7 ms·

The EU cookie laws were well-meaning, but have had the unintended consequence of making the web more annoying, more difficult to use, and more fragmented. We sh

• WanderPanda 6y ago
  > The EU cookie laws were well-meaning Road to hell is paved with good intentions. The EUssr is on a trajectory to making the world a much worse place in many regards...
  • qmmmur 6y ago
    Go on then. I'd rather have my privacy in their interests so predominantly American companies have less pow we to spy on me.
  • pif 6y ago
    Thus spoke idiot Brexiteer.
    • amlsP 6y ago
      Perhaps he understands things you don't. Like that living standards are falling since low wage jobs have to compete with a substantial part of the former Eastern block. Doesn't affect the rich (yet), of course.
• maddyboo 6y ago
  This definitely seems like the right solution. I wonder, did the EU even attempt to collaborate with web standards organizations and browser makers while crafting GDPR?
  • watwut 6y ago
    The way GDPR is written is partly consequence of the way cookie law treated. E.g. it is more about intent and data.
• MaxBarraclough 6y ago
  > Cookie consent should be a built-in feature of browsers and http Didn't we have that from day 1? A browser is free to disable cookies.
  • enlyth 6y ago
    The consent dialogs are not part of the browser, which is the issue because there is no standard way to block them
  • attilakun 6y ago
    Disabling tracking cookies is not the same as disabling all cookies though.
  • phire 6y ago
    Browser only allow consenting between no cookies, first party cookies and all cookies. The EU laws are more concerned about the intent of the cookies. Are they functional cookies or tracking cookies designed to reduce user privacy.
• cancerSpreads 6y ago
  >The EU cookie laws were well-meaning, but have had the unintended consequence This is all government. I'm not sure why we keep expecting anything other than regulatory capture with government intervention.
• DCKing 6y ago
  The law intended to restrict profiteering off of user behavior. Companies did not intend on having this profiteering limited, and would rather lower themselves to dark patterns and degrading the user experience. It goes to show what the real world incentives really are. The only way to get this fixed is to more specifically regulate user tracking and online advertising by tracking. There will be people who decry this, but the advertising industry has brought this on itself.
• jeremyjh 6y ago
  The problem is that they are not actually "cookie-consent". They are "track you for profit" consent. It is a misconception that is encouraged by the whole web advertising industry but there is no need under GDPR to get consent in order to use cookies for necessary features, such as an authenticated session or user preferences. You'll notice these prompts always have a link for "more information" where they explain what their actual intentions are.
• vinniejames 6y ago
  Better yet, there should be a setting to block cookies on all sites with a selective opt-in for sites you want tracking you
• amgreg 6y ago
  Has anyone here been involved in the lawmaking process? I’m curious to know whether the lawmakers had a good grasp of the technologies. I’ve always suspected the cookie law was written by a technocrat, clueless as to how the targeted technology actually works — but I’d love to be set right.
  • IfOnlyYouKnew 6y ago
    I’ve worked for the EU parliament, but not on this specifically. The people working on any given law (regulation) tend to be well-informed, and so are the parliamentarians that take lead roles on an issue. Part of the problem here is that websites are less-well informed on the law: session cookies, for example, do not require a warning IIRC. But many websites using only those needlessly ask for permission. One mistake in thinking by lawmakers was to assume that websites would chose to forgo third-party and long-lasting cookies in cases where they are of marginal utility. This obviously didn’t happen, partly because everyone started using cookie warnings and they therefore became normalized. It should be noted that unlike the previous iteration, the current warnings ask for consent and tend to include a not-too-difficult-to-reach option to deny it. I believe many people (and parliamentarians) that are passionate about privacy issues would also argue that the current situation is still better than quietly using your data. If you value privacy high enough, it rather quickly outweighs any annoyance, even if the latter is far more prominent in daily life.
    • easytiger 6y ago
      The cookie laws have done quite literally nothing to aid privacy. As a top level comment states, browsers are much more apt to handling this than forcing websites to. Furthermore it is singularly more painful to consider that most websites do not exist within the EU. Like most of the laws sponsored by these lawmakers they are technically useless and act as little more than a hook to allow various governments to arbitrarily penalise companies they don't like. Literally no one voted for an MEP hoping for regulation of cookies on their browsing.
    • amgreg 6y ago
      Thank you for this angle. This may have changed, but when I studied EU Law about eight years ago, the Parliament didn’t actually pass laws (despite the name) — I believe this was reserved for the Commission, who are unelected. If that’s right, how can we know if the Commission members who worked on this actually had a grasp of the technologies? (Real question, not rhetorical).
• dalf 6y ago
  From https://discourse.wicg.io/t/proposal-show-gdpr-popup/3433/4 https://discourse.wicg.io/t/proposal-show-gdpr-popup/3433/4 (from https://github.com/whatwg/meta/issues/126 https://github.com/whatwg/meta/issues/126 ) Quote: > This puts browsers in the direct path of legislation in any given country’s demands. Features in browsers should be based only on user needs. Only when a law absolutely targets browsers should they do anything regarding legislation. [Edit] remove the code block
  • Red_Leaves_Flyy 6y ago
    Please don't quote in code blocks.
• nnain 6y ago
  I hope EU can soon do a "Oops, we messed this one up. We're going to remove this requirement and work with browser makers on an updated set of requirements." The whole world shouldn't have to deal with the burden of one bad decision from EU. There should be a way to petition this. Imagine if this had happened due to a decision by some country like China.
  • BjoernKW 6y ago
    Unfortunately, that’s not how the EU works. Humility isn’t exactly their strong suit. Some of the most ardent proponents of GDPR have been quoted as saying that implementing its requirements is so easy that they themselves could do it and that people simply should stop complaining.
  • IanSanders 6y ago
    Web has been well broken already, at least EU tried something. I think it should be "Oops, this hasn't worked as planned and has been abused, let's try Y instead now"
• Nextgrid 6y ago
  This is yet again a misunderstanding of the GDPR thanks to the tons of bad advice around it. The GDPR requires consent for tracking technologies for non-essential purposes. It can be cookies, but is not limited to them. Local storage or browser fingerprinting fits the bill as well. Moving the cookie consent management into the browser won't fulfill the intent of the law - sure, cookies are now disabled by the browser, but what about fingerprinting or server logs? A compliant site will still need to ask for consent for those. When it comes to user experience, the regulation explicitly sets rules around how you ask for consent. Consent should be freely given so that users are not forced to opt-in (you can't force them to accept, so cookie popups where opting out is not possible or "by using this site you agree to our use of cookies" notices are not compliant). Tracking should also be opt-in, so pre-ticked checkboxes or where the flow to accept is easier than the one to decline (one click to accept, several clicks to decline) is not compliant either. Finally, functional cookies such as for shopping carts or logged-in user sessions are explicitly allowed without requiring consent nor disclosure. The problem here is not the design of the law but the lack of enforcement of it. All those obnoxious sites where you'd want to ad-block the consent popup are not compliant by default and should be fined. If the law was enforced we'd quickly see changes around this and consent popups would become unobtrusive.
  • FreakyT 6y ago
    IIRC, several sites actually got fined early on for using unobtrusive cookie pop ups, as it was ruled that people weren’t likely to notice them and therefore they didn’t count as “consent”.
    • Nextgrid 6y ago
      Unobtrusive popups are fine as the regulation also mandates tracking to be opt-in, so if you don’t notice nor interact with the popup then you don’t opt-in and there are no problems.
• rmc 6y ago
  Isn't that the point of the `DNT` header: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track ? If I set it on my web browser, I'm telling web server that I do not consent to being tracked. So they shouldn't ask?
  • Technetium 6y ago
    Unfortunately DNT is dead in the water, and has been for some time now. You are likely making it that much easier for yourself to be tracked because so few people go out of their way to turn that on anymore. An excerpt from the Tracking Protection Working Group mailing list[1]: "the TPWG working group then decided at the W3C technical plenary on 2019-10-24 to close down". Further than this, the corporations that are tracking us actively would like you tell you they don't care about DNT, and they've no obligation to respect any DNT user[2]: "The DAA does not require companies to honor DNT signals fixed by the browser manufacturers and set by them in browsers. Specifically, it is not a DAA Principle or in any way a requirement under the DAA Program to honor a DNT signal that is automatically set in IE10 or any other browser." This is point blank saying that DNT may as well be used as another way for you to be tracked, from one of the biggest places for advertising online. This is an international discussion; it's not just companies in the US[3] that feel this way either. [1] https://lists.w3.org/Archives/Public/public-tracking/2018Oct/0000.html https://lists.w3.org/Archives/Public/public-tracking/2018Oct... [2] https://digitaladvertisingalliance.org/press-release/digital-advertising-alliance-gives-guidance-marketers-microsoft-ie10-%E2%80%98do-not-track%E2%80%99 https://digitaladvertisingalliance.org/press-release/digital... [3] https://youradchoices.com/participating https://youradchoices.com/participating
• stared 6y ago
  History shows that the worst decision are "we wanted good but didn't consider the consequences". Compare and contrast with FOSTA to prevent sex trafficking (https://www.eff.org/deeplinks/2018/12/congress-censors-internet-eff-continues-fight-fosta-2018-review https://www.eff.org/deeplinks/2018/12/congress-censors-inter...). > “Anyone who thinks that the Communist regimes of Central Europe are exclusively the work of criminals is overlooking a basic truth: The criminal regimes were made not by criminals but by enthusiasts convinced they had discovered the only road to paradise. They defended that road so valiantly that they were forced to execute many people. Later it became clear that there was no paradise, that the enthusiasts were therefore murderers.” - Milan Kundera, The Unbearable Lightness of Being