45 ms·

No cookie consent walls, scrolling isn’t consent, says EU data protection body

• treve 7y ago
  It's time for a browser-level cookie consent API. The web interfaces are almost always a pain, especially on mobile. This would also open the door to extensions that just default consent to 'no'. This can't be the default though, to avoid another failure like Do Not Track.
  • gjs278 7y ago
    we already have that. it’s called your cookie settings.
  • TheSoftwareGuy 7y ago
    I've been saying this for years. Cookies are already a browser feature. Browsers just need to expose a little more control over it
    • Libeste 7y ago
      Firefox used to. But they ripped that out like every other useful feature over the years.
      • mcv 7y ago
        I don't understand why. This is exactly something that browsers should do.
      • neltnerb 7y ago
        They did? I haven't noticed a change in many years or using it. If anything it's gotten better with the availability of extra functionality through cookie autodelete and built in container tabs.
    • koonsolo 7y ago
      Me too... nobody listens...
      • jchook 7y ago
        How is this not solved by Brave + uBlock Origin or Disconnect or Privacy Badger?
        • koonsolo 7y ago
          1. Because websites keep bugging me about consent 2. Because website builders need to write custom things for consent
  • zozbot234 7y ago
    P3P https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P is a thing already, if perhaps a bit overengineered. It even works in IE6!
    • luckylion 7y ago
      That's server-side (and dead). Cookie consent would primarily be client-side. Otoh, we already have cookie-consent in browsers. Just don't accept cookies if you don't consent!
      • zozbot234 7y ago
        P3P also exposes a machine-readable semantics for privacy policies, which could be used by the browser to manage access to not just cookies but other problematic features as well. It's a lot more flexible than "just reject cookies" or the "DNT" header.
        • luckylion 7y ago
          The issue is imho that the decision needs to happen server-side (so that a user with an incompatible client isn't slurped up by default), ergo the user-agent must declare the intentions of the user and the server needs to act on it. P3P could be a hint for the the user-agent, but the user-agent would have to tell the server what level of tracking etc is acceptable to the user.
  • im3w1l 7y ago
    Do Not Tracked was not backed up by laws. That's the difference.
  • akvadrako 7y ago
    If the default was 'yes' (i.e. opt-in) then it's not consent. The solution is just proper enforcement and education. Opt-out by law must be the default while opt-in requires extra actions. Just teach people to always click No and eventually the dialogues will go away.
  • Deukhoofd 7y ago
    A browser setting replacing the popups is part of the new EU ePrivacy Regulation, which is at the moment still being discussed. I hope it gets finalized soon, because there's a number of improvements in there. https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...
    • kule 7y ago
      Thank god, I never understood the EU directives that didn’t consider that by making sure things were implemented at a browser level it would cause an order of magnitude less work for web developers/site owners and ensure a consistent experience for end users.
      • dom96 7y ago
        It boggles my mind why they didn't think of doing this in the first place. I've been annoyed by the stupid cookie law since it became a law, it's ridiculous to have every single website implement it differently when the darn browsers can just implement it.
        • Deukhoofd 7y ago
          The cookie law is 18 years old, browsers have changed quite a bit since then, as has legislative understanding of the tech field.
          • Kalium 7y ago
            Having read through GDPR, I got the distinct impression that nobody involved in writing it really understood the technologies involved. There's a lot of handwaving about "reasonable measures" whenever they run into ignorance that's absent in the many chapters about inter-government protocols.
            • mqus 7y ago
              GDPR was explicitly designed to be "general". Specifying website behaviour is a bit specific for a regulation that wants to regulate privacy at a whole (in virtual and reallife interactions). Of course that also means that the regulation is quite lacking when it comes to specifics but that wasn't its goal. The goal was to be a fallback-law which regulates everything that is not explicitly regulated otherwise. What you want is the ePrivacy Directive which "introduced" the cookie banners many years ago and its updated version which is (still) not ready.
  • kerkeslager 7y ago
    Frankly, I'd be happy if sites just supported Do Not Track.
    • tfehring 7y ago
      They do support it, if including it as a level of granularity for fingerprinting counts as support. :-)
  • Mirioron 7y ago
    This should've been what was done from the get go. Browsers have given us control over cookies for a very long time now. But hey, it's the EU, there's a reason the EU has a lack of tech companies. I'm sure that when they finally do what you suggest they'll screw it up somehow as well.
    • dgellow 7y ago
      You want regulators to design APIs?
      • Mirioron 7y ago
        What I want is irrelevant. I have as much say about what happens in the EU as I have say in US politics despite being from the EU. The politicians will do something stupid regardless and then years later not understand why things are going poorly. Meanwhile the Germans and French will love it, because it screws those evil evil American companies. So, the regulators might as well design APIs. It's hard to imagine that it would end up any worse than their usual.
      • lifeAsNerd 7y ago
        I'm pretty grossed out that the internet has been taken over by the government. Blocking cookies should be done by users via software. This is only going to make the barrier to entry higher and more expensive. I have no idea what many small non tech businesses would do? Pay a few thousand every year when standards change?
        • boomlinde 7y ago
          > This is only going to make the barrier to entry higher and more expensive. That's the point. We want the barrier to entry in widespread tracking to be high. For what it's worth, you don't need cookie consent warnings if you use them only for functionality integral to the product you offer your user. For example, if you need to use a cookie to facilitate a logged-in user session, you don't need to warn them. The only ones paying the high price is the people who use it to collect user information not essential to the service they provide to the user, for god knows what.
  • centimeter 7y ago
    It’s called “using an extension to manage cookies”. There are dozens of extensions for this. Encoding the usage of a particular (probably otherwise short-lived) technology in law is generally a pretty bad idea. Sure, have the EU write laws about cookies - the two outcomes are A) this becomes useless when people switch to a different tech stack that doesn’t use cookies B) we’re stuck using 30-year-old technology to try to get things done, at least for regulated industries like banking or government services. Like the IE regulatory situation in Korea but worse.
    • p410n3 7y ago
      The gdpr does NOT plainly state cookies. It refers to any form of user tracking from websites! Quoting recital 30 of gdpr "NATURAL PERSONS MAY BE ASSOCIATED WITH ONLINE IDENTIFIERS…SUCH AS INTERNET PROTOCOL ADDRESSES, COOKIE IDENTIFIERS OR OTHER IDENTIFIERS…. THIS MAY LEAVE TRACES WHICH, IN PARTICULAR WHEN COMBINED WITH UNIQUE IDENTIFIERS AND OTHER INFORMATION RECEIVED BY THE SERVERS, MAY BE USED TO CREATE PROFILES OF THE NATURAL PERSONS AND IDENTIFY THEM." https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/
      • centimeter 7y ago
        When a corporate lawyer hears a law explicitly list technologies like "IP addresses" and "cookies", they're going to (rationally) get scared when you step outside the clear boundaries of that law, and it's their job to place institutional pressure on technical people within the corporation not to do things that make them scared.
    • brownbat 7y ago
      > the IE regulatory situation in Korea I found this from 2013: https://www.zdnet.com/article/south-koreans-use-internet-explorer-its-the-law/ https://www.zdnet.com/article/south-koreans-use-internet-exp... Anyone have an update to that story? I know in Korea they use a ton of apps to order things all the time now. Maybe this law was phased out, or just didn't apply to phones? Not to take away from your broader point. Laws are just such a terrible development model. Everything's tested live and you can't easily revert anything.
  • artursapek 7y ago
    Seriously. If there was ever something that needs standardization, it's this horrible cookie law crap.
  • koonsolo 7y ago
    Oh boy this really has come full circle. I'm an old dude, so I never understood why you would require websites to ask for cookie consent, when you can handle that more safely in your web browser. That's like putting a sticker on your car saying "Don't come into my car" instead of just locking it. Why do you need regulation when you can just let technology solve it? No idea. So NO! NO fucking cookie consent API! Just let the browser ask you when a cookie needs to get set... DAMNIT! In my day, website used to be websites where you could read stuff. Anyone who wasn't able to predict these annoying popups after HTML5 and GDPR, is seriously blind. (Sorry for the rant ;))
    • freehunter 7y ago
      Yeah in your day websites were websites where you could read stuff. But today they’re massive interactive applications. It’s not even remotely the same.
      • koonsolo 7y ago
        Well, I don't want an article to be interactive.
    • dash2 7y ago
      I so agree with this. I find the level of admiration for this painful law absurd. I'm stuck in Europe. I was fine without the GDPR. Now, I waste my time clicking "accept" because I don't have time to deal with this crap. Meanwhile, my university has hired what my stepfather would have called a "tweety little person" to police GDPR regulations. God knows what she does (she doesn't). God knows in what single way she has improved a single person's life. But she has a job now, and by God, she'll fight for it. I care about privacy, but there were options to manage this already - like browser extensions. You could download them if you cared, and if you didn't want to, you didn't have to. Government regulation, demanded by zealots, has added one hundred tiny frustrations per day to millions of ordinary people, caused an expensive pain to thousands of small websites, and created a new, wholly useless compliance industry. And is Facebook tracking me any less? Ha ha ha. Facebook can afford lawyers.
  • boomlinde 7y ago
    You don't need an API for it. Browsers can reject cookies at a protocol level (by simply not sending cookie headers), and indeed used to ask users whether they wanted to allow cookies from a certain domain or not. You can disable all cookies altogether in at least Firefox and Chrome. You can make them only last for the current session.
    • nerdponx 7y ago
      The problem as always is that, like Javascript, some cookies are still useful (saved login and 2FA status). Power users, upon request, should be presented with and asked to accept/reject/blacklist/whitelist cookies. Interestingly the only browser I know of that does this is Lynx, which is text-only and does not support Javascript.
      • jchook 7y ago
        I use Brave + uBlock and get nearly this exact experience. Disconnect and Privacy Badger also work well.
        • nerdponx 7y ago
          I use uBlock as well, but it doesn't have a convenient interface that allows me to inspect and modify cookie permissions. What is your workflow when visiting a new site and figuring out what cookies to allow?
      • boomlinde 7y ago
        Then it's not so much a cookie consent API we're looking for but an "unwanted cookie" consent API. Issue immediately becomes political, which IMO is why previous attempts at such (Do Not Track header) have failed. With browsers you can of course default to blacklisting all cookies and add exceptions as you go. I did this privately in Firefox until I was sent to work from home during the pandemic, after which figuring out what cookies I needed to enable to get Teams to work proved too much of a hassle.
        • 7y ago
  • MiroF 7y ago
    Do Not Track was a failure because no state actor was forcing private companies to comply. Even if it had been an opt-in solution, no company would have respected it.
    • Avamander 7y ago
      Interestingly DNT was used by Medium to some extent.
      • saagarjha 7y ago
        It's sad that I need to ask what "used" means in this context, but did they respect Do Not Track or use it as a tracking point?
        • Avamander 7y ago
          They respected it in the sense that they didn't load external embedded content that didn't respect it.
• IgorPartola 7y ago
  This seems like it should have been handled as a browser feature, not an add-on to every damn website. Especially since they tend to somehow forget that you clicked accept or reject and keep asking you.
  • chapium 7y ago
    Whats harder, change 5 browsers or 2 billion websites.
    • luckylion 7y ago
      The big question: what makes more money for lawyers (who write & vote on the laws)?
      • IgorPartola 7y ago
        Nah, the Illuminati are funding it. It’s fine.
      • chapium 7y ago
        True, its probably easier to collect rent indefinitely on websites rather than convince Microsoft/Google/Mozilla/Apple to change their browsers.
  • onli 7y ago
    This is handled as a browser feature. Regulators just did not care - and most probably did not know about that.
    • Deukhoofd 7y ago
      It probably wasn't in 2002, when the current cookie law was written. The new ePrivacy Regulation does want to replace it with a browser function though: https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...
• esotericn 7y ago
  Can we kill off anything that takes more than a second or two to 'not opt-in' as well? It's obviously against the spirit of the law to have 200 different boxes that must be individually unticked, or the sort of nonsense that Oracle were pulling a while back (maybe still do) with the intentional delay spinner if you don't 'opt-in'.
  • gpderetta 7y ago
    it is against both the spirit and the letter, as preticked boxes are not considered a valid opt-in.
    • deleted 7y ago
      [deleted]
    • smolder 7y ago
      It's amazing how stubbornly site operators are clinging to tricks to get user data as if it's not all prohibited by GDPR.
      • mindslight 7y ago
        They're used to stonewalling USian regulators who will capitulate after a round or two.
      • Mirioron 7y ago
        Well, would you rather the site just not exist then? Because I'm pretty sure that most of these sites already aren't making much money. If you make it much much much harder for them to get money then they won't survive.
        • turbinerneiter 7y ago
          So then shut them down. There is no human right to run a profitable website, there is however a human right to privacy. If you can't run a website without literally violating the users basic human rights, then just don't.
• mankyd 7y ago
  > Hence cookie walls that demand ‘consent’ as the price for getting inside the club are not only an oxymoron but run into a legal brick wall. This seems like a slippery slope situation. What if you require people to login, signup, or pay to access your content? There is certainly some sites out there that reasonably require this. How do we define the boundary between the two?
  • hadrien01 7y ago
    This is... okay, obviously? Depends on what the consent is for. Tracking for targeted ads? No. Logged-in personalized content or subscription? Yes.
  • C4stor 7y ago
    The cookie consent wall is only a solution for sites willing to drop third-party cookies. You can still require anything regarding your own website to access it, including cookies, as long as those are needed for the correct functioning of your website. What this clarifies is that you can longer restrict your website access to people "consenting" to have tens of other companies dropping cookies on them.
    • macinjosh 7y ago
      > What this clarifies is that you can longer restrict your website access to people "consenting" to have tens of other companies dropping cookies on them. This is the same thing as forcing a religious baker to make a statement cakes that violate their religion. If you don't like how a site works don't fucking visit it! Every modern browser has a setting to block third party cookies as well. Forcing web site owners to serve customers who don't like the business model of the site is Orwellian.
      • C4stor 7y ago
        No, it's not orwellian at all. There a ton of things you can't ask as payment for your services. It may be physical (let's say body parts), or conceptual (let's say the user freedom of speech). Those things can't be enforced by any contract, however you want to write them, and even if you somehow got someone to sign on it, it would still be void. In the EU, we deemed suitable to add "privacy" to the list of things you can't legally ask a payment for when providing a service in the form of a website. That's it. Maybe that's shocking for you, but it's not for me, it's not for the people I voted for, and apparently it's not for quite a number of people and so, it passed. If you don't like how the law works, well, don't live in the EU ? You can find a lot of countries where this is isn't a consideration, and that may suit you better. Otherwise, well, you've been pwned by democracy. Tough luck ! (I won't begin to adress your comparison with the baker, because, well, I can't begin to make sense of it.)
• simongr3dal 7y ago
  Pretty ironic that this is coming from techcrunch. I get the yahoo consent wall every time I try to open their links.
  • csunbird 7y ago
    Their cookie wall is definitely not GDPR compliant, I am not sure why this is not reported yet.
    • alkonaut 7y ago
      Why do they even run a story where the main takeaway is "The site you are reading this on, is breaking the law"? Is TechCrunch some kind of bot aggregated site? Or is the irony just lost on them?
      • asdff 7y ago
        I'm willing to bet the writers have never seen the site in its modern form.
• evancox100 7y ago
  Please just let me opt out of this cookie consent idiocy. How are we making anything better with all these cookie consent pop ups?
  • coldpie 7y ago
    NoScript goes a pretty long way to making the web usable again, especially on mobile (attn web developers: don't like people using noscript? it's your fault. fix it.). There's also this, although I can't vouch for it personally: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
    • mardifoufs 7y ago
      I use it on firefox and it works very well. I think it doesn't support every website out of the box, but I've never came across one that it didn't work well on. The prompts were turning me crazy especially since I use a few privacy extensions that made it impossible for the websites to remember my settings. It meant even browsing the same website lead to one consent form per page I clicked...
    • aembleton 7y ago
      Or just add the list to uBlockOrigin https://www.i-dont-care-about-cookies.eu/abp/ https://www.i-dont-care-about-cookies.eu/abp/
      • fireattack 7y ago
        Other similar filter lists: EasyList Cookie: https://easylist-downloads.adblockplus.org/easylist-cookie.txt https://easylist-downloads.adblockplus.org/easylist-cookie.t... AdGuard Annoyances filter: http://adguard.com/filters.html#annoyances http://adguard.com/filters.html#annoyances (There is also "Fanboy’s Annoyance", but it blocks more than just cookie notifications. For example, it blocks social media share buttons which I use a lot. So I don't use it.)
  • ApolloFortyNine 7y ago
    I agree, I just love that's it's now legally required for the vast majority of sites on the internet to have a popup.
• nkassis 7y ago
  The part about having a genuine choice is basically ignoring the choice of not interacting with the website beyond reading the cookie message. I understand that it's a shitty choice but it's at least there. This essentially forces the site owner to provide content without it's side of the terms being allowed to be required.
  • C4stor 7y ago
    That's not true. It forces the site owner to provide content under its own terms as long as its terms does not involve non necessary functionalities provided by other companies. You can still enforce you own terms, but you can't enforce the GAFA cookies at the same time. Said otherwise, your terms of service must be privacy-sensible, which is indeed the very goal of the law.
  • DagAgren 7y ago
    It's a shitty choice, which is exactly why it is not a genuine choice. And yes, that is exactly what it does. That is the point. We have decided that that is a good thing to require.
• chapium 7y ago
  There has to be a better way to regulate technology rather than changing the document. Why not a browser plugin?
• whatsmyusername 7y ago
  I don't give the slightest fuck about GDPR because of the dumbass cookie popups they forced on every single site.
  • simias 7y ago
    It baffles be that people are mad at the GDPR for making websites be clear about how they share your privacy data instead of being mad at websites for not changing the way their operate in order not to need such a pop up in the first place. Advertising is a hell of a drug.
    • gjs278 7y ago
      adblockers should at least block these consent popups
    • nicky0 7y ago
      Who really gives a shit about advertising cookie tracking though? Just a few purist geeks on their high horses. And the rest of us suffer with these popups. I blame the GDPR for being drafted in a way that allowed this mess.
      • alkonaut 7y ago
        This is exactly the reason the law exists: that people can't actually be expected to understand the consquences. I sure don't - so I'm glad someone else looks after my interests.
      • pessimizer 7y ago
        I can imagine how you can believe that privacy is not a significant or real concern, what I can't imagine is how you think your annoyance with cookie permission popups is somehow more significant.
        • nicky0 7y ago
          It's more significant to me. In-your-face consent pop-ups are a multiple times daily annoyance. Targeted ads while creepy don't interrupt your task. After all you will be seeing an ad anyway, whether it is targeted or not hardly makes a difference. This "cure" is worse than the problem it tries to solve.
• zpeti 7y ago
  The amount of time the EU has taken away from internet users with this insane policy is ridiculous. Yes, everyone in the fucking EU knows what a cookie is now. I can't believe I have to waste 3-5 seconds of my life on most website visits clicking a box. But obviously sitting in an office in Brussels making an actual calculations of the years you take away from people is not something you do.
  • TomMarius 7y ago
    Actually no one around me does know, which shows just how misguided the law is.
  • nicbou 7y ago
    Don't blame the regulation, blame everyone who is trying to get you to click the consent button. Cookies are a simple yes/no question, with the default answer being no. If everyone did what's in the users' best interests, it would be a non-issue.
    • djohnston 7y ago
      you need session tokens to do useful things on WWW. why is the default no? i want my default to be yes.
      • chacha2 7y ago
        GDPR only needs a cookie warning if it's used for tracking.
      • notechback 7y ago
        Technical cookies don't need consent.
    • zpeti 7y ago
      So how do you store user information then? Like logins? Sessions? Also rely on cookies. Browser fingerprinting? Great - then you've switched one problem for another. This entire EU regulation is a non solution to a not really existing problem. Yes, third party advertisers use cookies to track you. But they can build technologies to use something else. In the meantime you are a) breaking the internet b) wasting hours of each EU citizens time every year.
• TomMarius 7y ago
  Can't they require a HTTP header that I would manage in my browser?
  • nathancahill 7y ago
    We had one. It didn't work. DNT: 1
    • TomMarius 7y ago
      I don't see any mention of that header in any law, nor any court resolution regarding that header. If that does not exist, we did not try.
      • zorked 7y ago
        Laws are not written around protocols. The GDPR is not HTTP-, Web- or Internet-specific.
        • TomMarius 7y ago
          Seems like we've uncovered the root cause of failure; besides, isn't the concept of cookies a part of the HTTP protocol?
• RandomBacon 7y ago
  One of my favorite bookmarklets to remove cookie notifications or other obnoxious overlays: javascript:(function(){(function () {var i, elements = document.querySelectorAll('body *');for (i = 0; i < elements.length; i++) {if (getComputedStyle(elements[i]).position === 'fixed') {elements[i].parentNode.removeChild(elements[i]);}}})();document.querySelector('body').style.setProperty('overflow','auto','important'); document.querySelector('html').style.setProperty('overflow','auto','important');})()
  • Sir_Substance 7y ago
    I'd really like to see an addon that just blocks the css overflow attribute. I've only ever seen it used by websites that try to stop people who are blocking their giant modal popups from scrolling. It might be that I'm dumb and can't figure out how to add a ublock/umatrix rule to block it, but I'd love a single purpose addon that just deletes "overflow:hidden" in all cases.
    • chadlavi 7y ago
      document.querySelectorAll('*').forEach(e => e.style.overflow = 'unset')
      • Sir_Substance 7y ago
        Nice, I'll keep that as a bookmarket, saves me rooting around in the inspector!
        • chadlavi 7y ago
          May also need to add others like e.style.overflowY
    • timdorr 7y ago
      I think you mean position: fixed or sticky? Overflow controls what happens when the contents of a bounding box exceed it's allowed size, which is usually to hide or make the box scrollable.
• VWWHFSfQ 7y ago
  this cookie consent stuff does absolutely nothing but annoy people
  • notechback 7y ago
    Not because of the law but because those pushing tracking and designing the banners intentionally make them intrusjve. Purely technical cookies (eg login, spam protection) don't need a consent by the user.
• Piisamirotta 7y ago
  Damn I hate those cookie pop-ups so much. Bullshit.
• eMSF 7y ago
  Somewhat ironically a consent wall is exactly what TechCrunch presents to an EU visitor the first time, and there's no opting out; only way to get past the consent dialog is to consent. I know this especially well because I automatically clear all browsing data each time I close my browser, and techcrunch.com is one of the domains I avoid on HN because of the more annoying "welcome" on any page. (edit: +n)
  • petargyurov 7y ago
    Same here. Isn't this against GDPR regulations? I thought that sites must give you the option to not provide consent and still visit the site.
    • jagged-chisel 7y ago
      Can a website be compelled to provide its content? I can see the POV where "We cannot serve you unless you agree to certain rules."
      • Johnjonjoan 7y ago
        They maintain the right to refuse service but my uneducated opinion is that it could be penned as discrimination given the circumstances
        • neltnerb 7y ago
          Surely they can require an account for all users. Of course then no one would register because who has time for that.
      • petargyurov 7y ago
        I may be mistaken, but I think it falls under some sort of discrimination ruling? I.e.: you can't discriminate against those users who don't want to give consent.
        • 7y ago
• aasasd 7y ago
  Pardon? Is this saying that closing the page is not a choice?
  • DagAgren 7y ago
    No.
    • aasasd 7y ago
      https://techcrunch.com/wp-content/uploads/2020/05/Screenshot-2020-05-06-at-12.28.43.png?resize=680,171 https://techcrunch.com/wp-content/uploads/2020/05/Screenshot... Where does this extract allow for the user be guided off the site? As far as I can see, it demands that the user can ‘freely give’ the choice to access the site without using cookies.
      • DagAgren 7y ago
        I was saying it is not saying it is "not a choice", it is saying it is not an acceptable choice.
• Quanttek 7y ago
  The guidelines can be found here: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... They are pretty great, beyond the examples brought up here. For instance, on the criterion free/freely given, they write the following: > The element “free” implies real choice and control for data subjects. As a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid.13If consent is bundled up as anon-negotiable part of terms and conditions it is presumed not to have been freely given. Accordingly,consent will not be considered to be free if the data subject is unable to refuse or withdraw his or her consent without detriment.14The notion of imbalance between the controller and the data subject is also taken into consideration by the GDPR. Regarding the last element they cite the examples of public authorities or employment (e.g. monitoring systems) as situations where there is an imbalance of power that may limit the ability to give consent freely (there are other bases for processing data). Also, I want to quickly remind HN that the GDPR applies to any data processing and goes far beyond consenting to cookies but also to, e.g., any other tracking, "selling" the email address to an advertising firm, taking a video of you, etc.
  • notechback 7y ago
    Giving you the right to get a copy of data held by Facebook & co!
• finnthehuman 7y ago
  The GDPR has made it a bit easier to see the non-surveillance dark patterns that software developers are addicted to. Consumer software that respects your wishes has become such a dying breed that I had forgotten just how deep we've fallen down the rabbit hole on everything until surveillance was pulled back out.
  • MattGaiser 7y ago
    It respects the customer wish to not pay a penny for anything.
• beastman82 7y ago
  I don't know about you but I consider this cookie consent thing to be an example of regulatory overreach and a giant pain in the butt
  • pedro_hab 7y ago
    yes, annoying as hell, I'd like to know stats on this, who cares about cookies? I sure as hell don't, my mom and aunts don't, they have a harder time using the web because of this. It makes everyone a privacy nut job, when most of us don't care.
    • belorn 7y ago
      I don't know anyone who care about cookies, but I know a lot that care about their private information not being sold and ending up causing trouble. People who are in the "elderly" demographic especially do not like when their data end up being sold to call centers focusing on calling old people (in very scummy ways), and in one case they basically had to give up answering the phone because each day they received several calls that tried to sell one type of crap after an other. A few years ago there was an article here on HN from a person who worked such call center, and they straight up describe how they bought information such as that in order to target vulnerable people. An other person I know had issues of identify thefts and are now quite concerned about their data being thrown around. Once a person has gotten burned they tend to become a bit more concerned about the potential issues of private data just floating around everywhere. But neither person care about cookies. They don't work with computers or care about web technology. The cookie existence or non-existence is completely irrelevant.
      • pedro_hab 7y ago
        I can see that but it sounds like a long shot, I do get a lot of spam and the "good ones" don't come from cookies, in my case none came from cookies. Most come from places where you give them your info, like phone number and address. If you are going to do such a broad requirement, I'd like to see info on this, how many scams are run on cookies? Is the price of adding these cookie walls worth it? To me this seems to be run on top of privacy nut jobs who don't get the real privacy threats we are facing. I am much more concerned on broad usage of facial recognition than I am of cookies of recipes my mom reads online. Now you can't exchange a service for data anymore, this is outlawed now, I don't know if thats good.
• 1f60c 7y ago
  A lot of websites seem to place cookies before you can consent to them doing so. I just loaded up the home page of The New York Times (a random example), and it had placed 23 cookies on my laptop before the "Your tracker settings" window finished loading. Now I still haven't clicked "ACCEPT", and we're up to 43.
  • epanchin 7y ago
    23 tracking cookies? Cookies have other uses.
    • 1f60c 7y ago
      My understanding has always been that no consent = no cookies of any kind. Am I wrong?
      • holtalanm 7y ago
        most of the web wouldn't function at all without cookies. my understanding is no consent = no tracking cookies. session cookies are okay. IANAL, though, so I could be incorrect.
        • yjftsjthsd-h 7y ago
          > most of the web wouldn't function at all without cookies. To be fair, though, that's pretty clearly a bug; at a minimum, any site that's just serving content should be fine with no cookies. Of course, any site that's just content should also be at least 95% functional with no JS and barely any CSS, and we all know how that worked out...
          • holtalanm 7y ago
            > To be fair, though, that's pretty clearly a bug No doubt. I was just making a statement about the current state of the web. Not applauding it in the least. :)
        • 7y ago
• brett-jackson 7y ago
  Have cookie consent pop ups made the web better? If you're concerned (or aware) about your privacy, you likely have an addon that blocks trackers enabled.
  • macinjosh 7y ago
    > Have cookie consent pop ups made the web better? Unequivocally no.
    • notechback 7y ago
      How many sites have seriously thought about reducing Google analytics and intrusive ads? If it's even 1% then the banners unequivocally HAVE made the web better.
  • alkonaut 7y ago
    > Have cookie consent pop ups made the web better? Those that are compliant have. 99% of them are still noncompliant so I think it's too soon for a ruling yet. If this law is actually enforced then websites will only have choices of 1) compliant banners/popups in which few will consent 2) finding alternative business models 3) going out of business. Right now, most sites do 4) just be noncompliant for now because 1..3 means we go out of business anyway. This is still a work in progress.
• dredmorbius 7y ago
  https://outline.com/LM8MTd https://outline.com/LM8MTd
• hammington 7y ago
  it amazes me how many hackernews readers/commenters seem to have no idea what gdpr is or what it means for them. if a site has a "gdpr popup" then that means they are doing something that the know is morally and legally questionable - not that the law is wrong ffs.
  • crusso 7y ago
    That's because for many of us outside of the EU, it doesn't mean much besides yet more email from content providers regarding changes to their privacy policies that I just delete. I wish you guys the best of luck with it, though. I would like for my country's notion of "who owns my data?" resolve more to "me". I'm torn about how much it'll cost me to own my own data, though, in a reduction of frictionless free stuff on the internet.
    • hammington 7y ago
      have you had any reduction in emails you dont want? i get a lot less since gdpr. plus i can now get my data from lots of sites as they cant be bothered to restrict non-eu people to not have the functionality. plus quite a few more sites / services have options to delete my account and data that only came about because of gdpr plus it seems like other places are considering similar laws too so then the "benifits" will be felt by even more people. oh and now you get an indicator of how crumby a company is by how hard it is to opt out of things. dunno it just seems like a lot of wins. with the main downside being that my person data abuse is regularly brought to my attention via popups etc. but that doesn't seem sustainable - i am hoping its a transitional thing and company actually just start complying.. but i guess that will take the EU laying down some serious fines to make examples - which to be fair this article seems to be a step towards. seems like many other control systems (e.g. dangerous goods shipping or hazardous chemical controls) that the governing bodies are careful in applying the law to make sure they don't just fine companies into oblivion if they are making steps in the right direction and fix anything specifically called out.
• jrochkind1 7y ago
  I am wondering when Google will get around to providing better "out of the box" support for GPDR. I should be able to get UI to let users opt out, and see/delete data, as easy as installing GA in the first place. Most of my projects are non-commercial, but they still usually have GA, GA tends to be the only thing I have that requires GPDR attention, that I'm aware of anyway.
  • hadrien01 7y ago
    I believe that simply disabling IP address collection is enough to be GDPR compliant with Google Analytics: https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#anonymizeIp https://developers.google.com/analytics/devguides/collection...
    • jrochkind1 7y ago
      Some people think so, it is not entirely clear. Perhaps it has to get more clear that it's not for Google to do anything about it though, if that's their theory. https://adzerk.com/blog/gdpr-google-analytics/ https://adzerk.com/blog/gdpr-google-analytics/
    • snowwrestler 7y ago
      The challenge with GA today is that the default code that Google gives you includes Tag Manager, and they encourage you to include DoubleClick as well (can't remember if that is in the default). If you go out of your way, you can implement GA, by itself, the "old way"--which is GDPR compliant out of the box. It's Tag Manager and DoubleClick that are not.
      • jrochkind1 7y ago
        I always find GA docs/instructions confusing, but when I try to see what current GA instructions tell you about how to include GA in a page, I get this: <!-- Global site tag (gtag.js) - Google Analytics --> <script async src="https://www.googletagmanager.com/gtag/js?id=[ID]"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', '[ID]'); </script> Is that the "old way" or the "new way"? Maybe it's an even newer way, which is essentially similar to the old way?
• kerkeslager 7y ago
  Given my browser sends out a "Do Not Track" header with every request, explicitly opting out of tracking, I'm not sure why I should ever even have to click a button to opt out. DNT is supported by Firefox, IE, Chrome, and Opera, and was supported by Safari until February 2019. The reason Apple dropped support was insufficient support and adoption by sites. The advertising industry is actively user-hostile.
  • csunbird 7y ago
    Apple actually dropped support for this, because advertisers were using this setting to fingerprint users.
    • kerkeslager 7y ago
      Geez. What's the HN advertiser spin on this? It's to help users find products they want and need, despite the fact that they explicitly say they don't want your help?
• eitland 7y ago
  Is it just me who reads this wrong or everyone else? The way I read this cookie "consent" banners are exposed as worthless so web sites should be no better off using them compared to not using them.
  • alkonaut 7y ago
    No, using banners or popups is fine. Sites just need to use compliant ones. The banner/popup has to say "Check this checkbox to continue with third party cookies, otherwise just continue without". (checkbox has to be unchecked at first) Or "Click [this button] to visit with third party cookies or [this button] to visit without" (buttons have to be the same size). But yes - in this form banners and popup present an annoyance to the user AND very few will actually consent (if they understand the question). So they will be worthless for the site owner, which is a good thing because no one likes these banners.
  • notechback 7y ago
    Most websites wouldn't need them to begin with (except to use Google analytics and ads). You can do basic user statistics without active tracking and for technical cookies the banners (nor any other form of consents) is necessary. The ad industry (Google & co) have pushed these user-hostile banners, it's not a feature of the law.
• alkonaut 7y ago
  Good. Now stop clarifying and start enforcing. Pick a few large players and make examples of them. Just demonstrate how this law can actually be applied to actual cookie wall cases. So long as any company thinks "I'll just use this dark pattern until we get complaints, everyone else is doing that and I don't want to lose ad income for no reason" the law is broken. The example has to be so clear that it is percieved as better to have the company die from lack of ad-revenue, than to put up a cookie wall. Companies should think "Ok we'll just have a discrete and compliant opt-in and hope that people will actually use it, and if this kills our business that's still better than the horror story that happened to FooCorp when they tried to pull that cookie wall stunt."
  • MattGaiser 7y ago
    Yay, let the EU slaughter what remains of the content ecosystem.
    • MiroF 7y ago
      The "content ecosystem" slaughtered the print ecosystem. If their revenue derives exclusively from invasive tracking, then "oops" they should have planned better. So it goes. No industry has a right to exist.
      • samoa42 7y ago
        > No industry has a right to exist. very well put
    • boomlinde 7y ago
      What is the content ecosystem?
    • FeepingCreature 7y ago
      This, but unironically.
• throw03172019 7y ago
  The TechCrunch website is really bad. Opening the link causes the back button to break. I need to double tap it before the redirect kicks in (hint: don’t push this to HTML5 history, please). Once you scroll down to the end of the article, it closes the article back to the list view and does a bunch of awkward scrolls just to leave me at the bottom of their list. iOS Safari
• cm2187 7y ago
  The consent should really have been implemented at the browser level. That would keep all sites honest.
• wswin 7y ago
  Cookies consent should be build in to browsers, just like all other permissions – auto play, camera, etc. This would save a lot of money and annoyance.
  • akersten 7y ago
    It already is! At least in Firefox, about:preferences#privacy, you can choose even to specifically block just tracking cookies.
• LunaSea 7y ago
  .
  • notechback 7y ago
    What's not conform? That's a language selection screen, not a cookie screen. In the banner at the top you can click "decline".
• deleted 7y ago
  [deleted]
• zilongli 7y ago
  Well meaning politicians making life more difficult for everyone.
• axegon_ 7y ago
  While the cookie initiative has a good intention, I really don't think it's actually useful. Large amounts of the population(willing to bet north of 99%) have absolutely 0 clue what cookies are in the context of the web or what they imply. Most people just click on "accept", just to get it out of their way. And I do too often enough, granted I know the site I'm on. Most people I've talked to who are not strictly technical are blown away by the realization that facebook for instance knows any site you've visited so long as it has a "like" button on it. "But wait how is this so?" is what I often get. To which I take a deep breath and say "You know what... It's magic". Truthfully people concerned about privacy either know what they are doing or use vpn's, tor and so on. The whole "consent" thing has simply turned into another annoying popup at this point.
  • JadeNB 7y ago
    > While the cookie initiative has a good intention, I really don't think it's actually useful. Large amounts of the population(willing to bet north of 99%) have absolutely 0 clue what cookies are in the context of the web or what they imply. Most people just click on "accept", just to get it out of their way. And I do too often enough, granted I know the site I'm on. But isn't that exactly an argument for why it is useful? If a site puts this big banner in your way, and you have to get rid of it to navigate, and if it seems consequence-free, then you'll do it. This is just saying that there has to be a way past the cookie-consent wall, so that the decision is no longer between "agree to this apparently without consequences" or "no content", but among "agree to this apparently without consequences" or "decline". Maybe lots of people will still choose the former, but at least you get a meaningful alternative, and that'll reduce the people allowing cookies (and, more importantly, give an option to those who do know about what they're agreeing to).
  • alkonaut 7y ago
    > Large amounts of the population(willing to bet north of 99%) have absolutely 0 clue what cookies are in the context of the web or what they imply. Most people just click on "accept", just to get it out of their way. That's exactly the reason the law exists! And that's why it has to say that the clueless option ("just clicking") should be the one preserving your privacy. It's why the law goes through such lengths to make the dumb thing the right thing: Because it's supposed to protect the privacy of people without those people even having to know what happens.
• fxtentacle 7y ago
  We need a service that'll visit the website for you, consent to all the stuff, take a screenshot and then wipe all browser data. Of course, the service would use the same browser and one static IP for all users. And then on your actual device at home, you only ever look at the screenshots. That way, it becomes technically impossible for these websites to collect data on you, no matter how much fake consent they acquire.
• dependenttypes 7y ago
  I am pretty sure that most sites assume that you have accepted and that "accept" does nothing but close the consent window.
• dirtydroog 7y ago
  To play devil's advocate... why should a publisher be forced to give away their content for free? It costs money to produce and serve content. Like it or not, advertising pays their bills.
  • anon98356 7y ago
    GDPR doesn't prevent a publisher charging for content, or displaying ads. What it says is, if you want to use personal data about a user to determine what ads to display, you have to get their explicit consent. I have noticed a few of the consent pop ups couching the choice explicitly in this manner. If you don't grant consent to us/our 3rd parties tracking you we will still show you ads, they will just be less relevant. Advertising doesn't actually require the detailed level of tracking that is used today. Physical newspapers survived with a much more limited set of data when convincing advertisers to place ads.
    • dirtydroog 7y ago
      Non-personalised ads command a far lower CPM than others. One possible outcome is that publishers have to display even more ads to make up the shortfall. That'll just annoy users even more and so they'll either stop visiting the site make ad-blocking even more prevalent. Either way, the publisher is really the one losing out.
• ineedasername 7y ago
  I am the person such sites hope for: With all of the data breaches, with all of the tracking over the years especially before GDPR, I have become numb & apathetic to the issue. I believe I'm in the majority on this (though not on HN) and most people simply click the thing that will get them to the content fastest. For this reason, I think the way to fix this is not with opt-out, but with opt-ins, where the option has a highly specified, by regulation, size, color, location and text for how it must be presented.
• encoderer 7y ago
  Will the EU please stop ruining the internet for the rest of us.
  • coldpie 7y ago
    The EU isn't ruining anything. The websites are choosing to abuse their users and ruin your experience. It's their fault this legislation exists in the first place. Aim your ire at the problem, not the fix.
    • defnotashton2 7y ago
      But it's not fixed and now all of us are here spending time talking about it and implementing it even in the end have any of us accomplished anything
• Ciantic 7y ago
  Law that dictates a dialog / consent for individual website to implement has shown already to be just a nuisance. Instead EU should make mandatory that browser vendors create standard "blocker button" clearly visible in the toolbar from which user can globally disable trackers, and perhaps preview them. This way each site does not have to do the annoying dialogs which users just mindlessly hit accept anyway.
  • notRobot 7y ago
    > Instead EU should make mandatory that browser vendors create standard "blocker button" clearly visible in the toolbar from which user can globally disable trackers, and perhaps preview them. So basically, uBlock Origin?
    • Ciantic 7y ago
      For us, the geeks and tech people, why not? But for ordinary people it could be simpler and easier to understand which had a standard icon etc. Idea would be that it replaces all dialogs in top of normal content. Maybe it could have some other standardization too, e.g. that if you have third-party trackers you must explicitely list them using <meta /> tags and browsers could make the list of trackers for the "blocker button" like that. The point being that having every website to implement their own dialogs (that just obscure the content) it has shown to become a terrible mess. None is bothered to read the dialogs, they just hit what ever buttons to get to the content.
• MattGaiser 7y ago
  I get why so many content driven websites just block EU ips. This is a compliance nightmare.
• maxwellito 7y ago
  How about we all agree to set an attribute on these popups (like *[data-legal="gdpr-cookies"]) and let people have browser plugin to hide them? Or HTTP headers to accept them straight from the initial request? Let's be honest, people don't read them they are just annoyed, devs who implement them feel bad about the experience.
• xwdv 7y ago
  As long as you return a 200 access to the site has not been denied. If you want to see additional site features you can do so by consenting to a cookie.
• Hitton 7y ago
  This will change nothing, because it's so easy to avoid it. The website won't give visitors choice to agree or gtfo, they will instead give choice to agree or pay instead (i.e. same result for 99.9 % of visitors), which is sufficient to fulfil lawful obligations.
  • forgotmylogin2 7y ago
    One can only hope that is the case. Otherwise, this ruling is basically a decree that journalists must give away their work for free.
• GiorgioG 7y ago
  This may be an unpopular view here but the GDPR has made the web experience infinitely worse. I'd like to see some stats on how many folks abandon without consenting. I'd guess the number is small, yet the majority of folks have to suffer these stupid consent popups. I'd as soon just not serve content to EU residents than have to make everyone suffer through the nonsense. That won't fly for big companies of course. Alternatively maybe make those popups only show for EU (geolocated) users.
• kgin 7y ago
  The idea that more than 5% of people have any idea what they're consenting to when they click these buttons is silly.
• jariel 7y ago
  The Cookie Consent banner is a terrible regulation, and it's just bad practice, there is absolutely no need for it, it does not make the world a better place, it makes it worse. 1st: almost nobody cares about cookies let alone knows what they are. 2cnd: people don't read the fine print. 3rd: it just creates an ugly barrier to the experience for 99% of people. We can solve this 'problem' in a much simpler way: What is needed for example is possibly a special image/token at the top of the page, like a 'seal' that indicates the 'privacy rating' and whether or not cookies are used. Like films are rated, sites can be rated. A little symbol implies that cookies are used. People can then decide to 'move on or not' but otherwise, the experience is not interrupted.
• megiddo 7y ago
  A consent wall is consent and this ruling is why I hope European regulatory bodies fall into a hole. How do you think those "free" articles are paid for? They're paid for with cookies. This is the same wall that separates me from content on paywall sites - it's just that you don't get out your credit card. Instead, you whip out your cookie jar. There is no universal "right" to view content. If the content is behind a cookie wall, you have two choices - either accept cookies or fuck off.
  • anon98356 7y ago
    No they are paid for with ads. How a website determines what ad to show is where it gets troublesome. There is no requirement to have 1000 trackers load cookies every time I go to your website in order to show me an ad.
  • colanderman 7y ago
    The best ads I've seen have been served from sites that do not target ads using cookies. I doubt that cookies are as necessary as you claim.
  • annoyingnoob 7y ago
    There is no universal "right" for websites to force cookies on me or for a website to force me to run 3rd party JS.
• thoraway1010 7y ago
  What is up with having to CONSTANTLY sign off on all these privacy policies. Why not just put control in users hands with their browser. Browse in incognito mode if you want less tracking. Block javascript, use an adblocker etc. This doesn't require that websites allow you to do this, just do it, delete your own cookies. Am I missing something. The CONSTANT popups on websites that serve EU visitors is SO SO annoying. If this is meant to have people think big govt is competent and helpful... not sure it's working.
• aerovistae 7y ago
  I have a Chrome extension called "No more cookies" I think, that just eliminates those walls completely. Best install I've made the past year.
• microcolonel 7y ago
  The more effective policy would be to regulate circumvention of tracking protection filters. Browsers could improve their UIs for default cookie/storage filtering, but it's still a much more effective way to do this.
• yllus 7y ago
  Is this a fair summary, then: A site with free-to-read content must by default load no tracking scripts/cookies - aside from those that do so in anonymized aggregate form - unless the website visitor positively confirm they're okay with being tracked individually? That's how I'm reading it. Basically they want to change the default behaviour of websites to collecting aggregate user analytics only. I suspect that a number of organizations that post free content and justify some/all of that expense with the marketing data they collect are going to look at changing that practice. More paywalls that require free user registration are the obvious next step. I wonder if that's not a step backwards for the Web.
• jpswade 7y ago
  I'm still not convinced about this law. While I think the intention behind it is noble, in many cases, it does not apply while in others it's simply unenforceable. Here's some examples: - http://www.lingscars.com/images/pdf/icoletter.pdf http://www.lingscars.com/images/pdf/icoletter.pdf - https://nocookielaw.com/ https://nocookielaw.com/
  • icelancer 7y ago
    Yeah it's complete bullshit. We're not serving notifications on our sites.
• peterhil 7y ago
  I think the whole cookie consent thing of GDPR went backwards, and instead of individual web services being required to show what they track, the browser makers should have been requireed to make it much easier to manage user cookies, and warn about users about tracking cookies, and offer a way to remove, clean up and otherwise empower users to take care of their privacy.
• danimal88 7y ago
  Has there been any sort of research done on whether these changes have actually done anything consequential and positive?
  • forgotmylogin2 7y ago
    I don't even live in Europe and these policies have still caused significant harm to me. I can only imagine it's even worse for people accessing the web from Europe.
• elric 7y ago
  Tangent: I wish the idiom of "placing" cookies would go away. Websites don't "place" cookies. Websites can include cookies in their HTTP responses. Your browser can include them in future requests. But it doesn't have to. There is nothing in the HTTP spec that says you have to accept cookies or include them in subsequent requests. There certainly isn't any reason to "place" them on your computer. If more browsers were still User Agents in the literal sense, maybe we wouldn't have needed this legislation. Browsers could have informed people about what cookies were, and could have presented the user with the option to never accept tracking cookies from Big Advertising. Every browser has the option to reject third party cookies or to clear all cookies at the end of the browser session. This mischaracterization of cookies has, ironically, made life a lot less pleasant for people who don't accept cookies. The "opt-out" is just another cookie. There's nothing special about them either, they can be used to track return visitors just as well as any other cookie. I'm sure they're not, because that would be against the spirit of the law ... Not tracking people without consent is definitely a Good Thing, but it shouldn't require everyone and their grandmother to put annoying cookie banners on every website under the sun. And I think it wouldn't have, had people been better informed.
  • dcow 7y ago
    Cookie banners have taken the internet back 20 years. Now every website has a mandatory popup. And you can’t block these new breed because they're part of the site.
    • notechback 7y ago
      They are not mandatory, it's a choice by the site owner to include them. They are only mandatory if you include tracking features that track users across the web (= ads and Google analytics).
      • mfontani 7y ago
        One can include ads and analytics without consent being granted - they're "just" restricted to a method of delivering ads and performing analytics which don't track the user. IANAL, mind you - but that's how we implemented it - you're opting-in to the ads that target you and analytics which track you, or you get the non-tracking/non-targeting ads and analytics.
• FailMore 7y ago
  Can someone explain/give examples of what a "good" website does in this case? For example, is StackOverflow doing the right thing (try in incognito mode)?
• oftenwrong 7y ago
  Perhaps it would be more appropriate for the EDPB to centrally track consent. For example: If example.com wishes to use Alice's private information in a way that is protected under GDPR, they would request consent from Alice via an EDPB-managed service. To opt-in, Alice would use the EDPB-managed service to accept the request. This way, the EDPB would have full control over how such requests are presented to a person, and would have an auditable record of all requests issued/declined/accepted.
• matheusmoreira 7y ago
  > You can’t make access to your website’s content dependent on a visitor agreeing that you can process their data Finally! Sites that require payment for their content need to return HTTP 402 Payment Required. Sites that make users pay with data should be fined with extreme prejudice. "Continuing to use the website" isn't consent either. Why do these companies insist on being deliberately obtuse? They know exactly what they need to do but they would rather ask lawyers about how they can get away with not doing it. How hard is it to avoid surveiling people?
  • Tade0 7y ago
    I guess it's not about what's hard, but what's more profitable. Companies are not people - any ethics they have are only there because otherwise it would be bad for business.
• cool-RR 7y ago
  What we need is a community-powered Chrome extension that can identify cookie warnings on different sites and disable them.
  • hombre_fatal 7y ago
    Extensions like uBlock already use community-updated filter lists like EasyList. I would be very perplexed if none existed that removed cookie warnings. Edit: If you open uBlock's options and go to the Filter Lists tab, you can see that https://kb.adguard.com/en/general/adguard-ad-filters#annoyances https://kb.adguard.com/en/general/adguard-ad-filters#annoyan... and Fanboy's Annoyances List are two that block some privacy popups, but you'd probably need to enable them. There are actually quite a lot of lists on that page (click the "+" marks to expand the unchecked lists) that are opt-in rather than on by default, so it's worthwhile to give them a whirl and see if any block cookie popups. Easylist Cookie is another one I found in uBlock filter list that specifically nukes cookie popups: https://easylist-downloads.adblockplus.org/easylist-cookie.txt https://easylist-downloads.adblockplus.org/easylist-cookie.t... (disable by default as well).
• syncsynchalt 7y ago
  Why haven't any of the browser makers made cookie consent a browser-side feature? Sites could detect the browser feature, skip displaying the pop-up, and users could have a consistent UI experience for cookie consent. Is this forbidden by the specifics of the legislation?
  • city41 7y ago
    I've wondered the same thing. The amount of annoyance, tedium and drop in people's focus and flow clicking these things over and over and over again has to really add up.
• sparkling 7y ago
  Anyone who is operating a website within EU juristication is either insane or masochistic. Cookie laws, privacy laws, arbitration laws, 5-digit copyright lawsuits over the use of a single unlicensed image, 5-digit lawsuits for a tiny mistake in the imprint. No thank you, happy to exclude all of EU to not deal with this nonsense.
• brabel 7y ago
  There is no solution to the insanity the web has become other than an alternative web. Want a place you can go to find interesting websites, chat, share knowledge... all that the web was supposed to allow, but without being constantly tracked and bombarded with ads? Try Gemini: https://gemini.circumlunar.space https://gemini.circumlunar.space Gemini is an extremely simplified version of HTTP and HTML, in essence. It is safe by default: the only way to allow user "sign in" is by using mutual TLS. with mutual TLS, YOU control whether the server talking to you should know who you are... and they can't know anything you don't tell them. And you can simply stop using your TLS client certificate if you don't feel like telling the server who you are anymore. This is what security looks like. Not what the mess of the web is right now. It's time to reboot the internet.
  • asdff 7y ago
    I find an aggressive ad blocker solves most issues with the modern web. Haven't seen an advertisement in years. Any facet of any website can be selectively blocked. You can pare anything down to plaintext if you really want.
• annoyingnoob 7y ago
  Can we get the same protections from 3rd party JS?
• cactus2093 7y ago
  The EU cookie legislation is still mind blowing to me. In terms of widely used protocols with terrible designs it's up there with US payment card processing (want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4 years, and hope they don't misuse it). Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn't they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they've approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting).
  • Nasrudith 7y ago
    To be frank I suspect that the answer is because that isn't their goal any more than a congressional fact finding session is to find facts - but to grandstand angrily about sour grapes.
    • droopyEyelids 7y ago
      Or it might have happened in the other direction, where there was an earnest goal, but opponents to that goal slipped a poison pill in
  • _pmf_ 7y ago
    There is no "cookie law". Nothing in the law has to do anything specifically with cookies.
    • ratww 7y ago
      This is correct in GDPR. This is why you can’t use something like LocalStorage, ETags or something else as a loophole.
• asdff 7y ago
  What happens legally when I don't consent to cookies, and just zap the cookie wall with my adblocker and proceed to the content?
• shinryuu 7y ago
  Am I the only one who finds it ironic being faced with a cookie consent wall while visiting the website?
• knorker 7y ago
  When will the EU just accept that this is a browser setting, not a mandate on websites? It's been a browser setting since the '90s. And what do they mean the user has "no choice"? What… don't they have a choice about? They have as much choice as I have in a store. I have the choice of paying for the thing and getting it, or not paying and not getting it. Why is it mandated that the "get the thing without paying for it" MUST be a choice?
• tathougies 7y ago
  The EU has made things worse for the entire world. I hate the cookie bars. They're annoying and I don't care that my browser is storing a Cookie header in a database. If i didn't like that, I can turn it off.
  • swongel 7y ago
    I hate it when companies want to track me and put a pop-up on their first page to ask my permission to do so. I don't care about cookies being placed on my system by my browser and that in and of itself isn't illegal under GDPR, I just don't want to consent to being tracked by corporations for profit or be tracked for profit without my consent. If companies choose to comply with EU law because they want to do business in the EU that's up to them, they don't have to.
• moomin 7y ago
  Of course, I didn’t read the article, because it’s behind a phenomenal Yahoo consent wall.
• neilwilson 7y ago
  Would it have been too difficult to pass legislation that requires opt out as the default and require people to opt-in?
• Pxtl 7y ago
  I am waiting on the edge of my seat for somebody to come up with a way to kill tracking cookies once and for all just so the EU will be able to drop this stupid bill. Honestly, the more things go on, the more I think the very fact that websites allow fetching resources from 3rd parties is a misfeature. If I go to example.com, my relationship is with example.com. This would eliminate cross-site-scripting attacks, tracking cookies, tracking images, etc. On the other hand, it would also kill CDNs. Single sign-on would have to be explicit instead of implicit. I'm not 100% sure those would be bad things.
  • hammington 7y ago
    couldnt the CDN issue be fixed by just having a little closer relationship with the CDN? - i am no expert but maybe with a dns record or similar. that way it is another host you are pulling from but within the same domain or something maybe? I don't know, overall i just wanted to say that i totally agree that it doesn't seem like a good feature you go to site X and your browser loads data and makes connections to wherever based on site x's instruction.
• butz 7y ago
  If anyone else is interested, the direct link to guidelines mentioned in article is here: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...
• throwawaysea 7y ago
  I am so sick of clicking "Accept" blindly on all these websites. The existing consent legislation makes no sense and it is making the Internet worse for everyone worldwide.
• solinent 7y ago
  These days I just inspect the page and if I can delete the overlay and find the overflow:hidden then I'm done! No accepting or scrolling required. It takes me 20 seconds to do this now typically.
• Nursie 7y ago
  You don't need a banner or a dialogue. You just need to stop tracking people. If you don't engage in tracking - congrats, you get to have a website without this shit. Stop complaining that the GDPE has broken the web and start realising that every site with a dialogue up os sharing your every move with anyone that will pay.
• zzo38computer 7y ago
  I agree they shouldn't have "cookie consent walls", although the user can be assumed to consent if the user has enabled cookies in their browser (no scrolling or notices or whatever should be required). The user can also disable cookies if they do not want it, and viewing documents still should work. If it uses cookies for multiple things, it may be a good idea to document what each cookie does, in case the user wants to enable only some of them, or delete only some of them.
• gtm1260 7y ago
  Am I the only one that seriously feels like the UX implications of GDPR should have been more seriously considered? Did the creators of the law consider how they were making the web like 5% more annoying to use? I just wish this stuff was thought through in a more holistic way, right now what we have is just an extra click through on every website, and no real sense that it is helping privacy since most users just click 'ok' to get to their website anyways.
• acd 7y ago
  Can we also please do something to put an end to End user license agreements? It used to be that in the late 1800s that for example an electricity contract would be a simple one page A4 page which everyone could understand and you signed. Now its pages up and down of legal content, that you almost need an PhD in law to understand. Many sign without even reading our understanding the contract. I would call for the simple end user agreement act or put an end to the practice as a whole and just fall back on national/eu law. Why the contract signing is asymmetrical power and you cannot alter the outcome either than simply opting out of the product. Further you do tell if it was a person who signed the EULA or the persons cat. Who did the consent?
• itsajoke 7y ago
  I know these consent warnings are generally considered an annoyance, as well as dangerous due to consent fatigue. Not to mention the little hacks I've seen POCs of where clicking the consent button allows for lots of nasty things since it works around the browser's autoloading javascript restriction since the user has to interact with the page. But I personally love these warnings and consent messages. I wish there were more of them! I wish there was a consent message before any kind of cross-origin action was allowed. Can you imagine how many there would be on any sites that use ad networks?
• deleted 7y ago
  [deleted]
• jimbob45 7y ago
  Surely this all ends in a cap on advertising spending. Advertising contributes no real output to a country and ties up its best minds in anti-citizen activity. I know you can't blanket ban advertising because that would be unenforceable (and some advertising is good) but a partial ban cannot be controversial anymore.
• collyw 7y ago
  Does anyone not accept cookies when they visit a website? If not why not? I often clear mine out or use private mode to get around "you have read your maximum 5 articles please subscribe now". What are genuine reasons for not wanting to visit a website with cookies?
  • ninkendo 7y ago
    Usually when I'm visiting a website, it's one of many sites/articles/search results I could be looking at. If a site tells me something like: - Sign up for a newsletter! - Please turn off your adblocker! - Please accept our use of cookies to continue - Pardon the interruption... I close the tab and try the next search result/article/whatever I want to see. Websites don't exist in a vacuum. Nearly always, they have to compete for my attention with other possible uses of my time. I'm going to pick the one that wastes my time the least.
    • collyw 7y ago
      I am the same with most of those. Medium being a particular pain in the butt. But almost every website uses cookies, I don't see them being such a problem.
      • ninkendo 7y ago
        Yeah, I guess it's not that I don't want to accept cookies, it's that I don't want to reject them either (I'd rather close the tab than do either one.) This sounds like GDPR is a bad thing for people like me, but I view it as a long game: as sites see increased bounce rates due to cookie popups, maybe it'll change the equation in favor of not having tracking cookies in the first place. I feel like I'm doing my part to help create that future every time I close the tab when getting nagged about cookies. (And GDPR doesn't require dialogs about all cookies, you're allowed to use cookies to have sessions/logons without nagging.)
• rikroots 7y ago
  For what it's worth, this was my take on the GDPR requirements for site cookies. I had to consider them when recoding my poetry website last year (mainly for Facebook and Twitter sharing buttons) https://blog.rikworks.co.uk/2020/02/05/The-RikVerse-rebuild-Fun-with-Cookies/ https://blog.rikworks.co.uk/2020/02/05/The-RikVerse-rebuild-... ... and this is how the cookie consents page looks on the site: http://rikverse2020.rikweb.org.uk/cookies http://rikverse2020.rikweb.org.uk/cookies It's not a difficult task to comply with the GDPR requirements in a nice way.
• gcatalfamo 7y ago
  Funny thing this very page had a cookie wall welcoming me.
• deleted 7y ago
  [deleted]
• KorematsuFred 7y ago
  While surfing internet from India I am really upset with all those 1990s styled banners with only "accept" button. I wish there was some browser extension that would automatically hide these manners and make them completely irrelevant.
• deleted 7y ago
  [deleted]
• severak_cz 7y ago
  I see massive irony in fact that article about consent wall is hidden behind one of them... :-) Your data, your experience TechCrunch is part of Verizon Media. Click 'I agree' to allow Verizon Media and our partners to use cookies and similar technologies to access your device and use your data (including location) to understand your interests, and provide and measure personalised ads.
• hootbootscoot 7y ago
  ironic. I can't read this article without consenting to everything...
• Vanayad 7y ago
  Accessing this site, requires a consent. :)))
• deleted 7y ago
  [deleted]
• paulie_a 7y ago
  Cookie consent needs to fuck off for the vast majority of the internet. If you are in the eu or you do business there it probably applies. Everywhere it doesn't.
• superkuh 7y ago
  I'm glad I don't like in the EU. I don't allow cookies to function in my personal browser and I don't use them on any of the websites that I make or maintain. But when someone goes to a website they're not forced to use cookies and they don't have to go to the website. A law like GDPR brings in the government's use of force to situations where there is no force, fraud, or anyone being hurt. It's massively worse than the problem it solves.
• austincheney 7y ago
  Continued use of cookies is evidence of just how incompetent web development practices are. Cookies allow storage of 4kb data in a file per single origin policy domain. They are slow to access and require an archaic API. At one point this made sense because it’s all we had. Local storage features an amazingly primitive API, stores 5mb per domain, and is dramatically faster to access. Local storage is achieved universal support since IE8. From a storage perspective localStorage is a complete and superior replacement for cookies. The only remaining difference is that cookies are artifacts separate from the browser. They can be sent in a an HTTP response without either a unique HTTP request and without appending that data to another artifact, such as hidden text in an HTML file. localStorage does not have that as it is meant to be local and thus would require JavaScript to write data from an HTTP response into storage. One extra step. In practical terms all that means is that cookies can be written by a server application by developers who lack basic understanding of browser technologies. In software we call this kind of incompetence ”accepted practice”, but other industries call it negligence. I suspect if end users sued individual developers by name every time they were harmed or violated by bad software there would be less negligence in the world.
  • johnchristopher 7y ago
    I don't think it matters if data is stored in cookies or local storage in the context of opt in and GDPR though.
    • austincheney 7y ago
      That may be true, but my comment is about any use of cookies regardless of the data they contain. It’s fully achieved technological obsolescence.
  • STRML 7y ago
    It is not that simple. Cookies can have attributes such as "HTTPOnly" (don't allow access from JavaScript), "Secure" (only send on TLS-enabled sites), and expiry. While it may seem possible to replicate some of these with JavaScript, there are a few problems: 1. Not everybody has JS enabled (your content site shouldn't require it) 2. If using localStorage, users can write their own data. Depending on how you store data, this ranges from "not a problem at all" to "serious attack vector". At the least, it increases risk if an attacker gets XSS. 3. Data stored in localStorage can't be transmitted upon page load, it has to be transmitted after the initial load, once scripts have executed. For some things, this is fine, for e.g. auth, this is pretty bad. They are different technologies: localStorage & sessionStorage are not a full replacement for cookies. That said, tracking is rampant across the web and with it, cookies. Getting rid of them would make some of this harder - but not at all impossible - while breaking other legitimate flows.
• dontTellMyB0ss 7y ago
  Cookie Law is a great example of why government shouldn't be allowed to stick its fingers into voluntary interactions. Good intentions by dumb people do more damage than good.
• sfifs 7y ago
  This is a foolish own goal. Publishers will simply implement a login based wall - possibly with federated logins of Google and FB with consent in the sign up giving even more accurate personally identifiable information. Cookies are at least anonymizable
• Kronmonker 7y ago
  As soon as I open the page I'm blocked by a cookie consent wall with no easy option to opt out
• Rounin 7y ago
  You realize the linked article IS a cookie consent wall, right?
• red_admiral 7y ago
  > You can’t make access to your website’s content dependent on a visitor agreeing that you can process their data — aka a ‘consent cookie wall’. Not if you need to be compliant with European data protection law. Brought to you by TC, a site with a cookie consent wall (at least here in the UK).
• arendtio 7y ago
  I wish the prosecution of breaking the GDPR would be quicker. There are so many sites out there that obviously do not comply with the spirit of the GDPR. The GDPR is very clear, that it should be the users choice if he wants to be tracked (freely given, so without any other negative consequences). But many pages out there are trying to trick people into accepting their cookies by accident (playing with buttons (size, color, arrangement, etc.)). Those Paywalls are just the tip of the iceberg. And for those companies who comply with the law, it is just a competitive disadvantage. Sometimes I am more drawn to accepting some page's cookies, just because they implemented the consent layer in a compliant way.