21 ms·

The author's consent form is very simple and isn't using any shady UX tricks to get the user to consent. One action will opt you in, one action will opt you out

The author's consent form is very simple and isn't using any shady UX tricks to get the user to consent. One action will opt you in, one action will opt you out. I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies.

shmageggy 6y ago
Verizon/Yahoo/Techcrunch is such a blatant offender, and especially noticable because they get posted here often. Their modal is a giant obfuscation dark-pattern, and far as I can tell, there is no way to opt out.
- beshrkayali 6y ago
  Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. I'd like to see how many websites offer a reasonable consent widget that doesn't opt you in by default, keep nothing checking but a huge button to tick and accept, or the usual million-and-one checkboxes to untick, and many other cheap tricks that even the most vigilant of consumers will fall to at some point. I use everything I can to prevent tracking on my machine. But for a general solution for everyone, I don't know what would be the answer, but I don't think it's GDPR. If it's to work, acts forbidden by GDPR need to be handled very fast, and without interaction from user nor legal mumbo jumbo. Without a zero-tolerance policy, the cheap tricks will only grow stronger. Edit: So apparently if you criticize gov/bureaucrats on HN you get downvoted.
  - rcxdude 6y ago
    All that's required is for the regulators to start holding companies using these dark patterns to account. These things aren't GDPR compliant by any reasonable interpretation, and these companies are basically trying their luck to see what they can get away with. If fines start coming to them they'll change their tune pretty quick.
    - anoncake 6y ago
      They are so blatantly non-compliant I wonder if at least some companies are actually trying to discredit the GDPR and the idea of regulation in general by annoying their users while blaming the GDPR.
      - DavidHm 6y ago
        I am sure that's at least part of the thinking. And judging from comments here on HN, it seems to be working. Just two post above yours there's a comment stating that any government solution cannot fix the tracking issue, and it can only be addressed by a company or an individual
  - black_puppydog 6y ago
    More a problem of enforcement than the legislation IMO. It wouldn't take many cases to be properly litigated before publishers would understand this is a law that is to be obeyed like any other.
    - beshrkayali 6y ago
      I honestly don't trust governments/bureaucrats to be able to come up with a solution for this issue. This is one of those problems that evolves very quickly, and the solution probably needs to be done by a private company or by each person individually.
      - oblio 6y ago
        In 2016, I think, there were 0 airplane crashes and 0 air travel fatalities. Across 200 countries, hundreds of airlines and several airplane manufacturers, probably thousands of airports, millions of flights. If you think that was an easy feat, then I don't know what to tell you. Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy. When people really care, bureaucracy works wonders. Bureaucracy is basically formalizing social interactions for a specific topic. Formalizing something ossifies it, but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain.
        MaxBarraclough 6y ago
        > 0 airplane crashes I presume you meant commercial aviation, rather than aviation in general. Unfortunately not quite true even there. Your broader point stands though. https://en.wikipedia.org/wiki/Category:Aviation_accidents_and_incidents_in_2016 https://en.wikipedia.org/wiki/Category:Aviation_accidents_an...
        AnthonyMouse 6y ago
        > Your broader point stands though. Well no, you've neatly disproved it. The reason it works for commercial aviation and not anything else -- not even aviation in general -- is that the bureaucratic processes used for commercial aviation incur a massive overhead. When you have a product which costs a hundred million dollars a unit anyway and can kill 300 people in one shot if it fails, you pay the cost. For anything else it's too expensive, but spending less money causes the bureaucracy to be ineffective. And even in commercial aviation, the overhead is still there, it's just capable of eating the loss. (Or maybe it isn't, given the miserable lack of competition in that industry now. And then where does that lead us on safety, Boeing?)
  - Barrin92 6y ago
    they just need to crack down much harder on websites and hand out big fines for dark patterns until the websites switch to sane defaults. It's just a question of how much the companies in question believe that the EU is going to come after them. Once the cost calculus shifts to being on the safe side it'd quickly turn into a norm, but it requires showing some teeth.
    - emn13 6y ago
      It's already happening, but slowly, slowly. The various agencies need time to get their act together, and have started with the most egregious excesses. It seems rather unlikely at this point that consent forms that apply inappropriate pressure - explicitly called out in the GDPR as invalid - will somehow escape enforcement. I'd expect invalid cookie banners to be on the chopping block sometime fairly soon. Additionally, the risks to advertisers and websites are quite large, which I'm not sure they fully appreciate (unless I'm misunderstanding something here?) - it's not that the consent form is illegal, after all - perfectly legal to have a confusing consent form. Rather, it's that all the personally identifying information thus collected is illegal acquired and held (and it's hard to argue the violation wasn't intentional, to boot!), and the fines for that can be quite large, and can be applied retroactively to whenever the GDPR came into force. Rules always get stretched, but specifically in this way sounds pretty unwise (unless they're cynically trying to have some subsidiary go bankrupt or otherwise encapsulate the risk). With any luck, the GDPR norms on this front will become global norms, but it's too early to tell.
      - hvidgaard 6y ago
        I'm pretty sure GDPR states that it must be opt-in in a non deceiving manner.
        emn13 6y ago
        Exactly; that's the point. An opt in that is coercive is not a valid grounds for holding personal data, ergo, that data is held illegally and subject to enforcement by a data-protection authority. Doesn't matter if everyone clicked yes. A coercive opt-in isn't so much illegal; it's simply void. Having a coercive opt-in would be fine yet weird (as I understand it) if you then proceeded to only retain and process personal information to the extent you would be permitted without the opt-in. (IANAL, and only as far as the GDPR is concerned, perhaps if it's misleading enough that violates some fraud statutes somewhere, but that's a different issue).
  - tannhaeuser 6y ago
    I can only speak for myself, but actually I go to the detailed cookie settings and unselect everything I'm not ok with. In particular, I unselect ga and Fb pixel because I believe the habit of collecting visit data at an all-seeing central site isn't worth it, and actually is the major characteristic of a dystopian future that hacker culture has always been opposed to. If the consent settings are rubbish, I don't bother and leave the site; OTOH, if the settings are reasonable, I usually accept optimization and some analytic cookies. I can't stress enough how much of a game changer that is, by revealing the amount of third-party trackers on websites (in the order of up to 500 on a single site) alone. So I guess GDPR works for me. There's a lack of enforcement, though. But that could change; for example, in Germany, bored law firms (eg those not having clients currently), or anybody actually, can print money by starting an "Abmahnwelle" eg. insist on GDPR compliance within a certain period of time, then sue any site for non-GDPR compliance, all the while being entitled for compensation of their expenses if they have a cause.
    - emn13 6y ago
      It may be the German implementation is different in this regard, but IIRC the GDPR did not create a personal right; enforcement is solely at the discretion of the relevant authority. I thought that was intentional; as a way to limit frivolous lawsuits, but I'm no expert by any means - are you sure this is actually possible?
      - tannhaeuser 6y ago
        No I'm not very sure, IANAL. I just thought that "Abmahnen", for once, could actually be used for something useful when it was used to bother small sites for violating the German "Impressumspflicht" (duty to include press contact info on sites). I'm also not sure it can be legally excluded for GDPR specifically as it has been a staple of German "Rechtspflege" (procurement of law by private orgs) for a long time. I know there has been a relative recent change in jurisdiction where compensation for "Abmahnen" was denied when it wasn't carried out in good faith, but I don't believe GDPR violators can rely on that one for continuing malpractice. I also believe when GDPR was enacted in 2017, internet companies got an additional two year's period of bringing their sites into compliance.
  - probst 6y ago
    > Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. This is very much not true. GDPR isn't restricted to regulating tracking on websites. It also restricts and regulates what companies can do with the customer data they are in possession of. Through my day job I constantly interact with large enterprises (Fortune XXXX) that have vast amounts of personal data through their regular operations (banks, telcos, car manufacturers, airlines, insurance companies and the likes). Nearly without exception they go to great lengths to ensure the data is managed correctly, not used for purposes the customer hasn't explicitly consented to etc. This is as a direct result of the GDPR.
  - HenryBemis 6y ago
    So apparently we (EU) have the right to rip a new one to any big-ass company that is too mucho and gives zero shit about our Right to Privacy. I think that this got you downvoted. I also do my best to avoid tracking (Firefox add-ons, Hosts file). But up until now I had no leverage against any companies. Now they ought to be afraid when they play dirty.
  - mrweasel 6y ago
    > is pretty much useless in practice It's useless because only a few people care enough to report these violations. If anything we need a campaign to get people to start reporting sites which violate the GDPR requirement of an informed opt-in.
  - rutthenut 6y ago
    Do seem to have a lot of downvotes, yes! GDPR is about a lot more than the tracking stuff though, it is about the personal data companies hold and are responsible for, your permission to request it, the risk of fines if they don't comply. Whatever dark patterns they use for tracking logic, they are still bound to use best practice security on the personally-identifiable-information they may hold and may be fined if they do not. That is what GDPR is mostly about, as I see it.
  - black_puppydog 6y ago
    FWIW, I didn't downvote you for this. And I just upvoted for this piece of comedy: > So apparently if you criticize gov/bureaucrats on HN you get downvoted.
- MayeulC 6y ago
  I think they're all Quantcast websites. I like that Firefox extension that adds a "I refuse" button: https://addons.mozilla.org/en-US/firefox/addon/qookiefix/ https://addons.mozilla.org/en-US/firefox/addon/qookiefix/
- gear54rus 6y ago
  I'd like to remind you and everyone else about Firefox reader mode. Solves like 99% of this user-enslaving shit.
  - AnthonyMouse 6y ago
    And this is really the solution to all of it in the end. A user agent which is actually an agent of the user. Can't wait until first party isolation is the default in browsers.
    - anoncake 6y ago
      You can't wait till websites use first-party cookies to track their users?
  - bad_user 6y ago
    Screw that, I just close the page. If a publication disrespects their readers like that, then the content is trash anyway.
    - Sodman 6y ago
      Outside of HN, most content creators, especially professionally, don't have the option to make significant changes to the platform on which their content is published. I agree that an entire publication's site can be trash, but good writers can still write on bad platforms.
      - ViViDboarder 6y ago
        They do as much as engineers at Google or Facebook do to change their companies. That is to say, each one cannot make much of an impact, but the responsible thing to do would be to not contribute or at least openly advocate for change from within. If enough people inside shift, then change can happen.
        Sodman 6y ago
- osullip 6y ago
  This is what yahoo were doing in 2018 (it's my twitter) https://twitter.com/pos43/status/999606375217967104 https://twitter.com/pos43/status/999606375217967104 I found a very convoluted way of opting out: https://twitter.com/pos43/status/1001331147110957056 https://twitter.com/pos43/status/1001331147110957056 It is now 2020 and I would be interested to see if these methods have been changed to make them easier or harder.
  - dmitriid 6y ago
    OAth is still the same
- 0xfaded 6y ago
  Check out the ublock origin annoyances list, which will block cookie and gdpr pop-ups without breaking most websites.
- gmantg 6y ago
  I couldn't get Verizon site to show me the cookie banner. I guess the banner code lives on another domain that my uBO blocked.
fxtentacle 6y ago
Thing is, if someone can show that they were tricked into giving consent when they were not willing to, then you're still in violation of GDPR. So those convoluted forms might not give those companies the legal protection they they hope for. And yes, I'd assume the "phony consent" rate to be much higher, because in some cases I also cannot find the no button and/or accidentally tap on the huge yes button on my phone when my intention was to click the tiny no link next to it.
- mehrdadn 6y ago
  How do you prove you were tricked into giving consent to tracking?
  - gpderetta 6y ago
    I think it is responsibility of the company to show that meaningful consent was freely given.
  - fxtentacle 6y ago
    Record screen sharing of 50 people that you instruct to withdraw consent. If 5+ of them fail, you have made your point that the UI is too misleading to provide legal compliance with GDPR => they are now liable for high fines
- VBprogrammer 6y ago
  I think those are just designed to show some attempt at compliance; muddying the waters of any future regulatory action. Perhaps because their business model is unsustainable without pervasive tracking.
WA 6y ago
A lot higher, that’s why they are shady in the first place.
MaxBarraclough 6y ago
> attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies If I understand correctly, this sort of trickery is forbidden by the GDPR, but so far no-one has seen any consequences for doing do.
- iamacyborg 6y ago
  > so far no-one has seen any consequences for doing do. This is precisely the problem with the GDPR to date. Last August the ICO (British regulatory body) stated that you can't run Analytics such as Google Analytics without a GDPR standard of consent. They've yet to enforce this despite tens of thousands of non-compliant websites.
  - Silhouette 6y ago
    Meanwhile, there has been talk of permitting first party analytics cookies without requiring explicit consent for at least as long as the GDPR has been around. IIRC, even the ICO previously indicated support for that position, though I can't immediately find a reference for that now.
rocho 6y ago
Yes, exactly. I hoped that he would repeat the experiment with a tricky one, like the horrendous forms served by Quantcast. In those, if you click "Reject all" nothing happens! How is that even allowed boggles my mind.
- ginko 6y ago
  It isn't.
- Semaphor 6y ago
  > How is that even allowed boggles my mind. It is not. But GDPR is sorely lacking enforcement with regard to tracking consent. The last time I checked only 3 cases were brought up (all in spain), and all of those would already have been illegal before GDPR in my non-lawyer opinion.
  - mpclark 6y ago
    It's a screw-tightening process. We've only just started, but proper enforcement will surely follow at some point.
- hadrien01 6y ago
  That's the website fault. The Quantcast form is highly configurable, you can choose to display a "I do not accept" button on the first screen
  - Thiez 6y ago
    It really shouldn't be possible not to display that button on the first screen, because opting out should be as easy as opting in. Unless the first screen also doesn't have an 'accept' button, but I've never seen that.
amelius 6y ago
We should have GDPR settings in the browser.
- iamacyborg 6y ago
  Most sites already ignore the "do not track" flag from your browser.
  - alpaca128 6y ago
    The difference is that "do not track" isn't enforced at all. It would be much better to make a browser-side dialog like it's done with location tracking and desktop notifications, and also provide a checkbox in the settings. Most importantly it would take away control from shady websites to implement it on their shady terms(though admittedly giving that control to Google's browser may not be ideal either).
- lloeki 6y ago
  You mean, like a checkbox that sends a `DNT` header set to `1`? I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header. † the consent (or rather, intent not to consent) is explicit, and although non-interactive at the site level it was interactive at the browser level until MS defaulted it to `1`. Now I'm wishing it were like those notifications/location/webcam/mic access and the dialogs were required to go through the browser itself.
  - amelius 6y ago
    > I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header. Then I think that's the best kept secret of the industry.
  - gpderetta 6y ago
    Technically with GDPR defaulting to 1 is the only correct option. MS were only ahead of the time :)
iamacyborg 6y ago
An interesting paper here on the influence of deliberate dark patterns in these consent boxes. https://arxiv.org/pdf/2001.02479.pdf https://arxiv.org/pdf/2001.02479.pdf
- smilespray 6y ago
  Thanks! This is the first proper breakdown I've seen.
encom 6y ago
I was quite pleased that the cookie banner example was blocked by uBlock. As it should be.
Macha 6y ago
Quantcast claimed a 91% any consent and 80% total consent rate for a sample point of a more unethical implementation: https://martechtoday.com/quantcast-reports-more-than-90-of-visitors-to-eu-domains-grant-gdpr-consent-219462 https://martechtoday.com/quantcast-reports-more-than-90-of-v...
bambax 6y ago
Why would anyone consent to be tracked if given a real choice? What are the benefits? The 9% look like an error.
- phito 6y ago
  I know people who just automatically click yes. I don't think they ever even cared to read what is says. They just have the habit to click yes to every prompt to "make sure it works"
  - Vinnl 6y ago
    I wonder what percentage would remain if the no-consent button was the primary button (filled button, saturated colour, bold font, etc.) and the consent button the secondary (outlined or transparent background without a border, regular font, etc.). I can't imagine it going much above 0, and I'd even guess that the ones who do consent intended not to consent but are expecting it to be the de-emphasised button.
  - dwild 6y ago
    He switched the yes/no button position... they would have automatically click "no" instead...
  - AnIdiotOnTheNet 6y ago
    Decades of bad UI design have trained people to click away these kinds of things without reading them. Even people like you or I who should otherwise know better frequently do it.
- Angostura 6y ago
  I consent to website 'Measurement' cookies - I'm happy for most websites to do statistical analysis on their visitors. I opt out of marketing cookies etc.
  - RealStickman_ 6y ago
    The author of the article mentioned a GDPR compliant alternative to google analytics that doesn't require users to give consent for tracking simply by not relying on personally identifiable information.
hfyksehuefs 6y ago
airbnb is one of the worst offenders of making it impossible to opt out UX wise. They give you a list of like 30 individual cookies to opt out of - so 30 clicks to opt out and no way of disabling all at once. For a company that prides itself on design and UX this is appalling.
ElLapidas 6y ago
Non-obvious buttons? If the end user is dumb we shouldn't blame the companies.
- thombat 6y ago
  Any contract should be a meeting of minds, not a cheating. So on the other end of the spectrum from manifestly dumb user is woefully deceitful company. The latter will make the button very small, low contrast, and place it in the middle of a wall of EULA text, and have it reject keyboard focus change so pressing TAB won't light upon it. I think we can blame that company. The old-school equivalent was small print, and in many jurisdictions there are limitations to how small a font can be used (e.g. no smaller than half the main body size and no smaller than 8 point).
8fingerlouie 6y ago
The latest trend in dark UI GDPR patterns is presenting an endless list of things that will track you. It starts with "allow necessary cookies" enabled, and the rest disabled, and presents 3 buttons, a 2 small gray ones and a big green one, and unless you're REALLY careful, you'll end up accepting all cookies. The text is something along the lines of "Cancel", "Save Changes", and finally the big green one is "Accept all cookies". The trick here is that the small gray "save changes" button is actually the one you want, as the "accept all" effectively enables ALL cookies.
- jnxx 6y ago
  The problem is that companies which do that kind of dark patterns are very likely to ignore your settings anyway in the future. Like, for example, Amazon. What then comes to my mind is the thought: "Well, would I try to do an ongoing delicate business with a well-known notorious asshole and trickster?". Obvious answer is "no". So, in most cases, I just leave that site.
  - 8fingerlouie 6y ago
    Anything that refuses to let me view content without setting cookies is ignored here. Sorry, no matter how good your content is, it’s not that good. Shady sites that use dark patterns are about to go the same route. And I have privacy badger, uBlock origins, as well as Pi-hole/PFBlockerNG (not at the same location). Our phones have ad blockers as well, though I doubt they’re as effective.
levosmetalo 6y ago
> I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies. I don't wonder about their numbers, it's obvious their numbers are good for them. What I wonder is how are they getting away with something that is clearly illegal. As already explained, in properly implemented GDPR survey, it should be equally easy to accept, decline or ignore tracking, with the default being decline if user doesn't give explicit consent.
rpastuszak 6y ago
> I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies. I wonder what's the best of shaming/reporting these examples and if an effective way exists[1]. If you have any ideas, sources, anything—please share. GDPR consent screens are pure dark UX. Yes, sometimes the information/actions are buried under a dozen of useless screens, but in some cases these changes are fairly subtle, like reversed the 'active' and 'inactive' states for Reject and Accept buttons on mobile, or things glitching, just a little bit. There's an obvious effort put into make things not only complicated, but also buggy. So _fear, uncertainty and doubt_ all over again. As someone who worked both on GDPR/Adtech/consent frameworks and privacy I still struggle to understand how some of these things are legal and what can we do to change it. [1] Digression: Publisher pressure is one potential solution, but a limited one. Some premium publishers don't want to be associated with this kind of creepy UX. But, at the same time until we've completely killed cookie-driven behavioural targeting (and the alternatives, behavioural, not contextual) higher CPMs/ad revenue will keep the other publishers quiet. Ironically, behavioural targeting is mostly bullshit, and CMPs inflated, but that's a different story.
- richardwhiuk 6y ago
  It's not clear to me that the dark UX forms are legal.
  - rpastuszak 6y ago
    It doesn’t seem to matter: https://arxiv.org/abs/2001.02479 https://arxiv.org/abs/2001.02479
    - richardwhiuk 6y ago
      Huh? That says that only 11.8% are lawful. Obviously this is all pending enforcement actions actually taking place, but it's not obvious that will never happen.
- 6y ago
fnord123 6y ago
Reddit doesn't have a consent form.
sgustard 6y ago
How do you remember the user has opted out of cookies without storing a cookie? Does anyone have an example of a site with a clear opt-in/out? I'm curious about what's actually stored on my machine in each case. And of course it's not really what's stored locally that's the issue: it's what is stored on their server.
- sjogress 6y ago
  Opting out of tracking is not the same as opting out of cookies. Per the GDPR a site is still allowed to set any cookies required for the site to work, including a "tracking consent cookie".

shmageggy 6y ago

Verizon/Yahoo/Techcrunch is such a blatant offender, and especially noticable because they get posted here often. Their modal is a giant obfuscation dark-pattern, and far as I can tell, there is no way to opt out.

beshrkayali 6y ago
Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. I'd like to see how many websites offer a reasonable consent widget that doesn't opt you in by default, keep nothing checking but a huge button to tick and accept, or the usual million-and-one checkboxes to untick, and many other cheap tricks that even the most vigilant of consumers will fall to at some point. I use everything I can to prevent tracking on my machine. But for a general solution for everyone, I don't know what would be the answer, but I don't think it's GDPR. If it's to work, acts forbidden by GDPR need to be handled very fast, and without interaction from user nor legal mumbo jumbo. Without a zero-tolerance policy, the cheap tricks will only grow stronger. Edit: So apparently if you criticize gov/bureaucrats on HN you get downvoted.
- rcxdude 6y ago
  All that's required is for the regulators to start holding companies using these dark patterns to account. These things aren't GDPR compliant by any reasonable interpretation, and these companies are basically trying their luck to see what they can get away with. If fines start coming to them they'll change their tune pretty quick.
  - anoncake 6y ago
    They are so blatantly non-compliant I wonder if at least some companies are actually trying to discredit the GDPR and the idea of regulation in general by annoying their users while blaming the GDPR.
    - DavidHm 6y ago
      I am sure that's at least part of the thinking. And judging from comments here on HN, it seems to be working. Just two post above yours there's a comment stating that any government solution cannot fix the tracking issue, and it can only be addressed by a company or an individual
- black_puppydog 6y ago
  More a problem of enforcement than the legislation IMO. It wouldn't take many cases to be properly litigated before publishers would understand this is a law that is to be obeyed like any other.
  - beshrkayali 6y ago
    I honestly don't trust governments/bureaucrats to be able to come up with a solution for this issue. This is one of those problems that evolves very quickly, and the solution probably needs to be done by a private company or by each person individually.
    - oblio 6y ago
      In 2016, I think, there were 0 airplane crashes and 0 air travel fatalities. Across 200 countries, hundreds of airlines and several airplane manufacturers, probably thousands of airports, millions of flights. If you think that was an easy feat, then I don't know what to tell you. Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy. When people really care, bureaucracy works wonders. Bureaucracy is basically formalizing social interactions for a specific topic. Formalizing something ossifies it, but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain.
      - MaxBarraclough 6y ago
        > 0 airplane crashes I presume you meant commercial aviation, rather than aviation in general. Unfortunately not quite true even there. Your broader point stands though. https://en.wikipedia.org/wiki/Category:Aviation_accidents_and_incidents_in_2016 https://en.wikipedia.org/wiki/Category:Aviation_accidents_an...
        AnthonyMouse 6y ago
        > Your broader point stands though. Well no, you've neatly disproved it. The reason it works for commercial aviation and not anything else -- not even aviation in general -- is that the bureaucratic processes used for commercial aviation incur a massive overhead. When you have a product which costs a hundred million dollars a unit anyway and can kill 300 people in one shot if it fails, you pay the cost. For anything else it's too expensive, but spending less money causes the bureaucracy to be ineffective. And even in commercial aviation, the overhead is still there, it's just capable of eating the loss. (Or maybe it isn't, given the miserable lack of competition in that industry now. And then where does that lead us on safety, Boeing?)
- Barrin92 6y ago
  they just need to crack down much harder on websites and hand out big fines for dark patterns until the websites switch to sane defaults. It's just a question of how much the companies in question believe that the EU is going to come after them. Once the cost calculus shifts to being on the safe side it'd quickly turn into a norm, but it requires showing some teeth.
  - emn13 6y ago
    It's already happening, but slowly, slowly. The various agencies need time to get their act together, and have started with the most egregious excesses. It seems rather unlikely at this point that consent forms that apply inappropriate pressure - explicitly called out in the GDPR as invalid - will somehow escape enforcement. I'd expect invalid cookie banners to be on the chopping block sometime fairly soon. Additionally, the risks to advertisers and websites are quite large, which I'm not sure they fully appreciate (unless I'm misunderstanding something here?) - it's not that the consent form is illegal, after all - perfectly legal to have a confusing consent form. Rather, it's that all the personally identifying information thus collected is illegal acquired and held (and it's hard to argue the violation wasn't intentional, to boot!), and the fines for that can be quite large, and can be applied retroactively to whenever the GDPR came into force. Rules always get stretched, but specifically in this way sounds pretty unwise (unless they're cynically trying to have some subsidiary go bankrupt or otherwise encapsulate the risk). With any luck, the GDPR norms on this front will become global norms, but it's too early to tell.
    - hvidgaard 6y ago
      I'm pretty sure GDPR states that it must be opt-in in a non deceiving manner.
      - emn13 6y ago
        Exactly; that's the point. An opt in that is coercive is not a valid grounds for holding personal data, ergo, that data is held illegally and subject to enforcement by a data-protection authority. Doesn't matter if everyone clicked yes. A coercive opt-in isn't so much illegal; it's simply void. Having a coercive opt-in would be fine yet weird (as I understand it) if you then proceeded to only retain and process personal information to the extent you would be permitted without the opt-in. (IANAL, and only as far as the GDPR is concerned, perhaps if it's misleading enough that violates some fraud statutes somewhere, but that's a different issue).
- tannhaeuser 6y ago
  I can only speak for myself, but actually I go to the detailed cookie settings and unselect everything I'm not ok with. In particular, I unselect ga and Fb pixel because I believe the habit of collecting visit data at an all-seeing central site isn't worth it, and actually is the major characteristic of a dystopian future that hacker culture has always been opposed to. If the consent settings are rubbish, I don't bother and leave the site; OTOH, if the settings are reasonable, I usually accept optimization and some analytic cookies. I can't stress enough how much of a game changer that is, by revealing the amount of third-party trackers on websites (in the order of up to 500 on a single site) alone. So I guess GDPR works for me. There's a lack of enforcement, though. But that could change; for example, in Germany, bored law firms (eg those not having clients currently), or anybody actually, can print money by starting an "Abmahnwelle" eg. insist on GDPR compliance within a certain period of time, then sue any site for non-GDPR compliance, all the while being entitled for compensation of their expenses if they have a cause.
  - emn13 6y ago
    It may be the German implementation is different in this regard, but IIRC the GDPR did not create a personal right; enforcement is solely at the discretion of the relevant authority. I thought that was intentional; as a way to limit frivolous lawsuits, but I'm no expert by any means - are you sure this is actually possible?
    - tannhaeuser 6y ago
      No I'm not very sure, IANAL. I just thought that "Abmahnen", for once, could actually be used for something useful when it was used to bother small sites for violating the German "Impressumspflicht" (duty to include press contact info on sites). I'm also not sure it can be legally excluded for GDPR specifically as it has been a staple of German "Rechtspflege" (procurement of law by private orgs) for a long time. I know there has been a relative recent change in jurisdiction where compensation for "Abmahnen" was denied when it wasn't carried out in good faith, but I don't believe GDPR violators can rely on that one for continuing malpractice. I also believe when GDPR was enacted in 2017, internet companies got an additional two year's period of bringing their sites into compliance.
- probst 6y ago
  > Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. This is very much not true. GDPR isn't restricted to regulating tracking on websites. It also restricts and regulates what companies can do with the customer data they are in possession of. Through my day job I constantly interact with large enterprises (Fortune XXXX) that have vast amounts of personal data through their regular operations (banks, telcos, car manufacturers, airlines, insurance companies and the likes). Nearly without exception they go to great lengths to ensure the data is managed correctly, not used for purposes the customer hasn't explicitly consented to etc. This is as a direct result of the GDPR.
- HenryBemis 6y ago
  So apparently we (EU) have the right to rip a new one to any big-ass company that is too mucho and gives zero shit about our Right to Privacy. I think that this got you downvoted. I also do my best to avoid tracking (Firefox add-ons, Hosts file). But up until now I had no leverage against any companies. Now they ought to be afraid when they play dirty.
- mrweasel 6y ago
  > is pretty much useless in practice It's useless because only a few people care enough to report these violations. If anything we need a campaign to get people to start reporting sites which violate the GDPR requirement of an informed opt-in.
- rutthenut 6y ago
  Do seem to have a lot of downvotes, yes! GDPR is about a lot more than the tracking stuff though, it is about the personal data companies hold and are responsible for, your permission to request it, the risk of fines if they don't comply. Whatever dark patterns they use for tracking logic, they are still bound to use best practice security on the personally-identifiable-information they may hold and may be fined if they do not. That is what GDPR is mostly about, as I see it.
- black_puppydog 6y ago
  FWIW, I didn't downvote you for this. And I just upvoted for this piece of comedy: > So apparently if you criticize gov/bureaucrats on HN you get downvoted.
MayeulC 6y ago
I think they're all Quantcast websites. I like that Firefox extension that adds a "I refuse" button: https://addons.mozilla.org/en-US/firefox/addon/qookiefix/ https://addons.mozilla.org/en-US/firefox/addon/qookiefix/
gear54rus 6y ago
I'd like to remind you and everyone else about Firefox reader mode. Solves like 99% of this user-enslaving shit.
- AnthonyMouse 6y ago
  And this is really the solution to all of it in the end. A user agent which is actually an agent of the user. Can't wait until first party isolation is the default in browsers.
  - anoncake 6y ago
    You can't wait till websites use first-party cookies to track their users?
- bad_user 6y ago
  Screw that, I just close the page. If a publication disrespects their readers like that, then the content is trash anyway.
  - Sodman 6y ago
    Outside of HN, most content creators, especially professionally, don't have the option to make significant changes to the platform on which their content is published. I agree that an entire publication's site can be trash, but good writers can still write on bad platforms.
    - ViViDboarder 6y ago
      They do as much as engineers at Google or Facebook do to change their companies. That is to say, each one cannot make much of an impact, but the responsible thing to do would be to not contribute or at least openly advocate for change from within. If enough people inside shift, then change can happen.
      - Sodman 6y ago
osullip 6y ago
This is what yahoo were doing in 2018 (it's my twitter) https://twitter.com/pos43/status/999606375217967104 https://twitter.com/pos43/status/999606375217967104 I found a very convoluted way of opting out: https://twitter.com/pos43/status/1001331147110957056 https://twitter.com/pos43/status/1001331147110957056 It is now 2020 and I would be interested to see if these methods have been changed to make them easier or harder.
- dmitriid 6y ago
  OAth is still the same
0xfaded 6y ago
Check out the ublock origin annoyances list, which will block cookie and gdpr pop-ups without breaking most websites.
gmantg 6y ago
I couldn't get Verizon site to show me the cookie banner. I guess the banner code lives on another domain that my uBO blocked.

fxtentacle 6y ago

Thing is, if someone can show that they were tricked into giving consent when they were not willing to, then you're still in violation of GDPR. So those convoluted forms might not give those companies the legal protection they they hope for. And yes, I'd assume the "phony consent" rate to be much higher, because in some cases I also cannot find the no button and/or accidentally tap on the huge yes button on my phone when my intention was to click the tiny no link next to it.

mehrdadn 6y ago
How do you prove you were tricked into giving consent to tracking?
- gpderetta 6y ago
  I think it is responsibility of the company to show that meaningful consent was freely given.
- fxtentacle 6y ago
  Record screen sharing of 50 people that you instruct to withdraw consent. If 5+ of them fail, you have made your point that the UI is too misleading to provide legal compliance with GDPR => they are now liable for high fines
VBprogrammer 6y ago
I think those are just designed to show some attempt at compliance; muddying the waters of any future regulatory action. Perhaps because their business model is unsustainable without pervasive tracking.

WA 6y ago

A lot higher, that’s why they are shady in the first place.

MaxBarraclough 6y ago

> attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies If I understand correctly, this sort of trickery is forbidden by the GDPR, but so far no-one has seen any consequences for doing do.

iamacyborg 6y ago
> so far no-one has seen any consequences for doing do. This is precisely the problem with the GDPR to date. Last August the ICO (British regulatory body) stated that you can't run Analytics such as Google Analytics without a GDPR standard of consent. They've yet to enforce this despite tens of thousands of non-compliant websites.
- Silhouette 6y ago
  Meanwhile, there has been talk of permitting first party analytics cookies without requiring explicit consent for at least as long as the GDPR has been around. IIRC, even the ICO previously indicated support for that position, though I can't immediately find a reference for that now.

rocho 6y ago

Yes, exactly. I hoped that he would repeat the experiment with a tricky one, like the horrendous forms served by Quantcast. In those, if you click "Reject all" nothing happens! How is that even allowed boggles my mind.

ginko 6y ago
It isn't.
Semaphor 6y ago
> How is that even allowed boggles my mind. It is not. But GDPR is sorely lacking enforcement with regard to tracking consent. The last time I checked only 3 cases were brought up (all in spain), and all of those would already have been illegal before GDPR in my non-lawyer opinion.
- mpclark 6y ago
  It's a screw-tightening process. We've only just started, but proper enforcement will surely follow at some point.
hadrien01 6y ago
That's the website fault. The Quantcast form is highly configurable, you can choose to display a "I do not accept" button on the first screen
- Thiez 6y ago
  It really shouldn't be possible not to display that button on the first screen, because opting out should be as easy as opting in. Unless the first screen also doesn't have an 'accept' button, but I've never seen that.

amelius 6y ago

We should have GDPR settings in the browser.

iamacyborg 6y ago
Most sites already ignore the "do not track" flag from your browser.
- alpaca128 6y ago
  The difference is that "do not track" isn't enforced at all. It would be much better to make a browser-side dialog like it's done with location tracking and desktop notifications, and also provide a checkbox in the settings. Most importantly it would take away control from shady websites to implement it on their shady terms(though admittedly giving that control to Google's browser may not be ideal either).
lloeki 6y ago
You mean, like a checkbox that sends a `DNT` header set to `1`? I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header. † the consent (or rather, intent not to consent) is explicit, and although non-interactive at the site level it was interactive at the browser level until MS defaulted it to `1`. Now I'm wishing it were like those notifications/location/webcam/mic access and the dialogs were required to go through the browser itself.
- amelius 6y ago
  > I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header. Then I think that's the best kept secret of the industry.
- gpderetta 6y ago
  Technically with GDPR defaulting to 1 is the only correct option. MS were only ahead of the time :)

iamacyborg 6y ago

An interesting paper here on the influence of deliberate dark patterns in these consent boxes. https://arxiv.org/pdf/2001.02479.pdf https://arxiv.org/pdf/2001.02479.pdf

smilespray 6y ago
Thanks! This is the first proper breakdown I've seen.

encom 6y ago

I was quite pleased that the cookie banner example was blocked by uBlock. As it should be.

Macha 6y ago

Quantcast claimed a 91% any consent and 80% total consent rate for a sample point of a more unethical implementation: https://martechtoday.com/quantcast-reports-more-than-90-of-visitors-to-eu-domains-grant-gdpr-consent-219462 https://martechtoday.com/quantcast-reports-more-than-90-of-v...

bambax 6y ago

Why would anyone consent to be tracked if given a real choice? What are the benefits? The 9% look like an error.

phito 6y ago
I know people who just automatically click yes. I don't think they ever even cared to read what is says. They just have the habit to click yes to every prompt to "make sure it works"
- Vinnl 6y ago
  I wonder what percentage would remain if the no-consent button was the primary button (filled button, saturated colour, bold font, etc.) and the consent button the secondary (outlined or transparent background without a border, regular font, etc.). I can't imagine it going much above 0, and I'd even guess that the ones who do consent intended not to consent but are expecting it to be the de-emphasised button.
- dwild 6y ago
  He switched the yes/no button position... they would have automatically click "no" instead...
- AnIdiotOnTheNet 6y ago
  Decades of bad UI design have trained people to click away these kinds of things without reading them. Even people like you or I who should otherwise know better frequently do it.
Angostura 6y ago
I consent to website 'Measurement' cookies - I'm happy for most websites to do statistical analysis on their visitors. I opt out of marketing cookies etc.
- RealStickman_ 6y ago
  The author of the article mentioned a GDPR compliant alternative to google analytics that doesn't require users to give consent for tracking simply by not relying on personally identifiable information.

hfyksehuefs 6y ago

airbnb is one of the worst offenders of making it impossible to opt out UX wise. They give you a list of like 30 individual cookies to opt out of - so 30 clicks to opt out and no way of disabling all at once. For a company that prides itself on design and UX this is appalling.

ElLapidas 6y ago

Non-obvious buttons? If the end user is dumb we shouldn't blame the companies.

thombat 6y ago
Any contract should be a meeting of minds, not a cheating. So on the other end of the spectrum from manifestly dumb user is woefully deceitful company. The latter will make the button very small, low contrast, and place it in the middle of a wall of EULA text, and have it reject keyboard focus change so pressing TAB won't light upon it. I think we can blame that company. The old-school equivalent was small print, and in many jurisdictions there are limitations to how small a font can be used (e.g. no smaller than half the main body size and no smaller than 8 point).

8fingerlouie 6y ago

The latest trend in dark UI GDPR patterns is presenting an endless list of things that will track you. It starts with "allow necessary cookies" enabled, and the rest disabled, and presents 3 buttons, a 2 small gray ones and a big green one, and unless you're REALLY careful, you'll end up accepting all cookies. The text is something along the lines of "Cancel", "Save Changes", and finally the big green one is "Accept all cookies". The trick here is that the small gray "save changes" button is actually the one you want, as the "accept all" effectively enables ALL cookies.

jnxx 6y ago
The problem is that companies which do that kind of dark patterns are very likely to ignore your settings anyway in the future. Like, for example, Amazon. What then comes to my mind is the thought: "Well, would I try to do an ongoing delicate business with a well-known notorious asshole and trickster?". Obvious answer is "no". So, in most cases, I just leave that site.
- 8fingerlouie 6y ago
  Anything that refuses to let me view content without setting cookies is ignored here. Sorry, no matter how good your content is, it’s not that good. Shady sites that use dark patterns are about to go the same route. And I have privacy badger, uBlock origins, as well as Pi-hole/PFBlockerNG (not at the same location). Our phones have ad blockers as well, though I doubt they’re as effective.

levosmetalo 6y ago

rpastuszak 6y ago

> I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies. I wonder what's the best of shaming/reporting these examples and if an effective way exists[1]. If you have any ideas, sources, anything—please share. GDPR consent screens are pure dark UX. Yes, sometimes the information/actions are buried under a dozen of useless screens, but in some cases these changes are fairly subtle, like reversed the 'active' and 'inactive' states for Reject and Accept buttons on mobile, or things glitching, just a little bit. There's an obvious effort put into make things not only complicated, but also buggy. So _fear, uncertainty and doubt_ all over again. As someone who worked both on GDPR/Adtech/consent frameworks and privacy I still struggle to understand how some of these things are legal and what can we do to change it. [1] Digression: Publisher pressure is one potential solution, but a limited one. Some premium publishers don't want to be associated with this kind of creepy UX. But, at the same time until we've completely killed cookie-driven behavioural targeting (and the alternatives, behavioural, not contextual) higher CPMs/ad revenue will keep the other publishers quiet. Ironically, behavioural targeting is mostly bullshit, and CMPs inflated, but that's a different story.

richardwhiuk 6y ago
It's not clear to me that the dark UX forms are legal.
- rpastuszak 6y ago
  It doesn’t seem to matter: https://arxiv.org/abs/2001.02479 https://arxiv.org/abs/2001.02479
  - richardwhiuk 6y ago
    Huh? That says that only 11.8% are lawful. Obviously this is all pending enforcement actions actually taking place, but it's not obvious that will never happen.
6y ago

fnord123 6y ago

Reddit doesn't have a consent form.

sgustard 6y ago

How do you remember the user has opted out of cookies without storing a cookie? Does anyone have an example of a site with a clear opt-in/out? I'm curious about what's actually stored on my machine in each case. And of course it's not really what's stored locally that's the issue: it's what is stored on their server.

sjogress 6y ago
Opting out of tracking is not the same as opting out of cookies. Per the GDPR a site is still allowed to set any cookies required for the site to work, including a "tracking consent cookie".