8 ms·

Slack stores browser cookies without user consent

95 points by mikrosom 6y ago

knorker 6y ago
I find it hard to care about violations of the worst law that ever happened to the internet.
- wlll 6y ago
  Care to elaborate on that? I rather like it. As a developer it's a pain, but as a citizen I find it to be a step in the right direction.
  - mikrosom 6y ago
    I'd also be interested in an elaboration. It isn't much about the violation of the law itself but the violation of privacy; why do I have linkedin.com, spiceworks.com, techtarget.com, godknowswhat.com suspiciously dumping cookies in my browser?
    - knorker 6y ago
      And that has changed now? (more text here: https://news.ycombinator.com/item?id=25028296 https://news.ycombinator.com/item?id=25028296)
    - jeofken 6y ago
      Keeping cookies is voluntary - the HTTP header can only ask if you wish to keep it. Most popular user agents just keep all cookies by default, but it’s by no means given.
  - lkbm 6y ago
    I think there's some merit to "this site uses cookies to track you as you visit different sites". There's none whatsoever to "this site uses cookies to remember your login information". The law seems to make no distinction. As a user, I view every cookie notice as pointless and annoying -- obviously you use cookies, and obviously I'm okay with it. If the notice were specifically about cross-site tracking, that would be a meaningful notice, and opting out would make sense. Session cookies, though? You're warning me about session cookies? If I could set a blanket "I accept cookies" in my browser settings and have those notices all go away,. I would in a heartbeat. And, in fact, I DO have a blanket "I accept cookies" setting in my browser. Sadly, I'm still forced to manually opt-in on each stupid website. Ideally, we would distinguish between different "types" of cookies (and I believe the law requires you do this), and we would have settings specifically for these in browsers (which we sort of do in a limited fashion), and we would simply make it a setting defaulted to "ask". show notice only if the user has manually changed the setting from "ask" to "accept" for the types of cookies used on a site. Boom, useful and non-annoying cookie notices. Until we do that, it's a bad system, and a useless law.
    - yladiz 6y ago
      > The law seems to make no distinction. What do you mean by this? The law does make a distinction between essential and nonessential cookies (cookies that are necessary for the function of the website/app, i.e. session cookies, and not necessary, i.e. analytics IDs) and requires you to get consent for nonessential cookies, while allowing essential cookies. If a website doesn't set any nonessential cookies then it doesn't need to ask for consent.
      - lkbm 6y ago
        Good point. I'm certainly not an expert on the law -- I did some quick googling, but not a lot. Session cookies, e.g. are fine. As best I can tell, "remember me" / "remember my email" checkboxes still do require a banner, though I'm not sure. Preference cookies in general seem to. That strikes me as silly. Facebook's tracking me on thousands of unrelated websites; Wikipedia is remembering that I X'd out the donation banner last week and don't want to be shown it again[0]. These are entirely different use-cases with entirely different privacy implications. As far as I can tell, both require a banner, and while the banner allegedly has (or links to) details about which is occurring, I've never, ever paid enough attention to those banners to see those details. Part of this mess may be due to the fact that our client software is dominated by the largest advertiser, but I'd prefer regulations that address that by demanding privacy-respecting settings and setting defaults, not by showing me banners that I've never found useful. I use uBlock Origin and Firefox' tracking protection. I don't use the consent banners. I think most people automatically click "yes" on those, yet given the option to block tracking cookies en masse, would enable that option. [0] Okay, seems as if Wikipedia ISN'T storing that info, but I wish they did.
        ajnin 6y ago
        The case you describe for Wikipedia would be a functional cookie, not subject to a banner, while Facebook would use a tracking cookie, subject to a banner. I think that the fact that a lot of websites nag you with endless lists of cookie consent checkboxes, even for functional cookies, is not entirely innocent, and contributes to the idea that cookie notices are terribly annoying and pointless.
  - burke 6y ago
    In my opinion, it’s solving the problem at the wrong level. If you, as a government, want to coerce someone into solving this problem, it should be forcing browser vendors to provide more visibility into and control over (especially third-party) cookies. Instead, we have a banner you have to interact with as the price to visit pretty much any website.
    - rafram 6y ago
      I don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.
      - contravariant 6y ago
        I mean sure, but technically you already have that choice. It's entirely up to you whether to keep, discard or modify cookies. Your user agent is doing a bad job of managing this for you.
        wlll 6y ago
        GDPR isn't a cookie law, it's a data privacy law. Cookies aren't the problem, it's what people are doing with the data that's the issue. You can track people with all sorts of other means other than cookies, you would also need to get people's permission to do this.
        contravariant 6y ago
        We were specifically discussing the cookie banners though.
        wlll 6y ago
        Yes, but in the context of GDPR, which doesn't really go into detail about cookies, "…throughout its’ 88 pages, it only mentions cookies directly once" - https://gdpr.eu/cookies/ https://gdpr.eu/cookies/. The issue is handling of PII, tracking users and the hoops companies are jumping through to try to trick users into agreeing to allow this. In reality forcing users to select through the myriad of cookies that many sites set isn't practical, and doesn't get round the fact that you still would have to "Receive users’ consent before you use any cookies except strictly necessary cookies." A better technical solution would be to enforce that web applications respect a client header that specifies the level of cookies the client will allow (see https://gdpr.eu/cookies/ https://gdpr.eu/cookies/). An even better solution to this would be to stop the invasive tracking and profiling of users that has brought us to this point at all.
  - knorker 6y ago
    Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… For users it was as awful then as the experience is now. The people who made this law seemed to be under the impression that sites would react by removing cookies. This is naive or plain stupid. Instead what we have now is that every single site has a popup saying "Lorem ipsum" (nobody reads this), and you have to click "fuck off" to get to the content. I would LIKE to say that all this law does is annoy people. I would like that, but no. Instead what it does is train literally billions of people to click "fuck off" (actual text is usually something like "I agree", but what the user means is "fuck off, I'm trying to read the article"), without reading what the box says. ACTUAL security problems now, or ACTUAL choices, now cannot be warned about. Because if users were not good at reading actual meaningful warnings before, they sure as hell don't read them now. So not only is this law (1) not helping, people still have cookies. It's also (2) annoying absolutely everyone every day, with up to four "fuck off" buttons users need to click per page load, and (3) actively hurting via huge externalities, as described above. Oh, and for extra bonus on a weekly basis I run into websites that chose to simply block users from EU IPs, presumably after a ROI calculation. Thanks, EU. Are you in Europe?
    - wlll 6y ago
      > Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… > > For users it was as awful then as the experience is now. Yes, I remember. Back in the 90s you could always choose another browser that didn't do that, and we didn't yet have the rampant data collection and exploitation that we have seen since. Back in the 90s it was a novel thing when $known_company got a website at all. In the intervening years a huge amount of our life and identity has moved online. > The people who made this law seemed to be under the impression that sites would react by removing cookies. This is naive or plain stupid. Instead what we have now is that every single site has a popup saying "Lorem ipsum" (nobody reads this), and you have to click "fuck off" to get to the content. Where there is no way of opting out of the data collection I leave, and I have taught my family to do the same. It is possible to run a website that doesn't use cookie popups. Amazon UK sets 3 essential cookies (i18n prefs and two session cookies) on first page load. https://basecamp.com/ https://basecamp.com/ doesn't set any. > ACTUAL security problems now, or ACTUAL choices, now cannot be warned about. Because if users were not good at reading actual meaningful warnings before, they sure as hell don't read them now. Sorry, which websites were warning users of potential security issues before? What choices were users being asked to make? I am not sure we were browsing the same web. > So not only is this law (1) not helping, people still have cookies. It's also (2) annoying absolutely everyone every day, with up to four "fuck off" buttons users need to click per page load, and (3) actively hurting via huge externalities, as described above. Remember that this law isn't about cookies. It's not a cookie law, it's a law about data privacy and control. Cookies are just one part of it. The law also deals with the safe and appropriate handling of user data, and when a website does pop up a huge hard to use banner that uses dark patterns to get you to click it then it's not the EU being annoying and forcing users through this annoying process, it's forcing websites to effectively tell users that they want to do extra things with their data. It's like forcing bank robbers to dress up in stripey shirts and use bags labelled "SWAG". Any website that is doing that is basically being forced to wave a big red flag "I AM DOING DODGY THINGS WITH YOUR DATA" when you visit. You can at that point blindly click the "Accept" button if you want, I choose to leave. The web industry, and avertisers in particular, have had over 20 years to pull their shit together to avoid this, but they didn't, so now we have this. > Oh, and for extra bonus on a weekly basis I run into websites that chose to simply block users from EU IPs, presumably after a ROI calculation. Thanks, EU. I've hit very few of those, and to be honest it's not been a particularly big deal. It's also their choice. Don't want to stick to the EU speed limit? Don't drive on the EU roads. > Are you in Europe? For now.
- ffpip 6y ago
  If you are complaining about cookie banners, you can block all of them with uBlock Origin. https://www.youtube.com/watch?v=8TvCGWwQr5o https://www.youtube.com/watch?v=8TvCGWwQr5o
ffpip 6y ago
1. Block 3rd party cookies (useless on 99.99% of the sites) 2. Install uBlock Origin (https://www.ublockorigin.com https://www.ublockorigin.com)
- yladiz 6y ago
  Don't forget step 0: 0. Don't illegally put nonessential cookies in the browser without the user's consent.
  - dheera 6y ago
    I think it's impossible to enforce this worldwide, and any website can be based in any jurisdiction. The consent popups are also super annoying. It's also hard to define what "essential" means. I'm personally much more in favor of the technological solution: I block all cookies and only explicitly enable them on websites that I need to log in to.
    - yladiz 6y ago
      I would disagree with the idea that it's hard to define what's essential: whatever is essential for the function of a website/app. This means things like session login cookies but not analytics cookies.
      - barell 6y ago
        That is still not clear. Not everyone need to sign in so it could not be essential. It should ask when you want to login if you want to store a cookie or not.
        yladiz 6y ago
        Yeah, that's why it depends on the function of the website or app. If you need to sign in to access an app, and the session token is saved using a cookie, then it can be considered an essential cookie. But on a marketing website that doesn't have a login component then yes, you're right, logging in isn't required and so it's arguably a nonessential cookie.
Sebb767 6y ago
I've always doubted that all these popups are actually delay the setting of cookies. With so many options, it would be quite an undertaking to actually only embed what people checked.
eloff 6y ago
If they're for technical purposes, not tracking purposes you don't need permission under GDPR at least. I'm going to assume they know what they're doing, at least until I see evidence to the contrary. Benefit of the doubt, innocent until proven guilty, and all that.
- mikrosom 6y ago
  I still struggle to see how cookies set for spiceworks.com or linkedin.com are for "technical" purposes of just serving a landing page.
  - hdudjdididbbfk 6y ago
    “We need these super high tech cookiemotrons to provide you with the best user experience possible. We consider it a technical necessity to meet your need to have your data harvested. You should be thanking us. We would explain further, but you’re too stupid. What are you gonna do? Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO?.”
    - lol768 6y ago
      > Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO? Slack operates in the EU and has paying customers in the EU. It also likes to take advantage of anti-competition regulations when convenient: https://slack.com/intl/en-in/blog/news/slack-files-eu-competition-complaint-against-microsoft https://slack.com/intl/en-in/blog/news/slack-files-eu-compet... CEO pay seemed to be $356,952 at time of Slack's IPO. Maximum fine under GDPR is the greater of 4% annual turnover and $23M. Slack's turnover is too small, which means the maximum fine is $23M, nearly 700% of CEO's basic compensation. Regulations here have teeth; it's not the United States - and it's a good thing for society that they do.
      - iamacyborg 6y ago
        > Regulations here have teeth; it's not the United States - and it's a good thing for society that they do. sadly, the regulators are yet to show that the GDPR has any teeth. Most recently, the ICO gave British Airways and Marriott significant reductions on fines they raised last year.
TonyTrapp 6y ago
One minute wasted watching this and it doesn't even show the contents of those cookies. Without looking at the contents, it's impossible to tell if they are "necessary for site functionality", for which you do not need consent (as you can see in the video, there is no checkbox for that sort of cookies, they are always active).
- mikrosom 6y ago
  Without looking at the contents, would you argue non-Slack cookies (linkedin.com, techtarget.net, etc.) are essential for site functionality?
  - TonyTrapp 6y ago
    Slack has no control over those cookies - but it is of course questionable at best that those third-party services are allowed to embed their crap by default. That's not a cookie consent issue though, strictly speaking.
    - mjlawson 6y ago
      This isn't accurate. Slack has 100% control over the content that goes on their site, and that includes 3rd-party tracking pixels and other mechanisms that lead to these cookies from 3rd parties.
    - whimsicalism 6y ago
      > Slack has no control over those cookies Sorry, I fail to see how Slack has "no control" over the usage of ads.linkedin cookies?
  - yonixw 6y ago
    Google bot protection\re-captcha has cookies in google.com and ARE essential. but in the video you have some other stuff. So, at least for google you can't be sure.
    - Nextgrid 6y ago
ajnin 6y ago
Don't know about the actual cookies, but I'm pretty sure the "click a simple button to accept all but go through a long and slow process to reject"-pattern is not compliant with GDPR.
- marcinzm 6y ago
  Compliant is anything which government do not fine companies for under GDPR. Non-compliant is anything they do. Any other definition isn't relevant in practice. So far I haven't heard of governments fining over this and so it is effectively compliant. So if you have an issue with this behavior complain to your government representatives.
  - tpxl 6y ago
    Criminals that did something illegal but weren't caught are compliant with the law then?
    - marcinzm 6y ago
      That's not what I said. I said, a law which is not enforced is not in practice a law. It's just worthless words on a piece of paper. There's a difference between a law which is not enforced and a law which a particular entity (but not others) manage to evade. I merely pointed out that the entity to blame isn't the corporations who follow the law as it is applied but the government who enforces it that way.
- WhyNotHugo 6y ago
  It's not. An update was published to the regulation stating this clearly for those who don't understand what consent means. The option to accept or reject must be equally prominent, and if there's complications to rejecting, then the consent cannot be considered freely given. Disclaimer: I'm not a lawyer.
unreal37 6y ago
Could easily be explained by the difference between a "tracking cookie" and another type of cookie.
danielrpa 6y ago
The Cookie AutoDelete extension lets you sidestep these problems completely. You don't need to rely on trust to control your cookies, but a whitelist fully managed by you.
rblatz 6y ago
Who cares? Those damn consent banners are ruining the web.
- pavelevst 6y ago
  Completely agree. So annoying especially when it take half of mobile device screen I think with tracking protection in modern browsers it should be absolutely fine to allow websites to store data in any possible way (cookies, local storage, websql etc)
  - whimsicalism 6y ago
    I think many on this site often neglect the reality that soft barriers (having to figure out how to configure your cookie settings) become hard barriers for huge majorities of people.
    - BlueTemplar 6y ago
      As long as it's opt-out by default (like GDPR mandates it), it should be fine ?
- contravariant 6y ago
  I'm still hoping we can some day come up with some HTTP header that signals *I know what I'm doing, if you send me cookies I'll keep or discard them as I see fit".
  - Nextgrid 6y ago
    We did, it was called Do-Not-Track. If websites were respecting it we wouldn't have the current situation. The problem? Websites were not only ignoring it but using it as yet another tracking vector.
    - BlueTemplar 6y ago
      Couldn't all these 'pick cookies' dashboards be integrated in the browser without running in the same issue ?
blueblisters 6y ago
Honestly what's more annoying is websites presenting non-EU visitors with consent banners. I understand doing an IP based geolocation filter might not meet stringent compliance requirements/might be technically involved, but I resent a UX pattern that repeatedly requests my consent for cookies because, ironically, I do a lot of my browsing in incognito mode.
- WhyNotHugo 6y ago
  The real problem is that companies insist on doing so much non-essential user tracking. The intent of GDPR is to reduce this, but companies seems to prefer providing a terrible UX instead of respecting user's privacy.
dusted 6y ago
I would be outraged if I didn't know what cookies were, but since I do, I think it's entirely reasonable, any half modern browser provides a mechanism to allow or disallow, and otherwise manage cookies, and I'd much prefer that we abandon these idiotic "we value your privacy" nag-screens and bars and let it be up to the browser and user settings. Even the smallest change to the Set-Cookie header could have made it trivial to implement a browser-side UI for this: Set-Cookie: <cookie-name>=<cookie-value>; Max-Age=<non-zero-digit>; Description=<LANGUAGE:User readable description,...>; Importance=<Required|Recommended|Noncritical> If people don't want cookies, they can disable them in their browser. This is still one of the most idiotic laws the EU has made so far.
- wlll 6y ago
  > I would be outraged if I didn't know what cookies were, but since I do, I think it's entirely reasonable, any half modern browser provides a mechanism to allow or disallow, and otherwise manage cookies… Unfortunately that mechanism doesn't exist. > I'd much prefer that we abandon these idiotic "we value your privacy" nag-screens and bars There's an easy way of fixing this, and that's to just not send the cookies. See basecamp.com or amazon.co.uk (from the UK). No cookie popups, and (respectively) 0 and 3 (seemingly essential) cookies. > let it be up to the browser and user settings. That ship has sailed. You now require user consent before you set all but essential cookies https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ > Even the smallest change to the Set-Cookie header could have made it trivial to implement a browser-side UI for this: Set-Cookie: <cookie-name>=<cookie-value>; Max-Age=<non-zero-digit>; Description=<LANGUAGE:User readable description,...>; Importance=<Required|Recommended|Noncritical> That ship has, as I said above, sailed. > If people don't want cookies, they can disable them in their browser. Ditto. But, seriously, do you know how ridiculous that argument sounds? Don't like people speeding? Don't drive! You are unlikely to be so thick to think that turning cookies off on a web browser will make the web anything other than completely unusable. > This is still one of the most idiotic laws the EU has made so far. The butthurt from people about this is amazing. We've had companies playing fast and loose with our data for 20+ years and they had all this time to sort themselves out, and they didn't. They kept on abusing the system to attempt to squeeze out ever more marginal gains from users personal data. This is on them.

95 points by mikrosom 6y ago

knorker 6y ago

I find it hard to care about violations of the worst law that ever happened to the internet.

wlll 6y ago
Care to elaborate on that? I rather like it. As a developer it's a pain, but as a citizen I find it to be a step in the right direction.
- mikrosom 6y ago
  I'd also be interested in an elaboration. It isn't much about the violation of the law itself but the violation of privacy; why do I have linkedin.com, spiceworks.com, techtarget.com, godknowswhat.com suspiciously dumping cookies in my browser?
  - knorker 6y ago
    And that has changed now? (more text here: https://news.ycombinator.com/item?id=25028296 https://news.ycombinator.com/item?id=25028296)
  - jeofken 6y ago
    Keeping cookies is voluntary - the HTTP header can only ask if you wish to keep it. Most popular user agents just keep all cookies by default, but it’s by no means given.
- lkbm 6y ago
  I think there's some merit to "this site uses cookies to track you as you visit different sites". There's none whatsoever to "this site uses cookies to remember your login information". The law seems to make no distinction. As a user, I view every cookie notice as pointless and annoying -- obviously you use cookies, and obviously I'm okay with it. If the notice were specifically about cross-site tracking, that would be a meaningful notice, and opting out would make sense. Session cookies, though? You're warning me about session cookies? If I could set a blanket "I accept cookies" in my browser settings and have those notices all go away,. I would in a heartbeat. And, in fact, I DO have a blanket "I accept cookies" setting in my browser. Sadly, I'm still forced to manually opt-in on each stupid website. Ideally, we would distinguish between different "types" of cookies (and I believe the law requires you do this), and we would have settings specifically for these in browsers (which we sort of do in a limited fashion), and we would simply make it a setting defaulted to "ask". show notice only if the user has manually changed the setting from "ask" to "accept" for the types of cookies used on a site. Boom, useful and non-annoying cookie notices. Until we do that, it's a bad system, and a useless law.
  - yladiz 6y ago
    > The law seems to make no distinction. What do you mean by this? The law does make a distinction between essential and nonessential cookies (cookies that are necessary for the function of the website/app, i.e. session cookies, and not necessary, i.e. analytics IDs) and requires you to get consent for nonessential cookies, while allowing essential cookies. If a website doesn't set any nonessential cookies then it doesn't need to ask for consent.
    - lkbm 6y ago
      Good point. I'm certainly not an expert on the law -- I did some quick googling, but not a lot. Session cookies, e.g. are fine. As best I can tell, "remember me" / "remember my email" checkboxes still do require a banner, though I'm not sure. Preference cookies in general seem to. That strikes me as silly. Facebook's tracking me on thousands of unrelated websites; Wikipedia is remembering that I X'd out the donation banner last week and don't want to be shown it again[0]. These are entirely different use-cases with entirely different privacy implications. As far as I can tell, both require a banner, and while the banner allegedly has (or links to) details about which is occurring, I've never, ever paid enough attention to those banners to see those details. Part of this mess may be due to the fact that our client software is dominated by the largest advertiser, but I'd prefer regulations that address that by demanding privacy-respecting settings and setting defaults, not by showing me banners that I've never found useful. I use uBlock Origin and Firefox' tracking protection. I don't use the consent banners. I think most people automatically click "yes" on those, yet given the option to block tracking cookies en masse, would enable that option. [0] Okay, seems as if Wikipedia ISN'T storing that info, but I wish they did.
      - ajnin 6y ago
        The case you describe for Wikipedia would be a functional cookie, not subject to a banner, while Facebook would use a tracking cookie, subject to a banner. I think that the fact that a lot of websites nag you with endless lists of cookie consent checkboxes, even for functional cookies, is not entirely innocent, and contributes to the idea that cookie notices are terribly annoying and pointless.
- burke 6y ago
  In my opinion, it’s solving the problem at the wrong level. If you, as a government, want to coerce someone into solving this problem, it should be forcing browser vendors to provide more visibility into and control over (especially third-party) cookies. Instead, we have a banner you have to interact with as the price to visit pretty much any website.
  - rafram 6y ago
    I don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.
    - contravariant 6y ago
      I mean sure, but technically you already have that choice. It's entirely up to you whether to keep, discard or modify cookies. Your user agent is doing a bad job of managing this for you.
      - wlll 6y ago
        GDPR isn't a cookie law, it's a data privacy law. Cookies aren't the problem, it's what people are doing with the data that's the issue. You can track people with all sorts of other means other than cookies, you would also need to get people's permission to do this.
        contravariant 6y ago
        We were specifically discussing the cookie banners though.
        wlll 6y ago
        Yes, but in the context of GDPR, which doesn't really go into detail about cookies, "…throughout its’ 88 pages, it only mentions cookies directly once" - https://gdpr.eu/cookies/ https://gdpr.eu/cookies/. The issue is handling of PII, tracking users and the hoops companies are jumping through to try to trick users into agreeing to allow this. In reality forcing users to select through the myriad of cookies that many sites set isn't practical, and doesn't get round the fact that you still would have to "Receive users’ consent before you use any cookies except strictly necessary cookies." A better technical solution would be to enforce that web applications respect a client header that specifies the level of cookies the client will allow (see https://gdpr.eu/cookies/ https://gdpr.eu/cookies/). An even better solution to this would be to stop the invasive tracking and profiling of users that has brought us to this point at all.
- knorker 6y ago
  Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… For users it was as awful then as the experience is now. The people who made this law seemed to be under the impression that sites would react by removing cookies. This is naive or plain stupid. Instead what we have now is that every single site has a popup saying "Lorem ipsum" (nobody reads this), and you have to click "fuck off" to get to the content. I would LIKE to say that all this law does is annoy people. I would like that, but no. Instead what it does is train literally billions of people to click "fuck off" (actual text is usually something like "I agree", but what the user means is "fuck off, I'm trying to read the article"), without reading what the box says. ACTUAL security problems now, or ACTUAL choices, now cannot be warned about. Because if users were not good at reading actual meaningful warnings before, they sure as hell don't read them now. So not only is this law (1) not helping, people still have cookies. It's also (2) annoying absolutely everyone every day, with up to four "fuck off" buttons users need to click per page load, and (3) actively hurting via huge externalities, as described above. Oh, and for extra bonus on a weekly basis I run into websites that chose to simply block users from EU IPs, presumably after a ROI calculation. Thanks, EU. Are you in Europe?
  - wlll 6y ago
    > Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… > > For users it was as awful then as the experience is now. Yes, I remember. Back in the 90s you could always choose another browser that didn't do that, and we didn't yet have the rampant data collection and exploitation that we have seen since. Back in the 90s it was a novel thing when $known_company got a website at all. In the intervening years a huge amount of our life and identity has moved online. > The people who made this law seemed to be under the impression that sites would react by removing cookies. This is naive or plain stupid. Instead what we have now is that every single site has a popup saying "Lorem ipsum" (nobody reads this), and you have to click "fuck off" to get to the content. Where there is no way of opting out of the data collection I leave, and I have taught my family to do the same. It is possible to run a website that doesn't use cookie popups. Amazon UK sets 3 essential cookies (i18n prefs and two session cookies) on first page load. https://basecamp.com/ https://basecamp.com/ doesn't set any. > ACTUAL security problems now, or ACTUAL choices, now cannot be warned about. Because if users were not good at reading actual meaningful warnings before, they sure as hell don't read them now. Sorry, which websites were warning users of potential security issues before? What choices were users being asked to make? I am not sure we were browsing the same web. > So not only is this law (1) not helping, people still have cookies. It's also (2) annoying absolutely everyone every day, with up to four "fuck off" buttons users need to click per page load, and (3) actively hurting via huge externalities, as described above. Remember that this law isn't about cookies. It's not a cookie law, it's a law about data privacy and control. Cookies are just one part of it. The law also deals with the safe and appropriate handling of user data, and when a website does pop up a huge hard to use banner that uses dark patterns to get you to click it then it's not the EU being annoying and forcing users through this annoying process, it's forcing websites to effectively tell users that they want to do extra things with their data. It's like forcing bank robbers to dress up in stripey shirts and use bags labelled "SWAG". Any website that is doing that is basically being forced to wave a big red flag "I AM DOING DODGY THINGS WITH YOUR DATA" when you visit. You can at that point blindly click the "Accept" button if you want, I choose to leave. The web industry, and avertisers in particular, have had over 20 years to pull their shit together to avoid this, but they didn't, so now we have this. > Oh, and for extra bonus on a weekly basis I run into websites that chose to simply block users from EU IPs, presumably after a ROI calculation. Thanks, EU. I've hit very few of those, and to be honest it's not been a particularly big deal. It's also their choice. Don't want to stick to the EU speed limit? Don't drive on the EU roads. > Are you in Europe? For now.
ffpip 6y ago
If you are complaining about cookie banners, you can block all of them with uBlock Origin. https://www.youtube.com/watch?v=8TvCGWwQr5o https://www.youtube.com/watch?v=8TvCGWwQr5o

ffpip 6y ago

1. Block 3rd party cookies (useless on 99.99% of the sites) 2. Install uBlock Origin (https://www.ublockorigin.com https://www.ublockorigin.com)

yladiz 6y ago
Don't forget step 0: 0. Don't illegally put nonessential cookies in the browser without the user's consent.
- dheera 6y ago
  I think it's impossible to enforce this worldwide, and any website can be based in any jurisdiction. The consent popups are also super annoying. It's also hard to define what "essential" means. I'm personally much more in favor of the technological solution: I block all cookies and only explicitly enable them on websites that I need to log in to.
  - yladiz 6y ago
    I would disagree with the idea that it's hard to define what's essential: whatever is essential for the function of a website/app. This means things like session login cookies but not analytics cookies.
    - barell 6y ago
      That is still not clear. Not everyone need to sign in so it could not be essential. It should ask when you want to login if you want to store a cookie or not.
      - yladiz 6y ago
        Yeah, that's why it depends on the function of the website or app. If you need to sign in to access an app, and the session token is saved using a cookie, then it can be considered an essential cookie. But on a marketing website that doesn't have a login component then yes, you're right, logging in isn't required and so it's arguably a nonessential cookie.

Sebb767 6y ago

I've always doubted that all these popups are actually delay the setting of cookies. With so many options, it would be quite an undertaking to actually only embed what people checked.

eloff 6y ago

If they're for technical purposes, not tracking purposes you don't need permission under GDPR at least. I'm going to assume they know what they're doing, at least until I see evidence to the contrary. Benefit of the doubt, innocent until proven guilty, and all that.

mikrosom 6y ago
I still struggle to see how cookies set for spiceworks.com or linkedin.com are for "technical" purposes of just serving a landing page.
- hdudjdididbbfk 6y ago
  “We need these super high tech cookiemotrons to provide you with the best user experience possible. We consider it a technical necessity to meet your need to have your data harvested. You should be thanking us. We would explain further, but you’re too stupid. What are you gonna do? Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO?.”
  - lol768 6y ago
    > Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO? Slack operates in the EU and has paying customers in the EU. It also likes to take advantage of anti-competition regulations when convenient: https://slack.com/intl/en-in/blog/news/slack-files-eu-competition-complaint-against-microsoft https://slack.com/intl/en-in/blog/news/slack-files-eu-compet... CEO pay seemed to be $356,952 at time of Slack's IPO. Maximum fine under GDPR is the greater of 4% annual turnover and $23M. Slack's turnover is too small, which means the maximum fine is $23M, nearly 700% of CEO's basic compensation. Regulations here have teeth; it's not the United States - and it's a good thing for society that they do.
    - iamacyborg 6y ago
      > Regulations here have teeth; it's not the United States - and it's a good thing for society that they do. sadly, the regulators are yet to show that the GDPR has any teeth. Most recently, the ICO gave British Airways and Marriott significant reductions on fines they raised last year.

TonyTrapp 6y ago

One minute wasted watching this and it doesn't even show the contents of those cookies. Without looking at the contents, it's impossible to tell if they are "necessary for site functionality", for which you do not need consent (as you can see in the video, there is no checkbox for that sort of cookies, they are always active).

mikrosom 6y ago
Without looking at the contents, would you argue non-Slack cookies (linkedin.com, techtarget.net, etc.) are essential for site functionality?
- TonyTrapp 6y ago
  Slack has no control over those cookies - but it is of course questionable at best that those third-party services are allowed to embed their crap by default. That's not a cookie consent issue though, strictly speaking.
  - mjlawson 6y ago
    This isn't accurate. Slack has 100% control over the content that goes on their site, and that includes 3rd-party tracking pixels and other mechanisms that lead to these cookies from 3rd parties.
  - whimsicalism 6y ago
    > Slack has no control over those cookies Sorry, I fail to see how Slack has "no control" over the usage of ads.linkedin cookies?
- yonixw 6y ago
  Google bot protection\re-captcha has cookies in google.com and ARE essential. but in the video you have some other stuff. So, at least for google you can't be sure.
  - Nextgrid 6y ago

ajnin 6y ago

Don't know about the actual cookies, but I'm pretty sure the "click a simple button to accept all but go through a long and slow process to reject"-pattern is not compliant with GDPR.

marcinzm 6y ago
Compliant is anything which government do not fine companies for under GDPR. Non-compliant is anything they do. Any other definition isn't relevant in practice. So far I haven't heard of governments fining over this and so it is effectively compliant. So if you have an issue with this behavior complain to your government representatives.
- tpxl 6y ago
  Criminals that did something illegal but weren't caught are compliant with the law then?
  - marcinzm 6y ago
    That's not what I said. I said, a law which is not enforced is not in practice a law. It's just worthless words on a piece of paper. There's a difference between a law which is not enforced and a law which a particular entity (but not others) manage to evade. I merely pointed out that the entity to blame isn't the corporations who follow the law as it is applied but the government who enforces it that way.
WhyNotHugo 6y ago
It's not. An update was published to the regulation stating this clearly for those who don't understand what consent means. The option to accept or reject must be equally prominent, and if there's complications to rejecting, then the consent cannot be considered freely given. Disclaimer: I'm not a lawyer.

unreal37 6y ago

Could easily be explained by the difference between a "tracking cookie" and another type of cookie.

danielrpa 6y ago

The Cookie AutoDelete extension lets you sidestep these problems completely. You don't need to rely on trust to control your cookies, but a whitelist fully managed by you.

rblatz 6y ago

Who cares? Those damn consent banners are ruining the web.

pavelevst 6y ago
Completely agree. So annoying especially when it take half of mobile device screen I think with tracking protection in modern browsers it should be absolutely fine to allow websites to store data in any possible way (cookies, local storage, websql etc)
- whimsicalism 6y ago
  I think many on this site often neglect the reality that soft barriers (having to figure out how to configure your cookie settings) become hard barriers for huge majorities of people.
  - BlueTemplar 6y ago
    As long as it's opt-out by default (like GDPR mandates it), it should be fine ?
contravariant 6y ago
I'm still hoping we can some day come up with some HTTP header that signals *I know what I'm doing, if you send me cookies I'll keep or discard them as I see fit".
- Nextgrid 6y ago
  We did, it was called Do-Not-Track. If websites were respecting it we wouldn't have the current situation. The problem? Websites were not only ignoring it but using it as yet another tracking vector.
  - BlueTemplar 6y ago
    Couldn't all these 'pick cookies' dashboards be integrated in the browser without running in the same issue ?

blueblisters 6y ago

Honestly what's more annoying is websites presenting non-EU visitors with consent banners. I understand doing an IP based geolocation filter might not meet stringent compliance requirements/might be technically involved, but I resent a UX pattern that repeatedly requests my consent for cookies because, ironically, I do a lot of my browsing in incognito mode.

WhyNotHugo 6y ago
The real problem is that companies insist on doing so much non-essential user tracking. The intent of GDPR is to reduce this, but companies seems to prefer providing a terrible UX instead of respecting user's privacy.

dusted 6y ago

I would be outraged if I didn't know what cookies were, but since I do, I think it's entirely reasonable, any half modern browser provides a mechanism to allow or disallow, and otherwise manage cookies, and I'd much prefer that we abandon these idiotic "we value your privacy" nag-screens and bars and let it be up to the browser and user settings. Even the smallest change to the Set-Cookie header could have made it trivial to implement a browser-side UI for this: Set-Cookie: <cookie-name>=<cookie-value>; Max-Age=<non-zero-digit>; Description=<LANGUAGE:User readable description,...>; Importance=<Required|Recommended|Noncritical> If people don't want cookies, they can disable them in their browser. This is still one of the most idiotic laws the EU has made so far.

wlll 6y ago
> I would be outraged if I didn't know what cookies were, but since I do, I think it's entirely reasonable, any half modern browser provides a mechanism to allow or disallow, and otherwise manage cookies… Unfortunately that mechanism doesn't exist. > I'd much prefer that we abandon these idiotic "we value your privacy" nag-screens and bars There's an easy way of fixing this, and that's to just not send the cookies. See basecamp.com or amazon.co.uk (from the UK). No cookie popups, and (respectively) 0 and 3 (seemingly essential) cookies. > let it be up to the browser and user settings. That ship has sailed. You now require user consent before you set all but essential cookies https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ > Even the smallest change to the Set-Cookie header could have made it trivial to implement a browser-side UI for this: Set-Cookie: <cookie-name>=<cookie-value>; Max-Age=<non-zero-digit>; Description=<LANGUAGE:User readable description,...>; Importance=<Required|Recommended|Noncritical> That ship has, as I said above, sailed. > If people don't want cookies, they can disable them in their browser. Ditto. But, seriously, do you know how ridiculous that argument sounds? Don't like people speeding? Don't drive! You are unlikely to be so thick to think that turning cookies off on a web browser will make the web anything other than completely unusable. > This is still one of the most idiotic laws the EU has made so far. The butthurt from people about this is amazing. We've had companies playing fast and loose with our data for 20+ years and they had all this time to sort themselves out, and they didn't. They kept on abusing the system to attempt to squeeze out ever more marginal gains from users personal data. This is on them.