10 ms·

Oh, but you can opt out. You first need to click the other button. Then again. Then you get the list of hundreds of “partners”, for each of which you have to ma

• mcv 6y ago
  At some point I just stopped reading sites that make it too hard to opt out. Though I would really like to have a browser that automatically opens links to such sites in incognito mode, accepts the popup for me, and makes sure everything is thoroughly deleted afterward.
  • dangerlibrary 6y ago
    firefox focus does ... some of this?
  • StavrosK 6y ago
    I would like an extension that replaces the page with "It's not worth it" so I know not to even try to opt out and just leave.
    • SkySkimmer 6y ago
      If you block the domain in umatrix it basically does that. For instance techcrunch redirects me to some "guce.advertising.com" url and umatrix blocks it https://imgur.com/bxGAbiH https://imgur.com/bxGAbiH
      • StavrosK 6y ago
        I'll look into doing that with uBlock/Privacy Badger, thanks!
  • mszcz 6y ago
    Oh, that's too much work. I've been using Cookie AutoDelete for Firefox and I've set it to clear all non-whitelisted cookies a couple of hours after last visit. This way I have to click once if I visit a couple of times a day.
  • BaitBlock 6y ago
    The chrome and firefox extension I made: https://baitblock.app https://baitblock.app has a feature called tracking resistance. It deletes cookies on websites that you are not logged into automatically
    • mcv 6y ago
      That sounds perfect. Login is the only legitimate use case for persistent cookies that I can think of.
      • kerkeslager 6y ago
        Logins are a common enough use case that browsers should simply support it directly, and drop support for cookies entirely. There's no reason we can't have sites set an auth token, and send that in under the Authorization header. And then when you want to sign out of a website, you can have a button for that in the browser. The tooling already exists in the HTTP standard, it's just that it's only widely used for server-server communication.
        • antsar 6y ago
          Wouldn't advertisers just use the auth token as a cookie then?
          • developer2 6y ago
            Bingo. "Auth Token" simply becomes "Session ID", and the backend then tracks anything it wants as part of the session. I don't see much of a solution other than making it a matter of policy, eg. Microsoft's "P3P" header. Otherwise authentication credentials need to be supplied with every request. Not a session id or token as a cookie, but the actual username and password being supplied with every request. Basically the old http basic auth, but with a more modern system to replace it. I understand the core idea behind the EU's desire, but the fact is that cookies are absolutely required for login sessions, and it's impossible to allow users to opt out. The EU doesn't understand the tech behind the laws they are trying to enforce, and this is where it leads to. Absurdity.
  • laumars 6y ago
    Firefox containers can be used that way. There’s a plug-in (on phone and I forget the name) which opens each new tab as a new container. It’s bliss.
    • Vinnl 6y ago
      https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con... Though you'll need an additional extension to auto-accept.
      • laumars 6y ago
        That’s the one. Thank you
  • MaxBarraclough 6y ago
    Personally I just use a Private Browsing window. Plant all the cookies you like, they'll last about 3 minutes.
  • peterhil 6y ago
    I use Vanilla Cookie for Chrome (it deletes all non-whitelisted cookies after some time or after closing the browser), and have been thinking about making a browser extension that just hides all fixed elements and transparent full size elements. The reason for me thinking this, is that nowadays I just accept almost everything, and trust the Valinna cookie to clean up afterwards. What do you think about this?
    • 0x38B 6y ago
      The first bookmark on my bookmark bar is "Kill floater", and it removes most floating elements on the page. It even works on many sites that hide the page behind a popup. Use it on my iPad all the time. The bookmarklet: javascript:(function()%7B(function%20()%20%7Bvar%20i%2C%20elements%20%3D%20document.querySelectorAll('body%20*')%3Bfor%20(i%20%3D%200%3B%20i%20%3C%20elements.length%3B%20i%2B%2B)%20%7Bif%20(getComputedStyle(elements%5Bi%5D).position%20%3D%3D%3D%20'fixed')%20%7Belements%5Bi%5D.parentNode.removeChild(elements%5Bi%5D)%3B%7D%7D%7D)()%7D)()
      • peterhil 6y ago
        Thanks! This will save me a lot of time.
      • ryanwaggoner 6y ago
        Do you mind prepending the bookmarklet code with two spaces as described here: https://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc It's breaking the layout of this entire comment thread for me so I have to scroll horizontally to read all of the comments. Thanks!
        • dang 6y ago
          I've added two spaces there.
      • peterhil 6y ago
        I cleaned up and improved this a little. Now it hides the fixed elements, unless their computed top is at 0px. Also makes the body to scroll automatically, as many sites set their body to fixed before the fixed popup is gone: ``` javascript:(function () { var i, elements = document.querySelectorAll('body *'); var style; document.body.style.overflow-y = 'auto' for (i = 0; i < elements.length; i++) { style = getComputedStyle(elements[i]); if (style.position === 'fixed' && style.top !== "0px") { elements[i].style.display = 'none'; } } })() ```
• funcDropShadow 6y ago
  According to GDPR the defaults has to be "no consent".
  • zepto 6y ago
    How is ‘default’ defined? Does just highlighting the ‘no consent button’ after a massive set of options count?
    • munchbunny 6y ago
      It will likely be up to the courts to interpret around the edges, such as "can the modal have everything turned on by default?" That said, at a baseline it means that if you didn't click a "consent" button or some equivalent action, they can't assume they have your consent.
    • pbhjpbhj 6y ago
      I was on a mainstream site yesterday (can't recall now which) it had a cookie dialog with no options checked, and a "accept and go to site" button, so I assumed it meant "accept the above settings". Nope, it fills in all the unchecked options, then "accepts" those settings and goes to the site. It was so incredibly devious I was almost impressed as I immediately closed the tab.
    • lmkg 6y ago
      The part of GDPR that covers this in depth is Recital 32. https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/ There's a lot of detail, but the most important part is this: "...inactivity should not therefore constitute consent." While I'm not sure there's an EU-wide ruling, the Greek DPA has specifically called out the "Consent" option being more visually prominent than the "Not Consent" option. They also mention the anti-pattern of bugging for consent daily but not bugging for un-consent afterwards, but that probably runs more afoul of "consent must be as easy to withdraw as to give" rather than "freely given."
    • PeterisP 6y ago
      The key part is that it's defined based on the intent and outcome. The company has to demonstrate that each user made an intentional, fully informed, freely given opt-in choice - that they knew what they agreed to and wanted to agree. If users did not intentionally want to opt in to you doing X with their data, then you don't have a valid legal basis for processing no matter what they clicked, since whatever system you built apparently did not truly capture what the user wanted. If a site wants to use data in ways that need consent (by the way, most reasonable uses don't need consent because 'legitimate need' applies - it's pretty much only things like "use all your private data for targeted advertising" and "share your private data with these 1000 trusted partners" that need consent) then it's the burden of the site to ensure that the options are presented in a clear, nonconfusing way, that users get fully informed, etc, and demonstrate to the data protection agency that whatever they implemented achieves these goals. "Just highlighting the ‘no consent button’ after a massive set of options" most likely is not effective to that goal, and a data protection agency can easily verify that (run a study with 10 new users signing up for the site and fill out a questionairre of what they wanted to consent) so it should invite administrative action from the DPAs, with mandates to change the system and/or fines depending on the circumstances. It's just that they're not really bothering with random websites (yet?) since the majority of their work is on how the all the EU non-web businesses (e.g. retailer loyalty programs, phone providers, banks, etc) handle private data.
• rapnie 6y ago
  Exactly. These dark patterns tell me more about the corp behind a site than any regular well-designed cookie popup could. One quick look on these, and I navigate away. Haven't visited TC for a long time.. just not worth it.
  • ce4 6y ago
    They also redirect you from TC to guce_advertising_com/collectIdentifiers... If you have uMatrix installed you need to add bypass lists for that... I won't.
  • rapnie 6y ago
    Another dark pattern you see more often these days are sites having a - seemingly very good - "Reject all" choice. But when you click/tap that both "Reject all" and the default "Accept all" are now highlighted, making the result of pressing "Continue" unclear.
    • Leherenn 6y ago
      Another one is taking a looong time to "save your choice". In the order of a couple minutes. I assume they hope you just click agree instead.
• crankylinuxuser 6y ago
  Eh in FF I just click reader view. It bypasses pretty much every popwall and popover. And if it doesn't, I leave.
  • kungato 6y ago
    But does it mean you opted out? To me it sounds like you entered undefined behavior territory and probably accepted everything
    • crankylinuxuser 6y ago
      I live in the USA, the country of caveat emptor and 'who cares about citizens, anyway?'. If I was a European citizen, then I believe by default I did not allow anything. They would be in abeyance of the GDPR if they were to track or identify me. If I can jam up even a bit of tracking with a PiHole, ublock origin, privacy badger, Bypass Paywalls Clean, Containers, and more, good on me. Im already inexorably tied to google at the moment, and working to remove myself from their ties.
    • deleted 6y ago
      [deleted]
    • gpm 6y ago
      GDPR is opt in not out. If they're tracking you when you do that they're breaking the law. Also, they're probably breaking the law.
    • levosmetalo 6y ago
      Consent needs to be explicit or there's no consent. Otherwise, we'd be back in the days of putting a message on the site telling "by using our website you accept our ToS and need to give use your firstborn child".
• fxtentacle 6y ago
  What if there was a service that would automatically email their legal team to withdraw your consent after you close the tab? Like every single time you just click OK and then afterwards they'll have to manually adhere to your request and delete the data again. That would make bad consent UI incredibly expensive :)
  • fludlight 6y ago
    They’d shut down the email account ;-) A better solution is websites actually accepting the “do not track” requests that browsers already send. Unfortunately the most popular web browser is run by the most popular tracking company, who also almost wholly funds the second most popular browser.
    • elcomet 6y ago
      Also, websites have no incentives to implement such a feature if it's not required by law. It costs money and gives them nothing in return
      • ViViDboarder 6y ago
        Well, GDPR and CCPA compliance cost something. That could be made simpler using this option. Also, Ad Blockers are becoming quite prevalent again. Personally, I’ve started using one again for privacy reasons. If a publisher would actually respect my Do Not Track request, I’d happily leave their ads up. I have no problem with contextual advertising. So that’s revenue left on the table.
        • nicbou 6y ago
          It would not be easier. It has to be implemented in addition to the consent form. I have a website. If I wanted to support DNT, I'd have to take an hour or two to figure it out. To be honest, it wasn't even on my radar.
      • close04 6y ago
        The solution is to send a message by avoiding those sites thus creating a disincentive for them to maintain the practices. But as you can see from the number of upvotes even very technically literate people will get over this just for an interesting title. Techcrunch routinely ends up on the front page on HN, ironically many times for articles that condemn the very practices they engage in. No website will change their practices because of strong, informed opinions when the clicks still come in, especially from a distinguished community like HN that just validates Techcrunch's choices.
• LeonM 6y ago
  Don't forget the fake progress spinner that takes ~30 seconds to complete if you opt-out, but is instant of you just agree.
• stiray 6y ago
  The consent is invalid if it is harder to reject consent than give it. Another thing, the consent must be opt in. What they are offering is opt out. I will post recitals, when I get home, searching on phone is annoying. Anyway, I boycott TC since they started their war on users.
  • stiray 6y ago
    Ok, back at my keyboard <3 Prequel, website owners, android developers,... PLEASE, please, check this video. You will more or less understand everything you need to know about GDPR. GDPR event London 2017 - with Tim Walters: https://www.youtube.com/watch?v=-stjktAu-7k https://www.youtube.com/watch?v=-stjktAu-7k I think that someone is earning large bucks to trick different websites into believing that they can avoid GDPR by simple tricks while on the other side owners are just too lazy to read simple interpretations made by Article 29 Data Protection Working Party (no, it does not matter what your lawyer thinks if it contradicts recitals). I would call it a scam but I think that some enlightment must be pushed in place: https://ec.europa.eu/newsroom/just/document.cfm?doc_id=48849 https://ec.europa.eu/newsroom/just/document.cfm?doc_id=48849 (page 16): "Without prejudice to existing (national) contract law, consent can be obtained through a recorded oral statement, although due note must be taken of the information available to the data subject, prior to the indication of consent. The use of pre-ticked opt-in boxes is invalid under the GDPR. Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice." (page 21): "Article 7(3) of the GDPR prescribes that the controller must ensure that consent can be withdrawn by the data subject as easy as giving consent and at any given time. The GDPR does not say that giving and withdrawing consent must always be done through the same action. However, when consent is obtained via electronic means through only one mouse-click, swipe, or keystroke, data subjects must, in practice, be able to withdraw that consent equally as easily."
    • ferzul 6y ago
      is this “equally easy” criterion met by a site that says “hi! we don't know each other yet, but you can't procede until you've either pressed the 'accept' button or found the 'manage options' link, worked evert oh good you're bored now thanks for clicking” and then never shows it again, so i don't really know where i would go to manage consent. i don't see why companies can't just behave like decent human beings. why do they want me to not trust them?
• floatrock 6y ago
  I'd love to see a blog post enumerating all the dark pattern design in all the GDPR and CCPA cookie opt-out. It could be a case study in user-hostile design. First you see the warning banner that has the large prominent "CONTINUE (i consent)" CTA button with a tiny "options" link somewhere below. If you catch that "options" is code for "I don't want to consent", you're then brought to a wall of legalize that you need to scroll to the bottom to find the double-negative-ambiguous-toggle labelled "Do not sell my privacy data". So you need to enable it to disable tracking. I think. But even so, it's a toggle UI instead of a checkbox, so you're not quite sure what state means what. There's one particular provider of these consent forms out there that a lot of sites use... I'm sure their marketing materials say "our world-class designers have identified the best and most clear user-design principles, which we have inverted to minimize your opt-out conversion rate!"