4 ms·

Just to be clear, you can still use cookies, you don't need consent. Shopping carts and login sessions etc. will work just fine. You can still display advertis

by wlll 6y ago

Just to be clear, you can still use cookies, you don't need consent. Shopping carts and login sessions etc. will work just fine. You can still display advertising, that also doesn't need consent. You just can't collect and process people's data that isn't required for providing the service. If a site displays that notice, it's because they're attempting to do more with your data, or collect extra data, than is strictly needed for the service.

manfredo 6y ago
Perhaps in theory. But in practice, nobody wants to risk being fined because a court determines that some data wasn't required to provide the service. Do you really need to have persistent carts for non-logged-in customers? Can't you just only offer the cart for logged in customers? It's not required, just beneficial. Thus, these cookie disclaimers are like Proposition 65 warnings in California. They're everywhere so people ignore them.
- ummonk 6y ago
  If you allow users to add items to their cart without logging in, that isn't tracking them. It's just storing the information which the user wants you to store on their browser. Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want.
  - manfredo 6y ago
    > Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want. You realize that in order to implement "add to cart" you have to track their activity on the site? That's what the cookie is for. To track customers and persist their cart. If you can't track customers then you can't associate them with their cart. As far as analyzing activities, what is any isn't allowed is murky. Is it okay to do A/B testing and see their impact on sales? This requires tracking and analyzing user activity, but isn't necessary to provide the service. But it is necessary to actually determine whether changes to the service are positive or negative. So do you throw away A/B testing, do A/B testing and risk fines, or throw up a cookie disclaimer? > If you can't work out what data is and isn't required for the functioning of your site then perhaps you shouldn't be running one. I'm more than confident in developers' abilities to know what is and requires. I'm dubious of government bureaucrats' abilities of doing so.
    - wlll 6y ago
      If you can't work out what data is and isn't required for the functioning of your site then perhaps you shouldn't be running one.
      - dingo_bat 6y ago
        The site owner can work it out, but the problem is the regulator cannot.
    - PeterisP 6y ago
      A "cookie disclaimer" does not solve any of the problems you describe. First, you can't avoid solving the murky analysis. You must be able to specify in clear language what personal data you're using for what purpose and which specific paragraph of the GDPR gives you the legal basis to do so. Are you using that data for A/B testing because it's a legitimate need where you don't need consent or because the user consents to it? Well, you have to decide before implementing that disclaimer, because the disclaimer should clearly state that answer! Furthermore, if you decide that some use case does not fit the legitimate need criteria and you need consent, then a "cookie disclaimer" does not reduce the risk of fines - because a disclaimer does not collect opt-in consent, it can (at best) record acknowledgement, so if you need consent but only have a disclaimer, then that still risks fines. On the other hand, if you trust your developers to know what is required and what's not, and you have documented it properly (because it's not just a good idea, it's mandatory), then you should be able to run that documentation through your local data protection authority to validate any doubts, that's part of their job, and wherever I have seen them work it's something they eagerly do.
- wlll 6y ago
  The most likely first steps in the UK is that ICO will get in touch and tell you you've done something wrong and need to fix it. Courts and enforcement penalties come later if you persist, or your infraction was signficant. I run websites, and I don't feel in any way worried about it personally.
  - manfredo 6y ago
    Right, and the easiest way to fix it is to throw up a cookie disclaimer and forget about it. So disclaimers become ubiquitous. Are you familiar with Proposition 65 in California? Any product of business location that has any detectible amount of carcinogens needs to disclaim that it potentially contains carcinogens. Among other things, gas stoves and roasted coffee both contain trace amounts of carcinogens. So most restaurants and coffee shops display Proposition 65 warnings. Said warnings have become so ubiquitous that nobody cares about them. The same scenario is playing out with cookie disclaimers. > Except there's no such thing as a cookie disclaimer as I said in another comment. Extra tracking/data processing has to be opt in, and you have to provide the service to the user even if they don't opt in, so you can't just throw up a notice that says you might not be compliant because you still need to be compliant. Yeah, they do exist. And you can find them on plenty of sites that block content unless the disclaimer is accepted. You may be of the mind that this is not complaint with the legislation, but reality demonstrates otherwise. > Prop 65 is different. The cookie law is like saying "if you sprinkle extra carcinogens in your product then you need to disclose it". This is making the same error as the washing hands analogy. This ignores the fact that cookies are necessary to power user-facing features.
    - wlll 6y ago
      > Right, and the easiest way to fix it is to throw up a cookie disclaimer and forget about it. So disclaimers become ubiquitous. Except there's no such thing as a cookie disclaimer as I said in another comment. Extra tracking/data processing has to be opt in, and you have to provide the service to the user even if they don't opt in, so you can't just throw up a notice that says you might not be compliant because you still need to be compliant. > Are you familiar with Proposition 65 in California? Yep, it's irellevant.
- a1369209993 6y ago
  You can't implement carts, persistent or otherwise, without cookies (localstorage et al is a type of cookie), because clicking on a link would throw away the cart data. If people click "add to cart" then of course they want you to track the cart contents; that doesn't give you right to track anything else.
  - manfredo 6y ago
    Right, and now you get sued by a group claiming that you don't need carts for non-logged in customers. Do you need to provide carts for non-logged in customers? No, says the lawyer, you selfishly used cookies to track people without consent in order to improve your sales. Or you can just throw up a cookie disclaimer to cover your ass. Sure, the cart is perhaps a trivial case. But persistent tracking is also used to prevent abusive behavior, and other things that aren't strictly necessary. The risk that someone might try to claim that these are unnecessary far outweighs the cost of throwing up a cookie disclaimer. Thus, cookie disclaimers become pointless through their ubiquity. Reply to your comment, since HN is rate limiting my work VPN: > That's not it works. Someone complains to the Information Comissioners Office (ICO). ICO determine if the complaint is valid and will get in touch with the site owner to help them come into compliance. And then they get sued if they don't come into compliance. This is just elaborating extra steps. > There is no such thing. > You have to make unecessary data collection and tracking opt in. You can't have a notice that says "we might do x unecessary data collection and/or tracking" and make the user click it or go away. You need to be compliant, or you need to not serve the European market. Right, and websites don't display content unless this supposedly unnecessary data collection is opted into. Because nobody wants to risk being on the wrong side of ambiguous restrictions on necessary and unnecessary tracking. You insist that websites have to display content regardless. Reality demonstrates otherwise - this is a practice sites do all the time. Again, cart's aren't actually necessary. They make it easier for users to buy multiple items, but you can make cart-less checkouts by having customers select all items on a single page. Thus, by adding cookies to implement a cart without consent you have violated user privacy for reasons unnecessary to provide your service.
    - wlll 6y ago

by wlll 6y ago

manfredo 6y ago

Perhaps in theory. But in practice, nobody wants to risk being fined because a court determines that some data wasn't required to provide the service. Do you really need to have persistent carts for non-logged-in customers? Can't you just only offer the cart for logged in customers? It's not required, just beneficial. Thus, these cookie disclaimers are like Proposition 65 warnings in California. They're everywhere so people ignore them.

ummonk 6y ago
If you allow users to add items to their cart without logging in, that isn't tracking them. It's just storing the information which the user wants you to store on their browser. Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want.
- manfredo 6y ago
  > Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want. You realize that in order to implement "add to cart" you have to track their activity on the site? That's what the cookie is for. To track customers and persist their cart. If you can't track customers then you can't associate them with their cart. As far as analyzing activities, what is any isn't allowed is murky. Is it okay to do A/B testing and see their impact on sales? This requires tracking and analyzing user activity, but isn't necessary to provide the service. But it is necessary to actually determine whether changes to the service are positive or negative. So do you throw away A/B testing, do A/B testing and risk fines, or throw up a cookie disclaimer? > If you can't work out what data is and isn't required for the functioning of your site then perhaps you shouldn't be running one. I'm more than confident in developers' abilities to know what is and requires. I'm dubious of government bureaucrats' abilities of doing so.
  - wlll 6y ago
    If you can't work out what data is and isn't required for the functioning of your site then perhaps you shouldn't be running one.
    - dingo_bat 6y ago
      The site owner can work it out, but the problem is the regulator cannot.
  - PeterisP 6y ago
    A "cookie disclaimer" does not solve any of the problems you describe. First, you can't avoid solving the murky analysis. You must be able to specify in clear language what personal data you're using for what purpose and which specific paragraph of the GDPR gives you the legal basis to do so. Are you using that data for A/B testing because it's a legitimate need where you don't need consent or because the user consents to it? Well, you have to decide before implementing that disclaimer, because the disclaimer should clearly state that answer! Furthermore, if you decide that some use case does not fit the legitimate need criteria and you need consent, then a "cookie disclaimer" does not reduce the risk of fines - because a disclaimer does not collect opt-in consent, it can (at best) record acknowledgement, so if you need consent but only have a disclaimer, then that still risks fines. On the other hand, if you trust your developers to know what is required and what's not, and you have documented it properly (because it's not just a good idea, it's mandatory), then you should be able to run that documentation through your local data protection authority to validate any doubts, that's part of their job, and wherever I have seen them work it's something they eagerly do.
wlll 6y ago
The most likely first steps in the UK is that ICO will get in touch and tell you you've done something wrong and need to fix it. Courts and enforcement penalties come later if you persist, or your infraction was signficant. I run websites, and I don't feel in any way worried about it personally.
- manfredo 6y ago
  Right, and the easiest way to fix it is to throw up a cookie disclaimer and forget about it. So disclaimers become ubiquitous. Are you familiar with Proposition 65 in California? Any product of business location that has any detectible amount of carcinogens needs to disclaim that it potentially contains carcinogens. Among other things, gas stoves and roasted coffee both contain trace amounts of carcinogens. So most restaurants and coffee shops display Proposition 65 warnings. Said warnings have become so ubiquitous that nobody cares about them. The same scenario is playing out with cookie disclaimers. > Except there's no such thing as a cookie disclaimer as I said in another comment. Extra tracking/data processing has to be opt in, and you have to provide the service to the user even if they don't opt in, so you can't just throw up a notice that says you might not be compliant because you still need to be compliant. Yeah, they do exist. And you can find them on plenty of sites that block content unless the disclaimer is accepted. You may be of the mind that this is not complaint with the legislation, but reality demonstrates otherwise. > Prop 65 is different. The cookie law is like saying "if you sprinkle extra carcinogens in your product then you need to disclose it". This is making the same error as the washing hands analogy. This ignores the fact that cookies are necessary to power user-facing features.
  - wlll 6y ago
    > Right, and the easiest way to fix it is to throw up a cookie disclaimer and forget about it. So disclaimers become ubiquitous. Except there's no such thing as a cookie disclaimer as I said in another comment. Extra tracking/data processing has to be opt in, and you have to provide the service to the user even if they don't opt in, so you can't just throw up a notice that says you might not be compliant because you still need to be compliant. > Are you familiar with Proposition 65 in California? Yep, it's irellevant.
a1369209993 6y ago
You can't implement carts, persistent or otherwise, without cookies (localstorage et al is a type of cookie), because clicking on a link would throw away the cart data. If people click "add to cart" then of course they want you to track the cart contents; that doesn't give you right to track anything else.
- manfredo 6y ago
  Right, and now you get sued by a group claiming that you don't need carts for non-logged in customers. Do you need to provide carts for non-logged in customers? No, says the lawyer, you selfishly used cookies to track people without consent in order to improve your sales. Or you can just throw up a cookie disclaimer to cover your ass. Sure, the cart is perhaps a trivial case. But persistent tracking is also used to prevent abusive behavior, and other things that aren't strictly necessary. The risk that someone might try to claim that these are unnecessary far outweighs the cost of throwing up a cookie disclaimer. Thus, cookie disclaimers become pointless through their ubiquity. Reply to your comment, since HN is rate limiting my work VPN: > That's not it works. Someone complains to the Information Comissioners Office (ICO). ICO determine if the complaint is valid and will get in touch with the site owner to help them come into compliance. And then they get sued if they don't come into compliance. This is just elaborating extra steps. > There is no such thing. > You have to make unecessary data collection and tracking opt in. You can't have a notice that says "we might do x unecessary data collection and/or tracking" and make the user click it or go away. You need to be compliant, or you need to not serve the European market. Right, and websites don't display content unless this supposedly unnecessary data collection is opted into. Because nobody wants to risk being on the wrong side of ambiguous restrictions on necessary and unnecessary tracking. You insist that websites have to display content regardless. Reality demonstrates otherwise - this is a practice sites do all the time. Again, cart's aren't actually necessary. They make it easier for users to buy multiple items, but you can make cart-less checkouts by having customers select all items on a single page. Thus, by adding cookies to implement a cart without consent you have violated user privacy for reasons unnecessary to provide your service.
  - wlll 6y ago