6 ms·

Who cares? Those damn consent banners are ruining the web.

by rblatz 6y ago

pavelevst 6y ago
Completely agree. So annoying especially when it take half of mobile device screen I think with tracking protection in modern browsers it should be absolutely fine to allow websites to store data in any possible way (cookies, local storage, websql etc)
- whimsicalism 6y ago
  I think many on this site often neglect the reality that soft barriers (having to figure out how to configure your cookie settings) become hard barriers for huge majorities of people.
  - BlueTemplar 6y ago
    As long as it's opt-out by default (like GDPR mandates it), it should be fine ?
contravariant 6y ago
I'm still hoping we can some day come up with some HTTP header that signals *I know what I'm doing, if you send me cookies I'll keep or discard them as I see fit".
- Nextgrid 6y ago
  We did, it was called Do-Not-Track. If websites were respecting it we wouldn't have the current situation. The problem? Websites were not only ignoring it but using it as yet another tracking vector.
  - BlueTemplar 6y ago
    Couldn't all these 'pick cookies' dashboards be integrated in the browser without running in the same issue ?
    - Nextgrid 6y ago
      The problem is that the GDPR consent prompts ask for tracking/data processing consent regardless of any technical methods like cookies, local storage or browser fingerprinting. A browser implementing a cookie consent UI would not fully solve the problem because websites might still want to track you through other means (browser fingerprinting, server-side analytics, etc) and if they want to respect the regulation then they still need to ask for consent.
      - BlueTemplar 6y ago
        Well, this would still offload most of it to the browser, and I guess that plenty of websites (especially smaller ones, for which GDPR compliance is likely to be a heavy drag) do not use these other means ?
  - grayhatter 6y ago
    Shocked-pikachu.jpg Why don't we have any browsers that aggressively deny and block tracking? Oh right, the ad companies.
    - zrobotics 6y ago
      Isn't that Brave? Granted, they have their wierd crypto crap, but the big selling point is adblocking by default.
  - recursive 6y ago
    Do-Not-Track is the opposite. Do-Not-Track is a request not to send cookies. This would be like Go-Ahead-And-Try-Track-Me-I-Dare-You.
  - merb 6y ago
    if gdpr would have used a framework like do-not-track it would have not happend. but as always in the eu. NIH syndrome. also they did not cared besides multiple people telling the rulemakers that this will happen.
    - danhor 6y ago
      There's nothing about the gdpr that forced cookie banners for each website. The tech industry could have implemented the requirements differently, but they haven't done that, instead taking the most annoying and obvious route. The closest thing to a technical solution that was widespread is do-not-track, but since it gets thoroughly ignored nowadays, it's worthless. As an example, since the DNT header is a pretty clear signal that you don't want to consent for various tracking, websites wouldn't have to display the consent-form for that and could only use essential cookies (or leave a choice for cookies for other purposes, if there are any). Recital 32: "This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data." And according to the ico (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...), the common click-this-button-to-get-through or do annoying things is not valid consent: "You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way.". The reason why you don't want a specific technical provision in this law (and almost all laws) is that they get outdated in less than five years. For example, imagine a framework based on http-headers fixed in law. That would've made it (almost) impossible for google to introduce spdy in europe, since it isn't http. Or, more general, the EU initiative to use micro-usb connectors would have made the switch to usb-c impossible, if they were written into law. And that's a comparatively slow moving field, with a very specific applications (charging mobile phones).
dijit 6y ago
That's the intention. Malicious compliance. "Oh, you want us to tell people we're tracking them as a means to stop us tracking them? nah, lets just make the banner as obnoxious as possible so that they hate the banners- if we all do it, people will overturn the regulation"
- Rexxar 6y ago
  Hopefully, people will just start to use site that comply without being malicious. I just close more and more often the page when I see this. The reality is that they need readers/users more than we need them.
piva00 6y ago
This is on purpose. It's done to be as painful as possible while being legal to make the user hate the experience and blame the law, not the implementation. I'm hoping the EU cracks down on dark pattern implementations, malicious compliance (as another comment mentioned) very likely goes against the spirit of the law. The ad-tech industry is quite powerful so I think this will drag on for a while. While it drags out, I've been stubborn. Always refusing all cookies when I can't zap the cookie banner/blocker with uBlock. The most pain I can take is setting about 20 toggles. There are some implementations creating hundreds of lines of opt-outs, some where you have to opt-out vendor by vendor on their own website. Those are the ones where I close the page and forget about the content. It's not worth the hassle and my data. I wasn't such an advocate for data privacy half a decade ago, I was aware about it and how it could be used, just had never seen it, not necessarily in action at the time, but being debated on corridors. The unethical proposals I heard in meetings or by the coffee machines on how to extract/transform/identify through amassing data were quite alarming. Not because they were blatant bad but that the collective way of talking about it completely disregarded the end user. GDPR really changed that talk internally, it's been a massive effort and a pain in the ass sometimes but I do value the spirit of it. Could it be the wrong approach? Or too heavy-handed? Misapplied? And so many other still unknown problems? Yes, I do think there are too much uncertainty in how this pans out on the long term. I do deeply appreciate the effort though from the EP and the EU in putting this into the public eye, we should have been having this discussion quite some years ago... There are still tons of open questions and discussions to be had on data privacy laws, I feel the pain of having an increased workload because of it but it should become cost of business. Protection of your customers' data, its usage and their privacy should be a cost of business for companies depending on that. Level the game, create some mechanisms to help smaller companies be bootstrapped with this mindset and with guidelines and best practices for a quick ramp up. It can be a cost of business for large enterprises, smaller companies might need help to not be overburden if these laws get too complex. I don't think I'm too revolutionary.
- BlueTemplar 6y ago
  > There are some implementations creating hundreds of lines of opt-outs, some where you have to opt-out vendor by vendor on their own website. If I'm not mistaken, if there isn't a big 'Refuse All' (non critical) button on the 1rst dashboard 'page', then that implementation is considered to be illegal by the GDPR ?
WhyNotHugo 6y ago
Yeah. Asking for people for consent before stepping on their rights is so annoying. We only we could be free to skip asking, right?

Who cares? Those damn consent banners are ruining the web.

by rblatz 6y ago

Who cares? Those damn consent banners are ruining the web.

Completely agree. So annoying especially when it take half of mobile device screen I think with tracking protection in modern browsers it should be absolutely fine to allow websites to store data in any possible way (cookies, local storage, websql etc)

whimsicalism 6y ago
I think many on this site often neglect the reality that soft barriers (having to figure out how to configure your cookie settings) become hard barriers for huge majorities of people.
- BlueTemplar 6y ago
  As long as it's opt-out by default (like GDPR mandates it), it should be fine ?

contravariant 6y ago

I'm still hoping we can some day come up with some HTTP header that signals *I know what I'm doing, if you send me cookies I'll keep or discard them as I see fit".

Nextgrid 6y ago
We did, it was called Do-Not-Track. If websites were respecting it we wouldn't have the current situation. The problem? Websites were not only ignoring it but using it as yet another tracking vector.
- BlueTemplar 6y ago
  Couldn't all these 'pick cookies' dashboards be integrated in the browser without running in the same issue ?
  - Nextgrid 6y ago
    The problem is that the GDPR consent prompts ask for tracking/data processing consent regardless of any technical methods like cookies, local storage or browser fingerprinting. A browser implementing a cookie consent UI would not fully solve the problem because websites might still want to track you through other means (browser fingerprinting, server-side analytics, etc) and if they want to respect the regulation then they still need to ask for consent.
    - BlueTemplar 6y ago
      Well, this would still offload most of it to the browser, and I guess that plenty of websites (especially smaller ones, for which GDPR compliance is likely to be a heavy drag) do not use these other means ?
- grayhatter 6y ago
  Shocked-pikachu.jpg Why don't we have any browsers that aggressively deny and block tracking? Oh right, the ad companies.
  - zrobotics 6y ago
    Isn't that Brave? Granted, they have their wierd crypto crap, but the big selling point is adblocking by default.
- recursive 6y ago
  Do-Not-Track is the opposite. Do-Not-Track is a request not to send cookies. This would be like Go-Ahead-And-Try-Track-Me-I-Dare-You.
- merb 6y ago
  if gdpr would have used a framework like do-not-track it would have not happend. but as always in the eu. NIH syndrome. also they did not cared besides multiple people telling the rulemakers that this will happen.
  - danhor 6y ago
    There's nothing about the gdpr that forced cookie banners for each website. The tech industry could have implemented the requirements differently, but they haven't done that, instead taking the most annoying and obvious route. The closest thing to a technical solution that was widespread is do-not-track, but since it gets thoroughly ignored nowadays, it's worthless. As an example, since the DNT header is a pretty clear signal that you don't want to consent for various tracking, websites wouldn't have to display the consent-form for that and could only use essential cookies (or leave a choice for cookies for other purposes, if there are any). Recital 32: "This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data." And according to the ico (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...), the common click-this-button-to-get-through or do annoying things is not valid consent: "You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way.". The reason why you don't want a specific technical provision in this law (and almost all laws) is that they get outdated in less than five years. For example, imagine a framework based on http-headers fixed in law. That would've made it (almost) impossible for google to introduce spdy in europe, since it isn't http. Or, more general, the EU initiative to use micro-usb connectors would have made the switch to usb-c impossible, if they were written into law. And that's a comparatively slow moving field, with a very specific applications (charging mobile phones).

dijit 6y ago

That's the intention. Malicious compliance. "Oh, you want us to tell people we're tracking them as a means to stop us tracking them? nah, lets just make the banner as obnoxious as possible so that they hate the banners- if we all do it, people will overturn the regulation"

Rexxar 6y ago
Hopefully, people will just start to use site that comply without being malicious. I just close more and more often the page when I see this. The reality is that they need readers/users more than we need them.

piva00 6y ago

This is on purpose. It's done to be as painful as possible while being legal to make the user hate the experience and blame the law, not the implementation. I'm hoping the EU cracks down on dark pattern implementations, malicious compliance (as another comment mentioned) very likely goes against the spirit of the law. The ad-tech industry is quite powerful so I think this will drag on for a while. While it drags out, I've been stubborn. Always refusing all cookies when I can't zap the cookie banner/blocker with uBlock. The most pain I can take is setting about 20 toggles. There are some implementations creating hundreds of lines of opt-outs, some where you have to opt-out vendor by vendor on their own website. Those are the ones where I close the page and forget about the content. It's not worth the hassle and my data. I wasn't such an advocate for data privacy half a decade ago, I was aware about it and how it could be used, just had never seen it, not necessarily in action at the time, but being debated on corridors. The unethical proposals I heard in meetings or by the coffee machines on how to extract/transform/identify through amassing data were quite alarming. Not because they were blatant bad but that the collective way of talking about it completely disregarded the end user. GDPR really changed that talk internally, it's been a massive effort and a pain in the ass sometimes but I do value the spirit of it. Could it be the wrong approach? Or too heavy-handed? Misapplied? And so many other still unknown problems? Yes, I do think there are too much uncertainty in how this pans out on the long term. I do deeply appreciate the effort though from the EP and the EU in putting this into the public eye, we should have been having this discussion quite some years ago... There are still tons of open questions and discussions to be had on data privacy laws, I feel the pain of having an increased workload because of it but it should become cost of business. Protection of your customers' data, its usage and their privacy should be a cost of business for companies depending on that. Level the game, create some mechanisms to help smaller companies be bootstrapped with this mindset and with guidelines and best practices for a quick ramp up. It can be a cost of business for large enterprises, smaller companies might need help to not be overburden if these laws get too complex. I don't think I'm too revolutionary.

BlueTemplar 6y ago
> There are some implementations creating hundreds of lines of opt-outs, some where you have to opt-out vendor by vendor on their own website. If I'm not mistaken, if there isn't a big 'Refuse All' (non critical) button on the 1rst dashboard 'page', then that implementation is considered to be illegal by the GDPR ?

WhyNotHugo 6y ago

Yeah. Asking for people for consent before stepping on their rights is so annoying. We only we could be free to skip asking, right?