6 ms·

I mean, still, the practical effect of the govt legislation was to annoy countless people and waste who-knows-how-much-effort implementing the stupid banners.

by dilap 6y ago

I mean, still, the practical effect of the govt legislation was to annoy countless people and waste who-knows-how-much-effort implementing the stupid banners. To argue that this leglislation would've had a good effect in some hypothetical alternative world where businesses had different incentives is beside the point! (Side note, if it were not for govt investment in the dentralized, open internet, we'd probably all be using some ungodly-advanced version or America Online. So I'm certainly not advocating govt has no place in tech!)

esperent 6y ago
Another way of looking at it: the effect of the legislation has been to expose that just about every website tracks you. Websites don't have to put a cookie banner for every kind of cookie. They have to show it whenever they collect identifying data about you. If they choose not to collect info on their visitors, then they don't have to put a banner.
- berkes 6y ago
  With most of my customers the conversation goes something like: - Customer: We must still implement that cookie popup before launch! - Me: No. You don't have to. If we just disable SomePerformanceMetrics and GoogleAnalytics, we're done: we don't need a pupop. - Me: who is using the performance metrics ATM? And who is acting on GA? How do you use them? Would this (shows three really neat Log-analyzers as alternative) suffice? - Customer: We don't use them yet. But we might want to in future. And we then we might need all that data. So we want to start collecting it now. Point is: you don't need Google Analytics, you don't need any of those 20+ tracking cookies if you actually look at it. But there's a lot a FOMO, combined with "but this is how we have always done it, so shut up". There are some rare cases where GA, new-relic, tagmanager etc are really nessecary and none of the privacy-friendly (ie no-cookie-popup required) alternatives cut it. But those are rare. I daresay that a vast majority of tracking cookies is just there because the developers/business is too lazy to take a serious look at the problem. Which is why I truly welcome more legislation that turns "collecting vast amounts of data" from "free" into a real and looming liability.
  - johannes1234321 6y ago
    You should add this question to your set of questions: "Do you really want to report all your users up to Google, so that Google sees how successful your product is and can build a competing product?" And yeah, doesn't work for all sorts of things, but as a site operator I would be careful in giving away that information out of self interest already ...
  - esperent 6y ago
    You don't even have to fully disable GA. You just need to disable individual level tracking, as far as I know.
    - smhg 6y ago
      With the anonymizeIp parameter? https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#anonymizeIp https://developers.google.com/analytics/devguides/collection...
    - berkes 6y ago
      I am no lawyer, but I was told this still is "third party tracking cookies" which is what the GDPR is about.
  - dorgo 6y ago
    >Log-analyzers as alternative You mean... no opt-in popup is required for logfiles? Isn't it also PII? IP + browser + timestamp + referrer? It's almost enough to identify unique visitors.
- m12k 6y ago
  Yup, it's very similar to what happened with Windows Vista. Those security dialogs were annoying as hell, but the real issue was that most applications were used to running with way more permissions than they really needed. Windows 7 didn't get the flak that Windows Vista got, but the biggest difference was just that applications had had time to fix their permissions so they didn't ask for admin rights that they didn't actually need.
Gene_Parmesan 6y ago
I'm just not sure how else it's supposed to work. The law says, "Can't track without consent." How else could that be put into place other than popups informing you of the use of cookies and asking for consent? I'm not trying to be a smart-ass, if someone has a better idea I'd be all for it.
- morsch 6y ago
  Just don't track.
- lopis 6y ago
  Don't use tracking tools and advertising networks that hurt people's privacy and you're good. You don't need a banner.
belorn 6y ago
The reason why companies implement those banners is that a banner talking about cookies sounds much nicer than saying: We want to create a profile of every detail we can find on you and auction that out to an advertisement network, press OK here. GDPR could have added a law against misrepresenting the profiling under the umbrella of a "cookie consent", but that would just be Whac-A-Mole legislation. Companies would just wrap the consent banner under some under pretense. A govt legislation that would actually work in practice would be to ban the practice of collecting and selling personal data. No consent, no popup, just a law making it illegal. That would have the desired practical effect and no annoying banners would ever be written. It would also be much harder politically to get accepted and people would complain that EU are draconian for not allowing consenting adults to go into an agreement where they trade personal data for service. Personally however I would prefer if EU did just that. Ban it. Make databases of personal data toxic to have and the liability if anything leaks be high enough that in practice a company like a news papers will do something else in order to earn profits.
- johannes1234321 6y ago
  > The reason why companies implement those banners is that a banner talking about cookies sounds much nicer than saying: We want to create a profile of every detail we can find on you and auction that out to an advertisement network, press OK here. The reality is even worse. The site operators would have to say "we want to give your data to google and others so they can create a profile of everything you do online." If an individual site would track how one navigates their site and see click paths that might be tolerable to some degree. (Till they use that to increase dark patterns like booking.com's "only 2 rooms left and 5 people looking at this") But giving it away, into central databanks is baaaad

by dilap 6y ago

esperent 6y ago

Another way of looking at it: the effect of the legislation has been to expose that just about every website tracks you. Websites don't have to put a cookie banner for every kind of cookie. They have to show it whenever they collect identifying data about you. If they choose not to collect info on their visitors, then they don't have to put a banner.

berkes 6y ago
With most of my customers the conversation goes something like: - Customer: We must still implement that cookie popup before launch! - Me: No. You don't have to. If we just disable SomePerformanceMetrics and GoogleAnalytics, we're done: we don't need a pupop. - Me: who is using the performance metrics ATM? And who is acting on GA? How do you use them? Would this (shows three really neat Log-analyzers as alternative) suffice? - Customer: We don't use them yet. But we might want to in future. And we then we might need all that data. So we want to start collecting it now. Point is: you don't need Google Analytics, you don't need any of those 20+ tracking cookies if you actually look at it. But there's a lot a FOMO, combined with "but this is how we have always done it, so shut up". There are some rare cases where GA, new-relic, tagmanager etc are really nessecary and none of the privacy-friendly (ie no-cookie-popup required) alternatives cut it. But those are rare. I daresay that a vast majority of tracking cookies is just there because the developers/business is too lazy to take a serious look at the problem. Which is why I truly welcome more legislation that turns "collecting vast amounts of data" from "free" into a real and looming liability.
- johannes1234321 6y ago
  You should add this question to your set of questions: "Do you really want to report all your users up to Google, so that Google sees how successful your product is and can build a competing product?" And yeah, doesn't work for all sorts of things, but as a site operator I would be careful in giving away that information out of self interest already ...
- esperent 6y ago
  You don't even have to fully disable GA. You just need to disable individual level tracking, as far as I know.
  - smhg 6y ago
    With the anonymizeIp parameter? https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#anonymizeIp https://developers.google.com/analytics/devguides/collection...
  - berkes 6y ago
    I am no lawyer, but I was told this still is "third party tracking cookies" which is what the GDPR is about.
- dorgo 6y ago
  >Log-analyzers as alternative You mean... no opt-in popup is required for logfiles? Isn't it also PII? IP + browser + timestamp + referrer? It's almost enough to identify unique visitors.
m12k 6y ago
Yup, it's very similar to what happened with Windows Vista. Those security dialogs were annoying as hell, but the real issue was that most applications were used to running with way more permissions than they really needed. Windows 7 didn't get the flak that Windows Vista got, but the biggest difference was just that applications had had time to fix their permissions so they didn't ask for admin rights that they didn't actually need.

Gene_Parmesan 6y ago

I'm just not sure how else it's supposed to work. The law says, "Can't track without consent." How else could that be put into place other than popups informing you of the use of cookies and asking for consent? I'm not trying to be a smart-ass, if someone has a better idea I'd be all for it.

morsch 6y ago
Just don't track.
lopis 6y ago
Don't use tracking tools and advertising networks that hurt people's privacy and you're good. You don't need a banner.

belorn 6y ago

The reason why companies implement those banners is that a banner talking about cookies sounds much nicer than saying: We want to create a profile of every detail we can find on you and auction that out to an advertisement network, press OK here. GDPR could have added a law against misrepresenting the profiling under the umbrella of a "cookie consent", but that would just be Whac-A-Mole legislation. Companies would just wrap the consent banner under some under pretense. A govt legislation that would actually work in practice would be to ban the practice of collecting and selling personal data. No consent, no popup, just a law making it illegal. That would have the desired practical effect and no annoying banners would ever be written. It would also be much harder politically to get accepted and people would complain that EU are draconian for not allowing consenting adults to go into an agreement where they trade personal data for service. Personally however I would prefer if EU did just that. Ban it. Make databases of personal data toxic to have and the liability if anything leaks be high enough that in practice a company like a news papers will do something else in order to earn profits.

johannes1234321 6y ago
> The reason why companies implement those banners is that a banner talking about cookies sounds much nicer than saying: We want to create a profile of every detail we can find on you and auction that out to an advertisement network, press OK here. The reality is even worse. The site operators would have to say "we want to give your data to google and others so they can create a profile of everything you do online." If an individual site would track how one navigates their site and see click paths that might be tolerable to some degree. (Till they use that to increase dark patterns like booking.com's "only 2 rooms left and 5 people looking at this") But giving it away, into central databanks is baaaad