1. 15

    I’m under the impression that opt-out is not allowed under GDPR, only opt-in. The question is, then, which this UI is. I’d argue it’s opt-out.

    1. 1

      The trick is that, had I clicked the button “Sounds Good, Thanks!”, I would have opt-in.

      1. 17

        IANAL, but I think this pretty clearly violates the GDPR. From the GDPR’s preamble:

        If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

        It is not clear, because it uses a dark pattern (using color choices) for the user to read: “We care about privacy -> Sounds Good, Thanks”. Also, I would call unticking 338 companies unnecessarily disruptive. Moreover:

        Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

        Again, I would call manually unticking 338 pretty detrimental.

        1. 5

          GDPR Recital 32 is particularly informative. I’ll reproduce paragraphs 1-3 here (reformatted for clarity):

          (1) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

          (2) This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data.

          (3) Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

          While reading (3) alone you might think that this system would be contrary to law, I think in the broader context it’s probably okay? Your attention is being drawn to the fact that you have to give consent to use of your personal data (the modal). You can either look for more information, or say okay. So I don’t see this as a pre-ticked box within the meaning of paragraph 3.

          However, it’s definitely shady (and common) practice. I think it’s borderline, and it would be fair for the regulator to raise concerns. I suspect that the “not unnecessarily disruptive to the use of the service” will actually count in InfoWorld’s favor here. The Correct Solution would be to offer a deselect all.

          1. -1

            Playing devil’s advocate here, but they don’t actually need to untick 338 checkboxes, they only need to click “deselect all” as the author did.

            1. 9

              Ehm… the author had to untick 338 checkboxes because there is no “deselect all”.

              It took a while, actually, but I hate to be manipulated.

              1. 3

                Sorry, somehow I misread that. I stand corrected.

          2. 4

            Yeah. I feel like that’s against the spirit of GDPR, if not the text. I guess the courts will decide. 🙂

            1. 2

              And if not GDPR violation, Shamar and others can sue them in class action for the damage to their hands from 338 checkboxes. Each violation will pay a fine equal to the sum of their users at risk of arthritis or carpal tunnel. That’s on top of any GDPR fines.

        1. 4

          It seems to me like the problems with null all stem from the fact that it is implemented as a bottom type, not the fact that it exists at all. Are there languages that implement null as a separate type, and not a subtype of all types? Is there a good reason why most languages don’t do this?

          1. 12

            Are there languages that implement null as a separate type, and not a subtype of all types?

            At this point you’ve got option, because it’s no longer legal for a variable with type T to contain a null. Instead, to contain a null that variable must be of a union type T|Null, a.k.a. option a.k.a. maybe. There are lots of languages that do this (Kotlin, Swift, Haskell, Scala, Rust).

            1. 3

              Ruby, but that’s probably not what you mean.

              1. 3

                TypeScript does this with the strict null checks flag on.

                1. 2

                  Yes, in .NET F# is a good example of this if you’re not interoping with C#. In C# we’re finally reaching a point where nullable reference types will no longer be the default and must be explicitly declared and will have proper compile time checking. It will be a warning by default for new projects, and you can also choose to make it a compile time error if you want.

                1. 5

                  You may not need Server Sent Events, either, depending on what “real time” means to you - sometimes it really means “less than a minute”, or just “faster than our competitor”. I’d always start with polling, unless I was sure it wasn’t going to work.

                  1. 2

                    I’ve also been wondering whether one can poll with HTTP persistent connections that delay the response for as long as possible. What do you think?

                    1. 2

                      What you’ve described is what the author of the article (and others) call long polling. It definitely works! There are some downsides especially for mobile devices, but it’s definitely a viable approach in many situations.

                      1. 3

                        Yeah, it’s what everyone was using before SSE came out.

                        Long polling is strictly worse. It’s just like SSE, except the connection is restarted on every message.

                        1. 1

                          I’d appreciate it if you’d describe why it’s worse. Why does the connection need to be restarted? An HTTP persistent connection wouldn’t need to be restarted would it? You’d need to send the HTTP header again but not the TCP handshake.

                          1. 1

                            Er, I don’t mean the TCP connection, that can be kept alive, sure. Yes, the HTTP request (which is a “connection” conceptually on both sides) is restarted.

                            1. 1

                              Interesting. Is it really so expensive restarting an HTTP connection?

                              1. 2

                                Technically not very expensive, but a) just feels like a horrible hack and b) pretty much always requires custom state tracking (like requesting messages since a timestamp) – with SSE, you only need that if you want resuming. You have an open stream on the server side, you just write into it whenever you want and data comes out on the other end.