10 ms·

Verizon/Yahoo/Techcrunch is such a blatant offender, and especially noticable because they get posted here often. Their modal is a giant obfuscation dark-patter

Verizon/Yahoo/Techcrunch is such a blatant offender, and especially noticable because they get posted here often. Their modal is a giant obfuscation dark-pattern, and far as I can tell, there is no way to opt out.

beshrkayali 6y ago
Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. I'd like to see how many websites offer a reasonable consent widget that doesn't opt you in by default, keep nothing checking but a huge button to tick and accept, or the usual million-and-one checkboxes to untick, and many other cheap tricks that even the most vigilant of consumers will fall to at some point. I use everything I can to prevent tracking on my machine. But for a general solution for everyone, I don't know what would be the answer, but I don't think it's GDPR. If it's to work, acts forbidden by GDPR need to be handled very fast, and without interaction from user nor legal mumbo jumbo. Without a zero-tolerance policy, the cheap tricks will only grow stronger. Edit: So apparently if you criticize gov/bureaucrats on HN you get downvoted.
- rcxdude 6y ago
  All that's required is for the regulators to start holding companies using these dark patterns to account. These things aren't GDPR compliant by any reasonable interpretation, and these companies are basically trying their luck to see what they can get away with. If fines start coming to them they'll change their tune pretty quick.
  - anoncake 6y ago
    They are so blatantly non-compliant I wonder if at least some companies are actually trying to discredit the GDPR and the idea of regulation in general by annoying their users while blaming the GDPR.
    - DavidHm 6y ago
      I am sure that's at least part of the thinking. And judging from comments here on HN, it seems to be working. Just two post above yours there's a comment stating that any government solution cannot fix the tracking issue, and it can only be addressed by a company or an individual
- black_puppydog 6y ago
  More a problem of enforcement than the legislation IMO. It wouldn't take many cases to be properly litigated before publishers would understand this is a law that is to be obeyed like any other.
  - beshrkayali 6y ago
    I honestly don't trust governments/bureaucrats to be able to come up with a solution for this issue. This is one of those problems that evolves very quickly, and the solution probably needs to be done by a private company or by each person individually.
    - oblio 6y ago
      In 2016, I think, there were 0 airplane crashes and 0 air travel fatalities. Across 200 countries, hundreds of airlines and several airplane manufacturers, probably thousands of airports, millions of flights. If you think that was an easy feat, then I don't know what to tell you. Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy. When people really care, bureaucracy works wonders. Bureaucracy is basically formalizing social interactions for a specific topic. Formalizing something ossifies it, but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain.
      - MaxBarraclough 6y ago
        > 0 airplane crashes I presume you meant commercial aviation, rather than aviation in general. Unfortunately not quite true even there. Your broader point stands though. https://en.wikipedia.org/wiki/Category:Aviation_accidents_and_incidents_in_2016 https://en.wikipedia.org/wiki/Category:Aviation_accidents_an...
        AnthonyMouse 6y ago
        > Your broader point stands though. Well no, you've neatly disproved it. The reason it works for commercial aviation and not anything else -- not even aviation in general -- is that the bureaucratic processes used for commercial aviation incur a massive overhead. When you have a product which costs a hundred million dollars a unit anyway and can kill 300 people in one shot if it fails, you pay the cost. For anything else it's too expensive, but spending less money causes the bureaucracy to be ineffective. And even in commercial aviation, the overhead is still there, it's just capable of eating the loss. (Or maybe it isn't, given the miserable lack of competition in that industry now. And then where does that lead us on safety, Boeing?)
- Barrin92 6y ago
  they just need to crack down much harder on websites and hand out big fines for dark patterns until the websites switch to sane defaults. It's just a question of how much the companies in question believe that the EU is going to come after them. Once the cost calculus shifts to being on the safe side it'd quickly turn into a norm, but it requires showing some teeth.
  - emn13 6y ago
    It's already happening, but slowly, slowly. The various agencies need time to get their act together, and have started with the most egregious excesses. It seems rather unlikely at this point that consent forms that apply inappropriate pressure - explicitly called out in the GDPR as invalid - will somehow escape enforcement. I'd expect invalid cookie banners to be on the chopping block sometime fairly soon. Additionally, the risks to advertisers and websites are quite large, which I'm not sure they fully appreciate (unless I'm misunderstanding something here?) - it's not that the consent form is illegal, after all - perfectly legal to have a confusing consent form. Rather, it's that all the personally identifying information thus collected is illegal acquired and held (and it's hard to argue the violation wasn't intentional, to boot!), and the fines for that can be quite large, and can be applied retroactively to whenever the GDPR came into force. Rules always get stretched, but specifically in this way sounds pretty unwise (unless they're cynically trying to have some subsidiary go bankrupt or otherwise encapsulate the risk). With any luck, the GDPR norms on this front will become global norms, but it's too early to tell.
    - hvidgaard 6y ago
      I'm pretty sure GDPR states that it must be opt-in in a non deceiving manner.
      - emn13 6y ago
        Exactly; that's the point. An opt in that is coercive is not a valid grounds for holding personal data, ergo, that data is held illegally and subject to enforcement by a data-protection authority. Doesn't matter if everyone clicked yes. A coercive opt-in isn't so much illegal; it's simply void. Having a coercive opt-in would be fine yet weird (as I understand it) if you then proceeded to only retain and process personal information to the extent you would be permitted without the opt-in. (IANAL, and only as far as the GDPR is concerned, perhaps if it's misleading enough that violates some fraud statutes somewhere, but that's a different issue).
- tannhaeuser 6y ago
  I can only speak for myself, but actually I go to the detailed cookie settings and unselect everything I'm not ok with. In particular, I unselect ga and Fb pixel because I believe the habit of collecting visit data at an all-seeing central site isn't worth it, and actually is the major characteristic of a dystopian future that hacker culture has always been opposed to. If the consent settings are rubbish, I don't bother and leave the site; OTOH, if the settings are reasonable, I usually accept optimization and some analytic cookies. I can't stress enough how much of a game changer that is, by revealing the amount of third-party trackers on websites (in the order of up to 500 on a single site) alone. So I guess GDPR works for me. There's a lack of enforcement, though. But that could change; for example, in Germany, bored law firms (eg those not having clients currently), or anybody actually, can print money by starting an "Abmahnwelle" eg. insist on GDPR compliance within a certain period of time, then sue any site for non-GDPR compliance, all the while being entitled for compensation of their expenses if they have a cause.
  - emn13 6y ago
    It may be the German implementation is different in this regard, but IIRC the GDPR did not create a personal right; enforcement is solely at the discretion of the relevant authority. I thought that was intentional; as a way to limit frivolous lawsuits, but I'm no expert by any means - are you sure this is actually possible?
    - tannhaeuser 6y ago
      No I'm not very sure, IANAL. I just thought that "Abmahnen", for once, could actually be used for something useful when it was used to bother small sites for violating the German "Impressumspflicht" (duty to include press contact info on sites). I'm also not sure it can be legally excluded for GDPR specifically as it has been a staple of German "Rechtspflege" (procurement of law by private orgs) for a long time. I know there has been a relative recent change in jurisdiction where compensation for "Abmahnen" was denied when it wasn't carried out in good faith, but I don't believe GDPR violators can rely on that one for continuing malpractice. I also believe when GDPR was enacted in 2017, internet companies got an additional two year's period of bringing their sites into compliance.
- probst 6y ago
  > Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. This is very much not true. GDPR isn't restricted to regulating tracking on websites. It also restricts and regulates what companies can do with the customer data they are in possession of. Through my day job I constantly interact with large enterprises (Fortune XXXX) that have vast amounts of personal data through their regular operations (banks, telcos, car manufacturers, airlines, insurance companies and the likes). Nearly without exception they go to great lengths to ensure the data is managed correctly, not used for purposes the customer hasn't explicitly consented to etc. This is as a direct result of the GDPR.
- HenryBemis 6y ago
  So apparently we (EU) have the right to rip a new one to any big-ass company that is too mucho and gives zero shit about our Right to Privacy. I think that this got you downvoted. I also do my best to avoid tracking (Firefox add-ons, Hosts file). But up until now I had no leverage against any companies. Now they ought to be afraid when they play dirty.
- mrweasel 6y ago
  > is pretty much useless in practice It's useless because only a few people care enough to report these violations. If anything we need a campaign to get people to start reporting sites which violate the GDPR requirement of an informed opt-in.
- rutthenut 6y ago
  Do seem to have a lot of downvotes, yes! GDPR is about a lot more than the tracking stuff though, it is about the personal data companies hold and are responsible for, your permission to request it, the risk of fines if they don't comply. Whatever dark patterns they use for tracking logic, they are still bound to use best practice security on the personally-identifiable-information they may hold and may be fined if they do not. That is what GDPR is mostly about, as I see it.
- black_puppydog 6y ago
  FWIW, I didn't downvote you for this. And I just upvoted for this piece of comedy: > So apparently if you criticize gov/bureaucrats on HN you get downvoted.
MayeulC 6y ago
I think they're all Quantcast websites. I like that Firefox extension that adds a "I refuse" button: https://addons.mozilla.org/en-US/firefox/addon/qookiefix/ https://addons.mozilla.org/en-US/firefox/addon/qookiefix/
gear54rus 6y ago
I'd like to remind you and everyone else about Firefox reader mode. Solves like 99% of this user-enslaving shit.
- AnthonyMouse 6y ago
  And this is really the solution to all of it in the end. A user agent which is actually an agent of the user. Can't wait until first party isolation is the default in browsers.
  - anoncake 6y ago
    You can't wait till websites use first-party cookies to track their users?
- bad_user 6y ago
  Screw that, I just close the page. If a publication disrespects their readers like that, then the content is trash anyway.
  - Sodman 6y ago
    Outside of HN, most content creators, especially professionally, don't have the option to make significant changes to the platform on which their content is published. I agree that an entire publication's site can be trash, but good writers can still write on bad platforms.
    - ViViDboarder 6y ago
      They do as much as engineers at Google or Facebook do to change their companies. That is to say, each one cannot make much of an impact, but the responsible thing to do would be to not contribute or at least openly advocate for change from within. If enough people inside shift, then change can happen.
      - Sodman 6y ago
osullip 6y ago
This is what yahoo were doing in 2018 (it's my twitter) https://twitter.com/pos43/status/999606375217967104 https://twitter.com/pos43/status/999606375217967104 I found a very convoluted way of opting out: https://twitter.com/pos43/status/1001331147110957056 https://twitter.com/pos43/status/1001331147110957056 It is now 2020 and I would be interested to see if these methods have been changed to make them easier or harder.
- dmitriid 6y ago
  OAth is still the same
0xfaded 6y ago
Check out the ublock origin annoyances list, which will block cookie and gdpr pop-ups without breaking most websites.
gmantg 6y ago
I couldn't get Verizon site to show me the cookie banner. I guess the banner code lives on another domain that my uBO blocked.

beshrkayali 6y ago

Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. I'd like to see how many websites offer a reasonable consent widget that doesn't opt you in by default, keep nothing checking but a huge button to tick and accept, or the usual million-and-one checkboxes to untick, and many other cheap tricks that even the most vigilant of consumers will fall to at some point. I use everything I can to prevent tracking on my machine. But for a general solution for everyone, I don't know what would be the answer, but I don't think it's GDPR. If it's to work, acts forbidden by GDPR need to be handled very fast, and without interaction from user nor legal mumbo jumbo. Without a zero-tolerance policy, the cheap tricks will only grow stronger. Edit: So apparently if you criticize gov/bureaucrats on HN you get downvoted.

rcxdude 6y ago
All that's required is for the regulators to start holding companies using these dark patterns to account. These things aren't GDPR compliant by any reasonable interpretation, and these companies are basically trying their luck to see what they can get away with. If fines start coming to them they'll change their tune pretty quick.
- anoncake 6y ago
  They are so blatantly non-compliant I wonder if at least some companies are actually trying to discredit the GDPR and the idea of regulation in general by annoying their users while blaming the GDPR.
  - DavidHm 6y ago
    I am sure that's at least part of the thinking. And judging from comments here on HN, it seems to be working. Just two post above yours there's a comment stating that any government solution cannot fix the tracking issue, and it can only be addressed by a company or an individual
black_puppydog 6y ago
More a problem of enforcement than the legislation IMO. It wouldn't take many cases to be properly litigated before publishers would understand this is a law that is to be obeyed like any other.
- beshrkayali 6y ago
  I honestly don't trust governments/bureaucrats to be able to come up with a solution for this issue. This is one of those problems that evolves very quickly, and the solution probably needs to be done by a private company or by each person individually.
  - oblio 6y ago
    In 2016, I think, there were 0 airplane crashes and 0 air travel fatalities. Across 200 countries, hundreds of airlines and several airplane manufacturers, probably thousands of airports, millions of flights. If you think that was an easy feat, then I don't know what to tell you. Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy. When people really care, bureaucracy works wonders. Bureaucracy is basically formalizing social interactions for a specific topic. Formalizing something ossifies it, but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain.
    - MaxBarraclough 6y ago
      > 0 airplane crashes I presume you meant commercial aviation, rather than aviation in general. Unfortunately not quite true even there. Your broader point stands though. https://en.wikipedia.org/wiki/Category:Aviation_accidents_and_incidents_in_2016 https://en.wikipedia.org/wiki/Category:Aviation_accidents_an...
      - AnthonyMouse 6y ago
        > Your broader point stands though. Well no, you've neatly disproved it. The reason it works for commercial aviation and not anything else -- not even aviation in general -- is that the bureaucratic processes used for commercial aviation incur a massive overhead. When you have a product which costs a hundred million dollars a unit anyway and can kill 300 people in one shot if it fails, you pay the cost. For anything else it's too expensive, but spending less money causes the bureaucracy to be ineffective. And even in commercial aviation, the overhead is still there, it's just capable of eating the loss. (Or maybe it isn't, given the miserable lack of competition in that industry now. And then where does that lead us on safety, Boeing?)
Barrin92 6y ago
they just need to crack down much harder on websites and hand out big fines for dark patterns until the websites switch to sane defaults. It's just a question of how much the companies in question believe that the EU is going to come after them. Once the cost calculus shifts to being on the safe side it'd quickly turn into a norm, but it requires showing some teeth.
- emn13 6y ago
  It's already happening, but slowly, slowly. The various agencies need time to get their act together, and have started with the most egregious excesses. It seems rather unlikely at this point that consent forms that apply inappropriate pressure - explicitly called out in the GDPR as invalid - will somehow escape enforcement. I'd expect invalid cookie banners to be on the chopping block sometime fairly soon. Additionally, the risks to advertisers and websites are quite large, which I'm not sure they fully appreciate (unless I'm misunderstanding something here?) - it's not that the consent form is illegal, after all - perfectly legal to have a confusing consent form. Rather, it's that all the personally identifying information thus collected is illegal acquired and held (and it's hard to argue the violation wasn't intentional, to boot!), and the fines for that can be quite large, and can be applied retroactively to whenever the GDPR came into force. Rules always get stretched, but specifically in this way sounds pretty unwise (unless they're cynically trying to have some subsidiary go bankrupt or otherwise encapsulate the risk). With any luck, the GDPR norms on this front will become global norms, but it's too early to tell.
  - hvidgaard 6y ago
    I'm pretty sure GDPR states that it must be opt-in in a non deceiving manner.
    - emn13 6y ago
      Exactly; that's the point. An opt in that is coercive is not a valid grounds for holding personal data, ergo, that data is held illegally and subject to enforcement by a data-protection authority. Doesn't matter if everyone clicked yes. A coercive opt-in isn't so much illegal; it's simply void. Having a coercive opt-in would be fine yet weird (as I understand it) if you then proceeded to only retain and process personal information to the extent you would be permitted without the opt-in. (IANAL, and only as far as the GDPR is concerned, perhaps if it's misleading enough that violates some fraud statutes somewhere, but that's a different issue).
tannhaeuser 6y ago
I can only speak for myself, but actually I go to the detailed cookie settings and unselect everything I'm not ok with. In particular, I unselect ga and Fb pixel because I believe the habit of collecting visit data at an all-seeing central site isn't worth it, and actually is the major characteristic of a dystopian future that hacker culture has always been opposed to. If the consent settings are rubbish, I don't bother and leave the site; OTOH, if the settings are reasonable, I usually accept optimization and some analytic cookies. I can't stress enough how much of a game changer that is, by revealing the amount of third-party trackers on websites (in the order of up to 500 on a single site) alone. So I guess GDPR works for me. There's a lack of enforcement, though. But that could change; for example, in Germany, bored law firms (eg those not having clients currently), or anybody actually, can print money by starting an "Abmahnwelle" eg. insist on GDPR compliance within a certain period of time, then sue any site for non-GDPR compliance, all the while being entitled for compensation of their expenses if they have a cause.
- emn13 6y ago
  It may be the German implementation is different in this regard, but IIRC the GDPR did not create a personal right; enforcement is solely at the discretion of the relevant authority. I thought that was intentional; as a way to limit frivolous lawsuits, but I'm no expert by any means - are you sure this is actually possible?
  - tannhaeuser 6y ago
    No I'm not very sure, IANAL. I just thought that "Abmahnen", for once, could actually be used for something useful when it was used to bother small sites for violating the German "Impressumspflicht" (duty to include press contact info on sites). I'm also not sure it can be legally excluded for GDPR specifically as it has been a staple of German "Rechtspflege" (procurement of law by private orgs) for a long time. I know there has been a relative recent change in jurisdiction where compensation for "Abmahnen" was denied when it wasn't carried out in good faith, but I don't believe GDPR violators can rely on that one for continuing malpractice. I also believe when GDPR was enacted in 2017, internet companies got an additional two year's period of bringing their sites into compliance.
probst 6y ago
> Which is why GDPR, although theoretically a good idea, is pretty much useless in practice. This is very much not true. GDPR isn't restricted to regulating tracking on websites. It also restricts and regulates what companies can do with the customer data they are in possession of. Through my day job I constantly interact with large enterprises (Fortune XXXX) that have vast amounts of personal data through their regular operations (banks, telcos, car manufacturers, airlines, insurance companies and the likes). Nearly without exception they go to great lengths to ensure the data is managed correctly, not used for purposes the customer hasn't explicitly consented to etc. This is as a direct result of the GDPR.
HenryBemis 6y ago
So apparently we (EU) have the right to rip a new one to any big-ass company that is too mucho and gives zero shit about our Right to Privacy. I think that this got you downvoted. I also do my best to avoid tracking (Firefox add-ons, Hosts file). But up until now I had no leverage against any companies. Now they ought to be afraid when they play dirty.
mrweasel 6y ago
> is pretty much useless in practice It's useless because only a few people care enough to report these violations. If anything we need a campaign to get people to start reporting sites which violate the GDPR requirement of an informed opt-in.
rutthenut 6y ago
Do seem to have a lot of downvotes, yes! GDPR is about a lot more than the tracking stuff though, it is about the personal data companies hold and are responsible for, your permission to request it, the risk of fines if they don't comply. Whatever dark patterns they use for tracking logic, they are still bound to use best practice security on the personally-identifiable-information they may hold and may be fined if they do not. That is what GDPR is mostly about, as I see it.
black_puppydog 6y ago
FWIW, I didn't downvote you for this. And I just upvoted for this piece of comedy: > So apparently if you criticize gov/bureaucrats on HN you get downvoted.

MayeulC 6y ago

I think they're all Quantcast websites. I like that Firefox extension that adds a "I refuse" button: https://addons.mozilla.org/en-US/firefox/addon/qookiefix/ https://addons.mozilla.org/en-US/firefox/addon/qookiefix/

gear54rus 6y ago

I'd like to remind you and everyone else about Firefox reader mode. Solves like 99% of this user-enslaving shit.

AnthonyMouse 6y ago
And this is really the solution to all of it in the end. A user agent which is actually an agent of the user. Can't wait until first party isolation is the default in browsers.
- anoncake 6y ago
  You can't wait till websites use first-party cookies to track their users?
bad_user 6y ago
Screw that, I just close the page. If a publication disrespects their readers like that, then the content is trash anyway.
- Sodman 6y ago
  Outside of HN, most content creators, especially professionally, don't have the option to make significant changes to the platform on which their content is published. I agree that an entire publication's site can be trash, but good writers can still write on bad platforms.
  - ViViDboarder 6y ago
    They do as much as engineers at Google or Facebook do to change their companies. That is to say, each one cannot make much of an impact, but the responsible thing to do would be to not contribute or at least openly advocate for change from within. If enough people inside shift, then change can happen.
    - Sodman 6y ago

osullip 6y ago

This is what yahoo were doing in 2018 (it's my twitter) https://twitter.com/pos43/status/999606375217967104 https://twitter.com/pos43/status/999606375217967104 I found a very convoluted way of opting out: https://twitter.com/pos43/status/1001331147110957056 https://twitter.com/pos43/status/1001331147110957056 It is now 2020 and I would be interested to see if these methods have been changed to make them easier or harder.

dmitriid 6y ago
OAth is still the same

0xfaded 6y ago

Check out the ublock origin annoyances list, which will block cookie and gdpr pop-ups without breaking most websites.

gmantg 6y ago

I couldn't get Verizon site to show me the cookie banner. I guess the banner code lives on another domain that my uBO blocked.