10 ms·

Noyb aims to end “cookie banner terror” and issues more than 500 GDPR complaints

194 points by robin_reala 5y ago

mprev 5y ago
Terror is a bit strong.
user-the-name 5y ago
Finally! The vast majority of these are in clear violation.
csunbird 5y ago
Can they include BBC as well? They have opted into disguising their malicious cookies as "Legitimate Interest", which will stay even if you reject the cookies and requires toggling off 100+ of them individually.
- deleted 5y ago
  [deleted]
- mrweasel 5y ago
  I've seen "Legitimate Interest", but no where has anyone explained what that actually means.
  - robin_reala 5y ago
    Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout). The fact that the BBC have chosen to add consent options to a purported legitimate interest is a hint that they’re trying to confuse the user.
    - martin_a 5y ago
      > The fact that the BBC have chosen to add consent options [...] is a hint that they’re trying to confuse the user. Yes, just another dark pattern which you see so often with those cookie banners.
    - merijnv 5y ago
      > Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout). Nope, that'd be the "contract" basis (i.e. this information is strictly necessary for the user's intended task). Legitimate interest is for non-essential data that it is, somehow, in the user's best interest to gather. But convincing a judge of that data being in the user's best interest is a...tricky bar to clear.
  - martin_a 5y ago
    The GDPR has a part about that, it's where this wording comes from. It boils down to basic visitor counting without privacy violations. Companies obviously try to broaden the definition of that.
  - thrawn0r 5y ago
    It's one of the reasons that allows a company to collect/process personal information without a) consent b) contractual obligation c) legal requirements It's a bit loopholey, but has high hurdles since the processor needs to argue that their legitimate interest is bigger than the right for data privacy of the user. The processor has to create a DPIA (data privacy impact assessment) to show that they indeed balanced these both sides. The document can only be requested from the data protection authorities and are not public though.
  - tpxl 5y ago
    Those are things you need for the website to work. Session/login cookies are examples of this. It also applies to other data, for example if you order something they have a legitimate interest to ask for and store your address (but only for the purposes of shipping, they cannot use it for anything else). This has been twisted into "It's legitimate we track you because this is how we make money and we can't exist without money" which is obvious bullshit.
    - megous 5y ago
      GDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." in its preface. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Anyway, flimsy legitimate interest excuses are easiest to override. You just object to data processing, then it's upon the other side to provide overriding reasons why their legitimate interest is more important than your "interests or fundamental rights and freedoms" of which right to object to data processing is one. Almost nobody even tried to pass that hurdle when I objected to data processing. And those few that did try, I just sent them the decision to fine for almost identical situation (where a company tried to claim legitimate interest for mining data from public registries and sources and publishing them on a website) from my country's DPA. And that made them comply too.
      - dorgo 5y ago
        >You just object to data processing The problem with objecting is that they claim to need to store your info for the future to exclude you from data gathering. And presumably give that blacklist to everybody else to "exlude" you.
        megous 5y ago
        Fine by me, as long as they can't use it for anything else.
- movedx 5y ago
  Thanks to Brexit the BBC cannot be held accountable to the EU anymore, no? Edit: thanks for the responses. Understood: it still applies.
  - WJW 5y ago
    GDPR is not limited to companies inside the EU only. It covers (the PII of) every _user_ from the EU, location of the website does not matter.
  - hervature 5y ago
    GDPR applies to all websites that want to operate within the EU.
    - throwaway3699 5y ago
      The BBC does not operate in the EU, except to serve an ad supported version.
      - speedgoose 5y ago
        So it does ?
  - robin_reala 5y ago
    GDPR isn’t an EU law, it’s an EU directive, which means that it was (mostly) required to be implemented into member states’ own legal system. This was done in the UK before leaving the EU, in the Data Protection Act 2018.
    - zepin 5y ago
      GDPR is not a directive, but a "regulation" (hence the name, General Data Protection Regulation). It is enforceable "as is" in the whole EU without the need to be transposed into the various national laws.
  - Angostura 5y ago
    GDPR is embodied in U.K. law as the 2018 Data Protection Act. It continues to function post-Brexit
- sneak 5y ago
  The extension you want is called Cookie Autodelete. Then, it simply doesn't matter what you leave on. The extension deletes all identifiers from the site 15 seconds after tab close.
  - csunbird 5y ago
    But, unfortunately, even if you auto delete cookies, by accepting or not objecting "Legitimate interest for anti-fraud purposes" allow browser fingerprinting scripts to be run and does not require cookies to be present. Yes, the advertising companies are that evil.
    - tpxl 5y ago
      Is there any indication those scripts are not run until you click you accept?
      - csunbird 5y ago
        No, some of the sites even think that this falls into "Essential" category, as ad fraud is a crime, creating a loop hole.
    - sneak 5y ago
      That's where NoScript and uBlock Origin come in.
matsemann 5y ago
Please nuke TrustArc from orbit, the one where it takes 2-3 minutes for it to "process your cookie preferences". But accepting all cookies is instant.
- EmielMols 5y ago
  Haha, this is hilarious in a very sad way. Can only imagine how the internal conversation about such an implementation went :).
  - raverbashing 5y ago
    My guess is that the same people that were complaining about multi-million dollar fines were the same ones that decided to adopt this blatantly violating "cookie solution" Would be fun if all companies relying on this "cookie solution" sued back if they were found in non-compliance.
- occz 5y ago
  It's a dark pattern, and it's arguably illegal under the GDPR.
  - merijnv 5y ago
    I'd scratch the arguably, seems to blatantly violate the pretty explicit text of the GDPR.
mrweasel 5y ago
Great, way to many businesses have attempted to just cruise along, making some symbolic change or hoping that they could just buy a "GDPR" solution and stick it on their website. Some of the 3. party solution provider are going to have a problem if Noyb wins. They sold solution which they most have known could not be complaint, but they did so anyway because their customers wanted to pretend that the GDPR doesn't exists.
igravious 5y ago
I want a cookie policy API in browsers. User has a master switch for: Ask Every Time, Yes, No, and Essential Only – then in the list of remembered sites you can toggle after the fact if your little heart so desires. That's it, that's all I want. Give me back my web please. Between cookies and user authentication I think the web is an actively user hostile place. We could and should have done better.
- swiley 5y ago
  lynx has this, it's one of my favorite features.
- fogihujy 5y ago
  This used to be a feature of most web browsers. Then they removed it.
- gregoriol 5y ago
  It actually kind of exists: in Chrome and Firefox, you can block all third-party cookies, which are mostly ads and tracking, and keep those from the site itself, which are likely more useful. This doesn't remove the stupid banners though.
  - weird-eye-issue 5y ago
    Yeah sorry but this just isn't true at all. When the browsers started blocking or otherwise crippling third party cookies by default a few years back, lots of companies changed how tracking works to get around it. I know because I did it for a company I was working for. Instead of being able to use a simple tracking pixel hosted on a third-party server we changed to having websites embed JavaScript hosted by us so we could set a first party cookie. I don't think any respectable tracking uses third-party cookies these days because they just don't work well at all anymore.
  - FabHK 5y ago
    Is there a halfway decent cookie manager for Safari (macOS, maybe iOS)?
- 5y ago
raverbashing 5y ago
> Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR. Thank you. Latest annoying offender to me is Stack Overflow with their ridiculous semi-intrusive banner. And if I accept it errors out (probably because the ad-blocker blocks it). So thanks but no thanks. Why should I be given the equivalent of an intrusive intimate "verification" every time I visit your site?
- hef19898 5y ago
  I love sites that do that, even three options, "reject all", "accept all" and "only legitimate interest" (whatever that means) are fine. No going through the pages of third parties to make sure all of them are deactivated. No ridiculous wait times. It could be so easy.
- Google234 5y ago
  Stack overflow has no obligation to function corretly with any arbitrary extension(s)?.
  - amatecha 5y ago
    It actually also errors out from the "Strict" preset in Privacy preferences in Firefox. Clicking "Customize settings" on the StackOverflow popup thing results in this error on their site: "We couldn’t save your cookie preferences. Please adjust your browser settings or disable ad blocking. You can access your cookie settings at any time by clicking “Cookie Settings” in the footer." To be fair, Firefox does say this under the Strict setting: Heads up! This setting may cause some websites to not display content or work correctly. If a site seems broken, you may want to turn off tracking protection for that site to load all content.
deleted 5y ago
[deleted]
jchw 5y ago
Nobody wants to “customize their cookie preferences.” Ever. It’s clear this should be a yes or no that has no impact on functionality, but once you do that it becomes clearer: why isn’t the answer just no for everyone? Is someone out there really thinking “ah man, if only advertisements were more relevant!” ??? I do see how someone could plausibly prefer relevant ads over irrelevant ones. But I’d be willing to bet a majority of people simply do not care and in fact would rather see neither. Of course, this is bad news for some, but it was supposed to be bad news. ¯\_(ツ)_/¯
- dvfjsdhgfv 5y ago
  > Is someone out there really thinking “ah man, if only advertisements were more relevant!”? To be fair, people who prefer personalized ads do exist. Some of them are not aware this involves not only tracking but also profiling them.
  - krono 5y ago
    Give them your finger, and they'll not only take the whole hand, but your arm too and then divide up your other limbs and make it into a wholesale.
- fx32s 5y ago
  I personally prefer having personalised ads over vanilla ones. Especially if the data is not sold but merely used to improve ads. If possible I try to pay where possible to not have ads in the first place.
  - krageon 5y ago
    > Especially if the data is not sold but merely used to improve ads Which is never. It's disingenuous to even pay homage to this idea being possible in practice, as it makes the space seem a lot less seedy than it is.
    - fx32s 5y ago
      You can be targeted without explicitly selling data to a third party. This is how most large advertising networks work. They don't send a dump of all user data to a third party who wants to advertise.
decremental 5y ago
Cookie banners are the worst thing to hit the web since ads. I hope at some point this will all be a thing of the past. > industry statistics show that only 3% of users actually want to agree I'm sure 99.9% of people are tired of having to click anything the moment they visit a site.
- sneak 5y ago
  Lots of adblockers support blocking those consent boxes, too.
- dvfjsdhgfv 5y ago
  > I'm sure 99.9% of people are tired of having to click anything the moment they visit a site. When you think about it, this whole scheme really makes no sense. The web is already partitioned by tech giants. When I visit a new website, the first few seconds define my love-or-hate relationship with it. If the first thing I see is this crap, the website already has some negative points. If I see more bullshit, I just close the tab, there is so much to choose from, I don't have to put up with all this. Website owners should understand it and not actively try to put the visitors off.
- elaus 5y ago
  In theory the solution is easy: As a website owner don't use tracking or marketing cookies (or any other non-essential cookies) and you don't have to annoy your users with banners.
danuker 5y ago
In the meantime, disable cookies from your browser and use https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- DavideNL 5y ago
  Awesome extension. It doesn't always disable though, it often just accepts them all... Big difference.
deleted 5y ago
[deleted]
alkonaut 5y ago
Imagine how many meetings there have been where companies have decided to violate the GDPR by various half-assed implementations of cookie banners. I'm guessing people here on HN have been in such meetings. How does that discussion actually go? "We could put up a clearly compliant 'Reject all', but it would hurt our bottom line too much, so what can we do instead"? Also: it's interesting to see the design of the OneTrust tool that (apparently) is popular for creating a cookie banner. It seems like a hundred options, where most combinations would form non-compliant solution, and are only there to give sites the ability to trick users by dark patterns. E.g. why would "Show reject all" even be an option? Who actually needs help from a third party tool to be not-quite-compliant?
- vort3 5y ago
  And then they go to https://termsandconditions.game/ https://termsandconditions.game/ and get some ideas to creatively violate GDPR.
UweSchmidt 5y ago
With the cookie banners the way they are I'd say cookies are an antipattern and I wonder why the webdesign industry hasn't done away with them entirely. I think they contribute to the overall decrease in excitement about the Web. You never start to interact with a website in a fun way, it's always a click-based legal contract first.
jeofken 5y ago
Alice sends Bob a message: “please GET me /coolpage” Bob replies, and adds a code, with which Alice can send to Bob to identify herself if she wishes. Alice is free to include it, or not, in any subsequent message. Asking to “store a cookie” in a banner makes no sense - as it is Alice’s choice to include it or not in the first place. Bureaucrat be gone
- swiley 5y ago
  Yeah I'm glad recent releases of firefox added the option to disable cookies back to the settings page. Oh wait
  - jeofken 5y ago
    I agree with you - Firefox does not help you keep cookies out without private mode or addons afaik
- Kbelicius 5y ago
  GDPR isn't about cookies, its about collection and handling of PII.
tester34 5y ago
AFAIK People inform about cookies when they don't have to. If you use cookies only for technical stuff (auth) then you do not have to inform about them and that's why Github stopped doing it in last months iirc.
- neals 5y ago
  Is this true? That would be great.
  - tester34 5y ago
    I think yea, but I didn't read all cookie related stuff >Operational cookies >There are some cookies that we have to include in order for certain web pages to function. For this reason, they do not require your consent. In particular: > authentication cookies > technical cookies required by certain IT systems https://ec.europa.eu/info/cookies_en https://ec.europa.eu/info/cookies_en
  - szszrk 5y ago
    Well, yes, although this "for technical stuff" is quite vogue and misleading. Law actually states things "strictly necessary" don't need and agreement. So your auth session doesn't need anything, but your 3rd party monitoring software does. I wish this would be easier for me. A lot of sites on my market add disgusting banners even if they don't use cookies at all, or cookies were already created :) "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." I had a glance at my local interpretation it also states that it is not necessary to consent if it is directly required to fulfill action explicitly started by a user. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CC0673 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62...
  - orwin 5y ago
    Yes. And more. At my previous company, we were close to the CNIL (French GDPR watchdog) because we hosted medical data. Auth and other technically important cookies (like a shopping cart) are usefull so GDPR don't apply. Basically, if you don't sell your user data and process it for your own services, you can recolt almost whatever you want, even PII like ip adresses
bsdubernerd 5y ago
The real problem with the law is that you need a cookie to set the preference for the tracking to begin with, which I don't want. The law of course states that there shouldn't be any tracking without explicit consent. I'm sure the people using cookie blockers here are pretty familiar at how bad the browsing experience becomes if you expire and/or block cookies. The law should have been amended to REQUIRE websites to honor the already-existing-and-failed do-not-track header and ENFORCE that such header results in no popup whatsoever, since the choice has ALREADY been made. That is also required since the law is pretty generic and doesn't explicitly mention "cookies", but any method which can be used for tracking purposes. The question for a website on a technical level is then: - If I land on a website with such a consent, how do I guarantee that the first request before and UNTIL the consent is acted on respects my will to not be tracked? - Doing so as a dev is an absolute nightmare. Using the header would be a huge time saver. - As a user, how do I ensure I'm not being tracked? Let's be honest: I do not trust even google to honor the setting. Shady organizations are commonplace on the web. Everybody knows (browser vendors included) you need to act in a defensive manner. Blocking everything unless explicitly allowed is the only strategy that should be followed currently by those who care (and are willing to endure the resulting experience)
- sarnowski 5y ago
  Not all cookies require consent. There are many legitimate reasons to collect personal data - consent is only required if you cannot find another legitimate reason. For cookies that mean: technical cookies that you need to technical provide your offering (think of authentication session cookie, loadbalancer sticky session cookies, but also cookies to understand if someone opted into tracking) can be set with legitimate interest and do not require a consent. A consent under GDPR is strictly opt-in. This means, by default you must not track a user (EU citizen) that just landed on your site. After consent, you can load your GA plugin.
- sime2009 5y ago
  > The real problem with the law is that you need a cookie to set the preference for the tracking to begin with, which I don't want. The law of course states that there shouldn't be any tracking without explicit consent. The law doesn't concern itself with tracking directly. It talks about the use and handling of personal information. Putting a cookie on your machine to record that you rejected all tracking (i.e. "tracking=no"), is perfectly fine and does not require consent. It is not personal information.
alanfranz 5y ago
One interesting point: it seems that the so-called cookie law and the GDPR are more connected than I initially thought. Under the "old" cookie law, I offer no cookie rejection change for my own (personal, non-commercial, no-advertising) blog, I just inform my visitors of the cookies I set. Now I'm not sure whether I'm subject to the GDPR and if I should change something on my website. Ref: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
- scrollaway 5y ago
  > Now I'm not sure whether I'm subject to the GDPR and if I should change something on my website. Do you use cookies or cookie-like functionality (localstorage etc) for purposes other than those essential to the function of your website (such as logging in, keeping track of items in a cart, or other user-visible legitimate functionality)? If you only use them for that, you are not subject to having to display a cookie banner. Otherwise, you have to give the user a way to refuse opting into having you do that.
  - alanfranz 5y ago
    I know the principles, but it's not that easy. AFAICU (I'm not a lawyer), if we only considered the cookie law, it was perfectly ok not to give access to my website until the user had clicked "ok" on my terms and accepted my cookies. Nothing forced the website owner to offer a "partial acceptance of terms". The user just had to be informed. Then GDPR happened. Now the marketing consent must be given freely, so "marketing cookies" need to be excluded. I use very few cookies on my website, but I employ Google Analytics (with some privacy options set) and Disqus (which has changed ownership some years ago). Should I let people use the website without GA or Disqus even though I, personally, don't do any marketing through those?
    - scrollaway 5y ago
      > Should I let people use the website without GA or Disqus even though I, personally, don't do any marketing through those? Even if they are served by third parties, you are the one who is responsible for those cookies. GA is definitely non-essential, disqus probably too. So if you want to be by the book, you need to ask the user for consent: If they consent, you can enable GA and Disqus. If they reject, you should disable those. You can also split up consent for disqus and GA. Now the "cookie banner" pattern frankly sucks egg. You don't have to go that route specifically. What you could do instead as a more user-friendly approach, as far as the comments go, is a "load comments" button which, when you click it, tells the user "Our comments are hosted externally. In order to load them, we need to load third party scripts and cookies from disqus.com. See Disqus privacy policy here <link>. [Accept] [Reject]" -- Once they click that, you're good to always load the comments by default, no more button/pop-up.
aritmo 5y ago
Do Facebook as well. Here is their trick: 1. Connect with a private browser session so that you get a fresh "Accept Cookies". 2. You are asked whether to "Accept All" (highlighted), or "Manage Settings". 3. You click on "Manage Settings". The cookie options are indeed unselected, but the only button says "Accept cookies". You click to "Accept cookies" in order to not accept cookies!
DavideNL 5y ago
FYI. Support Noyb here if you like to support them! (I do) : https://noyb.eu/en/support-us https://noyb.eu/en/support-us
______- 5y ago
In uBlock Origin I've seen a few domains with the word `cookie` in them and after investigating them, they are serving Javascript that by virtue of being a third party, are scooping up personal data, not protecting it. Of course I blocked these in uBlock manually, but it breaks the site since the banner overlaps the content and I can't read my article, so I have to manually remove the offending HTML element using uBlock's element picker. Such a ridiculous farce!
- Izkata 5y ago
  Of all places, StackOverflow/Exchange has something similar going on: The javascript for its cookie banner gets blocked by PrivacyBadger, so you end up with none of the buttons working and it blocking half the content.

194 points by robin_reala 5y ago

mprev 5y ago

Terror is a bit strong.

user-the-name 5y ago

Finally! The vast majority of these are in clear violation.

csunbird 5y ago

Can they include BBC as well? They have opted into disguising their malicious cookies as "Legitimate Interest", which will stay even if you reject the cookies and requires toggling off 100+ of them individually.

deleted 5y ago
[deleted]
mrweasel 5y ago
I've seen "Legitimate Interest", but no where has anyone explained what that actually means.
- robin_reala 5y ago
  Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout). The fact that the BBC have chosen to add consent options to a purported legitimate interest is a hint that they’re trying to confuse the user.
  - martin_a 5y ago
    > The fact that the BBC have chosen to add consent options [...] is a hint that they’re trying to confuse the user. Yes, just another dark pattern which you see so often with those cookie banners.
  - merijnv 5y ago
    > Typically legitimate interest is used where consent isn’t an applicable basis (e.g. for processing a user’s address details in an online checkout). Nope, that'd be the "contract" basis (i.e. this information is strictly necessary for the user's intended task). Legitimate interest is for non-essential data that it is, somehow, in the user's best interest to gather. But convincing a judge of that data being in the user's best interest is a...tricky bar to clear.
- martin_a 5y ago
  The GDPR has a part about that, it's where this wording comes from. It boils down to basic visitor counting without privacy violations. Companies obviously try to broaden the definition of that.
- thrawn0r 5y ago
  It's one of the reasons that allows a company to collect/process personal information without a) consent b) contractual obligation c) legal requirements It's a bit loopholey, but has high hurdles since the processor needs to argue that their legitimate interest is bigger than the right for data privacy of the user. The processor has to create a DPIA (data privacy impact assessment) to show that they indeed balanced these both sides. The document can only be requested from the data protection authorities and are not public though.
- tpxl 5y ago
  Those are things you need for the website to work. Session/login cookies are examples of this. It also applies to other data, for example if you order something they have a legitimate interest to ask for and store your address (but only for the purposes of shipping, they cannot use it for anything else). This has been twisted into "It's legitimate we track you because this is how we make money and we can't exist without money" which is obvious bullshit.
  - megous 5y ago
    GDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." in its preface. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Anyway, flimsy legitimate interest excuses are easiest to override. You just object to data processing, then it's upon the other side to provide overriding reasons why their legitimate interest is more important than your "interests or fundamental rights and freedoms" of which right to object to data processing is one. Almost nobody even tried to pass that hurdle when I objected to data processing. And those few that did try, I just sent them the decision to fine for almost identical situation (where a company tried to claim legitimate interest for mining data from public registries and sources and publishing them on a website) from my country's DPA. And that made them comply too.
    - dorgo 5y ago
      >You just object to data processing The problem with objecting is that they claim to need to store your info for the future to exclude you from data gathering. And presumably give that blacklist to everybody else to "exlude" you.
      - megous 5y ago
        Fine by me, as long as they can't use it for anything else.
movedx 5y ago
Thanks to Brexit the BBC cannot be held accountable to the EU anymore, no? Edit: thanks for the responses. Understood: it still applies.
- WJW 5y ago
  GDPR is not limited to companies inside the EU only. It covers (the PII of) every _user_ from the EU, location of the website does not matter.
- hervature 5y ago
  GDPR applies to all websites that want to operate within the EU.
  - throwaway3699 5y ago
    The BBC does not operate in the EU, except to serve an ad supported version.
    - speedgoose 5y ago
      So it does ?
- robin_reala 5y ago
  GDPR isn’t an EU law, it’s an EU directive, which means that it was (mostly) required to be implemented into member states’ own legal system. This was done in the UK before leaving the EU, in the Data Protection Act 2018.
  - zepin 5y ago
    GDPR is not a directive, but a "regulation" (hence the name, General Data Protection Regulation). It is enforceable "as is" in the whole EU without the need to be transposed into the various national laws.
- Angostura 5y ago
  GDPR is embodied in U.K. law as the 2018 Data Protection Act. It continues to function post-Brexit
sneak 5y ago
The extension you want is called Cookie Autodelete. Then, it simply doesn't matter what you leave on. The extension deletes all identifiers from the site 15 seconds after tab close.
- csunbird 5y ago
  But, unfortunately, even if you auto delete cookies, by accepting or not objecting "Legitimate interest for anti-fraud purposes" allow browser fingerprinting scripts to be run and does not require cookies to be present. Yes, the advertising companies are that evil.
  - tpxl 5y ago
    Is there any indication those scripts are not run until you click you accept?
    - csunbird 5y ago
      No, some of the sites even think that this falls into "Essential" category, as ad fraud is a crime, creating a loop hole.
  - sneak 5y ago
    That's where NoScript and uBlock Origin come in.

matsemann 5y ago

Please nuke TrustArc from orbit, the one where it takes 2-3 minutes for it to "process your cookie preferences". But accepting all cookies is instant.

EmielMols 5y ago
Haha, this is hilarious in a very sad way. Can only imagine how the internal conversation about such an implementation went :).
- raverbashing 5y ago
  My guess is that the same people that were complaining about multi-million dollar fines were the same ones that decided to adopt this blatantly violating "cookie solution" Would be fun if all companies relying on this "cookie solution" sued back if they were found in non-compliance.
occz 5y ago
It's a dark pattern, and it's arguably illegal under the GDPR.
- merijnv 5y ago
  I'd scratch the arguably, seems to blatantly violate the pretty explicit text of the GDPR.

mrweasel 5y ago

Great, way to many businesses have attempted to just cruise along, making some symbolic change or hoping that they could just buy a "GDPR" solution and stick it on their website. Some of the 3. party solution provider are going to have a problem if Noyb wins. They sold solution which they most have known could not be complaint, but they did so anyway because their customers wanted to pretend that the GDPR doesn't exists.

igravious 5y ago

I want a cookie policy API in browsers. User has a master switch for: Ask Every Time, Yes, No, and Essential Only – then in the list of remembered sites you can toggle after the fact if your little heart so desires. That's it, that's all I want. Give me back my web please. Between cookies and user authentication I think the web is an actively user hostile place. We could and should have done better.

swiley 5y ago
lynx has this, it's one of my favorite features.
fogihujy 5y ago
This used to be a feature of most web browsers. Then they removed it.
gregoriol 5y ago
It actually kind of exists: in Chrome and Firefox, you can block all third-party cookies, which are mostly ads and tracking, and keep those from the site itself, which are likely more useful. This doesn't remove the stupid banners though.
- weird-eye-issue 5y ago
  Yeah sorry but this just isn't true at all. When the browsers started blocking or otherwise crippling third party cookies by default a few years back, lots of companies changed how tracking works to get around it. I know because I did it for a company I was working for. Instead of being able to use a simple tracking pixel hosted on a third-party server we changed to having websites embed JavaScript hosted by us so we could set a first party cookie. I don't think any respectable tracking uses third-party cookies these days because they just don't work well at all anymore.
- FabHK 5y ago
  Is there a halfway decent cookie manager for Safari (macOS, maybe iOS)?
5y ago

raverbashing 5y ago

> Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR. Thank you. Latest annoying offender to me is Stack Overflow with their ridiculous semi-intrusive banner. And if I accept it errors out (probably because the ad-blocker blocks it). So thanks but no thanks. Why should I be given the equivalent of an intrusive intimate "verification" every time I visit your site?

hef19898 5y ago
I love sites that do that, even three options, "reject all", "accept all" and "only legitimate interest" (whatever that means) are fine. No going through the pages of third parties to make sure all of them are deactivated. No ridiculous wait times. It could be so easy.
Google234 5y ago
Stack overflow has no obligation to function corretly with any arbitrary extension(s)?.
- amatecha 5y ago
  It actually also errors out from the "Strict" preset in Privacy preferences in Firefox. Clicking "Customize settings" on the StackOverflow popup thing results in this error on their site: "We couldn’t save your cookie preferences. Please adjust your browser settings or disable ad blocking. You can access your cookie settings at any time by clicking “Cookie Settings” in the footer." To be fair, Firefox does say this under the Strict setting: Heads up! This setting may cause some websites to not display content or work correctly. If a site seems broken, you may want to turn off tracking protection for that site to load all content.

deleted 5y ago

[deleted]

jchw 5y ago

Nobody wants to “customize their cookie preferences.” Ever. It’s clear this should be a yes or no that has no impact on functionality, but once you do that it becomes clearer: why isn’t the answer just no for everyone? Is someone out there really thinking “ah man, if only advertisements were more relevant!” ??? I do see how someone could plausibly prefer relevant ads over irrelevant ones. But I’d be willing to bet a majority of people simply do not care and in fact would rather see neither. Of course, this is bad news for some, but it was supposed to be bad news. ¯\_(ツ)_/¯

dvfjsdhgfv 5y ago
> Is someone out there really thinking “ah man, if only advertisements were more relevant!”? To be fair, people who prefer personalized ads do exist. Some of them are not aware this involves not only tracking but also profiling them.
- krono 5y ago
  Give them your finger, and they'll not only take the whole hand, but your arm too and then divide up your other limbs and make it into a wholesale.
fx32s 5y ago
I personally prefer having personalised ads over vanilla ones. Especially if the data is not sold but merely used to improve ads. If possible I try to pay where possible to not have ads in the first place.
- krageon 5y ago
  > Especially if the data is not sold but merely used to improve ads Which is never. It's disingenuous to even pay homage to this idea being possible in practice, as it makes the space seem a lot less seedy than it is.
  - fx32s 5y ago
    You can be targeted without explicitly selling data to a third party. This is how most large advertising networks work. They don't send a dump of all user data to a third party who wants to advertise.

decremental 5y ago

Cookie banners are the worst thing to hit the web since ads. I hope at some point this will all be a thing of the past. > industry statistics show that only 3% of users actually want to agree I'm sure 99.9% of people are tired of having to click anything the moment they visit a site.

sneak 5y ago
Lots of adblockers support blocking those consent boxes, too.
dvfjsdhgfv 5y ago
> I'm sure 99.9% of people are tired of having to click anything the moment they visit a site. When you think about it, this whole scheme really makes no sense. The web is already partitioned by tech giants. When I visit a new website, the first few seconds define my love-or-hate relationship with it. If the first thing I see is this crap, the website already has some negative points. If I see more bullshit, I just close the tab, there is so much to choose from, I don't have to put up with all this. Website owners should understand it and not actively try to put the visitors off.
elaus 5y ago
In theory the solution is easy: As a website owner don't use tracking or marketing cookies (or any other non-essential cookies) and you don't have to annoy your users with banners.

danuker 5y ago

In the meantime, disable cookies from your browser and use https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/

DavideNL 5y ago
Awesome extension. It doesn't always disable though, it often just accepts them all... Big difference.

deleted 5y ago

[deleted]

alkonaut 5y ago

Imagine how many meetings there have been where companies have decided to violate the GDPR by various half-assed implementations of cookie banners. I'm guessing people here on HN have been in such meetings. How does that discussion actually go? "We could put up a clearly compliant 'Reject all', but it would hurt our bottom line too much, so what can we do instead"? Also: it's interesting to see the design of the OneTrust tool that (apparently) is popular for creating a cookie banner. It seems like a hundred options, where most combinations would form non-compliant solution, and are only there to give sites the ability to trick users by dark patterns. E.g. why would "Show reject all" even be an option? Who actually needs help from a third party tool to be not-quite-compliant?

vort3 5y ago
And then they go to https://termsandconditions.game/ https://termsandconditions.game/ and get some ideas to creatively violate GDPR.

UweSchmidt 5y ago

With the cookie banners the way they are I'd say cookies are an antipattern and I wonder why the webdesign industry hasn't done away with them entirely. I think they contribute to the overall decrease in excitement about the Web. You never start to interact with a website in a fun way, it's always a click-based legal contract first.

jeofken 5y ago

Alice sends Bob a message: “please GET me /coolpage” Bob replies, and adds a code, with which Alice can send to Bob to identify herself if she wishes. Alice is free to include it, or not, in any subsequent message. Asking to “store a cookie” in a banner makes no sense - as it is Alice’s choice to include it or not in the first place. Bureaucrat be gone

swiley 5y ago
Yeah I'm glad recent releases of firefox added the option to disable cookies back to the settings page. Oh wait
- jeofken 5y ago
  I agree with you - Firefox does not help you keep cookies out without private mode or addons afaik
Kbelicius 5y ago
GDPR isn't about cookies, its about collection and handling of PII.

tester34 5y ago

AFAIK People inform about cookies when they don't have to. If you use cookies only for technical stuff (auth) then you do not have to inform about them and that's why Github stopped doing it in last months iirc.

neals 5y ago
Is this true? That would be great.
- tester34 5y ago
  I think yea, but I didn't read all cookie related stuff >Operational cookies >There are some cookies that we have to include in order for certain web pages to function. For this reason, they do not require your consent. In particular: > authentication cookies > technical cookies required by certain IT systems https://ec.europa.eu/info/cookies_en https://ec.europa.eu/info/cookies_en
- szszrk 5y ago
  Well, yes, although this "for technical stuff" is quite vogue and misleading. Law actually states things "strictly necessary" don't need and agreement. So your auth session doesn't need anything, but your 3rd party monitoring software does. I wish this would be easier for me. A lot of sites on my market add disgusting banners even if they don't use cookies at all, or cookies were already created :) "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." I had a glance at my local interpretation it also states that it is not necessary to consent if it is directly required to fulfill action explicitly started by a user. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CC0673 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62...
- orwin 5y ago
  Yes. And more. At my previous company, we were close to the CNIL (French GDPR watchdog) because we hosted medical data. Auth and other technically important cookies (like a shopping cart) are usefull so GDPR don't apply. Basically, if you don't sell your user data and process it for your own services, you can recolt almost whatever you want, even PII like ip adresses

bsdubernerd 5y ago

The real problem with the law is that you need a cookie to set the preference for the tracking to begin with, which I don't want. The law of course states that there shouldn't be any tracking without explicit consent. I'm sure the people using cookie blockers here are pretty familiar at how bad the browsing experience becomes if you expire and/or block cookies. The law should have been amended to REQUIRE websites to honor the already-existing-and-failed do-not-track header and ENFORCE that such header results in no popup whatsoever, since the choice has ALREADY been made. That is also required since the law is pretty generic and doesn't explicitly mention "cookies", but any method which can be used for tracking purposes. The question for a website on a technical level is then: - If I land on a website with such a consent, how do I guarantee that the first request before and UNTIL the consent is acted on respects my will to not be tracked? - Doing so as a dev is an absolute nightmare. Using the header would be a huge time saver. - As a user, how do I ensure I'm not being tracked? Let's be honest: I do not trust even google to honor the setting. Shady organizations are commonplace on the web. Everybody knows (browser vendors included) you need to act in a defensive manner. Blocking everything unless explicitly allowed is the only strategy that should be followed currently by those who care (and are willing to endure the resulting experience)

sarnowski 5y ago
Not all cookies require consent. There are many legitimate reasons to collect personal data - consent is only required if you cannot find another legitimate reason. For cookies that mean: technical cookies that you need to technical provide your offering (think of authentication session cookie, loadbalancer sticky session cookies, but also cookies to understand if someone opted into tracking) can be set with legitimate interest and do not require a consent. A consent under GDPR is strictly opt-in. This means, by default you must not track a user (EU citizen) that just landed on your site. After consent, you can load your GA plugin.
sime2009 5y ago
> The real problem with the law is that you need a cookie to set the preference for the tracking to begin with, which I don't want. The law of course states that there shouldn't be any tracking without explicit consent. The law doesn't concern itself with tracking directly. It talks about the use and handling of personal information. Putting a cookie on your machine to record that you rejected all tracking (i.e. "tracking=no"), is perfectly fine and does not require consent. It is not personal information.

alanfranz 5y ago

One interesting point: it seems that the so-called cookie law and the GDPR are more connected than I initially thought. Under the "old" cookie law, I offer no cookie rejection change for my own (personal, non-commercial, no-advertising) blog, I just inform my visitors of the cookies I set. Now I'm not sure whether I'm subject to the GDPR and if I should change something on my website. Ref: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/

scrollaway 5y ago
> Now I'm not sure whether I'm subject to the GDPR and if I should change something on my website. Do you use cookies or cookie-like functionality (localstorage etc) for purposes other than those essential to the function of your website (such as logging in, keeping track of items in a cart, or other user-visible legitimate functionality)? If you only use them for that, you are not subject to having to display a cookie banner. Otherwise, you have to give the user a way to refuse opting into having you do that.
- alanfranz 5y ago
  I know the principles, but it's not that easy. AFAICU (I'm not a lawyer), if we only considered the cookie law, it was perfectly ok not to give access to my website until the user had clicked "ok" on my terms and accepted my cookies. Nothing forced the website owner to offer a "partial acceptance of terms". The user just had to be informed. Then GDPR happened. Now the marketing consent must be given freely, so "marketing cookies" need to be excluded. I use very few cookies on my website, but I employ Google Analytics (with some privacy options set) and Disqus (which has changed ownership some years ago). Should I let people use the website without GA or Disqus even though I, personally, don't do any marketing through those?
  - scrollaway 5y ago
    > Should I let people use the website without GA or Disqus even though I, personally, don't do any marketing through those? Even if they are served by third parties, you are the one who is responsible for those cookies. GA is definitely non-essential, disqus probably too. So if you want to be by the book, you need to ask the user for consent: If they consent, you can enable GA and Disqus. If they reject, you should disable those. You can also split up consent for disqus and GA. Now the "cookie banner" pattern frankly sucks egg. You don't have to go that route specifically. What you could do instead as a more user-friendly approach, as far as the comments go, is a "load comments" button which, when you click it, tells the user "Our comments are hosted externally. In order to load them, we need to load third party scripts and cookies from disqus.com. See Disqus privacy policy here <link>. [Accept] [Reject]" -- Once they click that, you're good to always load the comments by default, no more button/pop-up.

aritmo 5y ago

Do Facebook as well. Here is their trick: 1. Connect with a private browser session so that you get a fresh "Accept Cookies". 2. You are asked whether to "Accept All" (highlighted), or "Manage Settings". 3. You click on "Manage Settings". The cookie options are indeed unselected, but the only button says "Accept cookies". You click to "Accept cookies" in order to not accept cookies!

DavideNL 5y ago

FYI. Support Noyb here if you like to support them! (I do) : https://noyb.eu/en/support-us https://noyb.eu/en/support-us

______- 5y ago

In uBlock Origin I've seen a few domains with the word `cookie` in them and after investigating them, they are serving Javascript that by virtue of being a third party, are scooping up personal data, not protecting it. Of course I blocked these in uBlock manually, but it breaks the site since the banner overlaps the content and I can't read my article, so I have to manually remove the offending HTML element using uBlock's element picker. Such a ridiculous farce!

Izkata 5y ago
Of all places, StackOverflow/Exchange has something similar going on: The javascript for its cookie banner gets blocked by PrivacyBadger, so you end up with none of the buttons working and it blocking half the content.