6 ms·

Never understood the cookie popups mess. I remember back in the ages of internet explorer it showed a popup when a site tried to use cookies, why do the sites n

Never understood the cookie popups mess. I remember back in the ages of internet explorer it showed a popup when a site tried to use cookies, why do the sites need to implement the cookie popups rather than let the users configure it in their browsers?

oneplane 7y ago
Because browsers make it an all or nothing setting (all, 1st party, none) and there are many more combinations. On top of that, the laws are there to prevent companies from tracking people at will, and the DNT header that was supposed to make that an easy browser setting completely failed.
- ailideex 7y ago
  > Because browsers make it an all or nothing setting (all, 1st party, none) and there are many more combinations. Browsers can be changed, but instead of picking a reasonable well thought through solution the governments crammed a quite horrible solution through. I honestly don't see how that protects the people who are most vulnerable nor anyone else really.
- dependenttypes 7y ago
  > Because browsers make it an all or nothing setting (all, 1st party, none) At least for Firefox this is not the case. Anyway, extensions like uMatrix exist. > the DNT header The DNT header is yet another way for sites to track you. I am glad it failed.
  - ailideex 7y ago
    > The DNT header is yet another way for sites to track you. I am glad it failed. And clicking decline on cookie banners or your unique combination on the multiple choice cookie disclaimers wont allow sites to track you?
    - dependenttypes 7y ago
      Certainly it will, but I said already that I am against cookie banners.
      - oneplane 7y ago
        Keep in mind that cookie banners are an implementation choice of the website.
manigandham 7y ago
People don't understand or care about cookies maintaining state in browsers. It was complete folly for politicians to focus on them instead of actual personal data used. GDPR rectified some of it but added much more granularity which is why cookie popups have now turned into giant selection windows.
cyphar 7y ago
It's a classic example of a legislative loophole. What the cookie law was actually trying to do was provide a way for users to opt-out of cookie-based tracking. But, someone figured out that if you just ask for permission to use cookies (for any reason) and refuse service if the opt-out, you'd still be following the letter of law (but not the intent). Arguably, this is one of the reasons why the GDPR was necessary.
- mehrdadn 7y ago
  > if you just ask for permission to use cookies (for any reason) and refuse service if the opt-out Is that even true? If I never consent do I get no cookies left on my browser?
  - cyphar 7y ago
    It (in theory) should be, but most often if you click "opt-out" they kick you off the site -- hence "refuse service". With GDPR (loosely) that is no longer allowed when it comes to the opt-in nature of data processing disclosures (if you opt-out, they can't refuse you service for not opting-in -- with certain limitations).
    - g_p 7y ago
      Interestingly, a strict reading of GDPR suggests that "consent gating" should not be permitted, but admittedly the wording is quite weak, and it isn't clear cut. > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. This would suggest consent may not be freely given if it was obtained by conditionally providing a service based on consent bring obtained for processing of extraneous data. Recital 42 adds: > Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. I don't think many users have a genuine free choice on many websites, although admittedly it's now mostly the worst offenders to blame here - the average site probably does have an opt-out now that actually works (!) Recital 32 also appears to deal with the annoying, interrupting, semi modal nature of prompts we see on ad-laden sites: > If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

oneplane 7y ago

Because browsers make it an all or nothing setting (all, 1st party, none) and there are many more combinations. On top of that, the laws are there to prevent companies from tracking people at will, and the DNT header that was supposed to make that an easy browser setting completely failed.

ailideex 7y ago
> Because browsers make it an all or nothing setting (all, 1st party, none) and there are many more combinations. Browsers can be changed, but instead of picking a reasonable well thought through solution the governments crammed a quite horrible solution through. I honestly don't see how that protects the people who are most vulnerable nor anyone else really.
dependenttypes 7y ago
> Because browsers make it an all or nothing setting (all, 1st party, none) At least for Firefox this is not the case. Anyway, extensions like uMatrix exist. > the DNT header The DNT header is yet another way for sites to track you. I am glad it failed.
- ailideex 7y ago
  > The DNT header is yet another way for sites to track you. I am glad it failed. And clicking decline on cookie banners or your unique combination on the multiple choice cookie disclaimers wont allow sites to track you?
  - dependenttypes 7y ago
    Certainly it will, but I said already that I am against cookie banners.
    - oneplane 7y ago
      Keep in mind that cookie banners are an implementation choice of the website.

manigandham 7y ago

People don't understand or care about cookies maintaining state in browsers. It was complete folly for politicians to focus on them instead of actual personal data used. GDPR rectified some of it but added much more granularity which is why cookie popups have now turned into giant selection windows.

cyphar 7y ago

It's a classic example of a legislative loophole. What the cookie law was actually trying to do was provide a way for users to opt-out of cookie-based tracking. But, someone figured out that if you just ask for permission to use cookies (for any reason) and refuse service if the opt-out, you'd still be following the letter of law (but not the intent). Arguably, this is one of the reasons why the GDPR was necessary.

mehrdadn 7y ago
> if you just ask for permission to use cookies (for any reason) and refuse service if the opt-out Is that even true? If I never consent do I get no cookies left on my browser?
- cyphar 7y ago
  It (in theory) should be, but most often if you click "opt-out" they kick you off the site -- hence "refuse service". With GDPR (loosely) that is no longer allowed when it comes to the opt-in nature of data processing disclosures (if you opt-out, they can't refuse you service for not opting-in -- with certain limitations).
  - g_p 7y ago
    Interestingly, a strict reading of GDPR suggests that "consent gating" should not be permitted, but admittedly the wording is quite weak, and it isn't clear cut. > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. This would suggest consent may not be freely given if it was obtained by conditionally providing a service based on consent bring obtained for processing of extraneous data. Recital 42 adds: > Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. I don't think many users have a genuine free choice on many websites, although admittedly it's now mostly the worst offenders to blame here - the average site probably does have an opt-out now that actually works (!) Recital 32 also appears to deal with the annoying, interrupting, semi modal nature of prompts we see on ad-laden sites: > If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.