Thread · 5 tweets · 21 Jun 2018

An excellent @EFF article on browser fingerprinting under the #GDPR. I disagree on only two points: eff.org/deeplinks/2018…

First, I don't think that fingerprinting can ever hold water under legitimate interest as it deliberately circumvents the "reasonable expectations of data subjects". It is, as defined by @w3ctag, unsanctioned tracking.

Second, legitimate interest is not some sort of inferior compromise between privacy and business. It is much better for privacy than consent, which abdicates responsibility to the user for a system so complex they can't possibly understand.

Consent also massively incentivises dark UX patterns. Those will be very hard to litigate. Legitimate interest forces those who know what is going on to act responsibly, and be accountable for it.

The idea that consent is good at scale for privacy is a fairy tale that needs to die. There's a reason why Google and the rest of ad tech are pushing so hard for consent. Hint: it's not out of the kindness of their hearts.