Lack of interest Opt-In Cookies, Tracking, Receive saved Data - GDPR, DSGVO - European Law.

[hibiskus]

1.
I want to alarm the community, because i got a mail where one guy wanted to receive all his saved data, because now it is his right.
And he tried that for simple reason to see if he can sue me, because he literally said in the 2nd mail that he gives me another 48 the response or he will sue me.

I had before phpBB and the last 14 years it is lead by germans, and updated before few days before the law would come into effect, to be law compliant in front.
One of the changes was, that every user can Download all his saved Data all his Posts he ever did with a simple click from the profile panel.



So now I switched to Xenforo2 and i have to do it manually? and every time i fly to holidays i have to fear now that i can't answer a data request soon enough and get sued?

Please you have to implement that too, Facebook has also a Button for that, in phpBB it is Out-Of-The-Box because they are very strict when it is about laws, there are many trolls who will wait for it.

This is the Article 15 of GDPR - Right of access by the data subject - https://gdpr-info.eu/art-15-gdpr/


2.
Opt-In for cookies, where you have to accept cookies and analytics should be also out of the box, technically you are selling EU law non compliant software.
As specially when you have google analytics integrated, still everybody free to use, but out of the box i can't use it with EU law compliant.
And is very very simple i guess to implement that, you are using it on your Page to? Am I missing the Settings for that, or is this custom?
Also one where you can accept and not accepting doesn't have a effect is also not compliant with the law, but better then nothing.
But one example how it should be done and is more then 100% GDPR compliant can be find at - https://forums.macrumors.com
When you press on "Show Purpose" you get a full selection where you can tick off everything normal cookie, tracking cookies, analytic ..



This is the Recital No 32 of GDPR - https://gdpr-info.eu/recitals/no-32/

Those 2 things are essential because out of the box XenForo2 is not GDPR compliant, not anymore at least, as specially in strict Germany&Austria.
Since XenForo wants money for debranding which i understand but it makes it easy for troll lawyer or hacker to find a sue able or exploitable target.

 

[HWS]

There are several providers helping you with implementing any cookie consent solution down to any detail you would like.

For example:

For EU Cookie Law & GDPR Compliance | iubenda Cookie Solution

Our Google certified consent management platform (CMP) is easy to use, & helps you comply with laws like the GDPR, ePrivacy, CCPA+CPRA in minutes.

www.iubenda.com

Privacy and Consent Management Platform | Admiral

Manage consent to achieve GDPR and CCPA compliance. Protect visitor privacy, and integrate seamlessly with the company's existing revenue recovery.

getadmiral.com

and countless others....

Also keep in mind that you do not have to ask for consent to set any cookies needed for your website to be able to work (means no cookie set by default XF needs consent).

XenForo is officially in my opiniun selling illegal software.

This is simply wrong and ridiculous. No wonder you don't get any official response to this thread.

 

[hibiskus]

Even if it was "ineffective" it doesn't mean it is not meeting the requirements legally.


That stock XF cookie notice? That is a pretty big & clear statement which indicates the context in which a user is or is not accepting the terms.

You have only now proved that you cannot interpret any legal texts correctly or at least cannot assign relevant topics. In school you would now get an F- from me for a complete misdemeanor.

You have differentiate between indicating just something or getting a real acceptance.
If I accept a 20 million deal, it won't just be because I read that I accepted it. I have to make a clear indicating signature under the contract.

 

[Kevin]

You have only now proved that you cannot interpret any legal texts correctly or at least cannot assign relevant topics. In school you would now get an F- from me for a complete misdemeanor.

You have differentiate between indicating just something or getting a real acceptance.
If I accept a 20 million deal, it won't just be because I read that I accepted it. I have to make a clear indicating signature under the contract.

And you have proved that you are unable to understand the very thing you have posted yourself, are unable to show how legally XF is not complying with the requirements, and, apparently, refuse to accept that maybe, just maybe, the XF guys have already gone down this path in the past to see what they needed to do to comply.

 

[hibiskus]

There are several providers helping you with implementing any cookie consent solution down to any detail you would like.

For example:

For EU Cookie Law & GDPR Compliance | iubenda Cookie Solution

Our Google certified consent management platform (CMP) is easy to use, & helps you comply with laws like the GDPR, ePrivacy, CCPA+CPRA in minutes.

www.iubenda.com

Privacy and Consent Management Platform | Admiral

Manage consent to achieve GDPR and CCPA compliance. Protect visitor privacy, and integrate seamlessly with the company's existing revenue recovery.

getadmiral.com

and countless others....

Also keep in mind that you do not have to ask for consent to set any cookies needed for your website to be able to work (means no cookie set by default XF needs consent).



This is simply wrong and ridiculous. No wonder you don't get any official response to this thread.

There's someone else who's proven he can't read carefully. Did you even pay attention to the whole thread?

This may be true, you don't need to ask for consent for cookies that are associated with basic functions.
But I use Google Adsense you 9 times smart, are those fundamental functions? I don't think so or wait I know it, ITS NOT, it's a difference to believe.

No what simply is true, is that you don't have any clue, you are just a sheep an look what others do.

I asked a 2 **cking laywers, what do you want more?

 

[hibiskus]

And you have proved that you are unable to understand the very thing you have posted yourself, are unable to show how legally XF is not complying with the requirements, and, apparently, refuse to accept that maybe, just maybe, the XF guys have already gone down this path in the past to see what they needed to do to comply.

Again you didn't read carefully, but i can understand if its gone down.
You know that XF is shipped with Google Analytics or even Ads?
If I set this to on, out of the box, i am doing a crime in legal manner.

Maybe you got it now?

 

[HWS]

There's someone else who's proven he can't read carefully. Did you even pay attention to the whole thread?

Missing your manners....

Good luck.

 

[hibiskus]

Missing your manners....

Good luck.

True, but sometime you have to scream and spitt, burn few cars. To get heared..
The Christian had also no manners keeping the truth locked that the earth is round.
Maybe if there had screamed a few more people, we would have already self flying electric "cars" and cancer would be cured.

Everytime those people, hey let everything like it is,... like old people who can't figured out to call 991 for a hear attack from smartphone.

Edit:
Thanks for the luck very kind of you! :*

 

[Kirby]

Specifically what part of GDPR? A site is well within their remit to delete data they control and refuse access to anyone they please for any reason.

Nope There have been several court decisions in Germany that board owners can't just ban users as they like.

Kerpen, AG, Virtuelles Hausrecht in einem Internetforum - JurPC-Web-Dok. 0081/2017

www.jurpc.de

As far as XF cookies are concerned:
Some of them (like xf_session and xf_csrf) do not require consent as they are technically required, others (like from_search could be problematic.

Google Analytics could be problematic as well if you want the base legal data processing on GDPR 6.1 literal a, in which case consent is required - the default XF cookie notice (which can just be ignored and in fact many users just do exactly that while continuing to browse the site).
If you want to processe data based on GDPR 6.1 literal f, which Google Analytics might (not necessarily must, especially not if user IDs are being used or multi-device tracking) also fall under, consent is not required.

However, an Opt-Out is always required and out of the box XF does not offer a solution here.

And there are way more GDPR pitfalls (do not use Gravatar, do not use StopForumSpam/Project Honeypot/Akismet, do not allow to use [img], do not enable URL unfurling, do not use social embeds, limit storing of IP adresses, limit storing of user change logs, do not give staff/moderators access to PII (email, IP, etc.), do not use Add-ons like Login as User or Multi-Account detector, etc.)

 

[Slavik]

Nope There have been several court decisions in Germany that board owners can't just ban users as they like.

Kerpen, AG, Virtuelles Hausrecht in einem Internetforum - JurPC-Web-Dok. 0081/2017

www.jurpc.de

While google translate isnt going to be the best, it would seem this case hinges around contract law and the interpretations of the T+C's on signup.

 

[Kirby]

Yes

The forum had terms similar to those used for XenForo community forums:

We may remove or modify any Content submitted at any time, with or without cause, with or without notice. Requests for Content to be removed or modified will be undertaken only at our discretion. We may terminate your access to all or any part of the Service at any time, with or without cause, with or without notice.
[...]
These terms may be changed at any time without notice.

According to the court decision, these terms are invalid (paragraph 61-66) and therefore cannot be enforced.

As the forum, just like XenForo community forums and probably most online forums, did not define a cancellation period in their terms of usage, the law default (6 months) is to be applied.
So the board owner could not just ban the user and immediately terminate his account, they have to keep the account open and allow the user to post for another 6 month if they file a proper notice of termination now.
After this time the account is properly terminated and must be deleted, it cannot be banned as in this case the usage contract would still be active.

 

[Tealk]

Opt-In for cookies, where you have to accept cookies and analytics should be also out of the box, technically you are selling EU law non compliant software.

Opt-in is only required if cookies are not necessary for operation.
If advertising or analytics by google is integrated Xenforo is not responsible for integrating the cookie option.

Facebook does it to

And you really think Facebook is GPDR compliant?

It is EU law, ypu must be able to Opt-Out!

What "must be able" to opt-out?

I have a feeling you're throwing some information all over the place.

But I use Google Adsense

This is only your problem and not XenForo's.

You know that XF is shipped with Google Analytics or even Ads?

So I deal a lot with avoiding google and have nowhere found an integration of these two. The only thing I don't like is the Google Captcha because there should be a local version as default.

True, but sometime you have to scream and spitt, burn few cars.

Why can I really imagine that you would bring such mindless actions?

Nope There have been several court decisions in Germany that board owners can't just ban users as they like.

In your forum you have house authority and can exclude who you like. As long as you do not violate the AGG.

Google Analytics

Third party providers have already been announced as disproportionate:

https://www.datenschutzkonferenz-online.de/media/oh/20190405_oh_tmg.pdf

Spoiler: Quote

 

[twollert]

Can me someone explain how macrumors solved that?
Is that an addon, or is that custom made?
If it is custom made why the **** are they not selling it or put it out for free?

Did you found out how MacRumors solved that? I'm looking for a opt-in cookies solution too.

 

[HWS]

Did you found out how MacRumors solved that? I'm looking for a opt-in cookies solution too.

MacRumors use a PreBid setup with it's own GDPR solution. Either custom made or one from the many GDPR solution providers. It has nothing to do with Xenforo.

 

[hibiskus]

GDPR watchdog’s investigation finds that tracking and consent pop-ups used by Google and other major websites and apps are unlawful.​

GDPR watchdog’s investigation finds that tracking and consent pop-ups used by Google and other major websites and apps are unlawful.

The Belgian Data Protection Authority (APD-GBA) has found serious GDPR infringements in the system Google and others use to legitimise online tracking. The system behind nearly all of the consent messages that pop up on screens in Europe has been found to infringe the GDPR. The APD-GBA is the...

www.iccl.ie

 

[djbaxter]

yawn GPDR is out of control.

 

[duderuud]

That may be so but it is the law. So you have to deal with it.

Most of us are "lucky" to own a small website (compared to Facebook/Google/etc). Regulators usually don't give small websites much attention. But again, we must follow GPDR regulations as much as possible.

 

[hibiskus]

That may be so but it is the law. So you have to deal with it.

Most of us are "lucky" to own a small website (compared to Facebook/Google/etc). Regulators usually don't give small websites much attention. But again, we must follow GPDR regulations as much as possible.

Exactly i was already victim, it is only a matter of time when trolls will search out simple XenForo Installations over google and border them.

 

[Faust]

Exactly i was already victim, it is only a matter of time when trolls will search out simple XenForo Installations over google and border them.

Set your forum invitation only. Keep it small, and enjoy it.

 

[hibiskus]

Set your forum invitation only. Keep it small, and enjoy it.

Sorry but i really hate answers like that. You have nothing better to do? Nothing then aggression appears to my mind.
People like you are the reason why we will extinct. Thank you so for nothing!

My Forum is for anticensorship and crypto, so i never will consider to make it invitation only. Also it will still be against the law, but i guess you don't have big things planed in your life. You make things bigger they will be complicated, and I will not run away from that.. I like to play with the big boys, you can go back to your children's playground. Here are discussing real man about real world problems. You can smoke your pot some where else and ignore important problems. You not understanding it or here getting not enough attention doesn't change the fact that this is a important topic and no one is aware. Please don't waste your time with writing an answer, your short sentence shows already how deep you are in that matter, no further exchange needed.

 

[mcatze]

Sorry but i really hate answers like that. You have nothing better to do? Nothing then aggression appears to my mind.
People like you are the reason why we will extinct. Thank you so for nothing!

Keep calm...