c
The storage constraints are specific to the German law though. The GDPR itself doesn't forbid storing, only sharing (and storing-in-places-where-someone-could-steal-them if it's PII).
s
In a well made law they'd just say (regardless of cookies, local storage or another store being used) that you are not allowed to track users without consent. The decision shouldnt be made between "strictly necessary" and "optional". Because dark mode preferences are not stricly necessary. That's the wrong way to put it. It should be all about tracking.
The storage constraints are specific to the German law though.
The German law is what I fall under, so I'm concerned.
c
That's the wrong way to put it. It should be all about tracking.
That's exactly the approach of the EU GDPR law. It's the German law you don't like
(which is fair)
The EU GDPR doesn't even impact non-PII
s
Ah, I understand. I didn't separate those in my mind, because I need to follow german GDPR.
Thanks to ChatGPT I see that this local storage thing comes from § 25 Abs. 1 TDDDG, which is a german law that can be considered an addition to GPRD.
IANAL, but that law doesn't speak about browser. In that regard all my apps would need the user to ask for consent before saving anything on disk - like writing log files and such. So stupid.
I'm brave and just added this to my policy. I'll let you know when I receive my warning letter how that worked out.
Okay, maybe this is even better, because it clearly says that user interaction is necessary.
Hopefully that's not considered a dark pattern
It feels off to show a cookie banner when the user hits that toggle, because I know no one that does that - even though it's not really legal in Germany
c
Hopefully that's not considered a dark pattern
Honestly if anyone tries prosecuting that _a dark-mode setting_…
Also, I don't know the accessibility laws well, but I do believe having a dark mode is mandatory in some countries
s
There are some really awful people out there. We talked about Mr. Hohenecker here.
c
(but that's not the first time laws are contradictory—in France it's mandatory to store IPs in logs so the police can find out which user did what, but it's also forbidden to store IPs in logs because it's PII under GDPR)
💯 1
😆 1
s
Doesn't have to be contradictory. Gdpr has 69 opening clauses where each country fills in their own laws.
👀 1
That's why its often called a limping regulation, idea was uniform laws but negotiating those didn't work out.
s
The more laws they add to the pile, the more complex everything gets
s
Especially ones as vague as in the gdpr. And exactly the reason why it might/hopefully change in those aspects. At least every other country on this planet is pressing for it
s
In the link they discussed the issue that a localStorage property was written automatically for design issues and without user interaction. I hope that this was the main cause of the action. If a user hits a button I hope we can assume that the user expects the setting to be saved for revisits. If I state in my privacy policy why and how I do that, I hope everything is fine.
s
Regarding the French case, I think its art 6, if certain data is necessary in order to comply with other laws then you must collect and store it. It's not against the gdpr
s
It just feels off that for really basic questions like that everyone would be required to speak to a lawyer. They make masses of money for just answering FAQ questions, lol. So dumb. The law makers should clarify those questions from the beginning.
But this is exactly where you see that they never asked an developer when coming up with these laws.
The dark mode localStorage question is one of the first things everyone would ask I think.
Germany is so ambivalent anyways... Germany = Privacy is super important Also Germany = So you run a personal website? Please tell the world your living address and phone number.
😅 1
☝️ 1
Speaking of... I just visited https://kt.academy/article/compose-desktop (see #C0BJ0GTE2)... I DECLINED the privacy policy. And now look at this. 😅
image.png
I guess if I was in the business of sending warning letters I'd always find work. 😅
y
I've heard it said that such laws, in practice, only affect middle-sized businesses. No one goes after the little guys because it's not worth it, and the big guys are too big to fail, or they simply pay the fine as "cost of doing business". It seems like, in an effort intended to punish the big guys, the German GDPR ended up incentivising scummy lawyers to go after the little guys.
💯 1
s
Yeah, they aimed for Facebook and hit me. Especially in Germany.
Once you start to look for those things you'll find a lot. Checked some other pages and most of them create massive amounts of cookies even with declining cookies or not accepting the privacy policy.
4 Views
Open in Slack
PreviousNext
Powered by