Do lax and lazy cookie messages comply with cookie laws? On a web page, I received a cookie pop-up that looked like this: Which reads as: We use cookies. You probably don't care. Click the button to get rid of this pointless message. Whatever (the button) This seems pretty lax and lazy. Does it comply with cookie laws? If it helps, I am in the USA. I have very little legal experience, so tell me if I should clarify or add details.
The ePrivacy Directive Cookies are governed in the EU by the ePrivacy Directive which was first passed in 2002, and revised in 2009. However, if a site places a cookie, and later reads the cookie and stores an indication of the cookie content, this may be personal information and thus also subject to GDPR rules. (Other privacy laws, such as the CCPA, may also impose requirements on cookie use, when they apply.) Note that the so-called &quot;EU cookie law&quot; is a directive and not a regulation. This means that it is up to the various EU countries to implement it in their national legislation, and different countries may implement it in different ways. It would be the actual laws in individual EU countries that would be binding on website operators, and I am not going to try to find and analyze all the various laws on the topic. Paragraph 25 of the directive (linked above) reads: However, such devices, for instance so-called &quot;cookies&quot;, can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose. This should mean, if implemented straightforwardly, that cookies, beyond those absolutely essential to the operation of a site, can only be placed if a user is notified of the intention to place them, and freely consents. This can be done once per user, on an initial session. Users are supposed to be provided with provided with &quot;clear and precise information&quot;. I do not think a simple statement that the site uses cookies fulfills this. At the very least the purposes for which cookies will be used should be provided. The directive does not make clear what level of detail about individual cookies such a notice must provide. The notice described in the question neither describes the purpose of cookie placement, nor does it offer any meaningful choice to accept or reject them. As such, I do not think it would be compliant with the directive. If cookies are read back (which is after all pretty much the point of having them) and can be potentially identified with an individual, then under the GDPR (article 6) there must be a lawful basis for processing them, and the interaction above would not be enough to establish consent as a lawful basis. There might be some other basis that does not require consent, however. Interpretations from others This page from cookiebot explains some of the history of the directive, and how it contrasts with the GDPR (which is a regulation, and so is directly applicable without the action of national legislatures). This page from The Verge discusses recent changes in the directive and the guidelines for applying it, and criticizes how it has been complied with, and ignored, by many sites. Cookies and the GDPR This page, &quot;GDPR, and the ePrivacy Directive&quot;, from GDPR.EU says: ... cookies, insofar as they are used to identify users, qualify as personal data and are therefore subject to the GDPR. Companies do have a right to process their users’ data as long as they receive consent or if they have a legitimate interest. Passed in the 2002 and amended in 2009, the ePrivacy Directive (EPD) has become known as the “cookie law” since its most notable effect was the proliferation of cookie consent pop-ups after it was passed. It supplements (and in some cases, overrides) the GDPR, addressing crucial aspects about the confidentiality of electronic communications and the tracking of Internet users more broadly. To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: Receive users’ consent before you use any cookies except strictly necessary cookies. Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received. Document and store consent received from users. Allow users to access your service even if they refuse to allow the use of certain cookies Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place. That page also describes the proposed ePrivacy Regulation which, if passed, will replace the current directive, and links to drafts of it. Conclusion The site described in the question probably does not comply with legislation implementing the ePrivacy directive. Depending on where it is hosted and targeted, and what it does with cookies that it sets, it may fail to comply with the GDPR as well. There has been very little enforcement of the directive so far. This may change in the future, particularly if it is replaced by a regulation, as has been proposed.
A web site that is serious on protecting some content behind a paywall will put the protected content, or a version of the page with both protected and unprotected content, on separate page or pages, so arranged that a user will not be able to follow the link until that user has signed in and been accepted as an authorized user. A site that merely uses CSS to hide "protected" content is not really protecting it. CSS is designed to be modified by the ultimate user -- that is part of its function. If the site chooses to send you content, you are entitled to read it. Even if some of the content has a CSS tag attached which suppresses or obscures the display of that content, they know perfectly well that any user can supersede this with local CSS, and so I don't see how they have any legal claim, nor any way of knowing if you have accessed the "hidden" content or not. If you attempt to bypass or hack a login screen, that might be circumvention under the US DMCA, or "Unauthorized computer access" under any of several laws.
It's a gray area. You won't know for certain until a case is tried by a court. Regulatory bodies are notoriously assertive on the matter of jurisdiction. If there is a gray area, they often assert jurisdiction first, then let the judiciary limit their authority. Also, if you try to ask the regulatory body for an opinion or "permission" in advance (as a prudent person might think to do), they might offer you one if you are lucky. But they will most likely qualify it as "non-binding." In other words, they give themselves wiggle room to change their mind at a later time to file an action against you. The long and short of it is, the scenario you describe is likely to at least cost John Smith a fortune in legal fees to litigate the matter with the California authorities. So it would be prudent not to give the advice in the first place. Even if he were to ultimately eventually prevail on the action.
In German Law you need to give your agreement ("Willenserklärung") to a contract or in this case terms of service. This is done by telling the other part. In some cases this can also be implied by an action (example: putting your bottle of beer onto the cashiers table is an offer to buy this bottle). As a second criteria a "Willenserklärung" needs to be the exact will of the part that declares its will (the website user in this case) §§ 133, 157 BGB or that the other side (you) could only see so (not the case here as this mainly speaks of content). If you visit a website and there are terms of services, the "Willenserklärung" is only given when the user read and agreed to the terms. If he did not, the terms of service are not applied until the user agrees to them. So I would recommend to block the website until the user agreed (overlay) as you need to proof he did when in court. Additionally there are so called AGB's in Germany. Those are contracts that are used or planed for many (more than 3) uses and set by one side (you). This may apply here, so you need to follow a lot of other rules like making sure the user had access and agreed, then there are many content restrictions and so on... I recommend consulting a German Lawyer specialized on this topic as this is very complex and includes other German laws for Media too, depending on the content of your site and terms. Also note that everything said is only based on my own knowledge and can not be used as safe legal source.
Would any offence be committed for: Having this on your person? Buying or selling this? Leaving it around for people to plug in to a computer? In the abstract, I don't think that this conduct would violate either Section 36 of the U.K. law or U.S. law, although, obviously, purposefully destroying a computer itself (i.e. actually using the device without the consent of the owner of the computer) would violate many U.K. laws and would also violate many U.S. laws at both the state and federal level. I also don't think that possession or buying or selling this product would be a crime absent some intent that it be used illegally, in which case there might be an "attempt" to commit a crime offense, or an offense that would make one part of a conspiracy to commit a crime. In the "leaving it around" example, there is arguably an intent to use it to harm another improperly, although the phrasing is ambivalent. While many statutes in the U.S. criminalize possession of burglary tools, or drug paraphernalia, sometimes with an associated intent element (although even these crimes often have an express or judicially implied intent to use element), I'm not aware of any statute that criminalize possession of tools for malicious destruction of property. So, if the tools aren't possessed or used in a manner intended as a step in the facilitation of a crime, I don't think that any law is violated. So far as I know, the U.S. does not have a counterpart to Section 37 of the British statute cited above (it isn't a terribly easy thing to search for to definitively rule out the existence of such a law because federal law has many uncodified crimes in unexpected statutes and there are many sets of state criminal statutes, not all of which are codified either). The example giving in the comments by @gnasher729 of possession of a hammer which could be used to do the same things that this object could be used to do is instructive. Arguably, this USB-like tool is more specifically targeted at malicious conduct. But, for example, when I used to work as a radio news reporter, we had a machine that was basically a high powered magnet that was specifically designed to destroy all information on magnetic media. This was, in part, so that it could be reused, but it was also so that confidential interviews wouldn't fall into the wrong hands once they were no longer needed, in much the way that one might shred paper documents. It isn't so implausible to think that a device like this one might be necessary for individuals or firms with national defense secrets embedded in their hardware and software to have on hand in order to destroy a sensitive computer in order to prevent a security breach, if necessary. In a case like that, leaving one of these devices around the office unlabeled might be negligent, but wouldn't have the intent necessary to be an intended crime. And, it is hard to imagine that the device itself, which seems pretty simple, would itself involve any technology that is a national security secret, so it probably wouldn't violate export control laws. Of course, possession, purchase or sale of such a specialized device, or leaving it around unlabeled would certainly be powerful evidence of an intent to use the device in a wrongful manner, and hence, of an attempt to commit a crime. Indeed, possession of such a device or purchase of one might very well be sufficient to establish probable cause to seize the device and arrest the person holding it on charges of an attempt to destroy a computer. But, this device would be merely powerful evidence of an intent to commit a crime, rather than something that is a crime to commit in and of itself. There are no international laws that govern this kind of thing. The only international laws applicable to individuals pertain to war crimes and nuclear and chemical weapons. Even then, most international laws direct member nations to adopt domestic laws on the subject rather than being self-executing.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
It's not clear whether you mean that the entire agreement is carried out by text message. If you have a paper or electronic document stating what the parties will do, that is the agreement, and signatures are a conventional form of proof that there is an agreement. A handshake or a verbal statement – or text mesage – could also serve as evidence of the agreement, though there could be problems with the quality of the evidence (e.g. how do the witnesses know which piece of paper you agreed to). There is not a huge body of law surrounding text messages (and apparently none regarding text messages and contracts). We know that a text message is not a "printed receipt" (Shlahtichman v. 800 Contacts), and that a text message is a "call" w.r.t. the Do-Not-Call law (Campbell-Ewald Company v. Jose Gomez, Keating v. Nelnet). The closest that I have been able to come in terms of a decision about whether a text message is "written" is Commonwealth v. Mulgrave 472 Mass. 170, which states that While Massachusetts appellate courts have yet to approve admission of text messages or any other writing under the spontaneous utterance exception to the hearsay rule... The wording "any other writing" implies that the court believes text messages to be "writing", which of course it is if you look at the plain meaning of the word "write". Contracts can be formed and signed by email: 15 USC 7001 states that a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form....a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation so the fact of electronic writing does not make the contract non-written. There must be a venerable and well-known rationale behind the written / oral asymmetry, which presumably has to do with the volatility of memory which would be front and center in a dispute about oral contracts. FRE 1001 "clarifies" that a "writing" consists of letters, words, numbers, or their equivalent set down in any form, and that a "recording" consists of letters, words, numbers, or their equivalent recorded in any manner. 15 USC 7001 also states that An oral communication or a recording of an oral communication shall not qualify as an electronic record for purposes of this subsection except as otherwise provided under applicable law So a recording of an oral contract would be useful to prove that there was an agreement, but would not change the fact that the contract is oral.
OK, so you understand that clickwraps do create enforceable contracts. the person "agreeing" to the dialog can arbitrarily manipulate the contents of the agreement terms So what? I can do a similar thing with a pen and paper agreement. You send me an agreement, I tell you I accept but secretly I have changed it. Well, guess what, when this ends up in court the judge won't care if I wiped my ass with it - I communicated my acceptance of your terms; therefore that is what I accepted. Under the hood, Google can show what the HTML was that their server sent to you and the http response that you sent back. They said "Do you accept?" you sent back "yes", deal done. What you did with the html in your computer does not matter one iota; just like what you did with pen and ink terms would.