9 ms·

This latest trend is so annoying: there is either "Accept" or: "See purpose". And the "Don't accept" stuff is hidden under "See purpose". Infuriating.

teraku 6y ago
Sometimes it just refers me to the ad tracker's page and there is no option to opt-out except for mail...
speedgoose 6y ago
It's not GDPR compatible by the way.
- jjulius 6y ago
  Unfortunately, it's compatible until the EU decides to hold people accountable for it.
  - lmkg 6y ago
    Not even the EU as a whole, it's up to the individual regulators in each country. On a related note: Since most US companies base their EU subsidiaries in Ireland for tax purposes, it's actually just up to the Irish regulator. There are... concerns.
    - enriquec 6y ago
      Individual freedom and sovereignty are always pesky nuisances for foolish centralized schemes.
    - disgruntledphd2 6y ago
      To be fair to the Irish regulator, the only reason that people have been able to delete Facebook accounts is because of their 2012 investigation. They are somewhat under-staffed, but this is improving (did you know that they are also suing the Irish Government?)
  - the_gipsy 6y ago
    https://enforcementtracker.com/ https://enforcementtracker.com/
    - anonymousab 6y ago
      This probably needs to be an order of magnitude or more higher, in order to start catching up with the web. To speak nothing of getting ahead.
MaxBarraclough 6y ago
This sort of 'dark pattern' can be found even on otherwise reputable websites, like TomsHardware. I believe it's against the letter of the GDPR, but as it isn't being enforced, we can expect this kind of thing to continue.
newswasboring 6y ago
There are sites (like wwe.com) where after you have successfully located the preference to opt out from everything it shows a "processing" screen which is stuck at 98% for about a minute. But accept is "processed" in an instant. Another dark pattern is showing you have opted out but some sites cannot receive opt out requests through https which is written in small fonts. By doing this they have successfully targeted security conscious people. I know this is not something major, but still, how do these people sleep at night? edit: I looked it up and wwe.com uses TrustArc, which seems to be a shady org certifying privacy. Mired in controversy, they have even settled a case with FTC in 2014 for $200,000. I'm guessing when push comes to shove and EU actually decides to prosecute they will pay a similar amount. I bet that amount is already in there books, set aside as "future risk management" or something like that. Just the cost of doing business.
- HumblyTossed 6y ago
  > There are sites (like wwe.com) where after you have successfully located the preference to opt out from everything it shows a "processing" screen which is stuck at 98% for about a minute. But accept is "processed" in an instant. How desperate does one have to be to work as a developer on projects like this?
  - bluntfang 6y ago
    earning your food and housing tokens is way better doing something like this than a lot of other things.
    - ascorbic 6y ago
      I guarantee that any engineer working on that product could get another equally well-compensated job which is not so morally bankrupt.
      - notyourwork 6y ago
        This argument doesn't hold up if you refer back to all engineering ethics dilemmas of the past. If all these engineers could have easily gotten another job, why did they stay? Why did Boeing engineers not speak up, why did Firestone engineers not speak up, the list continues. Not everyone has the same moral compass and that is the bottom line.
mderazon 6y ago
The tracking banners frenzy gdpr started is unbearable. It has decreased the usability of the web significantly. Everyone is obsessed with improving page loading time but what does worth that the page loads instantly if I have to navigate a maze of banner consent screens before I can see the content behind it Why can't everyone at least agree on the same banner format / ui or have it delegated to the browser behind some native browser functionality like autocomplete
- secondcoming 6y ago
  Good question. The downvotes are undeserved. The reason is that if it's done in the browser then a person's preferences will apply to every website they use with that browser. Publishers will not want that as they hope that users will give them more consent than other web sites (I certainly do give some websites full permissions if I like them, others are a 'reject all' and 'object all') Also, your consent preferences are stored under that website's cookie. There is the option of a global cookie but nobody uses it. This cookie data is then sent to everyone involved in the adtech chain (which is causing issues since it can be multiple KB's in size). It's format is described in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...
  - Aerroon 6y ago
    Perhaps this is where the regulation should've been aimed at in the first place? Cookie options have been present for a long time, but they don't have the necessary granularity. This would've been a great push to update the system.
- cuspycode 6y ago
  GDPR does not require any banners or consent dialogs at all for cookies that are necessary for authentication, navigation, or keeping track of shopping cart contents in the current session, etc. It's only the unnecessary tracking that needs explicit consent. So it's a good thing if such sites are slow to load and have to present irritating banners for legal reasons. This will hopefully put them at a competitive disadvantage compared to sites that don't insist on tracking their customers.
PeterStuer 6y ago
The worst ones have no opt out at all except for a general referral to the browser page for deleting cookies.
Semaphor 6y ago
also absolutely meaningless. it's essentially then going that when fines get handed out, they just get a warning because they tried.
- Semaphor 6y ago
  Wow, autocorrect mangled the 2nd sentence badly. > It's essentially them hoping that when fines get handed out, they just get a warning because they tried.
retSava 6y ago
And, an "accept" holds for seemingly till the end of time, while a "I don't accept" is valid not much more than the mouse button click echoes through my room before you stand before the dialog box yet again, contemplating why you don't do something more useful with your life.
- Whitespace 6y ago
  Even worse, nowadays there's only "accept" and "maybe later"
  - grawprog 6y ago
    Hell I seen one yesterday that was only 'accept' or 'subscribe to newsletter' with the 'not accept' being linked to the 'cancel' button of the subscribe to newsletter popup. Which you had to click into first.
  - FridgeSeal 6y ago
    That's a classic Google move. Tried to deny some google apps access to fine location, and it would ask at every single opportunity, it was so easy to accidentally enable it as well, which I guess is the point, wear you down until you press the wrong thing or just give in.
- thirdsun 6y ago
  Thank you for mentioning this. I feel as if I have to repeatedly jump through those hoops to decline on the very same sites every other day, if not visit. Surely the GDPR has to have the foresight of dictating that my choice to accept or decline has to be valid for an equal amount of time, doesn't it? If I'm confronted with that popup as long as I'm declining the regulations are worthless.
  - hundlaser 6y ago
    The GDPR itself really doesn't delve into that kind of detail. Generally, it's up to individuals to lodge complaints with their national data inspectorates regarding this type of thing, who then determine whether some specific procedure is compliant with article 7 (in this case) of the GDPR.
snicky 6y ago
I'm wondering if enforcing this on the browser level wouldn't make more sense. I mean, if a site use cookies or wants to track you in any other ways it would have to ask for your permission the same way you are asked before accessing your camera or microphone. You could opt-in or opt-out which should be the default if you don't make any choice. Then the sites would have to clearly stop you from accessing their content if you didn't opt-in, the same way you are stopped with paywalls. I think this would be much more transparent if we really want to teach people that they can pay for the content either with their money or their data. Of course another choice would be to just avoid these sites whatsoever.
- ratww 6y ago
  This is how it should be. Unfortunately even if this becomes a standard I can foresee Google dragging their feet on this and never implementing, and providers refusing to comply on grounds of "the user didn't reeeeeally mean to block tracking".
- tomjakubowski 6y ago
  You might be interested in the proposed Do Not Track header, which has so far failed to get any traction. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
  - segfaultbuserr 6y ago
    It's worth noting that Microsoft enabled Do Not Track in Internet Explorer by default just after it started to gain traction, which caused a small backlash against its use [0], notably Apache started to ignore all DNT headers from Internet Explorer. I have to wonder whether it was an intentional effort by Microsoft to discredit DNT and to stop people from respecting it... On one hand, the same outcome (almost ignored everywhere) is likely to occur regardless of whether Microsoft made its move, on the other hand, it may have gave it a greater push. [0] I have my cynical Fundamental Law of Privacy - it must not be enabled by default, so that the industry will continue profiting from it, while giving the user the illusion of choice. But at least those who enabled it enjoyed privacy, although only to a very limited extent.
smnrchrds 6y ago
I have seen worse. Der Speigel has "Accept" and redirection to sign up page for a paid subscription. I wan under the impression that forcing people to agree to tracking by withholding services until they do is not allowed under GDPR. Well, apparently it is. https://www.spiegel.de https://www.spiegel.de https://imgur.com/VWBmUzU https://imgur.com/VWBmUzU
- ratww 6y ago
  > I wan under the impression that forcing people to agree to tracking by withholding services until they do is not allowed under GDPR. You're 100% correct in your assumption. Der Spiegel is treading on thin ice here, or at least I hope they are. Here's the relevant GDPR text: Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment [1] [1] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/
  - disgruntledphd2 6y ago
    The Washington Post have the same thing. To view articles for free, they require you to sign away your GDPR rights, and they attempt to charge you 2x the money for a subscription without tracking. Sucks to be them I guess, as I pay for news (and run Ublock) but won't reward this mendacious behaviour.
segfaultbuserr 6y ago
One of the only websites I've seen that offers a big and clear "Decline" button is NextRoll's advertising service [0], e.g. seen on Texas Instruments' website [1]. But I haven't checked whether clicking the "Decline" button actually opts out everything. [0] https://www.nextroll.com/trust-center https://www.nextroll.com/trust-center [1] https://www.ti.com/product/TPS543620 https://www.ti.com/product/TPS543620
mastazi 6y ago
On sherdog.com, you get a giant cookie dialogue that covers half screen on mobile. If you don't accept, but click on "cookie settings" instead, a page will tell you that you can't choose to block 3rd party cookies unless you accept their 3rd party cookie, because they need to save your setting of not accepting 3rd party cookies in a 3rd party cookie. It's not a Monty Python episode, it's real: https://ibb.co/6YFpGWK https://ibb.co/6YFpGWK alternatively, if you click on the next link, you will be taken to a page that explains how to disable cookies in all latest-gen browsers such as Netscape 3 or IE 4.0: http://www.allaboutcookies.org/manage-cookies/ http://www.allaboutcookies.org/manage-cookies/ Needless to say, I now exclusively use Sherdog's competitor, Tapology.com
hlau 6y ago
My company actually did a very extensive study on this and found that the majority of websites utilize dark patterns. Only 25% of sites are even legally compliant even after deploying consent management software. Companies are openly flouting privacy laws and we actually found some of the worst offenders in the app space where consent mechanisms don't even exist within the apps themselves.

teraku 6y ago

Sometimes it just refers me to the ad tracker's page and there is no option to opt-out except for mail...

speedgoose 6y ago

It's not GDPR compatible by the way.

jjulius 6y ago
Unfortunately, it's compatible until the EU decides to hold people accountable for it.
- lmkg 6y ago
  Not even the EU as a whole, it's up to the individual regulators in each country. On a related note: Since most US companies base their EU subsidiaries in Ireland for tax purposes, it's actually just up to the Irish regulator. There are... concerns.
  - enriquec 6y ago
    Individual freedom and sovereignty are always pesky nuisances for foolish centralized schemes.
  - disgruntledphd2 6y ago
    To be fair to the Irish regulator, the only reason that people have been able to delete Facebook accounts is because of their 2012 investigation. They are somewhat under-staffed, but this is improving (did you know that they are also suing the Irish Government?)
- the_gipsy 6y ago
  https://enforcementtracker.com/ https://enforcementtracker.com/
  - anonymousab 6y ago
    This probably needs to be an order of magnitude or more higher, in order to start catching up with the web. To speak nothing of getting ahead.

MaxBarraclough 6y ago

This sort of 'dark pattern' can be found even on otherwise reputable websites, like TomsHardware. I believe it's against the letter of the GDPR, but as it isn't being enforced, we can expect this kind of thing to continue.

newswasboring 6y ago

There are sites (like wwe.com) where after you have successfully located the preference to opt out from everything it shows a "processing" screen which is stuck at 98% for about a minute. But accept is "processed" in an instant. Another dark pattern is showing you have opted out but some sites cannot receive opt out requests through https which is written in small fonts. By doing this they have successfully targeted security conscious people. I know this is not something major, but still, how do these people sleep at night? edit: I looked it up and wwe.com uses TrustArc, which seems to be a shady org certifying privacy. Mired in controversy, they have even settled a case with FTC in 2014 for $200,000. I'm guessing when push comes to shove and EU actually decides to prosecute they will pay a similar amount. I bet that amount is already in there books, set aside as "future risk management" or something like that. Just the cost of doing business.

HumblyTossed 6y ago
> There are sites (like wwe.com) where after you have successfully located the preference to opt out from everything it shows a "processing" screen which is stuck at 98% for about a minute. But accept is "processed" in an instant. How desperate does one have to be to work as a developer on projects like this?
- bluntfang 6y ago
  earning your food and housing tokens is way better doing something like this than a lot of other things.
  - ascorbic 6y ago
    I guarantee that any engineer working on that product could get another equally well-compensated job which is not so morally bankrupt.
    - notyourwork 6y ago
      This argument doesn't hold up if you refer back to all engineering ethics dilemmas of the past. If all these engineers could have easily gotten another job, why did they stay? Why did Boeing engineers not speak up, why did Firestone engineers not speak up, the list continues. Not everyone has the same moral compass and that is the bottom line.

mderazon 6y ago

The tracking banners frenzy gdpr started is unbearable. It has decreased the usability of the web significantly. Everyone is obsessed with improving page loading time but what does worth that the page loads instantly if I have to navigate a maze of banner consent screens before I can see the content behind it Why can't everyone at least agree on the same banner format / ui or have it delegated to the browser behind some native browser functionality like autocomplete

secondcoming 6y ago
Good question. The downvotes are undeserved. The reason is that if it's done in the browser then a person's preferences will apply to every website they use with that browser. Publishers will not want that as they hope that users will give them more consent than other web sites (I certainly do give some websites full permissions if I like them, others are a 'reject all' and 'object all') Also, your consent preferences are stored under that website's cookie. There is the option of a global cookie but nobody uses it. This cookie data is then sent to everyone involved in the adtech chain (which is causing issues since it can be multiple KB's in size). It's format is described in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...
- Aerroon 6y ago
  Perhaps this is where the regulation should've been aimed at in the first place? Cookie options have been present for a long time, but they don't have the necessary granularity. This would've been a great push to update the system.
cuspycode 6y ago
GDPR does not require any banners or consent dialogs at all for cookies that are necessary for authentication, navigation, or keeping track of shopping cart contents in the current session, etc. It's only the unnecessary tracking that needs explicit consent. So it's a good thing if such sites are slow to load and have to present irritating banners for legal reasons. This will hopefully put them at a competitive disadvantage compared to sites that don't insist on tracking their customers.

PeterStuer 6y ago

The worst ones have no opt out at all except for a general referral to the browser page for deleting cookies.

Semaphor 6y ago

also absolutely meaningless. it's essentially then going that when fines get handed out, they just get a warning because they tried.

Semaphor 6y ago
Wow, autocorrect mangled the 2nd sentence badly. > It's essentially them hoping that when fines get handed out, they just get a warning because they tried.

retSava 6y ago

And, an "accept" holds for seemingly till the end of time, while a "I don't accept" is valid not much more than the mouse button click echoes through my room before you stand before the dialog box yet again, contemplating why you don't do something more useful with your life.

Whitespace 6y ago
Even worse, nowadays there's only "accept" and "maybe later"
- grawprog 6y ago
  Hell I seen one yesterday that was only 'accept' or 'subscribe to newsletter' with the 'not accept' being linked to the 'cancel' button of the subscribe to newsletter popup. Which you had to click into first.
- FridgeSeal 6y ago
  That's a classic Google move. Tried to deny some google apps access to fine location, and it would ask at every single opportunity, it was so easy to accidentally enable it as well, which I guess is the point, wear you down until you press the wrong thing or just give in.
thirdsun 6y ago
Thank you for mentioning this. I feel as if I have to repeatedly jump through those hoops to decline on the very same sites every other day, if not visit. Surely the GDPR has to have the foresight of dictating that my choice to accept or decline has to be valid for an equal amount of time, doesn't it? If I'm confronted with that popup as long as I'm declining the regulations are worthless.
- hundlaser 6y ago
  The GDPR itself really doesn't delve into that kind of detail. Generally, it's up to individuals to lodge complaints with their national data inspectorates regarding this type of thing, who then determine whether some specific procedure is compliant with article 7 (in this case) of the GDPR.

snicky 6y ago

I'm wondering if enforcing this on the browser level wouldn't make more sense. I mean, if a site use cookies or wants to track you in any other ways it would have to ask for your permission the same way you are asked before accessing your camera or microphone. You could opt-in or opt-out which should be the default if you don't make any choice. Then the sites would have to clearly stop you from accessing their content if you didn't opt-in, the same way you are stopped with paywalls. I think this would be much more transparent if we really want to teach people that they can pay for the content either with their money or their data. Of course another choice would be to just avoid these sites whatsoever.

ratww 6y ago
This is how it should be. Unfortunately even if this becomes a standard I can foresee Google dragging their feet on this and never implementing, and providers refusing to comply on grounds of "the user didn't reeeeeally mean to block tracking".
tomjakubowski 6y ago
You might be interested in the proposed Do Not Track header, which has so far failed to get any traction. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
- segfaultbuserr 6y ago
  It's worth noting that Microsoft enabled Do Not Track in Internet Explorer by default just after it started to gain traction, which caused a small backlash against its use [0], notably Apache started to ignore all DNT headers from Internet Explorer. I have to wonder whether it was an intentional effort by Microsoft to discredit DNT and to stop people from respecting it... On one hand, the same outcome (almost ignored everywhere) is likely to occur regardless of whether Microsoft made its move, on the other hand, it may have gave it a greater push. [0] I have my cynical Fundamental Law of Privacy - it must not be enabled by default, so that the industry will continue profiting from it, while giving the user the illusion of choice. But at least those who enabled it enjoyed privacy, although only to a very limited extent.

smnrchrds 6y ago

I have seen worse. Der Speigel has "Accept" and redirection to sign up page for a paid subscription. I wan under the impression that forcing people to agree to tracking by withholding services until they do is not allowed under GDPR. Well, apparently it is. https://www.spiegel.de https://www.spiegel.de https://imgur.com/VWBmUzU https://imgur.com/VWBmUzU

ratww 6y ago
> I wan under the impression that forcing people to agree to tracking by withholding services until they do is not allowed under GDPR. You're 100% correct in your assumption. Der Spiegel is treading on thin ice here, or at least I hope they are. Here's the relevant GDPR text: Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment [1] [1] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/
- disgruntledphd2 6y ago
  The Washington Post have the same thing. To view articles for free, they require you to sign away your GDPR rights, and they attempt to charge you 2x the money for a subscription without tracking. Sucks to be them I guess, as I pay for news (and run Ublock) but won't reward this mendacious behaviour.

segfaultbuserr 6y ago

One of the only websites I've seen that offers a big and clear "Decline" button is NextRoll's advertising service [0], e.g. seen on Texas Instruments' website [1]. But I haven't checked whether clicking the "Decline" button actually opts out everything. [0] https://www.nextroll.com/trust-center https://www.nextroll.com/trust-center [1] https://www.ti.com/product/TPS543620 https://www.ti.com/product/TPS543620

mastazi 6y ago

On sherdog.com, you get a giant cookie dialogue that covers half screen on mobile. If you don't accept, but click on "cookie settings" instead, a page will tell you that you can't choose to block 3rd party cookies unless you accept their 3rd party cookie, because they need to save your setting of not accepting 3rd party cookies in a 3rd party cookie. It's not a Monty Python episode, it's real: https://ibb.co/6YFpGWK https://ibb.co/6YFpGWK alternatively, if you click on the next link, you will be taken to a page that explains how to disable cookies in all latest-gen browsers such as Netscape 3 or IE 4.0: http://www.allaboutcookies.org/manage-cookies/ http://www.allaboutcookies.org/manage-cookies/ Needless to say, I now exclusively use Sherdog's competitor, Tapology.com

hlau 6y ago

My company actually did a very extensive study on this and found that the majority of websites utilize dark patterns. Only 25% of sites are even legally compliant even after deploying consent management software. Companies are openly flouting privacy laws and we actually found some of the worst offenders in the app space where consent mechanisms don't even exist within the apps themselves.