5 ms·

Privacy group targets website 'cookie terror'

18 points by tmfi 5y ago

svckr 5y ago
By the time I got through all the pre-selected "legitimate interest" checkboxes I lost interest.
matsemann 5y ago
Original source is discussed here https://news.ycombinator.com/item?id=27340769 https://news.ycombinator.com/item?id=27340769
catlifeonmars 5y ago
Does anyone have any good resources for thoughtful designs for gathering cookie permissions? I’m fairly unhappy with the proliferation of cookie banners that primarily exist to comply with the letter of the law and not necessarily the spirit. I’d like to know how I can do better.
- g_p 5y ago
  One of the challenges with this is that much of the best practice has evolved over time with guidance from national regulators and guidance from the EDPB. Latest EDPB guidelines I'm aware of are at https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... The current banners barely even comply with the letter of the law, let alone the spirit of the law - most sites are still dropping the cookies before the user sees or interacts with the banner. Assuming they actually do function (around half don't, in my experience), then you have different interpretations around even the size of buttons and their colour - current view seems to be that buttons should be equal in size and prominence, and that an accept all should be matched by a button to reject all (rather than forcing users to granularly opt out of each one). I have no clue where the modern trend to claim legitimate interest around cookies arises from, but it has no legal basis in the UK for one, and similar true for other jurisdictions - in the UK, there are only 3 situations where identifiers can be used or placed (see PECR legislation and guidelines from the ICO) - due to the technical necessity of getting the bits and bytes to you, in order to deliver solely functionality requested by the user (setting session cookie for login, setting a shopping basket cookie due to a user adding an item to their basket etc.). Your final option is explicit GDPR-level consent. Legitimate interest is not an option. The prevalence of presumed consent to use of third party and faux-first-party cookies for other purposes has no basis though - stats or telemetry etc are not permitted uses, as much as companies may cry... Either technical necessity to deliver bits and bytes, to deliver solely the user's explicitly requested functionality, or based on informed user consent. Ironically if you do it right, you don't need any cookie banner! Just don't use cookies for marketing, targeting, tracking, or anything else that's hidden from the user - no cookie consent is required to let them browse, shop, check out, etc!
- danaris 5y ago
  Not a lawyer and haven't looked closely into the relevant statutes, but... My understanding is that so long as you're not a) using third-party cookies, or b) trying to track the user beyond what's necessary for your site to function in a reasonable way (and that's "technical function", not "necessary for me to pay the bills for my site"), you don't need to have any banner. For instance, I run a small (and very niche) browser-based game, which has never done any advertising or tracking, not even Google Analytics. It needs a cookie to keep track of which account is logged in from any given browser, and another with a couple of per-device preferences for how the site should display, and that's it.
______- 5y ago
In uBlock Origin I've seen a few domains with the word `cookie` in them and after investigating them, they are serving Javascript that by virtue of being a third party, are scooping up personal data, not protecting it. Of course I blocked these in uBlock manually, but it breaks the site since the banner overlaps the content and I can't read my article, so I have to manually remove the offending HTML element using uBlock. Such a ridiculous farce.
- rolph 5y ago
  you should also try turning off the page style in FF open the view menu go to page style and select. it makes the page linear, looks like hell and shows you the information most of the time.
- g_p 5y ago
  This sounds like CNAME cloaking perhaps? (https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...)

18 points by tmfi 5y ago

By the time I got through all the pre-selected "legitimate interest" checkboxes I lost interest.

Original source is discussed here https://news.ycombinator.com/item?id=27340769 https://news.ycombinator.com/item?id=27340769

catlifeonmars 5y ago

Does anyone have any good resources for thoughtful designs for gathering cookie permissions? I’m fairly unhappy with the proliferation of cookie banners that primarily exist to comply with the letter of the law and not necessarily the spirit. I’d like to know how I can do better.

g_p 5y ago
One of the challenges with this is that much of the best practice has evolved over time with guidance from national regulators and guidance from the EDPB. Latest EDPB guidelines I'm aware of are at https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... The current banners barely even comply with the letter of the law, let alone the spirit of the law - most sites are still dropping the cookies before the user sees or interacts with the banner. Assuming they actually do function (around half don't, in my experience), then you have different interpretations around even the size of buttons and their colour - current view seems to be that buttons should be equal in size and prominence, and that an accept all should be matched by a button to reject all (rather than forcing users to granularly opt out of each one). I have no clue where the modern trend to claim legitimate interest around cookies arises from, but it has no legal basis in the UK for one, and similar true for other jurisdictions - in the UK, there are only 3 situations where identifiers can be used or placed (see PECR legislation and guidelines from the ICO) - due to the technical necessity of getting the bits and bytes to you, in order to deliver solely functionality requested by the user (setting session cookie for login, setting a shopping basket cookie due to a user adding an item to their basket etc.). Your final option is explicit GDPR-level consent. Legitimate interest is not an option. The prevalence of presumed consent to use of third party and faux-first-party cookies for other purposes has no basis though - stats or telemetry etc are not permitted uses, as much as companies may cry... Either technical necessity to deliver bits and bytes, to deliver solely the user's explicitly requested functionality, or based on informed user consent. Ironically if you do it right, you don't need any cookie banner! Just don't use cookies for marketing, targeting, tracking, or anything else that's hidden from the user - no cookie consent is required to let them browse, shop, check out, etc!
danaris 5y ago
Not a lawyer and haven't looked closely into the relevant statutes, but... My understanding is that so long as you're not a) using third-party cookies, or b) trying to track the user beyond what's necessary for your site to function in a reasonable way (and that's "technical function", not "necessary for me to pay the bills for my site"), you don't need to have any banner. For instance, I run a small (and very niche) browser-based game, which has never done any advertising or tracking, not even Google Analytics. It needs a cookie to keep track of which account is logged in from any given browser, and another with a couple of per-device preferences for how the site should display, and that's it.

______- 5y ago

In uBlock Origin I've seen a few domains with the word `cookie` in them and after investigating them, they are serving Javascript that by virtue of being a third party, are scooping up personal data, not protecting it. Of course I blocked these in uBlock manually, but it breaks the site since the banner overlaps the content and I can't read my article, so I have to manually remove the offending HTML element using uBlock. Such a ridiculous farce.

rolph 5y ago
you should also try turning off the page style in FF open the view menu go to page style and select. it makes the page linear, looks like hell and shows you the information most of the time.
g_p 5y ago
This sounds like CNAME cloaking perhaps? (https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...)