3 ms·

""" When a user visited the page google.fr, an information banner displayed at the bottom of the page, with the following note “Privacy reminder from Google”, i

""" When a user visited the page google.fr, an information banner displayed at the bottom of the page, with the following note “Privacy reminder from Google”, in front of which were two buttons: “Remind me later” and “Access now”. This banner did not provide the user with any information regarding cookies that had however already been placed on his or her computer when arriving on the site. The information was also not provided when he or she clicked on the button “Access now”. """ Wow. I though those reminders were about some updated policy, I didn't realise they were supposed to ask for consent. Could someone try standing with a sign saying "A reminder from me" in the google offices reception for 2 minutes and then walk out with whatever wasn't bolted down to see if they themselves consider that an adequate way to ask for consent?

jraph 6y ago
> Could someone try standing with a sign saying "A reminder from me" in the google offices reception for 2 minutes and then walk out with whatever wasn't bolted down to see if they themselves consider that an adequate way to ask for consent? That would be hilarious. But I think they know what they are doing (i.e. using dark patterns). I've seen this banner, knew it was related to the RGPD but haven't figured out how to opt out and to not accept.
- Nextgrid 6y ago
  > haven't figured out how to opt out and to not accept There doesn't seem to be an easy way. A lot of their proposed opt-outs rely on either disabling cookies browser-wide, installing an extension or creating/signing into an account and customizing your advertising preferences there (which means providing them even more info as part of the account creation and relying on their good faith to actually opt you out). To the best of my knowledge none of these things are compliant with the GDPR: * consent must be granular, so browser-wide cookie-blocking doesn't comply because disabling cookies entirely means you lose functionality (the GDPR mandates that you can opt-out of non-essential tracking but retain all other functionality) * mandating that people register for an account might run afoul of the "data minimization" principle (among others), meaning that you must collect the minimum amount of data to fulfil the required purpose; asking people to register/sign into an account (thus providing even more information) just to opt-out of non-essential tracking seems non-compliant * consent must be opt-in (seems like cookies were placed before the user explicitly agreed to it) * it must be as easy to opt-out as it is to opt-in, yet in Google's case the opt-in is one-click away (though it doesn't matter since apparently they set cookies even before the user clicks that) but opt-out is way more involved (and relies on reconfiguring the browser)
  - h_anna_h 6y ago
    Even worse, if you have cookies disabled it will keep asking you for consent over and over even if you decline/accept.
    - mxmel 6y ago
      How are you supposed to track that someone has consented if you disable tracking? I’m assuming that declining means you can’t use any form of storage.
      - Nextgrid 6y ago
        Cookies for functional purposes are allowed without consent.
      - Macha 6y ago
        "trackingEnabled: 0" does not require consent and lets you acknowledge "consentId: abc134" then looking that up in or even "consentDenied: exact timestamp" could be used to identify a user so would require consent. I suspect lots of companies want to use the second so they can choose to bug you for [more] consent at a later date, or choose to interpret the first as not allowed in case bugging the user again enough times does get consent.
jokoon 6y ago
There is no way to properly refuse those cookies. I've worked hard to block the HTML div with ublock origin, but recently it's messing with the html, adding overflow:hidden at weird places. I've added a rule to fix it but it's not a silver bullet. Youtube videos must be restarted because of the consent thing pauses the video or ask to sign in. I'm wondering if I've been noticed by Googles ad engineers because they must have developed tools related to this rgpd thing. On Facebook it's even worse. To be honest it's a fun game of cat and mouse and I'm so happy to have Firefox, containers, strict mode, etc.

jraph 6y ago

> Could someone try standing with a sign saying "A reminder from me" in the google offices reception for 2 minutes and then walk out with whatever wasn't bolted down to see if they themselves consider that an adequate way to ask for consent? That would be hilarious. But I think they know what they are doing (i.e. using dark patterns). I've seen this banner, knew it was related to the RGPD but haven't figured out how to opt out and to not accept.

Nextgrid 6y ago
> haven't figured out how to opt out and to not accept There doesn't seem to be an easy way. A lot of their proposed opt-outs rely on either disabling cookies browser-wide, installing an extension or creating/signing into an account and customizing your advertising preferences there (which means providing them even more info as part of the account creation and relying on their good faith to actually opt you out). To the best of my knowledge none of these things are compliant with the GDPR: * consent must be granular, so browser-wide cookie-blocking doesn't comply because disabling cookies entirely means you lose functionality (the GDPR mandates that you can opt-out of non-essential tracking but retain all other functionality) * mandating that people register for an account might run afoul of the "data minimization" principle (among others), meaning that you must collect the minimum amount of data to fulfil the required purpose; asking people to register/sign into an account (thus providing even more information) just to opt-out of non-essential tracking seems non-compliant * consent must be opt-in (seems like cookies were placed before the user explicitly agreed to it) * it must be as easy to opt-out as it is to opt-in, yet in Google's case the opt-in is one-click away (though it doesn't matter since apparently they set cookies even before the user clicks that) but opt-out is way more involved (and relies on reconfiguring the browser)
- h_anna_h 6y ago
  Even worse, if you have cookies disabled it will keep asking you for consent over and over even if you decline/accept.
  - mxmel 6y ago
    How are you supposed to track that someone has consented if you disable tracking? I’m assuming that declining means you can’t use any form of storage.
    - Nextgrid 6y ago
      Cookies for functional purposes are allowed without consent.
    - Macha 6y ago
      "trackingEnabled: 0" does not require consent and lets you acknowledge "consentId: abc134" then looking that up in or even "consentDenied: exact timestamp" could be used to identify a user so would require consent. I suspect lots of companies want to use the second so they can choose to bug you for [more] consent at a later date, or choose to interpret the first as not allowed in case bugging the user again enough times does get consent.

jokoon 6y ago

There is no way to properly refuse those cookies. I've worked hard to block the HTML div with ublock origin, but recently it's messing with the html, adding overflow:hidden at weird places. I've added a rule to fix it but it's not a silver bullet. Youtube videos must be restarted because of the consent thing pauses the video or ask to sign in. I'm wondering if I've been noticed by Googles ad engineers because they must have developed tools related to this rgpd thing. On Facebook it's even worse. To be honest it's a fun game of cat and mouse and I'm so happy to have Firefox, containers, strict mode, etc.