A disastrous technical glitch with Temporary Accounts has been reported on fr:wp and administrators there are mounting a cover-up. What happened is that a French administrator ran a test in which he forbade the Wikimedia to place a cookie on his device but it did, as he found out when he closed the window and the cookie was cleared. The report at fr:Wikipédia:Le Bistro/4 décembre 2024#IP, not IP et maintenance was swiftly removed, but here is an English translation:
From this discussion [link] you will see that "Temporary accounts" (which will arrive on Fr:wp in just eight weeks unless we stop them) will sound the death knell of the Wikipedia movement. The Regional Court will go berserk (it happened in Germany and it will happen here). They will issue an injunction to take down the website and impose a huge fine which will eliminate the Foundation's financial reserves and put an end to donations (who will make a donation to Wikipedia when their donation will go to the European Union?) How much will the fine be? Five airlines have just been fined 200 million euros for contravening European Union regulations. For popular websites like Google (and Wikipedia) the amount will be billions.
As someone with knowledge of product development, can you open a dialogue with the appropriate authorities on how to avert this impending disaster? 156.61.250.249 (talk) 13:06, 7 December 2024 (UTC)Reply
When you watch the Pippi Longstocking video on YouTube, before it starts you see an ad for Hertz Car Rental. A clickbox in the ad invites you to "Learn more", just as the notice which the consumer asking about Temporary Accounts does. The difference is that when you accept the "Learn more" invitation the page comes up with two boxes "Accept Cookies" and "Reject Cookies".. You cannot go any further until you have clicked one of the two boxes. Every website displays the options because it's illegal not to. Wikipedia is the sole exception. Do the Foundation realise what the European Union will do to them or do they just not care? 156.61.250.249 (talk) 14:29, 8 December 2024 (UTC)Reply
- If there is an issue with temporary accounts and cookies, I would assume it's a bug, not intentional or some kind of cover up conspiracy. As to cookie acceptance banners, there is likely a good reason Wikipedia doesn't have them, such as that obtaining consent for strictly necessary cookies isn't required by GDPR, as opposed to third party marketing cookies (which Wikimedia does not allow). Steven Walling • talk 19:04, 8 December 2024 (UTC)Reply
- I agree with you so far, that "strictly necessary cookies" can be used without specific authorisation from the consumer, but the temporary account cookie records the consumer's movement across locations by logging each IP address used. The Regional Court is pledged to take down every website which uses these additional cookies without telling the consumer in advance their purpose, that the consumer can continue to use the website without them, that she has the right to deletion of all the information they collect, and specifying the third parties who can access the information.
- The Regional Court orders takedown of websites which do not comply as a matter of course, but the threat to Wikipedia is the unique features of this cookie, involving tracking which will enable those in possession of the information to "doxx" consumers, the release of the information to third parties who cannot be identified, and the inability to recall the information when the data subject asks for it to be recalled. It's not the third party marketing aspect but the third party possession aspect which worries the Regional Court.
- Never before in data protection history has personal data been revealed without the consent of the data subject to more than a handful of website employees whose identities are known. What is proposed here is revelation to hundreds of thousands of unidentified third parties whose activities will go unmonitored because there is no requirement to make an entry in a transparency log detailing what information has been abstracted and the purpose for which it has been abstracted. Once the information has been collected there is no way of recalling it. The impending sh**storm will make the ongoing proceedings in the Indian High Court look like a vicarage tea party. 156.61.250.249 (talk) 12:33, 9 December 2024 (UTC)Reply
- Hello again. I'm delighted that you're asking pertinent questions of the development team over at MediaWiki. The major question has yet to be asked - perhaps you could ask it? Currently, virtually everyone will have access to tracking data as editors move between IP addresses, thus making real-life identification easy. It's true you will need 300 edits, but as they point out, you can amass 300 edits in an hour if you know where to fix typos. This invasion of privacy is illegal because the victims have not been told about it and have not given their consent to it. They say in their defence that the scheme is an improvement because fewer people than at present will have access to IP addresses, but that's not the point. The people who at present give out their IP addresses have consented to do so, possibly because they know that if they change IP address no link can be made to those used previously. Not only will the people who will be caught up in this scheme be unaware of how at risk they are but most of them will not know what a temporary account is. They may assume the account number is an IP address with the guaranteed anonymity that currently brings with it. Please run these points past the team and make sure they respond. The Arbitration Committee conducts thorough investigations of doxxing, so I am notifying @Liz: (congratulations on your appointment!) so they can be ready to act if necessary. 156.61.250.249 (talk) 12:35, 10 December 2024 (UTC)Reply
- Sorry but I don't think I agree that it's an invasion of privacy. If you edit Wikipedia it's a public action and you are warned that your IP address will be shown. Temporary accounts are actually more private than the system we have today. If you have concerns you should post them yourself. Steven Walling • talk 17:18, 10 December 2024 (UTC)Reply
- To avoid hiding the wood with the trees, can we take the points one by one? Here's a flowchart:
Is a cookie which links all IP addresses used by the data subject "a strictly necessary cookie?" YES...NO...(Please check appropriate box).
As soon as I get your response I'll continue the chart as follows:
YES NO
| |
| |
| |
V V
Waiting to hear from you. 156.61.250.249 (talk) 18:46, 10 December 2024 (UTC)Reply
- You are asking the wrong person about cookie policy on all Wikimedia sites. I do not have influence on this issue and I am not a lawyer. Steven Walling • talk 18:59, 10 December 2024 (UTC)Reply
- Please mull on this overnight
13.1 Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all [emphasis added] of the following information:
(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;
(b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; — Preceding unsigned comment added by 156.61.250.249 (talk) 19:44, 10 December 2024 (UTC)Reply
OK, I'm wending my way through GDPR and I've reached Article 13 (unlucky for someone). I've added paragraph numbers to the above quote. Other provisions of this Regulation read as follows:
13.1 (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
13.1 (e) the recipients or categories of recipients of the personal data, if any;
13.1 (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
13.2 In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
13.2 (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
13.2 (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
Now, we know that when the unregistered editor says she wants to edit she is told a temporary account will be created for her, and after she edits this is confirmed. She is told nothing else, so in my book the scheme is illegal for violation of Article 13 (apart from any other violations). Do you agree? You don't need to be a lawyer to answer, just have a normal command of the English language, and as a former WMF executive you obviously do. I'm asking because if you do agree it's 99.99% certain I'm right. Then we can go to Trust and Safety and say "It's cast iron that your scheme is illegal, what are you going to do about it? 156.61.250.249 (talk) 19:43, 11 December 2024 (UTC)Reply
- You are flogging a dead horse here. I worked at the Foundation a decade ago before GDPR even existed. I neither know nor care about enforcing EU regulations. Steven Walling • talk 20:17, 11 December 2024 (UTC)Reply
.png){kind=logo}
.jpg)
.jpg)
