6 ms·

I'm stuck in a "please accept our gazillion cookies" loop. After managing preferences (which is implemented illegally, as I understand, since opt-out should be

I'm stuck in a "please accept our gazillion cookies" loop. After managing preferences (which is implemented illegally, as I understand, since opt-out should be as easy as opt-in) and saving, I just get shown the same page again. Too bad, sounded like a fun article.

paol 8y ago
Just install Cookie AutoDelete (or equivalent extension) in your browser. You'll be able to click 'Accept' in cookie notices with abandon safe in the knowledge that it doesn't matter what the site says or does, you're in control. (Also disable 3rd party cookies in your browser settings while you're at it)
- xtf 8y ago
  Sites have to work without.
- probably_wrong 8y ago
  Non-compliance issues aside, here's why I'm not convinced that blindly agreeing is a good policy: Imagine that, by clicking "I accept", I agree to get my browser's fingerprint stored in their servers to identify me. For the sake of GDPR compliance, I can go back to their site at any time, revoke this consent, and they would actually forget me (crazy, I know). The problem is: since I have already agreed to the tracking, I won't see the "Accept" button anymore. Sure, I can go there and revoke my consent, but why would I? I don't even remember going there the first time. Agreeing to something I don't _really_ agree to is a bad idea overall. A better alternative, I think, is to start accessing cached versions of websites.
  - retSava 8y ago
    Also, accepting to tracking is accepting to tracking. Cookies are but one method of tracking, so even if cookies are deleted the site may still successfully and thus lawfully track you through other means.
asplake 8y ago
Yes, awful experience but the article is indeed great fun and very well done
Zealotux 8y ago
I'm currently making a list of bad implementations of GDPR, as far as I've observed I'd say that roughly 80% (low estimate) of cookie management systems are dark patterns, and that most of them are downright illegal. Maybe I should write an article on that, it's a perfect case study.
- class4behavior 8y ago
  A lot sites moved on to merge their privacy policies with their cookie policies, and they disallow access if you don't accept all of their tracking methods. How do you judge those examples? I'm not referring to those hiding the options to opt-out deep within their policies, sometimes even with text links, but those with absolute consent, i.e., either accept or move on.
  - Zealotux 8y ago
    My wording was indeed inappropriate (I'm not a native speaker), "dark patterns" are subjective but I'd say: - the less privacy-friendly option is a big shiny button, while privacy controls are behind a small greyed link - hiding the privacy options behind many interactions, basically making it as frustrating as possible to find the opt-out, I always find that amusing to read "We value your privacy" while I spend so much time looking for actual control over my privacy - all of the "partners" checked by default (non GDPR compliant), with no easy way to deselect all ("select all" is, however, usually an option) - bait and switch: when you go to partners' settings, checking the checkbox is actually requesting to opt-out, but to know that you need to read a long, grey paragraph with a small font size at the very end of the list - punishing the user by making it unnecessarily slow to opt-out, most of them are legitimate from my finding, but I've noticed a few fake loadings (zero requests in the network tab), it may simply be due to poor engineering though (Hanlon's razor) - redirecting the user from the original content after he opted-out, also feels like an intended punishment to me (but same as before: can be explained by poor engineering) The list is non-exhaustive, but I wish I had better writing abilities to share my observations in a Medium article or something like that.
    - 8y ago
sondr3 8y ago
I wonder if it would be possible to create a uBlock Origin like thing that automatically opt you out of everything on a website instead of having to go three menus down just do click them.
akavel 8y ago
As an extra insult, the page shown then has the preferences (which you have to get to through several smokescreens, where only one path is correct) reverted back to the original "enabled". Like showing you a contract with fine print, then after you carefully read and crossed out stuff in the fine print, they tear it down and pull out another copy of the original one. Their communication thus being: "fuck your choice, we think exactly nothing of it, are we clear enough?" I really hope some group of lawyers will start smashing the corporations with GDPR lawsuits with no remorse. I intensely hope there's money to be made out of this.
delfaras 8y ago
I absolutely hate how tumblr implemented their cookie policy. Doesn't GDPR forces vendors to have an easy opt-out from all button ? In any case, i took the trouble from opt-ing out and archiving the page : https://archive.is/2hADS https://archive.is/2hADS
- tpxl 8y ago
  No, GDPR forces vendors to have opt-out by default, with whatever opt-in they please. I stopped visiting tumblr because of that.
deleted 8y ago
[deleted]

paol 8y ago

Just install Cookie AutoDelete (or equivalent extension) in your browser. You'll be able to click 'Accept' in cookie notices with abandon safe in the knowledge that it doesn't matter what the site says or does, you're in control. (Also disable 3rd party cookies in your browser settings while you're at it)

xtf 8y ago
Sites have to work without.
probably_wrong 8y ago
Non-compliance issues aside, here's why I'm not convinced that blindly agreeing is a good policy: Imagine that, by clicking "I accept", I agree to get my browser's fingerprint stored in their servers to identify me. For the sake of GDPR compliance, I can go back to their site at any time, revoke this consent, and they would actually forget me (crazy, I know). The problem is: since I have already agreed to the tracking, I won't see the "Accept" button anymore. Sure, I can go there and revoke my consent, but why would I? I don't even remember going there the first time. Agreeing to something I don't _really_ agree to is a bad idea overall. A better alternative, I think, is to start accessing cached versions of websites.
- retSava 8y ago
  Also, accepting to tracking is accepting to tracking. Cookies are but one method of tracking, so even if cookies are deleted the site may still successfully and thus lawfully track you through other means.

asplake 8y ago

Yes, awful experience but the article is indeed great fun and very well done

Zealotux 8y ago

I'm currently making a list of bad implementations of GDPR, as far as I've observed I'd say that roughly 80% (low estimate) of cookie management systems are dark patterns, and that most of them are downright illegal. Maybe I should write an article on that, it's a perfect case study.

class4behavior 8y ago
A lot sites moved on to merge their privacy policies with their cookie policies, and they disallow access if you don't accept all of their tracking methods. How do you judge those examples? I'm not referring to those hiding the options to opt-out deep within their policies, sometimes even with text links, but those with absolute consent, i.e., either accept or move on.
- Zealotux 8y ago
  My wording was indeed inappropriate (I'm not a native speaker), "dark patterns" are subjective but I'd say: - the less privacy-friendly option is a big shiny button, while privacy controls are behind a small greyed link - hiding the privacy options behind many interactions, basically making it as frustrating as possible to find the opt-out, I always find that amusing to read "We value your privacy" while I spend so much time looking for actual control over my privacy - all of the "partners" checked by default (non GDPR compliant), with no easy way to deselect all ("select all" is, however, usually an option) - bait and switch: when you go to partners' settings, checking the checkbox is actually requesting to opt-out, but to know that you need to read a long, grey paragraph with a small font size at the very end of the list - punishing the user by making it unnecessarily slow to opt-out, most of them are legitimate from my finding, but I've noticed a few fake loadings (zero requests in the network tab), it may simply be due to poor engineering though (Hanlon's razor) - redirecting the user from the original content after he opted-out, also feels like an intended punishment to me (but same as before: can be explained by poor engineering) The list is non-exhaustive, but I wish I had better writing abilities to share my observations in a Medium article or something like that.
  - 8y ago

sondr3 8y ago

I wonder if it would be possible to create a uBlock Origin like thing that automatically opt you out of everything on a website instead of having to go three menus down just do click them.

akavel 8y ago

As an extra insult, the page shown then has the preferences (which you have to get to through several smokescreens, where only one path is correct) reverted back to the original "enabled". Like showing you a contract with fine print, then after you carefully read and crossed out stuff in the fine print, they tear it down and pull out another copy of the original one. Their communication thus being: "fuck your choice, we think exactly nothing of it, are we clear enough?" I really hope some group of lawyers will start smashing the corporations with GDPR lawsuits with no remorse. I intensely hope there's money to be made out of this.

delfaras 8y ago

I absolutely hate how tumblr implemented their cookie policy. Doesn't GDPR forces vendors to have an easy opt-out from all button ? In any case, i took the trouble from opt-ing out and archiving the page : https://archive.is/2hADS https://archive.is/2hADS

tpxl 8y ago
No, GDPR forces vendors to have opt-out by default, with whatever opt-in they please. I stopped visiting tumblr because of that.

deleted 8y ago

[deleted]