11 ms·

The consent popups you see aren't just about cookies though. They want (and sometimes illegally force) you to consent to processing of your personal information

by rlpb 6y ago

The consent popups you see aren't just about cookies though. They want (and sometimes illegally force) you to consent to processing of your personal information for reasons beyond just providing you with a service (or more commonly just reading an article). Cookies might be one technical means to assist with that, but it's not the only means.

Proven 6y ago
I don't care about that either. If I cared I wouldn't have visited sites with cookies, or any sites at all.
raverbashing 6y ago
For those, I wanted an extension that replaced data on the cookies with some random data at every access Enjoy tracking that
- koolba 6y ago
  There’s the added joy that some poorly written data munger is going to crash when it receives session tokens that never existed.
  - nickff 6y ago
    There is already analytics spam.
  - jesboat 6y ago
    Any sufficiently large data analyzer is going to handle that already. Even if you have reliable delivery of the "session created" event into the analyzer, you'll still occasionally get wonky data from bit flips.
topspin 6y ago
> The consent popups you see aren't just about cookies though. I don't care about all the other stuff the popups are about either. The popups are pointless, click-through damage and they serve no purpose. The laws that caused them to exist are equally pointless. There is no measurable benefit to any of this privacy theater and no less tracking is occurring since the advent of all of these pointless popups.
- artursapek 6y ago
  Its failure to make any real difference, together with the total lack of standard around implementation (why isn’t it treated like every other native browser permission dialog?) make it truly despicable.
  - Sebb767 6y ago
    > why isn’t it treated like every other native browser permission dialog? Because it's not a browser permission. The browser could offer to send a "no" for you, but the site could just go on and track you anyway. It would be like having a permission dialog where clicking "no" just would ask the program kindly not to run with admin permissions. Now, you might argue that the browser could start blocking cookies, but that would just break useful functionality (i.e. logins) without preventing the abundance of other methods of user tracking (local storage, tracking pixels, link parameters, fingerprints, ...). If you want to go down that route, the most reasonable response on clicking "no" would be to close the browser, really.
    - sharkjacobs 6y ago
      idgi, is it harder for a malicious website to ask you if you accept cross site tracking cookies and then ignore your refusal than it is for them to ignore the same instruction from your browser?
      - Sebb767 6y ago
        No, this is about boundaries, abstractions and context really. When a browser sets a bound, the website usually has no way to override that, as the browser is above it permission-wise. Similarly, if the OS sets a boundary, the browser looses out, since it's below the OS. Fittingly, when you deny crossing such a boundary, you'd expect it to be denied. Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater. At least that's the technical reason. If we're being honest, the discussion never came up, because a) laws are bad for setting technical standards in many ways and b) most site owners prefer to build their own dark patterns to get the user to click accept anyway. [0] Excluding heuristics, of course, which would just start a game of cat and mouse yet again and would necessarily be flawed.
eyelidlessness 6y ago
> and sometimes illegally force If they’re complying with the law this is absolute bullshit. You can just hit your browser back button or close the tab/window. Stop using “force” in a way that involves your choice to participate.
- eyelidlessness 6y ago
  OKAY apparently the "freedom" brigade is here. Do you know what the FUCK force means? Is someone being held captive and their digit or voice being manipulated by whatever service? You are not FORCED to visit a fucking website. Jesus fucking christ.
  - eyelidlessness 6y ago
    OKAY, the freedom brigade apparently believes they ARE forced to visit websites. Welp, sorry you are enslaved to Bloomberg.com or whatever. I'll help rescue you, just send some alert so I know where to look.
    - dang 6y ago
      Please stop.
1vuio0pswjnm7 6y ago
Any good examples of these terms. I would like to read through them. I see very few of these pop-ups because I rarely use a graphical browser, and if I do, Javascript is disabled unless necessary. It does seem like the GDPR is being exploited to manipulate how users consent in a way that benefits the website's online ad scheme more than the user's experience. If I were drafting a GDPR, I would standardise the consent mechanism and not allow for much creativity. Ideally IMO the consent process, e.g., each pop-up, should be so predictable that consent/denial of consent could be automated. Asking users to read terms, and engage in some sort of interactive consent is not practicable. Users will just click "OK" or whatever they need to in order to make the pop-up go away. Website developers know this and it should be no surpise if they are taking advantage of that to sneek in all manner of one-sided terms.
- number6 6y ago
  The standardized popup is not in the gdpr but it is stated, that you have to make the privacy friendlies setting your default. If the user just clicks ok this should lead to no tracking at all. https://gdpr-info.eu/art-25-gdpr/ https://gdpr-info.eu/art-25-gdpr/
- dkersten 6y ago
  The reason GDPR doesn't standardise a consent mechanism is because GDPR isn't about websites, its about data protection. It applies to offline companies just as much as it applies to online companies. GDPR has nothing to do with cookies (that's a separate directive), but is about personal data, personally identifiable data, the use of this data and user rights over their data.
- II2II 6y ago
  > Any good examples of these terms. I would like to read through them. I see very few of these pop-ups because I rarely use a graphical browser, and if I do, Javascript is disabled unless necessary. General terms: https://www.st.com/content/st_com/en/common/privacy-portal/cookie-information.html https://www.st.com/content/st_com/en/common/privacy-portal/c... Breakdown of cookie use: https://www.st.com/content/st_com/en/common/privacy-portal/privacy-notices.html https://www.st.com/content/st_com/en/common/privacy-portal/p... Technical opt-out measures: https://www.st.com/content/st_com/en/common/privacy-portal/privacy-choices.html https://www.st.com/content/st_com/en/common/privacy-portal/p... > It does seem like the GDPR is being exploited to manipulate how users consent in a way that benefits the website's online ad scheme more than the user's experience. Agreed. > If I were drafting a GDPR, I would standardise the consent mechanism and not allow for much creativity. Ideally IMO the consent process, e.g., each pop-up, should be so predictable that consent/denial of consent could be automated. Asking users to read terms, and engage in some sort of interactive consent is not practicable. Users will just click "OK" or whatever they need to in order to make the pop-up go away. Website developers know this and it should be no surpise if they are taking advantage of that to sneek in all manner of one-sided terms. I would agree, except ... these pop-ups are visible and it is easy to verify that certain information is being presented. The failure review such information falls to the end user, even though there are legitimate reasons why they would click to make the pop-up go away (e.g. the time required to review the information). Unfortunately, it is difficult for most people to verify which cookies are being used by a particular site and it is impossible for them to verify how they are being used.
rkagerer 6y ago
This creates an interesting situation if your browser addin auto-squashes those dialogs. I doubt any court of law would rule you gave consent to a dialog that was never displayed to you. (Of course if their terms are posted somewhere else on their website they might have you there).
- number6 6y ago
  It is stated that you habe to activly give consent e.g. click an unchecked box or a button. Just using the website after seeing a warning or a pop-up is not active in the courts opinion
  - rkagerer 6y ago
    Actually, enforceability of such terms varies by jurisdiction and other factors. Search on clickwrap, clickthrough, etc.
GekkePrutser 6y ago
Well consumer irritation with these popups is causing more and more sites to consider trackingless ads now. It's a hot topic in the EU. I agree this is the wrong way to go about the issue but it does seem to have some positive effects as well.
- _nalply 6y ago
  I hope that there are positive effects. I wonder how to measure them.
matsemann 6y ago
Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law.. Seriously, if you don't do shady shit your site doesn't need a popup asking for consent. But even Github has misunderstood it's not about the cookies. They had an article earlier about removing the popup since they managed to do stuff without cookies. The law doesn't care about cookies, it cares about tracking and illegitimate use of personal data. If you send data to third parties or track by other means, consent is still needed.
- sfvisser 6y ago
  > Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law.. Because the law obviously didn't help stopping companies from doing shady shit and made the user experience of the web worse?
  - llarsson 6y ago
    Quite a few companies have been fined for violating the law, and we are seeing positive effects for privacy because of it. The cookie stuff, yes, it's annoying for us end users. I get it. But take how H&M were fined for violating the privacy of their employees. That they had to stop doing that is a Good Thing, right? https://www.bbc.com/news/technology-54418936 https://www.bbc.com/news/technology-54418936
    - fguerraz 6y ago
      No, it is not a good thing. GDPR is a highly complex piece of legislation that is very hard to navigate and therefore only established companies with big bucks to spend on lawyers and extra engineering can profit from the ecosystem while everybody else is put at risk. Complex legislation and regulations is the best way to keep monopolies in place. Same goes for the financial sector, telecoms, etc. It's nearly impossible for new players to emerge. This complex frameworks are put it place so that big companies that do nasty things can get away with it because they will be able to demonstrate that they have complied with the regulations while emerging players will break their teeth on it. Instead of regulating _how_ data collection and processing should be done, we should penalise _what_ is done with the data in simple clear terms, and make _people_ (CEOs, etc.) responsible not just giving fines to companies. Basically, reintroduce skin in the game.
koonsolo 6y ago
I'm bracing myself for the downvotes, but I'm going to post this anyway. What do you mean with personal data anyway? In GDPR this means: a name and surname; a home address; an email address such as name.surname@company.com; (NOT info@company.com!!!!) an identification card number; location data (for example the location data function on a mobile phone); an Internet Protocol (IP) address; a cookie ID; the advertising identifier of your phone; data held by a hospital or doctor, which could be a symbol that uniquely identifies a person. For the IP address, I never count on the fact that they don't track it. Who does??? Same for location. Why would you think a website wouldn't be able to get your location, unless you take some real measure to prevent it. Some consent popup isn't going to convince me that they will or will not track it. I don't give a shit, I expect EVERY website to track this. For the rest, well, if I provide my info to the website, I'm guessing that they can also identify me with it, no? If I don't want the website to know it, I just don't provide it. Same thing here: I really don't care what their consent message says. So long story short: If I want to keep some privacy, I will definitely not rely on the "word of the website" that they will handle it any way they say. If I want privacy, I will take care of that myself. And for the rest of the legal bullshit, I never read it anyway. EULA's etc.... who does?

by rlpb 6y ago

Proven 6y ago

I don't care about that either. If I cared I wouldn't have visited sites with cookies, or any sites at all.

raverbashing 6y ago

For those, I wanted an extension that replaced data on the cookies with some random data at every access Enjoy tracking that

koolba 6y ago
There’s the added joy that some poorly written data munger is going to crash when it receives session tokens that never existed.
- nickff 6y ago
  There is already analytics spam.
- jesboat 6y ago
  Any sufficiently large data analyzer is going to handle that already. Even if you have reliable delivery of the "session created" event into the analyzer, you'll still occasionally get wonky data from bit flips.

topspin 6y ago

> The consent popups you see aren't just about cookies though. I don't care about all the other stuff the popups are about either. The popups are pointless, click-through damage and they serve no purpose. The laws that caused them to exist are equally pointless. There is no measurable benefit to any of this privacy theater and no less tracking is occurring since the advent of all of these pointless popups.

artursapek 6y ago
Its failure to make any real difference, together with the total lack of standard around implementation (why isn’t it treated like every other native browser permission dialog?) make it truly despicable.
- Sebb767 6y ago
  > why isn’t it treated like every other native browser permission dialog? Because it's not a browser permission. The browser could offer to send a "no" for you, but the site could just go on and track you anyway. It would be like having a permission dialog where clicking "no" just would ask the program kindly not to run with admin permissions. Now, you might argue that the browser could start blocking cookies, but that would just break useful functionality (i.e. logins) without preventing the abundance of other methods of user tracking (local storage, tracking pixels, link parameters, fingerprints, ...). If you want to go down that route, the most reasonable response on clicking "no" would be to close the browser, really.
  - sharkjacobs 6y ago
    idgi, is it harder for a malicious website to ask you if you accept cross site tracking cookies and then ignore your refusal than it is for them to ignore the same instruction from your browser?
    - Sebb767 6y ago
      No, this is about boundaries, abstractions and context really. When a browser sets a bound, the website usually has no way to override that, as the browser is above it permission-wise. Similarly, if the OS sets a boundary, the browser looses out, since it's below the OS. Fittingly, when you deny crossing such a boundary, you'd expect it to be denied. Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater. At least that's the technical reason. If we're being honest, the discussion never came up, because a) laws are bad for setting technical standards in many ways and b) most site owners prefer to build their own dark patterns to get the user to click accept anyway. [0] Excluding heuristics, of course, which would just start a game of cat and mouse yet again and would necessarily be flawed.

eyelidlessness 6y ago

> and sometimes illegally force If they’re complying with the law this is absolute bullshit. You can just hit your browser back button or close the tab/window. Stop using “force” in a way that involves your choice to participate.

eyelidlessness 6y ago
OKAY apparently the "freedom" brigade is here. Do you know what the FUCK force means? Is someone being held captive and their digit or voice being manipulated by whatever service? You are not FORCED to visit a fucking website. Jesus fucking christ.
- eyelidlessness 6y ago
  OKAY, the freedom brigade apparently believes they ARE forced to visit websites. Welp, sorry you are enslaved to Bloomberg.com or whatever. I'll help rescue you, just send some alert so I know where to look.
  - dang 6y ago
    Please stop.

1vuio0pswjnm7 6y ago

Any good examples of these terms. I would like to read through them. I see very few of these pop-ups because I rarely use a graphical browser, and if I do, Javascript is disabled unless necessary. It does seem like the GDPR is being exploited to manipulate how users consent in a way that benefits the website's online ad scheme more than the user's experience. If I were drafting a GDPR, I would standardise the consent mechanism and not allow for much creativity. Ideally IMO the consent process, e.g., each pop-up, should be so predictable that consent/denial of consent could be automated. Asking users to read terms, and engage in some sort of interactive consent is not practicable. Users will just click "OK" or whatever they need to in order to make the pop-up go away. Website developers know this and it should be no surpise if they are taking advantage of that to sneek in all manner of one-sided terms.

number6 6y ago
The standardized popup is not in the gdpr but it is stated, that you have to make the privacy friendlies setting your default. If the user just clicks ok this should lead to no tracking at all. https://gdpr-info.eu/art-25-gdpr/ https://gdpr-info.eu/art-25-gdpr/
dkersten 6y ago
The reason GDPR doesn't standardise a consent mechanism is because GDPR isn't about websites, its about data protection. It applies to offline companies just as much as it applies to online companies. GDPR has nothing to do with cookies (that's a separate directive), but is about personal data, personally identifiable data, the use of this data and user rights over their data.
II2II 6y ago
> Any good examples of these terms. I would like to read through them. I see very few of these pop-ups because I rarely use a graphical browser, and if I do, Javascript is disabled unless necessary. General terms: https://www.st.com/content/st_com/en/common/privacy-portal/cookie-information.html https://www.st.com/content/st_com/en/common/privacy-portal/c... Breakdown of cookie use: https://www.st.com/content/st_com/en/common/privacy-portal/privacy-notices.html https://www.st.com/content/st_com/en/common/privacy-portal/p... Technical opt-out measures: https://www.st.com/content/st_com/en/common/privacy-portal/privacy-choices.html https://www.st.com/content/st_com/en/common/privacy-portal/p... > It does seem like the GDPR is being exploited to manipulate how users consent in a way that benefits the website's online ad scheme more than the user's experience. Agreed. > If I were drafting a GDPR, I would standardise the consent mechanism and not allow for much creativity. Ideally IMO the consent process, e.g., each pop-up, should be so predictable that consent/denial of consent could be automated. Asking users to read terms, and engage in some sort of interactive consent is not practicable. Users will just click "OK" or whatever they need to in order to make the pop-up go away. Website developers know this and it should be no surpise if they are taking advantage of that to sneek in all manner of one-sided terms. I would agree, except ... these pop-ups are visible and it is easy to verify that certain information is being presented. The failure review such information falls to the end user, even though there are legitimate reasons why they would click to make the pop-up go away (e.g. the time required to review the information). Unfortunately, it is difficult for most people to verify which cookies are being used by a particular site and it is impossible for them to verify how they are being used.

rkagerer 6y ago

This creates an interesting situation if your browser addin auto-squashes those dialogs. I doubt any court of law would rule you gave consent to a dialog that was never displayed to you. (Of course if their terms are posted somewhere else on their website they might have you there).

number6 6y ago
It is stated that you habe to activly give consent e.g. click an unchecked box or a button. Just using the website after seeing a warning or a pop-up is not active in the courts opinion
- rkagerer 6y ago
  Actually, enforceability of such terms varies by jurisdiction and other factors. Search on clickwrap, clickthrough, etc.

GekkePrutser 6y ago

Well consumer irritation with these popups is causing more and more sites to consider trackingless ads now. It's a hot topic in the EU. I agree this is the wrong way to go about the issue but it does seem to have some positive effects as well.

_nalply 6y ago
I hope that there are positive effects. I wonder how to measure them.

matsemann 6y ago

Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law.. Seriously, if you don't do shady shit your site doesn't need a popup asking for consent. But even Github has misunderstood it's not about the cookies. They had an article earlier about removing the popup since they managed to do stuff without cookies. The law doesn't care about cookies, it cares about tracking and illegitimate use of personal data. If you send data to third parties or track by other means, consent is still needed.

sfvisser 6y ago
> Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law.. Because the law obviously didn't help stopping companies from doing shady shit and made the user experience of the web worse?
- llarsson 6y ago
  Quite a few companies have been fined for violating the law, and we are seeing positive effects for privacy because of it. The cookie stuff, yes, it's annoying for us end users. I get it. But take how H&M were fined for violating the privacy of their employees. That they had to stop doing that is a Good Thing, right? https://www.bbc.com/news/technology-54418936 https://www.bbc.com/news/technology-54418936
  - fguerraz 6y ago
    No, it is not a good thing. GDPR is a highly complex piece of legislation that is very hard to navigate and therefore only established companies with big bucks to spend on lawyers and extra engineering can profit from the ecosystem while everybody else is put at risk. Complex legislation and regulations is the best way to keep monopolies in place. Same goes for the financial sector, telecoms, etc. It's nearly impossible for new players to emerge. This complex frameworks are put it place so that big companies that do nasty things can get away with it because they will be able to demonstrate that they have complied with the regulations while emerging players will break their teeth on it. Instead of regulating _how_ data collection and processing should be done, we should penalise _what_ is done with the data in simple clear terms, and make _people_ (CEOs, etc.) responsible not just giving fines to companies. Basically, reintroduce skin in the game.

koonsolo 6y ago

I'm bracing myself for the downvotes, but I'm going to post this anyway. What do you mean with personal data anyway? In GDPR this means: a name and surname; a home address; an email address such as name.surname@company.com; (NOT info@company.com!!!!) an identification card number; location data (for example the location data function on a mobile phone); an Internet Protocol (IP) address; a cookie ID; the advertising identifier of your phone; data held by a hospital or doctor, which could be a symbol that uniquely identifies a person. For the IP address, I never count on the fact that they don't track it. Who does??? Same for location. Why would you think a website wouldn't be able to get your location, unless you take some real measure to prevent it. Some consent popup isn't going to convince me that they will or will not track it. I don't give a shit, I expect EVERY website to track this. For the rest, well, if I provide my info to the website, I'm guessing that they can also identify me with it, no? If I don't want the website to know it, I just don't provide it. Same thing here: I really don't care what their consent message says. So long story short: If I want to keep some privacy, I will definitely not rely on the "word of the website" that they will handle it any way they say. If I want privacy, I will take care of that myself. And for the rest of the legal bullshit, I never read it anyway. EULA's etc.... who does?