4 ms·

> The problem is there are bunch of warriors on the net and elsewhere that do things like claim that users hate cookies and won't accept them, so need to be war

> The problem is there are bunch of warriors on the net and elsewhere that do things like claim that users hate cookies and won't accept them, so need to be warned of them by every website (which can still technically set cookies regardless of any popup). If users don't want cookies they can block them at the browser level - that's how you have actual control BTW - a scam site may not put up the cookie notice and may still be able to set the cookie. Tracking was being targeted, cookies were conflated with tracking (they are, but not really at the level that's being talked about), and some ineffectual legislation was passed to target cookies instead of tracking. It's almost as if the whole process was steered to that point to avoid any useful change with regard to online tracking...

saagarjha 7y ago
If you're talking about the EU cookie law, that explicitly targets cookies that have nothing to do with the functionality of the site.
- kbenson 7y ago
  I'm just saying that it's 90% visual and 10% effectual (and I think I'm being generous), and likely makes the average person think good strides have been taken towards the problem of line tracking, which I don't think it really helps. It's the perfect level of highly visible and almost useless that it may in fact be counter-productive.
  - ratww 7y ago
    Implementations where there's only an "Accept" option are not following law, though. The user must opt-in of their own volition, must be able to reject the tracking cookies (or any kind of tracking) and must be able to opt-out later as well. Btw: Functional cookies (colours, session, login, cart, language) don't need consent, just disclosure (and it doesn't have to be an ugly cookie bar).
- klausjensen 7y ago
  What do you mean? If I have a website and ONLY use a single cookie to save a setting for the user for the background color - I still have to get the user to accept the cookie, right?
  - bouke 7y ago
    No. It's a functional cookie. You don't need permission for functional cookies.
- TheRealPomax 7y ago
  It explicitly _doesn't_ target cookies, it explicitly targets any and all stored information that can be resolved to "a specific person", which simply includes things like session and tracking cookies.
  - hjnilsson 7y ago
    Session cookies are allowed (without consent) if your site has something like login or stored settings. You don’t need consent if the cookie is required to provide a function to the user. Only cookies that are used to track user behavior, and can be tracked back to that particular user are disallowed. So things like Facebook like buttons would require consent (since Facebook will use the info gained to target you with ads in another context) while basic Google Analytics or similar is fine as it only presents aggregated data to the site owner and does not leak data cross-site. Some GA features do require consent though (like demographics tracking) as it requires Google to cross-reference between sites. You can generally turn these off (I think they even are off by default?) Note that implementation of the law also differs between EU countries. So a few are more strict. It is up to the national privacy agency to set exact rules.
- privateSFacct 7y ago
  The function of the website for the website owner is to make money. Setting cookies helps with that. The EU law says I have to disclose lots of stuff and get your consent before tracking you. So every website added a disclosure and consent button, and every user clicked on it. If you think of the wasted power of a billion warning / notifications a day, you realize how little folks will pay attention to these warnings, it's the only way to get on with your life is to tune these warnings out. SERIOUSLY - can't someone do a study in the EU showing that their constant warnings mean folks have totally tuned them out?
  - ratww 7y ago
    Most implementations where there's only a disclosure/consent button are not compliant and are as good as not having anything. Here's how the GDPR options of an European website looks like: https://imgur.com/a/ckOivi7 https://imgur.com/a/ckOivi7 That "Analytics Advertising Feature" MUST be unchecked by default. Only users that actually want to be tracked are tracked. Every "tracking feature" (cookies, fingerprinting, IP tracking, whatever) must be hard opt-in, and the website has to provide an option for the user to opt-out if they change their mind. If a website only use functional cookies (colours, session, login, cart, language) they don't need consent, just disclosure (and it doesn't have to be an ugly cookie bar).
    - privateSFacct 7y ago
      Go to this website: https://europa.eu/ https://europa.eu/ This is the official EU website. EVERYONE is being trained to click I accept. And then they do a nonauthenticated javascript scrip insert into a secure page ON THEIR HOMEPAGE. You gotta love it. <script type="text/javascript" src="http://ec.europa.eu/wel/surveys/wr_survey01/wr_survey.js"></script> What would provide users some actual security is if their browser would block this unauthenticated insert of javascript if its in a secure page. In other words, DON'T trust the website to do the right thing, just take control at the browser level.
      - saagarjha 7y ago
        That's because they're using cookies that are not essential to the functioning of their website.
throwaway2048 7y ago
The EU "cookie" law does not mention cookies, and is equally applicable to all forms client side tracking. Most websites made it about cookies, but it does not contain that language.

saagarjha 7y ago

If you're talking about the EU cookie law, that explicitly targets cookies that have nothing to do with the functionality of the site.

kbenson 7y ago
I'm just saying that it's 90% visual and 10% effectual (and I think I'm being generous), and likely makes the average person think good strides have been taken towards the problem of line tracking, which I don't think it really helps. It's the perfect level of highly visible and almost useless that it may in fact be counter-productive.
- ratww 7y ago
  Implementations where there's only an "Accept" option are not following law, though. The user must opt-in of their own volition, must be able to reject the tracking cookies (or any kind of tracking) and must be able to opt-out later as well. Btw: Functional cookies (colours, session, login, cart, language) don't need consent, just disclosure (and it doesn't have to be an ugly cookie bar).
klausjensen 7y ago
What do you mean? If I have a website and ONLY use a single cookie to save a setting for the user for the background color - I still have to get the user to accept the cookie, right?
- bouke 7y ago
  No. It's a functional cookie. You don't need permission for functional cookies.
TheRealPomax 7y ago
It explicitly _doesn't_ target cookies, it explicitly targets any and all stored information that can be resolved to "a specific person", which simply includes things like session and tracking cookies.
- hjnilsson 7y ago
  Session cookies are allowed (without consent) if your site has something like login or stored settings. You don’t need consent if the cookie is required to provide a function to the user. Only cookies that are used to track user behavior, and can be tracked back to that particular user are disallowed. So things like Facebook like buttons would require consent (since Facebook will use the info gained to target you with ads in another context) while basic Google Analytics or similar is fine as it only presents aggregated data to the site owner and does not leak data cross-site. Some GA features do require consent though (like demographics tracking) as it requires Google to cross-reference between sites. You can generally turn these off (I think they even are off by default?) Note that implementation of the law also differs between EU countries. So a few are more strict. It is up to the national privacy agency to set exact rules.
privateSFacct 7y ago
The function of the website for the website owner is to make money. Setting cookies helps with that. The EU law says I have to disclose lots of stuff and get your consent before tracking you. So every website added a disclosure and consent button, and every user clicked on it. If you think of the wasted power of a billion warning / notifications a day, you realize how little folks will pay attention to these warnings, it's the only way to get on with your life is to tune these warnings out. SERIOUSLY - can't someone do a study in the EU showing that their constant warnings mean folks have totally tuned them out?
- ratww 7y ago
  Most implementations where there's only a disclosure/consent button are not compliant and are as good as not having anything. Here's how the GDPR options of an European website looks like: https://imgur.com/a/ckOivi7 https://imgur.com/a/ckOivi7 That "Analytics Advertising Feature" MUST be unchecked by default. Only users that actually want to be tracked are tracked. Every "tracking feature" (cookies, fingerprinting, IP tracking, whatever) must be hard opt-in, and the website has to provide an option for the user to opt-out if they change their mind. If a website only use functional cookies (colours, session, login, cart, language) they don't need consent, just disclosure (and it doesn't have to be an ugly cookie bar).
  - privateSFacct 7y ago
    Go to this website: https://europa.eu/ https://europa.eu/ This is the official EU website. EVERYONE is being trained to click I accept. And then they do a nonauthenticated javascript scrip insert into a secure page ON THEIR HOMEPAGE. You gotta love it. <script type="text/javascript" src="http://ec.europa.eu/wel/surveys/wr_survey01/wr_survey.js"></script> What would provide users some actual security is if their browser would block this unauthenticated insert of javascript if its in a secure page. In other words, DON'T trust the website to do the right thing, just take control at the browser level.
    - saagarjha 7y ago
      That's because they're using cookies that are not essential to the functioning of their website.

throwaway2048 7y ago

The EU "cookie" law does not mention cookies, and is equally applicable to all forms client side tracking. Most websites made it about cookies, but it does not contain that language.