4 ms·

Meanwhile, visiting a large commercial website today involves: 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). 2. A pop

by sshine 8y ago

Meanwhile, visiting a large commercial website today involves: 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). 3. A pop-up asking the visitor if they'd like to subscribe to its newsletter. 4. A pop-up telling the visitor that it's run out of "free articles", but that you can sign up at a premium. 5. A pop-up asking the visitor to turn off the adblocker because the site's revenue depends on the ads. 6. A pop-up asking the visitor to participate in an online survey. 7. A pop-up telling the visitor about a unique way to earn money in your underwear. None of the pop-ups will share UI for closing them, and some of the close buttons will be so hard to press that you accidentally change site instead. (Clarification: It doesn't have to be a pop-up, but it does have to be annoying.)

nmca 8y ago
Don't forget about the pop-up for the live sales chat!
- VexorLoophole 8y ago
  Oh, and a pop-up about the new redesign and it's new (clunky for desktop users) features.
barking 8y ago
That's OK those sites are toast if they keep that up.
- black_puppydog 8y ago
  Yeah, because competition will make it so? Just that "the competition" is doing the exact same things...
  - barking 8y ago
    Yes and cable took the piss for years with subscriptions plus ads and then along came netflix
windows_tips 8y ago
EDD: EU-law Driven Design
- watt 8y ago
  The real goal of EDD is for websites to have landing page (assuming you navigate from search engine) that requires no cookies, and does not capture identifying/tracking information (so no asking for consent would be needed at all) before showing the article. The consent might be asked when you navigate to next article within the website, but majority of people don't.
cyborgx7 8y ago
I'm sure you know this, as you have included a bunch of pop-ups that aren't necessary but websites do anyway. But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to.
- josteink 8y ago
  > But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to. It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking. I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them. All in all, it's pretty sad.
  - ddalex 8y ago
    So technologically the non-tracking website is very very simple. Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
    - pdpi 8y ago
      > Even a simple commerce site needs to keep tracking of users Functional cookies like this are exempt from GDPR's opt-in requirement
      - dvfjsdhgfv 8y ago
        Exactly. I've been running a few webshops where cookies were used only to keep the session/cart state. It never occurred to me I should irritate my users with cookie/GDPR notices. To quote the famous cookie law [1], the cookies exempt from consent were: * user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases * authentication cookies, to identify the user once he has logged in, for the duration of a session * user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration * multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session * load‑balancing cookies, for the duration of session * user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer) * third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network. This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
BearsAreCool 8y ago
I put practically every major news website article through outline.com, only way I can stand to read it.
petre 8y ago
Thanx for reminding me. I just added them to uBlock Origin as a custom filter: https://github.com/ryanbr/fanboy-adblock/blob/master/fanboy-cookiemonster.txt https://github.com/ryanbr/fanboy-adblock/blob/master/fanboy-...
bumholio 8y ago
The proliferation of popups and overlays is the modern scourge of the Web, especially on the desktop. It makes life very hard for those browsing in anonymous mode by default. We need a combined Decrap extension that kills all this crap and presents a clean browsing experience on a fresh browser.
securityfreak 8y ago
While the “Accept” button is the only big blue button in the pop-up and the opt-out options are hidden after 2 clicks away on an arbitrary link hidden in the text. Of course, there is no “deselect all” personalized advertising vendors. One by one. Every time! I am thinking they should have made opt-in mandatory, but websites would have found a way. Greed always finds a way.
dspillett 8y ago
> 1. A pop-up notifying the visitor on the website's cookie policy. With a UI that deliberately makes it very cumbersome to opt out and very easy to opt-in with no obvious way (aside from clearing all browser cookies) to later change your mind... > (required by EU law) Contrary to what the sites imply, the pop-up is not required by law (I'm guessing you, sshine, are well aware of this, but the general public aren't). It could easily be an in-page (rather than over-page) or interstitial page politely requesting that we agree to the cookies being stored on later page views. The request to opt-in is required by the law. The pop-up is required by the site's desire to make it inconvenient for you not to. > (required by EU law) While we are on the subject of the law: the way many sites implement the consent walls is not compliant anyway. A common issue is storing data in tracking cookies until opt-out rather than not storing it until opt-in. The other common flaw is one is mis-classification of stored content: should that cookie for doubleclick.net really be classed as "essential for site operation"?!
- Asooka 8y ago
  When I see that I simply open the website in private browsing (in Firefox at least no cookies are shared between public/private), consent to all tracking, read what I want and close the window.
  - dspillett 8y ago
    That doesn't help if the implementation is bad (as many are) and drops tracking cookies until out-out - your main session still get the tracking nuggets. > in Firefox at least no cookies are shared between public/private That is also the case for incognito/private/what-ever-they-brand-it mode in Chrom{e|ium}, IE, Edge, and I assume (though I haven't tested this myself at all) Safari and others too. Though there are some clues that can leak from normal to private due to known bugs & edge cases in the browsers and common add-ons (like flash), search for "evercookie" to find some references about that, and there are other ways to fingerprint or track you which might be less reliable but still apparently work well enough for people to use them.
mrweasel 8y ago
One major annoyance is that one of my Firefox extension, either the ad blocker or the "I don't care about cookies" finds and remove the GDPR javascript pop up from CookieBot (which is GDPR compliance as a service for people who don't know what they're doing"). Because I can't see the CookieBot pop up anymore I can't dismiss, but it prevents scrolling from working on a large number of websites.... All news websites interestingly enough.
- ObsoleteNerd 8y ago
  I'm not familiar with CookieBot, but from the sound of your post alone, it sounds like what's blocking you is a DIV element that is expecting a JS script to remove it once the person clicks the button? If so, the DIV element should be the same for all sites that use CookieBot (I'd assume. JS libraries usually dictate what your DIV should be called), so you should just be able to block that DIV ID in your content-filter-of-choice?
the_mitsuhiko 8y ago
> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). That is both not required. Just don't collect PII and all is good. Apple for instance manages to run a website that does not involve any stupid cookie warnings.
- marksomnian 8y ago
  apple.com/shop begs to differ (and for the record, they don't have any cookie warnings, but Chrome DevTools shows me no less than 26 cookies)
  - the_mitsuhiko 8y ago
    That's the point: the cookies that apple sets do not require user consent.
sergiosgc 8y ago
> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). > 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). You never need both. GDPR superceded the "Cookie Law", so the cookie policy pop-up is no longer needed. You may not even need the explicit consent popup. You do need user consent for storing user personal data, if you gather, store, and process personal data. Even then, you only need explicit consent if none of the other implicit authorizations apply: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
deleted 8y ago
[deleted]
justsomedude43 8y ago
I have a solution for this. I don't visit such websites. They want to harvest my data, I won't give them my data. Either comply with GDPR or lose a visitor. Simples.
megous 8y ago
How could you forget! Popup for installing "our mobile application."
DanBC 8y ago
> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). Not always required by EU law, but always always blamed on EU law. > 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). Not always required by EU, but always always blamed on EU law.
mpolsz 8y ago
Don't forget dialog requesting for notifications permission because otherwise you would miss important news.

by sshine 8y ago

nmca 8y ago

Don't forget about the pop-up for the live sales chat!

VexorLoophole 8y ago
Oh, and a pop-up about the new redesign and it's new (clunky for desktop users) features.

barking 8y ago

That's OK those sites are toast if they keep that up.

black_puppydog 8y ago
Yeah, because competition will make it so? Just that "the competition" is doing the exact same things...
- barking 8y ago
  Yes and cable took the piss for years with subscriptions plus ads and then along came netflix

windows_tips 8y ago

EDD: EU-law Driven Design

watt 8y ago
The real goal of EDD is for websites to have landing page (assuming you navigate from search engine) that requires no cookies, and does not capture identifying/tracking information (so no asking for consent would be needed at all) before showing the article. The consent might be asked when you navigate to next article within the website, but majority of people don't.

cyborgx7 8y ago

I'm sure you know this, as you have included a bunch of pop-ups that aren't necessary but websites do anyway. But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to.

josteink 8y ago
> But for other people who love to hate on the GDPR, 1 and 2 are not necessarialy required by EU law either. Just don't have cookies when you don't need them and don't save data the visitor hasn't agreed to. It's this simple, and yet everyone on the internet freaks out like having a GDPR-compliant general purpose website is some massive undertaking. I can't fathom how people got so used to endless tracking that a non-tracking site now literally seems like a impossibility to them. All in all, it's pretty sad.
- ddalex 8y ago
  So technologically the non-tracking website is very very simple. Business wise, not so much. How do you monetize such a site? Even a simple commerce site needs to keep tracking of users, and to do any kind of marketing you need explicit user consent.
  - pdpi 8y ago
    > Even a simple commerce site needs to keep tracking of users Functional cookies like this are exempt from GDPR's opt-in requirement
    - dvfjsdhgfv 8y ago
      Exactly. I've been running a few webshops where cookies were used only to keep the session/cart state. It never occurred to me I should irritate my users with cookie/GDPR notices. To quote the famous cookie law [1], the cookies exempt from consent were: * user‑input cookies (session-id) such as first‑party cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases * authentication cookies, to identify the user once he has logged in, for the duration of a session * user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration * multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session * load‑balancing cookies, for the duration of session * user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer) * third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network. This means you could freely use cookies for normal operation. It's only when you start tracking people you needed to ask their consent. [1] http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

BearsAreCool 8y ago

I put practically every major news website article through outline.com, only way I can stand to read it.

petre 8y ago

Thanx for reminding me. I just added them to uBlock Origin as a custom filter: https://github.com/ryanbr/fanboy-adblock/blob/master/fanboy-cookiemonster.txt https://github.com/ryanbr/fanboy-adblock/blob/master/fanboy-...

bumholio 8y ago

The proliferation of popups and overlays is the modern scourge of the Web, especially on the desktop. It makes life very hard for those browsing in anonymous mode by default. We need a combined Decrap extension that kills all this crap and presents a clean browsing experience on a fresh browser.

securityfreak 8y ago

While the “Accept” button is the only big blue button in the pop-up and the opt-out options are hidden after 2 clicks away on an arbitrary link hidden in the text. Of course, there is no “deselect all” personalized advertising vendors. One by one. Every time! I am thinking they should have made opt-in mandatory, but websites would have found a way. Greed always finds a way.

dspillett 8y ago

> 1. A pop-up notifying the visitor on the website's cookie policy. With a UI that deliberately makes it very cumbersome to opt out and very easy to opt-in with no obvious way (aside from clearing all browser cookies) to later change your mind... > (required by EU law) Contrary to what the sites imply, the pop-up is not required by law (I'm guessing you, sshine, are well aware of this, but the general public aren't). It could easily be an in-page (rather than over-page) or interstitial page politely requesting that we agree to the cookies being stored on later page views. The request to opt-in is required by the law. The pop-up is required by the site's desire to make it inconvenient for you not to. > (required by EU law) While we are on the subject of the law: the way many sites implement the consent walls is not compliant anyway. A common issue is storing data in tracking cookies until opt-out rather than not storing it until opt-in. The other common flaw is one is mis-classification of stored content: should that cookie for doubleclick.net really be classed as "essential for site operation"?!

Asooka 8y ago
When I see that I simply open the website in private browsing (in Firefox at least no cookies are shared between public/private), consent to all tracking, read what I want and close the window.
- dspillett 8y ago
  That doesn't help if the implementation is bad (as many are) and drops tracking cookies until out-out - your main session still get the tracking nuggets. > in Firefox at least no cookies are shared between public/private That is also the case for incognito/private/what-ever-they-brand-it mode in Chrom{e|ium}, IE, Edge, and I assume (though I haven't tested this myself at all) Safari and others too. Though there are some clues that can leak from normal to private due to known bugs & edge cases in the browsers and common add-ons (like flash), search for "evercookie" to find some references about that, and there are other ways to fingerprint or track you which might be less reliable but still apparently work well enough for people to use them.

mrweasel 8y ago

One major annoyance is that one of my Firefox extension, either the ad blocker or the "I don't care about cookies" finds and remove the GDPR javascript pop up from CookieBot (which is GDPR compliance as a service for people who don't know what they're doing"). Because I can't see the CookieBot pop up anymore I can't dismiss, but it prevents scrolling from working on a large number of websites.... All news websites interestingly enough.

ObsoleteNerd 8y ago
I'm not familiar with CookieBot, but from the sound of your post alone, it sounds like what's blocking you is a DIV element that is expecting a JS script to remove it once the person clicks the button? If so, the DIV element should be the same for all sites that use CookieBot (I'd assume. JS libraries usually dictate what your DIV should be called), so you should just be able to block that DIV ID in your content-filter-of-choice?

the_mitsuhiko 8y ago

> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). That is both not required. Just don't collect PII and all is good. Apple for instance manages to run a website that does not involve any stupid cookie warnings.

marksomnian 8y ago
apple.com/shop begs to differ (and for the record, they don't have any cookie warnings, but Chrome DevTools shows me no less than 26 cookies)
- the_mitsuhiko 8y ago
  That's the point: the cookies that apple sets do not require user consent.

sergiosgc 8y ago

> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). > 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). You never need both. GDPR superceded the "Cookie Law", so the cookie policy pop-up is no longer needed. You may not even need the explicit consent popup. You do need user consent for storing user personal data, if you gather, store, and process personal data. Even then, you only need explicit consent if none of the other implicit authorizations apply: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

deleted 8y ago

[deleted]

justsomedude43 8y ago

I have a solution for this. I don't visit such websites. They want to harvest my data, I won't give them my data. Either comply with GDPR or lose a visitor. Simples.

megous 8y ago

How could you forget! Popup for installing "our mobile application."

DanBC 8y ago

> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). Not always required by EU law, but always always blamed on EU law. > 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). Not always required by EU, but always always blamed on EU law.

mpolsz 8y ago

Don't forget dialog requesting for notifications permission because otherwise you would miss important news.