6 ms·

See the tracking consent page on https://basecamp.com/ https://basecamp.com/? No? That's because there isn't one. Every time you see one of those cookie popups

by wlll 6y ago

See the tracking consent page on https://basecamp.com/ https://basecamp.com/? No? That's because there isn't one. Every time you see one of those cookie popups it is a sign, right there front and centre, that the website you are trying to use is trying to play fast and loose with your data. Complaining about these notices would be like complaining that restaurants are forced to put up a sign on their front door "Kitchen employees don't wash their hands" when they get caught not doing so.

eitland 6y ago
> Complaining about these notices would be like complaining that restaurants are forced to put up a sign on their front door "Kitchen employees don't wash their hands" when they get caught not doing so. Brilliant. I might copy and reuse that.
- manfredo 6y ago
  I wouldn't recommend it. It's a bad analogy and if I saw someone use it I'd think they don't have a good grasp on web technologies. Cookie tracking is used to do things like persist shopping cart items without logging in, and plenty of other things users expect websites to do. It is also used in data collection, but that's more of a moral objection to advertising-based monetization than some sort of strictly-worse practices (like kitchen employees not washing hands).
  - wlll 6y ago
    Just to be clear, you can still use cookies, you don't need consent. Shopping carts and login sessions etc. will work just fine. You can still display advertising, that also doesn't need consent. You just can't collect and process people's data that isn't required for providing the service. If a site displays that notice, it's because they're attempting to do more with your data, or collect extra data, than is strictly needed for the service.
    - manfredo 6y ago
      Perhaps in theory. But in practice, nobody wants to risk being fined because a court determines that some data wasn't required to provide the service. Do you really need to have persistent carts for non-logged-in customers? Can't you just only offer the cart for logged in customers? It's not required, just beneficial. Thus, these cookie disclaimers are like Proposition 65 warnings in California. They're everywhere so people ignore them.
      - ummonk 6y ago
        If you allow users to add items to their cart without logging in, that isn't tracking them. It's just storing the information which the user wants you to store on their browser. Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want.
        manfredo 6y ago
        > Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want. You realize that in order to implement "add to cart" you have to track their activity on the site? That's what the cookie is for. To track customers and persist their cart. If you can't track customers then you can't associate them with their cart. As far as analyzing activities, what is any isn't allowed is murky. Is it okay to do A/B testing and see their impact on sales? This requires tracking and analyzing user activity, but isn't necessary to provide the service. But it is necessary to actually determine whether changes to the service are positive or negative. So do you throw away A/B testing, do A/B testing and risk fines, or throw up a cookie disclaimer? > If you can't work out what data is and isn't required for the functioning of your site then perhaps you shouldn't be running one. I'm more than confident in developers' abilities to know what is and requires. I'm dubious of government bureaucrats' abilities of doing so.
        6y ago
strken 6y ago
It's a little closer to "kitchen employees may touch pens or keyboards". Of course the restaurant is going to print off a sign and stick it to the door instead of asking staff to remind you that they're going to write down your order.
- wlll 6y ago
  I think you are talking about wait staff not kitchen staff. The thing is, wait staff need to use pens/keyboards to do their job. It's part of what it is to be a waiter or waitress. GDPR doesn't make website owners ask people if they can use cookies, you can use cookies just fine without asking people. You have to ask people when you want to collect or process more data than is required to provide the service. The point of the analogy was to make a comparison between being clean with data and being clean with food.
  - cookiecaper 6y ago
    > GDPR doesn't make website owners ask people if they can use cookies, you can use cookies just fine without asking people. You have to ask people when you want to collect or process more data than is required to provide the service. I don't have any first-hand knowledge here, but my guess would be that the corporate lawyer's recommendation is always going to be "just get consent for every cookie". The alternative is to risk lengthy litigation over whether specific cookies required the consent. If they ask every time, they can avoid that nightmare. Because of this, the notice doesn't really serve any purpose of a signal of sysop goodwill. Virtually every business large enough to have lawyers will add it where there's the possibility it'd be required, regardless of the cookie's intention. Well-intended law that causes many negative side effects is still bad law, just as well-intended software may very well still be bad software.
    - wlll 6y ago
      It's up to you if you want to stick unnecessary notices on your website. If your lawyers tell you to do this then do it, or get better lawyers. Some lawyers make restaurants get waivers from customers before they order steak that's not fully cooked. It doesn't mean it's necessary (and I would definitely not eat at one).
AmericanChopper 6y ago
This is based on your own interpretation of what the law is supposed to do, and not the stated intention of the law. The premise that use of any cookie that would require a consent banner can only possibly mean abusive tracking is simply false. The UK guidance on the law describes 4 categories [0], strictly necessary, performance, functionality and tracking. The presence of a cookie consent banner could mean nothing more than the specific functionality of the service requires it. Furthermore, the difference in categorization from one cookie to another depends in part on how the data is used rather than what types of collection are technically feasible. The absence of could also mean that the service is simply non-compliant, and the presence of one is not sufficient to make the judgements you're making. Compliance, even among those who choose to display a banner is incredibly low [1]. The law has simply had no impact at all on privacy, the way it has been implemented only services to nuisance and mislead consumers, and if you actually do use it to divine the information you're claiming to, then you're simply intentionally misleading yourself. [0]: https://www.cookielaw.org/wp-content/uploads/2019/12/icc_uk_cookiesguide_revnov.pdf https://www.cookielaw.org/wp-content/uploads/2019/12/icc_uk_... [1]: https://www.engadget.com/2020-01-13-websites-not-following-eu-gdpr-rules-study.html https://www.engadget.com/2020-01-13-websites-not-following-e...
- wlll 6y ago
  I'm specifically talking about the GDPR which is the cause of all the popups we're seeing (but to be clear, doesn't require a popup), not the earlier "cookie law", which I agree is crap, and that you linked to. However, that law does state that you don't need to get permission if the cookie is: "Strictly necessary to provide a service explicitly requested by the user"
  - AmericanChopper 6y ago
    Which doesn't cover: A cookie that remembers your shopping cart if you leave the site and return to it later. A cookie that remembers any preference you register if you leave a site and return to it later. A login cookie that persists after you leave the site doesn't explicitly require consent, but if you don't get it, then you are technically deviating from the guidelines that "[strictly necessary cookies] will generally be first-party session cookies" and that session cookies are "temporary and expire once you close your browser (or once your session ends)". If you had a persistent auth cookie, it would be reasonable to lean towards consent based on the published guidance. from https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ > Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in. > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: > Receive users’ consent before you use any cookies except strictly necessary cookies. Your stated understanding of when consent is and is not required is simply incorrect.
nearbuy 6y ago
I do see a uuid cookie though.

by wlll 6y ago

eitland 6y ago

> Complaining about these notices would be like complaining that restaurants are forced to put up a sign on their front door "Kitchen employees don't wash their hands" when they get caught not doing so. Brilliant. I might copy and reuse that.

manfredo 6y ago
I wouldn't recommend it. It's a bad analogy and if I saw someone use it I'd think they don't have a good grasp on web technologies. Cookie tracking is used to do things like persist shopping cart items without logging in, and plenty of other things users expect websites to do. It is also used in data collection, but that's more of a moral objection to advertising-based monetization than some sort of strictly-worse practices (like kitchen employees not washing hands).
- wlll 6y ago
  Just to be clear, you can still use cookies, you don't need consent. Shopping carts and login sessions etc. will work just fine. You can still display advertising, that also doesn't need consent. You just can't collect and process people's data that isn't required for providing the service. If a site displays that notice, it's because they're attempting to do more with your data, or collect extra data, than is strictly needed for the service.
  - manfredo 6y ago
    Perhaps in theory. But in practice, nobody wants to risk being fined because a court determines that some data wasn't required to provide the service. Do you really need to have persistent carts for non-logged-in customers? Can't you just only offer the cart for logged in customers? It's not required, just beneficial. Thus, these cookie disclaimers are like Proposition 65 warnings in California. They're everywhere so people ignore them.
    - ummonk 6y ago
      If you allow users to add items to their cart without logging in, that isn't tracking them. It's just storing the information which the user wants you to store on their browser. Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want.
      - manfredo 6y ago
        > Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want. You realize that in order to implement "add to cart" you have to track their activity on the site? That's what the cookie is for. To track customers and persist their cart. If you can't track customers then you can't associate them with their cart. As far as analyzing activities, what is any isn't allowed is murky. Is it okay to do A/B testing and see their impact on sales? This requires tracking and analyzing user activity, but isn't necessary to provide the service. But it is necessary to actually determine whether changes to the service are positive or negative. So do you throw away A/B testing, do A/B testing and risk fines, or throw up a cookie disclaimer? > If you can't work out what data is and isn't required for the functioning of your site then perhaps you shouldn't be running one. I'm more than confident in developers' abilities to know what is and requires. I'm dubious of government bureaucrats' abilities of doing so.
        6y ago

strken 6y ago

It's a little closer to "kitchen employees may touch pens or keyboards". Of course the restaurant is going to print off a sign and stick it to the door instead of asking staff to remind you that they're going to write down your order.

wlll 6y ago
I think you are talking about wait staff not kitchen staff. The thing is, wait staff need to use pens/keyboards to do their job. It's part of what it is to be a waiter or waitress. GDPR doesn't make website owners ask people if they can use cookies, you can use cookies just fine without asking people. You have to ask people when you want to collect or process more data than is required to provide the service. The point of the analogy was to make a comparison between being clean with data and being clean with food.
- cookiecaper 6y ago
  > GDPR doesn't make website owners ask people if they can use cookies, you can use cookies just fine without asking people. You have to ask people when you want to collect or process more data than is required to provide the service. I don't have any first-hand knowledge here, but my guess would be that the corporate lawyer's recommendation is always going to be "just get consent for every cookie". The alternative is to risk lengthy litigation over whether specific cookies required the consent. If they ask every time, they can avoid that nightmare. Because of this, the notice doesn't really serve any purpose of a signal of sysop goodwill. Virtually every business large enough to have lawyers will add it where there's the possibility it'd be required, regardless of the cookie's intention. Well-intended law that causes many negative side effects is still bad law, just as well-intended software may very well still be bad software.
  - wlll 6y ago
    It's up to you if you want to stick unnecessary notices on your website. If your lawyers tell you to do this then do it, or get better lawyers. Some lawyers make restaurants get waivers from customers before they order steak that's not fully cooked. It doesn't mean it's necessary (and I would definitely not eat at one).

AmericanChopper 6y ago

This is based on your own interpretation of what the law is supposed to do, and not the stated intention of the law. The premise that use of any cookie that would require a consent banner can only possibly mean abusive tracking is simply false. The UK guidance on the law describes 4 categories [0], strictly necessary, performance, functionality and tracking. The presence of a cookie consent banner could mean nothing more than the specific functionality of the service requires it. Furthermore, the difference in categorization from one cookie to another depends in part on how the data is used rather than what types of collection are technically feasible. The absence of could also mean that the service is simply non-compliant, and the presence of one is not sufficient to make the judgements you're making. Compliance, even among those who choose to display a banner is incredibly low [1]. The law has simply had no impact at all on privacy, the way it has been implemented only services to nuisance and mislead consumers, and if you actually do use it to divine the information you're claiming to, then you're simply intentionally misleading yourself. [0]: https://www.cookielaw.org/wp-content/uploads/2019/12/icc_uk_cookiesguide_revnov.pdf https://www.cookielaw.org/wp-content/uploads/2019/12/icc_uk_... [1]: https://www.engadget.com/2020-01-13-websites-not-following-eu-gdpr-rules-study.html https://www.engadget.com/2020-01-13-websites-not-following-e...

wlll 6y ago
I'm specifically talking about the GDPR which is the cause of all the popups we're seeing (but to be clear, doesn't require a popup), not the earlier "cookie law", which I agree is crap, and that you linked to. However, that law does state that you don't need to get permission if the cookie is: "Strictly necessary to provide a service explicitly requested by the user"
- AmericanChopper 6y ago
  Which doesn't cover: A cookie that remembers your shopping cart if you leave the site and return to it later. A cookie that remembers any preference you register if you leave a site and return to it later. A login cookie that persists after you leave the site doesn't explicitly require consent, but if you don't get it, then you are technically deviating from the guidelines that "[strictly necessary cookies] will generally be first-party session cookies" and that session cookies are "temporary and expire once you close your browser (or once your session ends)". If you had a persistent auth cookie, it would be reasonable to lean towards consent based on the published guidance. from https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ > Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in. > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: > Receive users’ consent before you use any cookies except strictly necessary cookies. Your stated understanding of when consent is and is not required is simply incorrect.

nearbuy 6y ago

I do see a uuid cookie though.