5 ms·

I would love to know the full story on how we ended up with the "hey, we use cookies" legislation? Of all the ineffectual privacy laws, that one sure surely tak

I would love to know the full story on how we ended up with the "hey, we use cookies" legislation? Of all the ineffectual privacy laws, that one sure surely takes the cake. Has _anyone_ _anywhere_ ever left a web site because of that warning?

ancarda 6y ago
Sometimes when I see the Google Search popups, I just do my search on DuckDuckGo instead. It's something of a reminder the website I'm on doesn't care about privacy But aside from that, they are completely useless and just making the web less enjoyable
shakna 6y ago
The legislation wasn't intended to have popups about all cookies everywhere. It was intended to stop web developers relying on 3rd parties setting arbitrary cookies to pierce the user's privacy across the entire web. (And it doesn't apply to first-party cookies). Unfortunately, the tech industry as a whole decided instead of finding a way to work in a more privacy conscious way it was far easier just to exhaust users so that they didn't have to change anything.
coldpie 6y ago
Roughly, websites are using cookies to track user behavior. Privacy-conscious users objected. Lawmakers couldn't, or won't, ban all tracking outright. So the compromise is the user must consent to the tracking. Hence the popups.
Nextgrid 6y ago
The initial legislation (commonly called the "cookie law") is indeed completely stupid. However this has now been replaced by the GDPR which not only covers more than cookies (and exempts cookies with no privacy impact) but also as rules around how a consent prompt should look and behave for it to be considered valid (a prompt that's opt-in by default or too annoying is in breach). Here are the rules from the ICO's website, UK's privacy regulator: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... The problem is there is no enforcement of these rules despite the potential for huge fines.
privacylawthrow 6y ago
I'm a privacy lawyer at a multinational company that has dealt with cookies for years. I created an account because none of the responses to you are correct. The ePrivacy Directive was not replaced by GDPR and cookie rules do apply to first party cookies. We ended up with cookie rules because regulators were concerned about the use of cookies to create user profiles based on activity across multiple websites, especially for "evercookies"/"zombie cookies" where a user's cookieID would be resurrected even after a user deleted them. Instead of banning zombie cookies or cross-site tracking, the EU instead decided it was a violation of user privacy to place any cookies or other data files on the user's machine without their consent. The actual language is "Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information." Cookie consent boxes are implemented at the website level because the law applies to website publishers, not browser makers. Website publishers were explicitly told that they cannot rely on a user's browser settings. This put the browsers in the back seat and ended up with today's world where you have to opt out of a service provider like Google Analytics on a site-by-site basis. The vast, vast majority of users do not touch cookie settings. There are probably more users running scripts to disable cookie popups than there are users opting in or out of specific cookies. It is an odd world where websites bend over backward to make cookie popups that actually work knowing full well users do not care. The average user doesn't really know much about cookies, much less the wide variety of activities powered by cookies. Cookie consent popups are publicly available, making them easy targets for regulatory audits. Ireland ran a huge sweep and sent out letters to a number of large companies telling them to clean up their act by October or else. We are a few weeks away from seeing what the "or else" will be. I'm happy to answer any other questions you have on this.
- ryandvm 6y ago
  Thank you for the fantastically detailed response. That actually does explain how we ended up her.
- AlexanderZ 6y ago
  So what does the real minimal setup look like? Will text ("This website uses cookies") + a button ("I agree") work?
XCSme 6y ago
> Has _anyone_ _anywhere_ ever left a web site because of that warning? Not because they use cookies, but because they show a full-screen pop-up that I have to read through or simply accept what it is saying without reading. Whenever I get a cookie pop-up I just close the site. I hate a lot more the time and brain power wasted on dealing with cookie pop-ups than the cookies themselves.

ancarda 6y ago

Sometimes when I see the Google Search popups, I just do my search on DuckDuckGo instead. It's something of a reminder the website I'm on doesn't care about privacy But aside from that, they are completely useless and just making the web less enjoyable

shakna 6y ago

The legislation wasn't intended to have popups about all cookies everywhere. It was intended to stop web developers relying on 3rd parties setting arbitrary cookies to pierce the user's privacy across the entire web. (And it doesn't apply to first-party cookies). Unfortunately, the tech industry as a whole decided instead of finding a way to work in a more privacy conscious way it was far easier just to exhaust users so that they didn't have to change anything.

coldpie 6y ago

Roughly, websites are using cookies to track user behavior. Privacy-conscious users objected. Lawmakers couldn't, or won't, ban all tracking outright. So the compromise is the user must consent to the tracking. Hence the popups.

Nextgrid 6y ago

The initial legislation (commonly called the "cookie law") is indeed completely stupid. However this has now been replaced by the GDPR which not only covers more than cookies (and exempts cookies with no privacy impact) but also as rules around how a consent prompt should look and behave for it to be considered valid (a prompt that's opt-in by default or too annoying is in breach). Here are the rules from the ICO's website, UK's privacy regulator: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... The problem is there is no enforcement of these rules despite the potential for huge fines.

privacylawthrow 6y ago

I'm a privacy lawyer at a multinational company that has dealt with cookies for years. I created an account because none of the responses to you are correct. The ePrivacy Directive was not replaced by GDPR and cookie rules do apply to first party cookies. We ended up with cookie rules because regulators were concerned about the use of cookies to create user profiles based on activity across multiple websites, especially for "evercookies"/"zombie cookies" where a user's cookieID would be resurrected even after a user deleted them. Instead of banning zombie cookies or cross-site tracking, the EU instead decided it was a violation of user privacy to place any cookies or other data files on the user's machine without their consent. The actual language is "Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information." Cookie consent boxes are implemented at the website level because the law applies to website publishers, not browser makers. Website publishers were explicitly told that they cannot rely on a user's browser settings. This put the browsers in the back seat and ended up with today's world where you have to opt out of a service provider like Google Analytics on a site-by-site basis. The vast, vast majority of users do not touch cookie settings. There are probably more users running scripts to disable cookie popups than there are users opting in or out of specific cookies. It is an odd world where websites bend over backward to make cookie popups that actually work knowing full well users do not care. The average user doesn't really know much about cookies, much less the wide variety of activities powered by cookies. Cookie consent popups are publicly available, making them easy targets for regulatory audits. Ireland ran a huge sweep and sent out letters to a number of large companies telling them to clean up their act by October or else. We are a few weeks away from seeing what the "or else" will be. I'm happy to answer any other questions you have on this.

ryandvm 6y ago
Thank you for the fantastically detailed response. That actually does explain how we ended up her.
AlexanderZ 6y ago
So what does the real minimal setup look like? Will text ("This website uses cookies") + a button ("I agree") work?

XCSme 6y ago

> Has _anyone_ _anywhere_ ever left a web site because of that warning? Not because they use cookies, but because they show a full-screen pop-up that I have to read through or simply accept what it is saying without reading. Whenever I get a cookie pop-up I just close the site. I hate a lot more the time and brain power wasted on dealing with cookie pop-ups than the cookies themselves.