6 ms·
With notification spam fixed, how about tackling cookie banners spam next? Let's work on a standard to allow user to set their preferred cookie settings level o
by butz 7y ago
With notification spam fixed, how about tackling cookie banners spam next? Let's work on a standard to allow user to set their preferred cookie settings level once in browser UI and keep websites clean.
- alerighi 7y agoUnfortunately, they are required by law (at least in Europe) and we can't do much about it. You can't say use a browser API to set a global setting for them, because GDPR explicitly requires that every website must get the user consent for them. Of course the real solution (and the reason why GDPR introduced the banner) is for website to stop using cookies for tracking their users and thus have no reason to put the banner (you don't need the banner for technical cookies, such as the one used for logins, but only for third party profiling cookies).
- antisthenes 7y ago> You can't say use a browser API to set a global setting for them, because GDPR explicitly requires that every website must get the user consent for them. I can see why that prevents a browser from auto-accepting all cookies, but how in the world does this logic apply to me if I want to deny consent to 100% of the websites to use cookies? Set the default on the browser to deny all consent, and show the cookie notification somewhere unobtrusive, the same way it was done for notifications.
- afiori 7y agoI suspect that it would be far to expensive to make it work on the hard 20% of websites and brittle on the easy 80%. As a personal confession I cannot sympathize for this animosity towards banners. Apps usually have a worse onboarding experience than websites. My only considerations of GDPR notices is to note how many of them manage to be uncompliant and wonder if archiving services can bypass them.
- efreak 7y agoThe browser already has logic/settings controlling which cookies are accepted (first party, all, none). These settings have existed in most browsers for years. It's unfortunate that the cookie law didn't build on this in some way.
- kuschku 7y agoThe cookie law is very flexible. It considers any and all ways in which the user makes their intent explicit as good enough. The issue is that websites want to annoy users until they finally maybe actually say yes to get the site to shut up. Legally, tracking has to be off by default, tracking may not change the usability of the site, and tracking has to be purely optional, and the "no" has to be simpler, larger, and easier to use than the "yes". The point of the GDPR, over the course of the next years, is to utterly destroy online advertising as a business model, and any and all tracking solutions with it.
- gpvos 7y agoAFAIK, this was a separate law that existed already before GDPR came along.
- worble 7y agoA minor nitpick, but the "Cookie Law" that introduced these banners was way before GDPR, although the GDPR does have articles that also talk also about cookies. The intent of the parts of GDPR which mention cookies (or, at least, what I assume the intent was) was to essentially "upgrade" the banner from a simple and largely useless notification (i.e "By using this site you agree to our use of cookies") to one of informed consent (i.e "Please click accept or deny the use of cookies to continue using this site"). Interestingly, as far as I am aware, no site or company has ever been taken to court or even fined for not using a cookie banner, despite some websites publically declaring they won't use it[0]. 0: https://nocookielaw.com/ https://nocookielaw.com/
- Tilian 7y agoSince most websites seem to prefer slapping banners and modals on their pages as opposed to actually ridding their sites of tracking cookie usage I've found that just blocking the elements using a filterlist[0] is a nice solution. [0] https://www.i-dont-care-about-cookies.eu/abp/ https://www.i-dont-care-about-cookies.eu/abp/
- atoav 7y agoImportant point: GDPR allows you to use strictly necessary cookies without asking for consent. So if you hate to put cookie banners onto a site, just stick with storing only strictly necessary cookies without data that identifies your users and you are fine. The problem is, many people don’t even know what cookies their own site stores with their users and they store a ton of tracking cookies on their user’s devices.
- p1necone 7y agoIsn't the whole point of cookies to identify users (for session persistence and the like, not just ads)? If you're not identifying users what are you achieving?
- frabcus 7y agoSome sites store local settings in cookies, that the user has explicitly set.
- arkh 7y agoStoring the language they want to use or other configuration.
- atoav 7y agoFor some sites it could be enough to store the state of the site (e.g. display settings, language, etc) instead of a profile. When I visit a random wordpress blog I shouldn’t need any cookie from them — why would I? When I visit an online shop it should be my choice if they remember me (which is precisely what the GDPR demands). This could be a little toggle switch labled “Remember me” that is off by default and that would be it. But people seem to prefer forcing their cookies onto users.
- enlyth 7y agoHow would you detect if something is a cookie dialog in a standardized way? It's pretty much impossible as all of them are custom code with different layouts / selectors / sequence of actions you need to take to opt out.
- worble 7y agoThe "I don't care about cookies" addon[0] seems to do a pretty good job of it, I've not seen a banner in ages. I assume it works on a mixture of detecting popular cookie popup js libraries, and user feedback for the rest (although I can't seem to find a github or any code for it so it's hard to say). I think ublock also has a filter list for it built-in. 0: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- NilsIRL 7y agoI don't know if I'm paranoid but on the Mozilla add-on page, it says the code is licensed under GPLv3. So the source code MUST be available somewhere. Seems very odd.
- freeAgent 7y agoSee the author's comment here: https://www.reddit.com/r/privacy/comments/bru6wd/please_help_me_find_the_i_dont_care_about_cookies/eohtox3/ https://www.reddit.com/r/privacy/comments/bru6wd/please_help... The source code can be extracted from the extension file itself.
- scrollaway 7y agoI can't find the source repo either (source must be made available, can be on-demand to the author, hell the author could send it to you on CD-ROMs if they felt like it and still be compliant). That said, it makes an ABP-compatible filter list available. This works with ublock origin: https://www.i-dont-care-about-cookies.eu/abp/ https://www.i-dont-care-about-cookies.eu/abp/
- amelius 7y ago
- zozbot234 7y ago> Let's work on a standard to allow user to set their preferred cookie settings level once in browser UI and keep websites clean. Bring back P3P, with GDPR acting as the enforcement part (which was quite lacking when P3P was first proposed)? Might work quite nicely, and the support is in browsers already, it just tends to be ignored.
- Avamander 7y agoI've thought exactly the same and I think now might exactly be the right time to bring it back. However can the client tell to the server if it consents or not? Second problem is of course that malicious or lazy site admins won't use P3P just that they can annoy users to click Accept.
- humblebee 7y agoI don't remember the website, but I ran across one on hacker news a while ago that had the best cookie popover I've ever seen. It floated over from the left hand side of the page. Had simple and clean UX allowing for user configuration of cookies. Felt a little more like a cookie control panel than a popup disclaimer. Allowed the user to select which cookies to allow with a small description of what they did. Wish I had bookmarked the page.
- fiblye 7y agoSounds like something users want. Unfortunately, that’s not what most website owners want. They want to be as annoying as possible so that you smash “agree” just to get it over with.
- atoav 7y agoWhat users want? GDPR allows you explicitly to serve strictly necessary cookies without asking for consent. You only have to ask if you track people or don’t know what cookies your site stores with your users. It is 2020 and totally possible to create websites without cookies or with only functionally needed cookies. You do your users a favour and your site will look better. The very idea of the GDPR wasn’t to force websites to display cookie banners. It was to clarify that cookies can contain identifyable personal data and can be used for tracking, which is why we should avoid using them in that way or ask for consent if it really must be used.
- Normal_gaussian 7y agoI don't feel the same about cookies from HN, Facebook, GitLab, Slack, Amazon, Pentland Ferries, Ennerdale Brewery, or my mum's blog.