16 ms·

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie w

• plopz 8y ago
  So websites are supposed to just absorb the cost? That seems like a ridiculous stance.
  • paulmd 8y ago
    No, they're supposed to serve generic, non-tracking ads. Non-targeted, or whatever the terminology is. It's hilarious how everyone has just forgotten that used to be a thing. The people on this website are literally the problem, you can't even conceive of a website that doesn't track every click you make across the whole internet, and you guys are the people building the new web.
    • deanalevitt 8y ago
      Which is what DuckDuckGo does, I think.
    • johnchristopher 8y ago
      I think it has more to do with an anti-authoritarianism attitude than anything else.
    • woah 8y ago
      It’s not possible to do a lot of normal web stuff without session cookies.
      • kerng 8y ago
        The concepts of a session cookie is different then a cookie used for advertisemnet that tracks you across the internet. The problem is tracking and ads, not authentication and authorization for functional purposes. Cookies are just one way to track people and serve ads, there are many others. Facebook is a great example on keeping diluting these concepts. They ask for your information for function security purposes and then go back and use that same data for ads - that is unethical and has to stop.
      • darkarmani 8y ago
        Define "a lot of normal web stuff". How did we ever do normal web stuff before session cookies?
        • bigbadgoose 8y ago
          I think they would start another fire, and get another blanket
        • cortesoft 8y ago
          I mean, we have had session cookies since the first version of netscape. Almost everything we think of as 'normal web stuff' is post cookies.
        • wolco 8y ago
          We telnetted into places.
        • paxys 8y ago
          We didn't
        • deleted 8y ago
          [deleted]
        • taneq 8y ago
          Session cookie in the URL?
      • deleted 8y ago
        [deleted]
    • sonnyblarney 8y ago
      "It's hilarious how everyone has just forgotten that used to be a thing" Ads were always a thing, they're just going to be better targeted with more info. There is no free lunch, so what this means is the 'no cookie' users may be exposed to more ads. I understand the market dynamics are not working very well, but we have to remember that information provided is not free either.
      • tuco86 8y ago
        you will get as many ads as the typical user is able to bare no matter what.
        • sonnyblarney 8y ago
          The underlying economics are unavoidable. Companies are not trying to 'do inherent evil' - they just want to show relevant ads. And by the way, consumers definitely appreciate the relevance. There is another side to the equation, and there are economic consequences to all of this that will come home to root. Personally, I loathe Facebook and don't use it for personal reasons, but I have a small business and it's the only advertising mechanism that works for us: we have a neat little product for a niche category. There are entire economies that can only exist with the ability to effectively get the word out, there is tremendous social good in this. We just have to figure out a way to do it that fits within reasonable privacy guidelines.
    • wolco 8y ago
      I have my own ad that I made for a client. No third party is offering these kinda of ads because of fraud.
      • kristianp 8y ago
        Is that really true?
    • bsanr 8y ago
      Data addiction. Just say no.
    • repolfx 8y ago
      It has never been a thing, that's why. Adverts have been targeted for decades before the internet existed at all. Do you think TV adverts are placed randomly? They aren't. Different times of day have different value to different advertisers. TV ads are targeted based on detailed knowledge of audience demographics. Do you think billboard ads are placed randomly? They aren't. Their placement is optimised based on the beliefs of the ad firms about who will drive past them or see them. Do you think internet ads were placed randomly before AdSense? No, they were targeted by rough demographic guessed from the sites content just like TV and billboard ads were. All that's changed on the internet is that targeted has got more precise and more sophisticated. But there's no bright line separating "generic" from "targeted" ads, like you imagine. And the better targeting is hardly an optional feature like the DPAs seem to imagine. It increases revenues which enables firms to provide new content and new features. Roll back the web to 1990s era ad techniques and now all the ads on generic sites like news or search with no clearly defined audience will be barrel-scraping "punch the monkey" animations, for those of us who remember that stuff.
  • skybrian 8y ago
    Well, saying it's ridiculous isn't an argument. it's expensive and maybe non-viable for many websites. But it's not like all websites need to exist? There was a world wide web before cookies.
    • duxup 8y ago
      >There was a world wide web before cookies. I like to think of that time as a great time too, but oh man so much we couldn't do.... I get what you're saying generally, but man I'd hate "before cookies" to be the standard.
      • deleted 8y ago
        [deleted]
      • Jach 8y ago
        The big use of cookies for re-authentication and carrying around a session id enabled clean URLs lacking your session id as a query param, but it wouldn't be that big of a deal to lose it. You'd need to be careful with copy-pasting URLs -- but given browsers standardized on cookies they could have standardized on a sessionId param name to filter out of copy-pastes or not even display it at all similar to Chrome's proposal to not display the protocol, just a "secure" flag or not. A similar "session context established" flag could have been made. And in the age of password managers and/or having your browser remember your login, it wouldn't be that much of a loss to require logging in to everything again every time you restart your browser... maybe more of a pain with 2FA. I don't really see it as "what we couldn't do" but "what poor usability we have overcome". I'm glad we have cookies and other forms of local storage, especially for the latter there are many other benefits. Maybe one day we'll get Web SQL. In the meantime people can still disable cookies entirely, or at least delete them when they close the browser, both with out of the box browser settings (and I have no idea what extensions are available to do even more) and return to that less-usable (if slightly more private) experience. The crucial idea of a "user agent" is I think the biggest mindset change the web brought, it's important to keep that even if on the dev side we constantly complain about being asked to support more than one configuration of anything.
  • josephg 8y ago
    Yes absolutely! Websites need to find revenue models that don’t depend on violating the privacy of their users. That stance makes a lot of sense to me.
    • cortesoft 8y ago
      There are tons of websites that have other revenue models. Subscriptions, referral models, etc. Shouldn't people be able to choose what currency they want to pay for something in?
      • dageshi 8y ago
        It's been proven over and over again that people won't pay for content that gets successfully monetised with advertising. You only have to see the howling every time someone posts a subscription only newspaper link on HN to see how vehemently opposed people are to paying for stuff like news.
        • themacguffinman 8y ago
          So that means consumers have chosen to forgo their privacy to avoid paying money for content. Why can't I make that choice myself?
          • dageshi 8y ago
            Why doesn't MC Donalds sell pizza? (I know they did at some point and gave it up). Because their customers don't want it, or at least not enough of them do.
        • rhizome 8y ago
          "Subscribe or fuck off" is a stupid business model when it costs practically nothing to implement multiple revenue streams. This is such an obvious point.
      • josephg 8y ago
        > Shouldn't people be able to choose what currency they want to pay for something in? Thats a very libertarian position statement and I understand it. But the EU is much less capitalist/libertarian than you are. Their parliament made the call that they don't want people paying for services with their personal data. There's valid arguments on both sides here. Some arguments supporting the EU's stance: - If online newspapers get paid in proportion to views, they make more money by writing divisive clickbait - Privacy is a fundamental right; not a currency. Treating it as currency means only wealthy people will be free from spying, and that is borderline dystopian. - Advertising on the internet worked just fine before everyone was tracked and monitored through every click. Don't annoy me with cookie notices. Just don't use cookies for tracking and we'll get along fine.
  • renholder 8y ago
    >So websites are supposed to just absorb the cost? That seems like a ridiculous stance. The €0.00002 it took to serve that one page just because the user doesn't want to consent to cookie placement/tracking? Is it really that harmful? NPR seems to do this just fine for GDPR reasons: Decline and Visit Plain Text Site
    • laumars 8y ago
      In fairness it can add up pretty quickly on popular sites. I do love NPRs approach though.
      • renholder 8y ago
        >In fairness it can add up pretty quickly on popular sites. Aye, if they're only looking at it from a "cookie placement/tracking or nothing" hard-limit perspective, which is what the OC posited it as. ...but if other sites can absorb the costs, case in point: NPR, why is it such a dastardly evil thing to point out? Is there some foolhearted belief that if we cut tracking, tomorrow, the internet would cease to function? Is there absolutely no room for advertisements without cookies/pixels in the modern world...? Do we really believe that it's that expensive to serve webpages?
        • leetcrew 8y ago
          of course it's not expensive to serve pages. but creating content and services that are worth serving can be pretty expensive.
    • cortesoft 8y ago
      The cost to serve the page is a misleading number to use. You also have to factor in the cost to create the content, manage the service, etc. I mean, by your argument, all digital goods should be free, since it never costs much to transmit the bits.
      • renholder 8y ago
        My argument was one user who requested one page and didn't want to consent to cookies/tracking in order to offset the ridiculously low cost of serving the actual page (I'm considering the cost to make it as having already been burdened, as it's already being served). The OC didn't consider the fact that you can have advertising without cookies/tracking/fingerprinting and just reduced it to absrudism by saying that the company would bear the brunt of the cost but even the cost of that single event is marginally insignificant, overall. So, no, my argument was never about all digital goods being free. However, if we want to play the devil's advocate and utilise your reduction to absurdism: By your argument, shouldn't all digital goods be paid for...? For example, Ubuntu costs money to host and serve, yeah?
  • barkingcat 8y ago
    you can actually have an ad without tracking you know that right?
    • deleted 8y ago
      [deleted]
  • probably_wrong 8y ago
    Websites are allowed to charge you. They are also allowed to show (non-tracking) ads, and they can also track you if you agree to it. What is not allowed is to withdraw services to those that want to exercise their right to privacy.
    • plopz 8y ago
      Thanks, this helps clear up some of my understanding. I still think its ridiculous that websites can't refuse to serve who they want.
      • nothal 8y ago
        Why? It's relatively common for governments to prohibit businesses and services from discriminating against certain types of users, why do you think it's ridiculous in this specific case?
        • umanwizard 8y ago
          The only examples I can think of for the US where this happens have to do with historically discriminated classes of identities; e.g., gender, racial minority, etc. Are there other examples?
        • cortesoft 8y ago
          Whether we like it or not, tracking data used for ads is the currency of the free internet. It is how things are paid for. This is like a government saying to a restaurant "You can't discriminate against people who don't want to pay you money for the food. You can ask them if they are willing to give you money for the sandwich, but if they say no, you still have to give them the sandwich"
          • tuco86 8y ago
            "the government" as in >we the people< says to all the restaurants (and groceries): this stripping of all of our clothes before entering is nonsense and we can't choose not to eat, so we will force you.
  • rdiddly 8y ago
    If the cost is for hosting a bloated 14MB page, 30% of which is hostile JavaScript, let's talk about ridiculous. "But we need that JavaScript to scrape the data and run the ads to pay for hosting all that JavaScript!" My stance is even more ridiculous: Deadbeats who can't afford hosting without begging, selling ads, or turning against their users, scale your site down to something that's cheap to host, or get the hell off the internet. Back to the amateur web of the 90s. It was fine.
    • yspeak 8y ago
      Yes back to the 90s. I'm thinking actually 1993 or thereabouts. Gopher was great. No ads at all. Who needs them.
  • At1C 8y ago
    Believe me they are getting paid, read surveillance capitalism for the real story, http://www.shoshanazuboff.com/new/recent-publications-and-interviews/big-other-surveillance-capitalism-and-the-prospects-of-an-information-civilization/ http://www.shoshanazuboff.com/new/recent-publications-and-in... stop deferring your choice! to big technology monopolies, tell them stuff their cookies where the sun don't shine.
• duxup 8y ago
  Could say Germany, decide differently? GDPR seems like it could evolve quite quickly, and sort of fork a bit here... Also makes me wonder, do they have to have access to the whole site? This feels like a war on cookies, and there are bad things done with cookies, but I'm not sure if they're fighting on the right front long term here. If people simply just say yes all the time / don't know, not sure we're making progress.
  • tripzilch 8y ago
    > This feels like a war on cookies, and there are bad things done with cookies, but I'm not sure if they're fighting on the right front long term here. Problem is will-full misinformation. It's a war on tracking cookies, not session cookies for login state, etc. But all the cookie warning dialogs make it sound like it's a war on all cookies no matter what, so "just accept because otherwise this site won't work, also <insert clueless condescending remark about the cookie law>" (really, the amount of sites that use this dialog as a misinformation soapbox to vent against not being able to track their users...).
    • duxup 8y ago
      Maybe I'm just dense but I have my doubts that there are many cookie prompts that are intended to push misinformation about "cookie law".
• 1nverseMtx 8y ago
  Which doesn’t mean they have to provide access for free, they are most likely allowed to ask a fee for that. From the same website you link [1]: “Does anyone refuse tracking cookies? Then you still need to give this person access to your website or app, for example after payment.” (google translated) [1]: https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-vraag-ik-als-organisatie-toestemming-zonder-cookiewall-7112 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne...
  • orev 8y ago
    And how does one track if payment has been made without using a cookie?
    • mobilemidget 8y ago
      By the information a payment provider sends back. Edit: guess somebody never integrated a payment provider :-)
    • robocat 8y ago
      From cameron90 above: Shopping baskets, load balancer cookies and login tokens are fine (provided you only use them for those purposes!). Third party advertising tracking cookies are absolutely not (without consent).
  • tzs 8y ago
    The problem with asking for a fee is that Europe operates under the "transaction takes place at the buyer's location" model for such transactions, meaning you have to collect and report VAT on those fees in each country you have a paying user in. (The same goes for state sales tax in most US states). If a site makes its money from ads, on the other hand, the location of the visitors is irrelevant when it comes to taxation. The payments from the ad network will just be ordinary business income at the place the site is located. I don't think the charge a fee model has a chance, except for a few large sites, until some sort of intermediate service is developed that isolates the sites from having to deal with taxes in a bazillion jurisdictions. Something like a Spotify for site access, where users can pay the service a subscription fee, and the service pays sites after taking care of the appropriate taxes on the user's subscription fees so that the sites don't have to deal with it.
• jrochkind1 8y ago
  Hmm, there are features that one literally can't provide without state (cookies). I think the real problem here is that the technical feature of cookies providing browser state is a poor proxy for what EU/DPA _really_ wants to regulate, which is privacy-related tracking. There are tons of sites I've written which use cookies, but have no ads and perform no user-tracking whatsoever, not even Google Analytics. It is true that cookies are the _easiest_ (if not the only) way to do the other; but making "cookies" the thing that gets effectively "regulated"... I realize this isn't necessarily the intent of the regulations, but I'm suggesting it's part of what results in the situation troy mentions. There are very few sites that don't use cookies; there are or at least could be more sites that don't track you in a privacy-compromising way, to train the user that this is the same thing is just too much noise for the user to actually make any discernments.
  • nashashmi 8y ago
    What features? Is local data storage a possible substitute?
  • mort96 8y ago
    Most discussion about the EU cookie directive doesn't mention it, but not all cookies require consent. From https://privacypolicies.com/blog/eu-cookie-law/#some-cookies-dont-need-consent https://privacypolicies.com/blog/eu-cookie-law/#some-cookies...: "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." Of course, no website will ever tell you "Hey, we're using cookies to track you"; it's in most companies' (both legal consulting companies' and website owners') best interest to keep people ignorant. Consulting companies want website owners to be scared and buy legal consulting services, and website owners want people to think that the pop-ups are a result of stupid EU legislation and not because they are actually being tracked.
    • jrochkind1 8y ago
      " in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." If I need to get explicit opt-in for "So, remembering your shopping cart when you come back requires cookies, that okay with you?" I'm not sure how much better that would be. It's still gonna be information overload "false positives". But I think that is what the regulations actually intend. "We need cookies to give you: Shopping cart; search history; login to your account; whatever -- opt in or out to each one, you can still use the site just without those features if you go out." A) That is actually fairly expensive to implement. B) I think it _still_ wouldn't accomplish the goals, it's still _way too much information_. Nobody cares whether or not you use cookies to implement a shopping cart. They care about things related to "tracking", especially aggregated tracking, and profiling. C) But you are exactly right that no company is ever going to tell you what you _really_ care about. Unless regulations make them maybe. These regulations were trying. Not there yet.
• paulcole 8y ago
  > Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. No! It doesn't. Viewing a website isn't anyone's god-given right. The tracking cookies are part of the business model. If you don't agree with how a business makes money, stop patronizing them. If this is serious, look for companies to just block all traffic from The Netherlands. Why even bother dealing with the hassle.
  • TheCoelacanth 8y ago
    Siphoning up people's data isn't anyone's god-given right. If you don't like EU laws, then don't do business there.
    • jessaustin 8y ago
      Isn't that what "just block all traffic from The Netherlands" would mean?
  • white-flame 8y ago
    Slavery and child labor were also just "part of the business model". Some business models are predatory societal negatives and should be done away with at a government level of respecting individual rights. Behind-the-scenes tracking and data brokering are in that class.
    • strken 8y ago
      Slavery and child labour are coercive. Not letting you use a website is only coercive if that website is Facebook or Google or some other monopoly core to a person's ability to function in modern society. If you can't access Bob's Bargain Basement Underwear then you've got plenty of competitors to go to.
      • white-flame 8y ago
        It has nothing to do with being coercive, or any such specific facet of any implementation of rights violation. It's about being a rights violation, full stop. Regarding options, in the current model it is generally unknown to the user what is happening with their seemingly private, personal, and "lock icon" encrypted activities on a site. While some here might consider it a "fair exchange" to give up PII in exchange for website services, the vast majority do not understand or even perceive that, and it is not an informed exchange at all. It violates the user, both in the nature of the exchange and in the privacy implications. It is a type of interaction that should rightly be barred in the absence of understanding and explicit, intentional consent.
• PopeDotNinja 8y ago
  Does that affect the use of the session & local storage?
  • tripzilch 8y ago
    No it's about tracking cookies. Session cookies for keeping login state or shopping carts, etc, are allowed.
• mobilemidget 8y ago
  DPA can track you for at least 31 days before their log files rotate and get aggregated. It is not via a tracking cookie, but unique enough in my opinion to track you, and that happens without consent. For a privacy advocating party it would suit them to not log anything and be very clear about that. Source: https://autoriteitpersoonsgegevens.nl/nl/over-deze-site/cookiestatement https://autoriteitpersoonsgegevens.nl/nl/over-deze-site/cook...
• wsy 8y ago
  We are now in the middle game of GDPR. Companies whose business model depends on tracking users essentially have now an illegal business model, because practically no user will give informed consent when they are offered the same service without consenting. So what can these - now shady - companies do? They probe the limits of the law, and try to keep their business model alive as long as they can. We need to wait and see. In my opinion, the most probable development is that European data protection agencies will start to hand out fines. Of course, the shady companies will fight them in court, and of course, they will lose. Then they will retreat a step, and try again with a little bit less intrusion into the user's privacy. Over time, courts will rule, and fines will increase, until the shady companies will give up in EU. Then EU will essentially become free of tracking networks. It might take a few years, but I think the intermediate annoyance is worth it.
  • tripzilch 8y ago
    Oh, I so hope you're right!
  • UncleEntity 8y ago
    > Then EU will essentially become free of tracking networks. It might take a few years, but I think the intermediate annoyance is worth it. I don't disagree with you but I think it is more likely that these companies will just not let EU peoples use their sites at all. One BIG fine (and you know they're salivating at the prospect of getting multi-billions out of Google and/or FB) and doing business in the EU becomes too much of a gamble for a company to justify the risks.
    • NeedMoreTea 8y ago
      Some will choose to adjust practices, others might choose to block the EU. If they're happy to lose that many users, as they think tracking is more important, would that be so terrible? It might even encourage some more ethical alternatives, or some real attempts to solve micropayments.
      • UncleEntity 8y ago
• danielfoster 8y ago
  I haven't read the full decision but I'm always surprised at how little regard European courts have for property rights. If it's my website, I should be able to decide who has access and under what terms. Don't like cookies? No one is forcing you to visit a particular website. I also feel like tech companies could adopt an open standard for cookie acceptance preferencesin web browsers, but they're afraid to lest they be forced to deal with even more regulation later.
  • tripzilch 8y ago
    > If it's my website, I should be able to decide to decide whether to track your users? through third parties? for advertising purposes? Why? Why do you get to decide and not the users? I'd rather you didn't! It really honestly does surprise me the amount of crap Americans are willing to swallow when it comes to advertising methods, or even just profit in general. Your whole society is rife with abuse. There's robo-calling, giant billboards, attack ads, pharma ads, ads or contests that are literally scams, just a few from the top of my head. Probably more I don't know about (ads to target children? there is NO good way to argue that children "should" be targeted by ads). It's a small miracle you managed to push a mandatory "unsubscribe" link underneath mass email lists. I suppose it's mandatory because given the attitude to this kind of abuse I doubt they would put them there voluntarily. Also, you've seen what happened to the online ad industry without this kind of regulation. If you don't make rules they're going to push it as far as they can. It's gotten to the point where people recommend adblockers for security not getting rid of annoyance. Or for saving about 95% of your mobile data plan surfing sites. Did you ever notice the most profitable ads pay for the shittiest content? The system isn't even working.
    • emilfihlman 8y ago
      As an European, it honestly surprises me how much crap people are willing to put up with to advance the nanny state, and even support and advocate for that shit. I'll take freedom any day over someone telling me that they know better.
    • danielfoster 8y ago
      I'm a big fan of a lot of pro-consumer regulation in EU. For example the right to block junk mailers in Germany with a simple notice on your mailbox is amazing. However I think websites should be able to block access to anyone they want. It doesn't seem fair to force websites to serve an audience if they do not wish to.
• danra 8y ago
  What is the significance of this decision? This is already explicitly stated as disallowed in GDPR. Is this just an declaration of intention to enforce the existing law?
• Wowfunhappy 8y ago
  I don't understand how this wasn't obvious from the start. GDPR was quite clear that you can't "punish" users who reject cookies.