7 ms·
I was recently tasked with making an "Accept our use of cookies" banner for our public site. Before that banner we did not store any cookies at all; now we have
by nwsm 6y ago
I was recently tasked with making an "Accept our use of cookies" banner for our public site. Before that banner we did not store any cookies at all; now we have one to store their consent.
- unfunco 6y agoIf you don't store cookies at all then you don't need the banner, you don't need consent to be doing nothing.
- deleted 6y ago[deleted]
- TonyTrapp 6y agoTry explaining that to the non-technical people the requirement came from.
- samoa42 6y agoalso perfect excuse to introduce some other usage of cookies https://news.ycombinator.com/item?id=24979895 https://news.ycombinator.com/item?id=24979895
- encom 6y agoThat shouldn't be very difficult. It's not a complex situation. I don't have a sign in front of my house saying "Beware of the dog", because I don't have a dog.
- rootusrootus 6y agoOTOH, if you got asked often enough if you had a scary dog, you may consider putting up a sign saying "There is no dog here."
- JoshTriplett 6y agoAt which point the more common question will become "what's with the sign?", and the sign may become the bigger source of concern. (See also https://knowyourmeme.com/memes/a-lot-of-questions-already-answered-by-the-shirt https://knowyourmeme.com/memes/a-lot-of-questions-already-an... .) You might instead consider asking people why they're asking, and figuring out ways to promote more widespread understanding. Concretely: you might actively promote adblockers and tell people why they should use them. And rather than saying "we don't use tracking cookies", you could explain "here's why so many sites have cookie banners, here's why we don't".
- mewpmewp2 6y agoOr you could focus on your business goals... And just be safe legally.
- JoshTriplett 6y agoI'm not suggesting doing it proactively; I'm suggesting doing it in response to the question, if people repeatedly ask the question. "No, and here are other ways to protect yourself" is stronger and more definitive than just "no".
- TonyTrapp 6y agoSince the topic touches law, it's more complex to some people than you might think. To us it's obvious, but someone else might think that they better be safe than sorry and not get sued for accidentally setting a (non-essential) cookie somewhere without letting the user know. I definitely know some people who'd rather implement such "unnecessary" things than exposing themselves to a potential legal trap.
- bavila 6y agoI would recommend thinking like a lawyer and writing a memo like one. Legal writing and analysis follows a very common pattern known as IRAC (Issue, Rule, Analysis, Conclusion): (1) Identify the issue; (2) Quote all relevant rules; (3) Analyze the rules in light of your specific factual circumstances; and (4) Reach a reasonable conclusion based on your analysis of the rules. This is how your company's legal team is making recommendations to management. You have to fight fire with fire. The only advantage your legal department may have over you is access to more comprehensive legal research services like Westlaw and LexisNexis. But at the end of the day, all they're doing is researching what the law is and how the courts are interpreting the law. Search for the right terms on Google, and you can do a pretty damn good job at crafting credible arguments. We don't need the lawyers always acting like they're at the top of the food chain.
- virtue3 6y agoLawyers would argue that it might be a good idea to put up a sign if your neighbors have a dog that could attack them. (weak argument but somewhat funny). Lawyers are ultra cautious. If you can -guarantee- that no one is going to magically add tracking/google analytics or some such to your site than sure, tell them you don't need the banner.
- mewpmewp2 6y agoI would say big picture wise it is wiser to add the banner unless it hurts your conversions.
- mewpmewp2 6y agoWhat if you might consider adding some analytics later down the road, but are afraid someone will forget about the cookie banner at that point?
- hobby-coder-guy 6y agoGet better at explaining. It isn’t difficult.
- chrisweekly 6y agoRespectfully, educating stakeholders is part of your job. Until you accept and embrace that, you're likely to remain stuck in roles doing useless things.
- Klinky 6y agoIf they heard from legal they need it and legal hourly rate is greater than engineering hourly rate, they will rather waste engineering time than spend legal time to save engineering time.
- Griffinsauce 6y agoLegal won't be maintaining this feature ad infinitum will it? Also: it might be interesting to try and find some metrics on conversion impact for those stakeholders. You're making the product worse.
- outworlder 6y agoHow do you know so much about his job role?
- libria 6y agoAttempting to educate stakeholders is part of your job. Forcing them to accept your reasoning may not be possible and they may have other reasons for their decisions that you may not know about or they may not wish to reveal (legal, marketing, internal politics, etc). And at some point in pushing back, disagree-and-commit is the right thing to do.
- reaperducer 6y agoIf you don't store cookies at all then you don't need the banner, you don't need consent to be doing nothing. That was his point. He was illustrating the absurdity he has to deal with.
- mewpmewp2 6y agoWhat if you might consider adding some analytics later down the road, but are afraid someone will forget about the cookie banner at that point? Maybe the customer wants to not worry if some new developer is tasked with analytics and maybe this developer forgets about the cookie banner.
- rustybolt 6y agoI'll bite: So why did you need it in the first place?
- nwsm 6y agoEventually we'll add an analytics plugin and need the banner. But at the time it was one of those "every site has one" decisions from non-technical folks. Similar frustration with arbitrary password requirements on the same site.
- DarkWiiPlayer 6y ago> password requirements Tell your higher-ups I hate them. I decide what my password is and if its secure enough considering how much I value a given service.
- airstrike 6y agoSometimes I really want my password to be 123123!
- reaperducer 6y agoSometimes I really want my password to be 123123! Yes, I do. For example, I have a laptop that is airgapped from the internet. But macOS still requires a password to differentiate between users. Fortunately, Apple permits four-digit numbers to be used for logins, and doesn't impose its own views on the situation.
- DarkWiiPlayer 6y agoLinux mint tells you* your password isn't strong enough, but just lets you click "next" anyway. Best approach if you ask me. * During user creation at least
- dvtrn 6y agoWhat are we as technical operators even good for if our counsel, judgment and recommendations (things I thought we were even hired for as valuable key contribution points) are frequently overridden by non-technical people who in the best cases don’t understand the evidence shown, in the worst don’t even care to?
- ATsch 6y agoIt's extra fun because there's really two options: a) the cookies are necessary for technical reasons. This means you don't need to ask for permission b) the cookies are for marketing, which means you must be able to decline without consequences Half of the banners do neither of these things and are thus either unnecessary or insufficient.
- eli 6y agoFor GDPR or CCPA?
- stefgodjibayo 6y agoGDPR and PECR (CCPA is primarily aimed at preventing selling of data)
- vmception 6y agosidenote: I wish California would pass a Right to be Forgotten like the EU has. That would be epic. Maybe I make that ballot measure myself, given so many "digital measures" having so much interest here already.
- withinboredom 6y agoFiled bankruptcy? No problem. Just make the credit companies forget about it! After moving from the US to the EU, I've thought about trying to use that right on my credit history in the US. I don't think it would work, but it would be entertaining if they even responded.
- alangibson 6y agoAt least 90% of the banners I get hit with around the web are automatically not GDPR compliant because they require you to opt out. It's amazing to think of the effort that's been expended implementing them while still failing to follow the law. I'd call it a legal fig leaf, but it doesn't cover up anything at all.
- cuu508 6y agoIt's a legal face mask with the nose sticking out
- swyx 6y agoi could see an excellent webcomic being made out of this
- reaperducer 6y agoBefore that banner we did not store any cookies at all; now we have one to store their consent. Some of the web sites I manage have sections in their Terms of Service outlining how we handle cookies, and store user login information. These are web sites that store no cookies, and do not have user logins. But whatever the legal department wants, the legal department gets. When I feel generous, I chock it up to Legal future-proofing the situation. When I'm not, I call it trendchasing.
- TeMPOraL 6y ago> When I feel generous, I chock it up to Legal future-proofing the situation. When I'm not, I call it trendchasing. In my even less charitable mood, I'd call it copy-pasting ToS templates to avoid doing work.
- mewpmewp2 6y agoI am guilty of doing that for my MVPs. I just go extra safe everything, because I would rather get to market sooner.
- TeMPOraL 6y agoYeah, and I don't hold it against very early stage startups or Show HNs. But if your company has lawyers in-house preparing these texts, that's more surprising then.