6 ms·

I really wish this law had forced websites to respect a toggle in the browser UI instead of being allowed to engage in all their dark pattern shenanigans.

rjmunro 6y ago
Early on, browsers had UI to block cookies. Sometimes you had to press "yes" to accept a cookie. No participation from websites was needed. No one ever used it, and over time it got more and more hidden. It's still there if you look for it.
- dsego 6y ago
  Yes, I remember this as a kid in the early IE days, like version 4 or something, not sure, but it was there.
- Nextgrid 6y ago
  The concept of tracking as per the GDPR goes beyond cookies though. It includes any kind of personal data collection, and personal data refers to anything that can uniquely identify a person with reasonable certainty. So cookies aren't the only thing that requires consent - things like browser fingerprinting and even collecting IP addresses for non-essential purposes (aka you can probably claim legitimate interest if you collect them for technical or fraud prevention reasons, but using that data for analytics or marketing would require consent). This is also why I think clicking "accept all" on the cookie prompts with cookies disabled at the browser level isn't a good idea. You're still giving them permission to stalk you using other means than cookies, and they very well know that. At least use an ad-blocker which blocks the consent prompts completely - technically you never provided permission, so while they might still stalk you at least they don't have a legal basis for doing so. The GDPR is less about the technical aspect of data collection and more about the intent behind said collection and the planned use for the collected data, something the browser can't really tell.
- jokethrowaway 6y ago
  TL;DR: Thanks Europe for fixing something almost nobody cared about, by making the internet worse for everyone and by forcing society as a whole to spend money building terrible UIs. And in the end, people still just Accept All because it's the fastest way to content.
gggtt 6y ago
Totally agree. Maybe GPC could become that one day ? https://spreadprivacy.com/global-privacy-control-enabled-by-default/ https://spreadprivacy.com/global-privacy-control-enabled-by-... It kind of seems like a second attempt to the do-not-track switch which was a failure. There must be strong backing in the laws for such feature to be meaningful otherwise nobody will respect it
riggsdk 6y ago
The cookie policies and laws are broken. The ever-annoying cookie popups are breaking the internet in more ways than it fixes it. The choice to make each website show their own cookie selection screens is part of all this. I am one of the few that (most of the time) actually takes the time to click "Reject all" whenever possible. Some websites are EXTREMELY shady when it comes to this though and hides their targeted advertisement and user-profile building into their "legitimate interests" section that IS NOT automatically turned off even if you "reject all". You have to manually go trough them and "object" to each and every one of them. Often no "object to all" button. Imagine if sex used the same notion of "consent": "Ok so you rejected having intercourse with me, but I have a 'legitimate interest' in fellatio that you didn't specifically say no to, so now you have to!". It is just terrible.. "Legitimate interest" is a broken term in those cookie forms. Legitimate to whom? Of course any company has a legitimate interest in making buckets of money. Every browser should have a mandatory "cookie preferences" section where you can set your preferences for each of the typical use-cases for cookies. Strictly functional cookies? OK. Targeted advertisement? NO. Tracking between websites? NO. Measure site performance? OK. etc.etc. Whatever role the current cookie panes now fill, the browser should take over using some standard. The preferences could get sent directly over HTTP with the initial page-load and the server/site would have to comply or face extreme fines. With the browser approach you could maintain your own allow/blocklist for site-specific settings. All this could be synchronized across your various devices. Only then would we not be annoyed by those popups again.
- mnw21cam 6y ago
  It isn't the law that is broken, but rather the enforcement. All the concerns you raise here are covered by the law. It's illegal for it to take longer to reject tracking than to allow it, which should ban all these web site that try to get you to scroll through several hundred options turning them all off. "Legitimate interest" means that the whatever data they want to process is a necessary step in order to do what the user has asked for - for instance, the web site has to be able to set a login token cookie when you log in, and that's allowed because you literally just asked to log in, and that's the only way the web site can do what you asked. All these web site are illegally making the cookie experience dire. They are doing it so that they can: 1. Collect data from people who get fed up and click accept, people who accidentally click accept, etc. 2. Annoy everyone and make people think that the laws are broken, which increases the chances that the laws will be changed in the future. Enforcement would help with this, but there's little sign of it happening.
GordonS 6y ago
Gods, but that sounds brilliant. Having a single toggle for non-essential cookies, even if it's on a site-by-site basis, would be a whole lot better than every website having it's own, different (and often highly dubious) way of handling things. The cookie debacle has been going on for so long now, and is obviously not going away any time soon - surely there must have been draft RFCs or even W3C proposals along these lines at some point?

rjmunro 6y ago

Early on, browsers had UI to block cookies. Sometimes you had to press "yes" to accept a cookie. No participation from websites was needed. No one ever used it, and over time it got more and more hidden. It's still there if you look for it.

dsego 6y ago
Yes, I remember this as a kid in the early IE days, like version 4 or something, not sure, but it was there.
Nextgrid 6y ago
The concept of tracking as per the GDPR goes beyond cookies though. It includes any kind of personal data collection, and personal data refers to anything that can uniquely identify a person with reasonable certainty. So cookies aren't the only thing that requires consent - things like browser fingerprinting and even collecting IP addresses for non-essential purposes (aka you can probably claim legitimate interest if you collect them for technical or fraud prevention reasons, but using that data for analytics or marketing would require consent). This is also why I think clicking "accept all" on the cookie prompts with cookies disabled at the browser level isn't a good idea. You're still giving them permission to stalk you using other means than cookies, and they very well know that. At least use an ad-blocker which blocks the consent prompts completely - technically you never provided permission, so while they might still stalk you at least they don't have a legal basis for doing so. The GDPR is less about the technical aspect of data collection and more about the intent behind said collection and the planned use for the collected data, something the browser can't really tell.
jokethrowaway 6y ago
TL;DR: Thanks Europe for fixing something almost nobody cared about, by making the internet worse for everyone and by forcing society as a whole to spend money building terrible UIs. And in the end, people still just Accept All because it's the fastest way to content.

gggtt 6y ago

Totally agree. Maybe GPC could become that one day ? https://spreadprivacy.com/global-privacy-control-enabled-by-default/ https://spreadprivacy.com/global-privacy-control-enabled-by-... It kind of seems like a second attempt to the do-not-track switch which was a failure. There must be strong backing in the laws for such feature to be meaningful otherwise nobody will respect it

riggsdk 6y ago

The cookie policies and laws are broken. The ever-annoying cookie popups are breaking the internet in more ways than it fixes it. The choice to make each website show their own cookie selection screens is part of all this. I am one of the few that (most of the time) actually takes the time to click "Reject all" whenever possible. Some websites are EXTREMELY shady when it comes to this though and hides their targeted advertisement and user-profile building into their "legitimate interests" section that IS NOT automatically turned off even if you "reject all". You have to manually go trough them and "object" to each and every one of them. Often no "object to all" button. Imagine if sex used the same notion of "consent": "Ok so you rejected having intercourse with me, but I have a 'legitimate interest' in fellatio that you didn't specifically say no to, so now you have to!". It is just terrible.. "Legitimate interest" is a broken term in those cookie forms. Legitimate to whom? Of course any company has a legitimate interest in making buckets of money. Every browser should have a mandatory "cookie preferences" section where you can set your preferences for each of the typical use-cases for cookies. Strictly functional cookies? OK. Targeted advertisement? NO. Tracking between websites? NO. Measure site performance? OK. etc.etc. Whatever role the current cookie panes now fill, the browser should take over using some standard. The preferences could get sent directly over HTTP with the initial page-load and the server/site would have to comply or face extreme fines. With the browser approach you could maintain your own allow/blocklist for site-specific settings. All this could be synchronized across your various devices. Only then would we not be annoyed by those popups again.

mnw21cam 6y ago
It isn't the law that is broken, but rather the enforcement. All the concerns you raise here are covered by the law. It's illegal for it to take longer to reject tracking than to allow it, which should ban all these web site that try to get you to scroll through several hundred options turning them all off. "Legitimate interest" means that the whatever data they want to process is a necessary step in order to do what the user has asked for - for instance, the web site has to be able to set a login token cookie when you log in, and that's allowed because you literally just asked to log in, and that's the only way the web site can do what you asked. All these web site are illegally making the cookie experience dire. They are doing it so that they can: 1. Collect data from people who get fed up and click accept, people who accidentally click accept, etc. 2. Annoy everyone and make people think that the laws are broken, which increases the chances that the laws will be changed in the future. Enforcement would help with this, but there's little sign of it happening.

GordonS 6y ago

Gods, but that sounds brilliant. Having a single toggle for non-essential cookies, even if it's on a site-by-site basis, would be a whole lot better than every website having it's own, different (and often highly dubious) way of handling things. The cookie debacle has been going on for so long now, and is obviously not going away any time soon - surely there must have been draft RFCs or even W3C proposals along these lines at some point?