14 ms·

Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no i

Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no indication as to whether the "Got it" button is taken as consent for tracking, nor is there a "Reject all non-essential tracking" option on the main banner. Whether or not this site is compliant depends on whether the "Got it" button is taken as affirmative consent for non-essential tracking or not.

ectopod 6y ago
The best way to let a site know that you don't want tracking cookies is to disable cookies. Most sites work fine. This one redirects you to: https://dl.acm.org/action/cookieAbsent https://dl.acm.org/action/cookieAbsent
danShumway 6y ago
The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodically to help maintain and improve our Web Site and enforce our online service polices. ACM only uses analytical cookies and does not use any user-specific targeting cookies. > A cookie is a small file of letter and numbers that is placed on your device. Cookies are only set by ACM when you visit restricted portions of our Web Site and help us to provide you with an enhanced user experience. Raw log files are treated as confidential. So... not sure why a public portion of their website straight-up won't load without them. They're clearly not only checking/setting cookies on certain pages, otherwise they wouldn't know that my cookies were disabled.
- shadowgovt 6y ago
  It took some digging, but if you go to https://www.acm.org/privacy-policy https://www.acm.org/privacy-policy, the "this website uses cookies" banner at the bottom includes a selector to choose which ones are used, and "necessary" is auto-selected. Expanding the "Show details" panel along the selector shows which cookies are considered necessary, and it looks like it's part of their Cloudflare attack protection system (__cfduid), their load balancing schema (AWSALBCORS), the cookie storing the status of your cookie consent (hah, ironic) (CookieConsent). But then there are some that I wouldn't personally consider necessary, such as two Bloomberg-vended cookies that appear to mirror the consent information to Bloomberg's servers, a Swiftype tracking pixel, a YouTube cookie to estimate the user's bandwidth for optimizing video loading, and some suspiciously-opaque BACKEND and sessionState cookies. In general, it's unfortunate their page doesn't degrade gracefully if cookies are disabled (though that's not always possible; for example, you can't assume that traffic Cloudflare can't analyze for trust is trusted... but those BACKEND and sessionState cookies being mandatory feels lazy).
- that_guy_iain 6y ago
  One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but not login and use the actual system. I am still not sure if I am compliant or not.
  - satellite2 6y ago
    It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.
    - that_guy_iain 6y ago
      There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.
      - cdrx 6y ago
        To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.
        that_guy_iain 6y ago
        Honestly, considering the state of play at the moment the law is pretty much unenforcable. They literally can't fine everyone who is breaching it, they don't have the manpower. And considering the ICO, the UK org that enforces these laws and where you have to go to find out the UK laws on it, literally just tell you that they use cookies to make their website work and don't ask for consent makes me think this is so much more complicate than any of us truly understand. If they're setting cookies without consent with a user tracking id, I am going to guess that my session cookie falls under the same thing theirs does. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/#:~:text=PECR%20are%20the%20Privacy%20and,the%20e%2Dprivacy%20Directive https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...'. - Check developer tools and cookies.
- dheera 6y ago
  Why does a site even get to know when cookies are disabled? I feel like this is a horrible implementation of this browser feature. If the user disables cookies, the browser shouldn't tell the website "I don't support cookies", but rather let the website's JS think it happily set a cookie but not store anything when you navigate to any other page.
  - satellite2 6y ago
    Your system wouldn't prevent detection as a simple fixed cookie on the landing page and a redirect on a robot prohibited page, with js on this page expecting the cookie and you get yourself a detection mechanism. (Note that you could also check server side on the redirection page) I believe (but I cannot formally prove it) that it's actually impossible to prevent detection. It's a bit similar to private browsing mode (which in that case should in theory not be detectable) but has revealed to be a challenging problem.
  - hansvm 6y ago
    Detection is hard (impossible for arbitrary JS) if the cookie isn't physically stored somewhere (at least in memory). That said, I think cookie auto deletion basically satisfies that use case? I personally have cookies set to wipe when I close my browser, and I close my browser fairly frequently. That's not quite as often as you're suggesting though.
- DangitBobby 6y ago
  Maybe they found a loophole. If you make your website stop working without what are otherwise unnecessary cookies, suddenly the cookies are essential.
sandgiant 6y ago
This is just a regular journal page. Not surprised they're tracking their users. A better place to link would probably have been the arXiv: https://arxiv.org/abs/2001.02479v1 https://arxiv.org/abs/2001.02479v1.
deleted 6y ago
[deleted]
1vuio0pswjnm7 6y ago
"Interesting that this site itself may use one of the described patterns." Is it really interesting, though. For example, we have seen this as a very common retort in HN comments every time an author is critical of advertising, tracking/analytics, etc. Someone points out the author's site itself uses the thing being critiqued. Is that supposed to detract from the argument being made by the author. That does not make much sense. It is a bit like another common retort we see in discussing tech company behaviour: "But everyone else is doing it." Does that make it OK. Or one we see when discussing regulatory action: "They should be focusing on X not Y." Don't look here, look over there. I am highly skeptical of comments that try to leverage these tactics. The message is what it is. Whether or not it is valid does not depend on who is voicing it, where it appears, or what's going on somewhere else. This is pure misdirection. This paper might be a worthwhile read. It makes little sense to pre-judge it before reading, simply because it appears on ACM's website, and ACM's website developers try to get users to enable cookies. What if the paper is re-posted on a site with no Javascript and that does not try to set cookies. Does the content of the paper then become "legitimate". Why or why not. It is easy to retrieve this paper without using cookies, from another site. For example, https://web.archive.org/web/20210305175101/https://dl.acm.org/doi/10.1145/3313831.3376321 https://web.archive.org/web/20210305175101/https://dl.acm.or... PDF: https://web.archive.org/web/20200701025846if_/https://dl.acm.org/doi/pdf/10.1145/3313831.3376321 https://web.archive.org/web/20200701025846if_/https://dl.acm... Not trying to single out this one comment. It's fine. The paper is not really arguing for or against banners and other notice and consent mechanisms, just studying their use. I cannot even see the banner because I use a text-only browser. The most interesting paragraph in the paper IMO is the last one. They ask why the client, e.g., through browser settings, cannot be in control of the legal consent mechanism. What if clients were to sed an additional HTTP header to indicate whether or not the user consent to cookies. For example, Allow-Cookies: no. The online advertising companies have apparently fought against this, e.g., the DNT header. If you enable DNT in one popular browser deployed by an advertising company you get this ridiculous warning message. Why the heck is it a big deal if the user controls the headers sent and the server has to honour them. When you read RFCs about www development they always make it sound like clients and servers on are equal footing. The reality is quite different. These companies want to control how a user "consents".
asdff 6y ago
I get some sick satisfaction whenever I mouse over these, right click, and hit "Block element"
- rgoulter 6y ago
  Another technique: I've just been trying out the tridactyl Firefox plugin. (vi-inspired keybindings for browser usage). In tridactyl, the element can be hidden by typing out ";k", followed by a couple of letters to select the element hierarchy to hide.
- tomjen3 6y ago
  I have had some luck just using reader mode. It is not important when I am on my ipad, because I use Safari in private mode and it doesn’t share cookies with other tabs, but this is even easier.
  - asdff 6y ago
    depends on the page, but reader mode can move around images strangely in my experience
stiray 6y ago
What I have seen everywhere is that all the consent is based on violating one of fundamentals of GDPR Art. 7(4): "It shall be as easy to withdraw as to give consent." All those dark patterns to hide the rejection, keep some things ticked etc. are a complete waste of time. They all violate GDPR and are just another case for: no one has read the GDPR and is just copying everyone else. It is just a waste of developers time, hiding rejection of consent, making it less understandable, etc. is just violating the GDPR. Google is violating it, Facebook is violating it,... but they have money for lawsuits, if you have it too, no problem, just copy them, if not, reconsider your tactics. Bottom line, you are wasting time and effort to implement it, you are trolling the users with popups and at the end even the consents that you got is invalid and void. So why doing it? Imagine the scenario, your beautiful website, your beautiful android application is being checked for a GDPR compliance based on lawsuit. And you bring in your dark-patterned consent dialog (whoever the provider is, it doesn't matter, YOU are the controller, YOU are the one who needs to care for your visitors/users privacy and you will be fined if google ads are violating privacy by their scripts run from your application/site). What do you think will happen, you will get pat on your back and someone one will say "you poor thing, you didn't understand, let me pardon you" or you will get an "Tommy Lee Jones" implicit facepalm [1]? Same goes for all the sites that stuff the user id into the "consent/no consent" cookie where just setting "consent=yes" or "consent=no" would be enough. Again, just same thing, for avoiding storing one PII you create another PII (by GDPR, anything that is unique to a person is PII) and violate it by doing that. Just why. Dont bother. Wait for a law suit and that is it. Dont just waste more money with same result as not wasting it, rather label a jar with "GDPR Lawsuit" label and stuff the money wasted for illegal consent methods into the jar. [1] https://me.me/i/implied-facepalm-when-something-is-so-ridiculous-that-a-full-21442403 https://me.me/i/implied-facepalm-when-something-is-so-ridicu...

ectopod 6y ago

The best way to let a site know that you don't want tracking cookies is to disable cookies. Most sites work fine. This one redirects you to: https://dl.acm.org/action/cookieAbsent https://dl.acm.org/action/cookieAbsent

danShumway 6y ago

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodically to help maintain and improve our Web Site and enforce our online service polices. ACM only uses analytical cookies and does not use any user-specific targeting cookies. > A cookie is a small file of letter and numbers that is placed on your device. Cookies are only set by ACM when you visit restricted portions of our Web Site and help us to provide you with an enhanced user experience. Raw log files are treated as confidential. So... not sure why a public portion of their website straight-up won't load without them. They're clearly not only checking/setting cookies on certain pages, otherwise they wouldn't know that my cookies were disabled.

shadowgovt 6y ago
It took some digging, but if you go to https://www.acm.org/privacy-policy https://www.acm.org/privacy-policy, the "this website uses cookies" banner at the bottom includes a selector to choose which ones are used, and "necessary" is auto-selected. Expanding the "Show details" panel along the selector shows which cookies are considered necessary, and it looks like it's part of their Cloudflare attack protection system (__cfduid), their load balancing schema (AWSALBCORS), the cookie storing the status of your cookie consent (hah, ironic) (CookieConsent). But then there are some that I wouldn't personally consider necessary, such as two Bloomberg-vended cookies that appear to mirror the consent information to Bloomberg's servers, a Swiftype tracking pixel, a YouTube cookie to estimate the user's bandwidth for optimizing video loading, and some suspiciously-opaque BACKEND and sessionState cookies. In general, it's unfortunate their page doesn't degrade gracefully if cookies are disabled (though that's not always possible; for example, you can't assume that traffic Cloudflare can't analyze for trust is trusted... but those BACKEND and sessionState cookies being mandatory feels lazy).
that_guy_iain 6y ago
One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but not login and use the actual system. I am still not sure if I am compliant or not.
- satellite2 6y ago
  It depends on what you do with the session cookie. If you use it only to keep track of the logged in status and access management of the user then you are compliant. If you use it to track the user server side, then depending on the use case consent is probably required.
  - that_guy_iain 6y ago
    There is some server side tracking, basically the source and campaign if they convert. And some A/B testing tracking. But the thing is, I can't have two separate session cookies with the framework I'm using. And it's not exactly possible to delay a session cookie creation with the framework i am using if it's in an area converted by the security firewall rules.
    - cdrx 6y ago
      To be legal you need to get the user's consent, upfront, for that tracking. Technical challenges are not a defence. GDPR is not the only regulation at play here. The PECR also applies. You need consent for the session cookie in the public areas of your site. It doesn't become essential until the user logs in, registers, adds an item to the cart, etc.
      - that_guy_iain 6y ago
        Honestly, considering the state of play at the moment the law is pretty much unenforcable. They literally can't fine everyone who is breaching it, they don't have the manpower. And considering the ICO, the UK org that enforces these laws and where you have to go to find out the UK laws on it, literally just tell you that they use cookies to make their website work and don't ask for consent makes me think this is so much more complicate than any of us truly understand. If they're setting cookies without consent with a user tracking id, I am going to guess that my session cookie falls under the same thing theirs does. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/#:~:text=PECR%20are%20the%20Privacy%20and,the%20e%2Dprivacy%20Directive https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...'. - Check developer tools and cookies.
dheera 6y ago
Why does a site even get to know when cookies are disabled? I feel like this is a horrible implementation of this browser feature. If the user disables cookies, the browser shouldn't tell the website "I don't support cookies", but rather let the website's JS think it happily set a cookie but not store anything when you navigate to any other page.
- satellite2 6y ago
  Your system wouldn't prevent detection as a simple fixed cookie on the landing page and a redirect on a robot prohibited page, with js on this page expecting the cookie and you get yourself a detection mechanism. (Note that you could also check server side on the redirection page) I believe (but I cannot formally prove it) that it's actually impossible to prevent detection. It's a bit similar to private browsing mode (which in that case should in theory not be detectable) but has revealed to be a challenging problem.
- hansvm 6y ago
  Detection is hard (impossible for arbitrary JS) if the cookie isn't physically stored somewhere (at least in memory). That said, I think cookie auto deletion basically satisfies that use case? I personally have cookies set to wipe when I close my browser, and I close my browser fairly frequently. That's not quite as often as you're suggesting though.
DangitBobby 6y ago
Maybe they found a loophole. If you make your website stop working without what are otherwise unnecessary cookies, suddenly the cookies are essential.

sandgiant 6y ago

This is just a regular journal page. Not surprised they're tracking their users. A better place to link would probably have been the arXiv: https://arxiv.org/abs/2001.02479v1 https://arxiv.org/abs/2001.02479v1.

deleted 6y ago

[deleted]

1vuio0pswjnm7 6y ago

"Interesting that this site itself may use one of the described patterns." Is it really interesting, though. For example, we have seen this as a very common retort in HN comments every time an author is critical of advertising, tracking/analytics, etc. Someone points out the author's site itself uses the thing being critiqued. Is that supposed to detract from the argument being made by the author. That does not make much sense. It is a bit like another common retort we see in discussing tech company behaviour: "But everyone else is doing it." Does that make it OK. Or one we see when discussing regulatory action: "They should be focusing on X not Y." Don't look here, look over there. I am highly skeptical of comments that try to leverage these tactics. The message is what it is. Whether or not it is valid does not depend on who is voicing it, where it appears, or what's going on somewhere else. This is pure misdirection. This paper might be a worthwhile read. It makes little sense to pre-judge it before reading, simply because it appears on ACM's website, and ACM's website developers try to get users to enable cookies. What if the paper is re-posted on a site with no Javascript and that does not try to set cookies. Does the content of the paper then become "legitimate". Why or why not. It is easy to retrieve this paper without using cookies, from another site. For example, https://web.archive.org/web/20210305175101/https://dl.acm.org/doi/10.1145/3313831.3376321 https://web.archive.org/web/20210305175101/https://dl.acm.or... PDF: https://web.archive.org/web/20200701025846if_/https://dl.acm.org/doi/pdf/10.1145/3313831.3376321 https://web.archive.org/web/20200701025846if_/https://dl.acm... Not trying to single out this one comment. It's fine. The paper is not really arguing for or against banners and other notice and consent mechanisms, just studying their use. I cannot even see the banner because I use a text-only browser. The most interesting paragraph in the paper IMO is the last one. They ask why the client, e.g., through browser settings, cannot be in control of the legal consent mechanism. What if clients were to sed an additional HTTP header to indicate whether or not the user consent to cookies. For example, Allow-Cookies: no. The online advertising companies have apparently fought against this, e.g., the DNT header. If you enable DNT in one popular browser deployed by an advertising company you get this ridiculous warning message. Why the heck is it a big deal if the user controls the headers sent and the server has to honour them. When you read RFCs about www development they always make it sound like clients and servers on are equal footing. The reality is quite different. These companies want to control how a user "consents".

asdff 6y ago

I get some sick satisfaction whenever I mouse over these, right click, and hit "Block element"

rgoulter 6y ago
Another technique: I've just been trying out the tridactyl Firefox plugin. (vi-inspired keybindings for browser usage). In tridactyl, the element can be hidden by typing out ";k", followed by a couple of letters to select the element hierarchy to hide.
tomjen3 6y ago
I have had some luck just using reader mode. It is not important when I am on my ipad, because I use Safari in private mode and it doesn’t share cookies with other tabs, but this is even easier.
- asdff 6y ago
  depends on the page, but reader mode can move around images strangely in my experience

stiray 6y ago

What I have seen everywhere is that all the consent is based on violating one of fundamentals of GDPR Art. 7(4): "It shall be as easy to withdraw as to give consent." All those dark patterns to hide the rejection, keep some things ticked etc. are a complete waste of time. They all violate GDPR and are just another case for: no one has read the GDPR and is just copying everyone else. It is just a waste of developers time, hiding rejection of consent, making it less understandable, etc. is just violating the GDPR. Google is violating it, Facebook is violating it,... but they have money for lawsuits, if you have it too, no problem, just copy them, if not, reconsider your tactics. Bottom line, you are wasting time and effort to implement it, you are trolling the users with popups and at the end even the consents that you got is invalid and void. So why doing it? Imagine the scenario, your beautiful website, your beautiful android application is being checked for a GDPR compliance based on lawsuit. And you bring in your dark-patterned consent dialog (whoever the provider is, it doesn't matter, YOU are the controller, YOU are the one who needs to care for your visitors/users privacy and you will be fined if google ads are violating privacy by their scripts run from your application/site). What do you think will happen, you will get pat on your back and someone one will say "you poor thing, you didn't understand, let me pardon you" or you will get an "Tommy Lee Jones" implicit facepalm [1]? Same goes for all the sites that stuff the user id into the "consent/no consent" cookie where just setting "consent=yes" or "consent=no" would be enough. Again, just same thing, for avoiding storing one PII you create another PII (by GDPR, anything that is unique to a person is PII) and violate it by doing that. Just why. Dont bother. Wait for a law suit and that is it. Dont just waste more money with same result as not wasting it, rather label a jar with "GDPR Lawsuit" label and stuff the money wasted for illegal consent methods into the jar. [1] https://me.me/i/implied-facepalm-when-something-is-so-ridiculous-that-a-full-21442403 https://me.me/i/implied-facepalm-when-something-is-so-ridicu...