11 ms·
What really drives me crazy are prompts that start by showing two options: "Consent to all cookies", or "customize". If you click "customize", it opens a new mo
by blauditore 6y ago
What really drives me crazy are prompts that start by showing two options: "Consent to all cookies", or "customize". If you click "customize", it opens a new modal window with a loading indicator that just doesn't seem to finish. I literally waited 60 seconds and then tried again by refreshing the page, ending up with another infinite loading indicator.
This means that users are de-factor forced to click "consent to all". I'm not even sure if that's legal.
Now, this was not some obscure small website, but the official Java documentation on docs.oracle.com! They use some third-party service for that - I just tried again, and though it worked this time, it still took 30+ seconds to submit my settings. I have a very hard time to believe this has technical reasons. Either this was made slow on purpose, or built by a bunch of morons.
/rant
- leadingthenet 6y agoI know exactly which prompt you’re talking about, it’s very common around the web. Unfortunately, the only solution I found that fixes it is disabling ad and tracker blockers. They seem to break that prompt, though if you set them to be very aggressive, the prompt disappears altogether.
- mnw21cam 6y agoDisabling javascript works pretty well too.
- SilasX 6y agoYou could report the site to the governing authorities as well.
- Nextgrid 6y agoThe solution is to fix your ad-blocker. Any good one will also block the consent management garbage from loading to begin with. uBlock Origin with all the "annoyances" lists enabled will block them all according to my experience.
- leadingthenet 6y agoThat’s what I meant by “setting to aggressive”, though I should’ve been more clear on that.
- beshrkayali 6y agoDockerHub uses a company/product called "TrustArc: TRUSTe" and they have _exactly_ this method. The slowdown is intentional. People who come up with sort of tactics and those who implement them should go to jail. It's beyond infuriating. I've decided to not upload my images to dockerhub because of this. Edit: jail time is not for anger obviously, but for intentionally swindling people. It'll be handled on a case by case bases obviously, but data is worth something, people who swindle you out of your data are like those who scam you in the street for your wallet, and as far as I know, there's jail time for that.
- dsabanin 6y agoWhy jail? I think we should just execute them on the spot. /s
- strbean 6y agoJust like we do in the USA for the crime of 'suspicion of selling loose cigarettes'!
- dimitrios1 6y agoCausing you to get angry is all it takes to warrant justification for jail time in your eyes? I am thankful you aren't in charge of any lawmaking.
- this_was_posted 6y agoJail might be a bit much, but giving them the maximum fine allowed under the GDPR seems quite reasonable to me. I'd even go so far as to try and transfer the debt to the individuals responsible if this causes the company to go bankrupt, as this is clearly malpractice.
- oarsinsync 6y ago> I'd even go so far as to try and transfer the debt to the individuals responsible if this causes the company to go bankrupt So who's liable in this scenario? Someone in the C suite? The coder monkey who implemented it? Someone in between? All of the above? Unless I'm mis-remembering, the maximum fine under GDPR is a % of the total revenue of the company, so depending on the size of the company, this could result in bankruptcy of any individuals deemed responsible too.
- CaptainZapp 6y agoWhat's even worse is the same system (Customize) to then land on a 30 page privacy statement with instructions how to opt-out with each of their 140 "partners". Alternatively you get advised (also in the context of that 30 page privacy statement) to disable cookies.
- mrunkel 6y agoWhich, after laboriously opting out of all 130 options, will show you an error message that not all partners currently except opt-outs. It's infuriating.
- rmc 6y agoIf people _cannot_ opt out, then the opt in is legally meaningless. i.e. people cannot legally opt in.
- rmc 6y agoThe GDPR says that you only have consent if it is as easy to opt out as to opt in. So if it's one click to opt in and 140+ to opt out, then the opt ins don't count. So you're processing personal data without consent. That's the way we prosecute them.
- nicbou 6y agoIf I can't opt out in two clicks, I leave the website and click the next search result.
- theocs 6y agoOr I just right click open it in private mode
- deleted 6y ago[deleted]
- jl6 6y agoNo guarantee that they won’t track you through other fingerprinting methods.
- iainmerrick 6y agoWhen do you ever have that guarantee anyway, though?
- rhizome 6y agoI'm not a statistician, but I'd think the less they can fingerprint you, the more you go in the "noise" bucket.
- blauditore 6y agoYeah, but that's kind of a pity if this one was the official documentation...
- kumarvvr 6y agoSlow on purpose. All incentives for the site owners are against user interests. No one benefits from users clicking to No Consent.
- marcosdumay 6y agoA dark pattern from Oracle? That's unexpected. That's why people are abandoning Java, by the way. But yes, isn't there on the GDPR that tracking must be opt-in? I don't see how the pop-up is legal, and making the opt-out inaccessible is probably a large violation.
- MereInterest 6y agoThe standard popups are 100% against the GDPR. In the GDPR, all consent must be explicit, uncoerced, and opt-in. If I recall correctly, there can be a request displayed to the user, but the "No tracking" option must be the default, and must not require any more user interaction than the "Yes tracking" option. If there is a "Yes tracking" button that immediately closes the banner and continues, then even having a "are you sure" dialog on the "no tracking" button breaks the GDPR. The GDPR gets this exactly right, and advertising companies are flagrantly breaking it. I'm hoping that there is actually some enforcement on it as well.
- jl6 6y agoCan you cite the part of the regulation that requires “no tracking” must not require any more user interaction than the "Yes tracking" option.
- SilasX 6y agoEveryone here seems to be unaware of article 7, section 3: >The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. Emphasis added. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
- cuu508 6y agoAlso relevant bits from recital 32 https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/ > Silence, pre-ticked boxes or inactivity should not therefore constitute consent. > If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
- heeen2 6y agoSomeone should write the next level of counter measures that just sends a bespoke cookie that contains the do not track info based on patterns similar to ad block - without ever having visited the site beforehand. Or if that's not working for some sites pretend you accept tracking but just forge the tracking ids with random data every visit
- chefandy 6y agoOr just use EFF's Privacy Badger.
- deleted 6y ago[deleted]
- chrisxcross 6y agoIt's the official solution created by Interactive Advertising Bureau and as the standard way to opt-out for all the companies in this organization: https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa... There are serious doubts if this is a complaint way to handle cookie consent.
- jimmaswell 6y agoYou can't take someone's lifeline away and act surprised when they try to get around it. Of course websites will do what they can to remain viable.
- Hokusai 6y agoThere is many people that will change their business model once it's unlawful. Not everybody is willing to break the law. But, there is people that does not care for their customers nor the law. From safety food violations to illegal pollution of air or rivers. That's why we need more strict law enforcement for companies.
- toast0 6y agoRight now, most places are dragging their feet, because there is at least plausible uncertainty. They're waiting for enforcement actions to see what the limits really are, and then they'll likely comply (or cut off access to EU ips, which doesn't strictly comply, but is more effective than asking people if they are EU persons and then denying service)
- ric2b 6y agoAdvertising doesn't depend on tracking users, please stop spreading this incorrect idea.
- arendtio 6y agoI am not even sure, if it is legal to make the opt-in easier than the opt-out. But I guess that is some kind of grey area nobody really cares about, even if it is crucial from a UX perspective.
- jyriand 6y agoAre there any good examples where the consent is done right?
- red_admiral 6y agoI personally wish that making user-hostile dark patterns on your site would attract the same kind of shame as saying something racist. People would learn _very_ quickly not to do it, and the police/state wouldn't need to get involved.
- rhizome 6y agoOneTrust, Evidon, and the rest of the "privacy management" services...why can't I just click once at their site that I don't want any cookies from any of the companies that use them? I just went through a thing with Evidon where each of their opt outs is a JS-required redirect, and when you get to a company like Adobe, you have to click on a million things with a million disappointments. https://imgur.com/a/d2qMJqn https://imgur.com/a/d2qMJqn It's intentional, and fuck you if you don't like it. Sorry, more like FUCK YOU if you don't like it.
- takeda 6y agoIt's clear, that the GDPR should be amended so the only way that tracking will be allowed is to have user send a notary signed letter every year saying that s/he wants to be tracked with a minimum 3 pages of attachment explanation why tracking is so great (in own words, no templates allowed). The company will be required to keep physical copies of these letters for 10 years for random checkups. Fuck the adtech industry.
- merb 6y agodont you like personalized ad's? btw. I do not get the adtech industry either, most of these targeted ads are definitiv not in my favor.
- takeda 6y agoI don't, the only times that I clicked on ads was by accident or site did some shenanigans to make me click on it. I absolutely never bought anything based on ad on site.
- easterncalculus 6y agoThis is like reCAPTCHA all over again. Sure, we don't block accessing our site from a proxy, we just make you select the traffic lights forever. Is a crosswalk light a traffic light? Sometimes. Does it count if only the edge is in the picture? What if it's almost completely out of shot? Let's also slow down the loading of the images to a crawl for no reason and sometimes even if you manage to wait for all of them to show up and select them all correctly 20 times in a row we just say you fail anyway and send you back to the beginning. There's no point in creating the line if you make the line endless. I'm not surprised Oracle of all places is doing what you've described, either.
- allarm 6y agoJust tried that (twice) - it took literally a fraction of second to open. Probably it was a temporary issue?
- pull_my_finger 6y agoReminds me of trying to opt out of DAA ads[1] I have never had much luck using it. I just tried now to see if it's different I managed to successfully opt out of 10 / 123. Clearly intentional or all these billion dollar ad companies are running their servers on broken raspberry pis. [1] - https://optout.aboutads.info https://optout.aboutads.info