48 ms·

Ask HN: A way to adblock “we're using cookies” popups?

668 points by rayalez 6y ago

Whatever the intent of the GDPR was, the practical result is that now I have to click away the annoying "we're using cookies" popup on every website. Is there any way to do this automatically? If there isn't - there should be. Maybe people should use some special tag for them, so that it would be easy for users to block them on all the websites, if they want to.

swixmix 6y ago
I use vimium[1] to close most pop-ups by typing "f" and then hitting the letter that pops up next to the close button. If that doesn't work, I use a bookmarklet called "Remove Sticky"[2]. I type "bre" and hit enter when sticky things pop up to get them gone. [1]: https://chrome.google.com/webstore/detail/vimium/dbepggeogbaibhgnhhndojpepiihcmeb https://chrome.google.com/webstore/detail/vimium/dbepggeogba... [2]: https://news.ycombinator.com/item?id=23446504 https://news.ycombinator.com/item?id=23446504
- behnamoh 6y ago
  That's actually a smart way of using vimium, thank you! I'm gonna set more bookmarklets for various tasks now.
markgavalda 6y ago
Yes, quite easily: https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...
- the_pwner224 6y ago
  That is the way, but there's no need to install an extension just for it. Just add the IDCAC filter list to uBlock Origin (uBO settings => Filter Lists => Import, at the very bottom): https://www.i-dont-care-about-cookies.eu/abp/ https://www.i-dont-care-about-cookies.eu/abp/ Also on that same page you can enable some of the 'Annoyances' filters. Just be aware that some of them block social media buttons (FB/Twitter like/follow embeds), which you may not want.
  - nailer 6y ago
    Isn't uBlock Origin an extension?
    - ryankrage77 6y ago
      Yes, but uBlock and can do everything IDCAC can do, and more, so there's no point in having both installed.
      - nailer 6y ago
        Sure but what if you only care about cookie warnings and use site that are supported by ads?
        Fiveplus 6y ago
        Tangential question, but I would love to know if a group of people who prefer ads but not cookie warnings exist? Do they rank supporting the website above minor inconvenience of pop-ups and advertisements? That's gotta be a unicorn in terms of internet users.
        Wowfunhappy 6y ago
        Uh, I'm in this group. I think that if I'm visiting a website and using its bandwidth, the website ought to get paid. If the ads are too egregious, then using the website isn't "worth the cost" and I go to a different website. I do however pay for Scroll[1], and I use Firefox's Enhanced Tracking Protection. Due to the latter, many websites think I'm using an adblocker and complain, which really irks me. --- 1: https://scroll.com/ https://scroll.com/
        namibj 6y ago
        You'd be surprised if you knew how indoctrinated teens get in terms of not blocking ads on their favorite youtuber's channel.
        renewiltord 6y ago
- boudra 6y ago
  Check out the homepage where you can find versions of the extension for other browsers: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- deleted 6y ago
  [deleted]
- londons_explore 6y ago
  That chrome extension has quite a memory footprint and seems to slow everything down... Haven't debugged, but my browsing sessions have been a lot less laggy since I disabled it...
  - ksaj 6y ago
    That's the reason I disable it and install Ghostery instead. uBlock Origin makes youtube videos stutter at about the 2 second mark on my Raspberry Pi 3's (I don't know about the rpi 4's because I remove uBlock and install Ghostery as a default nowadays) and also my laptop, which runs Windows instead of Linux (so it's not just an OS issue.) Ghostery doesn't have as many bells and whistles, but it does greatly minimize the main annoyances out there, and it doesn't slow anything down noticeably. It might all be a moot point by this time, since Youtube has changed how they load in such a way that it stutters no matter what because it is so busy downloading absolutely every item on a page all at one time instead of prioritizing the video stream like it did about a decade ago (back when you could pause a video and it would download fully even while not yet playing, thus avoiding the bottlenecks altogether...). Ironically that puts me back to pausing everything first just to give all the useless off-screen crap enough bandwidth to load without ruining the video experience. No matter how much faster technology gets, they find a way to make it more and more sluggish every time.
    - surround 6y ago
      Try disabling generic cosmetic filters in uBlock.
    - branon 6y ago
      Ghostery is the one which reports your browsing history to advertisers (by default/opt-out), and also shows advertisements of its own. Not recommended over uBO. https://en.wikipedia.org/wiki/Ghostery#Criticism https://en.wikipedia.org/wiki/Ghostery#Criticism
      - ksaj 6y ago
        I haven't seen any ads, except Twitter's sponsored posts. It is possible/probable I set the right setting back when. Since Youtube chokes anyway nowadays (I did manage to stave it off for a few years), I might as well go back to uBO.
gpas 6y ago
If you are already using ublock origin go to settings > filters list > annoyances, turn on easylist-cookies.
- pedrogpimenta 6y ago
  And for the ones that still pop-up, you can manually filter that DOM element and save it on your rules.
  - surround 6y ago
    Make sure to report unblocked cookie banners to the Easylist developers https://forums.lanik.us/ https://forums.lanik.us/
  - bonestamp2 6y ago
    Ya, and it seems like about 20% of sites use cookielaw.org, so filtering out that domain is a good start.
- hutzlibu 6y ago
  I am amazed, at how much that annoyed me, too - and why I never bothered to find out, that ublock origin has this as a hidden feature. Awesome. I just also turned on all of the other annoyance settings. Is there a good chance of real content getting removed, on occasion, or do they work quite good?
  - zamadatix 6y ago
    I have had all list except the extra languages lists enabled for a couple years now. Online fast food ordering sites (e.g. Chipotle) are the only ones I've noticed get broken.
  - bashinator 6y ago
    It's pretty easy to make your own, too. I use the element zapper and picker to block Reddit's incessant demands that I use "new" reddit and get a "premium" membership. I also use it to block Facebook's "trending" bullshit.
vz8 6y ago
Thank you. There are numerous sites I go to regularly incognito to log in as an admin vs. end-user: several have low-profile, low-contrast cookie warnings which disable all other menus until you acknowledge them (without an apparent overlay). Just that little extra bit of friction every day adds up.
TechBro8615 6y ago
I’ve always thought this should be a browser feature. It would be more useful than the DNT header, anyway...
- MithrilTuxedo 6y ago
  I think of websites as just programs that run on a platform, a browser, which has a much smaller API than an operating system but effectively is one. On the one hand, these notices are akin to EULAs some programs make you click through when you first run them. We're more desensitized to those now, but they were never mandatory. On the other, I can't remember the last time an app maker got in trouble for keeping track of what users do. I can see it making sense to know that a single entity has been tracking you through a diversity of websites, but you enabled cookies in your browser for a reason. The site I deliberately chose to download and run the code of shouldn't need my permission to save state for that site. Android prompts you when an app needs permissions. OSX has started promoting you for permission the first time an app wants to access the filesystem. Seems a bit arbitrary to make websites handle that.
- drdaeman 6y ago
  This is what happens if browser vendors don't solve the issue with technical measures, being too afraid to break things. (Not surprising, given that a the largest one, being or close to being a de-facto monopolist, has conflict of interests on the matter of user tracking and profiling.) We get a legal solution which is poorly understood, has weird unintended side effects (because it was made by non-experts) essentially breaking things (just... non-technically), and doesn't really prevent the bad actors from continuing what they did.
  - anoncake 6y ago
    This issue can't be solved purely with technical measures, unless you're willing to accept major loss of functionality. The GDPR is fine, enforcement is what's awful.
jeff3dx 6y ago
1Blocker for iPhone filters most “we’re using cookies” annoyances.
marcrosoft 6y ago
We should encourage the EU to remove this ridiculous requirement.
- skrause 6y ago
  That is part of the ePrivacy Regulation (https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...) which was supposed be implemented at the same time as the GDPR, but got stuck because of (so far) successful lobbying by advertising companies: Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors.
  - awb 6y ago
    > The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. Browsers have provided this functionality for 10+ years. Why the law didn't target the user/browser level instead of the website level is beyond me.
    - notriddle 6y ago
      The browser knows that the cookie exists, but it has no way of knowing how the server is going to use it, or what the cookie is actually for. A single cookie might even be simultaneously both, and force the user to accept cross-site tracking in order for the site to work correctly. I guess there's complication zero-knowledge proofs that could solve this problem, but they're too slow right now.
      - gruez 6y ago
        >The browser knows that the cookie exists, but it has no way of knowing how the server is going to use it, or what the cookie is actually for. There was a standard for that, too. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P. There's no reason why something similar can't be implemented now.
alkonaut 6y ago
When my browser just hides the popup or banner, which setting did I choose? The GDPR is pretty clear that opting out must be the default choice, but it wouldn’t surprise me if some use a system that only follows that if it is actually shown.
- TeMPOraL 6y ago
  I wish member nations were more proactive in fining people over this, because I'd then happily report every system like that. On a related note, has anyone ever seen the corresponding consent popup that would let me opt back out of tracking cookies? I haven't. Which strikes me as weird, since consent was supposed to be as easily to rescind as it is to grant it.
  - matheusmoreira 6y ago
    I haven't seen any either. The pop ups just say "cookies exist and we use them". There is no option to say no: the only way to dismiss the pop up is to click the accept button. So not only do they not inform the user about the risks associated with this invasion of privacy which is a prerequisite for informed consent, they also take away the option to explicitly say no. Even though opting out of tracking is the default, sites are probably placing cookies and fingerprinting the user's browser on their first visit anyway before they even see the consent pop up. So ignoring the pop up is probably not a real option either.
  - livre 6y ago
    >has anyone ever seen the corresponding consent popup that would let me opt back out of tracking cookies? I have but only once, I don't remember where, it was probably an obscure site that didn't have whatever I was looking for. The pop-up was a big list of third party companies with checkboxes (Android style, slide left to uncheck) that had to be disabled individually. I don't think that was legal, consent was given by default unless I manually unchecked each box. There was of course no "uncheck all" button.
- anoncake 6y ago
  None, in the vast majority of cases you illegally weren't given a choice.
jimnotgym 6y ago
There is a really frustrating thing happening on this thread where people are downvoting answers that are technically correct, which suggests they must be simply disagreeing with the writers opinion on underlying politics. That is a sad way for hn to go.
- ARandomerDude 6y ago
  It's been that way for a very long time. I get down-voted if I say anything from a conservative perspective here.
  - ciarannolan 6y ago
    I believe you when you say that you notice you get down voted for expressing a conservative view on HN, but I seem to notice the opposite. HN has a way of defending Trump and quickly down voting direct criticism of conservatives, at least in my own n=1 experience. edit: ...and this comment was flagged. Case in point.
    - ufmace 6y ago
      Well I find that a bit odd. But I vouched your comment anyways, because I think it's better to discuss these things than try to flag and ban the other side.
      - ciarannolan 6y ago
        Agreed! I upvoted both of your comments too.
    - ARandomerDude 6y ago
      Conservative != Trump. I actually never say anything about Trump (breaking the rule here), because: (1) conservative ideas don't depend on Trump for their origin or continuance (2) Trump isn't really that conservative anyway, and (3) he is such a polarizing figure that it's almost impossible to have a rational conversation (with either side) once you mention him.
myfonj 6y ago
For "manual" cleanup I'm using slightly extended universal "Sweep Stickies" bookmarklet [1], based on idea taken from "Kill Sticky" [0]. Removes generally all those banners and overlays obscuring content and eating viewport. (Userscript available [2], but I prefer good old bookmarklet way for this.) It literally crawls all elements in page, tests their computed style and removes those with sticky position (and a bit more). Works quite well for me. [0] https://alisdair.mcdiarmid.org/kill-sticky-headers/ https://alisdair.mcdiarmid.org/kill-sticky-headers/ [1] http://myfonj.github.io/utils/bookmarklets/sweep-stickies.html http://myfonj.github.io/utils/bookmarklets/sweep-stickies.ht... [2] https://greasyfork.org/en/scripts/370572-sweep-stickies https://greasyfork.org/en/scripts/370572-sweep-stickies
TooKool4This 6y ago
Any solutions for mobile (iOS)? This problem is really painful on mobile devices where (in Safari) the popup takes up half the screen after the url+nav bars takes up a quarter leaving you with 25% of the screen to look at the actual content (with autoplaying ad videos every few paragraphs if you are lucky!) until you dismiss the popup. Argh, makes me angry just thinking about it. The web is becoming increasingly painful to use through a UI browser.
- Nextgrid 6y ago
  AdGuard on iOS works well for those (in addition to ads, social media and other trash).
  - TooKool4This 6y ago
    Wow that was awesome and super easy. Thanks for the tip, didn't know iOS Safari had an API for content blocking, I will need to explore that more.
Good_Karma 6y ago
Yes. Install uBlock Origin. Right click on ad / pop up -> Block Element ( a rule is automatically generated ) -> Create. Voila ! You might have to do it 2-3 times for the same element as it might have several layers. But then you're done and you haven't been forced into clicking. "ok"
mD5pPxMcS6fVWKE 6y ago
I use "I don't care about cookies" extension for Firefix, seems to work well.
- CawCawCaw 6y ago
  This is a great extension and also available on Chrome.
Good_Karma 6y ago
Before I discovered this ( through an HN comment as it happens ) I was just ignoring them and scrolling with the screen half-covered. Does anyone know if by just refusing to click anything you're basically ~ not opting in ? Some sites won't let you do that at all though. ( See my other comment for manual uBlock Origin method )
scarface74 6y ago
So you mean government involvement in tech both didn’t serve its intended purpose and its an annoyance to the end user? I would have never guessed....
- johannes1234321 6y ago
  The government doesn't enforce cookie banners. They enforce that there shouldn't be tracking. It's the tech companies who think it's worth while to annoy the users with coockie banners in order to be able to do more tracking (my assumption is that some make the banners extra painful as a way to steer anger towards legislature ...)
  - dilap 6y ago
    I mean, still, the practical effect of the govt legislation was to annoy countless people and waste who-knows-how-much-effort implementing the stupid banners. To argue that this leglislation would've had a good effect in some hypothetical alternative world where businesses had different incentives is beside the point! (Side note, if it were not for govt investment in the dentralized, open internet, we'd probably all be using some ungodly-advanced version or America Online. So I'm certainly not advocating govt has no place in tech!)
    - esperent 6y ago
      Another way of looking at it: the effect of the legislation has been to expose that just about every website tracks you. Websites don't have to put a cookie banner for every kind of cookie. They have to show it whenever they collect identifying data about you. If they choose not to collect info on their visitors, then they don't have to put a banner.
      - berkes 6y ago
        With most of my customers the conversation goes something like: - Customer: We must still implement that cookie popup before launch! - Me: No. You don't have to. If we just disable SomePerformanceMetrics and GoogleAnalytics, we're done: we don't need a pupop. - Me: who is using the performance metrics ATM? And who is acting on GA? How do you use them? Would this (shows three really neat Log-analyzers as alternative) suffice? - Customer: We don't use them yet. But we might want to in future. And we then we might need all that data. So we want to start collecting it now. Point is: you don't need Google Analytics, you don't need any of those 20+ tracking cookies if you actually look at it. But there's a lot a FOMO, combined with "but this is how we have always done it, so shut up". There are some rare cases where GA, new-relic, tagmanager etc are really nessecary and none of the privacy-friendly (ie no-cookie-popup required) alternatives cut it. But those are rare. I daresay that a vast majority of tracking cookies is just there because the developers/business is too lazy to take a serious look at the problem. Which is why I truly welcome more legislation that turns "collecting vast amounts of data" from "free" into a real and looming liability.
talideon 6y ago
I would recommend the Consent-O-Matic (https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic) plugin. It doesn't get rid of everything, but it does automatically fill in the forms on practically every website, and you can submit an issue to them when it misses one. I have it set up to automatically deny.
atleta 6y ago
They most of the time shouldn't be "we're using cookies (and we've planted all of them without your consent, oops)" anyway, but consent managers. But yeah, this could be handled in a more user friendly way, if there was a standard way to express the consent options (with the cookies and their functionalities) that the browsers could parse. Then the page could check if the browser handles it or if it has to fall back to what they're doing now.
- pythux 6y ago
  As mentioned in another comment, it’s actually possible: https://news.ycombinator.com/item?id=23524626 https://news.ycombinator.com/item?id=23524626
  - atleta 6y ago
    Makes sense. Actually it could very much work without the active participation of the web sites, at least for cross-site tracking. Because we can collect and identify and categorize those cookies. And now that we're talking about it, Firefox does have something similar accessible from the URL bar, called "Enhanced tracking protection".
    - pythux 6y ago
      Well, enhanced tracking protection is closer to what an adblocker/content blocker would do as far as I know. They classify some domains as trackers based on a static list from Disconnect then use that information to either block requests or enforce extra restrictions on those (like blocking cookies/storage).
rajangdavis 6y ago
Depending on how bad the warning is, it might be easier to disable javascript. Have found that this gets around some noiser news sites.
TACIXAT 6y ago
I can't believe this isn't handled by the browser. Make a standard API like the location or notification pop ups. Have a setting that says I understand what cookies are and I accept all.
- julianlam 6y ago
  The problem is you're expecting the developers and website owners to voluntarily opt-in to this browser standard. It'll probably have about as much adoption as Do-Not-Track...
  - fourstar 6y ago
    So show a warning when it’s not detected like SSL.
    - lopis 6y ago
      Wouldn't that hurt simple websites which don't track by default?
  - lolinder 6y ago
    Well, in my ideal world a browser would ask for permission before placing a cookie at all. It shouldn't matter what the developers did, my browser would detect an attempted cookie placement, notify me, and ask to verify that that's okay.
- wyldfire 6y ago
  I think most of those popups are intended for compliance with GDPR. A browser feature that eliminated the interaction might conflict with the intent of the statute.
- swiley 6y ago
  Lynx does this.
- jugg1es 6y ago
  That would also necessitate an 'accept none' option, which no corporation wants.
tgsovlerkhgsel 6y ago
In addition to taking whatever technical measures you are taking, if you're in the EU, consider also grabbing one web site that has a particularly bad consent flow (e.g. a dozen clicks to not get tracked, or a "click or scroll anywhere to consent"), and report them to the appropriate DPA. The DPAs often only work off consumer reports. You need to know that these popups are a result of two separate laws: The ePrivacy directive aka Cookie Law, and GDPR. GDPR is enforceable one that you care about. A web site can process your data (e.g. for personalized ads) for one of the explicitly given reason, the most common ones being "legitimate interest", "fulfillment of a contract" and "consent". There have been a couple recent statements about what counts and doesn't count as legitimate interest, fulfilling a contract, and consent. You also have the right to ask the controller of the data (not the processor) for a list of data stored about you. Try it with one of said web sites! Make a clean cookie jar, use the site and only the site, send them the cookie jar, and see what data they store. (If they don't, file a complaint with the DPA)
dificilis 6y ago
For people who are disabled, dismissing cookie dialogs is one extra difficult pointless thing they have to do _every_ time they visit any website. Is this a violation of human rights?
- smabie 6y ago
  Yeah, just like how movies existing that blind people can't watch is a violation of human rights.
- self_awareness 6y ago
  Which specific right are you referring to? A right to not be forced to click on a button on every website?
BurningFrog 6y ago
I never get Jehovah's Witnesses knocking on my door to talk about Jesus anymore. Instead I have the EU asking me about Cookies on every other web page.
atirip 6y ago
I use Safari User Stylesheet. This is mine: /* "custom" */ [class*="as-oil"]:not(body, html), [class*="optanon"]:not(body, html), /* "generic" */ [class*="consent"]:not(body, html), [id*="consent"], [class*="gdpr"]:not(body, html), [id*="gdpr"], [class*="announcement"]:not(body, html), [id*="announcement"], [class*="policy"]:not(body, html), [id*="policy"], [class*="cookie"]:not(body, html), [id*="cookie"] { display: none!important; visibility: hidden!important; transform: scale(0)!important; opacity: 0!important; width: 0!important; height: 0!important; z-index: -1!important; background: transparent!important; color: transparent!important; font-size:0!important; }
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
Haga 6y ago
There should be a standard api for these, we're you auto negotiate your willingness to share data.
Brajeshwar 6y ago
Try These, - For Safari, if you're using 1Blocker, in "General" > "Block Annoyances". - For NextDNS, I thought I saw "Annoyances" but could not find it now. Should have it somewhere. - Chrome have a plethora of Extensions that "don't care about cookies" or similar. Other than that, as someone else commented, uBlock Origin > Settings > Filters List > Annoyances
- fouc 6y ago
  Ugh so irritating when App Store doesn't let me install an older version of the app, need 10.15 to install 1Blocker, but if I had tried it a year or two ago, then that wouldn't even be an issue.
- pythux 6y ago
  It’s pretty unlikely that a DNS blocker (like NextDNS or others) can effectively remove cookie notices since content blockers rely on injecting custom style sheets in practice to tackle them (which a DNS blocker absolutely cannot do).
082349872349872 6y ago
My heritage is of a web that worked just fine without cookies at all.
mrweasel 6y ago
There’s an “I don’t care about cookies” plugin for Firefox, it just hides the cookie popup. It’s not perfect but works well enough.
- qxxx 6y ago
  I use this on all my machines. I even donated to support the project. It works like a charm. It removes most of these cookie popups. I wish there was a better version like someone stated directly in the browser - currently this is a mess.
ajimix 6y ago
Contact the EU and tell them to remove that non-sense rule as it makes the internet waste time clicking annoying things that nobody reads or cares.
- happymellon 6y ago
  On the contrary. I love it, because now it is illegal for me to be tracked without my consent (and my not clicking on decline is not consent), which is why American news sites block EU IPs because they can't just data mine me without my knowledge.
  - number6 6y ago
    Works as intended. It's not the regulators task to put the law in a nice UX.
  - alpaca128 6y ago
    But it could have been solved so much better, for example via the browser using the same UI as the location tracking. Then again we already have that with the "do not track" flag and that doesn't really work without real consequences.
- petepete 6y ago
  This is ad companies dragging their heels and making the UX as bad as possible. It's clearly a good tactic because you're now blaming the EU instead of the ones tracking your every move.
  - mdrachuk 6y ago
    Just disable cookies in the browser if you don’t want to send them.
    - nicbou 6y ago
      Some cookies are actually needed
lazyjones 6y ago
I use "Banner Hunter" for Safari which does just this and nothing else. Unfortunately it will sometimes leave the websites unusable because it removes the modal cookie banners but not the "greying out" layer over the content that disables it while the banner is visible...
- MaxikCZ 6y ago
  "Behind The Overlay Revival" Firefox addon solves this!
thiht 6y ago
I feel like something should have been implemented at browser level through HTML meta tags to display the cookie banner. This would allow websites to declare technical cookies that cannot be blocked and other cookies that can be blocked by the user. We could even have a standardized, native cookie banner in the same way as the permissions asked by the browser. Any idea if there's a chance to get this one day?
- onion2k 6y ago
  What if I want to block "technical cookies"?
  - thiht 6y ago
    At this point just block all the cookies with the browser setting.
    - onion2k 6y ago
      You suggested browsers should implement unblockable "technical cookies" though, when you said "This would allow websites to declare technical cookies that cannot be blocked and other cookies that can be blocked by the user." Your own suggestion would stop me blocking them in the browser, unless "that cannot be blocked" means something other than what it sounds like.
      - thiht 6y ago
        Not the point, that's nitpicking. The point is that cookie banners should be a browser component.
  - aembleton 6y ago
    Then block them. Use uMatrix or one of the other plugins to do so.
    - onion2k 6y ago
rhardih 6y ago
Still have to click to remove it the first time, but I made an extension for this very purpose: https://chrome.google.com/webstore/detail/ekill/lcgdpfaiipaelnpepigdafiogebaeedg https://chrome.google.com/webstore/detail/ekill/lcgdpfaiipae...
aembleton 6y ago
Import the following filter list into uBlock Origin: https://www.i-dont-care-about-cookies.eu/abp/ https://www.i-dont-care-about-cookies.eu/abp/
sillycube 6y ago
except giving me more troubles whether as a developer or a web surfer, I don't know what value is given by GDPR
Reason077 6y ago
The EU cookie laws were well-meaning, but have had the unintended consequence of making the web more annoying, more difficult to use, and more fragmented. We shouldn’t have to resort to ad blockers just to make the web usable again. The solution? Cookie consent should be a built-in feature of browsers and http, not something that is reimplemented in a slightly different way by every single website. Your browser should pop up a standardised cookie consent request when you browse a new site, and enforce your selection as part of its security policy. If you choose to block all cookies (ie: private browsing mode) then the cookie consent request wouldn’t need to appear at all.
- WanderPanda 6y ago
  > The EU cookie laws were well-meaning Road to hell is paved with good intentions. The EUssr is on a trajectory to making the world a much worse place in many regards...
  - qmmmur 6y ago
    Go on then. I'd rather have my privacy in their interests so predominantly American companies have less pow we to spy on me.
  - pif 6y ago
    Thus spoke idiot Brexiteer.
    - amlsP 6y ago
      Perhaps he understands things you don't. Like that living standards are falling since low wage jobs have to compete with a substantial part of the former Eastern block. Doesn't affect the rich (yet), of course.
- maddyboo 6y ago
  This definitely seems like the right solution. I wonder, did the EU even attempt to collaborate with web standards organizations and browser makers while crafting GDPR?
inimino 6y ago
At this point we're better off building a samizdat-like shadow WWW which simply loads the genuine content by using the URL as a content identifier, but without relying on the HTTP server on port 443 on the A or AAAA record mentioned in the domain. URLs are also URIs, after all, and nobody said we have to put up with broken servers being the only content resolver available.
sneeuwpopsneeuw 6y ago
Most cookie popups are using javascript so when one is popping up i use the chrome extension "Quick Javascript Switcher" to toggle the Javascript off. This does not always work but it works in most cases. I tried external list for Ublock as well. They say they will remove those things but they sometimes break things. Video's or slideshows for example did not seam to work when Ublock removed the cookie pup-ups.
blacklight 6y ago
1. Cookie policy management should be done at browser level with using standard HTML/JS constructs. Instead, everyone nowadays is doing it by adding custom HTML to their own pages to handle the panel/popup logic: they're doing it wrong, because it makes it much harder to detect which part of the page hosts the cookie settings panel. 2. Also, many of those panels have "Accept all" as a default option. Many make it purposely hard to disable some trackers without going deep down into crowded cookies preference pages. This is also the wrong way of complying to GDPR, and the sites that do it must be appropriately punished. The default should be "Deny all except for non-third-party functional cookies". 3. In the meantime, NoScript helps blocking some of that crap. If you never whitelist domains like cookielaw.com you're unlikely to see many of them.
Angostura 6y ago
> The EU cookie laws were well-meaning, but have had the unintended consequence of making the web more annoying, more difficult to use, and more fragmented. Not really. GDPR says that non-transactional cookies should default off.
spartas 6y ago
Don't drag the GDPR through this mess. It's not the fault of the GDPR that everyone decided that these cookie consent walls are the new normal. https://techcrunch.com/2020/05/06/no-cookie-consent-walls-and-no-scrolling-isnt-consent-says-eu-data-protection-body/ https://techcrunch.com/2020/05/06/no-cookie-consent-walls-an...
ghostwords 6y ago
Check out Cliqz Autoconsent: https://github.com/cliqz-oss/autoconsent https://github.com/cliqz-oss/autoconsent This is a library of rules for navigating through common consent popups on the web. These rules can be run in a Firefox webextension, or in a puppeteer orchestrated headless browser. Using these rules, opt-in and opt-out options can be selected automatically, without requiring user-input. This library is primarily used by the cliqz browser in order to automate user-consent, and make a cleaner browsing experience. There is also a standalone addon that can be installed in Firefox.
jgimenez 6y ago
I'm tired or ad blockers, they make the page usually slower to load. Even if they save you some downloading, they usually block the loading pipeline, so they end up costing you more time. I use a combination of "I don't care about cookies" to automatically accept all cookies, so websites are free to show the ads they want and send me the cookies they want. Then I use Firefox Enhanced Tracking Protection in strict mode to delete all tracking cookies as I go. It has worked great so far. Yes, I see ads, but they're not targeted and the page loads fast.

naravara 6y ago
Either an element zapper or a one click sticky-header killer should honestly be standard issue features in browsers nowadays. The web would be a miserable without them, especially on mobile.
- hydroxonium 6y ago
  One-click sticky-header killer via JavaScript bookmarklet https://medium.com/@jacob.tan.en/floating-elements-on-web-pages-annoying-48c4a0a5a2db https://medium.com/@jacob.tan.en/floating-elements-on-web-pa...
- bashinator 6y ago
  I'm just concerned that's inviting an arms race where unwelcome page elements get randomized CSS namespaces. Fuck that noise.
  - chmod775 6y ago
    In that case we could just match by the CSS rules' content - i.e. match all elements that have style X, Y, Z applied to them. That kind of arms race would be over real quick.
    - dmurray 6y ago
      The arms race is that the next time you come back to the page, the offending element has a slightly different style (randomized CSS class name, RGB values changed by 1, font size changed by 0.1...) and your browser doesn't recognise it as being the right element to block.
      - dredmorbius 6y ago
        Whitelist, not blacklist. Which whould break CSS minifiers, but that's the point.
      - chmod775 6y ago
        Match by ranges so changing values by 1 doesn't work. At the end of the day a human would have to come up with an entirely alternative style for the page to defeat your filters. Pretty much any machine generated variations can also be defeated automatically by a machine. If defeating your filters takes a lot of work, and only helps until a few days later you update your filters in a few minutes, nobody is gonna bother.
  - literallycancer 6y ago
    You can have filters that look at parent or child elements of the randomized element or other patterns.
  - FroshKiller 6y ago
    I hate to tell you this, but we're already there.
  - janitor61 6y ago
    That's already the case with sites like Twitter. In order to remove the trending pane in uBO, I had to rely on a11y attributes: ##div[aria-label="Timeline: Trending now"]
  - dorgo 6y ago
    And random structure to break nth-child selectors. Even better: draw everything in a canvas.

close04 6y ago

Wouldn't that defeat the purpose of having the choice to not allow sites to save a truckload of cookies on your computer? If anything maybe we should encourage having a "master preference" set in the browser, something like DNT (but not so easily ignorable) that just tells all websites on the user's behalf to only allow the absolute minimum number of cookies needed for the site to function. A small message on the bottom of the page could give more details or allow manual changes.

Zamicol 6y ago
The choice is programmatic. You can disable cookies on your browser. You can delete cookies you don't want. Done.
- janoc 6y ago
  The thing is, this is not only about cookies, despite the cookies being the poster child for it. The regulation applies also to all sorts of analytics, fingerprinting, behavior tracking, user tracking, etc., which is far more prevalent and problematic than simple cookies. How do you "delete" that?
  - contravariant 6y ago
    We can still establish that cookies are fine and outright fingerprinting/tracking is not, this isn't even that difficult because on a technical level cookies are the optimal option privacy-wise, in the sense that users have full control over what data is being stored, and to whom it is sent. The problem is that not everyone is aware of this choice and most browsers don't provide safe defaults.
CommanderData 6y ago
Some web admins have no choice if their CMS sets cookies. Theres plenty of content management systems that do just this. OctoberCMS for example sets a cookie for every user and there's no way of turning this off, and lots of WordPress plugins just don't care with no option to disable this behaviour . So most banners are just a notification rather than a choice. e.g. Continue to use the site and you automatically opt in. Which is not the intended goal for the law.
- kd5bjo 6y ago
  > Some web admins have no choice... Of course they do, or one of their superiors does. Computers are physical devices that do what their operators tell them to do; it’s entirely reasonable to hold the operator responsible for what the computer does at their request. That includes the overt behavior of any software they choose to run, and they always have the option to choose different software or, in the extreme case, unplug the server and discontinue service.
- M2Ys4U 6y ago
  >Some web admins have no choice if their CMS sets cookies. Then the solution is simple: Stop using those CMSes. >So most banners are just a notification rather than a choice. e.g. Continue to use the site and you automatically opt in. Which is not the intended goal for the law. That is breaking the law. Generally, people should not do that.
CuriousSkeptic 6y ago
What’s wrong with DNT? Just need some judge to determine that DNT means there is no consent given.
- close04 6y ago
  The problem is that ticking the DNT box will probably have absolutely no effect. At this point we can safely consider it dead. It barely ever saw any adoption, it was easily and "legally" ignored anyway, Apple dropped support for it more than one year ago, and even the W3C DNT working group was dissolved. Now we have GDPR which is legally enforceable (officially) so we could use the technical implementation that can automate applying it.

janoc 6y ago

EU doesn't require these BS popups. Both GDPR and the earlier "cookie directive" (the ePrivacy directive) only require user consent before setting cookies (or using other similar technologies, not only cookies) that have privacy implications (e.g. user tracking, advertising) - and then that consent can be also managed by other means, there is no requirement to have such a popup. Normal cookies required for the functioning of the website - e.g. session tracking, user input, etc. are exempted and don't require user consent. See for ex. here (the official cookie guidelines for EU institutions' websites): https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies Don't blame these BS popups, interstitials, click-through wrappers etc. on Europe, that's purely site operators' laziness, legal CYA (force these wrappers even where not required) and greed where various analytics and tracking cookies (which do require consent) are being deployed.

Vanit 6y ago
The penalty for screwing it up is 20m euros or 4% turnover - why is it not surprising that devs play it safe? This is entirely the laws fault for driving this behaviour.
- jimnotgym 6y ago
  That is not correct. This is the penalty for wilfully screwing it up, and refusing to engage with the regulator when challenged. The most likely outcome of being reported is some advice from the regulator about how to comply.
  - thereisnospork 6y ago
    > This is the penalty for wilfully screwing it up It isn't incidental that the penalty for being accused of willfully screwing it up is quite high: having to defend oneself against a 20 million dollar judgement.
    - anoncake 6y ago
      By now it should be known that doesn't happen.
      - thereisnospork 6y ago
        Says who? Even if it doesn't today, what authoritative source says it won't tomorrow? You can't act surprised when people drive 55 in a 65mph zone because 'no one gets a 20 million dollar ticket for accidentally doing 5 over.'
        anoncake 6y ago
        It's simply how things work in countries that aren't failing like the USA. Your paranoia is unfounded.
        thereisnospork 6y ago
        Yup you are right, it is definitely every website with a cookie banner that's wrong. Can't possibly be the result of regulation which protects important things like privacy. When the world disagrees with what you think should be happening the problem is not with the world but with your understanding of it.
        anoncake 6y ago
        "Eat shit! Millions of flies can't be wrong." I prefer critical thinking over appeals to the majority.
  - neximo64 6y ago
    > 'wilfully' subjective and at the discretion of the accuser. There's a saying somewhere: Simple rules give rise to complex behaviour. Complex rules give rise to simplistic behaviour.
    - anoncake 6y ago
      So you think the law shouldn't make a difference between murder and accidents either?
      - thereisnospork 6y ago
        Are you volunteering your site to be the test case?
        anoncake 6y ago
        If I had one, of course.
stupidcar 6y ago
I absolutely blame the EU for this. The job of any political organisation isn't just to blindly regulate, but to predict the likely response of the regulated industry, including in a worst case scenario. I worked in web dev when these regulations were introduced, and any idiot could see that most companies would take the laziest, safest route to complying with them, in a way that would put a massive burden of inconvenience on the user. If the EU was competent, they wouldn't have needed warning about this outcome. But they were warned, again and again and again. They chose to ignore it and screwed over their constituents for nothing.
- Nextgrid 6y ago
  The majority of these are not compliant either way because they are either "opt-out" (with pre-ticked checkboxes) or make it difficult to not grant consent/withdraw consent (declining usually requires much more clicks than accepting). What the EU did wrong is not the design of the law, it's the lack of enforcement. Enforcement of the law will fine anyone requesting consent in an annoying/obnoxious way and will clean up the current mess we're in.
- TeMPOraL 6y ago
  Well yes, I agree. They should've banned tracking cookies outright, informed consent or not. Alas, they tried to leave space for honest businesses to play with - which is always a bad idea where it comes to the advertising industry.
u801e 6y ago
> Normal cookies required for the functioning of the website If I happen to click a link on a news aggregator website like this one, then why would the website I visit (possibly for the first time) require my browser to accept cookies?
- CuriousSkeptic 6y ago
  A technical answer might be that they want to implement a policy to grant you free access to one article per week, and than demand payment to access more than that, and a cookie is simple way to do that (yes, easy to circumvent, but that’s pretty uninteresting from a legal sense) I don’t think GDPR demands “consent” for this though.
RHSeeger 6y ago
It works the same as the "cancer causing" law in CA. Because the penalty isn't worth the risk, it's almost universally considered better to include the warning even if you don't "think" you need it, because you could be wrong. And being wrong (especially when including the notice costs virtually nothing) is definitely a risky thing.

markovbot 6y ago

We should encourage websites to stop tracking us.

atleta 6y ago

This is indeed a very positive and smart move. Despite the fact that - a lot of sites just don't really play along (they'll just show you a nag popup that you have to OK, but they'll plant their tracking cookies before that anyway) - a lot of sites deliberately make it hard to opt out (this ranges from having to click around in the consent manager to outright sending you to a 20 page PDF that tells you that you can disable cookies in your browser if you want to - this, BTW, is clearly not an acceptable solution according to GDPR), don't show you the content if you don't accept all their tracking cookies (this is also illegal) - some sites just make it a bit harder than it could be (you can see the very same consent boxes on other sites with a more user friendly 'opt out all' option) - some sites do 100% OK But it turns out that 100% OK is still not good enough. This whole thing should really be managed either by the browsers or by an extension and the consent request should come in a standard, machine digestable way (XML, json, what not). You could then just set your preferences once, that should work for most sites and every now and then (but less and less frequently) you'd be asked about what to do with unknown cookies on unknown sites. In short, just because part of the industry is trying to circumvent regulation and because the current implementation is not the most efficient, we should not give up on the whole idea.

CuriousSkeptic 6y ago
Or just tweak the law. Remove informed consent as a legal basis for collecting data on web users. There are probably some context where “informed consent” is a sensible legal basis for processing data. But no-one in their right mind would freely agree to all this tracking that those pop-ups are trying trick you into. So instead of trying to make “consent” easier to give, just assume that is wont be given. I can think of two or three entities I interact with for whom I might enter such a consensual agreement with. Neither are “sites”, and the web is not the primary way I interact with them, so a browser would not be to tool to maintain those agreements.
- atleta 6y ago
  Would that mean a complete ban? I don't think that would be great. There is a lot of value in collecting statistics for the sake of analyzing user behavior. I also see the value in targeted ads and I'd say that it would probably be beneficial for the user (but I always opt out, because it's not worth it for me). Semi-automatic consenting could solve this, I think. E.g. I'm happy to provide non-tracking usage statistics for most small startups and I'm OK with Amazon tracking what I'm looking at on their site so they can give me better recommendations. But I might not know what exactly 'consensual agreement' as a legal expression means. BTW, this is pretty much the same issue as with ToS's. Some sites will try to DoS you.
  - CuriousSkeptic 6y ago
    Consent is only required if there are no other valid reasons for the tracking. Tracking required to provide a service for the user don’t require consent f.ex. So you could still get personalized ads from Amazon as service provided for you without needing explicit consent for the tracking as such. Similarly “non-tracking” analytics don’t require consent either. If you by non-tracking mean more or less anonymous. You only need consent to for processing PII that you don’t have a a legitimate interest to process.
RegW 6y ago
> a lot of sites deliberately make it hard to opt out Amusingly I've just followed a link on HN to The Economist [https://www.economist.com https://www.economist.com] - their popup offers a link to "manage your cookies" where you can untick huge numbers of them or click "Opt Out All". Great - did that, however on returning to the page found the popup still covers part of the page :-) However, we must remember Hanlon's Razor.

kristopolous 6y ago

Government is deeply involved in tech and tech is deeply involved in government. There's major mutual touchpoints just about everywhere Cherry picking an outlier, then attributing one side of the relationship as completely as fault and sarcastically implying it's generally representative isn't an honest depiction of reality. I've seen lip service to this clear misrepresentation of reality my whole life. I don't let it slide anymore. We can do better.

scarface74 6y ago
The difference is that giving the government more power is inherently dangerous. I can refuse to use a specific tech company’s product a lot easier than I can refuse to be under a government. A corporation doesn’t have the power of the state to threaten to take away property or liberty.
- strbean 6y ago
  > A corporation doesn’t have the power of the state to threaten to take away property or liberty. Questionable, and to the extent that this is true, it is because of power given to governments to ensure those rights.
  - scarface74 6y ago
    You mean the power given to unelected departments like the FTC, FDA, etc that actually create regulations or the unelected judges with lifetime appointments or the unelected officials in the Department of Justice?
    - kristopolous 6y ago
      Those obviously need to be fixed. Finding egregious oversights in the structure of our public office doesn't immediately invalidate it because we have tangible, actionable mechanisms for fixing it. Corporations on the other hand are effectively vestigial 21st century monarchies, with all the cost and benefits that comes with that. I've ran a few small ones and believe in private industry. I'm not anti corporation, but let's call a spade a spade here. Believing in bullshit never helps you in a competitive marketplace, don't do it.
      - scarface74 6y ago
        You mean fix one entire branch of the US government - the judicial branch. Or do you mean the Senate that has two senators regardless of population where someone in the Midwest has far more voting power than someone in a more populous state? Or do you mean gerrymandering? It’s not libertarianism. It’s seeing the history of biased enforcement when it comes to the “War on Drugs” among other things but even with tech, we see the government would love to get access to data and in the case of the current administration “shut down Twitter”. If the government had more control over the tech industry, who do you think they would go after?
        kristopolous 6y ago
        The government could trivially shut down the internet. They could easily raid the ICANN and IANA offices in playa vista and shut down global DNS in about an hour if they wanted. It's just a single floor, you could probably do it with 2 police officers. The chains that bind them from doing so are those of public accountability. A diligent public strangles the powers of a revanchist government. Again I agree with you there are regrettable policies that should be addressed. Governance offers us that mechanism. That's why it's preferable as an institution in deciding public policy. I'd rather have our imperfect government with their awful War on Drugs running the show than say Beyer, who marketed heroin to kids for mild ailments, or Purdue pharma which peddled opioids, you know, as late as last year, or the huxster Elizabeth Holmes or the price gouging Martin Shkreli or RJ Reynolds or any other profit seeking unaccountable entity. Replacing the FDA with say a board of Shkreli, Holmes and Purdue? Yeah, I'm sure that'd go just great.
        scarface74 6y ago
        And there you have it. When drugs were affecting the inner city it was all about “lack of morality” and being “tough on crime”. But when it started affecting “rural America” it was “let’s blame the drug companies” and “treat it like a disease”. I doubt people in the inner city or the people who “fit the description” wouldn’t feel the same way about the “War on Drugs”.
- kristopolous 6y ago
  Of course they do! Private mercenaries, prisons, banks, repo companies, landlords, insurance providers, all kinds... of course they do. Corporations were initially an arm of the state to do state functions. They still do that today. What corporations don't have is any obligation to cede to the public demand or be held accountable for their actions. There's no democratic control, no way they can be fired by the voter nor do they have any responsibility of transparency. Voting systems, red light cameras, municipal water, nearly every aspect is controlled by private corporations shirking responsibility oftentimes for decades. Polluting a town's water supply and walking away pretending they didn't - there's even many well known movies about things like this with academy awards. Often the criminals get away with it having hid under the legal fiction of the corporation. If a secretive unaccountable private corporation determining the outcome of an election and claiming the audit trail is a trade secret doesn't ruffle your libertarian feathers then there's something seriously wrong. What you claimed is yet another silly thing I've been hearing my whole life. It's totally wrong. Any inspection would immediately reveal this
  - scarface74 6y ago
    What corporations don't have is any obligation to cede to the public demand or be held accountable for their actions. There's no democratic control, no way they can be fired by the voter nor do they have any responsibility of •transparency. How well has that whole accountability thing worked out for the police department and the American military? The justice system? There's no democratic control, no way they can be fired by the voter nor do they have any responsibility of transparency. Nor can judges with lifetime appointments. Voting systems, Where conservative states consistently disenfranchise minority voters by closing polling places, passing voter id laws but then make it harder for minorities to get an ID and they count gun registrations as valid Id but not college IDs... Polluting a town's water supply and walking away pretending they didn't See the government run water supply in Flint Michigan.
    - kristopolous 6y ago
      Absolutely! Humans can be real bastards and governments aren't magical solutions just as corporations aren't magically evil. The question is about who can be held more accountable, who can be more feasibly removed from power and what kind of institution can be more promptly remedied. We as moral actors could potentially change the laws of governance probably far easier than we could form a corporation to defeat ExxonMobil in the marketplace. Both should be easier, but that's another discussion. Both governance and private capital are imperfect and both deserve criticism. Being a fan of either is a mistake.
- lmkg 6y ago
  > * I can refuse to use a specific tech company's product* This is less true than you might realize. Consider that if a friend of yours is on Facebook, they might upload photos of you and tag your name, allowing Facebook to build a profile of you regardless of whether you use Facebook or not. Consider that credit rating agencies buy your loan history in order to rate you as a customer, regardless of whether you check your credit history with them or not. Consider that Google buys your credit card purchase history to build a profile of you. Consider that Google takes pictures of your house regardless of whether you search for it on Maps. Consider that GM and Ford collect and sell your location data from your vehicle. Note that vehicles that don't do this are getting more difficult to obtain because the price of vehicles is becoming increasingly subsidized by surveillance. Technology is ubiquitous. Not all technology is a product sold to consumers, and you don't always have a say in how it's used. GDPR covers all of the above situations. Its effect on websites is peanuts. > A corporation doesn’t have the power of the state to threaten to take away property or liberty. Automated systems are currently part of the decision-making process in hiring, firing, choosing to loan, choosing to rent, policing, and determining prison sentences. A corporation that offers "fraud detection" services has a surprising amount of power over your liberty and property.
  - narag 6y ago
    ...allowing Facebook to build a profile of you regardless of whether you use Facebook or not. Why isn't there a law to prevent this while there's a law that accomplishes nothing except guarrantied annoyances? Is not the government that makes laws?
    - happymellon 6y ago
      There is, it's called the General Data Protection Regulations. Its purpose is to protect consumers from companies that surveil and track without your knowledge and permission. You should read up on it as cookies are just a tiny paragraph.
      - narag 6y ago
        My point is that it's the government that makes and enforces laws. Government is responsible for both its own misconduct and companies'.
- rorykoehler 6y ago
  Seems a bit simplistic. I'm always surprised at how really smart people revert to tribalist sound bites when it comes to politics. Power is derived from the ability to successfully enforce it. Doesn't matter who has the power.

amgreg 6y ago

Has anyone here been involved in the lawmaking process? I’m curious to know whether the lawmakers had a good grasp of the technologies. I’ve always suspected the cookie law was written by a technocrat, clueless as to how the targeted technology actually works — but I’d love to be set right.

IfOnlyYouKnew 6y ago
I’ve worked for the EU parliament, but not on this specifically. The people working on any given law (regulation) tend to be well-informed, and so are the parliamentarians that take lead roles on an issue. Part of the problem here is that websites are less-well informed on the law: session cookies, for example, do not require a warning IIRC. But many websites using only those needlessly ask for permission. One mistake in thinking by lawmakers was to assume that websites would chose to forgo third-party and long-lasting cookies in cases where they are of marginal utility. This obviously didn’t happen, partly because everyone started using cookie warnings and they therefore became normalized. It should be noted that unlike the previous iteration, the current warnings ask for consent and tend to include a not-too-difficult-to-reach option to deny it. I believe many people (and parliamentarians) that are passionate about privacy issues would also argue that the current situation is still better than quietly using your data. If you value privacy high enough, it rather quickly outweighs any annoyance, even if the latter is far more prominent in daily life.
- easytiger 6y ago
  The cookie laws have done quite literally nothing to aid privacy. As a top level comment states, browsers are much more apt to handling this than forcing websites to. Furthermore it is singularly more painful to consider that most websites do not exist within the EU. Like most of the laws sponsored by these lawmakers they are technically useless and act as little more than a hook to allow various governments to arbitrarily penalise companies they don't like. Literally no one voted for an MEP hoping for regulation of cookies on their browsing.
- amgreg 6y ago
  Thank you for this angle. This may have changed, but when I studied EU Law about eight years ago, the Parliament didn’t actually pass laws (despite the name) — I believe this was reserved for the Commission, who are unelected. If that’s right, how can we know if the Commission members who worked on this actually had a grasp of the technologies? (Real question, not rhetorical).
  - IfOnlyYouKnew 6y ago
    Only the Commission gets to initiate legislation. But after that, a majority in parliament is needed and parliament is allowed to and regularly does amend the text. “Amend” shouldn’t be interpreted to mean “lightly edit”. Any given paragraph is more likely to be changed than not in this process, and on at least one occasion parliament just replaced the entirety of a bill. The commissioners vary widely in competence both generally as well as in relation to their portfolio. There are legitimate superstars such as competition commissioner Margrethe Vestager. People disagree about some of the targets of her investigations. But even her worst critics are apt to lament her ability to get thinks done rather than doubt her skills. Then, there are commissioners decidedly lacking in competence, at least in regard to their portfolio. Günther Oettinger is a prime example here, and he was bound to head the digitization portfolio but was thankfully booted from the commission by von der Leyen taking up the German spot. These are usually long-time politicians who for some reason or other make an awkward fit for any national position, but are still too powerful within their national parties to be ignored altogether. Then, there are actually corrupt lowlights. There are far fewer of these than people assume. Look for a Maltese flag to improve your chances if you’re looking for them. Of course all of them have staff, which does the actual heavy lifting of writing bills (among other things). I hesitate to judge their skills on any absolute scale. But, purely subjectively, I’d say these teams are at least as good as any delegation from Germany, which are generally regarded as top-notch, but in my experience often carry along some bad apples they can’t get rid off because of tenure or whatnot. I don’t know the people who worked on GDPR. You can expect them to have the internet skills of any 30- or 40-year old high performer, with a degree in law or the humanities more often than STEM. So they are unlikely to have programming experience, but do probably know what cookies are. I’m somewhat struggling to come up with examples of technical knowledge that may have been missing here. In fact, I could probably summarize everything I know about cookies in less than five minutes. And while I probably lack some details, I doubt it would include anything of relevance to this legislation.

Jaruzel 6y ago

Is this true? What about shopping cart cookies, especially as a 'guest'? Does that need Cookie op-in, legally?

lozenge 6y ago
"the cookie is strictly necessary to provide an ‘information society service’ (eg a service over the internet) requested by the subscriber or user. Note that it must be essential to fulfil their request – cookies that are helpful or convenient but not essential, or that are only essential for your own purposes, will still require consent." If the site's using a common framework, convenient and essential uses will be combined in a "session id" cookie which needs re-developing, or just slap a cookie warning on it. https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
belorn 6y ago
We can look to the GDPR text itself to answer that. Is the cookie there in order to create a profile with other information in order to identify a natural person. If yes, then the company is required to treat that cookie identifier with the same care and requirements as other sensitive personal data like social security numbers, passport numbers, personal ID numbers, and so on. Law is fuzzy by nature, but it seems pretty clear that a shopping cart cookie is exempted from needing consent. Functionality of services that are expressly requested by users do not need consent, and in this case we have users that want to put items inside a cart in order to buy it. If that creates a profile on the server, and that profile is combined with other information, and then used outside the scope of the customer relationship, then we are moving into the area where consent is needed. We can draw a parallel to data collected offline. A person go to a store and talk to a sales representative about buying a product and having it shipped home. At what point do the sales person need to ask for GDPR consent? The answer is likely the point where the sales person saves a profile of that customer on the computer, and the profile is intended to be used outside the context of that purchase.
- Jaruzel 6y ago
  Thank you - clear breakdown there!

scarface74 6y ago
The US has a long history of not being “moral actors” when it comes to the rights and freedoms of racial and religious minorities and non straight people. Having a government that caters to the majority is fine if you are in the majority. We just saw the government stripping rights of transexuals with regards to health care. What would they do if they had more access to data? If you were a Muslim America would you trust the government in its current state to have more access to your data?
- kristopolous 6y ago
  I'm sure that will be addressed far faster than the 60 years it took to hold tobacco companies accountable, only possible through government.
  - scarface74 6y ago
    You mean the same government that still hands out farm subsidies to tobacco farmers? https://www.ewg.org/agmag/2018/05/thank-you-subsidizing-smoking https://www.ewg.org/agmag/2018/05/thank-you-subsidizing-smok... How many decades did it take the government to rule that it was discrimination not to allow gay people to adopt kids? Get pregnant by in vitro insemination? If you aren’t in the affected group it’s easy to tell those who are to be patient.
    - kristopolous 6y ago
      What's the point here? Mine is there's endless propaganda depicting corporate America as bright shiny perfect perfection and government as slow clunky incompetence and I'm really really tired of the bullshit. It's not academic, it's not scholarly, it's mindless partisan cheerleading, some kind of religious orthodoxy, a blind adherence to something that's obviously nonsense. It's just endless streams of nonstop crap from places line heritage, hoover, heartland, aei, cato, they're overflowing bullshit factories. Enough of that nonsense already. Governments do incorporated things and corporations do governance - they are different structures of cultural institutions that interact with each other all the time.
      - scarface74 6y ago
        Well let’s see. In 25 years I’m quite positive that I have never been discriminated against when it came to hiring working in technology. That’s from working at some of the smallest companies to some of the largest. I can’t say the same when it comes to being stopped by police when I “looked suspicious”. Given a choice between trusting Big Tech and Big Government. I trust Big Tech a lot more. Non anecdotally, who were the first to recognize the rights of LGBTQ? The government or Big Tech?
        kristopolous 6y ago
        The Kingdom of France 1791? Monaco in 1793? Prussia in 1794? When do you want to start this? Maybe 20th century instead? The October Revolution in 1917, Poland 1932, Denmark 1933? Oh you're talking LGBT protected class discrimination for employment! Pennsylvania, 1975, Wisconsin 1982? Maybe you're talking about Bostock v. Clayton County(2020) which got to the SCOTUS because a private corporation, in 2019, fired an employee for being gay. That's how it got there, a private company not respecting LGBT rights. So maybe you mean the courts? When was the first case in lgbt's people's favour? One, Inc. v. Olesen 1958. Nineteen fifty eight. So yeah, probably government. Feel free to move the goalposts around if you want. I'm pretty confident on this on wherever you decide to place them