9 ms·

Now if only they forced websites to have a single, standardized, accessible, unobtrusive popup~

paxys 5y ago
I'm surprised there is no standard for this yet. Just build it into the browser like all other privacy-related requests (location, webcam etc.) are handled. If sites don't implement it, don't accept their cookies. That way I can also manage a blanket yes/no list without getting an obtrusive popup every time.
- Hamuko 5y ago
  Expecting another smash success like the Do Not Track header.
  - atoav 5y ago
    If you could sue people for real money when they violate said header it might be taken more seriously pretty quickly.
    - Hamuko 5y ago
      I don't believe that you can sue under the GDPR. I've always understood it to be something that you can lodge a complaint against someone with your local authorities. No idea about the CCPA but I wouldn't be surprised if you could considering how lawsuit-happy Americans are.
      - atoav 5y ago
        > I don't believe that you can sue under the GDPR. I don't believe that either, I just think that flags like these can only be taken seriously if all actors have maximum incentive to take these seriously.
  - cm2187 5y ago
    Do not track is a gentleman's agreement in a world of thugs. But you could block cookies at the browser level if the user clicks No.
  - paxys 5y ago
    Do Not Track didn't work because (1) it was not enforced at the browser level, (2) it had no legal backing and (3) it was not granular enough to be useful. With GDPR, CCPA etc. in place the online privacy landscape is very different, and a new standard is very much possible today. Why did every site in the world implement all the consent popups in the first place when they could have continued to do nothing?
- djxfade 5y ago
  The problem is that I can't possible imagine Google implementing this, as it would hurt their data hoarding
  - lostcolony 5y ago
    Why? The browser has access to it at all times, and you can still ask for it anywhere. So Google (via Chrome) isn't losing anything. In fact, everyone else (including Google via analytics) is probably get more data; make it so that in the same way the browser form fills address and phone number and things automatically based on past fills, have a standard API in the browser to handle that. Now users just have to click "okay" to share all that data, rather than enter it in.
    - skohan 5y ago
      Well seeing as a lot of sites use dark patterns to confuse users into accepting more liberal tracking, I'm not sure I would agree that this would lead to more data collected
  - zibzab 5y ago
    It may surprise you, but Google was not the villain here: https://www.cnet.com/news/apache-web-software-overrides-ie10-do-not-track-setting/ https://www.cnet.com/news/apache-web-software-overrides-ie10...
- seoaeu 5y ago
  The problem is that sites will just pretend that any such standard doesn't actually exist. All of these sites could suppress cookie popups for clients that send a do-not-track header, but choose not to.
- kmeisthax 5y ago
  They did. It was called Do-Not-Track and Microsoft had the bright idea to pull an iOS 14 and turn it on by default in IE. At that point the few ad companies that had supported it basically told the browser vendors to pound sand and it became entirely useless for anything but fingerprinting.
  - MiddleEndian 5y ago
    Do not track should have been on by default. But the idea that anyone would ever obey it without the legal force was always a fantasy. If 90% of people checked "do not track" do you think they would have started to follow it? Of course not. They would just have some other reason.
- eli 5y ago
  Everyone's talking about DNT, but P3P from Microsoft circa 2002 is probably more instructive: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P Privacy is nuanced. It's' really hard to encode all ways you may or may not want your data used into a few boolean questions.
  - Hamuko 5y ago
    One of my favourite Stack Overflow answers still is making your privacy policy a potato. https://stackoverflow.com/a/16475093 https://stackoverflow.com/a/16475093
    - eli 5y ago
      I definitely spent time in like 2004 trying to understand what to put in the field to make my SSO work in IE until I found out everyone just lied.
zibzab 5y ago
The point of that is to make you click and maybe by mistake give them their consent. We already had do-not-track in the browser, why do you think companies refuse to honour it?
- Quarrelsome 5y ago
  because they're not getting fined 200m for it?
- deleted 5y ago
  [deleted]
tgsovlerkhgsel 5y ago
Even better, force them to respect something like https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ and prohibit showing an obtrusive popup.
sharken 5y ago
So much this, I'd actually rather opt-in if that meant the cookie popup would go away once and for all.
amelius 5y ago
Or force websites to obey the Do-Not-Track HTTP header. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
- cm2187 5y ago
  that's a lot of trust in the fly-by-night ad industry
- L0stRegulator 5y ago
  That's being encouraged by California law: either honor DNT or come up with something else: https://www.dwt.com/blogs/privacy--security-law-blog/2020/07/pole-camera-surveilance-fourth-amendment https://www.dwt.com/blogs/privacy--security-law-blog/2020/07...
vmception 5y ago
They should fine organizations for providing a worse experience while people choose what settings to accept Basically I see a quick experience for accepting everything, and a degraded experience for not clicking that but getting a list of what to accept or denying all
cm2187 5y ago
The worst is that it punishes the most privacy conscious of us, who clear cookies on every session, and are forced to click and reclick again on the same popups. I think the law should have been enforced at the browser level, mandate browser makers to prompt for authorization and once it has been refused, to never ask again.
- comboy 5y ago
  In other words you want to delete a cookie and still have a cookie.
- TheCoelacanth 5y ago
  They should have mandated treating the Do Not Track header as opting out of all tracking.
  - tomcooks 5y ago
    I wonder whom is to be blamed, maybe If politicians asked technicians and accessibility experts before taking decisions we'd have a better world.
- tomcooks 5y ago
  This what happens when people who don't know how to use the internet make laws for those who do. I'm implying every politician involved in the decision, or at least the majority, uses a couple or sites and had to approve cookies and data handling only on a handful of sites, once in their life. I shouldn't generalize but, even as an able bodied internet user, I find it extremely cumbersome to surf.
dmayle 5y ago
In France, we're starting to see sites where they give you two options: 1) accept advertising/tracking cookies 2) pay a monthly subscription I've seen this on AlloCiné (French IMDB), and "aufeminen" which is a random forum that a Google search led me to.
- kybernetikos 5y ago
  I believe that this is likely not GDPR compliant, although this view doesn't seem to be shared by many. My basis for saying it's not is https://www.privacy-regulation.eu/en/recital-43-GDPR.htm https://www.privacy-regulation.eu/en/recital-43-GDPR.htm > Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. I take this to mean that you cannot rely on consent that a user has given you to process their personally identifiable information if they did it in order to access a service you wouldn't let them have access to otherwise.
  - toffi-fee 5y ago
    But the provision of the service is not made dependent on the consent if you can alternatively pay the monthly subscription. So I would assume, “accept all cookies or enter paid subscription” is Gdpr compliant.
    - kybernetikos 5y ago
      > Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. https://gdpr.eu/Recital-42-Burden-of-proof-and-requirements-for-consent/ https://gdpr.eu/Recital-42-Burden-of-proof-and-requirements-... I think having to pay a monthly subscription, or losing access to a service when you withdraw consent and don't pay a subscription should be regarded as a detriment.
- tomcooks 5y ago
belorn 5y ago
What about having a law that makes it clear that an popup does not create informed consent, and then have companies decide to ignore that part of the law because it would be super inconvenient if they had to actually get informed consent. Maybe EU should write a new law by copying the GDPR text that defines consent and make it bold, all in caps, and underlined.
- number6 5y ago
  Cookies are somewhat out of scope of the GDPR. The GDPR was designed to have a twin who should regulate somethings like Cookies, Email and Telecommunications; it is now stalled for 3 years and everyone hopes it will come out next year.

I'm surprised there is no standard for this yet. Just build it into the browser like all other privacy-related requests (location, webcam etc.) are handled. If sites don't implement it, don't accept their cookies. That way I can also manage a blanket yes/no list without getting an obtrusive popup every time.

Hamuko 5y ago
Expecting another smash success like the Do Not Track header.
- atoav 5y ago
  If you could sue people for real money when they violate said header it might be taken more seriously pretty quickly.
  - Hamuko 5y ago
    I don't believe that you can sue under the GDPR. I've always understood it to be something that you can lodge a complaint against someone with your local authorities. No idea about the CCPA but I wouldn't be surprised if you could considering how lawsuit-happy Americans are.
    - atoav 5y ago
      > I don't believe that you can sue under the GDPR. I don't believe that either, I just think that flags like these can only be taken seriously if all actors have maximum incentive to take these seriously.
- cm2187 5y ago
  Do not track is a gentleman's agreement in a world of thugs. But you could block cookies at the browser level if the user clicks No.
- paxys 5y ago
  Do Not Track didn't work because (1) it was not enforced at the browser level, (2) it had no legal backing and (3) it was not granular enough to be useful. With GDPR, CCPA etc. in place the online privacy landscape is very different, and a new standard is very much possible today. Why did every site in the world implement all the consent popups in the first place when they could have continued to do nothing?
djxfade 5y ago
The problem is that I can't possible imagine Google implementing this, as it would hurt their data hoarding
- lostcolony 5y ago
  Why? The browser has access to it at all times, and you can still ask for it anywhere. So Google (via Chrome) isn't losing anything. In fact, everyone else (including Google via analytics) is probably get more data; make it so that in the same way the browser form fills address and phone number and things automatically based on past fills, have a standard API in the browser to handle that. Now users just have to click "okay" to share all that data, rather than enter it in.
  - skohan 5y ago
    Well seeing as a lot of sites use dark patterns to confuse users into accepting more liberal tracking, I'm not sure I would agree that this would lead to more data collected
- zibzab 5y ago
  It may surprise you, but Google was not the villain here: https://www.cnet.com/news/apache-web-software-overrides-ie10-do-not-track-setting/ https://www.cnet.com/news/apache-web-software-overrides-ie10...
seoaeu 5y ago
The problem is that sites will just pretend that any such standard doesn't actually exist. All of these sites could suppress cookie popups for clients that send a do-not-track header, but choose not to.
kmeisthax 5y ago
They did. It was called Do-Not-Track and Microsoft had the bright idea to pull an iOS 14 and turn it on by default in IE. At that point the few ad companies that had supported it basically told the browser vendors to pound sand and it became entirely useless for anything but fingerprinting.
- MiddleEndian 5y ago
  Do not track should have been on by default. But the idea that anyone would ever obey it without the legal force was always a fantasy. If 90% of people checked "do not track" do you think they would have started to follow it? Of course not. They would just have some other reason.
eli 5y ago
Everyone's talking about DNT, but P3P from Microsoft circa 2002 is probably more instructive: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P Privacy is nuanced. It's' really hard to encode all ways you may or may not want your data used into a few boolean questions.
- Hamuko 5y ago
  One of my favourite Stack Overflow answers still is making your privacy policy a potato. https://stackoverflow.com/a/16475093 https://stackoverflow.com/a/16475093
  - eli 5y ago
    I definitely spent time in like 2004 trying to understand what to put in the field to make my SSO work in IE until I found out everyone just lied.

zibzab 5y ago

The point of that is to make you click and maybe by mistake give them their consent. We already had do-not-track in the browser, why do you think companies refuse to honour it?

Quarrelsome 5y ago
because they're not getting fined 200m for it?
deleted 5y ago
[deleted]

tgsovlerkhgsel 5y ago

Even better, force them to respect something like https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ and prohibit showing an obtrusive popup.

sharken 5y ago

So much this, I'd actually rather opt-in if that meant the cookie popup would go away once and for all.

amelius 5y ago

Or force websites to obey the Do-Not-Track HTTP header. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track

cm2187 5y ago
that's a lot of trust in the fly-by-night ad industry
L0stRegulator 5y ago
That's being encouraged by California law: either honor DNT or come up with something else: https://www.dwt.com/blogs/privacy--security-law-blog/2020/07/pole-camera-surveilance-fourth-amendment https://www.dwt.com/blogs/privacy--security-law-blog/2020/07...

vmception 5y ago

They should fine organizations for providing a worse experience while people choose what settings to accept Basically I see a quick experience for accepting everything, and a degraded experience for not clicking that but getting a list of what to accept or denying all

cm2187 5y ago

The worst is that it punishes the most privacy conscious of us, who clear cookies on every session, and are forced to click and reclick again on the same popups. I think the law should have been enforced at the browser level, mandate browser makers to prompt for authorization and once it has been refused, to never ask again.

comboy 5y ago
In other words you want to delete a cookie and still have a cookie.
TheCoelacanth 5y ago
They should have mandated treating the Do Not Track header as opting out of all tracking.
- tomcooks 5y ago
  I wonder whom is to be blamed, maybe If politicians asked technicians and accessibility experts before taking decisions we'd have a better world.
tomcooks 5y ago
This what happens when people who don't know how to use the internet make laws for those who do. I'm implying every politician involved in the decision, or at least the majority, uses a couple or sites and had to approve cookies and data handling only on a handful of sites, once in their life. I shouldn't generalize but, even as an able bodied internet user, I find it extremely cumbersome to surf.

dmayle 5y ago

In France, we're starting to see sites where they give you two options: 1) accept advertising/tracking cookies 2) pay a monthly subscription I've seen this on AlloCiné (French IMDB), and "aufeminen" which is a random forum that a Google search led me to.

kybernetikos 5y ago
I believe that this is likely not GDPR compliant, although this view doesn't seem to be shared by many. My basis for saying it's not is https://www.privacy-regulation.eu/en/recital-43-GDPR.htm https://www.privacy-regulation.eu/en/recital-43-GDPR.htm > Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. I take this to mean that you cannot rely on consent that a user has given you to process their personally identifiable information if they did it in order to access a service you wouldn't let them have access to otherwise.
- toffi-fee 5y ago
  But the provision of the service is not made dependent on the consent if you can alternatively pay the monthly subscription. So I would assume, “accept all cookies or enter paid subscription” is Gdpr compliant.
  - kybernetikos 5y ago
    > Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. https://gdpr.eu/Recital-42-Burden-of-proof-and-requirements-for-consent/ https://gdpr.eu/Recital-42-Burden-of-proof-and-requirements-... I think having to pay a monthly subscription, or losing access to a service when you withdraw consent and don't pay a subscription should be regarded as a detriment.
tomcooks 5y ago

belorn 5y ago

What about having a law that makes it clear that an popup does not create informed consent, and then have companies decide to ignore that part of the law because it would be super inconvenient if they had to actually get informed consent. Maybe EU should write a new law by copying the GDPR text that defines consent and make it bold, all in caps, and underlined.

number6 5y ago
Cookies are somewhat out of scope of the GDPR. The GDPR was designed to have a twin who should regulate somethings like Cookies, Email and Telecommunications; it is now stalled for 3 years and everyone hopes it will come out next year.