14 ms·

We should encourage the EU to remove this ridiculous requirement.

skrause 6y ago
That is part of the ePrivacy Regulation (https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...) which was supposed be implemented at the same time as the GDPR, but got stuck because of (so far) successful lobbying by advertising companies: Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors.
- awb 6y ago
  > The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. Browsers have provided this functionality for 10+ years. Why the law didn't target the user/browser level instead of the website level is beyond me.
  - notriddle 6y ago
    The browser knows that the cookie exists, but it has no way of knowing how the server is going to use it, or what the cookie is actually for. A single cookie might even be simultaneously both, and force the user to accept cross-site tracking in order for the site to work correctly. I guess there's complication zero-knowledge proofs that could solve this problem, but they're too slow right now.
    - gruez 6y ago
      >The browser knows that the cookie exists, but it has no way of knowing how the server is going to use it, or what the cookie is actually for. There was a standard for that, too. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P. There's no reason why something similar can't be implemented now.
  - anoncake 6y ago
    Browsers don't have a way to block tracking cookies without collateral damage.
- deleted 6y ago
  [deleted]
close04 6y ago
Wouldn't that defeat the purpose of having the choice to not allow sites to save a truckload of cookies on your computer? If anything maybe we should encourage having a "master preference" set in the browser, something like DNT (but not so easily ignorable) that just tells all websites on the user's behalf to only allow the absolute minimum number of cookies needed for the site to function. A small message on the bottom of the page could give more details or allow manual changes.
- Zamicol 6y ago
  The choice is programmatic. You can disable cookies on your browser. You can delete cookies you don't want. Done.
  - janoc 6y ago
    The thing is, this is not only about cookies, despite the cookies being the poster child for it. The regulation applies also to all sorts of analytics, fingerprinting, behavior tracking, user tracking, etc., which is far more prevalent and problematic than simple cookies. How do you "delete" that?
    - contravariant 6y ago
      We can still establish that cookies are fine and outright fingerprinting/tracking is not, this isn't even that difficult because on a technical level cookies are the optimal option privacy-wise, in the sense that users have full control over what data is being stored, and to whom it is sent. The problem is that not everyone is aware of this choice and most browsers don't provide safe defaults.
- CommanderData 6y ago
  Some web admins have no choice if their CMS sets cookies. Theres plenty of content management systems that do just this. OctoberCMS for example sets a cookie for every user and there's no way of turning this off, and lots of WordPress plugins just don't care with no option to disable this behaviour . So most banners are just a notification rather than a choice. e.g. Continue to use the site and you automatically opt in. Which is not the intended goal for the law.
deleted 6y ago
[deleted]
janoc 6y ago
EU doesn't require these BS popups. Both GDPR and the earlier "cookie directive" (the ePrivacy directive) only require user consent before setting cookies (or using other similar technologies, not only cookies) that have privacy implications (e.g. user tracking, advertising) - and then that consent can be also managed by other means, there is no requirement to have such a popup. Normal cookies required for the functioning of the website - e.g. session tracking, user input, etc. are exempted and don't require user consent. See for ex. here (the official cookie guidelines for EU institutions' websites): https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies Don't blame these BS popups, interstitials, click-through wrappers etc. on Europe, that's purely site operators' laziness, legal CYA (force these wrappers even where not required) and greed where various analytics and tracking cookies (which do require consent) are being deployed.
- Vanit 6y ago
  The penalty for screwing it up is 20m euros or 4% turnover - why is it not surprising that devs play it safe? This is entirely the laws fault for driving this behaviour.
  - jimnotgym 6y ago
    That is not correct. This is the penalty for wilfully screwing it up, and refusing to engage with the regulator when challenged. The most likely outcome of being reported is some advice from the regulator about how to comply.
    - thereisnospork 6y ago
      > This is the penalty for wilfully screwing it up It isn't incidental that the penalty for being accused of willfully screwing it up is quite high: having to defend oneself against a 20 million dollar judgement.
      - anoncake 6y ago
        By now it should be known that doesn't happen.
markovbot 6y ago
We should encourage websites to stop tracking us.
- babarock 6y ago
  The 2 aren't mutually exclusive. Seriously, I wonder if adding those cookie banner impacted tracking in any significant manner, because it definitely significantly impacted the usability of the web.
  - markovbot 6y ago
    Actually, it only impacted the part of the web that is trying to track it's users. Things that didn't have cookies aren't impacted. The only world in which your statement makes sense in one where user tracking is assumed to be acceptable and something that must be done. Neither of those things are true.
    - james-skemp 6y ago
      Not OP, but I completely agree with their statement that "it definitely significantly impacted the usability of the web." As others have noted, a ton of sites seem to have just thrown the necessary JS on their site without actually seeing if they needed to, or if they did, if they could make minor changes that would remove the need. From a usability/user experience perspective, now users have these popups displaying on some number of sites that they visit, often developed with the assumption that they will be accepted by the user. Based upon some of the experiences I've had, I would say a number of teams neglect to properly test their sites as a user that has not accepted/dismissed the pop-up/overlay.
  - Jorge1o1 6y ago
    An argument could be made that cookie banners might somehow be normalizing tracking cookies too. Through enough repetition the act of opening a new website and immediately clicking away the cookie popup becomes so automatic that people don't bother to read the disclosure, think about whether XYZ site should be tracking them, whether they want to consent or not, etc. I myself am guilty of just clicking the damn thing without really thinking, and then I realize in horror that I opted-in by accident.
Nextgrid 6y ago
Remember that only cookies (or similar) used for tracking are forbidden and require prior consent. Functional cookies like shopping carts, logged-in user sessions, etc do not require disclosure nor consent. Furthermore consent is only valid if it's opt-in (and not opt-out, so pre-ticked checkboxes are not compliant) and if it's just as easy to decline as to accept (so if it takes more clicks to say no than yes then they're in breach already). Don't blame the EU for this, blame the website operators and their broken business models.
- Jorge1o1 6y ago
  Except for the part where blogs, templates, the uninformed, and the webdevs trying to CYA add the popups anyways regardless of whether or not they are needed because why run the legal risk?
  - Nextgrid 6y ago
    The way they are doing it doesn't actually comply with the law either, so the CYA aspect of it doesn't work as designed. Adding a popup doesn't do anything as far as the GDPR is concerned unless the popup allows you to decline tracking just as easily as it is to accept it (no pre-ticked boxes or anything). I believe the problem here is wrong advice leftover from the previous "cookie law" (which I agree is completely stupid) being repeated endlessly (either honestly or maliciously from the adtech/spyware industry to try and make the GDPR look more annoying to the users). I sometimes even see this wrong "advice" here on HN on GDPR-related threads.
    - perl4ever 6y ago
      I just Googled for the top GDPR myths, and one of the first hits goes to a page purportedly listing just that, but I couldn't read it because...wait for it...the pop-up wouldn't go away unless I selected Accept Cookies. Yes, they do track users.
  - geoka9 6y ago
    "CYA" == "Cover Your Ass"
atleta 6y ago
This is indeed a very positive and smart move. Despite the fact that - a lot of sites just don't really play along (they'll just show you a nag popup that you have to OK, but they'll plant their tracking cookies before that anyway) - a lot of sites deliberately make it hard to opt out (this ranges from having to click around in the consent manager to outright sending you to a 20 page PDF that tells you that you can disable cookies in your browser if you want to - this, BTW, is clearly not an acceptable solution according to GDPR), don't show you the content if you don't accept all their tracking cookies (this is also illegal) - some sites just make it a bit harder than it could be (you can see the very same consent boxes on other sites with a more user friendly 'opt out all' option) - some sites do 100% OK But it turns out that 100% OK is still not good enough. This whole thing should really be managed either by the browsers or by an extension and the consent request should come in a standard, machine digestable way (XML, json, what not). You could then just set your preferences once, that should work for most sites and every now and then (but less and less frequently) you'd be asked about what to do with unknown cookies on unknown sites. In short, just because part of the industry is trying to circumvent regulation and because the current implementation is not the most efficient, we should not give up on the whole idea.
- CuriousSkeptic 6y ago
  Or just tweak the law. Remove informed consent as a legal basis for collecting data on web users. There are probably some context where “informed consent” is a sensible legal basis for processing data. But no-one in their right mind would freely agree to all this tracking that those pop-ups are trying trick you into. So instead of trying to make “consent” easier to give, just assume that is wont be given. I can think of two or three entities I interact with for whom I might enter such a consensual agreement with. Neither are “sites”, and the web is not the primary way I interact with them, so a browser would not be to tool to maintain those agreements.
  - atleta 6y ago
    Would that mean a complete ban? I don't think that would be great. There is a lot of value in collecting statistics for the sake of analyzing user behavior. I also see the value in targeted ads and I'd say that it would probably be beneficial for the user (but I always opt out, because it's not worth it for me). Semi-automatic consenting could solve this, I think. E.g. I'm happy to provide non-tracking usage statistics for most small startups and I'm OK with Amazon tracking what I'm looking at on their site so they can give me better recommendations. But I might not know what exactly 'consensual agreement' as a legal expression means. BTW, this is pretty much the same issue as with ToS's. Some sites will try to DoS you.
rorykoehler 6y ago
They should just ban all ad tracking cookies outright and remove the cookie for good.

That is part of the ePrivacy Regulation (https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...) which was supposed be implemented at the same time as the GDPR, but got stuck because of (so far) successful lobbying by advertising companies: Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors.

awb 6y ago
> The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. Browsers have provided this functionality for 10+ years. Why the law didn't target the user/browser level instead of the website level is beyond me.
- notriddle 6y ago
  The browser knows that the cookie exists, but it has no way of knowing how the server is going to use it, or what the cookie is actually for. A single cookie might even be simultaneously both, and force the user to accept cross-site tracking in order for the site to work correctly. I guess there's complication zero-knowledge proofs that could solve this problem, but they're too slow right now.
  - gruez 6y ago
    >The browser knows that the cookie exists, but it has no way of knowing how the server is going to use it, or what the cookie is actually for. There was a standard for that, too. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P. There's no reason why something similar can't be implemented now.
- anoncake 6y ago
  Browsers don't have a way to block tracking cookies without collateral damage.
deleted 6y ago
[deleted]

close04 6y ago

Wouldn't that defeat the purpose of having the choice to not allow sites to save a truckload of cookies on your computer? If anything maybe we should encourage having a "master preference" set in the browser, something like DNT (but not so easily ignorable) that just tells all websites on the user's behalf to only allow the absolute minimum number of cookies needed for the site to function. A small message on the bottom of the page could give more details or allow manual changes.

Zamicol 6y ago
The choice is programmatic. You can disable cookies on your browser. You can delete cookies you don't want. Done.
- janoc 6y ago
  The thing is, this is not only about cookies, despite the cookies being the poster child for it. The regulation applies also to all sorts of analytics, fingerprinting, behavior tracking, user tracking, etc., which is far more prevalent and problematic than simple cookies. How do you "delete" that?
  - contravariant 6y ago
    We can still establish that cookies are fine and outright fingerprinting/tracking is not, this isn't even that difficult because on a technical level cookies are the optimal option privacy-wise, in the sense that users have full control over what data is being stored, and to whom it is sent. The problem is that not everyone is aware of this choice and most browsers don't provide safe defaults.
CommanderData 6y ago
Some web admins have no choice if their CMS sets cookies. Theres plenty of content management systems that do just this. OctoberCMS for example sets a cookie for every user and there's no way of turning this off, and lots of WordPress plugins just don't care with no option to disable this behaviour . So most banners are just a notification rather than a choice. e.g. Continue to use the site and you automatically opt in. Which is not the intended goal for the law.

deleted 6y ago

[deleted]

janoc 6y ago

EU doesn't require these BS popups. Both GDPR and the earlier "cookie directive" (the ePrivacy directive) only require user consent before setting cookies (or using other similar technologies, not only cookies) that have privacy implications (e.g. user tracking, advertising) - and then that consent can be also managed by other means, there is no requirement to have such a popup. Normal cookies required for the functioning of the website - e.g. session tracking, user input, etc. are exempted and don't require user consent. See for ex. here (the official cookie guidelines for EU institutions' websites): https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies Don't blame these BS popups, interstitials, click-through wrappers etc. on Europe, that's purely site operators' laziness, legal CYA (force these wrappers even where not required) and greed where various analytics and tracking cookies (which do require consent) are being deployed.

Vanit 6y ago
The penalty for screwing it up is 20m euros or 4% turnover - why is it not surprising that devs play it safe? This is entirely the laws fault for driving this behaviour.
- jimnotgym 6y ago
  That is not correct. This is the penalty for wilfully screwing it up, and refusing to engage with the regulator when challenged. The most likely outcome of being reported is some advice from the regulator about how to comply.
  - thereisnospork 6y ago
    > This is the penalty for wilfully screwing it up It isn't incidental that the penalty for being accused of willfully screwing it up is quite high: having to defend oneself against a 20 million dollar judgement.
    - anoncake 6y ago
      By now it should be known that doesn't happen.

markovbot 6y ago

We should encourage websites to stop tracking us.

babarock 6y ago
The 2 aren't mutually exclusive. Seriously, I wonder if adding those cookie banner impacted tracking in any significant manner, because it definitely significantly impacted the usability of the web.
- markovbot 6y ago
  Actually, it only impacted the part of the web that is trying to track it's users. Things that didn't have cookies aren't impacted. The only world in which your statement makes sense in one where user tracking is assumed to be acceptable and something that must be done. Neither of those things are true.
  - james-skemp 6y ago
    Not OP, but I completely agree with their statement that "it definitely significantly impacted the usability of the web." As others have noted, a ton of sites seem to have just thrown the necessary JS on their site without actually seeing if they needed to, or if they did, if they could make minor changes that would remove the need. From a usability/user experience perspective, now users have these popups displaying on some number of sites that they visit, often developed with the assumption that they will be accepted by the user. Based upon some of the experiences I've had, I would say a number of teams neglect to properly test their sites as a user that has not accepted/dismissed the pop-up/overlay.
- Jorge1o1 6y ago
  An argument could be made that cookie banners might somehow be normalizing tracking cookies too. Through enough repetition the act of opening a new website and immediately clicking away the cookie popup becomes so automatic that people don't bother to read the disclosure, think about whether XYZ site should be tracking them, whether they want to consent or not, etc. I myself am guilty of just clicking the damn thing without really thinking, and then I realize in horror that I opted-in by accident.

Nextgrid 6y ago

Remember that only cookies (or similar) used for tracking are forbidden and require prior consent. Functional cookies like shopping carts, logged-in user sessions, etc do not require disclosure nor consent. Furthermore consent is only valid if it's opt-in (and not opt-out, so pre-ticked checkboxes are not compliant) and if it's just as easy to decline as to accept (so if it takes more clicks to say no than yes then they're in breach already). Don't blame the EU for this, blame the website operators and their broken business models.

Jorge1o1 6y ago
Except for the part where blogs, templates, the uninformed, and the webdevs trying to CYA add the popups anyways regardless of whether or not they are needed because why run the legal risk?
- Nextgrid 6y ago
  The way they are doing it doesn't actually comply with the law either, so the CYA aspect of it doesn't work as designed. Adding a popup doesn't do anything as far as the GDPR is concerned unless the popup allows you to decline tracking just as easily as it is to accept it (no pre-ticked boxes or anything). I believe the problem here is wrong advice leftover from the previous "cookie law" (which I agree is completely stupid) being repeated endlessly (either honestly or maliciously from the adtech/spyware industry to try and make the GDPR look more annoying to the users). I sometimes even see this wrong "advice" here on HN on GDPR-related threads.
  - perl4ever 6y ago
    I just Googled for the top GDPR myths, and one of the first hits goes to a page purportedly listing just that, but I couldn't read it because...wait for it...the pop-up wouldn't go away unless I selected Accept Cookies. Yes, they do track users.
- geoka9 6y ago
  "CYA" == "Cover Your Ass"

atleta 6y ago

This is indeed a very positive and smart move. Despite the fact that - a lot of sites just don't really play along (they'll just show you a nag popup that you have to OK, but they'll plant their tracking cookies before that anyway) - a lot of sites deliberately make it hard to opt out (this ranges from having to click around in the consent manager to outright sending you to a 20 page PDF that tells you that you can disable cookies in your browser if you want to - this, BTW, is clearly not an acceptable solution according to GDPR), don't show you the content if you don't accept all their tracking cookies (this is also illegal) - some sites just make it a bit harder than it could be (you can see the very same consent boxes on other sites with a more user friendly 'opt out all' option) - some sites do 100% OK But it turns out that 100% OK is still not good enough. This whole thing should really be managed either by the browsers or by an extension and the consent request should come in a standard, machine digestable way (XML, json, what not). You could then just set your preferences once, that should work for most sites and every now and then (but less and less frequently) you'd be asked about what to do with unknown cookies on unknown sites. In short, just because part of the industry is trying to circumvent regulation and because the current implementation is not the most efficient, we should not give up on the whole idea.

CuriousSkeptic 6y ago
Or just tweak the law. Remove informed consent as a legal basis for collecting data on web users. There are probably some context where “informed consent” is a sensible legal basis for processing data. But no-one in their right mind would freely agree to all this tracking that those pop-ups are trying trick you into. So instead of trying to make “consent” easier to give, just assume that is wont be given. I can think of two or three entities I interact with for whom I might enter such a consensual agreement with. Neither are “sites”, and the web is not the primary way I interact with them, so a browser would not be to tool to maintain those agreements.
- atleta 6y ago
  Would that mean a complete ban? I don't think that would be great. There is a lot of value in collecting statistics for the sake of analyzing user behavior. I also see the value in targeted ads and I'd say that it would probably be beneficial for the user (but I always opt out, because it's not worth it for me). Semi-automatic consenting could solve this, I think. E.g. I'm happy to provide non-tracking usage statistics for most small startups and I'm OK with Amazon tracking what I'm looking at on their site so they can give me better recommendations. But I might not know what exactly 'consensual agreement' as a legal expression means. BTW, this is pretty much the same issue as with ToS's. Some sites will try to DoS you.

rorykoehler 6y ago

They should just ban all ad tracking cookies outright and remove the cookie for good.