7 ms·

CNIL forces bad UX pattern on EU users. The correct pattern would be to use reasonable default settings and allow more advanced users to customize. But EU wan

• xg15 8y ago
  I think they are perfectly free to present an unticked "personalize ads" box as a reasonable default. > For vast majority of users advanced configuration options look like mumbo-jumbo, so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all. Hiding the (pre-ticked) consent boxes in "advanced configuration" UI has been the default strategy so far. This fine made clear that this doesn't actually work to obtain valid consent.
  • dennisgorelik 8y ago
    Why do you think that an unticked "personalize ads" box is a reasonable default? I, personally, when I browse internet, strongly prefer personalized ads (over non-personalized ads). Most users, probably, do not care either way (because they do not understand the implications). But the business (e.g. Google) cares about ads personalization a lot, because ads personalization significantly increases tax revenue and reduces number of irrelevant ads that users see. In this situation the reasonable default choice is to allow ads personalization, so the business will have ad revenue to function and deliver functionality users need.
    • xg15 8y ago
      In this case, the EU per their democratic processes decided they need additional consent. Easy as that. > because they do not understand the implications This is the point. Relying on people not understanding something is not ethical and certainly not "reasonable".
      • dennisgorelik 8y ago
        > EU per their democratic processes decided Do you imply that democratic process never make mistakes? > Relying on people not understanding something is not ethical CNIL bureaucrats rely on people not understanding, that these GDPR regulations make internet worse (annoying "accept/deny cookies" questions, less relevant ads, less revenue for businesses to create functionality users want). Would you say that CNIL is unethical?
        • xg15 8y ago
          How does the GDPR force any of that? Anyway, that's whataboutism.
    • whyever 8y ago
      It's not about personal preference. The GDPR does not talk about a "reasonable default", but about "freely given, specific, informed and unambiguous" consent from the user. There must be a "clear affirmative act" by the user, so consent has to be opt-in.
      • dennisgorelik 8y ago
        > There must be a "clear affirmative act" by the user ... according to GDPR. My point is that GDPR is bad (for internet users) at the very core (intent) of GDPR legislation. I claim that it is bad for internet users to force them to make cookies decisions for every website that wants to use cookies.
        • DanBC 8y ago
          > I claim that it is bad for internet users to force them to make cookies decisions for every web site. Which EU law do you think forces this? Please can you link to it?
          • dennisgorelik 8y ago
            I meant "make cookies decisions for every website that wants to use cookies" (I just updated my comment). ========== https://eugdpr.org/the-regulation/ https://eugdpr.org/the-regulation/ The request for consent must be given ... ==========
            • detaro 8y ago
              more precise: for every website that wants to use cookies and choose (or had to choose for lack of alternatives) consent as their justification for processing. Not all data processing requires consent.
            • DanBC 8y ago
              Please can you paste the text that you think forces websites to gain consent for all cookies if that website uses cookies? The site you linked is not the law, it's some kind of blog. But let's use this site: where does it say that all cookies require opt-in consent?
    • AnaniasAnanas 8y ago
      Personalized ads require some sort of your information to be stored, which is why I think that it is not a reasonable default. In addition to that by making the information collection opt-out you could easily track the privacy-minded that decide to disable it - see DNT for example.
    • zrobotics 8y ago
      >>I, personally, when I browse internet, strongly prefer personalized ads Which is fine if you want to click the checkbox to enable personalization. But not everyone wants that personalization and tracking. For instance, I've found personalized ads to be worse than generic ads, where Google tries to sell me a product for weeks after I researched and purchased it. If you enjoy the personalized ads, there is nothing to stop you from opting in, but that shouldn't be the default behavior.
    • M2Ys4U 8y ago
      >Most users, probably, do not care either way (because they do not understand the implications). But the business (e.g. Google) cares about ads personalization a lot, because ads personalization significantly increases tax revenue and reduces number of irrelevant ads that users see. This is exactly the reason for the GDPR. Users don't understand the implications and so they shouldn't be automatically opted-in to systems that violate their human rights.
• CrlNvl 8y ago
  The simple approach is the Do Not Track option activated in my browser. Seems like nobody cared about it, so yeah, forcing opt-in is the way to go.
  • dennisgorelik 8y ago
    > Do Not Track option activated in my browser 1) "Incognito" mode. 2) "Clear browsing data". > Seems like nobody cared about it That is exactly my point: vast majority of users do not care much about removing their cookies. If users do not really care -- why pollute UI of websites with questions that users do not care about?
    • TACIXAT 8y ago
      Those things don't stop companies from collecting information on you. I wish that stuff was stored locally. >Most websites and web services, including Google's, don't change their behavior when they receive a Do Not Track request. [1] 1. https://support.google.com/chrome/answer/2790761 https://support.google.com/chrome/answer/2790761
  • scarejunba 8y ago
    Almost all advertising companies were gearing up to respect that, then IE10 violated the standard as in the RFC and set a default value for that header.
• dmitriid 8y ago
  > CNIL forces bad UX pattern on EU users. It doesn't. The current breed of UIs that we see is companies trying to find an easy way out. Easily half of them are illegal under GDPR: they are either ambiguous, or redirect to third-party websites, or employ dark patterns, or require consent to collect data that's not required for website operation, or all of the above and more.
• Adrig 8y ago
  That's bullshit. Explaining what you get and what you give is not bad UX and can be integrated nicely into almost any user path. UX is not about smoothness of the first 5 min of using a product. Long term counts. Let's ask how people feel about facebook these days ? They had a perfect blindfloded way to inboard you, do you still think that is good UX ?
  • kortilla 8y ago
    I don’t want a 5 minute onboarding process to read a news article.
    • cjg 8y ago
      I wouldn't choose to give up any personal information to read a news article.
  • dennisgorelik 8y ago
    > Long term counts. Only if you keep using the same website again and again and do not delete cookies. Is it your goal to reduce number of websites that users visit?
    • Adrig 8y ago
      I'm sorry you're right, I only used google 2 times last year.. Name 1 internet website that don't care about retention. People usually don't delete cookies at all, and it could be a good pre-signup tool. And if a website that I'd only use once vacuumed all my personal data, I'd really question their ethics
• stefan_ 8y ago
  That is entirely by design? If you collect so much diverse data that you exploit in 100 different ways and share with 1000 different companies that you require a hundred pages of individual consent checkboxes, the system is working as intended. Will most users just accept all? Maybe. But I think the share of concerned users is larger than you believe it to be. And if history is any indication, "reasonable default settings" have a bad habit of never erring on the side of data collection minimization, particularly for new and novel features.
  • alkonaut 8y ago
    It should be a requirement that the hassle is proportional to the data sharing. Want to share my data with 100 different places? Make me click 100 checkboxes.
  • quest88 8y ago
    Where does it say Google shares its data with other companies?
• simias 8y ago
  I don't blame the CNIL, I blame the tech giants who use dark patterns to trick me into giving my data. I hope the CNIL and other regulatory bodies won't relent until Google & friends figure their shit out and offer sane defaults in a sane UI. I don't understand what "advanced users" have to do about that, it's about privacy and owning your data, do you think less savvy internet users should just let Google siphon their data? If anything they're the one who most benefit from this change since they're less likely to understand what data they're sharing exactly and implement countermeasures client-side. >so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all. That's because of the dark patterns I talk about above. Given clear "I accept/I refuse" controls it wouldn't be any slower or difficult to quickly dismiss the dialog -- without reading it at all. But of course Google doesn't want you to do that so they make it as hard as they can to find the "I refuse" control, leaving you with a cumbersome UI where you're tempted to click "I accept" to get it over with.
  • dennisgorelik 8y ago
    > Given clear "I accept/I refuse" controls it wouldn't be any slower or difficult to quickly dismiss the dialog 1) It would definitely be slower than not having that dialogue at all (the less UI elements - the simpler). Do you remember that typical user visits Google web site NOT to setup his privacy settings, but with a totally different goal (such as do web search)? 2) "Accept vs Deny" is easy to read, but how would most users know what choice is better for them? In order to form a reasonable opinion on that cookie choice -- I personally spent multiple hours (if not days) of reading and thinking.
    • simias 8y ago
      >1) It would definitely be slower than not having that dialogue at all (the less UI elements - the simpler). >Do you remember that typical user visits Google web site NOT to setup his privacy settings, but with a totally different goal (such as do web search)? I mean have you seen the current dialog you get when you get on a google domain with a "fresh" session? It's a wall of text with a scrollbar redirecting you to multiple other pages if you want to see what exactly Google collects. It's also pretty unclear what each link leads to and how to opt out of everything. Clearly they didn't really optimize for simplicity here, they're the only ones to blame for that. I'm perfectly aware that people don't go to google.com specifically to setup privacy settings, and that's precisely what Google is counting on. By using an unnecessarily complex interface they hope that people will give up immediately and accept whatever Google is pushing. >In order to form a reasonable opinion on that cookie choice -- I personally spent multiple hours (if not days) of reading and thinking. Well that's your choice, my modus operandi is simpler: I systematically refuse everything I can refuse. That's quick and easy. I have yet to witness any degradation of my browsing experience. I'd be curious to hear what kinds of dilemmas you've had while reading the terms and conditions that lead you to days of thinking.
• maaaats 8y ago
  > CNIL forces bad UX pattern on EU users. I prefer bad ux patterns over dark ux patterns.
• Animats 8y ago
  Compliance is easy. Make the default "no tracking, no ad customization". Only trying to evade that makes it hard.
• goto11 8y ago
  If the default was not to track the user, it would not be a problem. Advanced settings could allow the user to opt-in to various forms of tracking.
• abelhabel 8y ago
  I cannot disagree more. There is a general confusion that the job of a user interface is to simplify the system, where that is the last thing a user interface should do. What a user interface should do is to make it as simple as possible for a user to understand and interact with the system. Google's system is immensely complex and they have intentionally not given their users all the information and not all the options for interaction. This is intentional of course, but by looking at the user interfaces they provide as is we have to conclude that they are doing a very poor job of giving us access to understand the full complexity. Imagine if Adobe replaced all their interfaces with a few simplified buttons, one brush to use, filters are automatically applied, lighting automatically adjusted based on personal history etc. No one would use such a program. The GRPR in this case is pointing out that Google is not showing all the options and when they are they obscure them, ie they have bad user interfaces by making it as difficult as possible for a user to understand and interact with their system. If anything, this will force Google to make good user interfaces. For, if the measurement of a good interface is about how simple the interface is regardless of the complexity of the underlying system, then all good user interfaces should be reduced to one button. Such a measurement of quality is ignorant and cannot further any skill in designing user interfaces.
  • wokwokwok 8y ago
    What is simple? What is simple enough? For who? This is entirely subjective and meaningless unless you have a way of measuring it objectively. All it’s actually doing is making people change things, basically arbitrarily, in the hope it’ll make things better. Maybe the intent is vaguely in the right place, but I’m pretty skeptical of any kind of magic bullet for making people make “good” user interfaces. I think it is far from clear this will make things better, not worse.
• abricot 8y ago
  From TFA: "That does not mean that the GDPR is respected. Indeed, the user not only has to click on the button “More options” to access the configuration, but the display of the ads personalization is moreover pre-ticked. However, as provided by the GDPR, consent is “unambiguous” only with a clear affirmative action from the user (by ticking a non-pre-ticked box for instance)." I don't think the "More options" issue would have been too much of an issue if all the options weren't preselected.