5 ms·

The only reason you need consent is when you're tracking people or storing data that isn't required for the functionality of the site. Shopping carts, subscrip

by wlll 6y ago

The only reason you need consent is when you're tracking people or storing data that isn't required for the functionality of the site. Shopping carts, subscription services etc. will still work, you don't need to consent to that, as long as you're not tracking people or handling their data unecessarily. When you see one of those cookie popups it is a sign that the website is trying to get more information out of you than they need.

rcxdude 6y ago
> When you see one of those cookie popups it is a sign that the website is trying to get more information out of you than they need. Or the owner of the website has failed to understand the nature of the law. Given the amount of confusion in this comment section this also seems likely. The ones which deliberately make the flow for closing the popup and accessing the site without 'consenting' are the ones I think are actually acting malicously.
- wlll 6y ago
  > Or the owner of the website has failed to understand the nature of the law. Oh, sure, but if they don't understand it then they probably shouldn't be gathering people's data either. GDPR is pretty complex, but website operators have proved for years and years that they can't be trusted to do the right thing themselves, so here we are.
  - dantheman 6y ago
    I'm still waiting to see the harm this tracking is causing that is requiring the GDPR and it's giant cost to society.
    - wlll 6y ago
      Giant cost to society?
      - leppr 6y ago
        An exageration, but in aggregate, the time wasted on this by users having to close yet another pop-up (and being more reluctant to browse new websites), and providers implementing the functionality on their websites is not negligible.
        wlll 6y ago
        I hate the consent popups, but to me they signal something different to me than I think perhaps they do you or the parent commenter. Bear in mind: - Extra data collection or processing must be opt in. - Not opting in must be as easy as opting in. - The content must be available if the user chooses not to opt in. Then: For instance, you go to a site, tumblr.com for example. Why is not important. You get a consent popup. Opting in to extra data collection is easy but you don't want to. Navigating this consent popup is almost impossible. within a few clicks you are lost, you find a list of several hundred "partners" tumblr wants to share your data with. All are checked and need to be individually unchecked. You still can't work out how to opt out. To me it's like someone's trying to scam you out of your data. They are so desperate to get your information that they are jumping through all sorts of hoops to try to trick you into giving it. Do I really want to give my data so an entity that is acting so creepily? Nope. I close the window.
        TeMPOraL 6y ago
        Both these time wasters are on website providers. If they stuck to collecting only what they need to provide the service, they wouldn't need to ask for consent. Alas, they're greedy, but then they don't get to complain.
        tripzilch 6y ago
        "Providers" that have previously wasted time on making sure all the data collection, tracking and adtech on their site worked perfectly. That time "wasted" now, is time spent to fix their mistake. The mistake of thinking they could collect data on me and sell it to third parties in perpetuity.
      - dantheman 6y ago
        How much time and effort have gone into compliance, it's insane. That's measurable. The real cost is the delay to new projects, uncertainty, increased costs - its what we wont have...
    - flukus 6y ago
      Tracking has a giant cost to society, the sole reason it exists is so we can be manipulated by advertisers into spending more than we otherwise would have.
- saagarjha 6y ago
  GDPR isn't very hard to understand, it's just that website owners want to have their cake and eat it too. Looking around for loopholes to do analytics that aren't actually what the user came to the site for is fundamentally the thing that the legislation is targeting, and all this handwringing about cookie popups and consent and anonymized data is "complicated" simply because it is not in the nature of the law. You do that, you need permission, period, and you need to be OK with people saying "no, I'd really rather you not do that".
  - mcqueenjordan 6y ago
    > GDPR isn't very hard to understand It may not be terribly difficult to understand, but it is indeed very complex to enact at scale, especially with large systems that were designed under different constraints. > Looking around for loopholes to do analytics that aren't actually what the user came to the site for is fundamentally the thing that the legislation is targeting... Totally agree, and this shouldn't be done. > ...this handwringing about cookie popups and consent and anonymized data is "complicated" simply because it is not in the nature of the law. You do that, you need permission, period, and you need to be OK with people saying "no, I'd really rather you not do that". This is where we disagree a little. Calling it handwringing is hand-wavey and dismissive -- this stuff isn't easy to get right, and it's arguably a large cost for the wrong solution. Cookies come in HTTP response headers. Don't want the cookie to do anything? Don't read it! Tell your browser to ignore it. Don't like the JS that's being run? Disable JS. Waging a war against cookies is just a cop-out for fighting the actual problem. What's next? Opt-in banners for JS in webpages? For using HTTP? TCP?
    - wlll 6y ago
      > It may not be terribly difficult to understand, but it is indeed very complex to enact at scale, especially with large systems that were designed under different constraints. As a developer, I agree. As an end user, I am OK with this. If organisations have to think hard about what data they collect, because it means they have to think hard about how to safely store and destroy it, then that's a good thing. It has been easy to collect, store and disseminate user data without thought for a long time, and website operators have proved they can't (in general) act responsibly. > This is where we disagree a little. Calling it handwringing is hand-wavey and dismissive My honest opinion about most of the consent popups I see is that they are at best trying to weasel out of having to comply with the regulations, or at worst applying dark patterns to trick the user into "consenting". I am sure there are some honest people with consent popups out there, but I'm not generally generous enough to attribute anything other than malice or incompetence. > this stuff isn't easy to get right, and it's arguably a large cost for the wrong solution. For sure, but it works both ways. There is a (potential) financial penalty for not taking care of user data, but at the same time, there's a pretty large cost to a user if their data is spaffed all over databases on the Internet when they didn't want that. Also, I'm pretty sure if you are actually trying to be GDPR compliant then your first interaction with the information commissioners office will be them trying to help you comply, and you do always have the option of just deleting the data if you can't treat it safely. > Cookies come in HTTP response headers. Don't want the cookie to do anything? Don't read it! Tell your browser to ignore it. Don't like the JS that's being run? Disable JS. I feel like I read somewhere that telling the user to adjust their cookie settings in the browser was speficically discussed, and not allowed, but I could be wrong. > Waging a war against cookies is just a cop-out for fighting the actual problem. What's next? Opt-in banners for JS in webpages? For using HTTP? TCP? It would be a mistake to think that Cookies are the focus of the GDPR. See https://gdpr.eu/cookies/ https://gdpr.eu/cookies/: "However, throughout its’ 88 pages, it only mentions cookies directly once, in Recital 30." The GDPR is about user privacy, cookies are one of the primary tools for violating it, and the most prominent artefact seen on the web, so it's the focus of a lot of discussion, but the main thrust of the regulations aren't around cookies themselves. It is significantly unlikely that there will be opt in banners for JS, HTTP, TCP, phone calls, cameras at the beach, or just looking at people with your eyes any time soon.
- tripzilch 6y ago
  As with most law, you're not excused from following it if you fail to understand it. If the admin of a site thinks they need a cookie banner when they don't, it's really because they haven't really bothered to give much thought to reducing the amount of data collection they do on their users. But I bet it's not really that common, website admins who think they need a cookie banner when they really do not. What is WAY more common: the website admins that do need a cookie banner, but ONLY because they use Google Analytics, and don't realise this is a choice they get to make. Or people (right here in this thread) saying "I can't make a useful website otherwise" -- it's not that the law is hard to understand, it's not. It's that they refuse to give the problem any thought. The ones "failing to understand the nature of the law", actually just don't give a crap. It's like a butcher complaining "Why do I have to label my meat with 'made from tortured animals', I have to kill them right? I can't possibly produce any meat without using this rusty spoon that I've used for decades". > The ones which deliberately make the flow for closing the popup and accessing the site without 'consenting' are the ones I think are actually acting malicously. You can easily not act maliciously, and still be a crucial part of the problem. That's also what laws are for, even if you cross them non-maliciously, you get punished. That's because people "not understanding the nature of the law", when it directly applies to their business, is undesirable, and really a responsibility they should carry.
markdown 6y ago
> The only reason you need consent is when you're tracking people or storing data that isn't required for the functionality of the site. You forgot one more... you're a citizen of an EU member state. I live in a sovereign nation and EU law doesn't apply to me. It's been quite funny seeing Americans fall over themselves to comply with GDPR requirements. It won't be funny when they also fall in line behind Chinese law.

by wlll 6y ago

rcxdude 6y ago

> When you see one of those cookie popups it is a sign that the website is trying to get more information out of you than they need. Or the owner of the website has failed to understand the nature of the law. Given the amount of confusion in this comment section this also seems likely. The ones which deliberately make the flow for closing the popup and accessing the site without 'consenting' are the ones I think are actually acting malicously.

wlll 6y ago
> Or the owner of the website has failed to understand the nature of the law. Oh, sure, but if they don't understand it then they probably shouldn't be gathering people's data either. GDPR is pretty complex, but website operators have proved for years and years that they can't be trusted to do the right thing themselves, so here we are.
- dantheman 6y ago
  I'm still waiting to see the harm this tracking is causing that is requiring the GDPR and it's giant cost to society.
  - wlll 6y ago
    Giant cost to society?
    - leppr 6y ago
      An exageration, but in aggregate, the time wasted on this by users having to close yet another pop-up (and being more reluctant to browse new websites), and providers implementing the functionality on their websites is not negligible.
      - wlll 6y ago
        I hate the consent popups, but to me they signal something different to me than I think perhaps they do you or the parent commenter. Bear in mind: - Extra data collection or processing must be opt in. - Not opting in must be as easy as opting in. - The content must be available if the user chooses not to opt in. Then: For instance, you go to a site, tumblr.com for example. Why is not important. You get a consent popup. Opting in to extra data collection is easy but you don't want to. Navigating this consent popup is almost impossible. within a few clicks you are lost, you find a list of several hundred "partners" tumblr wants to share your data with. All are checked and need to be individually unchecked. You still can't work out how to opt out. To me it's like someone's trying to scam you out of your data. They are so desperate to get your information that they are jumping through all sorts of hoops to try to trick you into giving it. Do I really want to give my data so an entity that is acting so creepily? Nope. I close the window.
      - TeMPOraL 6y ago
        Both these time wasters are on website providers. If they stuck to collecting only what they need to provide the service, they wouldn't need to ask for consent. Alas, they're greedy, but then they don't get to complain.
      - tripzilch 6y ago
        "Providers" that have previously wasted time on making sure all the data collection, tracking and adtech on their site worked perfectly. That time "wasted" now, is time spent to fix their mistake. The mistake of thinking they could collect data on me and sell it to third parties in perpetuity.
    - dantheman 6y ago
      How much time and effort have gone into compliance, it's insane. That's measurable. The real cost is the delay to new projects, uncertainty, increased costs - its what we wont have...
  - flukus 6y ago
    Tracking has a giant cost to society, the sole reason it exists is so we can be manipulated by advertisers into spending more than we otherwise would have.
saagarjha 6y ago
GDPR isn't very hard to understand, it's just that website owners want to have their cake and eat it too. Looking around for loopholes to do analytics that aren't actually what the user came to the site for is fundamentally the thing that the legislation is targeting, and all this handwringing about cookie popups and consent and anonymized data is "complicated" simply because it is not in the nature of the law. You do that, you need permission, period, and you need to be OK with people saying "no, I'd really rather you not do that".
- mcqueenjordan 6y ago
  > GDPR isn't very hard to understand It may not be terribly difficult to understand, but it is indeed very complex to enact at scale, especially with large systems that were designed under different constraints. > Looking around for loopholes to do analytics that aren't actually what the user came to the site for is fundamentally the thing that the legislation is targeting... Totally agree, and this shouldn't be done. > ...this handwringing about cookie popups and consent and anonymized data is "complicated" simply because it is not in the nature of the law. You do that, you need permission, period, and you need to be OK with people saying "no, I'd really rather you not do that". This is where we disagree a little. Calling it handwringing is hand-wavey and dismissive -- this stuff isn't easy to get right, and it's arguably a large cost for the wrong solution. Cookies come in HTTP response headers. Don't want the cookie to do anything? Don't read it! Tell your browser to ignore it. Don't like the JS that's being run? Disable JS. Waging a war against cookies is just a cop-out for fighting the actual problem. What's next? Opt-in banners for JS in webpages? For using HTTP? TCP?
  - wlll 6y ago
    > It may not be terribly difficult to understand, but it is indeed very complex to enact at scale, especially with large systems that were designed under different constraints. As a developer, I agree. As an end user, I am OK with this. If organisations have to think hard about what data they collect, because it means they have to think hard about how to safely store and destroy it, then that's a good thing. It has been easy to collect, store and disseminate user data without thought for a long time, and website operators have proved they can't (in general) act responsibly. > This is where we disagree a little. Calling it handwringing is hand-wavey and dismissive My honest opinion about most of the consent popups I see is that they are at best trying to weasel out of having to comply with the regulations, or at worst applying dark patterns to trick the user into "consenting". I am sure there are some honest people with consent popups out there, but I'm not generally generous enough to attribute anything other than malice or incompetence. > this stuff isn't easy to get right, and it's arguably a large cost for the wrong solution. For sure, but it works both ways. There is a (potential) financial penalty for not taking care of user data, but at the same time, there's a pretty large cost to a user if their data is spaffed all over databases on the Internet when they didn't want that. Also, I'm pretty sure if you are actually trying to be GDPR compliant then your first interaction with the information commissioners office will be them trying to help you comply, and you do always have the option of just deleting the data if you can't treat it safely. > Cookies come in HTTP response headers. Don't want the cookie to do anything? Don't read it! Tell your browser to ignore it. Don't like the JS that's being run? Disable JS. I feel like I read somewhere that telling the user to adjust their cookie settings in the browser was speficically discussed, and not allowed, but I could be wrong. > Waging a war against cookies is just a cop-out for fighting the actual problem. What's next? Opt-in banners for JS in webpages? For using HTTP? TCP? It would be a mistake to think that Cookies are the focus of the GDPR. See https://gdpr.eu/cookies/ https://gdpr.eu/cookies/: "However, throughout its’ 88 pages, it only mentions cookies directly once, in Recital 30." The GDPR is about user privacy, cookies are one of the primary tools for violating it, and the most prominent artefact seen on the web, so it's the focus of a lot of discussion, but the main thrust of the regulations aren't around cookies themselves. It is significantly unlikely that there will be opt in banners for JS, HTTP, TCP, phone calls, cameras at the beach, or just looking at people with your eyes any time soon.
tripzilch 6y ago
As with most law, you're not excused from following it if you fail to understand it. If the admin of a site thinks they need a cookie banner when they don't, it's really because they haven't really bothered to give much thought to reducing the amount of data collection they do on their users. But I bet it's not really that common, website admins who think they need a cookie banner when they really do not. What is WAY more common: the website admins that do need a cookie banner, but ONLY because they use Google Analytics, and don't realise this is a choice they get to make. Or people (right here in this thread) saying "I can't make a useful website otherwise" -- it's not that the law is hard to understand, it's not. It's that they refuse to give the problem any thought. The ones "failing to understand the nature of the law", actually just don't give a crap. It's like a butcher complaining "Why do I have to label my meat with 'made from tortured animals', I have to kill them right? I can't possibly produce any meat without using this rusty spoon that I've used for decades". > The ones which deliberately make the flow for closing the popup and accessing the site without 'consenting' are the ones I think are actually acting malicously. You can easily not act maliciously, and still be a crucial part of the problem. That's also what laws are for, even if you cross them non-maliciously, you get punished. That's because people "not understanding the nature of the law", when it directly applies to their business, is undesirable, and really a responsibility they should carry.

markdown 6y ago

> The only reason you need consent is when you're tracking people or storing data that isn't required for the functionality of the site. You forgot one more... you're a citizen of an EU member state. I live in a sovereign nation and EU law doesn't apply to me. It's been quite funny seeing Americans fall over themselves to comply with GDPR requirements. It won't be funny when they also fall in line behind Chinese law.