27 ms·

Only 9% of visitors give GDPR consent to be tracked

• davidweatherall 6y ago
  The author's consent form is very simple and isn't using any shady UX tricks to get the user to consent. One action will opt you in, one action will opt you out. I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies.
  • shmageggy 6y ago
    Verizon/Yahoo/Techcrunch is such a blatant offender, and especially noticable because they get posted here often. Their modal is a giant obfuscation dark-pattern, and far as I can tell, there is no way to opt out.
    • beshrkayali 6y ago
      Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. I'd like to see how many websites offer a reasonable consent widget that doesn't opt you in by default, keep nothing checking but a huge button to tick and accept, or the usual million-and-one checkboxes to untick, and many other cheap tricks that even the most vigilant of consumers will fall to at some point. I use everything I can to prevent tracking on my machine. But for a general solution for everyone, I don't know what would be the answer, but I don't think it's GDPR. If it's to work, acts forbidden by GDPR need to be handled very fast, and without interaction from user nor legal mumbo jumbo. Without a zero-tolerance policy, the cheap tricks will only grow stronger. Edit: So apparently if you criticize gov/bureaucrats on HN you get downvoted.
      • rcxdude 6y ago
        All that's required is for the regulators to start holding companies using these dark patterns to account. These things aren't GDPR compliant by any reasonable interpretation, and these companies are basically trying their luck to see what they can get away with. If fines start coming to them they'll change their tune pretty quick.
        • anoncake 6y ago
          They are so blatantly non-compliant I wonder if at least some companies are actually trying to discredit the GDPR and the idea of regulation in general by annoying their users while blaming the GDPR.
          • DavidHm 6y ago
            I am sure that's at least part of the thinking. And judging from comments here on HN, it seems to be working. Just two post above yours there's a comment stating that any government solution cannot fix the tracking issue, and it can only be addressed by a company or an individual
      • black_puppydog 6y ago
        More a problem of enforcement than the legislation IMO. It wouldn't take many cases to be properly litigated before publishers would understand this is a law that is to be obeyed like any other.
        • beshrkayali 6y ago
          I honestly don't trust governments/bureaucrats to be able to come up with a solution for this issue. This is one of those problems that evolves very quickly, and the solution probably needs to be done by a private company or by each person individually.
          • oblio 6y ago
            In 2016, I think, there were 0 airplane crashes and 0 air travel fatalities. Across 200 countries, hundreds of airlines and several airplane manufacturers, probably thousands of airports, millions of flights. If you think that was an easy feat, then I don't know what to tell you. Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy. When people really care, bureaucracy works wonders. Bureaucracy is basically formalizing social interactions for a specific topic. Formalizing something ossifies it, but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain.
            • MaxBarraclough 6y ago
              > 0 airplane crashes I presume you meant commercial aviation, rather than aviation in general. Unfortunately not quite true even there. Your broader point stands though. https://en.wikipedia.org/wiki/Category:Aviation_accidents_and_incidents_in_2016 https://en.wikipedia.org/wiki/Category:Aviation_accidents_an...
              • AnthonyMouse 6y ago
                > Your broader point stands though. Well no, you've neatly disproved it. The reason it works for commercial aviation and not anything else -- not even aviation in general -- is that the bureaucratic processes used for commercial aviation incur a massive overhead. When you have a product which costs a hundred million dollars a unit anyway and can kill 300 people in one shot if it fails, you pay the cost. For anything else it's too expensive, but spending less money causes the bureaucracy to be ineffective. And even in commercial aviation, the overhead is still there, it's just capable of eating the loss. (Or maybe it isn't, given the miserable lack of competition in that industry now. And then where does that lead us on safety, Boeing?)
      • Barrin92 6y ago
        they just need to crack down much harder on websites and hand out big fines for dark patterns until the websites switch to sane defaults. It's just a question of how much the companies in question believe that the EU is going to come after them. Once the cost calculus shifts to being on the safe side it'd quickly turn into a norm, but it requires showing some teeth.
        • emn13 6y ago
          It's already happening, but slowly, slowly. The various agencies need time to get their act together, and have started with the most egregious excesses. It seems rather unlikely at this point that consent forms that apply inappropriate pressure - explicitly called out in the GDPR as invalid - will somehow escape enforcement. I'd expect invalid cookie banners to be on the chopping block sometime fairly soon. Additionally, the risks to advertisers and websites are quite large, which I'm not sure they fully appreciate (unless I'm misunderstanding something here?) - it's not that the consent form is illegal, after all - perfectly legal to have a confusing consent form. Rather, it's that all the personally identifying information thus collected is illegal acquired and held (and it's hard to argue the violation wasn't intentional, to boot!), and the fines for that can be quite large, and can be applied retroactively to whenever the GDPR came into force. Rules always get stretched, but specifically in this way sounds pretty unwise (unless they're cynically trying to have some subsidiary go bankrupt or otherwise encapsulate the risk). With any luck, the GDPR norms on this front will become global norms, but it's too early to tell.
          • hvidgaard 6y ago
            I'm pretty sure GDPR states that it must be opt-in in a non deceiving manner.
            • emn13 6y ago
              Exactly; that's the point. An opt in that is coercive is not a valid grounds for holding personal data, ergo, that data is held illegally and subject to enforcement by a data-protection authority. Doesn't matter if everyone clicked yes. A coercive opt-in isn't so much illegal; it's simply void. Having a coercive opt-in would be fine yet weird (as I understand it) if you then proceeded to only retain and process personal information to the extent you would be permitted without the opt-in. (IANAL, and only as far as the GDPR is concerned, perhaps if it's misleading enough that violates some fraud statutes somewhere, but that's a different issue).
      • tannhaeuser 6y ago
        I can only speak for myself, but actually I go to the detailed cookie settings and unselect everything I'm not ok with. In particular, I unselect ga and Fb pixel because I believe the habit of collecting visit data at an all-seeing central site isn't worth it, and actually is the major characteristic of a dystopian future that hacker culture has always been opposed to. If the consent settings are rubbish, I don't bother and leave the site; OTOH, if the settings are reasonable, I usually accept optimization and some analytic cookies. I can't stress enough how much of a game changer that is, by revealing the amount of third-party trackers on websites (in the order of up to 500 on a single site) alone. So I guess GDPR works for me. There's a lack of enforcement, though. But that could change; for example, in Germany, bored law firms (eg those not having clients currently), or anybody actually, can print money by starting an "Abmahnwelle" eg. insist on GDPR compliance within a certain period of time, then sue any site for non-GDPR compliance, all the while being entitled for compensation of their expenses if they have a cause.
        • emn13 6y ago
          It may be the German implementation is different in this regard, but IIRC the GDPR did not create a personal right; enforcement is solely at the discretion of the relevant authority. I thought that was intentional; as a way to limit frivolous lawsuits, but I'm no expert by any means - are you sure this is actually possible?
          • tannhaeuser 6y ago
            No I'm not very sure, IANAL. I just thought that "Abmahnen", for once, could actually be used for something useful when it was used to bother small sites for violating the German "Impressumspflicht" (duty to include press contact info on sites). I'm also not sure it can be legally excluded for GDPR specifically as it has been a staple of German "Rechtspflege" (procurement of law by private orgs) for a long time. I know there has been a relative recent change in jurisdiction where compensation for "Abmahnen" was denied when it wasn't carried out in good faith, but I don't believe GDPR violators can rely on that one for continuing malpractice. I also believe when GDPR was enacted in 2017, internet companies got an additional two year's period of bringing their sites into compliance.
      • probst 6y ago
        > Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. This is very much not true. GDPR isn't restricted to regulating tracking on websites. It also restricts and regulates what companies can do with the customer data they are in possession of. Through my day job I constantly interact with large enterprises (Fortune XXXX) that have vast amounts of personal data through their regular operations (banks, telcos, car manufacturers, airlines, insurance companies and the likes). Nearly without exception they go to great lengths to ensure the data is managed correctly, not used for purposes the customer hasn't explicitly consented to etc. This is as a direct result of the GDPR.
      • HenryBemis 6y ago
        So apparently we (EU) have the right to rip a new one to any big-ass company that is too mucho and gives zero shit about our Right to Privacy. I think that this got you downvoted. I also do my best to avoid tracking (Firefox add-ons, Hosts file). But up until now I had no leverage against any companies. Now they ought to be afraid when they play dirty.
      • mrweasel 6y ago
        > is pretty much useless in practice It's useless because only a few people care enough to report these violations. If anything we need a campaign to get people to start reporting sites which violate the GDPR requirement of an informed opt-in.
      • rutthenut 6y ago
        Do seem to have a lot of downvotes, yes! GDPR is about a lot more than the tracking stuff though, it is about the personal data companies hold and are responsible for, your permission to request it, the risk of fines if they don't comply. Whatever dark patterns they use for tracking logic, they are still bound to use best practice security on the personally-identifiable-information they may hold and may be fined if they do not. That is what GDPR is mostly about, as I see it.
      • black_puppydog 6y ago
        FWIW, I didn't downvote you for this. And I just upvoted for this piece of comedy: > So apparently if you criticize gov/bureaucrats on HN you get downvoted.
    • MayeulC 6y ago
      I think they're all Quantcast websites. I like that Firefox extension that adds a "I refuse" button: https://addons.mozilla.org/en-US/firefox/addon/qookiefix/ https://addons.mozilla.org/en-US/firefox/addon/qookiefix/
    • gear54rus 6y ago
      I'd like to remind you and everyone else about Firefox reader mode. Solves like 99% of this user-enslaving shit.
      • AnthonyMouse 6y ago
        And this is really the solution to all of it in the end. A user agent which is actually an agent of the user. Can't wait until first party isolation is the default in browsers.
        • anoncake 6y ago
          You can't wait till websites use first-party cookies to track their users?
      • bad_user 6y ago
        Screw that, I just close the page. If a publication disrespects their readers like that, then the content is trash anyway.
        • Sodman 6y ago
          Outside of HN, most content creators, especially professionally, don't have the option to make significant changes to the platform on which their content is published. I agree that an entire publication's site can be trash, but good writers can still write on bad platforms.
          • ViViDboarder 6y ago
            They do as much as engineers at Google or Facebook do to change their companies. That is to say, each one cannot make much of an impact, but the responsible thing to do would be to not contribute or at least openly advocate for change from within. If enough people inside shift, then change can happen.
            • Sodman 6y ago
    • osullip 6y ago
      This is what yahoo were doing in 2018 (it's my twitter) https://twitter.com/pos43/status/999606375217967104 https://twitter.com/pos43/status/999606375217967104 I found a very convoluted way of opting out: https://twitter.com/pos43/status/1001331147110957056 https://twitter.com/pos43/status/1001331147110957056 It is now 2020 and I would be interested to see if these methods have been changed to make them easier or harder.
      • dmitriid 6y ago
        OAth is still the same
    • 0xfaded 6y ago
      Check out the ublock origin annoyances list, which will block cookie and gdpr pop-ups without breaking most websites.
    • gmantg 6y ago
      I couldn't get Verizon site to show me the cookie banner. I guess the banner code lives on another domain that my uBO blocked.
  • fxtentacle 6y ago
    Thing is, if someone can show that they were tricked into giving consent when they were not willing to, then you're still in violation of GDPR. So those convoluted forms might not give those companies the legal protection they they hope for. And yes, I'd assume the "phony consent" rate to be much higher, because in some cases I also cannot find the no button and/or accidentally tap on the huge yes button on my phone when my intention was to click the tiny no link next to it.
    • mehrdadn 6y ago
      How do you prove you were tricked into giving consent to tracking?
      • gpderetta 6y ago
        I think it is responsibility of the company to show that meaningful consent was freely given.
      • fxtentacle 6y ago
        Record screen sharing of 50 people that you instruct to withdraw consent. If 5+ of them fail, you have made your point that the UI is too misleading to provide legal compliance with GDPR => they are now liable for high fines
    • VBprogrammer 6y ago
      I think those are just designed to show some attempt at compliance; muddying the waters of any future regulatory action. Perhaps because their business model is unsustainable without pervasive tracking.
  • WA 6y ago
    A lot higher, that’s why they are shady in the first place.
  • MaxBarraclough 6y ago
    > attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies If I understand correctly, this sort of trickery is forbidden by the GDPR, but so far no-one has seen any consequences for doing do.
    • iamacyborg 6y ago
      > so far no-one has seen any consequences for doing do. This is precisely the problem with the GDPR to date. Last August the ICO (British regulatory body) stated that you can't run Analytics such as Google Analytics without a GDPR standard of consent. They've yet to enforce this despite tens of thousands of non-compliant websites.
      • Silhouette 6y ago
        Meanwhile, there has been talk of permitting first party analytics cookies without requiring explicit consent for at least as long as the GDPR has been around. IIRC, even the ICO previously indicated support for that position, though I can't immediately find a reference for that now.
  • rocho 6y ago
    Yes, exactly. I hoped that he would repeat the experiment with a tricky one, like the horrendous forms served by Quantcast. In those, if you click "Reject all" nothing happens! How is that even allowed boggles my mind.
    • ginko 6y ago
      It isn't.
    • Semaphor 6y ago
      > How is that even allowed boggles my mind. It is not. But GDPR is sorely lacking enforcement with regard to tracking consent. The last time I checked only 3 cases were brought up (all in spain), and all of those would already have been illegal before GDPR in my non-lawyer opinion.
      • mpclark 6y ago
        It's a screw-tightening process. We've only just started, but proper enforcement will surely follow at some point.
    • hadrien01 6y ago
      That's the website fault. The Quantcast form is highly configurable, you can choose to display a "I do not accept" button on the first screen
      • Thiez 6y ago
        It really shouldn't be possible not to display that button on the first screen, because opting out should be as easy as opting in. Unless the first screen also doesn't have an 'accept' button, but I've never seen that.
  • amelius 6y ago
    We should have GDPR settings in the browser.
    • iamacyborg 6y ago
      Most sites already ignore the "do not track" flag from your browser.
      • alpaca128 6y ago
        The difference is that "do not track" isn't enforced at all. It would be much better to make a browser-side dialog like it's done with location tracking and desktop notifications, and also provide a checkbox in the settings. Most importantly it would take away control from shady websites to implement it on their shady terms(though admittedly giving that control to Google's browser may not be ideal either).
    • lloeki 6y ago
      You mean, like a checkbox that sends a `DNT` header set to `1`? I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header. † the consent (or rather, intent not to consent) is explicit, and although non-interactive at the site level it was interactive at the browser level until MS defaulted it to `1`. Now I'm wishing it were like those notifications/location/webcam/mic access and the dialogs were required to go through the browser itself.
      • amelius 6y ago
        > I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header. Then I think that's the best kept secret of the industry.
      • gpderetta 6y ago
        Technically with GDPR defaulting to 1 is the only correct option. MS were only ahead of the time :)
  • iamacyborg 6y ago
    An interesting paper here on the influence of deliberate dark patterns in these consent boxes. https://arxiv.org/pdf/2001.02479.pdf https://arxiv.org/pdf/2001.02479.pdf
    • smilespray 6y ago
      Thanks! This is the first proper breakdown I've seen.
  • encom 6y ago
    I was quite pleased that the cookie banner example was blocked by uBlock. As it should be.
  • Macha 6y ago
    Quantcast claimed a 91% any consent and 80% total consent rate for a sample point of a more unethical implementation: https://martechtoday.com/quantcast-reports-more-than-90-of-visitors-to-eu-domains-grant-gdpr-consent-219462 https://martechtoday.com/quantcast-reports-more-than-90-of-v...
  • bambax 6y ago
    Why would anyone consent to be tracked if given a real choice? What are the benefits? The 9% look like an error.
    • phito 6y ago
      I know people who just automatically click yes. I don't think they ever even cared to read what is says. They just have the habit to click yes to every prompt to "make sure it works"
      • Vinnl 6y ago
        I wonder what percentage would remain if the no-consent button was the primary button (filled button, saturated colour, bold font, etc.) and the consent button the secondary (outlined or transparent background without a border, regular font, etc.). I can't imagine it going much above 0, and I'd even guess that the ones who do consent intended not to consent but are expecting it to be the de-emphasised button.
      • dwild 6y ago
        He switched the yes/no button position... they would have automatically click "no" instead...
      • AnIdiotOnTheNet 6y ago
        Decades of bad UI design have trained people to click away these kinds of things without reading them. Even people like you or I who should otherwise know better frequently do it.
    • Angostura 6y ago
      I consent to website 'Measurement' cookies - I'm happy for most websites to do statistical analysis on their visitors. I opt out of marketing cookies etc.
      • RealStickman_ 6y ago
        The author of the article mentioned a GDPR compliant alternative to google analytics that doesn't require users to give consent for tracking simply by not relying on personally identifiable information.
  • hfyksehuefs 6y ago
    airbnb is one of the worst offenders of making it impossible to opt out UX wise. They give you a list of like 30 individual cookies to opt out of - so 30 clicks to opt out and no way of disabling all at once. For a company that prides itself on design and UX this is appalling.
  • ElLapidas 6y ago
    Non-obvious buttons? If the end user is dumb we shouldn't blame the companies.
    • thombat 6y ago
      Any contract should be a meeting of minds, not a cheating. So on the other end of the spectrum from manifestly dumb user is woefully deceitful company. The latter will make the button very small, low contrast, and place it in the middle of a wall of EULA text, and have it reject keyboard focus change so pressing TAB won't light upon it. I think we can blame that company. The old-school equivalent was small print, and in many jurisdictions there are limitations to how small a font can be used (e.g. no smaller than half the main body size and no smaller than 8 point).
  • 8fingerlouie 6y ago
    The latest trend in dark UI GDPR patterns is presenting an endless list of things that will track you. It starts with "allow necessary cookies" enabled, and the rest disabled, and presents 3 buttons, a 2 small gray ones and a big green one, and unless you're REALLY careful, you'll end up accepting all cookies. The text is something along the lines of "Cancel", "Save Changes", and finally the big green one is "Accept all cookies". The trick here is that the small gray "save changes" button is actually the one you want, as the "accept all" effectively enables ALL cookies.
    • jnxx 6y ago
      The problem is that companies which do that kind of dark patterns are very likely to ignore your settings anyway in the future. Like, for example, Amazon. What then comes to my mind is the thought: "Well, would I try to do an ongoing delicate business with a well-known notorious asshole and trickster?". Obvious answer is "no". So, in most cases, I just leave that site.
      • 8fingerlouie 6y ago
        Anything that refuses to let me view content without setting cookies is ignored here. Sorry, no matter how good your content is, it’s not that good. Shady sites that use dark patterns are about to go the same route. And I have privacy badger, uBlock origins, as well as Pi-hole/PFBlockerNG (not at the same location). Our phones have ad blockers as well, though I doubt they’re as effective.
  • levosmetalo 6y ago
    > I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies. I don't wonder about their numbers, it's obvious their numbers are good for them. What I wonder is how are they getting away with something that is clearly illegal. As already explained, in properly implemented GDPR survey, it should be equally easy to accept, decline or ignore tracking, with the default being decline if user doesn't give explicit consent.
  • rpastuszak 6y ago
    > I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies. I wonder what's the best of shaming/reporting these examples and if an effective way exists[1]. If you have any ideas, sources, anything—please share. GDPR consent screens are pure dark UX. Yes, sometimes the information/actions are buried under a dozen of useless screens, but in some cases these changes are fairly subtle, like reversed the 'active' and 'inactive' states for Reject and Accept buttons on mobile, or things glitching, just a little bit. There's an obvious effort put into make things not only complicated, but also buggy. So _fear, uncertainty and doubt_ all over again. As someone who worked both on GDPR/Adtech/consent frameworks and privacy I still struggle to understand how some of these things are legal and what can we do to change it. [1] Digression: Publisher pressure is one potential solution, but a limited one. Some premium publishers don't want to be associated with this kind of creepy UX. But, at the same time until we've completely killed cookie-driven behavioural targeting (and the alternatives, behavioural, not contextual) higher CPMs/ad revenue will keep the other publishers quiet. Ironically, behavioural targeting is mostly bullshit, and CMPs inflated, but that's a different story.
    • richardwhiuk 6y ago
      It's not clear to me that the dark UX forms are legal.
      • rpastuszak 6y ago
        It doesn’t seem to matter: https://arxiv.org/abs/2001.02479 https://arxiv.org/abs/2001.02479
        • richardwhiuk 6y ago
          Huh? That says that only 11.8% are lawful. Obviously this is all pending enforcement actions actually taking place, but it's not obvious that will never happen.
    • 6y ago
  • fnord123 6y ago
    Reddit doesn't have a consent form.
  • sgustard 6y ago
    How do you remember the user has opted out of cookies without storing a cookie? Does anyone have an example of a site with a clear opt-in/out? I'm curious about what's actually stored on my machine in each case. And of course it's not really what's stored locally that's the issue: it's what is stored on their server.
    • sjogress 6y ago
      Opting out of tracking is not the same as opting out of cookies. Per the GDPR a site is still allowed to set any cookies required for the site to work, including a "tracking consent cookie".
• bewareandaware 6y ago
  I must say I'm really surprised. I'm a frontend developer and probably more keen to keep an eye on this stuff but there are lots of times where I just say yes because the popup is in-my-face and I just want to scroll to the content. I guess where the article falls flat is where the author says a "proper GDPR content banner" was implemented. No online publication will do this. At least they will trick you with button colors, or some kind of double negative mind trick. Sometimes they will require you to tick all the checkboxes out. GDPR was a good idea from the start but it's implementation is rather dull - they shifted responsibility to each country without penalization for relaxed enforcing, and now there are countries like mine (Portugal) where we have less than a hundred fines.
  • _Understated_ 6y ago
    > but there are lots of times where I just say yes because the popup is in-my-face and I just want to scroll to the content. I am exactly the same. I use UBlock Origin and Privacy Badger so pretty much nothing gets through anyway but just to get rid of the banner, I click on OK. However, that being said, I only do it if the other choice is "Manage Preferences" or something equally vague: If I am given a clear yes-or-no choice, I always choose "No".
    • afiori 6y ago
      I sort of think this kind of behavior is problematic. I also do it often, but for example Gitlab offers some level of tracking: Necessary, Functional, Performance, and Personalization with the first three preselected. there is also a Show details for more information. I see no reason to turn off Performance and Functional in most cases.
    • 8fingerlouie 6y ago
      > I use UBlock Origin and Privacy Badger so pretty much nothing gets through anyway And yet the cookie is still there and can be used to track you. They don't need to serve you adds to track you. A simple check for the presence of the cookie is enough to track.
    • RealStickman_ 6y ago
• cm2187 6y ago
  Unless they do browser fingerprinting, the number will be overinflated by all the people like me who clear their cookies regularly, if not on every browser session, and are therefore re-asked consent on every single visit.
  • innocenat 6y ago
    I'd imagine the people who do that to be a very small percentage.
    • lysium 6y ago
      I know many people who only browse in incognito mode.
      • smilespray 6y ago
        I do, too, but fingerprinting still works for these people. In fact, using Incognito Mode is part of the fingerprint.
  • afiori 6y ago
    that should not matter, the obvious choice would be to ask every time until they say yes. It is also the simpler choice, if the user opts out of all tracking then you cannot track their choice.
    • tuco86 6y ago
      1. opt out is not gdpr conform. 2. saving a cookie no_consent=true does not require consent by the user. that's the type of cookie easily classified as functional/necessary
      • afiori 6y ago
        if the users opts out of your opt-in pop up, then :) > saving a cookie no_consent=true does not require consent by the user. that's the type of cookie easily classified as functional/necessary It looks like an unusual choice for the website. Assuming that the intention of the website is to use all the trackers that it is asking to use going out of their way not to ask the user to be tracked seems counterproductive. Sure the website is also interested in not annoying the users to death, but then it sounds a better idea to offer less invasive prompts and more informed choices than a blanket yes/no. Here again I feel like gitlab made fanstastic choices for their prompt.
• PaulKeeble 6y ago
  I am not convinced that GDPR will ever really be enforced. Severe breaches have mostly been ignored so far and the minor dark patterns that dominate GDPR compliance popups and wrong defaults are going to be the tail end of compliance enforcement. Just like cookie laws before it GDPR will probably just make websites annoying with obnoxious implementations and remain largely unenforced until the EU does something else to try and fix this class of data problems and the cycle will continue.
  • locallost 6y ago
    One really incredibly annoying trick that I see more and more is when they pre-check only the "mandatory cookies" option, but then when you want to confirm this selection you end up allowing all tracking cookies. It's because they make the confirmation button less prominent, and something that looks more like the typical confirm button is actually "allow all cookies". I guess a lot of people just click on it automatically. edit: sorry, replied to the wrong post
    • PaulKeeble 6y ago
      There are a lot of dark patterns. The most common stuff I am seeing (and its basically everwhere) are: 1) Accept being brightly coloured and decline as white so its less prominent. 2) Having accept all be a simple thing but decline being a more information that requires turn lots of individual things off. 3) Requiring the decline to be individual across hundreds of individual cookies. 4) Clicking accept all is stored and used forever but decline is asked everytime you come back to the website. 5) Having the decline process take minutes to complete as if significant processing is required. 6) Having the default be acceptance. I think breaches of GDPR are the normal, 95% of the websites I see these popups on is breaking the law in some way or another and at this point have been doing so for years.
  • a_imho 6y ago
    It won't be enforced as long as the incentives with the power to enforce are not aligned with the users. Probably never.
• cpcallen 6y ago
  Ironically, if you disable cookies in your browser you won't be able to see the images in this blog post.
  • sergeykish 6y ago
    Not in my case (Chromium, uMatrix block cookies)
  • RealStickman_ 6y ago
    Works for me on Firefox mobile with cookies blocked in the settings.
    • drcongo 6y ago
      Works for me in Safari with cookies blocked too.
• argon81 6y ago
  Wait. You tracked users after they opted out of tracking? How else did you get this data?
  • iamacyborg 6y ago
    You can track things anonymously in a way which complies with the GDPR without requiring consent.
  • abofh 6y ago
    Counters are not pii
  • GlitchMr 6y ago
    It's not personal data, so it's not under the scope of GDPR.
    • BeniBoy 6y ago
      Yeah, no. This about the ePrivacy directive, if you don't have proper consent, you can't read/write tracers regardless of wether this is personnal data or not, except for tracers needed to establish the communication or demanded by the user (carts, login, etc). EDIT: Thought about it, and if you only record the button click and does not identify the user, it works, and I am wrong! In general ePrivacy is very restrictive, only about access to terminal and not about personnal data ( and btw PII is not a GDPR thing, we say personnal data), but here it's ok! So yeah, no to me!
      • crawlcrawler 6y ago
        GDPR defines what is PII and then regulates when companies may use PII. A page visit counter collects anonymous data. Anonymous data is not PII. You cannot tell I was their 345th visitor. >> Yeah, no. Exactly.
      • kevsim 6y ago
        There’s no tracer. Just a counter of how many said yes vs how many said no. There’s no personally identifiable information there
• Fiveplus 6y ago
  The article says mobile users are more likely to engage with the banner. Rightly so, cause it takes up precious screen real estate. What are some ways I can protect myself more when browsing the web through my phone?
  • encom 6y ago
    Depends on the phone, but generally you can't protect yourself as well as on PC, because phones (sadly) are locked down devices running proprietary software. Best you can do is probably DNS-level blocking.
    • maest 6y ago
      Firefox on Android with ublock works just fine.
      • distances 6y ago
        Additionally, set Firefox to clear all data when selecting Quit from the menu. It's then easy enough to do a reset of any lingering bits every now and then.
  • tuco86 6y ago
    if it's an android, I'm very happy with firefox + ublock.
  • opportune 6y ago
    I believe Firefox focus on iOS removes many banners or at least makes it so a consent to tracking doesn’t effectively do anything, by disabling tracking/making it easy to wipe.
• lessname 6y ago
  Still, many web sites make it hard for their users to opt out tracking.
  • cuu508 6y ago
    Or, they set their cookies first and then ask. Or, they don't ask anything, and just set their cookies. (case in point: each and every status page by Atlassian Statuspage)
• dr_dshiv 6y ago
  GDPR opt-in questions train people to accept forms without reading or thinking. I think this will be dangerous. And I'm really irritated that I can't access local news sites in America because they aren't compliant -- so they blanket ban European access. That's deeply problematic.
  • duckington 6y ago
    Agreed. I'd guess for ~90% of web users, GDPR popups have lost all meaning. The thought process is not about opting in or out, it's more "how do I close this popup as quickly as possible?".
  • Mirioron 6y ago
    >And I'm really irritated that I can't access local news sites in America because they aren't compliant -- so they blanket ban European access. That's deeply problematic. The usual answer I get when I complain about this is either "It doesn't happen to me" or "They wanted to steal your data. You're better off without being able to use their site." I've yet to be convinced by either argument as a European. It's almost like a knee-jerk reaction by some Europeans that if Americans do something we don't like then they're automatically in the wrong.
    • afiori 6y ago
      I personally see as usual business of the internet. Every country has their rights to regulate internal markets and every company need to decide how many markets to cover. Personally I like GDPR more than no-GDPR and think that it would be nice if the US had a GDPR compatible regulation (as in the EU and the US diplomatically agree that it is enough for US company to respect the US regulation and for European companies to respect the GDPR to be compliant under both). On the other hand as laws stands I appreciate that they take this law seriously, even if not in the way I would like most. Overall I do not think that losing access to local US news sites warrants remaining in a GDPRless world
      • Mirioron 6y ago
        But it's not just local US news sites. Plenty of other businesses won't do business with Europeans as a result. Even video games shut down over this (Ragnarok online, I believe). But the real question is the signal GDPR sends - how many online businesses will simply not get created (especially in Europe) because of GDPR? The nebulousness of the situation is why I've decided to not create at least one website before. I'm sure the lack of my website is no loss for the world, but what about others? And keep in mind that none of this will actually save your privacy. A Chinese service could steal all of your data, sell it, and nothing would happen because they're outside the jurisdiction of the EU. The only thing that will save your privacy is not giving out the information in the first place.
• PietdeVries 6y ago
  How cycnical - an article further down (Two young scientists built a $250M business using yeast to clean up wastewater) links to Forbes.com that indeed allows me to set my tracking preferences.However, anything other than 'accept' will result in a message stating 'we are processing the request <snip> this may take up to a few minutes'. So they can set hundreds (yeah - that is right, I have seen pages tell me they wanted 500+ cookies to set, some of them to last 20 years) of cookies in a second or so, but will take minutes of me waiting for the page to show while they 'process my preferences'?!?
  • ginko 6y ago
    All that stuff is gone if you block javascript on forbes.com
    • monadic2 6y ago
      I’m rather shocked they allow viewing content without it.
      • rightbyte 6y ago
        Probably a bug.
        • ShinTakuya 6y ago
          More likely they know most users won't do it, and it probably aids in some SEO or something.
  • Silhouette 6y ago
    This is like the companies that mysteriously lack the ability to unsubscribe you from their mailing lists in less than 30 days, even though plenty of us manage to run systems that normally do it in real time.
    • jtnjns 6y ago
• chrisacky 6y ago
  I signed up for a new account on a fitness website yesterday. They track health and food and diet you enter. anyway, during the sign up they had a opt out, I chose to do just that, however the opt out process then took over the screen with a modal window, which gave a loading bar and took about thirty seconds to complete... But guess what... There was a big CANCEL button. I couldn't perform any action during sign up and opt out. This was one of the worst dark patterns I've seen. PS. The app was MyFitnessPal which i registered on recommendation but that felt so shady.
  • Tarq0n 6y ago
    There's a Germany-based competitor to myfitnesspal called Yazio that has a good privacy policy. Don't know if their database of nutritional information is as good in your location though.
  • jiveturkey 6y ago
    for apps like this why does anyone sign up with their real name, email, and/or demographic info? get a throwaway email and there you go. i can't remember the last time i used my real info or email. although there was a case just last week where a site "needed" my phone number. in 2 seconds flat i decided i didn't need that service. of course without a legit email you can't, or it's much++ harder for account recovery, but i can live with that.
  • vorpalhex 6y ago
    I use "LoseIt" since MFP went overboard with having features and not a single UI/UX review.
    • acheron9383 6y ago
      It really is impressive how many taps it takes me to do anything in MFP. Why are there so many damn menus, I just want to input calories and see a counter. It is so overly complex I just switched back to a legal pad and doing the math by hand, it is faster.
  • mikestew 6y ago
• black_puppydog 6y ago
  Assuming for a moment that the test websites didn't give a specific reason to trust them more or less than any other website operator. This means that if your website has significantly more than those 9% consent, you're either perceived as very trustworthy, or your GDPR banner is confusing (or, less charitably, deceiving) users. Would be interesting to see how the consent rates for big offenders like techcrunch, newspapers etc are. IIRC there were specific studies about which brands are trusted by consumers, and Comcast et al. didn't fare all that well in those.
  • rightbyte 6y ago
    I tried Tech Crunch without adblocker and I would have to click out 16 "partners" after clicking "read more" two times. There is like hundreds of "IAB Partners" of which an unspecified amount need separate opt-out on their websites. It is not clear if "select all" opts out or in on the "IAB Partners". So I guess exactly zero visitors opt out there in the intended way. So 100% "opt-in". I tried to opt-out from all to see how many cookies would be set anyway but gave up after 5 minutes.
    • 3131s 6y ago
      Yes, I've also seen the GDPR notices where there is no "select all" function and you have to manually disable hundreds of separate options.
• amelius 6y ago
  The real question is: is the other 91% not being tracked?
  • smilespray 6y ago
    Of course they're being tracked through any and all means. The whole adtech biz is one big shady shitshow. You can probably count the ethical, law-abiding adtech firms on one hand.
    • distances 6y ago
      I work on mobile apps, and I can promise there's no tracking on the apps I've been building if you opt out. The SDKs I've seen seem to do what they promise: no communication to backend when tracking is disabled. Of course, I can only speak for the apps I've been building and SDKs I've used.
      • smilespray 6y ago
        Do you have to explicitly opt out to stop tracking? If so, are you sure your apps are GDPR compliant?
        • distances 6y ago
          They are not my apps per se, that part is for the company lawyers. I'm just taking care of the technical implementation. It's always some way of opting out/opting in during the onboarding.
• grx 6y ago
  Regarding "engagement rate": is your banner filtered by ad blockers? In my session, there's no banner displayed. Could also be a hint on why mobile browsers are more likely to enable engagement, since they might lack CSS filtering techniques (used to hide the banner). Other point: third party hosters. It's good to see you as the website creator put effort into GDPR compliant behaviour! Did you also include Netlify and your GDPR-provider into the evaluation? Do they use additional tracking technologies? btw, your post was copied to https://www.facebook.com/BloggersWorldToday/posts/623836871864402 https://www.facebook.com/BloggersWorldToday/posts/6238368718... fyi
• lowwave 6y ago
  If allowed. NO Body, and I mean No Body wants to be tracked in any kind of way.
  • hobofan 6y ago
    Sure I do. I opt into any kind of "voluntary user experience research" tracking that a lot of desktop apps offer. As long as a website does the same thing (and doesn't try to gather PII to tie it to my identity), I'm also open for it.
  • skrebbel 6y ago
    This is nonsense. I mind Google data hoarding as much as everyone else, but if a website or app uses a Mixpanel type tool to see which features people use, then I don't think that's immediately evil.
  • jaekash 6y ago
    At this point I would accept some EU bureaucrat putting a surveillance camera in my bedroom if I never have to click another GDPR popup ever again.
• Paianni 6y ago
  Surprised no one has mentioned the systems that, if opted out of, redirect users to a 'privacy policy' page and won't allow access to content without opting in. Or the sites that don't bother with compliance and just show a message to the effect of 'this site operates under a jurisdiction that may have different privacy laws to your country' and leaves it at that.
  • Fradow 6y ago
    Those very much falls in the shady part. The first option, redirect, is not GDPR-compliant, because then the "consent" cannot be considered freely given, and thus is not valid The second option is really borderline, and could work out for a US-only news website, for example (arguing it doesn't cater to European residents), but would be non-compliant for a business which knowingly serve European residents.
    • tzs 6y ago
      > The first option, redirect, is not GDPR-compliant, because then the "consent" cannot be considered freely given, and thus is not valid. I don't quite understand the reasoning on that one. In Europe, and pretty much everywhere else, there are a bazillion interactions every day in the form of one party offering to provide some good or service only if the other party agrees to something. For example, the grocery store will only give me food if I agree to let them charge my credit card. Why is consent considered freely given when I give someone money for a good or service because if I do not do so they will not provide the good or service, but not freely given when I click "agree" on a privacy policy disclosure because if I do not do so they will not provide the good or service?
      • elliekelly 6y ago
        Under GDPR consent can’t be “freely given” when it’s bundled as a condition of service unless the consent they’re asking for is necessary in order to perform the service. To use your example: The grocery store doesn’t need to ask if you consent to paying for an apple because if you didn’t consent there wouldn’t be any transaction to perform. Now if you paid for your apple and the cashier said okay hand over your phone so I can poke around a bit because there’s some fine print that says by nature of walking through the front doors you agree to allow the store to look through your phone. Did you consent to that? Of course not. Consent wasn’t “freely given” because the store is requiring you disclose information (the contents of your phone) as a condition of service (you can’t even walk through the door without “consenting” let alone make a purchase) and that information isn’t necessary in order for the store to complete the transaction. GDPR says they have to ask you first (usually in the form of a giant irritating banner as soon as you walk in the door) and that if you say no they have to let you buy your apple anyway.
• K0nserv 6y ago
  This research is interesting because it's highly relevant given Apple's upcoming changes to tracking consent in iOS 14. Unlike the DNT[0] header Apple are in a position to enforce apps actually respecting the users consent preference, either by technical means or by kicking offending apps off the App Store. The walled garden has many problems but this is one of the benefits. Given that almost all apps and websites have implemented GDPR's consent management in a supremely user hostile way[1] that is far from an equal binary choice I suspect we'll see much higher opt out rates in iOS 14. I've seen people argue that users will just continue to click accept at high rates as they do with current consent management solutions, but I think this is the wrong analysis. Users click accept precisely because the amount of effort required to opt out is unreasonable, when both options require equal effort the number of users clicking accept will plummet. 0: https://en.wikipedia.org/wiki/Do_not_track_header https://en.wikipedia.org/wiki/Do_not_track_header 1: https://twitter.com/K0nserv/status/1279361112627167234 https://twitter.com/K0nserv/status/1279361112627167234
• rezeroed 6y ago
  And a large proportion of that 9% is tricked with misleading labels on buttons.
  • RealStickman_ 6y ago
    There are three buttons with very clear functions in the popup the author used.
    • rezeroed 6y ago
      In general.
• TekMol 6y ago
  I would say that it means 9% of visitors "click away" any banner they see without reading it. And usually clicking "yes" will do away the banner in the most hassle free way. I am surprised the number is so low. I surely click "Yes" on any banner immediately without reading it. My guess is that the number was so low because his banner (by its simplicity) looked unusual enough that many people read it. With the typical spammy pseudo consent banner, the number would probably be much higher. Even without dark patterns. People are just trained to click yes.
  • jiveturkey 6y ago
    well, that is the article's point. i mean one of it's 2 main points. (the other being itself an ad/SEO).
  • dottedmag 6y ago
    I'd be interesting to perform another test, with "No" and "Yes" buttons swapped (and the banner text updated accordingly).
• billysielu 6y ago
  We value your privacy. Accept.
• Angostura 6y ago
  I'm one of those strange people who will happily opt in to your Measurement cookies and opt out of the other stuff.
• franciscop 6y ago
  I tried your website Metomic and I really like the preview example! The preview, overlay, etc. is very well done.
• dariosalvi78 6y ago
  is this the end of tracking in the ads industry? Hopefully so.
• lmilcin 6y ago
  I would say of 9% who gave consent the vast majority gave their consent through error, deceit or because they don't know what tracking really means and they wanted the service anyway. Why not outright outlaw opt-out tracking and be done with this silly state of things? There are legitimate uses of tracking and any company would still be able to provide it for the users, but you would have to have legally binding contract and opt in for the service.
  • Nextgrid 6y ago
    Tracking already has to be opt-in according the GDPR. The issue is that the GDPR is not enforced so sites get away with non-compliant consent prompts.
    • WealthVsSurvive 6y ago
      The issue here simply seems like enforcement needs to be formalized to be as cost-effective and simple as possible. It starts with fines, ramps up to full investigations if bad faith is shown. Turns out when you write laws they also need to be enforced.
• AnthonyMouse 6y ago
  I wonder how much of this is the Lizardman constant. Do people even exist who actually volunteer to be tracked in exchange for nothing?
  • WealthVsSurvive 6y ago
    No, the entire transaction relies on coercion and/or deceit. If companies aren't going to listen, maybe it's easier to just ban any sort of unnecessary tracking across the board in order to cut down on enforcement costs, so it stops becoming a process and more of a draconian whip. We tried the carrot, it's time for the stick!
• sergeykish 6y ago
  Why would one need GDPR consent for blog? Privacy Policy should be enough for server logs (without PII). It would be nice to have standard Privacy Policy though (like we have MIT, BSD licenses).
  • nicbou 6y ago
    I run a blog. It has Google Analytics. I could probably host my own analytics solution, but that's not easy. I'll get to it eventually, but content benefits my users more. I need analytics because this blog pays the bills. I need to see what works and what doesn't. When building partnerships, I'm usually expected to share some numbers with them. It also lets me spot issues with the website.
    • sergeykish 6y ago
      Thank you, I understand convenience for author / inconvenience for reader. I do not use Google Analytics but it looks like it is possible to disable Cookies [1], anonymize IPs, disable data sharing with google [2]. Effectively making it almost third party server logs analytics (no consent required). Would remaining functionality be sufficient for you? [1] https://law.stackexchange.com/questions/36105/can-usage-of-google-analytics-without-consent-be-considered-a-legitimate-inter https://law.stackexchange.com/questions/36105/can-usage-of-g... [2] https://law.stackexchange.com/questions/35528/is-it-really-possible-to-use-google-analytics-without-consent-and-if-so-why-ex/35587#35587 https://law.stackexchange.com/questions/35528/is-it-really-p...
      • nicbou 6y ago
        Yes, that would be far more than I need. That's the problem, actually. I could track a fraction of that and be really happy. I tried Plausible today, but their event handling is completely insufficient for my needs. It's basically a key-based counter. The keys have to be created in advance, and can't be categorised. This means I couldn't track outbound clicks without first creating a new event for every known URL on my website. It just doesn't work. It's a shame, because I loved every other aspect of Plausible.
• pyepye 6y ago
  Before I found out about ublock origins filter lists I always wanted to opt-out of these GDPR cookie banners, modals etc but I got a lot of fatigue having to follow all the steps for each website. I tried to make an open source extension to try and do it for me: https://github.com/pyepye/GDPR-opt-out https://github.com/pyepye/GDPR-opt-out Although I hit a snag where some GDPR banners / buttons didn't return when using `querySelector` in the extension but do when you use the inspector / console and do it manually. Does anyone know why and how to work around it? It was always something I wanted to know why but didn't find the time to dig into (and wasn't important while using ublock origin)
• ThePhysicist 6y ago
  Small changes in UI can have a significant effect on acceptance rate. I'm developing an open-source consent tool (Klaro - https://klaro.kiprotect.com https://klaro.kiprotect.com, Github: https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro) and where to put the different buttons, which colors to give to them and how easy to make opt-out is a large debate in our community. By default we favor a very user-friendly approach but we give our users (i.e. the website owners) different ways to ask for consent: A mandatory modal, a consent flow that accepts all cookies/apps (or customize) and a consent flow that accepts only a pre-selection of cookies/apps by default. In every flow there's a "Decline" button that visitors can use, so declining consent is just as easy as giving it. Most website publishers prefer the "Accept all" flow as they usually have a good reason for including a given app/tracker on their website, so only choosing a subset doesn't make much sense. A few sites also implement the mandatory flow, where the visitor won't be able to see the website content until he/she has chosen to either give or decline consent (and again, both options are equally simple to reach). From a GDPR and ePrivacy perspective it's clear that opting out needs to be just as easy as opting in. Most websites violate this principle as opting in is in fact way easier, and often the UI is designed to be deliberately confusing to the user. IMHO the consent problem one of the central unsolved issues in privacy though, as most people would not opt-in to tracking if they were given a real choice.
  • wongarsu 6y ago
    I now see a lot of websites now complying with the "opt-out as easy as opt-in" part by giving you checkboxes for configuring your cookies, with a faint "save choice" button that effectively opts out, and a really obvious, well contrasted "accept all" button. I think that ticks all checkboxes of the law, while still being an obvious dark pattern designed to trick the user into opting in.
• marvinblum 6y ago
  This is one of the reasons server side tracking becomes more and more important. Even if users agree, tools like uBlock block client side scripts like Analytics. I build a library for Go [1] to solve this. Check it out! [1] https://marvinblum.de/blog/server-side-tracking-without-cookies-in-go-OxdzmGZ1Bl https://marvinblum.de/blog/server-side-tracking-without-cook...
• monadic2 6y ago
  It’s like ads are something nobody wants.
• IshKebab 6y ago
  I've noticed on most sites even if you click deny you still get tracking cookies. Enforcement is nonexistent.
• perryizgr8 6y ago
  Fundamentally, the browser is the user's agent. Storing cookies, running tracking scripts, etc. should be controlled by the browser. Some browsers may take a strict "block everything" approach, some may be relaxed, and some may harass the user with prompts. Users are free to choose the appropriate browser. Depending on websites to limit tracking by on their own is very difficult, since it is inherently against many websites' business model. They will keep trying to bypass the rules.
  • JulianWasTaken 6y ago
    This is nice in theory, except the amount of fragmentation in 2020 is huge. The average user simply cannot switch browsers. The likelihood of encountering a website that breaks even switching from Chrome to Firefox is too much for any normal user to want to bother for just these purposes. They'll switch back the minute they find a website that doesn't work in their new browser, if they even get that far. So unless you're suggesting "Chrome should make it more obvious how to clear cookies automatically and/or not accept them at all" (which seems like quite a UX challenge itself), saying "just tell everyone to switch browsers" just isn't going to work I don't think. EDIT: to finish the thought -- yes I agree, browsers should provide users with choice, and switching browsers should be available to anyone who is unhappy with the way their browser treats their data, but that can't be the only way -- otherwise, the average user will get left behind.
    • horsawlarway 6y ago
      To be fair to chrome it's actually incredibly easy to clear cookies and to specifically block them. Just click the lock next to the url in the url bar.
    • perryizgr8 6y ago
      I agree that switching browsers is too much to ask. But forcing websites to act against their own interests is not going to work either. It's like forcing a tiger to treat a deer with love and compassion. It's just unnatural. Do you seriously think Facebook is ever going to genuinely give users a way to opt out of tracking? Or Google? Never. They will always try to weasel out of all the requirements, always adhere to the letter but go against the spirit of these regulations. At least browsers don't have that inherent agenda against their own users. There will always be a Firefox which genuinely strives to serve its users, rather than exploit them.
• simias 6y ago
  I enjoy the GDPR if only because it forces websites, even big ones like Google or Reddit, to show me that they value tracking me over everything else, even if it means ruining the user experience and using every dark pattern in the book. Those websites that are usually all about streamlining and reducing friction to a maximum suddenly don't hesitate to trick me into a maze of slow-loading menus with weird conventions and a purposefully broken and confusing UI in an obvious attempt to trick me into opting in by mistake, even though the mere fact that I clicked the "more options" button means that I'm almost certainly looking to opt out. These are tactics that I expect to encounter on shady websites, not some of the biggest websites in the world. Advertising is a cancer that offers next to no added value in our hyper-connected society. Tricking people into seeing ads to trick them into buying stuff they don't need has become the foundation of the web economy. An utter travesty that puts our industry to shame.
• oregontechninja 6y ago
  One click opt out should be mandatory. It's obviously unscrupulous to force you to go through several pages of text when I could've clicked one button. Most the time I just use a special blocker script or reader mode.
  • hedora 6y ago
    One click opt-in, zero click opt-out would be better.
  • akvadrako 6y ago
    Under GDPR it essentially is mandatory, or at least it can't be more cumbersome to opt-out then opt-in, and most websites will want a one-button opt-in. It's just not well enforced yet.
• blauditore 6y ago
  What really drives me crazy are prompts that start by showing two options: "Consent to all cookies", or "customize". If you click "customize", it opens a new modal window with a loading indicator that just doesn't seem to finish. I literally waited 60 seconds and then tried again by refreshing the page, ending up with another infinite loading indicator. This means that users are de-factor forced to click "consent to all". I'm not even sure if that's legal. Now, this was not some obscure small website, but the official Java documentation on docs.oracle.com! They use some third-party service for that - I just tried again, and though it worked this time, it still took 30+ seconds to submit my settings. I have a very hard time to believe this has technical reasons. Either this was made slow on purpose, or built by a bunch of morons. /rant
  • leadingthenet 6y ago
    I know exactly which prompt you’re talking about, it’s very common around the web. Unfortunately, the only solution I found that fixes it is disabling ad and tracker blockers. They seem to break that prompt, though if you set them to be very aggressive, the prompt disappears altogether.
    • mnw21cam 6y ago
      Disabling javascript works pretty well too.
    • SilasX 6y ago
      You could report the site to the governing authorities as well.
    • Nextgrid 6y ago
      The solution is to fix your ad-blocker. Any good one will also block the consent management garbage from loading to begin with. uBlock Origin with all the "annoyances" lists enabled will block them all according to my experience.
      • leadingthenet 6y ago
• jefftk 6y ago
  This looks like an ePrivacy (cookie) consent dialog, and not a GDPR dialog? https://markosaric.com/wp-content/uploads/gdpr-banner-on-mobile.jpg https://markosaric.com/wp-content/uploads/gdpr-banner-on-mob... It's asking for consent to store cookies "to power statistics".
• fabiospampinato 6y ago
  I hate ads as much as everybody else, and this reads to me like "given the choice only 9% of people would pay for their meal", should we forbid charging for food then? Probably not. As sad as the current ads-powered internet is becoming I haven't seen any promising viable alternative, and sure non-tracking-based ads is not the same thing as having no ads, but it significantly moves the needle in that same direction in terms on revenue.
  • alkonaut 6y ago
    A meal paid for by money is a transaction where both parties understand what’s being exchanged. Not paying for it criminal. A viable alternative: show non tracking ads and see if it keeps the lights on, otherwise shut down?
    • fabiospampinato 6y ago
      > A viable alternative: show non tracking ads and see if it keeps the lights on, otherwise shut down? I'm not sure that'd be viable in general, like what would the economic impact globally if all websites that barely can manage to keep the lights on today because of effective ads just disappeared? Maybe the impact could be even positive, like by disallowing politically very-targeted ads, among all other kinds of targeted ads, maybe we can prevent idiots from being elected, but if I had to guess I'd say I wouldn't like to see those websites disappear. Like imagine if YouTube disappeared because it can't make enough money to host all that staggering amount of content.
      • ianhorn 6y ago
        I wouldn't miss it. If they can find a viable non-tracking business model, I'd imagine most would. People used to pay for newspapers so there's pretty good precedent.
        • dantheman 6y ago
          If you don't miss it, then why bother forcing them to do this? Just don't visit their site?
• dwild 6y ago
  The position of the "no" is what made the most difference. My SO constantly click on "Ok" without thinking. The number of time she told me something didn't work, I asked her for the error, she said there was none, I then ask her to reproduce the problem and then she mechanically click on "Ok" of an error warning... Is it really less disingenuous to place it to fit what HE wants versus what SOMEONE else wants? Both still abuse this mechanic... it's just the goal that we agree with.
• paulie_a 6y ago
  The amazing thing is that the vast majority of websites do not even need to display a warning or anything. The gdpr doesn't apply to vast portions of the internet. He it doesn't apply to the vast majority of the internet
• pcora 6y ago
  I for one have been enjoying the verge and weather.com without any crap or slowness.. just ignoring the consent at the bottom :P for websites that do not allow me to navigate or do not have a refuse button, I simply navigate away.
• veselin 6y ago
  There are some sites (e.g. sites by Vox Media like TheVerge) that are outright illegal according to GDPR. There is only "Accept" and cookie information links that don't include any opt-out options. This is not just a dark pattern, but actually not having the settings on the site. Maybe I can email them not to track me. I wonder why aren't they fined a few hundred millions so that this kind of practice stops. So my guess overall is that GDPR is not enforced at a larger scale and we are very far from enforcing the requirement to have "Accept"/"Decline" buttons equally usable.
• alkonaut 6y ago
  The GDPR is designed to be explicitly opt-in. Given compliant consent dialogs, of course very few opt in. Hopefully few enough that keeping the tracking infrastructure just for that minority isn’t worth it. The GDPR is and should be effectively a ban on tracking ads once sites actually comply (or, in many cases - leave the EU market or go under instead). Whether the alternative is a good solution for paying for content or if it’s the end of the majority of content online isn’t really interesting as both outcomes are better than the status quo.
• jacquesm 6y ago
  The worst offenders are the ones that give you instructions on how to disable your ad/tracking blockers. If I wanted them disabled I wouldn't have them in the first place.
• 2T1Qka0rEiPr 6y ago
  > But writing is on the wall. If your business model requires user consent, chances are that your business will suffer if and when GDPR gets enforced. The implication of users not giving the required consent is that the ad-tech industry might collapse. Is the writing on the wall? GDPR came into enforcement over 2 years ago, and I'm not aware of improvements having been made with respect to clarity, because I'm not aware of any punitive measures actually having been taken. Would love to hear comments to the contrary.
• hmd_imputer 6y ago
  yet another EU law with tons of loopholes.
• 12bits 6y ago
  If I need to figure out what they’re actually asking I’m out. This article makes it clear the majority of these consent boxes are not really compliant. On a side note if someone says they’re in advertising I automatically hate them, this terrible I know, but they’re usually pompous assholes and that’s how I feel of that industry as a whole.
  • latexr 6y ago
    > if someone says they’re in advertising I automatically hate them You might enjoy Bill Hicks’ take: https://youtu.be/tHEOGrkhDp0 https://youtu.be/tHEOGrkhDp0
• germinalphrase 6y ago
  So we have an entire industry built upon a coercion? Gonna be a long fight.
• jiveturkey 6y ago
  complain complain complain. these threads exist so that people can gripe, together. it's tiring. instead let's talk about solutions. safari's cookie and localStorage policy is great and automatic. beyond that, firefox containers are good, albeit effectively limited to isolating a few "top sites" like FB. and then of course, UBO, ABP, ghostery and the like. it's actually not that hard to take a few small steps (or just do the default things on MacOS) to stop this from affecting you, without impacting your (ahem) user journeys. first-order fixes are easy. now let's get ahead of these assholes and work on fixing fingerprinting. TFA is ironically quite interesting in that it itself is SEO content, aka an ad. targeting those that care about not being targeted. i, for one, have bookmarked it.
• sloshnmosh 6y ago
  Now is a good time to remind users that to easily remove large cookie consent banners from view is to use uMaytrix to block CSS and refresh your browser. Gorhill’s browser extensions are a must when browsing the web these days.
• chrisxcross 6y ago
  Relevant Study examining different types of banners and their impact on interaction: https://dl.acm.org/doi/10.1145/3319535.3354212 https://dl.acm.org/doi/10.1145/3319535.3354212 (Preprint: https://arxiv.org/pdf/1909.02638.pdf https://arxiv.org/pdf/1909.02638.pdf)
• hedora 6y ago
  This law (and the California one) should be amended so that it takes the same number of clicks to opt in as to opt out, and so that ignoring the banner is an opt out.
  • richv 6y ago
    This is actually already the case with the GDPR, just very few websites practise it that way
• jyriand 6y ago
  I’m wondering if i should implement the consent prompt myself or use some plugin? If i were to implement it myself is it enough to give two options Yes/No or does the law require me to give some additional customisation options? Edit:typos
  • latk 6y ago
    Yes you can implement it yourself – given how bad available cookie consent tools are, you're more likely to be compliant that way. However, consent under the GDPR must be specific. That means the user should be able to consent to or withhold consent for individual processing purposes. Analytics would be one purpose, personalized ads another. Note that under EU cookie laws you don't need consent for cookies that are strictly necessary for the service requested by the user. E.g. using a cookie for dark mode preference, for a shopping cart, or for the consent status itself is perfectly fine without consent.
  • Macha 6y ago
    A "I do not consent to any of this" option that you actually respect is perfectly compliant. All of these granular options are to "provide full control to allow users to customise the partners that they trust" (read: extra complexity to put off users exercising their right to not be tracked, plus the marginal improvement to telemetry from the 1% of users that will allow google analytics but not ad tracking). That said, you do need to inform users of who specifically they're sending the data to (and what they're going to do with it) in the consent option. So "Yes, track me with all your unspecified partners" doesn't quite cut it for the yes option.
• jillesvangurp 6y ago
  Of course they don't; and even if they do, their browser might still block the cookies or discard them frequently. Tracking effectively is getting harder both technically and legally; and that's a good thing long term but leads to chaotic and desperate behavior short term. Long term, there are three ways to adapt: - drive users to apps instead of browsers. E.g. Google and Apple do this serve most of their news via apps where they control the ad experience, tracking, and user signin. There are no anonymous users there. GDPR still applies of course but practically speaking users only have the choice whether to use it or not. And none of the legales specific to browser based things like cookies apply. - tap into other sources of revenue (subscription based, sponsored, donations, etc). Ad revenues have in any case been declining for lots of news sites so this is something they need to do in any case. - switch to non personalized advertising that can still be lucrative if you have access to large amounts of users. E.g. most big brands still advertise this way and still lots of money floating around here. No cookies required.
• serpent 6y ago
  I'm actively working on a cookie banner blocker for iOS. Feedback, questions and suggestions appreciated! https://213tec.com https://213tec.com
• dwaltrip 6y ago
  How can we report websites who use the blatant dark patterns? I’m sure they must be violating GDPR.
• coldtea 6y ago
  GDPR consent should be mandated for, added, and enforced at the browser level. Not a different popup for every website, but some way for the website to include some JSON say and have its rules shown in a browser native UI. And once set, the browser should pass the user decisions to the website, and enforce those that can be enforced locally (at the browser level).
• red_admiral 6y ago
  General rule: most people pick the default option if there is one. For example, organ donation [1]: Germany and Austria are culturally very similar, but in Germany 12% of citizens are organ donors and in Austria 99%. The reason: Germany is opt-in, Austria is opt-out. The interesting thing about GDPR is it officially bans "opt out" tracking cookies - you need someone's consent, although lots of sites interpret that in a way which ... let's just say if they applied the same standards of consent to their private lives they'd very quickly find themselves at the center of the next #MeToo campaign. GDPR does allow you to make the "Yes" and "No" buttons the same size, so "equal choice" rather than "opt in" - maybe that gets you better conversion rates? [1] http://www.behaviouraldesign.com/2015/08/11/why-99-of-austrians-donate-their-organs/ http://www.behaviouraldesign.com/2015/08/11/why-99-of-austri...
• qxxx 6y ago
  20 years ago we had popups, popunders, etc... nowadays we have this crap. I don't care about GDPR, I don't care about cookies... I just want the content. That's why I use a browser extension called "I don't care about cookies" which removes these things from websites. Accepting to GDPR / Cookies: This should be some kind of a web standard , built inside a browser so user can accept it once, ignore or whatever, but seeing this on every website drives (drived) me nuts.
• yladiz 6y ago
  I helped implement a consent tool in our SaaS product that has users from a lot of different regions, many of which are more technical/"developer persona", and the tool we use isn't shady (it depends on the region, but for example in Germany it is opt-in by default and the options are presented immediately rather than behind a modal). During the initial stages we had worried that consent rates would be low, and while Germany was "low" at around 70-75%, we found that overall consent rates across all countries were 90%+ with exceptions for Germany, France, and a couple other European countries. This was consistent across both the application and our marketing website, and across 10s of 1000s of users. So while I don't doubt that the author ran an experiment and got these results, I strongly disagree that you will get "only 9%". Specifically, these lines in the blog post: > And if you give them an easy way to ignore your banner or to say no to be tracked, most of them will simply do that. > Most web users will simply select “no to tracking” once in their browser and the browser will block all the trackers for them as they surf the web. is not correct, at least from my experience, and it absolutely can't be used as a blanket statement like this. Of course my anecdote is, well, anecdotal, so take it with a grain of salt, but I don't think it's fair to say that users will simply reject it no matter what, and it really depends on both context and trust levels.
• wnmurphy 6y ago
  When you're made aware of the tracking, why would anyone willingly choose it? It's a sad state of the internet when you're doing 90% of your Google searches in an incognito window.
• miki123211 6y ago
  In my opinion, GDPR, if properly enforced, is going to be a disaster for many users. Not everyone can pay for the content they consume. Some people are poor, under 18, live in a country where Visa/Mastercard isn't widely supported or can't pay for some other reason. Internet has made the lives of those people much, much better. They definitely prefer being tracked over having to pay for Facebook, Snapchat, Youtube and all the other sites they use. GDPR forces providers to provide their services to customers who opt out of tracking, and most of them will. That means switching to a payment-only model is going to become the only viable option, hurting a large part of the population. The "just force them to pay" attitude that I often see here is extremely elitist. For someone making six figures, being tracked matters. For someone barely scraping by or without a credit card, that's an acceptable price to pay for all the goodies they get.
• rendall 6y ago
  I usually reopen the site in private / incognito and "agree all". I don't trust these sites to abide by the modal agreement anyway.
• orangecat 6y ago
  This is why the GDPR is a bad law. Of course nobody wants to be tracked. If you believe that the harms of tracking outweigh the benefits of increased revenue, then just ban tracking altogether. Instead, the GDPR incentivizes sites to come up with these dark patterns so they can claim that users "voluntarily" "consented", when everyone knows that's not the case.
• dang 6y ago
  Current related thread: https://news.ycombinator.com/item?id=23757272 https://news.ycombinator.com/item?id=23757272
• morpheuskafka 6y ago
  There is a setting in every web browser that controls which sites can store cookies on your computer. They are a core part of the standard web specification along with JavaScript, <img> tags, etc. If you need a reminder every single freaking time you visit a website, that's your problem not the government's. If you don't want them, turn them off in your browser, install a blocking/auto-wipe extension, use lynx, whatever you want. Now, I completely agree that websites should clearly state what they are doing with data the user uploads, if it is end-to-end encrypted, etc. The user otherwise has no way of knowing, and it is material to assessing the accuracy of the often-BS "military-grade security"-type marketing and other claims like that. But there is no need for users to "consent" to using a public API of their web browser.
• Shared404 6y ago
  "On the lifestyle site, three permissions were being asked for. Web statistics (Google Analytics), personalized advertising (Doubleclick) and social media sharing (Pinterest). Only 1 person out of the 774 who opted into being tracked drilled down and made a more granular choice. That visitor said no to stats but said yes to advertising and social media." This seems weird to me. Why would you block google from getting the statistics, and then give it to them anyways via doubleclick?