23 ms·

Norwegian Consumer Council report on how tech companies use dark patterns [pdf]

731 points by erlend_sh 8y ago

ckastner 8y ago
Page 14: [edit: number corrected, thanks] > As the screenshots below illustrate, the Facebook GDPR popup requires users to go into “Manage data settings” to turn off ads based on data from third parties. If the user simply clicks “Accept and continue”, the setting is automatically turned on. This is not privacy by default. Beautiful! A minimal demonstration of a clear violation of the principal of data protection by default (article 25 of the GDPR). It will we really hard to talk oneself out of this one.
- scrollaway 8y ago
  That flow was really scummy. I remember going through it. The entry point was an email claiming you have to "read and accept the updated policies in order to continue using the site". And the first thing you're presented with was that two-choice "Manage data settings" / "Accept and continue", implying for the user who is less than extremely careful that if you don't "Accept and continue", you won't be able to use the site anymore. It's only after that modal that you're presented with the updated T&Cs which you indeed need to either accept or delete your account. And of course all the various things people have noted: - A red dot in the fake-header to make you think you have pending notifications - A complete disregard for "privacy by default" All this right after Mark testified in congress saying "no we used to be bad and we made mistakes but now we really care, you see". For a site that despises transparency, Facebook has never been so transparent about how little it gives a crap about its users. I have some friends working at Facebook who will probably read this and be upset I think so little of their place of work. Folks, I have a huge respect for some of the excellent work that goes on at Facebook, especially in open source. But that doesn't change how scummy the core site itself is.
  - malka 8y ago
    Facebook will never care about Privacy. People like Zuckerberg are scum, and deserve jail. As an individual, I really do NOT want to live in the same society as this kind of person.
    - CaptainZapp 8y ago
      Mr. Zuckerberg cares a lot about privacy. Privacy for him and his family, that is.
  - lancewiggs 8y ago
    By staying at Facebook your friends are explicitly supporting these and other scummy actions. They have decided to hold their noses and prioritise themselves over humanity. Think less of them.
    - fsloth 8y ago
      "Think less of them." That's a horrible metric to apply measuring 'human worth', whatever that is. Humans are by default wired to do what everyone else is doing. Just using Facebook because everyone else is doing it as well is what humans do. They flock to the communities and forums where the action is. They cannot comprehend graph theory intuitively and what power Facebook potentially wields in interfering in their lives. Governments are supposed to protect people from threats the masses cannot comprehend. Like example taking care of vaccinations.
    - scrollaway 8y ago
      This is a totally inappropriate thing to ask of anyone. Please rethink your view on life. Edit: Also, that's not what "explicitly" means. I think you meant "implicitly".
      - TheSpiceIsLife 8y ago
        Superior orders, often known as the Nuremberg defense, lawful orders or by the German phrase Befehl ist Befehl ("an order is an order"), is a plea in a court of law that a person—whether a member of the military, law enforcement, a firefighting force, or the civilian population—not be held guilty for actions ordered by a superior officer or an official.[1] The Nuremberg defence is widely regarded as invalid. 1. https://en.m.wikipedia.org/wiki/Superior_orders https://en.m.wikipedia.org/wiki/Superior_orders
      - rickycook 8y ago
        some people work for charities, some people work for facebook. the employees make the company, and are complicit if they don’t react harshly to decisions made by their board like google employees did... if nobody wants to support the scummy tactics that “the company” is pushing, it won’t get done. sometimes you need to have a spine to get anything changed otherwise we are just heading for a blade runner distopia, and we in the tech industry are pushing us there as fast as our pay cheques can. people quit google over the military project because they didn’t agree with it. i don’t think it’s crazy to do the same over facebooks disgusting manipulation of their user base.
- dannyw 8y ago
  Note that Facebook still refuses to let you opt out of personalised advertising based on Facebook activity. This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB?
  - tehabe 8y ago
    The paper deals with this, it even says this gives the users the false impression of control. I remember this weird pop up if you allow Facebook applications of friends to access your information. It was never really clear if you agree or disagree to it by checking the check boxes.
  - adventured 8y ago
    > This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB? The GDPR fans on HN have said over and over again that GDPR wouldn't result in instant fines, that companies would be given a warning and an opportunity to make changes. We'll soon find out if that's true or not.
    - rickycook 8y ago
      facebook made their changes, and failed. they’ve played their hand, now it’s time for the law to tell them what utter bull it is. do you think facebook is going to change anything from now? the point of “no instant fines” is to give companies a chance to change and develop their GDPR systems. if those systems are both complete, and in violation, why shouldn’t they be fined?
      - fauigerzigerk 8y ago
        >facebook made their changes, and failed. That is yet to be determined by the regulator and the courts. Facebook has made their changes. Now someone will complain to the regulator. Then the regulator will make a determination and maybe ask Facebook to make further changes. Then Facebook has another opportunity to comply. If they refuse to make those changes they will get fined and can go to court to fight the regulator's decision. At least that is my understanding of how this system works.
- Arn_Thor 8y ago
  * page 14
- pfortuny 8y ago
  Oh: we made mistakes. They will not happen again.
- WorkLifeBalance 8y ago
  I noticed Twitch is doing the same thing, if you "manage your choices" you get the banner to "manage your choices" on every page load, the only way to get rid of the banner was to "accept" which accepts everything. (I hope it was just a 'bug' but it didn't feel like it.) I don't get it though, if companies are so scared of being fined 4% of revenue that they put up these banners, aren't they inviting the worse end of the punishment scale by trying to weasel around the law rather than just ignoring it completely?
  - ckastner 8y ago
    The worst offender I've encountered is imgur.com, where "click here to manage your privacy settings" brings you to a page with literally hundreds of advertisers. About half are on "allowed" by default. If you want to disallow, you have to select each entry individually. The other half only specify "requires opt-out", apparently imgur expects you to contact some third party to do so. How on earth they expect to weasel around the law with this ham-fisted approach is beyond me.
    - okanesen 8y ago
      Same goes with Tumblr and Yahoo for example, where everything is enabled by default and you have to go one (I'm not talking about 10-20, it's more like +300) by one to enable the tracking done by advertising/marketing companies. One of the better thing is, though I don't want to advocate the behavior of auto opt-in at all, that most of these sites are at least using something like TRUSTe or Oath, where you only have to disable hundreds of marketing services once and are done with all the sites, which are using the same service for cookie consent. It's against the law to make the options opt-out but these companies are still trying hard to don't obey by the law, it's really comical.
    - fauigerzigerk 8y ago
      >How on earth they expect to weasel around the law with this ham-fisted approach is beyond me. They reckon, perhaps correctly, that almost all websites weasel around the law and only very few of them will ever be fined. Privacy activists will go after the big fish first and there will be time for the small sites to correct course once it becomes clear what is and isn't permitted.
- passwd 8y ago
  > It will we really hard to talk oneself out of this one. I'm reasonably sure they knew it's a violation. So it feels like they're either prepared to fight over it, or testing the ground to see what the consequences are... After all, I would have guessed that they're in for major losses in ad revenue if most people sign out. So it's worth almost any risk.
- mort96 8y ago
  I would like to point out this message I got on the mobile Facebook website a month ago: https://i.redd.it/hh6xerkskmx01.jpg https://i.redd.it/hh6xerkskmx01.jpg "To personalise content, tailor and measure ads and provide a safer experience, we use cookies. By tapping on the site, you agree to our use of cookies on and off Facebook." Agreeing to something by tapping anywhere on the site doesn't sound enforceable...
a_imho 8y ago
Great summary, hopefully the EU can deliver what these companies are asking for.
- tbassetto 8y ago
  Doesn't invalidate what you said, but just in case: Norway is not in the EU.
  - digi_owl 8y ago
    May as well be, as via the EEA we seem to adopt more directives from Brussels than some full members...
    - EliRivers 8y ago
      Well, speaking as a Brit, allow us to demonstrate Norway++ We shall finish up subject to the full set of EU obligations and privileges, but everyone shall strongly agree that the UK is not part of the EU. No no no. Just in the various unions and so forth, matching all the rules and that sort of thing. Not part of the EU. Nu uh! :)
      - lapnitnelav 8y ago
        Plausible denEUbility?
      - pjc50 8y ago
        Yeah, this is the ""best case"" Brexit option: the same as now, except we've excluded ourselves from all the political institutions of the EU. So we have to accept all the rules and get no say in them. (The worst case option is the government is too disorganised to agree anything with anyone and we start running out of food, fuel and medicine...)
    - kazen44 8y ago
      The only thing holding norway back from full EU membership is fishing rights and a referendum on EU membership. Norway seems to actually accept its current political position inside the EU's sphere of influence just fine.
cs702 8y ago
Yes. Yes. Yes. Dark patterns ought to be illegal: They exploit the innate weaknesses of human perception and cognition to get human beings unwittingly to do things they otherwise don't want to do.
- Deestan 8y ago
  We already have functional laws against misleading (not just obvious lies) advertisements, so it should be no stretch to have similar ones for misleading instructions.
subroutine 8y ago
There was an interesting post related to this a few months ago, that maybe some of you missed and would enjoy... "Dark Patterns, The Ratchet" https://jacquesmattheij.com/dark-patterns-the-ratchet/ https://jacquesmattheij.com/dark-patterns-the-ratchet/
- walterbell 8y ago
  Thanks. A quote: > ... instantly all memory of the consent obtained will be forgotten. There is no way back. That ‘click’ of your mouse (or tap of the finger) was the ratchet advancing one little step. Good luck finding the permission you have just about irrevocably changed in a mountain of convolution designed to lead you astray in your quest to undo your action. Of course it would be trivial to have a log of recently given permissions and an ‘undo’ option for each of those. But there is no money in there and so you won’t find it. The ratchet has clicked and that’s all that matters, you ‘gave your consent’, time to move on. And so the company gets to claim that not only did you give your consent, you gave it willingly and obviously they would have never ever used your data without that consent.
minpur 8y ago
What a surprise! Microsoft villianised over the decades seems to be better than Google and Facebook. This brings us to the question. Have you paid XX money for a service that doesn’t show ads. Are you happy with it?
- digi_owl 8y ago
  Villains comes in all shapes and sizes. MS was, and possibly still is, the classical abuser of market position. The kind that age old antitrust laws were written to combat.
- 1125 8y ago
  Still I think there's a difference in how deep the intrusion goes. I can just not use Google (except it's harder on stock Android phones), but I can definitely go without Facebook by just not using it. Having my own Operating System to spy on me makes me a victim whatever I do. I can't really escape from that.
  - Vinnl 8y ago
    It's hard for me not to use Google's products because they're good, it's hard for me not to use Facebook's because they managed to lock me in using social pressure.
  - SmellyGeekBoy 8y ago
    Just use an operating system that doesn't track you? There are plenty out there.
- deleted 8y ago
  [deleted]
- tyfon 8y ago
  Microsoft _still_ does not let me turn off "Basic usage data/telemetry" being sent to them. I tried to call them about it a month ago and they hung up on me. The one computer in my house running windows is still blocked with this popup.
janlaureys 8y ago
Especially on mobile some of these cookie management screens I've seen lately are HORRIBLE. If you're gonna make me click on every single partner to opt out of their tracking, I'm just not gonna use your site.
- sideshowb 8y ago
  Or hopefully wait and watch while someone with more time than you takes them to court
- hadrien01 8y ago
  I use EasyList Annoyances with my adblocker, it hides all cookies/GDPR popups. If the website respects GDPR and waits for my click on the "Accept" button, I'll never see it and tracking shouldn't be enabled (many websites still don't respect that basic concept nonetheless)
  - stef25 8y ago
    Are you referring to "Fanboy's Annoyance List" here: https://easylist.to/ https://easylist.to/ ? I really want to get rid of all the cookies/GDPR popups.
    - hadrien01 8y ago
      I just checked, and apparently on mobile I use 'AdGuard Annoyances filter' and not 'Fanboy's Annoyance List' like on desktop. The former is a fork of the latter by Adguard, so I think it's about the same thing. EasyList's one works perfectly on desktop.
    - y0ghur7_xxx 8y ago
      This filter removes most of the cookie dialogs: https://github.com/r4vi/block-the-eu-cookie-shit-list https://github.com/r4vi/block-the-eu-cookie-shit-list
- alkonaut 8y ago
  Unless every tracking setting is off by default, they are clearly already in violation - so why would they then even bother having settings for it? Why not just track everyone and not ask?
dsco 8y ago
I was expecting "dark patterns" to be a hyperbole but these are clear violations of GDPR. This will probably catch public attention when the press gets hold of it and makes the screen shots more accessible (not hidden deep down in a PDF).
- marichards 8y ago
  The press gets hold of it and realises that they're littered with Facebook and Google integrations, their consent policy is little better and then they decide that they're going to publish this? The press has been suckered into this whole mess in its sacrifice to keep revenue from advertising
  - walterbell 8y ago
    Sacrifice is an interesting word choice when discussing digital gods of internet advertising. Press could use the photos of recently discovered mass-sacrifice skulls in Mexico City.
  - matt4077 8y ago
    „The media‘s” recent attention to digital privacy issues seems to disprove your conspiracy theories, and to show that journalists operate separate from their publications’ business departments.
    - zrobotics 8y ago
      How is this a conspiracy theory? I don't think that the business groups in publishing are any happier about the current state of affairs, but they have seen little option but to make themselves beholden to advertising companies. I doubt the irony of these articles escapes anyone in the media, but their failure to adapt early on has led them down this road (although gleefully embracing Facebook instead of their own sites as a way to spread content is not 100% Facebook's fault). It should be clear to anyone paying attention that current business models to sustainably support journalism have failed, and we are approaching (or have already reached) a point where only low-effort 'clickbait' and recycled AP content is profitable.
walterbell 8y ago
Good summary of dark patterns and consent, on page 7: > In digital services, design of user interfaces is in many ways even more important than the words used ... Dark patterns are considered ethically problematic, because they mislead users into making choices that are not in their interest, and deprive them of their agency. > This is particularly problematic given the power imbalances and information asymmetries that already exist between many service providers and their users ... a suspicion that tampering with default settings might remove important functionality, may affect the tendency to leave default settings alone. > ... information asymmetry in many digital services becomes particularly large because most users cannot accurately ascertain the risks of exposing their privacy. If a user is asked to trade their personal data for a short-term financial benefit, such as a discount, the actual cost of the trade-off is difficult to grasp. In this case, the short-term gain (discount) is tangible and immediate, while the potential loss (privacy) long term.
Angostura 8y ago
I presume this will get past to the Norwegian privacy regulator - https://www.datatilsynet.no https://www.datatilsynet.no
- emilga 8y ago
  Yes, it will. Here's a good news-article [0] giving context to the report. Quote: > Director of Digital Services in the Consumer Council, Finn Myrstad, says they will now ask the Norwegian Data Inspectorate [i.e. Datatilsynet] to assess whether Google and Facebook violate the new Privacy Policy (GDPR) that has entered into force in the EU. Furthermore: > The operation is coordinated with 23 European sister organizations in 16 countries. Of these, the Consumer Council states that 12 organizations will deliver letters to their respective data surveillance. At least six American consumer organizations are also behind the report. [0] https://nrkbeta.no/2018/06/27/facebook-og-google-manipulerer-og-villeder-deg-til-a-dele-privatlivet-ditt-mener-forbrukerradet/ https://nrkbeta.no/2018/06/27/facebook-og-google-manipulerer...
ttonkytonk 8y ago
Just noticed how chrome is giving me a notification to close all my incognito tabs (all one or two of them)
- Deestan 8y ago
  As porn (or "shopping for surprise gifts" for a more PR-friendly example) is a common use case for those, it makes sense to get a reminder to also close the tabs.
antpls 8y ago
Let's hope it goes to more EU consumer associations
grosjona 8y ago
I knew that someone would write about this eventually. Facebook's GDPR popup was criminal. When I got the popup, I accepted some default settings accidentally. Based on the context of the popup and placement of UI elements, I thought that the "Next" button meant "Proceed to my settings management screen" but in reality it meant "Keep default settings and proceed to Facebook".
jokoon 8y ago
I would pay money to have someone clean up my data online since I live in a GDPR country. I have this weird conspiracy in my brain that big IT companies are just fronts for what the CIA/NSA/governments need to do to do their job. I don't think those companies really care about getting your data, but government do, because governments saw and know that the internet is not something they directly control. Information is power, and it flows beyond the government's reach and proper authority. I don't really understand how those companies work so hard at great extents to get that data at the limit of the law or morality. I don't see how it's not the government doing this for security or economic reasons. Liberty and freedom of speech are important, but until the internet, governments were able to have their eyes on sensitive tools. Now citizens have access to technologies that can do a lot of things at the speed of light, so in a way, governments are losing control, so it's natural that governments are trying to get back the control they lost. Of course politically it's not going to please everyone, but I think that the golden age of information sharing is over. The problem is that escaping data collection will often be seen as ambiguous, politicized or very complicated, so you can't even justify it morally, you have to consent. I'm a little worried because because at some point you could have cyber activists that could resort to "cyber-terrorism" to attack companies that do data collection, and show it to the public. Sending users their own data would be one way to stain the image of those companies. Ironically, terrorism justified data collection. I don't think people realize how they are controlling their flow of thought and what they say when they know it can be heard. How many times I thought about what I was writing, knowing its trace could land somewhere that could have consequence on my image.
throw2016 8y ago
Without decentralization and alternatives criticism is toothless and hand wringing. Google and Facebook have developed this extremely invasive dystopic surveillance model and they are not going to abandon it. Its for users to abandon them. SV and the entire culture is operating in a moral vacuum, and everyone here knows it. All the talk about freedom and liberty has been exposed as posturing and what we have instead are the biggest sellouts in history.
sancha_ 8y ago
Couldn't find where I can change my GDPR settings in Facebook. Can someone send me a link?
dstdk 8y ago
Why not also include Linux in the list, to show that it is indeed possible to get "all green" score..
kennydude 8y ago
In contrast, Twitter's was well thought out and simple
hellofunk 8y ago
I just went through the "Manage Your Information" option on the FB website itself. It's terrible, every individual option only has a link to a long document you must read to figure out how to manage your information for only that one particular setting. Then you must separately do that yourself following the instructions, then go back to the Manage Your Information screen and select another of the many topics there and do it all again -- for each individual item in the list. FB really does not want to make it easy for you to quickly change all your settings.
lumberjack 8y ago
On the one hand it is good to deny them explicit permission. On the other hand I am 100% certain that Facebook is still tracking every single data point of every single EU user. They are not scared of breaking the law.
it_can_be_done 8y ago
You can do something to make a real difference. First contact data controller ex. Facebook, Google or any company which doesn't respect your privacy and rights, tell them to stop. If they refuse to take action then contact your national data authority and they will investigate it for you. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo.... Direct link to contact details: https://ec.europa.eu/commission/sites/beta-political/files/national-data-protection-authorities-jan_2018_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/n...
BrissyCoder 8y ago
Please - if there're no aliens stop up-voting this shit you Nintendo fanbois.
neya 8y ago
God, I wish someone added Quora to that list. After you read the first article, Quora masks all its content and forces you down the throat to sign up or sign in, pretending to be part of an age verification process (irrespective of the topic). I remember when this happened - I was so pissed off that I made an add-on called "fuck quora" that will simply reset their cookies to have unlimited reading possible without signing in. Will be happy to open source if the need be :)
- Fnoord 8y ago
  Please do! Though wouldn't it work to just never accept the cookie at all? I got very pissed off at Quora for the same reason, and made an account just to read (knowing full well they'd use it for profiling).
  - bo1024 8y ago
    Not sure about Quora, but I've noticed that many sites start you off with a big "Accept and Continue" popup and set cookies when you accept. So if you deny cookies, you can't get past the popup (it just refreshes).
    - Fnoord 8y ago
      IIRC you can read one article for free on Quora. But yes, that accept and continue is common and annoying.
      - isostatic 8y ago
        Private mode works fine with quora
    - mrhappyunhappy 8y ago
      Yep. They even try to make them clever by showing actual cookies or people getting slapped by a cookie. Even use words GOT IT to accept terms.
- pkkm 8y ago
heavenlyhash 8y ago
Those flowcharts and color coding are amazing. Everyone: even if you skim the rest of the article (mind, it's ALL worth reading), scroll to the last few pages and LOOK at those. They're color-coded by ease of flow (and yes, a definition of that was selected and clearly explained). I'm excited by this because I feel that often when we talk about Dark Patterns, conversations often devolve into a "both-sides"-ism pattern -- something which is as useless in UX discussion as it is in politics. These clear visualizations and starkly color-coded call-outs of flows that add extra work make it easy to compare flows, and point out ones which are obviously arcane.
- SpecialistEMT 8y ago
  Is there a tool for easilly making cool flowcharts like this?
  - squaresmile 8y ago
    I'm pretty certain the whole report was created in MS Word and the flowchart used Word flowchart as well.
    - hobs 8y ago
      Yeah it looks like one of the default "Smart Art" sets.
- oligopoly 8y ago
  Good Manual for upcoming startups as well.
- reaperducer 8y ago
  You're right -- the flowcharts are above par. But the very first chart in the PDF is troublesome because of negative language. For example, "No privacy intrusive default settings in popups." Does the X on Facebook mean "There are no privacy intrusive default settings in popups" or "There are privacy intrusive default settings in popups." Double negatives are difficult; especially for non-native English speakers. It's like when you see someone on HN write "it's not non-trivial." Just say if it's easy or hard. Don't bury yourself in confusing jargon.
dalbasal 8y ago
Im kind of torn on this. On one hand, I agree that these "dark patterns" undermine what legislators and voters want in terms of consumer protections and rights. Consumers and legislators need to be aware of it. On the other, I think it leads to a banal conclusion. Legislation tried to achieve something by putting responsibilities/restrictions on corporations. It did not achieve its goals, because companies "implementing" the law have different things they want to achieve. One common sense conclusion is "moral failings." I expect most journalists and legislators refering to this report will be in this category. Google is greedy. FB is cynical. Nowhere to go from here but moral righteousness. Another common conclusion will be "loopholes." This will send us down the legislative rabbit Warren that financial regulation and tax law has been down. The right (imo) conclusion is that the whole approach is wrong. We cannot rely on explicit (or even implicit) contracts between a website and every person who visits it. There must be rules, not contracts. Where users need control or an agreement has to be made, these need to be baked into browsers, where the party implementing "user empowerment" are not the ones losing from it. Moving to a world where an average consumer "signs" multiple agreements with companies per day.. that's not what our legal conventions were made for.
- deleted 8y ago
  [deleted]
- tunap 8y ago
  An enforceable "Tell websites I do not want to be tracked" would be nice. We saw quite clearly how that was ignored wholesale when it is voluntary.
- tomxor 8y ago
  > There must be rules, not contracts. Where users need control or an agreement has to be made, these need to be baked into browsers, where the party implementing "user empowerment" are not the ones losing from it. Yes! This is the right way. Unfortunately it's also looks like it's going to be really, really hard, because the platform did not evolve with this foresight.
- chriswarbo 8y ago
  Reminds me of P3P https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P which is unfortunately dead :(
brookhaven_dude 8y ago
Another reason to stay in Apple ecosystem.
daveheq 8y ago
This is how you get it for free
dzhiurgis 8y ago
I've recently got caught in a dark pattern by cheap airline in Europe - Wizzair. They've cancelled one of my flights and "automatically rebooked" into different one. Turns out it wasn't really automatic - scroll down the email and there's bunch of options with buttons "Click here to login". Because I didn't really accept my new automatic flight booking, I had to pay €30 check-in fee at the airport.
- fjsolwmv 8y ago
  If that happened to me there would have been a scene that led to my arrest. That's a textbook case of an unconscionable contract, creating a situation of duress (accept new terms or be stranded) Still, after the 30 extra, was it still cheaper than a legitimate airline?
  - dzhiurgis 8y ago
    I did make somewhat of a scene, but the staff wasn't official airline one. Poor Icelandic guy had his fingers shake a bit, felt sorry for him and my behaviour. The flight wasn't that much of a difference in price, rather than destination. Matter of fact lately I see premium airlines in Europe win me over ultra cheap ones - same price but better airports, better seats, complimentary coffee and couple of euros back in alliance rewards.
stevesimmons 8y ago
Bloomberg is also surprisingly bad. I naively expected them to have more integrity. Their consent page (linked from The Recycling Game story a few slots above this on HN right now) has a huge "Accept and Continue" button and a much smaller "More Information" link. The really bad thing IMO is each section has a switch with options Out and In, with a black/white slider on a black background. Not only is it unclear what Out and In mean here, it's unclear which of black or white means selected. That's bad enough I'm actually tempted to write to their GC.
OnlyRepliesToBS 8y ago
For decades.
phobosdeimos 8y ago
I'm shocked! I just assume hostility and act accordingly. Ublock origin and tampermonkey scripts at anyone who bypasses it. Cookie autodelete to remove tracking cookies every 3 seconds. Canvasblocker against fingerprinting. Honestly this is how the internet makes money and I can't even be mad. Asking Facebook to respect privacy is like asking a drugdealer to find legal employment. Just don't do drugs!

731 points by erlend_sh 8y ago

Page 14: [edit: number corrected, thanks] > As the screenshots below illustrate, the Facebook GDPR popup requires users to go into “Manage data settings” to turn off ads based on data from third parties. If the user simply clicks “Accept and continue”, the setting is automatically turned on. This is not privacy by default. Beautiful! A minimal demonstration of a clear violation of the principal of data protection by default (article 25 of the GDPR). It will we really hard to talk oneself out of this one.

scrollaway 8y ago
That flow was really scummy. I remember going through it. The entry point was an email claiming you have to "read and accept the updated policies in order to continue using the site". And the first thing you're presented with was that two-choice "Manage data settings" / "Accept and continue", implying for the user who is less than extremely careful that if you don't "Accept and continue", you won't be able to use the site anymore. It's only after that modal that you're presented with the updated T&Cs which you indeed need to either accept or delete your account. And of course all the various things people have noted: - A red dot in the fake-header to make you think you have pending notifications - A complete disregard for "privacy by default" All this right after Mark testified in congress saying "no we used to be bad and we made mistakes but now we really care, you see". For a site that despises transparency, Facebook has never been so transparent about how little it gives a crap about its users. I have some friends working at Facebook who will probably read this and be upset I think so little of their place of work. Folks, I have a huge respect for some of the excellent work that goes on at Facebook, especially in open source. But that doesn't change how scummy the core site itself is.
- malka 8y ago
  Facebook will never care about Privacy. People like Zuckerberg are scum, and deserve jail. As an individual, I really do NOT want to live in the same society as this kind of person.
  - CaptainZapp 8y ago
    Mr. Zuckerberg cares a lot about privacy. Privacy for him and his family, that is.
- lancewiggs 8y ago
  By staying at Facebook your friends are explicitly supporting these and other scummy actions. They have decided to hold their noses and prioritise themselves over humanity. Think less of them.
  - fsloth 8y ago
    "Think less of them." That's a horrible metric to apply measuring 'human worth', whatever that is. Humans are by default wired to do what everyone else is doing. Just using Facebook because everyone else is doing it as well is what humans do. They flock to the communities and forums where the action is. They cannot comprehend graph theory intuitively and what power Facebook potentially wields in interfering in their lives. Governments are supposed to protect people from threats the masses cannot comprehend. Like example taking care of vaccinations.
  - scrollaway 8y ago
    This is a totally inappropriate thing to ask of anyone. Please rethink your view on life. Edit: Also, that's not what "explicitly" means. I think you meant "implicitly".
    - TheSpiceIsLife 8y ago
      Superior orders, often known as the Nuremberg defense, lawful orders or by the German phrase Befehl ist Befehl ("an order is an order"), is a plea in a court of law that a person—whether a member of the military, law enforcement, a firefighting force, or the civilian population—not be held guilty for actions ordered by a superior officer or an official.[1] The Nuremberg defence is widely regarded as invalid. 1. https://en.m.wikipedia.org/wiki/Superior_orders https://en.m.wikipedia.org/wiki/Superior_orders
    - rickycook 8y ago
      some people work for charities, some people work for facebook. the employees make the company, and are complicit if they don’t react harshly to decisions made by their board like google employees did... if nobody wants to support the scummy tactics that “the company” is pushing, it won’t get done. sometimes you need to have a spine to get anything changed otherwise we are just heading for a blade runner distopia, and we in the tech industry are pushing us there as fast as our pay cheques can. people quit google over the military project because they didn’t agree with it. i don’t think it’s crazy to do the same over facebooks disgusting manipulation of their user base.
dannyw 8y ago
Note that Facebook still refuses to let you opt out of personalised advertising based on Facebook activity. This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB?
- tehabe 8y ago
  The paper deals with this, it even says this gives the users the false impression of control. I remember this weird pop up if you allow Facebook applications of friends to access your information. It was never really clear if you agree or disagree to it by checking the check boxes.
- adventured 8y ago
  > This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB? The GDPR fans on HN have said over and over again that GDPR wouldn't result in instant fines, that companies would be given a warning and an opportunity to make changes. We'll soon find out if that's true or not.
  - rickycook 8y ago
    facebook made their changes, and failed. they’ve played their hand, now it’s time for the law to tell them what utter bull it is. do you think facebook is going to change anything from now? the point of “no instant fines” is to give companies a chance to change and develop their GDPR systems. if those systems are both complete, and in violation, why shouldn’t they be fined?
    - fauigerzigerk 8y ago
      >facebook made their changes, and failed. That is yet to be determined by the regulator and the courts. Facebook has made their changes. Now someone will complain to the regulator. Then the regulator will make a determination and maybe ask Facebook to make further changes. Then Facebook has another opportunity to comply. If they refuse to make those changes they will get fined and can go to court to fight the regulator's decision. At least that is my understanding of how this system works.
Arn_Thor 8y ago
* page 14
pfortuny 8y ago
Oh: we made mistakes. They will not happen again.
WorkLifeBalance 8y ago
I noticed Twitch is doing the same thing, if you "manage your choices" you get the banner to "manage your choices" on every page load, the only way to get rid of the banner was to "accept" which accepts everything. (I hope it was just a 'bug' but it didn't feel like it.) I don't get it though, if companies are so scared of being fined 4% of revenue that they put up these banners, aren't they inviting the worse end of the punishment scale by trying to weasel around the law rather than just ignoring it completely?
- ckastner 8y ago
  The worst offender I've encountered is imgur.com, where "click here to manage your privacy settings" brings you to a page with literally hundreds of advertisers. About half are on "allowed" by default. If you want to disallow, you have to select each entry individually. The other half only specify "requires opt-out", apparently imgur expects you to contact some third party to do so. How on earth they expect to weasel around the law with this ham-fisted approach is beyond me.
  - okanesen 8y ago
    Same goes with Tumblr and Yahoo for example, where everything is enabled by default and you have to go one (I'm not talking about 10-20, it's more like +300) by one to enable the tracking done by advertising/marketing companies. One of the better thing is, though I don't want to advocate the behavior of auto opt-in at all, that most of these sites are at least using something like TRUSTe or Oath, where you only have to disable hundreds of marketing services once and are done with all the sites, which are using the same service for cookie consent. It's against the law to make the options opt-out but these companies are still trying hard to don't obey by the law, it's really comical.
  - fauigerzigerk 8y ago
    >How on earth they expect to weasel around the law with this ham-fisted approach is beyond me. They reckon, perhaps correctly, that almost all websites weasel around the law and only very few of them will ever be fined. Privacy activists will go after the big fish first and there will be time for the small sites to correct course once it becomes clear what is and isn't permitted.
passwd 8y ago
> It will we really hard to talk oneself out of this one. I'm reasonably sure they knew it's a violation. So it feels like they're either prepared to fight over it, or testing the ground to see what the consequences are... After all, I would have guessed that they're in for major losses in ad revenue if most people sign out. So it's worth almost any risk.
mort96 8y ago
I would like to point out this message I got on the mobile Facebook website a month ago: https://i.redd.it/hh6xerkskmx01.jpg https://i.redd.it/hh6xerkskmx01.jpg "To personalise content, tailor and measure ads and provide a safer experience, we use cookies. By tapping on the site, you agree to our use of cookies on and off Facebook." Agreeing to something by tapping anywhere on the site doesn't sound enforceable...

a_imho 8y ago

Great summary, hopefully the EU can deliver what these companies are asking for.

tbassetto 8y ago
Doesn't invalidate what you said, but just in case: Norway is not in the EU.
- digi_owl 8y ago
  May as well be, as via the EEA we seem to adopt more directives from Brussels than some full members...
  - EliRivers 8y ago
    Well, speaking as a Brit, allow us to demonstrate Norway++ We shall finish up subject to the full set of EU obligations and privileges, but everyone shall strongly agree that the UK is not part of the EU. No no no. Just in the various unions and so forth, matching all the rules and that sort of thing. Not part of the EU. Nu uh! :)
    - lapnitnelav 8y ago
      Plausible denEUbility?
    - pjc50 8y ago
      Yeah, this is the ""best case"" Brexit option: the same as now, except we've excluded ourselves from all the political institutions of the EU. So we have to accept all the rules and get no say in them. (The worst case option is the government is too disorganised to agree anything with anyone and we start running out of food, fuel and medicine...)
  - kazen44 8y ago
    The only thing holding norway back from full EU membership is fishing rights and a referendum on EU membership. Norway seems to actually accept its current political position inside the EU's sphere of influence just fine.

cs702 8y ago

Yes. Yes. Yes. Dark patterns ought to be illegal: They exploit the innate weaknesses of human perception and cognition to get human beings unwittingly to do things they otherwise don't want to do.

Deestan 8y ago
We already have functional laws against misleading (not just obvious lies) advertisements, so it should be no stretch to have similar ones for misleading instructions.

subroutine 8y ago

There was an interesting post related to this a few months ago, that maybe some of you missed and would enjoy... "Dark Patterns, The Ratchet" https://jacquesmattheij.com/dark-patterns-the-ratchet/ https://jacquesmattheij.com/dark-patterns-the-ratchet/

walterbell 8y ago
Thanks. A quote: > ... instantly all memory of the consent obtained will be forgotten. There is no way back. That ‘click’ of your mouse (or tap of the finger) was the ratchet advancing one little step. Good luck finding the permission you have just about irrevocably changed in a mountain of convolution designed to lead you astray in your quest to undo your action. Of course it would be trivial to have a log of recently given permissions and an ‘undo’ option for each of those. But there is no money in there and so you won’t find it. The ratchet has clicked and that’s all that matters, you ‘gave your consent’, time to move on. And so the company gets to claim that not only did you give your consent, you gave it willingly and obviously they would have never ever used your data without that consent.

minpur 8y ago

What a surprise! Microsoft villianised over the decades seems to be better than Google and Facebook. This brings us to the question. Have you paid XX money for a service that doesn’t show ads. Are you happy with it?

digi_owl 8y ago
Villains comes in all shapes and sizes. MS was, and possibly still is, the classical abuser of market position. The kind that age old antitrust laws were written to combat.
1125 8y ago
Still I think there's a difference in how deep the intrusion goes. I can just not use Google (except it's harder on stock Android phones), but I can definitely go without Facebook by just not using it. Having my own Operating System to spy on me makes me a victim whatever I do. I can't really escape from that.
- Vinnl 8y ago
  It's hard for me not to use Google's products because they're good, it's hard for me not to use Facebook's because they managed to lock me in using social pressure.
- SmellyGeekBoy 8y ago
  Just use an operating system that doesn't track you? There are plenty out there.
deleted 8y ago
[deleted]
tyfon 8y ago
Microsoft _still_ does not let me turn off "Basic usage data/telemetry" being sent to them. I tried to call them about it a month ago and they hung up on me. The one computer in my house running windows is still blocked with this popup.

janlaureys 8y ago

Especially on mobile some of these cookie management screens I've seen lately are HORRIBLE. If you're gonna make me click on every single partner to opt out of their tracking, I'm just not gonna use your site.

sideshowb 8y ago
Or hopefully wait and watch while someone with more time than you takes them to court
hadrien01 8y ago
I use EasyList Annoyances with my adblocker, it hides all cookies/GDPR popups. If the website respects GDPR and waits for my click on the "Accept" button, I'll never see it and tracking shouldn't be enabled (many websites still don't respect that basic concept nonetheless)
- stef25 8y ago
  Are you referring to "Fanboy's Annoyance List" here: https://easylist.to/ https://easylist.to/ ? I really want to get rid of all the cookies/GDPR popups.
  - hadrien01 8y ago
    I just checked, and apparently on mobile I use 'AdGuard Annoyances filter' and not 'Fanboy's Annoyance List' like on desktop. The former is a fork of the latter by Adguard, so I think it's about the same thing. EasyList's one works perfectly on desktop.
  - y0ghur7_xxx 8y ago
    This filter removes most of the cookie dialogs: https://github.com/r4vi/block-the-eu-cookie-shit-list https://github.com/r4vi/block-the-eu-cookie-shit-list
alkonaut 8y ago
Unless every tracking setting is off by default, they are clearly already in violation - so why would they then even bother having settings for it? Why not just track everyone and not ask?

dsco 8y ago

I was expecting "dark patterns" to be a hyperbole but these are clear violations of GDPR. This will probably catch public attention when the press gets hold of it and makes the screen shots more accessible (not hidden deep down in a PDF).

marichards 8y ago
The press gets hold of it and realises that they're littered with Facebook and Google integrations, their consent policy is little better and then they decide that they're going to publish this? The press has been suckered into this whole mess in its sacrifice to keep revenue from advertising
- walterbell 8y ago
  Sacrifice is an interesting word choice when discussing digital gods of internet advertising. Press could use the photos of recently discovered mass-sacrifice skulls in Mexico City.
- matt4077 8y ago
  „The media‘s” recent attention to digital privacy issues seems to disprove your conspiracy theories, and to show that journalists operate separate from their publications’ business departments.
  - zrobotics 8y ago
    How is this a conspiracy theory? I don't think that the business groups in publishing are any happier about the current state of affairs, but they have seen little option but to make themselves beholden to advertising companies. I doubt the irony of these articles escapes anyone in the media, but their failure to adapt early on has led them down this road (although gleefully embracing Facebook instead of their own sites as a way to spread content is not 100% Facebook's fault). It should be clear to anyone paying attention that current business models to sustainably support journalism have failed, and we are approaching (or have already reached) a point where only low-effort 'clickbait' and recycled AP content is profitable.

walterbell 8y ago

Good summary of dark patterns and consent, on page 7: > In digital services, design of user interfaces is in many ways even more important than the words used ... Dark patterns are considered ethically problematic, because they mislead users into making choices that are not in their interest, and deprive them of their agency. > This is particularly problematic given the power imbalances and information asymmetries that already exist between many service providers and their users ... a suspicion that tampering with default settings might remove important functionality, may affect the tendency to leave default settings alone. > ... information asymmetry in many digital services becomes particularly large because most users cannot accurately ascertain the risks of exposing their privacy. If a user is asked to trade their personal data for a short-term financial benefit, such as a discount, the actual cost of the trade-off is difficult to grasp. In this case, the short-term gain (discount) is tangible and immediate, while the potential loss (privacy) long term.

Angostura 8y ago

I presume this will get past to the Norwegian privacy regulator - https://www.datatilsynet.no https://www.datatilsynet.no

emilga 8y ago
Yes, it will. Here's a good news-article [0] giving context to the report. Quote: > Director of Digital Services in the Consumer Council, Finn Myrstad, says they will now ask the Norwegian Data Inspectorate [i.e. Datatilsynet] to assess whether Google and Facebook violate the new Privacy Policy (GDPR) that has entered into force in the EU. Furthermore: > The operation is coordinated with 23 European sister organizations in 16 countries. Of these, the Consumer Council states that 12 organizations will deliver letters to their respective data surveillance. At least six American consumer organizations are also behind the report. [0] https://nrkbeta.no/2018/06/27/facebook-og-google-manipulerer-og-villeder-deg-til-a-dele-privatlivet-ditt-mener-forbrukerradet/ https://nrkbeta.no/2018/06/27/facebook-og-google-manipulerer...

ttonkytonk 8y ago

Just noticed how chrome is giving me a notification to close all my incognito tabs (all one or two of them)

Deestan 8y ago
As porn (or "shopping for surprise gifts" for a more PR-friendly example) is a common use case for those, it makes sense to get a reminder to also close the tabs.

antpls 8y ago

Let's hope it goes to more EU consumer associations

grosjona 8y ago

I knew that someone would write about this eventually. Facebook's GDPR popup was criminal. When I got the popup, I accepted some default settings accidentally. Based on the context of the popup and placement of UI elements, I thought that the "Next" button meant "Proceed to my settings management screen" but in reality it meant "Keep default settings and proceed to Facebook".

jokoon 8y ago

I would pay money to have someone clean up my data online since I live in a GDPR country. I have this weird conspiracy in my brain that big IT companies are just fronts for what the CIA/NSA/governments need to do to do their job. I don't think those companies really care about getting your data, but government do, because governments saw and know that the internet is not something they directly control. Information is power, and it flows beyond the government's reach and proper authority. I don't really understand how those companies work so hard at great extents to get that data at the limit of the law or morality. I don't see how it's not the government doing this for security or economic reasons. Liberty and freedom of speech are important, but until the internet, governments were able to have their eyes on sensitive tools. Now citizens have access to technologies that can do a lot of things at the speed of light, so in a way, governments are losing control, so it's natural that governments are trying to get back the control they lost. Of course politically it's not going to please everyone, but I think that the golden age of information sharing is over. The problem is that escaping data collection will often be seen as ambiguous, politicized or very complicated, so you can't even justify it morally, you have to consent. I'm a little worried because because at some point you could have cyber activists that could resort to "cyber-terrorism" to attack companies that do data collection, and show it to the public. Sending users their own data would be one way to stain the image of those companies. Ironically, terrorism justified data collection. I don't think people realize how they are controlling their flow of thought and what they say when they know it can be heard. How many times I thought about what I was writing, knowing its trace could land somewhere that could have consequence on my image.

throw2016 8y ago

Without decentralization and alternatives criticism is toothless and hand wringing. Google and Facebook have developed this extremely invasive dystopic surveillance model and they are not going to abandon it. Its for users to abandon them. SV and the entire culture is operating in a moral vacuum, and everyone here knows it. All the talk about freedom and liberty has been exposed as posturing and what we have instead are the biggest sellouts in history.

sancha_ 8y ago

Couldn't find where I can change my GDPR settings in Facebook. Can someone send me a link?

dstdk 8y ago

Why not also include Linux in the list, to show that it is indeed possible to get "all green" score..

kennydude 8y ago

In contrast, Twitter's was well thought out and simple

hellofunk 8y ago

I just went through the "Manage Your Information" option on the FB website itself. It's terrible, every individual option only has a link to a long document you must read to figure out how to manage your information for only that one particular setting. Then you must separately do that yourself following the instructions, then go back to the Manage Your Information screen and select another of the many topics there and do it all again -- for each individual item in the list. FB really does not want to make it easy for you to quickly change all your settings.

lumberjack 8y ago

On the one hand it is good to deny them explicit permission. On the other hand I am 100% certain that Facebook is still tracking every single data point of every single EU user. They are not scared of breaking the law.

it_can_be_done 8y ago

You can do something to make a real difference. First contact data controller ex. Facebook, Google or any company which doesn't respect your privacy and rights, tell them to stop. If they refuse to take action then contact your national data authority and they will investigate it for you. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo.... Direct link to contact details: https://ec.europa.eu/commission/sites/beta-political/files/national-data-protection-authorities-jan_2018_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/n...

BrissyCoder 8y ago

Please - if there're no aliens stop up-voting this shit you Nintendo fanbois.

neya 8y ago

God, I wish someone added Quora to that list. After you read the first article, Quora masks all its content and forces you down the throat to sign up or sign in, pretending to be part of an age verification process (irrespective of the topic). I remember when this happened - I was so pissed off that I made an add-on called "fuck quora" that will simply reset their cookies to have unlimited reading possible without signing in. Will be happy to open source if the need be :)

Fnoord 8y ago
Please do! Though wouldn't it work to just never accept the cookie at all? I got very pissed off at Quora for the same reason, and made an account just to read (knowing full well they'd use it for profiling).
- bo1024 8y ago
  Not sure about Quora, but I've noticed that many sites start you off with a big "Accept and Continue" popup and set cookies when you accept. So if you deny cookies, you can't get past the popup (it just refreshes).
  - Fnoord 8y ago
    IIRC you can read one article for free on Quora. But yes, that accept and continue is common and annoying.
    - isostatic 8y ago
      Private mode works fine with quora
  - mrhappyunhappy 8y ago
    Yep. They even try to make them clever by showing actual cookies or people getting slapped by a cookie. Even use words GOT IT to accept terms.
pkkm 8y ago

heavenlyhash 8y ago

Those flowcharts and color coding are amazing. Everyone: even if you skim the rest of the article (mind, it's ALL worth reading), scroll to the last few pages and LOOK at those. They're color-coded by ease of flow (and yes, a definition of that was selected and clearly explained). I'm excited by this because I feel that often when we talk about Dark Patterns, conversations often devolve into a "both-sides"-ism pattern -- something which is as useless in UX discussion as it is in politics. These clear visualizations and starkly color-coded call-outs of flows that add extra work make it easy to compare flows, and point out ones which are obviously arcane.

SpecialistEMT 8y ago
Is there a tool for easilly making cool flowcharts like this?
- squaresmile 8y ago
  I'm pretty certain the whole report was created in MS Word and the flowchart used Word flowchart as well.
  - hobs 8y ago
    Yeah it looks like one of the default "Smart Art" sets.
oligopoly 8y ago
Good Manual for upcoming startups as well.
reaperducer 8y ago
You're right -- the flowcharts are above par. But the very first chart in the PDF is troublesome because of negative language. For example, "No privacy intrusive default settings in popups." Does the X on Facebook mean "There are no privacy intrusive default settings in popups" or "There are privacy intrusive default settings in popups." Double negatives are difficult; especially for non-native English speakers. It's like when you see someone on HN write "it's not non-trivial." Just say if it's easy or hard. Don't bury yourself in confusing jargon.

dalbasal 8y ago

Im kind of torn on this. On one hand, I agree that these "dark patterns" undermine what legislators and voters want in terms of consumer protections and rights. Consumers and legislators need to be aware of it. On the other, I think it leads to a banal conclusion. Legislation tried to achieve something by putting responsibilities/restrictions on corporations. It did not achieve its goals, because companies "implementing" the law have different things they want to achieve. One common sense conclusion is "moral failings." I expect most journalists and legislators refering to this report will be in this category. Google is greedy. FB is cynical. Nowhere to go from here but moral righteousness. Another common conclusion will be "loopholes." This will send us down the legislative rabbit Warren that financial regulation and tax law has been down. The right (imo) conclusion is that the whole approach is wrong. We cannot rely on explicit (or even implicit) contracts between a website and every person who visits it. There must be rules, not contracts. Where users need control or an agreement has to be made, these need to be baked into browsers, where the party implementing "user empowerment" are not the ones losing from it. Moving to a world where an average consumer "signs" multiple agreements with companies per day.. that's not what our legal conventions were made for.

deleted 8y ago
[deleted]
tunap 8y ago
An enforceable "Tell websites I do not want to be tracked" would be nice. We saw quite clearly how that was ignored wholesale when it is voluntary.
tomxor 8y ago
> There must be rules, not contracts. Where users need control or an agreement has to be made, these need to be baked into browsers, where the party implementing "user empowerment" are not the ones losing from it. Yes! This is the right way. Unfortunately it's also looks like it's going to be really, really hard, because the platform did not evolve with this foresight.
chriswarbo 8y ago
Reminds me of P3P https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P which is unfortunately dead :(

brookhaven_dude 8y ago

Another reason to stay in Apple ecosystem.

daveheq 8y ago

This is how you get it for free

dzhiurgis 8y ago

I've recently got caught in a dark pattern by cheap airline in Europe - Wizzair. They've cancelled one of my flights and "automatically rebooked" into different one. Turns out it wasn't really automatic - scroll down the email and there's bunch of options with buttons "Click here to login". Because I didn't really accept my new automatic flight booking, I had to pay €30 check-in fee at the airport.

fjsolwmv 8y ago
If that happened to me there would have been a scene that led to my arrest. That's a textbook case of an unconscionable contract, creating a situation of duress (accept new terms or be stranded) Still, after the 30 extra, was it still cheaper than a legitimate airline?
- dzhiurgis 8y ago
  I did make somewhat of a scene, but the staff wasn't official airline one. Poor Icelandic guy had his fingers shake a bit, felt sorry for him and my behaviour. The flight wasn't that much of a difference in price, rather than destination. Matter of fact lately I see premium airlines in Europe win me over ultra cheap ones - same price but better airports, better seats, complimentary coffee and couple of euros back in alliance rewards.

stevesimmons 8y ago

Bloomberg is also surprisingly bad. I naively expected them to have more integrity. Their consent page (linked from The Recycling Game story a few slots above this on HN right now) has a huge "Accept and Continue" button and a much smaller "More Information" link. The really bad thing IMO is each section has a switch with options Out and In, with a black/white slider on a black background. Not only is it unclear what Out and In mean here, it's unclear which of black or white means selected. That's bad enough I'm actually tempted to write to their GC.

OnlyRepliesToBS 8y ago

For decades.

phobosdeimos 8y ago

I'm shocked! I just assume hostility and act accordingly. Ublock origin and tampermonkey scripts at anyone who bypasses it. Cookie autodelete to remove tracking cookies every 3 seconds. Canvasblocker against fingerprinting. Honestly this is how the internet makes money and I can't even be mad. Asking Facebook to respect privacy is like asking a drugdealer to find legal employment. Just don't do drugs!