14 ms·

The EU cookie legislation is still mind blowing to me. In terms of widely used protocols with terrible designs it's up there with US payment card processing (wa

by cactus2093 6y ago

The EU cookie legislation is still mind blowing to me. In terms of widely used protocols with terrible designs it's up there with US payment card processing (want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4 years, and hope they don't misuse it). Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn't they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they've approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting).

Nasrudith 6y ago
To be frank I suspect that the answer is because that isn't their goal any more than a congressional fact finding session is to find facts - but to grandstand angrily about sour grapes.
- droopyEyelids 6y ago
  Or it might have happened in the other direction, where there was an earnest goal, but opponents to that goal slipped a poison pill in
_pmf_ 6y ago
There is no "cookie law". Nothing in the law has to do anything specifically with cookies.
- ratww 6y ago
  This is correct in GDPR. This is why you can’t use something like LocalStorage, ETags or something else as a loophole.
  - deleted 6y ago
    [deleted]
  - allover 6y ago
    This is not correct, in the UK at least. Similar technologies like LocalStorage fall under cookie law. [1] [1] https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
    - allover 6y ago
      Parent edited their comment from "can" to "can't", and I got downvoted, yikes.
  - Nursie 6y ago
    No, you can't, because the law concerns itself with data storage and processing, not whether you are using a cookie.
    - ratww 6y ago
      Ah that was a brain fart moment, sorry. I meant to say you cannot use, GDPR is something I handle daily. Thanks for correcting, I amended the answer.
- allover 6y ago
  There absolutely is a cookie law. The UK legislation is "PECR" [1] which sits alongside the GDPR. > PECR are the Privacy and Electronic Communications Regulations. Their full title is The Privacy and Electronic Communications (EC Directive) Regulations 2003. > They are derived from European law. They implement European Directive 2002/58/EC, also known as ‘the e-privacy Directive’. > PECR cover several areas: > The use of cookies or similar technologies that track information about people accessing a website or other electronic service. See "How does this fit with the GDPR?" for how the two relate, tl;dr: > The GDPR does not replace PECR, although it changes the underlying definition of consent. Existing PECR rules continue to apply, but using the new GDPR standard of consent. [1] https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...
filleduchaos 6y ago
> want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4 years, and hope they don't misuse it I don't understand this at all, and I always feel so nervous using my card at US retailers for this reason (these days I try to stick to PayPal where possible). Where I'm from, _all_ one-off online card transactions are 2FA'd between you and your bank; it was strange to say the least the first time I paid for something on Amazon and the transaction just...went through.
- Erlich_Bachman 6y ago
  Look up what a "chargeback" is. That's the mechanism (and which has been working well enough in practice to keep the system going, and everyone is happy (except for some merchants of course)) that is preventing the dangers you are thinking about from occuring too often to unsuspecting card holders.
  - AnthonyMouse 6y ago
    Then it brings with it a whole list of different problems, like being incredibly susceptible to buyer fraud, the cost of which everybody then has to eat. Meanwhile it causes the payment processors to not want to do business with merchants who get a large number of chargebacks, even if the problem isn't with the merchants but with their customers. In other words, it discriminates against merchants who do business with disadvantaged clientele who are more likely to have payment issues.
    - salawat 6y ago
      A merchant getting excessive numbers of chargebacks is not in and of itself an issue if you have all your ducks in a row. I mean it's an interesting enough heuristic, but can you provide an example of a processor that would refuse to business with someone because they had excessive chargeback, but also had the information in place to prove the purchases in question? I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in. I don't have much firsthand experience in it though, so I'd be thrilled if you could share some insight on it.
anoncake 6y ago
Believing that there is such a thing as an "EU cookie legislation" is a clear sign that you don't know what you are talking about. You seriously want the EU to micro-manage the HTTP spec?
- cactus2093 6y ago
  I'm very curious what leads you to believe that this law doesn't exist? And be so sure about it as to call out someone else for not knowing what they're talking about. "Passed in the 2002 and amended in 2009, the ePrivacy Directive (EPD) has become known as the “cookie law” since its most notable effect was the proliferation of cookie consent pop-ups after it was passed." https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
  - tjoff 6y ago
    I think point is that there is only a need for a cookie pop-ups if the site try to exploit their users. It is not the cookie that requires pop-ups. It's despicable behavior that does.
    - oaiey 6y ago
      Well said.
- AnthonyMouse 6y ago
  > You seriously want the EU to micro-manage the HTTP spec? Well no, what you really want is browsers that do the right thing to begin with and e.g. block third party cookies by default. Then you don't need "cookie legislation" at all. But if they're going to require something then it should at least be clear what the requirement is. If multiple large corporations who can obviously afford competent attorneys are doing something ridiculous, that's pretty good evidence that your legislation is drafted stupid.
  - oaiey 6y ago
    The obvious problem we all know, is that a browser cannot distinguish between a functional and an advertisement cookie. And honestly, cookies are a method. There are tracking methods where the user agent has no chance and is not involved. Also GDPR is addressing much more than tracking consent.
deleted 6y ago
[deleted]
smountjoy 6y ago
Wouldn't we just get pop-ups saying, "please enable X-Allow-Tracking for this website"? Same thing that some websites do in response to ad blockers.
- stared 6y ago
  Yes, it means that if you consent for cookies, you don't get annoying popups everywhere. Or, what actually would be interesting, a law explicitly disallowing "please enable X-Allow-Tracking for this website" popups. Right now the web is broken anyway - some pay (in data and ads), some are free-riders. And everyone is pested by cookie popups. This "no tracking unless required for functionality" would make it nice to change a model for actually paying for use. (It promotes quality content, less distractions, less clickbaits; and thinking twice if you want to spend more time on yet another meme aggregator.)
Rexxar 6y ago
The law itself is perfectly sane. The problem is that everybody try to apply it in the worst possible way. Let's imagine a world where a government force car builder to add speed limiter to cars. The car builders all decides to just cut the engine if you go over the limit. Will you say the law is bad or that car makers are trolling everybody ? It's the same for this law. But curiously everybody is prompt to say that the law is bad. The reality is that a majority of internet actors are bad and are just trolling us.
- bgun 6y ago
  If the worst possible application of a law is insane, then the law itself is NOT perfectly sane.
  - Rexxar 6y ago
    I don't see why. People don't need laws to do insane things. Everybody can do insane things and respect the law. Law is not a magical thing that force everybody to act rationally and sanely.
  - anticensor 6y ago
    Imagine the converse: if the worst possible application of a law is too sane, then the law itself is not _strong enough_.
- AmericanChopper 6y ago
  I have never seen a cookie consent implementation that wasn’t annoying, and absolutely do not believe that this law has had any beneficial impact at all on anybody’s privacy. It is the very definition of a bad law. It makes the web worse and more user hostile, and achieves none of its objectives.
  - wlll 6y ago
    See the tracking consent page on https://basecamp.com/ https://basecamp.com/? No? That's because there isn't one. Every time you see one of those cookie popups it is a sign, right there front and centre, that the website you are trying to use is trying to play fast and loose with your data. Complaining about these notices would be like complaining that restaurants are forced to put up a sign on their front door "Kitchen employees don't wash their hands" when they get caught not doing so.
oaiey 6y ago
I think they tried a cooperative approach with more technical design . It was called DNT .. the do not track header thingy. Failed because no one gave a shit. So they made it financially painful. It is the only language companies understand and respect. Cookies are also just a method. GDPR is not specific about it.
gsich 6y ago
>Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn't they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they've approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting). Like with DNT? Nobody cares about that. Defaults matter too and DNT is default off. So it probably adds more entropy if you enable it. Besides that: Technical cookies (or any other storage in your browser) that are required for your site to work do not require consent. Tracking from ads are obviously not included in that definition.
dathinab 6y ago
Note that the law only requires this banners for cookies which e.g. track you. (Which by now require far more opt in than a cookie banner, thanks to GDPR). For purly functional cookies like they are used for CSRF prevention or login cookies do not require any user notifications as far as I know. (Be aware that this is only true for login cookies which are just used to handle a active login, which means they must set the right flags to not be send to a different domain, etc.)
pornel 6y ago
It's malicious compliance. Sites were supposed to stop using a shotgun method of grabbing all data they can, sharing it with everyone that will take it, and hoping something will stick. They were supposed to take responsibility for data they collect and share. But instead of changing anything, sites went for the laziest workaround (which apparently isn't even legal), so that they could ignore the legislation and keep business as usual.
WhyNotHugo 6y ago
4 years? You're lucky. My Argentian card expires in 2031. Yet I've never gone more than 2-3 years without having to cancel it due to some bad actor overcharging me.
rmc 6y ago
“introduce an X-Allow-Tracking header in the http spec” The DNT HTTP header is about 10 years old. It is widely ignore by many data collectors. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track

Nasrudith 6y ago

To be frank I suspect that the answer is because that isn't their goal any more than a congressional fact finding session is to find facts - but to grandstand angrily about sour grapes.

droopyEyelids 6y ago
Or it might have happened in the other direction, where there was an earnest goal, but opponents to that goal slipped a poison pill in

_pmf_ 6y ago

There is no "cookie law". Nothing in the law has to do anything specifically with cookies.

ratww 6y ago
This is correct in GDPR. This is why you can’t use something like LocalStorage, ETags or something else as a loophole.
- deleted 6y ago
  [deleted]
- allover 6y ago
  This is not correct, in the UK at least. Similar technologies like LocalStorage fall under cookie law. [1] [1] https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
  - allover 6y ago
    Parent edited their comment from "can" to "can't", and I got downvoted, yikes.
- Nursie 6y ago
  No, you can't, because the law concerns itself with data storage and processing, not whether you are using a cookie.
  - ratww 6y ago
    Ah that was a brain fart moment, sorry. I meant to say you cannot use, GDPR is something I handle daily. Thanks for correcting, I amended the answer.
allover 6y ago
There absolutely is a cookie law. The UK legislation is "PECR" [1] which sits alongside the GDPR. > PECR are the Privacy and Electronic Communications Regulations. Their full title is The Privacy and Electronic Communications (EC Directive) Regulations 2003. > They are derived from European law. They implement European Directive 2002/58/EC, also known as ‘the e-privacy Directive’. > PECR cover several areas: > The use of cookies or similar technologies that track information about people accessing a website or other electronic service. See "How does this fit with the GDPR?" for how the two relate, tl;dr: > The GDPR does not replace PECR, although it changes the underlying definition of consent. Existing PECR rules continue to apply, but using the new GDPR standard of consent. [1] https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...

filleduchaos 6y ago

> want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4 years, and hope they don't misuse it I don't understand this at all, and I always feel so nervous using my card at US retailers for this reason (these days I try to stick to PayPal where possible). Where I'm from, _all_ one-off online card transactions are 2FA'd between you and your bank; it was strange to say the least the first time I paid for something on Amazon and the transaction just...went through.

Erlich_Bachman 6y ago
Look up what a "chargeback" is. That's the mechanism (and which has been working well enough in practice to keep the system going, and everyone is happy (except for some merchants of course)) that is preventing the dangers you are thinking about from occuring too often to unsuspecting card holders.
- AnthonyMouse 6y ago
  Then it brings with it a whole list of different problems, like being incredibly susceptible to buyer fraud, the cost of which everybody then has to eat. Meanwhile it causes the payment processors to not want to do business with merchants who get a large number of chargebacks, even if the problem isn't with the merchants but with their customers. In other words, it discriminates against merchants who do business with disadvantaged clientele who are more likely to have payment issues.
  - salawat 6y ago
    A merchant getting excessive numbers of chargebacks is not in and of itself an issue if you have all your ducks in a row. I mean it's an interesting enough heuristic, but can you provide an example of a processor that would refuse to business with someone because they had excessive chargeback, but also had the information in place to prove the purchases in question? I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in. I don't have much firsthand experience in it though, so I'd be thrilled if you could share some insight on it.

anoncake 6y ago

Believing that there is such a thing as an "EU cookie legislation" is a clear sign that you don't know what you are talking about. You seriously want the EU to micro-manage the HTTP spec?

cactus2093 6y ago
I'm very curious what leads you to believe that this law doesn't exist? And be so sure about it as to call out someone else for not knowing what they're talking about. "Passed in the 2002 and amended in 2009, the ePrivacy Directive (EPD) has become known as the “cookie law” since its most notable effect was the proliferation of cookie consent pop-ups after it was passed." https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
- tjoff 6y ago
  I think point is that there is only a need for a cookie pop-ups if the site try to exploit their users. It is not the cookie that requires pop-ups. It's despicable behavior that does.
  - oaiey 6y ago
    Well said.
AnthonyMouse 6y ago
> You seriously want the EU to micro-manage the HTTP spec? Well no, what you really want is browsers that do the right thing to begin with and e.g. block third party cookies by default. Then you don't need "cookie legislation" at all. But if they're going to require something then it should at least be clear what the requirement is. If multiple large corporations who can obviously afford competent attorneys are doing something ridiculous, that's pretty good evidence that your legislation is drafted stupid.
- oaiey 6y ago
  The obvious problem we all know, is that a browser cannot distinguish between a functional and an advertisement cookie. And honestly, cookies are a method. There are tracking methods where the user agent has no chance and is not involved. Also GDPR is addressing much more than tracking consent.

deleted 6y ago

[deleted]

smountjoy 6y ago

Wouldn't we just get pop-ups saying, "please enable X-Allow-Tracking for this website"? Same thing that some websites do in response to ad blockers.

stared 6y ago
Yes, it means that if you consent for cookies, you don't get annoying popups everywhere. Or, what actually would be interesting, a law explicitly disallowing "please enable X-Allow-Tracking for this website" popups. Right now the web is broken anyway - some pay (in data and ads), some are free-riders. And everyone is pested by cookie popups. This "no tracking unless required for functionality" would make it nice to change a model for actually paying for use. (It promotes quality content, less distractions, less clickbaits; and thinking twice if you want to spend more time on yet another meme aggregator.)

Rexxar 6y ago

The law itself is perfectly sane. The problem is that everybody try to apply it in the worst possible way. Let's imagine a world where a government force car builder to add speed limiter to cars. The car builders all decides to just cut the engine if you go over the limit. Will you say the law is bad or that car makers are trolling everybody ? It's the same for this law. But curiously everybody is prompt to say that the law is bad. The reality is that a majority of internet actors are bad and are just trolling us.

bgun 6y ago
If the worst possible application of a law is insane, then the law itself is NOT perfectly sane.
- Rexxar 6y ago
  I don't see why. People don't need laws to do insane things. Everybody can do insane things and respect the law. Law is not a magical thing that force everybody to act rationally and sanely.
- anticensor 6y ago
  Imagine the converse: if the worst possible application of a law is too sane, then the law itself is not _strong enough_.
AmericanChopper 6y ago
I have never seen a cookie consent implementation that wasn’t annoying, and absolutely do not believe that this law has had any beneficial impact at all on anybody’s privacy. It is the very definition of a bad law. It makes the web worse and more user hostile, and achieves none of its objectives.
- wlll 6y ago
  See the tracking consent page on https://basecamp.com/ https://basecamp.com/? No? That's because there isn't one. Every time you see one of those cookie popups it is a sign, right there front and centre, that the website you are trying to use is trying to play fast and loose with your data. Complaining about these notices would be like complaining that restaurants are forced to put up a sign on their front door "Kitchen employees don't wash their hands" when they get caught not doing so.

oaiey 6y ago

I think they tried a cooperative approach with more technical design . It was called DNT .. the do not track header thingy. Failed because no one gave a shit. So they made it financially painful. It is the only language companies understand and respect. Cookies are also just a method. GDPR is not specific about it.

gsich 6y ago

>Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn't they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they've approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting). Like with DNT? Nobody cares about that. Defaults matter too and DNT is default off. So it probably adds more entropy if you enable it. Besides that: Technical cookies (or any other storage in your browser) that are required for your site to work do not require consent. Tracking from ads are obviously not included in that definition.

dathinab 6y ago

Note that the law only requires this banners for cookies which e.g. track you. (Which by now require far more opt in than a cookie banner, thanks to GDPR). For purly functional cookies like they are used for CSRF prevention or login cookies do not require any user notifications as far as I know. (Be aware that this is only true for login cookies which are just used to handle a active login, which means they must set the right flags to not be send to a different domain, etc.)

pornel 6y ago

It's malicious compliance. Sites were supposed to stop using a shotgun method of grabbing all data they can, sharing it with everyone that will take it, and hoping something will stick. They were supposed to take responsibility for data they collect and share. But instead of changing anything, sites went for the laziest workaround (which apparently isn't even legal), so that they could ignore the legislation and keep business as usual.

WhyNotHugo 6y ago

4 years? You're lucky. My Argentian card expires in 2031. Yet I've never gone more than 2-3 years without having to cancel it due to some bad actor overcharging me.

rmc 6y ago

“introduce an X-Allow-Tracking header in the http spec” The DNT HTTP header is about 10 years old. It is widely ignore by many data collectors. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track