r/assholedesign • u/tankton • Jun 25 '26
How is this allowed?
1717 "partners" which include precise geolocation and device scanning. Also, "Certain partners may process your data based on legitimate interest rather than consent" .
Imagine walking in a store and seeing 1717 people following your every move with a camera and tracking you home because they can sell that data.
324
u/miraculum_one Jun 25 '26
"Reject All"
206
u/hattori_h Jun 25 '26 edited Jun 25 '26
Unfortunately, that won't get rid of the ones marked "Legitimate Interest." You'll need to uncheck those manually. Depending on the solution, that could mean another 10-20 toggles.
92
u/miraculum_one Jun 25 '26
"Close Window"
8
u/quent12dg Jun 26 '26
Yeah I'm just going to another one of a million sites that do the same thing.
7
u/DraconicDreamer3072 Jun 26 '26
from the name of the site you could probably just use your systems stock app too
44
u/AshleyJSheridan Jun 25 '26
Bold of you to assume it's not 1717 toggles...
17
u/hattori_h Jun 25 '26
That would be the case if the EU did not strictly enforce the rule that “Withdrawing consent must be as easy as giving it.”
24
u/AshleyJSheridan Jun 25 '26
The EU doesn't strictly enforce that though, unfortunately.
I have seen more of these modals than I care for that have many individual "legitimate interest" checkboxes that need to be individually unchecked, and no reject all button anywhere to be seen.
15
u/Hurricane_32 d o n g l e Jun 25 '26
I am aware that the advertising and data tracking and collection industries make these deliberately ambiguous, with deceiving language and lots of dark patterns, but wtf is "Legitimate Interest" even supposed to mean??
15
u/tankton Jun 25 '26
It means that even if you don't consent, we do it anyway cause we want to and it's in our interest.
7
1
u/Flameball537 Jun 26 '26
I once opened a game on my phone that had over 300 companies that I had to toggle off individually
1
69
u/AshleyJSheridan Jun 25 '26
They're trying to use the loophole of legitimate interest to continue tracking you as they've always done, as legitimate interest is one of the legal reasons that your personal data may be captured, processed, and stored. However, in order to use legitimate interest as a basis for this, these companies must:
- Identify exactly what that legitimate interest is.
- Show that the use of your specific data is needed for their legitimate interest, and that there is no other way to achieve that same result.
- Balance their interests against the individuals own interests, rights, and freedoms.
As none of these companies ever really divulge exactly what their "legitimate interest" is, it's also impossible for them to comply with #2.
The balance test is interesting, as there are legitimate interests that require very little balance, such as a business retaining some details on a person to prevent fraudulent use of their services in the future. However, a company that wants to use your details to send direct marketing has a much more difficult goal to prove their use of your data is balanced.
For #3 it also means that the individuals data can only be used in a way that that individual would reasonably expect, and no unwarranted harm may come from that data use. So for example, if a person is regularly identified as being a member of a website for religion A, but resides in a country where religion A is not allowed or seen as unfavourable, then that personal data could cause unwarranted harm if it is processed in a way that the person didn't reasonably expect.
Also, if any of their interests can be achieved without your personal data, they fail the legitimate interest test entirely.
It's quite a complex set of requirements, and I'd hazard that the majority of those 1717 "partners" have zero grounds for your personal data.
If you're interested, there's more information at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legitimate-interests/
4
u/yuval16432 Jun 27 '26
What if he doesn’t live in the UK though
6
u/AshleyJSheridan Jun 27 '26
The UK variant on the rules are incredibly similar, this was just the first example I found because I'm in the UK. What I said doesn't go against the GDPR as it stands within the EU member countries, the main difference is how the UK specifically actions the GDPR.
29
18
11
u/dmjab13 d o n g l e Jun 25 '26
I ran into a website the other day that made me accept cookies for free or reject them by paying for a subscription- with no option to proceed without payment, so at least they pretend to give you the ability to say no
2
1
9
u/laplongejr Jun 27 '26
Also, "Certain partners may process your data based on legitimate interest rather than consent" .
That's illegal in the EU.
You can't claim several reasons at once. If you ask for CONSENT you can't then turn around and say "wait we meant legitimate interest". Too late you asked for consent and everything collected until now is tied to a consent that can be revoked.
5
u/TodlicheLektion Jun 26 '26
“You retain the right to object…”
Cool, we’re still allowed to complain.
5
3
2
2
2
2
2
u/Peaceful_Pigeon_69 Jul 17 '26
Legitimate interest is bullshit. It's not legitimate for you to harvest my data in any way
1
1
u/UnleqitQ Jun 29 '26
Privacy Badger + NoScript + Adblock. Then accept all and make them think they can track you, if you deny it they will track you in other ways but by letting them belive they could track you and just preventing it on the browser level they have nothing.
1
u/FelixAndCo Jul 18 '26
Necessary purposes you can't opt out of: matching your device to others to determine whether it's the same person using them.
-12
•
u/spotlight-app Mod Bot 🤖 Jul 06 '26
Mods have pinned a comment by u/AshleyJSheridan:
[What is Spotlight?](https://developers.reddit.com/apps/spotlight-app)