Listening to the consent standards #CPDP2021 panel led by @nataliabielova

How to collect empirical data from websites about tracking? How to decide if consent is needed? How to evaluate if consent is valid?

Cristiana Santos is discussing their study of the IAB Transparency and Consent Framework https://www-sop.inria.fr/members/Nataliia.Bielova/cookiebanners/

Romain Robert ( @NOYBeu) discussing the Grindr case. Sometimes developers might not even know that they are processing personal data - they might just cut-and-paste code or use libraries from elsewhere.

How can users understand the choice between consent and legitimate interest in a cookie dialogue? Romain is using his mother as an example but I am much younger than her and have a PhD in Computer Science and am also confused by this!

The Norwegian DPA goes into a lot of detail about what valid consent is in the Grindr decision (I haven't read it yet - bookmarking the link here https://www.datatilsynet.no/en/news/2021/intention-to-issue--10-million-fine-to-grindr-llc2/)

Aurélie Pols - it can be difficult for developers to interpret and understand their obligations. Everyone needs to work together - don't point fingers.

We still have no mechanisms for verifying that what actually happens to data is what is said will happen in the privacy notice

Armand Heslot (CNIL) - it is the role of the ecosystem to come up with solutions that work

Cristiana Santos - IAB framework is becoming a de facto standard but is not compliant with Art 5(1)(b). Not specific, not explicit, not legitimate.

Benoît Oberlé ( @SirdataGroup) - we would like more transparency/explanations/control. In adtech there are so many companies involved in processing data - resellers, platforms etc. So controls need to be granular for each company which becomes complex.

Aurélie - is the IAB independent enough to be creating standards? Why not ISO, IEEE or someone else?

Cristiana - we need more guidance from EDPB and DPAs

Armand - CNIL has some guidance. They have looked at purposes and say that there are really only three purposes for ads. These must be explained to data subjects in the first layer - other information can be presented in another layer.

There is a question in the chat about using AI agents to give consent on behalf of data subjects (to reduce load). We and others have looked at this: our own studies have focused on social networks e.g. https://www.aaai.org/ocs/index.php/ICWSM/ICWSM15/paper/view/10493 https://arxiv.org/abs/1910.05265 

Romain: Belgian DPA is looking at the IAB framework right now so guidance might be coming

I have to run. There is no mechanism to thank the speakers on the @CPDPconferences website so thank you @nataliabielova!