6 ms·

As clear as can be yes. Now you know which websites are willing to absolutely ruin your experience just to abuse you. The implications can be seen pretty much

by tjoff 6y ago

As clear as can be yes. Now you know which websites are willing to absolutely ruin your experience just to abuse you. The implications can be seen pretty much everywhere in society, it is a momentous step in the right direction.

iFreilicht 6y ago
Exactly, this just brings to light how little most companies care about their customers. Not saying the legislation couldn't be improved, though.
- unicornporn 6y ago
  What would you improve? I think what happened when brexit went into full effect was pretty telling. Both Facebook and Google were on their toes to get back to abusing the data of UK citizens. There's much to be gained. https://www.theguardian.com/technology/2020/dec/15/facebook-move-uk-users-california-eu-privacy-laws https://www.theguardian.com/technology/2020/dec/15/facebook-... https://www.reuters.com/article/us-google-privacy-eu-exclusive-idUSKBN20D2M3 https://www.reuters.com/article/us-google-privacy-eu-exclusi...
  - iFreilicht 6y ago
    That was meant more as a preliminary defense as I saw other people complain and don’t know enough to defend the specific legislation. But damn, that is indeed a pretty good indicator that it’s working as intended.
Shivetya 6y ago
ignoring the fact the vast majority of users never noticed , never cared, and still don't care but not robotic like click away the warnings. I am not dismissing the need to let consumers know how their habits and information are used I am merely stating that many here overreact on behalf of people who really could care less, they just want their content
- newswasboring 6y ago
  Whenever I read such comments I'm reminded of the fact that many indians did not want independence from British Raj. Many people actually made similar arguments, that indians don't really care, but I'm glad those people didn't win the idea war.
sn_master 6y ago
How so? Almost every single one uses cookies and I press I agree anyway because otherwise I'll be off more than half the internet.
- iso1631 6y ago
  HN doesn't seem to have a problem, thus showing sites in general don't need to have a problem
  - sn_master 6y ago
    HN is unique in that it doesn't have or care to have ads. Same for GitHub and websites owned by big companies that don't depend on ads as a primary revenue source.
- dkersten 6y ago
  I'm slowly starting to stop using these sites because it turns out that half of the internet is clickbait misinformation trash run by people who do not care about my privacy and who want to suck up as much data about me as possible. Its difficult sometimes, mentally, but I feel like my life is better without these garbage sites anyway. I now spend more time playing guitar, that I used to spend on the internet.
stingraycharles 6y ago
But the worst offenders just have a simple “we use cookies” banner; the ones that give you the most choice are often more intrusive.
- newswasboring 6y ago
  The best are ones which just give reject all cookies option (of course they still use strictly functional cookies). And I always thought that is how it should be, both extremes should be equally easy to choose.
  - black_puppydog 6y ago
    The best ones are the ones without a cookie banner because they only use cookies that don't need consent, i.e. the strictly functional ones. One issue I do see with GDPR (or its consequences) is that a market participant that only sets those strictly necessary cookies actually now gets viewed by some as iffy, because they don't ask for consent. Basically, the industry standard of treating users (paying or not) like shit has normalized this sort of abuse/harassment so much that "the good ones" stick out in a bad way. None of which is meant to discredit GDPR though. If anything, I'm looking forward to more case law like from last year in Germany, where a dark-patterned cookie banner was ruled to be so misleading that it didn't constitute informed consent anymore. The GDPR is lacking enforcement, if anything.
  - wyre 6y ago
    My favorite was a record label with language like “I don’t want this” or something similar.
  - iso1631 6y ago
    The best ones are the ones that only use functional cookies until you do something active (like check "remember me" on a login page), thus negating any need for popups etc at all.
    - EtienneK 6y ago
      This is the correct answer. Non essential cookies should just be turned off by default and should only be enabled via normal navigation through a website. Your ‘remember me’ example is a good one. Thus, no banners are required, ever. This is the exact approach Github went with.
bzb6 6y ago
> Now you know which websites are willing to absolutely ruin your experience just to abuse you. Which is absolutely all of them. I guess the legislators wanted the popups to be annoying so publishers would be forced not to import their party scripts. Turns out publishers can’t stay open without the ads that pay their bills which means popups are the new normal, to the point where when I see a website that doesn’t have popups I suppose they are just in violation of the law. Thanks EU!
- avianlyric 6y ago
  > I guess the legislators wanted the popups to be annoying so publishers would be forced not to import their party scripts. Nope, GDPR is pretty clear on this point. All they want is informed consent. GDPR doesn’t care how you get it.
  - deleted 6y ago
    [deleted]
- piva00 6y ago
  No, the legislators didn't want the pop-ups to be annoying. They didn't even require pop-ups. Who wants the pop-ups to be annoying and riddled with dark patterns are the ones implementing it, exactly to cause this kind of reaction on you so you start hating the law, not the ones who are trying their best to skirt around it, to find the loopholes and abuse them. To make your experience as poor as possible while being compliant so you will focus your hatred on the ones who wrote the laws. This is part of their game, make the experience miserable to people start getting angry at politicians. Don't fall for that.
  - bzb6 6y ago
    I know the law and how bloody stupid it is. Third party cookies and ad blockers are configurable in your browser, if you don’t configure them then it’s your fault.
    - dmitriid 6y ago
weinzierl 6y ago
Many sites ruin your experience because they don't know any better. GDPR is perceived as a Sword of Damocles by many smaller and medium sized companies and they will annoy you with elaborate consent solution for which they are paying a ton of money even if they most probably wouldn't need to do it. For the big players it is easy. They often don't annoy you with consent banners because: - they have legal departments that understand GDPR and protect them (e.g. GitHub) - they require your login and therefore have your consent anyway (e.g. Facebook) - they can afford to skip Cookies because they have elaborate fingerprinting solutions - they just ignore the law and risk be sued (e.g. Germany's Spiegel Online)
- frenchy 6y ago
  > - they can afford to skip Cookies because they have elaborate fingerprinting solutions This is really just a special case of your last point. As far as I know, there is nothing cookie specific in the GDPR.
  - Fradow 6y ago
    That's because the "Cookie Law", which real name is the ePrivacy directive, is separate (and predates) from the GDPR. This directive defines in (24) [1] : So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users. The definition is broad. Does server-side fingerprinting solutions fits into it? Maybe not in the letter of the law, but at least in the spirit. Until a court decide either way, we won't know for sure. [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- hrktb 6y ago
  > they don't know any better There is a ton of literature about how it should be done, there has been enough press for anyone to be aware that it's a serious subject that needs to be studied, and small companies will often consult with external legal advisors because they can't afford to get on the wrong side of the law on this aspect. I've participated to a ton of these discussions in small and big entities, basically everytime a new service is launched or significantly changed. In my opinion it's pretty close to handling your finances: you don't go through all the hoops to pass you holiday rental as expenses just because you didn't know better.
forgotmypw17 6y ago
I agree, I think it's better to just leave and spend my time reading a different website.
qwertox 6y ago
It's also interesting to see how Google has reacted to this. Them being the owner of Chrome, they could have implemented a new API in no time which would allow advertisers to use an alternative to cookies. An API where I as a user can define my preferences regarding targeted advertising, and the site owner can query these preferences. An API where advertisers can also store advertising-ids and more site-specific, tracking-related settings into (if the user grants this permission), giving them the possibility to move away from the use of cookies for this purpose. Then it should become obligatory to not use cookies for tracking and ad-related purposes. There are cases where 3rd-party cookies are important, and I'm a bit afraid that Google wants to remove them altogether. I personally don't care about non-personalized ads. If the advertisers see that it makes no sense to offer me a random ad, they may start looking at the context of the page where they are serving there ads, in order to serve me a bit more relevant ads. Then again, there are others who absolutely love personalized ads. So this solution would be a fair offering to the advertisement industry. This API could even be so advertiser-friendly that the user could even specify categories of interest so that the advertiser doesn't have to guess through tracking.
- curiousllama 6y ago
  Didn't they try, and got hit for antitrust? ETA: https://news.ycombinator.com/item?id=26018928 https://news.ycombinator.com/item?id=26018928
- jefftk 6y ago
  It sounds like you're describing https://github.com/WICG/turtledove https://github.com/WICG/turtledove, which Google is definitely working on. (Disclosure: I work on ads at Google, including the seller-side of Turtledove. Speaking only for myself.)
- dkersten 6y ago
  I assume the key aspect here isn't to provide an alternative storage mechanism (since the cookie laws aren't actually about cookies themselves, but rather storage), but rather to provide a mechanism with clear and centralised user control. Users must opt-in, so its good in the eyes of the laws, but the advertisers get the benefit of easy legally-compliant tracking when a user allows it.

by tjoff 6y ago

iFreilicht 6y ago

Exactly, this just brings to light how little most companies care about their customers. Not saying the legislation couldn't be improved, though.

unicornporn 6y ago
What would you improve? I think what happened when brexit went into full effect was pretty telling. Both Facebook and Google were on their toes to get back to abusing the data of UK citizens. There's much to be gained. https://www.theguardian.com/technology/2020/dec/15/facebook-move-uk-users-california-eu-privacy-laws https://www.theguardian.com/technology/2020/dec/15/facebook-... https://www.reuters.com/article/us-google-privacy-eu-exclusive-idUSKBN20D2M3 https://www.reuters.com/article/us-google-privacy-eu-exclusi...
- iFreilicht 6y ago
  That was meant more as a preliminary defense as I saw other people complain and don’t know enough to defend the specific legislation. But damn, that is indeed a pretty good indicator that it’s working as intended.

Shivetya 6y ago

ignoring the fact the vast majority of users never noticed , never cared, and still don't care but not robotic like click away the warnings. I am not dismissing the need to let consumers know how their habits and information are used I am merely stating that many here overreact on behalf of people who really could care less, they just want their content

newswasboring 6y ago
Whenever I read such comments I'm reminded of the fact that many indians did not want independence from British Raj. Many people actually made similar arguments, that indians don't really care, but I'm glad those people didn't win the idea war.

sn_master 6y ago

How so? Almost every single one uses cookies and I press I agree anyway because otherwise I'll be off more than half the internet.

iso1631 6y ago
HN doesn't seem to have a problem, thus showing sites in general don't need to have a problem
- sn_master 6y ago
  HN is unique in that it doesn't have or care to have ads. Same for GitHub and websites owned by big companies that don't depend on ads as a primary revenue source.
dkersten 6y ago
I'm slowly starting to stop using these sites because it turns out that half of the internet is clickbait misinformation trash run by people who do not care about my privacy and who want to suck up as much data about me as possible. Its difficult sometimes, mentally, but I feel like my life is better without these garbage sites anyway. I now spend more time playing guitar, that I used to spend on the internet.

stingraycharles 6y ago

But the worst offenders just have a simple “we use cookies” banner; the ones that give you the most choice are often more intrusive.

newswasboring 6y ago
The best are ones which just give reject all cookies option (of course they still use strictly functional cookies). And I always thought that is how it should be, both extremes should be equally easy to choose.
- black_puppydog 6y ago
  The best ones are the ones without a cookie banner because they only use cookies that don't need consent, i.e. the strictly functional ones. One issue I do see with GDPR (or its consequences) is that a market participant that only sets those strictly necessary cookies actually now gets viewed by some as iffy, because they don't ask for consent. Basically, the industry standard of treating users (paying or not) like shit has normalized this sort of abuse/harassment so much that "the good ones" stick out in a bad way. None of which is meant to discredit GDPR though. If anything, I'm looking forward to more case law like from last year in Germany, where a dark-patterned cookie banner was ruled to be so misleading that it didn't constitute informed consent anymore. The GDPR is lacking enforcement, if anything.
- wyre 6y ago
  My favorite was a record label with language like “I don’t want this” or something similar.
- iso1631 6y ago
  The best ones are the ones that only use functional cookies until you do something active (like check "remember me" on a login page), thus negating any need for popups etc at all.
  - EtienneK 6y ago
    This is the correct answer. Non essential cookies should just be turned off by default and should only be enabled via normal navigation through a website. Your ‘remember me’ example is a good one. Thus, no banners are required, ever. This is the exact approach Github went with.

bzb6 6y ago

> Now you know which websites are willing to absolutely ruin your experience just to abuse you. Which is absolutely all of them. I guess the legislators wanted the popups to be annoying so publishers would be forced not to import their party scripts. Turns out publishers can’t stay open without the ads that pay their bills which means popups are the new normal, to the point where when I see a website that doesn’t have popups I suppose they are just in violation of the law. Thanks EU!

avianlyric 6y ago
> I guess the legislators wanted the popups to be annoying so publishers would be forced not to import their party scripts. Nope, GDPR is pretty clear on this point. All they want is informed consent. GDPR doesn’t care how you get it.
- deleted 6y ago
  [deleted]
piva00 6y ago
No, the legislators didn't want the pop-ups to be annoying. They didn't even require pop-ups. Who wants the pop-ups to be annoying and riddled with dark patterns are the ones implementing it, exactly to cause this kind of reaction on you so you start hating the law, not the ones who are trying their best to skirt around it, to find the loopholes and abuse them. To make your experience as poor as possible while being compliant so you will focus your hatred on the ones who wrote the laws. This is part of their game, make the experience miserable to people start getting angry at politicians. Don't fall for that.
- bzb6 6y ago
  I know the law and how bloody stupid it is. Third party cookies and ad blockers are configurable in your browser, if you don’t configure them then it’s your fault.
  - dmitriid 6y ago

weinzierl 6y ago

Many sites ruin your experience because they don't know any better. GDPR is perceived as a Sword of Damocles by many smaller and medium sized companies and they will annoy you with elaborate consent solution for which they are paying a ton of money even if they most probably wouldn't need to do it. For the big players it is easy. They often don't annoy you with consent banners because: - they have legal departments that understand GDPR and protect them (e.g. GitHub) - they require your login and therefore have your consent anyway (e.g. Facebook) - they can afford to skip Cookies because they have elaborate fingerprinting solutions - they just ignore the law and risk be sued (e.g. Germany's Spiegel Online)

frenchy 6y ago
> - they can afford to skip Cookies because they have elaborate fingerprinting solutions This is really just a special case of your last point. As far as I know, there is nothing cookie specific in the GDPR.
- Fradow 6y ago
  That's because the "Cookie Law", which real name is the ePrivacy directive, is separate (and predates) from the GDPR. This directive defines in (24) [1] : So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users. The definition is broad. Does server-side fingerprinting solutions fits into it? Maybe not in the letter of the law, but at least in the spirit. Until a court decide either way, we won't know for sure. [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
hrktb 6y ago
> they don't know any better There is a ton of literature about how it should be done, there has been enough press for anyone to be aware that it's a serious subject that needs to be studied, and small companies will often consult with external legal advisors because they can't afford to get on the wrong side of the law on this aspect. I've participated to a ton of these discussions in small and big entities, basically everytime a new service is launched or significantly changed. In my opinion it's pretty close to handling your finances: you don't go through all the hoops to pass you holiday rental as expenses just because you didn't know better.

forgotmypw17 6y ago

I agree, I think it's better to just leave and spend my time reading a different website.

qwertox 6y ago

It's also interesting to see how Google has reacted to this. Them being the owner of Chrome, they could have implemented a new API in no time which would allow advertisers to use an alternative to cookies. An API where I as a user can define my preferences regarding targeted advertising, and the site owner can query these preferences. An API where advertisers can also store advertising-ids and more site-specific, tracking-related settings into (if the user grants this permission), giving them the possibility to move away from the use of cookies for this purpose. Then it should become obligatory to not use cookies for tracking and ad-related purposes. There are cases where 3rd-party cookies are important, and I'm a bit afraid that Google wants to remove them altogether. I personally don't care about non-personalized ads. If the advertisers see that it makes no sense to offer me a random ad, they may start looking at the context of the page where they are serving there ads, in order to serve me a bit more relevant ads. Then again, there are others who absolutely love personalized ads. So this solution would be a fair offering to the advertisement industry. This API could even be so advertiser-friendly that the user could even specify categories of interest so that the advertiser doesn't have to guess through tracking.

curiousllama 6y ago
Didn't they try, and got hit for antitrust? ETA: https://news.ycombinator.com/item?id=26018928 https://news.ycombinator.com/item?id=26018928
jefftk 6y ago
It sounds like you're describing https://github.com/WICG/turtledove https://github.com/WICG/turtledove, which Google is definitely working on. (Disclosure: I work on ads at Google, including the seller-side of Turtledove. Speaking only for myself.)
dkersten 6y ago
I assume the key aspect here isn't to provide an alternative storage mechanism (since the cookie laws aren't actually about cookies themselves, but rather storage), but rather to provide a mechanism with clear and centralised user control. Users must opt-in, so its good in the eyes of the laws, but the advertisers get the benefit of easy legally-compliant tracking when a user allows it.