11 ms·

This shows utter incompetence and detachment from reality by European legislators. Maybe it seemed like good idea in theory but the only practical significant i

This shows utter incompetence and detachment from reality by European legislators. Maybe it seemed like good idea in theory but the only practical significant impact is that browsing the web has become more annoying. Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes?

dageshi 8y ago
I installed a plugin in firefox that just autoclicks "yes" or closes (no clue which) either way it makes the web much less annoying.
- darkstar999 8y ago
  This one? https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
  - dageshi 8y ago
    yeah pretty sure it's that one. It works as advertised so far, basically restored the web back to how it used to be pre cookie spam.
- yellowapple 8y ago
  uBlock Origin (and presumably other ad-blockers) lets you block arbitrary elements, including cookie dialogs.
smileysteve 8y ago
How do you remember that a customer has responded to a popup if you don't give them a cookie? Even a cookie as a session identifier.
- scrollaway 8y ago
  "Cookies" are mentioned only once in GDPR, in a long list of examples. They're not targeted specifically. The law talks about information that can be used to identify a person. So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance.
  - joemi 8y ago
    > So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance. I wouldn't be so certain about that. Before now, most people were pretty certain that an accept/decline warning was enough and that they had the right to refuse service to people who did not click OK on the warning.
    - gnud 8y ago
      If anyone believed that, they did not research more than 10 minutes. This comes up in _every_ discussion about GDPR. I honestly worry - are we as developers just extra stupid, or are other occupations (electricians, ship captains, architects) equally lax when it comes to reading and following regulations?
      - kd5bjo 8y ago
        Those other occupations have been regulated for a long time, so the training and verification practices have had time to mature. This is still the early days of software development regulation, so there's not much history or tradition to fall back on -- I'm pretty sure that all the other industries had similar problems when their first regulations were enacted.
- J5892 8y ago
  You'll need to use fingerprinting and other much more intrusive tracking methods to track the cookie preferences of any user that refuses cookies.
  - asgrdz 8y ago
dmitriid 8y ago
“incompetence”, “detachment” right. I, for one, am happy that bullshit like “hey, we send your data to 244 trackers uncontrollably” has become visible and is being called out. I mean, visible only in the EU. Dark patterns and site-blocking are anti-GDPR, so I’m hoping for some heavy fine across the board. And, hopefully, if not the end then curtailing of the intrusive and tracking cookies, ads etc.
- Sir_Substance 8y ago
  Facebook hasn't made any more privacy or policy SANFU's over the last 12 months than they have any year before that, and yet interestingly this is the year where the people around me have been taking an interest in what I use instead of facebook and taking active steps to move away from it. These laws force people who are attempting to take advantage of non-technical users to either stop it, or do so in an obvious way that lets even non-technical users see that /something/ is up. It's good, I like it. It's driving social progress, as truth always does. I'll get downvoted for expressing that opinion here of course. Too many american software developers who want to inflict their freedom on others I guess.
raverbashing 8y ago
> Surely there are solutions that don't require a popup on every webpage you visit? I don't get any popups or cookie notices on visiting HN or several other sites. It's not like it's a fundamental need to set hundreds of tracking cookies on a visitor's browser to show them a website.
- RivieraKid 8y ago
  HN doesn't have ads though.
  - rickycook 8y ago
    duck duck go has ads and doesn’t track you... you don’t need cookies to show ads; only to show intrusive “track you across the internet” ads
  - meken 8y ago
    Don’t they have hiring advertisements for their startups?
    - bzbz 8y ago
      True, but very different. That’s not the highly-targeted, audience-segmented approach to advertising that parent commenter (and most people on the internet) is referring to by saying “ads”.
ben174 8y ago
Back in the early days, browsers used to prompt you for every cookie: https://i.imgur.com/FThIFHe.png https://i.imgur.com/FThIFHe.png
- volkk 8y ago
  i don't think i ever saw that. which browser?
  - rhn_mk1 8y ago
    Maemo's Web used to do that if I recall correctly.
  - ben174 8y ago
    I believe early versions of Internet Explorer did iirc. Maybe it was netscape.
  - majewsky 8y ago
    Konqueror did that when I used it in 2007-2010. I don't remember if it was the default behavior, but I had it configured by default. These days I just block all third-party cookies, which solves most of the problem.
  - SilasX 8y ago
    It was pretty common! Check out this Onion parody (from 2002), which refers to a website prompting you to accept cookies: >"She goes apeshit whenever a pop-up window comes up. And one time, she paged me because she got a message about accepting cookies. She was all freaked out because now she thought she was being charged for actual cookies." https://local.theonion.com/getting-mom-onto-internet-a-sisyphean-ordeal-1819566480 https://local.theonion.com/getting-mom-onto-internet-a-sisyp...
    - volkk 8y ago
      wow this is amazing. clearly this lady was ahead of her time typing cheesecake into the "address bar" and expecting search results.
chriswarbo 8y ago
> This shows utter incompetence and detachment from reality by European legislators. > Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes? Wait, what? There are such solutions. GDPR, and the "cookie law" before it, don't "require" any popups. They allow cookies, 1x1 pixel images, browser fingerprinting, Flash supercookies, browser local storage, etc. without any need for stupid popups... as long as that's required to implement the site's functionality. Consent for these things is implied by the user's use of the functionality (e.g. game scoreboards, saving word processor documents, keeping track of a user's shopping cart, etc.). What these laws do require is that handling such personal data without such implied consent, should require explicit consent. This acts as a disincentive for sites who want to continue spying on their visitors, by forcing the UX to be more annoying and dissuade visitors from staying. > the only practical significant impact is that browsing the web has become more annoying. Sounds like the dissuasion is working. Hopefully that is causing spyware sites to receive fewer visitors (and perhaps revenue), and potentially rethink their decisions.
- RivieraKid 8y ago
  > Sounds like the dissuasion is working. It clearly isn't. Vast majority of people (me too) are trained to automatically accept whatever cookie BS the website asks for, just to get rid of the popup as quickly as possible and get to content. And no, these "spyware" sites such as reddit.com or bloomberg.com won't switch to non-tracking ads to get rid of the popup.
  - rickycook 8y ago
    well the GDPR does say many things about how the tracking consent can’t be the default right? so yeah it’s working if you just click through... of course if businesses are breaking the law, that’s different and enforcement will come for reference there are at least 2 parts that make this outcome true: “Consent must be freely given, specific, informed and unambiguous ... Any element of inappropriate pressure or influence which could affect the outcome of that choice renders the consent invalid”: a default choice if “i agree” is influence “The withdrawal must be as easy as giving consent”: if you hit “i agree” in a box that automatically pops up to give consent, there must be a withdrawal mechanism that’s as easy as that to withdraw (and then they must delete your tracking data) https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/
tabs_masterrace 8y ago
The EU has generally been a really positive force when it comes to consumer rights, but I'm not a fan of this either. The question I have is, what did web company do to deserve this kind of regulation? It is quite unusual to see governments enact regulations, without the existence of a measurable harm being caused - but solely on the premise, that the act of collecting data is 'unethical'. I mean this is really not normal, and quite unfair, if you look how regulations worked in the past for other industries, it has always been a response to very clear quantifiable harm being caused. We have seen nothing of that, contrary, tech companies have improved our life's immensely, for free, and in my opinion, are the one of the biggest driving force towards improving the future. Data is not just being collected for advertisement, tracking, and evil purposes, but is a very important asset in the development of products. Furthermore, historically it was governments, not companies, that were abusing private data for nefarious purposes. Yet there seems to be no effort to stop it happening from that direction? Well of course not, its way to useful, and you'd be a fool not to use it, but companies are 'bad' trying utilize it...
- playpause 8y ago
  > if you look how regulations worked in the past for other industries, it has always been a response to very clear quantifiable harm being caused. It should be straightforward to show quantifiable harm to people’s right to privacy. You could survey a large number of people to ask if they would be OK with having their online habits monitored in detail by unknown companies (whose websites they didn’t even visit) for the purpose of targeting ads to them at later dates. If close to 100% of respondents say this is an invasion of their privacy, then that’s what it is. You could also do some more technical research to work out how many times per week people’s privacy is invaded in this way. You’d probably arrive at a very big number, rising every year.
- dmitriid 8y ago
  > The question I have is, what did web company do to deserve this kind of regulation? Have you been asleep for the past decade? Pervasive tracking and spying on consumers has been the topic of discussion even long before that. EU countries have had data protection laws since late 90s, and the web companies have taken a collective dump on them. So now the EU has created a single law that is quite sensible (if not without flaws) which says: you can only collect the data you absolutely require to work. If you collect other data and especially if you send to third parties, you must ask the person using your site if that's ok. Oh my, did web company do to deserve this? Oh, I don't know. Open TechCrunch and opt out of ~300 tracking, data collection and ad companies, and tell me what they have done.
sytelus 8y ago
I've rather radical thought: I don't think tracking itself is fundamentally a bad thing. I rather see useful relevant ads then irrelevant ones. Yes, it may be creepy but its not a bad thing that people in ad industry are working hard to figure out things that would be worth my time and interest. However, what is bad is how else is tracking data used? Who else has access to it and for what purpose? GDPR should have created law that tracking data may not be used for anything other than machine generated recommendations by same company and it would have been 1000X more beneficial. Downvotes may begin now.

dageshi 8y ago

I installed a plugin in firefox that just autoclicks "yes" or closes (no clue which) either way it makes the web much less annoying.

darkstar999 8y ago
This one? https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
- dageshi 8y ago
  yeah pretty sure it's that one. It works as advertised so far, basically restored the web back to how it used to be pre cookie spam.
yellowapple 8y ago
uBlock Origin (and presumably other ad-blockers) lets you block arbitrary elements, including cookie dialogs.

smileysteve 8y ago

How do you remember that a customer has responded to a popup if you don't give them a cookie? Even a cookie as a session identifier.

scrollaway 8y ago
"Cookies" are mentioned only once in GDPR, in a long list of examples. They're not targeted specifically. The law talks about information that can be used to identify a person. So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance.
- joemi 8y ago
  > So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance. I wouldn't be so certain about that. Before now, most people were pretty certain that an accept/decline warning was enough and that they had the right to refuse service to people who did not click OK on the warning.
  - gnud 8y ago
    If anyone believed that, they did not research more than 10 minutes. This comes up in _every_ discussion about GDPR. I honestly worry - are we as developers just extra stupid, or are other occupations (electricians, ship captains, architects) equally lax when it comes to reading and following regulations?
    - kd5bjo 8y ago
      Those other occupations have been regulated for a long time, so the training and verification practices have had time to mature. This is still the early days of software development regulation, so there's not much history or tradition to fall back on -- I'm pretty sure that all the other industries had similar problems when their first regulations were enacted.
J5892 8y ago
You'll need to use fingerprinting and other much more intrusive tracking methods to track the cookie preferences of any user that refuses cookies.
- asgrdz 8y ago

dmitriid 8y ago

“incompetence”, “detachment” right. I, for one, am happy that bullshit like “hey, we send your data to 244 trackers uncontrollably” has become visible and is being called out. I mean, visible only in the EU. Dark patterns and site-blocking are anti-GDPR, so I’m hoping for some heavy fine across the board. And, hopefully, if not the end then curtailing of the intrusive and tracking cookies, ads etc.

Sir_Substance 8y ago
Facebook hasn't made any more privacy or policy SANFU's over the last 12 months than they have any year before that, and yet interestingly this is the year where the people around me have been taking an interest in what I use instead of facebook and taking active steps to move away from it. These laws force people who are attempting to take advantage of non-technical users to either stop it, or do so in an obvious way that lets even non-technical users see that /something/ is up. It's good, I like it. It's driving social progress, as truth always does. I'll get downvoted for expressing that opinion here of course. Too many american software developers who want to inflict their freedom on others I guess.

raverbashing 8y ago

> Surely there are solutions that don't require a popup on every webpage you visit? I don't get any popups or cookie notices on visiting HN or several other sites. It's not like it's a fundamental need to set hundreds of tracking cookies on a visitor's browser to show them a website.

RivieraKid 8y ago
HN doesn't have ads though.
- rickycook 8y ago
  duck duck go has ads and doesn’t track you... you don’t need cookies to show ads; only to show intrusive “track you across the internet” ads
- meken 8y ago
  Don’t they have hiring advertisements for their startups?
  - bzbz 8y ago
    True, but very different. That’s not the highly-targeted, audience-segmented approach to advertising that parent commenter (and most people on the internet) is referring to by saying “ads”.

ben174 8y ago

Back in the early days, browsers used to prompt you for every cookie: https://i.imgur.com/FThIFHe.png https://i.imgur.com/FThIFHe.png

volkk 8y ago
i don't think i ever saw that. which browser?
- rhn_mk1 8y ago
  Maemo's Web used to do that if I recall correctly.
- ben174 8y ago
  I believe early versions of Internet Explorer did iirc. Maybe it was netscape.
- majewsky 8y ago
  Konqueror did that when I used it in 2007-2010. I don't remember if it was the default behavior, but I had it configured by default. These days I just block all third-party cookies, which solves most of the problem.
- SilasX 8y ago
  It was pretty common! Check out this Onion parody (from 2002), which refers to a website prompting you to accept cookies: >"She goes apeshit whenever a pop-up window comes up. And one time, she paged me because she got a message about accepting cookies. She was all freaked out because now she thought she was being charged for actual cookies." https://local.theonion.com/getting-mom-onto-internet-a-sisyphean-ordeal-1819566480 https://local.theonion.com/getting-mom-onto-internet-a-sisyp...
  - volkk 8y ago
    wow this is amazing. clearly this lady was ahead of her time typing cheesecake into the "address bar" and expecting search results.

chriswarbo 8y ago

> This shows utter incompetence and detachment from reality by European legislators. > Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes? Wait, what? There are such solutions. GDPR, and the "cookie law" before it, don't "require" any popups. They allow cookies, 1x1 pixel images, browser fingerprinting, Flash supercookies, browser local storage, etc. without any need for stupid popups... as long as that's required to implement the site's functionality. Consent for these things is implied by the user's use of the functionality (e.g. game scoreboards, saving word processor documents, keeping track of a user's shopping cart, etc.). What these laws do require is that handling such personal data without such implied consent, should require explicit consent. This acts as a disincentive for sites who want to continue spying on their visitors, by forcing the UX to be more annoying and dissuade visitors from staying. > the only practical significant impact is that browsing the web has become more annoying. Sounds like the dissuasion is working. Hopefully that is causing spyware sites to receive fewer visitors (and perhaps revenue), and potentially rethink their decisions.

RivieraKid 8y ago
> Sounds like the dissuasion is working. It clearly isn't. Vast majority of people (me too) are trained to automatically accept whatever cookie BS the website asks for, just to get rid of the popup as quickly as possible and get to content. And no, these "spyware" sites such as reddit.com or bloomberg.com won't switch to non-tracking ads to get rid of the popup.
- rickycook 8y ago
  well the GDPR does say many things about how the tracking consent can’t be the default right? so yeah it’s working if you just click through... of course if businesses are breaking the law, that’s different and enforcement will come for reference there are at least 2 parts that make this outcome true: “Consent must be freely given, specific, informed and unambiguous ... Any element of inappropriate pressure or influence which could affect the outcome of that choice renders the consent invalid”: a default choice if “i agree” is influence “The withdrawal must be as easy as giving consent”: if you hit “i agree” in a box that automatically pops up to give consent, there must be a withdrawal mechanism that’s as easy as that to withdraw (and then they must delete your tracking data) https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/

tabs_masterrace 8y ago

The EU has generally been a really positive force when it comes to consumer rights, but I'm not a fan of this either. The question I have is, what did web company do to deserve this kind of regulation? It is quite unusual to see governments enact regulations, without the existence of a measurable harm being caused - but solely on the premise, that the act of collecting data is 'unethical'. I mean this is really not normal, and quite unfair, if you look how regulations worked in the past for other industries, it has always been a response to very clear quantifiable harm being caused. We have seen nothing of that, contrary, tech companies have improved our life's immensely, for free, and in my opinion, are the one of the biggest driving force towards improving the future. Data is not just being collected for advertisement, tracking, and evil purposes, but is a very important asset in the development of products. Furthermore, historically it was governments, not companies, that were abusing private data for nefarious purposes. Yet there seems to be no effort to stop it happening from that direction? Well of course not, its way to useful, and you'd be a fool not to use it, but companies are 'bad' trying utilize it...

playpause 8y ago
> if you look how regulations worked in the past for other industries, it has always been a response to very clear quantifiable harm being caused. It should be straightforward to show quantifiable harm to people’s right to privacy. You could survey a large number of people to ask if they would be OK with having their online habits monitored in detail by unknown companies (whose websites they didn’t even visit) for the purpose of targeting ads to them at later dates. If close to 100% of respondents say this is an invasion of their privacy, then that’s what it is. You could also do some more technical research to work out how many times per week people’s privacy is invaded in this way. You’d probably arrive at a very big number, rising every year.
dmitriid 8y ago
> The question I have is, what did web company do to deserve this kind of regulation? Have you been asleep for the past decade? Pervasive tracking and spying on consumers has been the topic of discussion even long before that. EU countries have had data protection laws since late 90s, and the web companies have taken a collective dump on them. So now the EU has created a single law that is quite sensible (if not without flaws) which says: you can only collect the data you absolutely require to work. If you collect other data and especially if you send to third parties, you must ask the person using your site if that's ok. Oh my, did web company do to deserve this? Oh, I don't know. Open TechCrunch and opt out of ~300 tracking, data collection and ad companies, and tell me what they have done.

sytelus 8y ago

I've rather radical thought: I don't think tracking itself is fundamentally a bad thing. I rather see useful relevant ads then irrelevant ones. Yes, it may be creepy but its not a bad thing that people in ad industry are working hard to figure out things that would be worth my time and interest. However, what is bad is how else is tracking data used? Who else has access to it and for what purpose? GDPR should have created law that tracking data may not be used for anything other than machine generated recommendations by same company and it would have been 1000X more beneficial. Downvotes may begin now.