4 ms·

I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. When you browse from outside the

by mjgs 6y ago

I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. When you browse from outside the UK, the sites don’t have the consent forms.

remus 6y ago
> I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. If they're asking about cookies for GDPR then that's a mistake on the part of those sites. You can read about the details of PECR here https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... Of course under GDPR they may need to get permission for other forms of data processing (signing you up to a marketing mailing list, for example), but the rash of cookie permissions banners are because of PECR and similar legislation in other EU countries.
- mjgs 6y ago
  So the only way to not have consent forms is to browse from outside the UK & EU? It’s getting more and more difficult to have a good experience browsing the web. That worries me.
jlokier 6y ago
Consent is not required for "essential" cookies, because they are essential. Things like keeping track of your logged in state or shopping cart. (Even if consent were required for that, it should be asked at the point where you login or add the first item). For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that. I've personally implemented websites in the EU with logging in, carts and analytical tracking that didn't require up-front consent popups because their behaviour was already reasonable and therefore compliant. Some of us believe that the bigger sites deliberately use obnoxious consent forms in order to encourage USA residents to remain politically in favour of "implied consent" to individual behaviour tracking. In other words, obnoxious on purpose to give the impression the EU system is more onerous to each user than it really has to be. After the UK leaves the EU I will do my browsing via a VPN through an EU country specifically because I want to be able to deny all such consents except to sites that I trust and support. (In practice I grant consent to about 10% of sites and deny the other 90%). If I can find a browser extension to automate denying consent that would be great, but if I can't then I'll do it manually. The thought of my consent to being tracked down to the level of individual, personal detailed behaviour being "implied consent" the USA way is horrible. I do not consent, full stop. It seems an affront to basic legal principles that the norm is for people to not be told about or therefore have the opportunity for informed consent to the detailed databases built up about their every action online, similar to credit files but much more detailed and secretive.
- mjgs 6y ago
  Having some way to auto deny consent seems like a good idea. But anything automatic can have serious downsides, what happens if you start denying ‘good’ sites without realising it. Should all things that require consent be blocked? This World Wide Web of permissions sounds like it’s going to be a bit of a nightmare.
  - kuschku 6y ago
    The default should always be "block everything". When you try to do an action on a website that requires additional consent, you should be asked additionally. Just like the iOS/new Android permissions Dialogs. No to all by default, only allowing specific permissions on demand.
    - mjgs 6y ago
      It’s so opaque though. Most of the time I have no idea what I’m really consenting to. Every website has a different way of asking, a different way of describing what it’s asking consent for. It often feels like the list of permissions being asked for is way more than what is necessary. Compare that to reading a magazine: - Step 1 - open - Step 2 - read It’s night and day. Eventually it will be too difficult to use the web. I’m think people who make a living from building for the web have not grasped the severity of the problem. If you worked in the movie business and someone said that eventually it would be too difficult to watch a movie, because you would have to give permission left right and centre, you would be worried because that’s bad for business. Your viewers will eventuakly go do something else. Well that’s what’s happening on the web.
- jnxx 6y ago
  > For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that. And one is not obliged to agree for using the service. Of course, US FAANG companies try to create a kind of backlash, also things like when Amazon tries to force users to use credit card payments when other payment methods like bank transfer in advance work fine. But on the other hand, there is a noticeable increase in web shops in the EU which, for example, do not require any account creation at all - put something into the shopping cart, go to check-out, enter your address, enter your SEPA direct debit number, done. It is much faster and serves me as a customer better. And no GDPR consent form needed, as all the processing is only for what is needed to do the payment and the delivery.

by mjgs 6y ago

remus 6y ago

> I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. If they're asking about cookies for GDPR then that's a mistake on the part of those sites. You can read about the details of PECR here https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... Of course under GDPR they may need to get permission for other forms of data processing (signing you up to a marketing mailing list, for example), but the rash of cookie permissions banners are because of PECR and similar legislation in other EU countries.

mjgs 6y ago
So the only way to not have consent forms is to browse from outside the UK & EU? It’s getting more and more difficult to have a good experience browsing the web. That worries me.

jlokier 6y ago

Consent is not required for "essential" cookies, because they are essential. Things like keeping track of your logged in state or shopping cart. (Even if consent were required for that, it should be asked at the point where you login or add the first item). For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that. I've personally implemented websites in the EU with logging in, carts and analytical tracking that didn't require up-front consent popups because their behaviour was already reasonable and therefore compliant. Some of us believe that the bigger sites deliberately use obnoxious consent forms in order to encourage USA residents to remain politically in favour of "implied consent" to individual behaviour tracking. In other words, obnoxious on purpose to give the impression the EU system is more onerous to each user than it really has to be. After the UK leaves the EU I will do my browsing via a VPN through an EU country specifically because I want to be able to deny all such consents except to sites that I trust and support. (In practice I grant consent to about 10% of sites and deny the other 90%). If I can find a browser extension to automate denying consent that would be great, but if I can't then I'll do it manually. The thought of my consent to being tracked down to the level of individual, personal detailed behaviour being "implied consent" the USA way is horrible. I do not consent, full stop. It seems an affront to basic legal principles that the norm is for people to not be told about or therefore have the opportunity for informed consent to the detailed databases built up about their every action online, similar to credit files but much more detailed and secretive.

mjgs 6y ago
Having some way to auto deny consent seems like a good idea. But anything automatic can have serious downsides, what happens if you start denying ‘good’ sites without realising it. Should all things that require consent be blocked? This World Wide Web of permissions sounds like it’s going to be a bit of a nightmare.
- kuschku 6y ago
  The default should always be "block everything". When you try to do an action on a website that requires additional consent, you should be asked additionally. Just like the iOS/new Android permissions Dialogs. No to all by default, only allowing specific permissions on demand.
  - mjgs 6y ago
    It’s so opaque though. Most of the time I have no idea what I’m really consenting to. Every website has a different way of asking, a different way of describing what it’s asking consent for. It often feels like the list of permissions being asked for is way more than what is necessary. Compare that to reading a magazine: - Step 1 - open - Step 2 - read It’s night and day. Eventually it will be too difficult to use the web. I’m think people who make a living from building for the web have not grasped the severity of the problem. If you worked in the movie business and someone said that eventually it would be too difficult to watch a movie, because you would have to give permission left right and centre, you would be worried because that’s bad for business. Your viewers will eventuakly go do something else. Well that’s what’s happening on the web.
jnxx 6y ago
> For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that. And one is not obliged to agree for using the service. Of course, US FAANG companies try to create a kind of backlash, also things like when Amazon tries to force users to use credit card payments when other payment methods like bank transfer in advance work fine. But on the other hand, there is a noticeable increase in web shops in the EU which, for example, do not require any account creation at all - put something into the shopping cart, go to check-out, enter your address, enter your SEPA direct debit number, done. It is much faster and serves me as a customer better. And no GDPR consent form needed, as all the processing is only for what is needed to do the payment and the delivery.