8 ms·

The GDPR Is a Cookie Monster

64 points by adrian_mrd 8y ago

simplecomplex 8y ago
GDPR doesn’t help anyone, so let’s pass more half baked regulations! Let’s just ban companies from using the internet! That will stop internet advertising for good. Thank God smart politicians like me care so much.
- patrickmcnamara 8y ago
  In what way does it not help anyone? It certainly seems to help EU citizens, like myself.
TeMPOraL 8y ago
My country is so great. How on Earth did we register 30% positive growth of third-party domains and 20% growth of third-party cookies? (Good that I don't generally visit the local Internet much anyway.)
- blfr 8y ago
  Third party scripts for dealing with GDPR requirements perhaps?
cyborgx7 8y ago
I'm glad the GDPR actually manages to enforce one of it's lesser talked about principals: data minimasation. What is worrying about this article is that it implies companies are using other, even less consensual ways of tracking users. Or maybe I'm reading too much into it.
- Spare_account 8y ago
  That was my take on it as well: > In a September 2017 study of 250 US digital marketers by Viant, about 60% of respondents said they will no longer rely on cookies for the majority of their digital marketing within the next two years. The absence of any description about what they will use instead is frustrating.
  - nannal 8y ago
    Well if they talked about browser fingerprinting via javascript, someone would take a stab that too
  - woud420 8y ago
    Considering you cannot use cookies for mobile traffic, it's understandable that most firms are moving away from it. Fingerprinting and device IDs have been common for a few years and I don't think it will go away any time soon.
    - sleavey 8y ago
      Why can't you use cookies for mobile traffic?
      - woud420 8y ago
        I wasn't clear enough and I apologize. You can use cookies but they will only be within the context of a singular app's browser. For example, suppose that you use two web browsers on your Desktop, Chrome and Firefox. If you visit xyz.com on FF, some cookie information will most likely be stored. However, if at a later time, you visit the domain on Chrome, it will not have access to the same cookie store. This becomes important in the context of third party cookies that want to track you across apps. Hence why cookies are not a reliable method of identification on mobile. Hope this clears it up. :)
  - klmr 8y ago
    Which is odd, since GDPR isn’t about cookies. Other means of user tracking fall under GDPR too. (To clarify, it wouldn’t be particularly odd if companies were found to violate GDPR; but the selective move from cookies to other technologies doesn’t change the legal situation.)
iicc 8y ago
The "Factsheet" this is about (7 page pdf - https://reutersinstitute.politics.ox.ac.uk/sites/default/files/2018-08/Changes%20in%20Third-Party%20Content%20on%20European%20News%20Websites%20after%20GDPR_0_0.pdf https://reutersinstitute.politics.ox.ac.uk/sites/default/fil...) >All results presented here reflect site activity prior to obtaining consent; the picture may change dramatically once the user provides the affirmative opt-in GDPR requires. So, meh.
- 4ad 8y ago
  Yep. If anything, things are worse now. You HAVE to give consent to do anything useful on the website (so blocking the notice won't work), and in the consent form it's usually very hard to turn tracking off, full of dark patterns. Not legal from the perspective of GDPR, sure, but it seems that everyone is doing it. /edit: downvoted for stating basic facts, amazing.
  - cyborgx7 8y ago
    And I hope they will all get heavy fines for doing so. Let's see how well the EU will enforce the GDPR.
    - paulie_a 8y ago
      I honestly don't get why so many sites are even paying attention to GDPR. If they don't have a presence in the EU, it is irrelevant.
      - shagen 8y ago
        It is not. If their customers are in the EU they have to to comply.
        jwineinger 8y ago
        What authority would make them comply?
        8y ago
legitster 8y ago
Honestly, the upcoming ePrivacy regulation is much needed- the cookies opt-in/out needs to be handled at the browser level. The current setup is lose-lose for businesses and end users. As a site admin, I have no problem honoring your request to not be tracked. I just can't wait until I don't have to deal with the nightmare that is OneTrust anymore.
- Lio 8y ago
  You mean like the "do not track" request header? https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track It never ceases to amaze me the number of companies that "value" my privacy but still somehow ignore the do not track header.
  - pluma 8y ago
    Well, Microsoft kinda dropped the ball on that one by making it the default (although they later changed that).
    - deleted 8y ago
      [deleted]
    - Lio 8y ago
      I don't feel like they did drop the ball there. By default I don't want to be tracked. I think that tracking across the internet should be opt in and users should be made aware of what websites are doing _before_ they start doing it. I also find the idea of secret shadow profiles to slightly immoral for the same reason.
      - pluma 8y ago
        DNT is a flawed idea in the first place. DNT is based on the idea that users can opt out of being tracked by sending that header. But (e.g.) European privacy law requires having users explicitly opt in to being tracked -- the message DNT is meant to assert is the legal default under GDPR. DNT only works if the assumption is that users who make no choice can be treated as consenting (which is no longer the case under GDPR). But if you set DNT by default you're not asserting "this user doesn't want to be tracked", you're just making it impossible to tell whether the user explicitly opts out or hasn't made a choice (and therefore actually do consent). If tracking is opt-out rather than opt-in (i.e. if we disregard GDPR and similar privacy laws and go with how US startups have operated so far) that means DNT is no longer a reliable signal for opting out and thus meaningless. Implications about consent and privacy aside, DNT only works if it is used with intent. In the absence of intent, by making it the default without the user's knowledge, it becomes ambiguous and therefore pointless. To put it differently: if there had never been any browsers that set DNT by default (except maybe browsers explicitly marketing themselves as "privacy first" like Brave does), you could use DNT as an explicit assertion that you do not consent to being tracked. This means it could actually serve as a technical implementation to opt-out of any "implied consent" allowed by the GDPR and making use of your right to control your data. But thanks to Microsoft randomly slapping on the header to piss off Google, DNT is now too ambiguous to infer any of that.
dstroot 8y ago
Yeesh... 80 cookies on average for news sites! Down to 60... how many different ways do they need to track one person?
- tim333 8y ago
  At least it shows some decentralised competition! Instead of just Google and Facebook tracking you it's like everyone.
- Uw7yTcf36gTc 8y ago
  each ad network needs to track you separately. so most of those 60 cookies are not sending data to the news site, but rather to the ad network which bids to display the ad to you.
  - ravenstine 8y ago
    There's ad networks, but there's also the plethora of vanity metrics that management likes to collect to fill their charts which they will then use to impress stakeholders, with the hope of getting paid more than the engineers. I could probably make a million dollars selling companies a "customer acquisition score" using phony baloney math if they place my script on their website.
jarfil 8y ago
The GDPR made me switch my cookie policy, to using two Chrome extensions in tandem: - I don't care about cookies: auto accepts all cookies - Cookie AutoDelete: auto deletes all cookies So now you can track me all you want... until I leave your website and all the cookies are gone (unless whitelisted).
- Jerry2 8y ago
  Chrome and these extensions give you a false sense of privacy. Currently, no extension can remove local storage and tracking information contained within them. https://bugs.chromium.org/p/chromium/issues/detail?id=78093 https://bugs.chromium.org/p/chromium/issues/detail?id=78093 You'll either have to clear local storage manually or get a privacy-oriented browser.
yeukhon 8y ago
I fucking hate GDPR policy making every website to show "Cookie Policy" ad pop modal. STOP. Every single time after I have accepted it, I come back the next day, I see the same modal again. I just accept it anyway, so stop. Stop this horrible UX. Sorry, but it really annoys the shit out of me. It does and I am pissed off every single time. If I accept, stop asking.
- sleavey 8y ago
  Are you blocking third party cookies in your browser? If the site uses a third party cookie to store your preference, then it may be unable to recall what you previously entered.
  - yeukhon 8y ago
    No :/
- simias 8y ago
  Are you using a browser extension that may be interfering with the website? I haven't had issues with website forgetting my preferences yet. Also being in the EU I'm used to these cookie dialogues, except before GDPR if I wanted to opt-out (assuming that it was even an option) I'd often have to wade through multiple pages, opting-out of the tracking which would take a while, especially since they were usually using every dark pattern in the book. Now with GDPR I still get the messages but everything is opt-in instead of opt-out and I can just click the (sometimes obfuscated) "I refuse" and carry on. It's actually a huge quality of life improvement as far as I'm concerned.
  - yeukhon 8y ago
    At work I don't have any third-party blocking extensions (I use Chrome). At home and on my mobile I do (I use Firefox Focus), but neither let websites to "remember". Is there something I need to configure?
    - r3bl 8y ago
snowwolf 8y ago
The dark patterns in play now to get explicit consent are pretty bad now though. Take Mashable for example. On first visiting the site you are presented with the option to "Consent" or view more Options (where you can Opt Out of all - except you can't really because some require Opting Out on the specific Advertisers site). But if you do choose to Opt Out all, they will then show you the initial Option box on every visit to the site, where you have to go through the More Options route every time. And if you ever accidentally click I Consent, then they opt you back in to everything again and then never show you that option box ever again. Note: I just picked on Mashable, but there are many, many sites following this same dark pattern.
- sleavey 8y ago
  This. I also found the Daily Mail decided that if you ignored the banner asking for consent and scrolled far enough down the page, it assumed consent for everything. Definitely shady, probably illegal.
  - r3bl 8y ago
    GDPR requires affirmative action for consent. This was specifically touched upon in the recital 32: > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
- EastSmith 8y ago
  Enter Brave. And uBlock Origin. And DuckDuckGo privacy essentials.
  - jszymborski 8y ago
crazygringo 8y ago
I just HATE all the pop-ups asking for permission to use cookies now. Seriously, having to opt-in on a per-site basis has led me to loathe the GDPR. It's a usability disaster. I never thought I'd hate anything more than the "sign up for our newsletter" pop-ups... but these are even more pervasive. If I'm the kind of person who hates cookies/tracking, I'll just install a blocker and block it everywhere, and then whitelist any domains I need to. It just makes me feel like the GDPR was a win for lawyers and legalese, and nobody else.
- jasonkostempski 8y ago
  I think we should have a de facto standard element class for legal notices with no required user action, like legal-notice-no-action-required. Webistes use the css class, uBlock Origin makes it a built-in default element filter. Website owners can fulfill their legal obligations and users that proactively shape their browsing experience are all set. Neither side wants these things messing up the browsing experience so, unlike the ad wars, we can work together.
  - chriswarbo 8y ago
    > I think we should have a de facto standard element class for legal notices with no required user action, like legal-notice-no-action-required. Webistes use the css class, uBlock Origin makes it a built-in default element filter. Website owners can fulfill their legal obligations and users that proactively shape their browsing experience are all set. Sounds like P3P ( https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P ) > Neither side wants these things messing up the browsing experience so, unlike the ad wars, we can work together. Personally, I absolutely want to know when sites are trying to spy on me and sell the data. Despicable crap like that should be forced out into the public, not quietly agreed to by the browser. That's exactly what GDPR is for.
    - jasonkostempski 8y ago
      > Personally, I absolutely want to know when sites are trying to spy on me and sell the data. It's best to assume they're all doing that to some degree whether they tell you they are or not. For one, most of the world isn't beholden to EU law. Also, bad players don't play by the rules and by the time you know they're bad, it's too late. > Despicable crap like that should be forced out into the public, not quietly agreed to by the browser. But the cookie law doesn't fix that problem, or any problem for that matter. The notifications are 100% pointless and we're stuck with them because of a stupid law. If anything, having a standard way to block the notices might encourage more users towards a real fix for the tracking problems, which is using something like uBlock Origin (just don't tell that to the site owners that don't want users having tracking blockers).
amaccuish 8y ago
I feel like the DNT header could have been made a lot better if it worked alongside GDPR. Like, 0 = haven't chosen/prompt me (I want to pick exactly what cookies I want), 1 = don't care give me everything, 2 = functional, 3 = please don't track me at all. You could then just surface this per-site even in the browser, maybe in a way resembling the IE Security Zone settings with their nice sliders.
- patrickmcnamara 8y ago
  I don't think this would work as it makes it too easy to not be fully tracked. There are so many hoops to go through now because companies want to incentivise being tracked and punish those who don't wish to be. If this was brought in through regulation, that's a different story.
barbegal 8y ago
The methodology behind this study looks okay but it isn't necessarily representative of real world use. The study looks at the front page of around 200 news sites in Europe with a browser cleaned of all cookies. However in all cases the IP address belonged to a machine at the university of Oxford so it probably had some history attached to it. It shows some reduction in cookies served before user interaction but it isn't clear is this is due to GDPR or other changes that have been made over the 3 month period. My summary is that the data found is not statistically significant given the relatively limited sample size and lack of any control sample to compare against showing usual variation over a 3 month period.
alkonaut 8y ago
The GDPR should get one important update and that’s QUICK: You shouldn’t be allowed to ask for consent to do tracking or targeting as a pop up. The site must be completely usable using only “required” cookies (to which no consent should be required if it only tracks a limited set of data) and any option to consent to anything outside this must be a hidden option. That is: sites should have to work 100% without popups and shouldn’t be allowed to use “marketing cookies” (for tracking and ad targeting) Otherwise we just traded one nuisance for another.
- chriswarbo 8y ago
  > The site must be completely usable using only “required” cookies (to which no consent should be required if it only tracks a limited set of data) I think GDPR does actually say this. > any option to consent to anything outside this must be a hidden option. You're right that this would be a difference (although I imagine sites would still end up covered in dark patterns trying to get users to enable it)
  - alkonaut 8y ago
    Right. And ”hidden option” is perhaps the wrong word, but let’s say one that doesn’t prevent using the site/service in full. Even supposedly serious outlets like WaPo does this. Full screen splash that says “by using the site you agree to targeted ads”. Why even bother with that when it’s so blatantly in violation? Isn’t it almost better to not look like you are deliberately in violation like that? It’s not even a dark pattern, it’s just a big fat splash explaining how they don’t care about the GDPR and intend to show me targeted ads using tracking cookies.
codedokode 8y ago
I don't understand why there is so much negative impression of GDPR. Most businesses do not need to track users; they do it only because they can and it is not forbidden. Let me give you some examples: - Wikipedia can serve you pages without knowing anything about you - You can download and use Debian distribution without providing any data about yourself. Microsoft can do the same. - Internet shops like Amazon or Ebay don't need to track you. They earn money when you buy something and if they delete PII after the order is completed they still have the money. GDPR is not taking them away. - Google can work just fine without tracking users. They show advertisement in search results, they get paid for it and they don't need to collect everything you have typed to earn profit - Youtube can show ads and get paid for it to completely anonymous users - Android and Google Maps don't need to track you. You paid for them when you bought your device, you don't have to pay once more with your data and opt into dubious "help us improve your user experience" scams. - Netflix gets money from you anyway and doesn't need to track you - Facebook doesn't need to track you across the web. It can show ads and get paid for it anyway. Look around. Most of businesses can earn money without collecting any personal information. The ones who can lose because of GDPR are only shady marketing agencies, legal spam conpanies, data brokers and three-letter agencies. I don't feel sorry for any of them. We should think about better protection of privacy and anonimity rather than worry about profits of Californian corporations wanting to make everyone their product.
- baseballdork 8y ago
  If you're looking for advertisers, all other things being equal, do you go with the advertiser who guarantees your ads will go to those most likely to have interest in your product, or do you go with the advertiser that will send your ads to random people? Of course they _can_ serve ads randomly, but they're competing to provide the best value for those buying ads.
  - codedokode 8y ago
    Corporations want cheaper ads; I understand that but I don't understand why I should be tracked. They should develop better ads without violating someone's privacy or anonymity.

64 points by adrian_mrd 8y ago

GDPR doesn’t help anyone, so let’s pass more half baked regulations! Let’s just ban companies from using the internet! That will stop internet advertising for good. Thank God smart politicians like me care so much.

patrickmcnamara 8y ago
In what way does it not help anyone? It certainly seems to help EU citizens, like myself.

TeMPOraL 8y ago

My country is so great. How on Earth did we register 30% positive growth of third-party domains and 20% growth of third-party cookies? (Good that I don't generally visit the local Internet much anyway.)

blfr 8y ago
Third party scripts for dealing with GDPR requirements perhaps?

cyborgx7 8y ago

I'm glad the GDPR actually manages to enforce one of it's lesser talked about principals: data minimasation. What is worrying about this article is that it implies companies are using other, even less consensual ways of tracking users. Or maybe I'm reading too much into it.

Spare_account 8y ago
That was my take on it as well: > In a September 2017 study of 250 US digital marketers by Viant, about 60% of respondents said they will no longer rely on cookies for the majority of their digital marketing within the next two years. The absence of any description about what they will use instead is frustrating.
- nannal 8y ago
  Well if they talked about browser fingerprinting via javascript, someone would take a stab that too
- woud420 8y ago
  Considering you cannot use cookies for mobile traffic, it's understandable that most firms are moving away from it. Fingerprinting and device IDs have been common for a few years and I don't think it will go away any time soon.
  - sleavey 8y ago
    Why can't you use cookies for mobile traffic?
    - woud420 8y ago
      I wasn't clear enough and I apologize. You can use cookies but they will only be within the context of a singular app's browser. For example, suppose that you use two web browsers on your Desktop, Chrome and Firefox. If you visit xyz.com on FF, some cookie information will most likely be stored. However, if at a later time, you visit the domain on Chrome, it will not have access to the same cookie store. This becomes important in the context of third party cookies that want to track you across apps. Hence why cookies are not a reliable method of identification on mobile. Hope this clears it up. :)
- klmr 8y ago
  Which is odd, since GDPR isn’t about cookies. Other means of user tracking fall under GDPR too. (To clarify, it wouldn’t be particularly odd if companies were found to violate GDPR; but the selective move from cookies to other technologies doesn’t change the legal situation.)

iicc 8y ago

The "Factsheet" this is about (7 page pdf - https://reutersinstitute.politics.ox.ac.uk/sites/default/files/2018-08/Changes%20in%20Third-Party%20Content%20on%20European%20News%20Websites%20after%20GDPR_0_0.pdf https://reutersinstitute.politics.ox.ac.uk/sites/default/fil...) >All results presented here reflect site activity prior to obtaining consent; the picture may change dramatically once the user provides the affirmative opt-in GDPR requires. So, meh.

4ad 8y ago
Yep. If anything, things are worse now. You HAVE to give consent to do anything useful on the website (so blocking the notice won't work), and in the consent form it's usually very hard to turn tracking off, full of dark patterns. Not legal from the perspective of GDPR, sure, but it seems that everyone is doing it. /edit: downvoted for stating basic facts, amazing.
- cyborgx7 8y ago
  And I hope they will all get heavy fines for doing so. Let's see how well the EU will enforce the GDPR.
  - paulie_a 8y ago
    I honestly don't get why so many sites are even paying attention to GDPR. If they don't have a presence in the EU, it is irrelevant.
    - shagen 8y ago
      It is not. If their customers are in the EU they have to to comply.
      - jwineinger 8y ago
        What authority would make them comply?
      - 8y ago

legitster 8y ago

Honestly, the upcoming ePrivacy regulation is much needed- the cookies opt-in/out needs to be handled at the browser level. The current setup is lose-lose for businesses and end users. As a site admin, I have no problem honoring your request to not be tracked. I just can't wait until I don't have to deal with the nightmare that is OneTrust anymore.

Lio 8y ago
You mean like the "do not track" request header? https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track It never ceases to amaze me the number of companies that "value" my privacy but still somehow ignore the do not track header.
- pluma 8y ago
  Well, Microsoft kinda dropped the ball on that one by making it the default (although they later changed that).
  - deleted 8y ago
    [deleted]
  - Lio 8y ago
    I don't feel like they did drop the ball there. By default I don't want to be tracked. I think that tracking across the internet should be opt in and users should be made aware of what websites are doing _before_ they start doing it. I also find the idea of secret shadow profiles to slightly immoral for the same reason.
    - pluma 8y ago
      DNT is a flawed idea in the first place. DNT is based on the idea that users can opt out of being tracked by sending that header. But (e.g.) European privacy law requires having users explicitly opt in to being tracked -- the message DNT is meant to assert is the legal default under GDPR. DNT only works if the assumption is that users who make no choice can be treated as consenting (which is no longer the case under GDPR). But if you set DNT by default you're not asserting "this user doesn't want to be tracked", you're just making it impossible to tell whether the user explicitly opts out or hasn't made a choice (and therefore actually do consent). If tracking is opt-out rather than opt-in (i.e. if we disregard GDPR and similar privacy laws and go with how US startups have operated so far) that means DNT is no longer a reliable signal for opting out and thus meaningless. Implications about consent and privacy aside, DNT only works if it is used with intent. In the absence of intent, by making it the default without the user's knowledge, it becomes ambiguous and therefore pointless. To put it differently: if there had never been any browsers that set DNT by default (except maybe browsers explicitly marketing themselves as "privacy first" like Brave does), you could use DNT as an explicit assertion that you do not consent to being tracked. This means it could actually serve as a technical implementation to opt-out of any "implied consent" allowed by the GDPR and making use of your right to control your data. But thanks to Microsoft randomly slapping on the header to piss off Google, DNT is now too ambiguous to infer any of that.

dstroot 8y ago

Yeesh... 80 cookies on average for news sites! Down to 60... how many different ways do they need to track one person?

tim333 8y ago
At least it shows some decentralised competition! Instead of just Google and Facebook tracking you it's like everyone.
Uw7yTcf36gTc 8y ago
each ad network needs to track you separately. so most of those 60 cookies are not sending data to the news site, but rather to the ad network which bids to display the ad to you.
- ravenstine 8y ago
  There's ad networks, but there's also the plethora of vanity metrics that management likes to collect to fill their charts which they will then use to impress stakeholders, with the hope of getting paid more than the engineers. I could probably make a million dollars selling companies a "customer acquisition score" using phony baloney math if they place my script on their website.

jarfil 8y ago

The GDPR made me switch my cookie policy, to using two Chrome extensions in tandem: - I don't care about cookies: auto accepts all cookies - Cookie AutoDelete: auto deletes all cookies So now you can track me all you want... until I leave your website and all the cookies are gone (unless whitelisted).

Jerry2 8y ago
Chrome and these extensions give you a false sense of privacy. Currently, no extension can remove local storage and tracking information contained within them. https://bugs.chromium.org/p/chromium/issues/detail?id=78093 https://bugs.chromium.org/p/chromium/issues/detail?id=78093 You'll either have to clear local storage manually or get a privacy-oriented browser.

yeukhon 8y ago

I fucking hate GDPR policy making every website to show "Cookie Policy" ad pop modal. STOP. Every single time after I have accepted it, I come back the next day, I see the same modal again. I just accept it anyway, so stop. Stop this horrible UX. Sorry, but it really annoys the shit out of me. It does and I am pissed off every single time. If I accept, stop asking.

sleavey 8y ago
Are you blocking third party cookies in your browser? If the site uses a third party cookie to store your preference, then it may be unable to recall what you previously entered.
- yeukhon 8y ago
  No :/
simias 8y ago
Are you using a browser extension that may be interfering with the website? I haven't had issues with website forgetting my preferences yet. Also being in the EU I'm used to these cookie dialogues, except before GDPR if I wanted to opt-out (assuming that it was even an option) I'd often have to wade through multiple pages, opting-out of the tracking which would take a while, especially since they were usually using every dark pattern in the book. Now with GDPR I still get the messages but everything is opt-in instead of opt-out and I can just click the (sometimes obfuscated) "I refuse" and carry on. It's actually a huge quality of life improvement as far as I'm concerned.
- yeukhon 8y ago
  At work I don't have any third-party blocking extensions (I use Chrome). At home and on my mobile I do (I use Firefox Focus), but neither let websites to "remember". Is there something I need to configure?
  - r3bl 8y ago

snowwolf 8y ago

The dark patterns in play now to get explicit consent are pretty bad now though. Take Mashable for example. On first visiting the site you are presented with the option to "Consent" or view more Options (where you can Opt Out of all - except you can't really because some require Opting Out on the specific Advertisers site). But if you do choose to Opt Out all, they will then show you the initial Option box on every visit to the site, where you have to go through the More Options route every time. And if you ever accidentally click I Consent, then they opt you back in to everything again and then never show you that option box ever again. Note: I just picked on Mashable, but there are many, many sites following this same dark pattern.

sleavey 8y ago
This. I also found the Daily Mail decided that if you ignored the banner asking for consent and scrolled far enough down the page, it assumed consent for everything. Definitely shady, probably illegal.
- r3bl 8y ago
  GDPR requires affirmative action for consent. This was specifically touched upon in the recital 32: > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
EastSmith 8y ago
Enter Brave. And uBlock Origin. And DuckDuckGo privacy essentials.
- jszymborski 8y ago

crazygringo 8y ago

I just HATE all the pop-ups asking for permission to use cookies now. Seriously, having to opt-in on a per-site basis has led me to loathe the GDPR. It's a usability disaster. I never thought I'd hate anything more than the "sign up for our newsletter" pop-ups... but these are even more pervasive. If I'm the kind of person who hates cookies/tracking, I'll just install a blocker and block it everywhere, and then whitelist any domains I need to. It just makes me feel like the GDPR was a win for lawyers and legalese, and nobody else.

jasonkostempski 8y ago
I think we should have a de facto standard element class for legal notices with no required user action, like legal-notice-no-action-required. Webistes use the css class, uBlock Origin makes it a built-in default element filter. Website owners can fulfill their legal obligations and users that proactively shape their browsing experience are all set. Neither side wants these things messing up the browsing experience so, unlike the ad wars, we can work together.
- chriswarbo 8y ago
  > I think we should have a de facto standard element class for legal notices with no required user action, like legal-notice-no-action-required. Webistes use the css class, uBlock Origin makes it a built-in default element filter. Website owners can fulfill their legal obligations and users that proactively shape their browsing experience are all set. Sounds like P3P ( https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P ) > Neither side wants these things messing up the browsing experience so, unlike the ad wars, we can work together. Personally, I absolutely want to know when sites are trying to spy on me and sell the data. Despicable crap like that should be forced out into the public, not quietly agreed to by the browser. That's exactly what GDPR is for.
  - jasonkostempski 8y ago
    > Personally, I absolutely want to know when sites are trying to spy on me and sell the data. It's best to assume they're all doing that to some degree whether they tell you they are or not. For one, most of the world isn't beholden to EU law. Also, bad players don't play by the rules and by the time you know they're bad, it's too late. > Despicable crap like that should be forced out into the public, not quietly agreed to by the browser. But the cookie law doesn't fix that problem, or any problem for that matter. The notifications are 100% pointless and we're stuck with them because of a stupid law. If anything, having a standard way to block the notices might encourage more users towards a real fix for the tracking problems, which is using something like uBlock Origin (just don't tell that to the site owners that don't want users having tracking blockers).

amaccuish 8y ago

I feel like the DNT header could have been made a lot better if it worked alongside GDPR. Like, 0 = haven't chosen/prompt me (I want to pick exactly what cookies I want), 1 = don't care give me everything, 2 = functional, 3 = please don't track me at all. You could then just surface this per-site even in the browser, maybe in a way resembling the IE Security Zone settings with their nice sliders.

patrickmcnamara 8y ago
I don't think this would work as it makes it too easy to not be fully tracked. There are so many hoops to go through now because companies want to incentivise being tracked and punish those who don't wish to be. If this was brought in through regulation, that's a different story.

barbegal 8y ago

The methodology behind this study looks okay but it isn't necessarily representative of real world use. The study looks at the front page of around 200 news sites in Europe with a browser cleaned of all cookies. However in all cases the IP address belonged to a machine at the university of Oxford so it probably had some history attached to it. It shows some reduction in cookies served before user interaction but it isn't clear is this is due to GDPR or other changes that have been made over the 3 month period. My summary is that the data found is not statistically significant given the relatively limited sample size and lack of any control sample to compare against showing usual variation over a 3 month period.

alkonaut 8y ago

The GDPR should get one important update and that’s QUICK: You shouldn’t be allowed to ask for consent to do tracking or targeting as a pop up. The site must be completely usable using only “required” cookies (to which no consent should be required if it only tracks a limited set of data) and any option to consent to anything outside this must be a hidden option. That is: sites should have to work 100% without popups and shouldn’t be allowed to use “marketing cookies” (for tracking and ad targeting) Otherwise we just traded one nuisance for another.

chriswarbo 8y ago
> The site must be completely usable using only “required” cookies (to which no consent should be required if it only tracks a limited set of data) I think GDPR does actually say this. > any option to consent to anything outside this must be a hidden option. You're right that this would be a difference (although I imagine sites would still end up covered in dark patterns trying to get users to enable it)
- alkonaut 8y ago
  Right. And ”hidden option” is perhaps the wrong word, but let’s say one that doesn’t prevent using the site/service in full. Even supposedly serious outlets like WaPo does this. Full screen splash that says “by using the site you agree to targeted ads”. Why even bother with that when it’s so blatantly in violation? Isn’t it almost better to not look like you are deliberately in violation like that? It’s not even a dark pattern, it’s just a big fat splash explaining how they don’t care about the GDPR and intend to show me targeted ads using tracking cookies.

codedokode 8y ago

I don't understand why there is so much negative impression of GDPR. Most businesses do not need to track users; they do it only because they can and it is not forbidden. Let me give you some examples: - Wikipedia can serve you pages without knowing anything about you - You can download and use Debian distribution without providing any data about yourself. Microsoft can do the same. - Internet shops like Amazon or Ebay don't need to track you. They earn money when you buy something and if they delete PII after the order is completed they still have the money. GDPR is not taking them away. - Google can work just fine without tracking users. They show advertisement in search results, they get paid for it and they don't need to collect everything you have typed to earn profit - Youtube can show ads and get paid for it to completely anonymous users - Android and Google Maps don't need to track you. You paid for them when you bought your device, you don't have to pay once more with your data and opt into dubious "help us improve your user experience" scams. - Netflix gets money from you anyway and doesn't need to track you - Facebook doesn't need to track you across the web. It can show ads and get paid for it anyway. Look around. Most of businesses can earn money without collecting any personal information. The ones who can lose because of GDPR are only shady marketing agencies, legal spam conpanies, data brokers and three-letter agencies. I don't feel sorry for any of them. We should think about better protection of privacy and anonimity rather than worry about profits of Californian corporations wanting to make everyone their product.

baseballdork 8y ago
If you're looking for advertisers, all other things being equal, do you go with the advertiser who guarantees your ads will go to those most likely to have interest in your product, or do you go with the advertiser that will send your ads to random people? Of course they _can_ serve ads randomly, but they're competing to provide the best value for those buying ads.
- codedokode 8y ago
  Corporations want cheaper ads; I understand that but I don't understand why I should be tracked. They should develop better ads without violating someone's privacy or anonymity.