47 ms·

Cookie Warning Shenanigans Have Got to Stop

• weinzierl 8y ago
  To add insult to injury the big players with most trackers just refuse to show the cookie warnings at all. At least that's the situation Germany where most major news outlets are full of ads and trackers and handle all of it via opt-out(!) in the privacy policy. For a example see spiegel.de, the most widely read German-language news website. It's mostly small and medium sized firms that show the cookie warning out of fear. That's completely the opposite of what I want as a consumer as well as a small-time webmaster. EDIT: Just to be clear: spiegel.de never shows a cookie warning even if visit with a fresh browser. You can opt out by visiting their privacy page [1] (in English). [1] http://m.spiegel.de/extra/what-we-do-with-your-data-a-1211940.html http://m.spiegel.de/extra/what-we-do-with-your-data-a-121194...
  • tmikaeld 8y ago
    That's a lot of tracking, uBlock blocks 13 domains before even loading google tag manager.
  • Angostura 8y ago
    Popped in a complaint to your local data protection body?
  • fixermark 8y ago
    Anyone who didn't see this as the predictable end-result of requiring cookie awareness and consent was hopelessly naive about how large vs. small organizations respond to unfunded government mandates. The money and time could have been a lot better spent on international awareness campaigns arming consumers with more privacy knowledge instead of expecting website owners to shoulder the informational burden (because those orgs in aggregate have no core incentive to treat user's privacy as an inherent good).
    • ucarion 8y ago
      These organizations do have such an incentive. The very essence of GDPR is to create these incentives. The EU's goal with GDPR was to make user data a liability, and to encourage organizations to reconsider their need to hoover and hoard it. The GDPR is unlikely to be overturned, and there are plenty in the EU who are eager to enforce it. Just because it's not being enforced right this second doesn't mean the law won't catch up to offenders. Especially if Margrethe Vestager replaces Jean-Claude Juncker as president of the European Commission, you can expect a ton of action on this front.
      • blibble 8y ago
        > Especially if Margrethe Vestager replaces Jean-Claude Juncker as president of the European Commission, you can expect a ton of action on this front. the odds of this are essentially zero she's in a minor EU party and her own country won't put her forward as candidate
      • MaxBarraclough 8y ago
        > there are plenty in the EU who are eager to enforce it But we haven't yet seen it enforced, have we?
        • int_19h 8y ago
          https://news.ycombinator.com/item?id=18416887 https://news.ycombinator.com/item?id=18416887
        • rickycook 8y ago
          we have definitely seen movement (plenty of data protection authorities have issued warnings), but it really hasn’t been that long (it’s been less than a year) the only way that a law like the GDPR that’s purposefully vague and broad can work is to allow plenty of lead time for warnings and fixes before fines it’s a process; you shouldn’t expect it to change everything overnight
      • Mirioron 8y ago
        >The EU's goal with GDPR was to make user data a liability, and to encourage organizations to reconsider their need to hoover and hoard it. And as a consequence we're going to continue sinking into irrelevance. >The GDPR is unlikely to be overturned, and there are plenty in the EU who are eager to enforce it. I think it will be overturned a couple of decades from now, when an economic crisis hits and we find that we've fallen significantly behind other countries due to our fear of technology.
  • alkonaut 8y ago
    There is a window now when players can argue that the regulation text isn't clear (it is). Let's hope regulators pick a few high-profile targets that are in violations and hit them with massive fines.
  • dexen 8y ago
    >players with most trackers just refuse to show the cookie warnings at all The results of the legislation -in regard to cookies- are inconsistent, annoying, unevenly enforced, create a moral hazard and two-tier system, and I presume have negative overall utility. This is why I do not consider the law to have been written with good intentions. The intentions were claimed to be good, but I don't see the lawmakers having had put in the necessary effort to ensure privacy improvement. Nor admit there are shortcomings to the legislation that need either fixing, or perhaps scrapping the legislation. Did they really intent on exerting enough effort to write the legislation well? To shoulder blame if it does not work out? To take the responsibility? Or to shore it up as situation develops? Right now I perceive the cookie warnings to be merely EU's advertising banners - "Heeey, this is EU taking care of you!" - plastered all around the web just like banner ads used to be plastered all over the web. Morally the same - pompous self promotion, except paid for with legal rubberstamp rather than money.
  • rebelde 8y ago
    Can somebody explain how Der Spiegal does this legally? If they can do it, maybe others can use the same justification.
  • lixtra 8y ago
    Spiegel.de also sometimes refuses to serve you content if you have DNT flag set which in theory would be a convenient way of getting rid of cookie banners.
• dash2 8y ago
  This is like a case study of well-intentioned, carefully designed regulation doing more harm than good. Honestly, I'd rather just have a browser addin that blocks the cookies I don't want. The market was working fine. Now every new website is a pain, and my organization has hired some amiable lady to be "GDPR expert". She doesn't appear to know anything about anything, but she sure seems nice.
  • paxys 8y ago
    I wouldn't call GDPR "carefully designed" at all. It is ridiculously broad and vague, and so far all implementations (including the cookie warnings all over the internet) are best guesses.
    • kybernetikos 8y ago
      Most of the cookie warnings are clearly against guidance which says that consent must not be a condition of service to be considered freely given, must be opt in not opt out and that even with consent the use of pii must be in the user's interests. Almost no cookie warnings meet the law and many of the ones that do could use a different lawful basis and not show a dialog at all.
      • paxys 8y ago
        > consent must not be a condition of service So what do you do if your website literally cannot function without cookies?
        • rcxdude 8y ago
          Then you do not need to ask consent to use them. You only need consent for cookies or data collection if it is not necessary to the service (and 'necessary for tracking ads' does not count as necessary).
          • paxys 8y ago
            Why not, if that's how you are paying for the site to exist?
• tylerrobinson 8y ago
  I find the clarification about cookie walls being out of compliance with GDPR to be a real headscratcher. Here's part of the Dutch authority's FAQs[0] thanks to Google Translate: "At a cookie wall, website visitors have no real or free choice. It is true that they can refuse tracking cookies, but that is not possible without adverse consequences. Because refusing tracking cookies means that they cannot access the website. That is why cookie walls are prohibited under the AVG." I find this fascinating. Is there really not a free choice to simply leave the website? A paywall is surely legal. But it is illegal for me to "pay" using something other than money. Am I allowed to offer users additional functionality in exchange for access to their data? [0] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#mag-ik-als-organisatie-een-cookiewall-gebruiken-7111 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne...
  • roywiggins 8y ago
    That's how the GDPR is designed. I'm not a lawyer or a GDPR expert, but I believe this means that unless your service actually requires a particular type of data collection to function, you're not allowed to make access to that service contingent on that data collection. http://www.privacy-regulation.eu/en/r43.htm http://www.privacy-regulation.eu/en/r43.htm > Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. In other words, people aren't allowed to sell their data in exchange for services. I suppose the argument is that people are really bad at valuing their own data. They don't know how it can be combined with other datasets and how it might be resold and repackaged and never go away. There are other things people can't legally sell, such as organs, votes and sex, so it's not an entirely brand new idea.
  • shaki-dora 8y ago
    I am befuddled by your befuddlement. Consumer protection laws regularly put limits on the freedom of contracts between companies and consumers. A rental car agency can’t give you a rebate for renting an unsafe car. The fact that no money changes hands doesn’t change this. If you’re offering free taster portions of bread to passer-bys, you can not use lead as an ingredient. Neither being free, nor putting up a sign with the list of ingredients will change that.
• Causality1 8y ago
  Congratulations, there's now a pop-up added to every single website on the internet that isn't blocked by adblockers. It makes zero difference to me whether the pop-up is telling me about cookies or advertising "huge anime tiddy" it's still an obstruction and a delay.
  • timbit42 8y ago
    This Firefox add-on hides of most of them: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/?src=search https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
• duxup 8y ago
  I feel like GDPR and such had some good spirit to it... but the result isn't what they had in mind and the consumers just click through everything / have no more clue. Piling on or malforming GDPR seems like it would just make the already unworkable situation more of a mess. I like the "ideas" behind GDPR, it's just this isn't the way to do it and really accomplish anything that really helps an individual.
  • dcbadacd 8y ago
    The reason it hasn't been super successful is that there haven't been big punishments.
  • fixermark 8y ago
    I wonder how often we'll repeat the error of treating user privacy as something the user cares deeply about (against all this observable evidence to the contrary) before we accept that the well-demonstrated-and-documented default is users do not care (and if we want the behavior of websites to change, step 1 is educating users as to why they should care and what the risk models are).
    • duxup 8y ago
      Yeah I fear that is the case. Unless users really become educated and then care ... this is all for not. If it ever happens (people caring and informed) maybe we're a generation or two away from it being a thing. :(
    • cm2012 8y ago
      I mean, for the average person, it's pretty rational not to care. The only result they see from tracking is seeing more relevant ads. 99.99% of people for the foreseeable future will not have a bad experience from commercial tracking (that they wouldn't have from non-tracked ads anyway).
  • Baeocystin 8y ago
    It kind of feels like Prop 65 here in California. So many things have a 'this could cause cancer' tag that it is ignored 100% of the time, the exact opposite of its intent.
• shaki-dora 8y ago
  What people miss about the new GDPR notices, compared to cookie warnings of yore, is that they offer you the choice of opting out. In my experience, the option is usually hidden (look for “options”). But a surprising number of sites do actually comply and make this not prohibitively obscure.
  • duxup 8y ago
    I think Troy's point though is that if you understand the situation. You already have lots of tools at your disposal to opt out. It's not easy, but you know and can to some extent do it. Meanwhile everyone else doesn't understand these pop ups, doesn't know anything more post GDPR, and they just roll through them and get tracked just the same. In effect we have big annoying pop ups and little seems to have changed. If we care about the ideas behind GDPR, I think we have to recognize that it may be failing miserably in practice.
  • mrweasel 8y ago
    It was my clear understanding that "pre-checked boxes" would be illegal. Meaning that if you want to have 200 trackers on a page, then the user needs to click accept to all 200 trackers. So that if you just dismiss the "Cookie warning", you would be default get no tracking. That pretty much solves the issue right there, most people would effectively have zero tracking.
  • rcxdude 8y ago
    Some of them make the process as slow and painful as possible (I've seen one where you need to deselect a huge number of pre-checked boxes, and then you need to wait through an excrutiatingly long and artificial 'applying preferences' process bar before you are permitted to continue. The website then forgets this preference the next time you visit it). This is directly against GDPR and I hope that companies engaging in these practices to try and make sure as few users as possible opt out get slapped as hard as they can by the regulators.
• kilburn 8y ago
  I'm sure there's some good reason not do it, so I'll ask if anyone here knows: why doesn't the law just require some technical implementation that can be automated? Why can't the law just specify something similar to the DNT header (finer grained) and require compliance with that?
  • currysausage 8y ago
    The GDPR offers a general privacy framework. Technological specifics may (or may not) become part of the upcoming, heavily embattled "ePrivacy regulation", which was intended to come in effect simultaneously with the GDPR. Right now, we have a somewhat unfortunate limbo.
  • wsy 8y ago
    The law should lay out principles, not techniques. The GDPR works for any kind of data processing, it is not specific to browsing on the Web. The core issue is that the ~150 companies of the Oath network will effectively go out of business when they comply with GDPR. So now they try to play some games, until the fines handed out to them become too large to sustain in EU.
    • Mirioron 8y ago
      Can't they just stop their business in the EU?
• currysausage 8y ago
  The omnipresent "Please accept our privacy policy (or leave)" is worthless cargo cult GDPR pseudo-compliance. If it's neither freely given nor informed, it's not consent under GDPR. See Art. 7: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." See Recital 32: "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data ... This could include ticking a box when visiting an internet website ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent." If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach). Please feel free to downvote this if you don't like it, but I'm merely telling you what the law says. If you disagree factually, I'd appreciate a comment though.
  • alkonaut 8y ago
    > If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach) Exactly this. Basically what the GDPR says is: if your business doesn't require the data, you cant use it without the user's consent. And data used for better advertising is NOT essential to e.g. a news site. What's more, the regulation syas that you can NOT simply say "accept or leave" in that case. You then have to provide the service to the user without storing that non essential data. You can't provide a service, even for free, that you condition on storing data not essential for that service. There is no "if you don't like it, leave" clause. Basically: spiegel.de has to be prepared to show their news to anyone, including those that do not wish to be tracked by their ads. Right now we are in a period of denial where site owners believe they can have these "By entering you agree to..." banners. Once the first large fines are handed out, It'll be fun to watch.
    • icedchai 8y ago
      This is the view of a US person: These are private owned and operated web sites. The site owner determines what is "essential." If you do not agree to to the terms, do not use the site. If you don't want to be tracked for advertising, that's on you to install ad blockers.
• radium3d 8y ago
  As a web developer I gotta say the only true solution to this is to stop using the internet altogether. Might as well shut the internet down. We can't authenticate you without cookies or some other form of identification, so that throws out any site with an account. Even if I am not even remotely interested in tracking what pages you view on my website if I need to have you login and authenticate I need some form of cookie / session ID. If you need to be anonymous use a browser like Firefox Focus or similar but understand that you won't be able to log in for longer than a single session, if at all. Cancel GDPR and similar privacy laws before we outlaw the [useful] internet completely. These laws are a mess written by people who honestly are not remotely qualified to make these kinds of decisions. I'm all for the option of privacy but it's your own responsibility -- stop using the internet leave all your electronics at home and go ride your horse into the wilderness and breathe some fresh air if you want privacy.
  • JoshTriplett 8y ago
    While I'm certainly not going to argue in favor of the GDPR, the "cooking warning" actually specifically excludes cookies used for things like authentication. It covers cookies used for other purposes, such as trackers.
    • radium3d 8y ago
      From my understanding if the cookie is for an account on a website (which usually is only required to store private information such as name, email, address, etc) you would need to display the cookie warning.
      • scrollaway 8y ago
        Cookies are only affected if they are not a core and essential part of the product's functionality, and can identify the user. You could also argue that authentication may not be an essential part of an app's functionality, but you would not be successful; it's well-established by now.
        • 8y ago
• deleted 8y ago
  [deleted]
• dcbadacd 8y ago
  It's time GDPR is actually enforced. I tried to get my country's law enforcement on the tail of some violators but they're toothless. I don't understand the downvotes though, are you disagreeing that certain countries do not have the manpower to enforce GDPR to the extent they could? Please.
  • jolmg 8y ago
    Are those violators outside the EU? I'm interested to know if the EU would seriously try to enforce their laws in foreign lands that never agreed to them.
    • dcbadacd 8y ago
      Nope, local violators.
  • Semaphor 8y ago
    I think they are currently going after the big ones. Personally, I expect that to change once they are through with them. It simply makes no sense to go after big companies when there is still google and facebook to go after. And well, medium and small? I think those still have another year or 2.
    • dcbadacd 8y ago
      Let's hope so.
    • pdkl95 8y ago
      In addition to the practicality of choosing the big, obvious violators first, one or two actions against well-known targets should hopefully convince a lot of the secondary and tertiary potential enforcement targets that the EU is serious about enforcing these regulations. Some[1] companies might even decide that complying with the regulations be a better business plan than abusing their user's ignorance to undermine democracy[2]. [1] Unfortunately, experience suggests many will prefer bullheaded clinging to their surveillance capitalism business models to the bitter end. [2] http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and-a-the-age-of-surveillance-capital.html http://nymag.com/intelligencer/2019/02/shoshana-zuboff-q-and...
• bjt2n3904 8y ago
  FTA he's quoting: > And the Dutch DPA’s guidance makes it clear internet visitors must be asked for permission in advance for any tracking software to be placed — such as third-party tracking cookies; tracking pixels; and browser fingerprinting tech — and that that permission must be freely obtained. Ergo, a free choice must be offered. Neither cookies, nor tracking pixels, nor browser fingerprinting are software. Your web browser is software. The server side runs software. These are data. It seems pedantic, but I think it shows that the lawmakers have an underlying misunderstanding of how tech (and the world) works. To make an analogy, cookies and tracking pixels are akin to license plates. I think the authors of this law thought they were more like cellular GPS beacons. It's one thing to say, "no installing a device which actively communicates home on your visitors". It's quite another to say, "No remembering your visitor's face unless they tell you it's ok."
  • sk5t 8y ago
    Tracking cookies, pixels, etc., are implemented by server-side software; perhaps the matter you would like to contend is what the meaning of the word "placed" is.
    • shkkmo 8y ago
      Cookies are data that is placed on the visitor's computer. Tracking pixels are software instructions placed on the visitor's computer. The tracking that is akin "remembering a face" is user agent and ip address tracking. In my mind, a store that uses facial recognition software to track my movement within the store and purchasing habbits is still incredibly creepy and highly invasive of my privacy.
      • bjt2n3904 8y ago
        The government has automated license plate readers that do much the same thing. Their justification is, you're in a public place, you have no expectation of privacy. I'm a little more concerned about that. If I don't want to be tracked, I can choose to shop at a different store. But I can't live in a system of underground tunnels.
• VectorLock 8y ago
  Its too bad nobody invented a browser header to be sent with HTTP requests for Allow-Cookies: SURE_YES_WHATEVER_OMG_STOP_ASKING_PLZ
  • pxtail 8y ago
    There are browsers addons for removing these annoying notifications, most popular is named "I don't care about cookies"
    • dcbadacd 8y ago
      uBlock cookie annoyance list works too
  • mherrmann 8y ago
    The name for such a header should have been included in the EU directive about cookies. HN, can we get a political movement going to make the EU adopt this?
  • dexen 8y ago
    The next best thing is uBlock filter list. What if I told you... [1][2] [1] http://prebake.eu/ http://prebake.eu/ [2] https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
  • contravariant 8y ago
    It's too bad nobody came up with the simple idea of forcing browsers to ask permission before sending personally identifying information everywhere.
    • monocasa 8y ago
      It's amazing what's personally identifiable though. Browser fingerprinting combined with ever present analytics scripts gets you most of the way there.
      • 8y ago
• pedro_hab 8y ago
  What I don't understand is why websites hosted outside the EU, for non-EU users have the cookie banners. At least keep it in Europe, use the IP to geolocate, let the EU users deal it. Some companies have outright banned EU traffic, sounds like only showing the banners for EU IPs seems ok.
  • bunderbunder 8y ago
    The law doesn't just apply to pages being served to the EU, it applies to pages being served to EU citizens, wherever they happen to be at the moment. So geolocation is not a satisfactory option.
    • Chris_Chambers 8y ago
      The EU are a bunch of unelected parasites. Perpetuating the delusion that they have any power by obeying their imaginary laws is cowardly and immoral.
    • jahewson 8y ago
      No, that not true. I am an EU citizen and live in the US. GDPR does not apply to me when I deal with US businesses! Likewise a non-EU citizen who lives and works in the EU is in fact covered by GDPR. GDPR actually applies to companies which are doing business in the EU and storing personal data of anybody who resides in the EU.
    • downandout 8y ago
      It only applies to sites outside the EU if the site "envisages" serving EU customers. The suggested test for this is if the site offers foreign language versions of the site for EU countries, allows payments in EU currencies, etc. For sites in the US that are intended for a US audience, compliance is unnecessary, regardless of the fact that some traffic may be coming from the EU. From [1]: Recital 23 provides a further clarification for cases where it’s unclear if a firm offers goods and services to EU data subjects: Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/
• draw_down 8y ago
  Everything in California is labeled carcinogenic, and so nobody pays it any mind, but it's still done anyway because that's what regulations and the law say. Similarly, this isn't just a bunch of people who operate websites deciding to write these wacky cookie banners because they think people really care about cookies. When I implemented one of these it was because lawyers told my team to do it. We didn't want this, neither as developers nor as users of websites. Neither were our designers thrilled at the prospect of cluttering up our site with this dingus. I get that this is just a general rant, and I agree that people just click through them and don't actually care. But it's important to keep in mind how this actually came about, and (as a somewhat separate point) that lots of things in our society operate this way. Which is not intended as a defense, but it's more common than just cookies. Or do you read every terms of service document shoved in your face when you sign up for something?
• colordrops 8y ago
  Is it possible to write a browser extension that has the browser request access to store cookies just like it does for microphone or location access?
  • nvr219 8y ago
    You can do this and it’s abhuge pain in the butt for the user
  • timbit42 8y ago
    Firefox has had that built in for years but you have to manually accept or deny cookies for each website and you would still get the popups. I just use this Firefox add-on to hide most of the popups: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/?src=search https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
  • bo1024 8y ago
    I think it must be. I use uMatrix which essentially does this, except it doesn't use popup requests - if you want cookies, just make a few clicks.
  • noxToken 8y ago
    You don't need an extension. You set cookies to deny all. Then you look at the list of blocked cookies when you on a website, and you can individually allow cookies on a per domain basis.
• KorematsuFred 8y ago
  It is common sense vs dumb bureaucrats of EU. Who do you think wins in the long run ?
  • expertentipp 8y ago
    Media companies, publishers, and copyright hoarders, obviously.
• pxtail 8y ago
  Well, only somebody completely out of touch with reality (=government folks) wasn't able to predict outcome of this law. Good thing that there are browsers extensions which take care about removing these "cookies" notification so I don't have to deal with it. Regular users absolutely do not care about privacy,cookies GDPR etc. When events like "cambridge analytica" occur they will be enraged, maybe even some "thumbs down" and "angry face" emotes will appear under facebook news notification before scrolling further down! Probably for HN users it is hard to comprehend because you are looking at the world from inside of your knowledge bubble. More knowledgeable users know that this is total farce and masquerade and don't care about cookie notifications too.
• then 8y ago
  this gdpr....argh.. all smoke and mirrors bs leftist incompetence, breaking the www experience, luring users into using even more more opaque 'apps' (usually simple ux making http api calls). The real question is who will be siphoning 'our' (eu) data in the near future (more), china, u.s. or full on balkanisation?
• purple_ducks 8y ago
  (European) Most sites have a simple 'Reject All' which I definitely use all the time. Oath and it's sites are the devil incarnate when it comes to implementation and they deserve to be slapped down.
  • eclat 8y ago
    This is precisely it. It's not that the EU legislation is too restrictive, it's that it doesn't go far enough. Sites like these shouldn't be compliant, users should be prompted with a simple yes/no consent form without any dark patterns.
    • wsy 8y ago
      They are not compliant. The fining machinery is just being started, and it will take a while.
• peterwwillis 8y ago
  Can anyone explain to me why the browser isn't the one asking the user? Since, y'know, the browser is the only thing that actually prevents a cookie from being placed or sent in the first place?
  • tgsovlerkhgsel 8y ago
    The browser cannot distinguish between cookies that are necessary to support a feature you're using (e.g. a session cookie for a login or shopping cart) and a tracking cookie. The former does not require consent. The latter does.
    • peterwwillis 8y ago
      That's a technical problem, which shouldn't prevent solving the main usability issue. For example, the CAN-SPAM act requires the words "SEXUALLY EXPLICIT" to accompany messages with sexual/adult content. A tracking cookie's name can simply have the word "tracking" in it, which would trigger a browser to throw up a consent pop-up. A long, useless message from the site about why the user should click it could be provided to the user in a number of ways. The law doesn't even have to specify that
• reaperducer 8y ago
  internet visitors must be asked for permission in advance for any tracking software to be placed — such as third-party tracking cookies; tracking pixels; and browser fingerprinting tech — and that that permission must be freely obtained... Is this really what we want? Yes. I'm not even European, and I'm perfectly fine with this. Ask me to track me. If I like you, your web site, or your content, then sure. I'll give you a little personal data.
  • l9k 8y ago
    I agree they need to ask to track us. But the little personal data you mention is not only given to them but to 224 different ad networks. Most of them make it impossible or difficult to opt out.
  • blensor 8y ago
    So once you've determined that you like a site you are going through the hassle of figuring out how you can reenable the tracking after you disabled it on your first visit?
    • reaperducer 8y ago
      I have faith that the best and brightest people in the SV bubble will find a way to "surface" that feature.
    • rickycook 8y ago
      “you’ve visited this site a few times recently. are you still okay with these settings? (if you ever change your mind, click privacy at the bottom of the page)” just because we don’t currently have solutions doesn’t mean they aren’t out there. i guarantee my 5 second developer definitely not UX idea is the LEAST that a real UX professional will come up with, when pushed *EDIT: and yes this kind of cookie is okay with GDPR because it’s not tracking a “data subject”... it’s maybe a broad timestamp (the day you first accessed the site), and a counter for the number of articles/site loads... you don’t have to ask for this permission, because you can’t track someone with it
• OscarTheGrinch 8y ago
  Train people to click away on annoying shit, what could go wrong?
  • underdown 8y ago
    ideal for clickjacking
  • ihuman 8y ago
    Aren't people already trained to ignore cookie banners? They've been around for years.
  • Mirioron 8y ago
    That's how we got pop-up blockers, wasn't it?
• _bxg1 8y ago
  It's not even clear to me how they actually work. Usually what I do when there's no "Deny" button (which is most of the time) is just leave the dialog open in hopes that that qualifies as "not accepting". But then some of them say "by continuing to use this site you agree". But, what does that even mean? Do they wait for a scroll event before setting the cookie, or is it there already before I even click "Agree", and the dialog does nothing whatsoever?
  • tgsovlerkhgsel 8y ago
    Legally, you haven't consented. They're of course tracking you anyways because they're too lazy/greedy to implement it properly, so you should use the usual security measures (adblocker, PrivacyBadger), but they're breaking the law. It's just that there's too many people doing that for the overloaded DPAs to take care of them all.
  • askvictor 8y ago
    Spin up developer tools and see if the cookie has been set
• _bxg1 8y ago
  What if the EU instead mandated that browser makers have to keep up with, implement, and enable by default the highest levels of tracking protection possible? It would be far easier to enforce that on four or five organizations (half of which already do that) than to try and corral millions of websites into compliance.
  • lmkg 8y ago
    GDPR applies to a lot of things that are not mediated by the data subject's web browser. For example, when your grocery store takes your purchase history (from your rewards card) and sells it to a marketing or credit reporting agency. Or when housing or job applications are rejected by error-prone automated background checks. The website stuff may be more visible, but it's not the main thrust of the legislation except insofar as it has exposed how many websites are collecting and trading in your information.
    • _bxg1 8y ago
      I'm pretty sure the cookies thing predates GDPR
• tgsovlerkhgsel 8y ago
  I disagree with a number of premises stated in the article: > it essentially boils down to "take this cookie or no access for you" This is something GDPR explicitly bans. "Consent" obtained this way is invalid; the site doesn't even have to bother asking at that point. > To continue chucking up cookie warnings to everyone and somehow expecting them to make an informed decision about the risks they present? 99% of people are going to click through them anyway No, sites don't have to chuck up cookie warnings. If the cookie warnings were actually compliant, i.e. didn't try to hide the "no" option behind several clicks, there would be very little incentive for the user to say yes, because "no" means the warning goes away just as well, plus the user doesn't get tracked. Of course, the sites realize that, and are setting up non-compliant "consent" dialogs that try to trick or pressure the user into "consenting". The solution to that is to prosecute the ones that do that until they stop. (I bet many of the sites set and use tracking cookies even before you close the dialog.) At that point, the sites can choose whether they want to annoy users or not, but since a large part of the users will click "no" at that point (since the sites can't really provide an incentive to click yes), they might as well stop using the trackers. And sites using cookies for functionality the user actually wants don't have to ask for consent for those cookies. If the site asks, it's because it wants to track you, and you have no reason to agree.
• jaredhansen 8y ago
  It's almost as if the GDPR were less a carefully designed way to increase the degree of freedom individuals experience while perusing the web, and more an expensive and highly visible way to demonstrate that EU functionaries are Doing Something About Scary Technology Companies. I mean, obviously, it's totally not that at all, of course but it's almost as if it were.
• DavideNL 8y ago
  In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moeten-toegankelijk-blijven-bij-weigeren-tracking-cookies https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...
  • plopz 8y ago
    So websites are supposed to just absorb the cost? That seems like a ridiculous stance.
    • paulmd 8y ago
      No, they're supposed to serve generic, non-tracking ads. Non-targeted, or whatever the terminology is. It's hilarious how everyone has just forgotten that used to be a thing. The people on this website are literally the problem, you can't even conceive of a website that doesn't track every click you make across the whole internet, and you guys are the people building the new web.
      • deanalevitt 8y ago
        Which is what DuckDuckGo does, I think.
      • johnchristopher 8y ago
        I think it has more to do with an anti-authoritarianism attitude than anything else.
      • woah 8y ago
        It’s not possible to do a lot of normal web stuff without session cookies.
        • kerng 8y ago
• buboard 8y ago
  this isnt very accurate. Usually, there is first a generic "this site uses cookies" popup, then an interstitial about how much they "care for your privacy", then a popup about their newsletter, and finally a sticky header to nag you to take their survey.
• RivieraKid 8y ago
  This shows utter incompetence and detachment from reality by European legislators. Maybe it seemed like good idea in theory but the only practical significant impact is that browsing the web has become more annoying. Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes?
  • dageshi 8y ago
    I installed a plugin in firefox that just autoclicks "yes" or closes (no clue which) either way it makes the web much less annoying.
    • darkstar999 8y ago
      This one? https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
      • dageshi 8y ago
        yeah pretty sure it's that one. It works as advertised so far, basically restored the web back to how it used to be pre cookie spam.
    • yellowapple 8y ago
      uBlock Origin (and presumably other ad-blockers) lets you block arbitrary elements, including cookie dialogs.
  • smileysteve 8y ago
    How do you remember that a customer has responded to a popup if you don't give them a cookie? Even a cookie as a session identifier.
    • scrollaway 8y ago
      "Cookies" are mentioned only once in GDPR, in a long list of examples. They're not targeted specifically. The law talks about information that can be used to identify a person. So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance.
• dev_dull 8y ago
  This is honestly what your “regulated internet” looks like. None of the solutions ultimately address the real issue and are done purely for liability purposes.
  • anonymousab 8y ago
    It's what it looks like without any enforcement of the spirit of the law, sure. You'll see malicious or smart-aleck compliance with any rule that a group doesn't agree with or when they feel that it personally spites them.
• btbuildem 8y ago
  I'm sure they mean something like "if the user chooses no, make your website work without cookies".
• deleted 8y ago
  [deleted]
• jrochkind1 8y ago
  That post reminded me about the https://amiunique.org/ https://amiunique.org/ site for seeing how trackable you are with browser fingerprints. I had remembered that I had installed a "Random User-Agent" plugin in Chrome, with privacy concerns in mind. Sometimes it sends a user-agent that causes a site to send me a page that can't actually be rendered by my browser, so I have to turn it off on some sites. But I was curious to see what amiunique.org would make of the various random user-agent strings that the plugin would send it. Ironically, the plugin seems to break the amiunique.org site, I can only get a whitescreen or occasionally a spinner forever, unless I disable the "random user-agent" plugin. Not sure what to make of that.
  • kevindqc 8y ago
    I think it's having problems right now. I don't use anything and it's slow, blank page, 500 errors, etc.
    • snailmailman 8y ago
      I am encountering the same issues. Hopefully it comes back up soon, I'm curious what it has to say about my browser setup.
• todd3834 8y ago
  I am not a fan of the cookie banners at all. If anything I feel like browsers should implement it as it already does with other security settings (access to location, camera, etc…) and then people can decide to allow all websites. Blacklist, whitelist whatever. Why are we making every site implement a completely unique interface with different verbiage?
  • syrrim 8y ago
    Cookie warnings don't show up for any old cookie usage. HN has no cookie warnings, despite having accounts and logins. Cookie warnings are shown when the "evil bit" or the "color" of the cookie is set; that is, there is no way for the browser to know when a cookie should require a warning and when it shouldn't.
  • zanny 8y ago
    Because its done under legal compulsion rather than web standards good faith. Cookies predated the more democratic process by which the web evolves today, and it was outside the EUs power to just ask the likes of the dying Netscape / Microsoft / etc to all standardize on this feature at the spec level, especially when nobody was really much following web standards at all in the early 2000s. All those settings in browsers that let you control access to your camera, location, etc aren't part of legal compliance, they are just there because Google, Mozilla, sometimes Apple and Microsoft all agreed this is a good best behavior to avoid getting regulated on again. If the EU started mandating an opt-in system for camera access you can bet most websites would start dumping pop up banners about it regardless of if all the browsers supported the regulation already just to avoid culpability.
  • Mirioron 8y ago
    But you've had control over cookies for at least 15 years in your browser.
• l9k 8y ago
  I think consent is important for tracking, but I noticed an implementation problem/annoyance: On the same device, I consume news of the same sites from multiple sources or embeded browsers: Facebook, Google News, Chrome... I don't want to go through the hassle of opting out of tracking from every partner of the very same site I visit. Now multiply the task by every site you visit and every device you use... I now even suspect they intentionally remove the preference cookies so that you get tired of opting out
• bigbadgoose 8y ago
  No man, let's keep waving that dead chicken! Apocalypse is upon us.
• foateaca 8y ago
  Standardize it. Policy makers should provide a standard message, or small set of messages websites can reuse and consumers recognize with links to an EU-run informational website easy to understand for consumers. I don't understand why it wasn't implemented this way, maybe to allow for more freedom of implementation, but we have seen that has hurt the policy effort. Just standardize it. Incidentally, with all of the Organic / GMO-Free / et all certifiers out there, would a privacy badge be the way to go, or is that backwards thinking in the way of early internet site badges?
  • asgrdz 8y ago
    There's not a standard copy-paste-ready set of phrases because it would be impossible for the law makers to craft such. They couldn't possibly know what site A or B respectively does with a user's data. That differs from site to site. It is therefore of course the obligation of each site that directly or indirectly works with user PII to explain to its users how that specific site is using the data.
• Reason077 8y ago
  The EU should ban cookie “walls” and pop-ups completely. They’re uneccessary, annoying, and against the spirit of the GDPR.
• gpm 8y ago
  I think what is missing from this discussion is possible solutions that don't involve allowing free for all surveillance. The obvious one to me is to just ban consent. Make anything you would need consent for outright illegal. No one in the right mind would be giving consent for tracking without compensation (which is what the GDPR asks for) anyways. Maybe leave a small prohibitively expensive loophole for projects that do need to track things (e.g. scientific studies). For instance requiring approval by an ethics committee and a contract signed in person by hand by both parties after jointly reviewing every term.
• afarah 8y ago
  It's the result of government interference everyone around here loves so much.
• Jansi 8y ago
  Testcomment
• dheera 8y ago
  Do they expect a user to re-enter their password every time they click a button on a website? Without requiring cookies how do they expect a session to persist between pages?
  • TheGrumpyBrit 8y ago
    Session cookies are fine, it's only advertising and tracking cookies which are covered by the legislation.
• Jansi 8y ago
  Cookie warnings cannot be provided without state
• deleted 8y ago
  [deleted]
• Nextgrid 8y ago
  The main problem here is that the GDPR is not enforced. Those annoying cookie banners aren't actually GDPR compliant. GDPR mandates that consent should be freely given and should be opt-in, so forcing you to consent in order to view the site is illegal, and so is pre-checking the tick boxes or making it hard to opt-out (like having to explicitly visit the privacy policy, or uncheck hundreds of tick boxes). If GDPR was actually enforced, fines would start flying out, and website operators will quickly start complying and cookie banners will become much less intrusive or annoying.
• deleted 8y ago
  [deleted]
• 3xblah 8y ago
  The browser fingerprint nonsense assumes Javascript is turned on and the user has allowed someone else to choose the user agent string and other headers. Thought experiment: What would these "fingerprints" look like if on given day everyone were to turn off JS and set their user agent string and other headers to the same values? The author writes that if I visit amiunique.org I "will almost certainly be" informed that I am unique. Well that is not what happened. According to their test, I am "almost" unique, but still not unique. What the page says is that we can almost certainly be tracked. Does not say whether this would still be worth it to an advertiser. The question is not "whether we can be tracked". Of course we can. Most people using the computers on the internet, in the same way as people using telephones on a landline or cellular network, are not expecting to be "untraceable". The question is how easy we are making it for anyone to conduct tracking -- not just those who are properly authorised to do so -- and for what purpose are they collecting this information.
• wereHamster 8y ago
  So I have a question regarding GDPR. I've recently done two projects for intergovernmental organizations (like the UN, to give you an example). Both organizations claim that they do not have to comply with GDPR. I kindof doubt that but IANAL. Short of reading the GDPR laws, or contacting an expensive lawyer, what's the best way to find out if they are right? I'd like to find out before I start the next project for such an organization. Thanks.
  • asgrdz 8y ago
    Read the document: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... That's the cheapest. It's not really that hard to understand. I'm not a lawyer, read it and had a GDPR consulting firm review the tweaks we made of our systems. They were happy with it. But if you're working for a larger company, then consult with their legal department or have the company hire a GDPR consulting firm. They should be able to afford it without a problem, and will likely be happy to support such an action if the non-compliance risk is deemed large enough. A business decision, not a technical one.
• gnud 8y ago
  Most cookie warnings are beyond useless, in that they don't even try to actually comply with the GDPR. The fact that your site uses cookies is irrelevant, and there's no need to tell anyone. However! If your site stores personal information (directly or via a partner), you need to have a valid reason. The definitions of "personal information" and "valid reason" are, fortunately, not exhaustively enumerated in the GDRP. I say fortunately, because if they were exhaustively enumerated, Facebook would find a loophole, and the whole law would be worthless. One of the 'valid reasons' for storing personal information, is a clear, freely given, consent from the user. This is the one that all the tracking companies want to get, because they think it allows them to do shady things if they can trick the user into pressing 'OK'. But if the user was tricked or coerced, the consent was not really clear or freely given. Hence the sort of court rulings that the article mentions. So, if you store a cookie for your domain saying 'tracking_consent=false', this is probably not personally identifiable, so you can just do it. No reason for any banner. But if you track the 'browser fingerprint' that Troy Hunt is talking about, without consent, you are probably in violation of the GDPR. Even if it's not a cookie. And you had a cookie banner.
  • currysausage 8y ago
    Very true, that can't be stressed enough. One note though: > The fact that your site uses cookies is irrelevant, and there's no need to tell anyone. Let's not forget the infamous ePrivacy directive, e.g. Recital 66: "Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. ... Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user." Of course, the relationship between GDPR and the old ePrivacy directive is rather ambiguous.
• systematical 8y ago
  Agreed. Not happy EU laws are affecting US business. We had to do a bunch of GDPR stuff even though we sell products only in the United States. I get if we are marketing to or selling in the EU, but we're not. What do I know though? I'm just some dude who lives in a terminal.
• danra 8y ago
  At my company’s site[1] we have a non-intrusive banner at the bottom which lets you agree or disagree to tracking cookies, or just ignore it and browse the site. You don’t get served any tracking cookies until you agree. This fulfills the explicit consent requirement of GDPR as well as the requirement for people to be able to use your site even if they don’t accept cookies. We get much less analytics then we used to - many people just ignore the cookies bar, either knowingly or just because they don’t notice it. But it’s totally worth it. I hope the EU starts fining non-compliant (i.e. 99% of) sites aggressively, specifically those that pretend to care about your privacy, but don’t really (“Agree” button only). [1] https://www.soundradix.com/ https://www.soundradix.com/
• Sir_Cmpwn 8y ago
  The problem isn't dumb ol' grandpa EU's folly lawmaking. The lawmaking is on point and the cookie banners are the problem - not the symptom. EU regulations are trying to eliminate privacy-invasive practices like tracking. It's not about making users aware that they're being tracked. It's about making businesses cut that shit out. Of course, on HN I have to acknowledge that half of the users on this website get their paychecks from invading the privacy of the general public. If you fall into this category: what you're doing has always been wrong and now the law is catching up to that.
  • Mirioron 8y ago
    It doesn't matter what they're trying to do. What matters is what actually ends up happening. The socialists in the Soviet Union tried to improve things as well. It's also quite ironic that the EU now cares about privacy considering that a decade ago they passed the Data Retention Directive. I guess privacy didn't matter then, huh?
    • asgrdz 8y ago
      "It's also quite ironic that the EU now cares about privacy considering that a decade ago they passed the Data Retention Directive. I guess privacy didn't matter then, huh?" This is a very astute observation, and is causing some angst among parts of the European population. However, this seemingly conflicting behavior has a cultural rationale behind it. In general, Europeans see government as trying to look out for their best interest, while they view corporate power with large skepticism. "Americans" hold the complete opposite view. So when the governments in the EU tout sheepish clichés like "think about the children, catch terrorists, pedophiles" etc, by being able to retain data for those purposes, the public falls flat and lets Orwellian laws pass without much fuss. Because ... "the government is our ally, and we trust it, the claims, and that the data will be managed responsibly". However, when corporations do the same, there's more fuss. The one european people that is of sane mind here is those of germany, due to their history. Unfortunately germans are also deceived by their government through back-room deals on EU level, and with the national security excuse, when it can be kept out of the public eye; effect same as the other EU nations. The good thing however is that the german people are not as gullible as other parts of europe when it comes to surveilance and tracking, and they do tend to kick up a big fuss when this sh*t goes down. So they act as a sort of moral calibration for the other nations, such as mine. Understanding this fundamentally different mindsets between US and European citizen will hopefully help explain quite a lot, for those who didn't already know this. This is why "american" views are insane to some europeans, and why EU is naive/retarded in the eyes of the US. (very generalized)
• golemiprague 8y ago
  The internet was fine without any regulation, then Trump won and now all the butthurt lefties want to regulate and control everything in some stupid hope it will help them win the next election. It won't and it just cause problems, I much prefer a wild west were every website can do whatever they want, you don't like it don't use it and leave us alone to sell our most intimate data to satan. It is our decision.
• godber 8y ago
  I feel the same way about California Prop 65 warnings. Any overused warning will result in warning fatigue. We'll just blindly click that OK button or lick that pewter candle stick. Look, it's even a real thing: https://en.wikipedia.org/wiki/Alarm_fatigue https://en.wikipedia.org/wiki/Alarm_fatigue
• thom 8y ago
  Any site that makes it a hassle to manage this stuff, I just close the tab and never visit again. Hasn't affected my happiness one iota.
• everyone 8y ago
  I'm in the EU. I just dont bother looking at those sites anymore.. So, a lot of the links posted here for example. ps. If I ever mention that the article had a ridiculous cookie warning system that I didnt bother getting through (eg. The techcrunch gif in the article), or that the site is just plain broken from EU, then I get downvoted to hell. pps. If I really wanna read something, or need to for work or whatever then I use outline.com
• lwansbrough 8y ago
  Troy’s statement that accepting one advertiser’s agreements means accepting all their partners’ agreements, and all their partners agreements, and so on is interesting. It lead me to the idea that it might be interesting to build a bot that builds a “consent graph” which will tell you exactly how many (and perhaps draw connections visually) different companies you have to provide consent to from a given advertiser/company/website. This is a pretty interesting argument against the clumsy rules of GDPR which exist, in my opinion, practically entirely outside reality.
• subroutine 8y ago
  ITT people are suggesting GDPR mandated cookie warnings are pointless because people have been trained to automatically tap "accept" or not gain access. I don't buy it, and was the main point of this latest GDPR clarification [1]: > "Cookie walls that demand a website visitor agrees to their internet browsing being tracked for ad-targeting as the “price” of entry to the site are not compliant..." [adding] "...There is no objection to software for the proper functioning of the website and the general analysis of the visit on that site... sharing of this information with 3rd parties is only allowed with permission." Basically the mere presence of a cookie warning (regardless of the specifics) should not be signaling to the visitor "[agree] to enter" or "[agree] to enable features". They should be signaling "[agree] to us sharing some identity elements and browsing behavior with 3rd parties, mostly for ad targeting; or [decline] the aforementioned; either way, welcome to the site." Once users realize they can still enter the site if they click deny, their (automatic) choice will better align with their actual preference. [1] https://techcrunch.com/2019/03/08/cookie-walls-dont-comply-with-gdpr-says-dutch-dpa/ https://techcrunch.com/2019/03/08/cookie-walls-dont-comply-w...
• zhoujianfu 8y ago
  Is there a browser plugin that just auto-accepts (or denies I guess) all those cookie pop-ups? That’d be nice!
• auslander 8y ago
  Did he actually said something new? A rant upvoted to 800s.
• GrryDucape 8y ago
  That last warning comes so close to being a good horror movie quote. "Something or somebody is making changes to your connection" should obviously be "Someone or ... something". The true monster was the intrusive firewall/AV all along.
• neop1x 8y ago
  I often visit many sites every day and I often see big popups with full "ad partners" configuration. I don't have time for this! Sometimes, if I can see at least three lines of an article text in the middle, I try to read through it. Other times, I just confirm it so I can read the article. I think the providers should be forced to react to the "do not track" browser feature and then simple don't track and don't show any cookie prompts. Browsers are configurable so they should let people decide. Per-site web prompts like that do more harm than good unfortunately.
• rmc 8y ago
  > Is this really what we want? To continue chucking up cookie warnings to everyone and somehow expecting them to make an informed decision about the risks they present? 99% of people are going to click through them anyway (note: this is a purely fabricated figure based on the common-sense assumption that people will generally click through anything that gets in the way of performing the task they set out to complete in the first place). And honestly, how on earth is your average person going to make an informed decision on a message like this: I think the logic is "Yes, you're right, many regular people can't make freely informed consent for that sort of mass tracking... so the solution is to stop tracking people"