10 ms·

Noyb.eu files 422 formal GDPR complaints on nerve-wrecking “Cookie Banners”

189 points by hosteur 5y ago

hosteur 5y ago
Max Schrems, Chairperson of noyb: > “We saw a lot of improvements on many websites and are very happy with the first results. Some major players like Seat, Mastercard or Nikon have instantly changed their practices. However, many other websites have only stopped the most problematic practices. For example, they may have added a ‘reject’ option, but still make it hard to read. The requirement to show a prominent withdrawal option clearly faced the biggest resistance from website owners.”
hyperman1 5y ago
Nice. Keep up the good work
zibzab 5y ago
It feels as if the companies are working hard to make it annoying and complex to opt out. Every iteration makes things a bit worse. We need people like Max to stop this annoying trend. Edit: while at it, i have to get this off my chest: Legitimate Interest is probably illegal and violates GDPR. Max should go after that next.
- deleted 5y ago
  [deleted]
- tcldr 5y ago
  Legitimate interest is one of the six legal bases for processing personal data under the GDPR, alongside: consent, performance of a contract, a vital interest, a legal requirement, and a public interest. I don’t think we’ve seen much in the way of precedent being set here, but theoretically if you can demonstrate and document a measured approach to the way you collect and process data it should be fine. (Objection not withstanding.) On the other hand, a drag net approach to collecting and sharing data won’t stand up to legitimate interest claims no matter how many toggles you put on your cookie banners.
  - zibzab 5y ago
    My personal take is that there is no real legitimate interest here and these companies are just testing to see how far they can push this.
  - xg15 5y ago
    In the dialogs I have seen so far, the "legitimate interest" page was always a perfect carbon-copy of the "consent" page - with the only difference that the "consent" options were off by default while the "legimate interest" options were on by default. I understand that, legally, the buttons represent different actions (not giving consent vs objecting a legitimate interest claim) but practically, the only purpose the "legitimate interest" page seems to serve is as a way to have on-by-default options that are still borderline legal. I can't imagine this is in the spirit of the law.
    - pieno 5y ago
      I think a lot of sites are conflating cookie consent and GDPR consent. You only need GDPR consent when processing personal data, so you don’t need consent just for storing settings in a cookie (as long as those settings do not contain personal data or identifiers linked to personal data). But many sites will ask “GDPR consent” or claim “GDPR legitimate interest” for those settings cookies in any case (in my view that’s a dark pattern in itself because you’re actually making the side harder or impossible to use and thereby inducing visitors to just click the big green “accept all” button to get it over with already…)
      - M2Ys4U 5y ago
        >I think a lot of sites are conflating cookie consent and GDPR consent. They are doing that, however the the legal standard of consent under the ePrivacy Directive is the same as the GDPR. The ePD initially referenced the definition in the Data Protection Directive, but that was replaced by the GDPR.
        tcldr 5y ago
        As I understand, there's currently an update to the ePD working its way through which aims to clarify some of these points and unify it with the GDPR. Here's what they say about analytics for example: > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0...
- glitchcrab 5y ago
  Of all the major players in this space, Trustarc are by far the worst imo. "Please wait while we save your preferences. This may take a few minutes". No it shouldn't, you're just taking punitive action because I didn't opt in to all the tracking. I guarantee that if I just accepted all cookies then the popup would disappear immediately.
  - zibzab 5y ago
    Can HN readers do an analysis of trustarcs code and publish it here? Is that thing doing anything or communicating with any servers while we are waiting?
    - isbvhodnvemrwvn 5y ago
      It is, but it shouldn't have to in the first place.
  - heckerhut 5y ago
    100% correct. I tested both options.
- xg15 5y ago
  Based on the occasional comments here, some analytics sites seem to track how many % of visitors actually accept cookies through the banners. It's not a surprising thing to do, but it pretty quickly leads to the percentage becoming yet another metric to "optimize". I think it's save to assume there is no practical way to make more visitors want to accept more cookies. That leaves only one way to optimize that metric, and that is dark patterns.
  - thewebcount 5y ago
    I have to ask, do people really click on these things? I have never once clicked on a cookie banner. I mostly leave them alone neither accepting nor denying. In most cases I read the page using Reader mode, so other than seeing them flash in at the bottom for a second, I don't even see them. When a page doesn't work in Reader mode, I still ignore it and don't interact with it, even when it takes up half the page. If I'm prohibited from viewing the page without it and Reader view doesn't work, I hit the back button and leave the page. Who is clicking on these things and accepting them? Can anyone share their acceptance rate? I'm seriously curious how many people accept them and why. I've almost never had any bad consequence of ignoring them other than poor website design, which is usually a given even without them.
    - jlokier 5y ago
      On my phone I use a browser, Firefox Focus, that wipes all saved state every time it's used. That means no cookies and the banners are always there fresh. I didn't pick it specifically out of concern for tracking. I just tried it and found it nice to use, and it gives a little more peace of mind, so I made it the default So like you, I browse with the banners because they are always there anyway and there's no point clicking them. If a big one is in the way, I'm reluctant to take the easy route and pseudo-"agree" even knowing that all local state is wiped when I finish reading that page. Just because the insidious trackers might take it as pseudo-"consent" to use other tracking techniques that go beyond browser state. But who am I kidding. Such trackers are unlikely to respect the law or the stated intentions of people browsing anyway.
- aspyct 5y ago
  Yeah, legitimate interest toggles have become a nightmare recently. Dozens of teeny tiny switches to click, it's infuriating. Let alone the fact that "selling my data to make money" hardly qualifies ad "legitimate" in my book. Come on, that's exactly why GDPR exists in the first place! I'm hitting the back button more and more these days.
ckastner 5y ago
Max Schrems is just amazing. Big Tech has been steamrolling over privacy for more than a decade, but Schrems keeps pushing back on them through courts. With major success (in the EU, at least). And he's not some hard-line activist with extreme demands, all he's doing is asking for reasonable stuff. [1] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
- DavideNL 5y ago
  Agreed, which is why i decided to donate to Noyb to help support privacy in general; https://support.noyb.eu/join https://support.noyb.eu/join
solarkraft 5y ago
Take my money. I hate these banners, among the other common GDPR violations.
- slownews45 5y ago
  The banners are not GDPR violation, they are GDPR requirement. Check out the .eu govs own websites!
  - M2Ys4U 5y ago
    It's not a case that banner => GDPR compliance. A site can have a banner and still be in violation, hence Noyb's actions here.
eberkund 5y ago
What if the EU had a tech team which produced widgets that were mandatory to be used by companies rather than every company creating their own custom cookie prompt filled with dark patterns? Kind of like the standardized Facebook like buttons which used to be so popular. But instead it's a JavaScript snippet or web component provided by the EU that Google would be legally mandated to integrate into their site? Alternatively, could we just go back to using the DNT header? I liked this solution a lot better anyways, just set it once and forget about it. The problem was that sites would just ignore it, but if the EU adds some legal weight behind this functionality it could actually be meaningful.
- qwerty456127 5y ago
  We don't need damn widget. All we need is every web site to respect the standard do-not-track flag. And this can only work if the flag is off by default so only those who actually care set it. Things like Google Analytics should also check and respect the flag. Requiring every webmaster to ask every visitor if they don't mind Google Analytics being injected is nonsensical. We should also exclude remembering a user which has signed in from the tracking definition. It's absurd to warn the user about cookies when they sign in. I also don't want classic (no-choice) cookie warning banners, regardless to whether I am tracked or not. Almost everybody already knows cookies are always there (and we can just introduce a browser extension indicating cookies usage for those who don't). The banners serve no purpose other than annoying people.
  - rhn_mk1 5y ago
    > this can only work if the flag is off by default so only those who actually care set it. As the effort in the article is attempting to establish, this can also work when there is a legal stick against those who don't comply. All we need is companies to stop tracking people by default. A side benefit is that webmasters don't need to ask about Google Analytics if it's not being used.
    - qwerty456127 5y ago
      This is utopian. I want this but don't believe this is possible. Perhaps they might agree to stop tracking a portion of users who opt out but forcing them to stop tracking anybody is unlikely to succeed, and even if it succeeds they will just track everybody secretly. I also am not confident in total elimination of tracking being a good idea from the economical point of view - many small businesses rely on precise targeting today.
AlanYx 5y ago
Doesn't this approach put the cart before the horse? The GDPR contains a lot of aspirational language, but European data protection authorities haven't yet articulated clear, binding common standards in this area. In the linked article, Max acknowledges this ("Others said that they want a clear ruling by the authorities, before they start complying.") There's also the reality that different DPAs have different interpretations of what the GDPR requires. In the linked article, Max also acknowledges this: "We need clear pan-European rules. Right now, a German company feels that the French authorities’ interpretation of the GDPR only applies to France, even though they operate under the same law within the same European market." This may be an unpopular take, but Noyb is essentially harassing hundreds of companies with his organization's particular interpretation of the GDPR. Wouldn't it be more appropriate to first push authorities to develop common, clear, technically detailed, and legally binding interpretations of the GDPR, rather than going after companies to take action in what is still a grey area? It's not even clear at this point that the changes Noyb is pushing for are either legally required or, on the flipside, legally sufficient.
- WesolyKubeczek 5y ago
  Oh, just stop it right there. GDPR is already quite clear, the companies just keep pretending it’s more complicated than it actually is because they want to continue to look out for number one, is all.
  - AlanYx 5y ago
    But the GDPR is not clear -- I gave two examples from the linked article to support my point. The same thing is true across the GDPR... I'm more familiar with the academic literature around whether there is a "right to an explanation" for AI systems embedded in the GDPR, for example. There are dozens of academic papers arguing both sides of that specific question, with no clear conclusion or consensus.
    - zibzab 5y ago
      Your mistake is that you belive that (1) the law is not clear and (2) these poor companies end up with these crazy solutions because the law is unclear. The thing is that the _intent_ of the law is very clear. You could search for loopholes and come up with all kinds of creative solutions to go around it, but then you can't pretend it is a decision you made in good fate.
stavros 5y ago
NOYB is great for our liberties, please make sure to support them with a recurring donation: https://support.noyb.eu/join https://support.noyb.eu/join
hhlbf 5y ago
How can I file a formal complaint against the EU for this stupid cookie law?
- dt3ft 5y ago
  I would like to know this as well.
- mook 5y ago
  The cookie law is fine, the problem is with companies who maliciously comply with it (and often "comply" with it in a way that doesn't actually comply at all). It's sort of like how telcos in America like to comply with various sales taxes by… making something up and adding a line item to your bill purporting to be taxes, but really it's just them charging you for no reason.
  - IMTDb 5y ago
    Is it fine ? As a user, I consider that it's OK for websites to track my activity. This is true for every single website in the world. Is there any way for me to indicate that preference anywhere in the current framework ? The complain here is that it's too complex to opt out of the tracking. But I have no way of opting out of that fake "protection" framework, which I consider to be useless and wrong. None at all. As made extensively clear by the pencil pusher who came up with this grand idea of mandating an interruption for every single website I visit: those are my data. I want to have the freedom of letting websites track me if they want to, I don't need them to ask me. Give me any way to do that, and I'll be happy. But that was explicitly prevented. The EU seems to think they know what's best for me, and won't let me make my own choices. It really doesn't, and rather than accepting that fact and giving me the freedom they claim to defend, they would rather annoy me. So I'll keep on clicking on "Accept All" for the years to come cursing the hours of brain time lost to make a dude feel important.
    - jlokier 5y ago
      Then you should consider supporting NOYB, as they want to make what you want easier for you. "Advanced Data Protection Control": https://www.dataprotectioncontrol.org/ https://www.dataprotectioncontrol.org/ If you did try to pursue the EU, I think you would quickly meet the counter argument that there are many people who are unhappy being tracked in detail systematically without consent, and would be even more if they knew the extent of it, so it would not be ok to make your preference just be how it is for everyone.
tester756 5y ago
Just out of curiosity Do you know how many websites are there that show cookie banners when they don't have to? e.g they have only auth/technical cookies
- 7952 5y ago
  Don't know how many. But I have a few times where we used external APIs that could conceivably set a cookie.
- g_p 5y ago
  An interesting question as many don't understand the rules for when consent is required. I'd wager it is far fewer sites than who don't show one, or show a meaningless pop-up saying they use cookies and you agree by browsing to the site. These sites almost invariably are using GTM to load all sorts of third party scripts and cookies.... Heck even sites that show cookie prompts often don't link the prompt to the actual script placing the cookies! Cookies dumped before the consent box has even loaded...
pentagrama 5y ago
I didn't remember the site, but the other day I saw one of this deceptive cookie banners that tries to trick you to accept all cookies and make you do many steps to reject. I noticed that the banner was made by "One Trust", and if you go to One Trust site, the examples showed are not deceptive at all [1], all the examples have a clear "Reject all"/"Accept all" buttons. One Trust marketing page is hiding that has deceptive designs built in. I guess the OP can make GDPR complaints to One Trust and services like that, and fix in bulk the sites that are using those services (or make it lose clients and shut down). [1] https://www.onetrust.com/cookie-banner-gallery/ https://www.onetrust.com/cookie-banner-gallery/
- Macha 5y ago
  The CMP vendors claimed defense is that they make their widgets configurable so sites can judge for themselves what they think they need to legally ask users for and give a default maximally compliant interface, but conveniently with lots of knobs to twiddle to maximise "consent" rates by making alternatives harder. That said, even that preview page gives the option to see the "Legitimate Interests" interface by selecting "IAB TCF 2.0" under the regulations section, rather than just "GDPR".
trangus_1985 5y ago
I use a Firefox extension (self deleting cookies). Clicking "accept" and then having the browser delete all of those trackers when I leave the site? Pretty good.
- zibzab 5y ago
  But that means they can do whatever they want with your data during that session? Furthermore, some store it externally (e.g Trustarc) and maybe they can recover your consent later somehow?
- tinus_hn 5y ago
  In a world where browser fingerprinting doesn’t exist this is a great solution.
  - trangus_1985 5y ago
    browser fingerprinting hasn't been deployed in the wild, and I use the firefox built in anti-fingerprinting as well as extensive privacy protecting extensions. Of course, that's not perfect. On the other hand, it took 30% of people using adblock for anti-adblock measures to be enforced. I have yet to see practical, wide spread fingerprinting be deployed (although I don't doubt it's out there). Self Deleting Cookies are, of course, one component of online privacy. Sadly.
Aerroon 5y ago
https://europa.eu/ https://europa.eu/ If the European Union's own main website cannot do without a pop-up then what are we even talking about? They have effectively limitless resources to make it work. Their website doesn't even have to earn money and yet even they use a consent pop-up.
- PhasmaFelis 5y ago
  I'm not sure what you're trying to say. It seems perfectly reasonable for the EU's website to adhere to its own rules.
  - latexr 5y ago
    The goal of the law shouldn’t be for you to implement a banner asking for permission, but for you to build a website which does not need it because it respects and doesn’t gobble user data. The EU’s website is setting a bad example by not embodying the optimal result of the law they created.
    - tinus_hn 5y ago
      I agree with the sentiment but if you read the statement that comes with the banner, you’ll find that it is mostly reasonable. It’s just a problem that if you embed tweets on your website, or a YouTube video or something, your visitors will get the associated cookies.
      - thewebcount 5y ago
        > ... if you read ... Nobody reads them. They either completely ignore them like me, or search for the "get the fuck out of my way and let me do the thing I came here to do" button. > It’s just a problem that if you embed tweets on your website, or a YouTube video or something, your visitors will get the associated cookies. Then don't do that on a government website! Why should I have to consent to that shit when visiting my government's websites? I don't want to use Twitter or YouTube and participating in government shouldn't force me to! WTF?
kevin_thibedeau 5y ago
I rarely use my GDrive but today I had to download an image sent from my phone and wasn't allowed because third party cookies were disabled. It seems like they've added a new dark pattern to force 3PC on but nobody's been complaining about it. It seems absolutely ridiculous that a Google property depends on a separate domain for access. After enabling, there were network requests to googleusercontent.com which really has no reason to exist other than to serve as a wedge for the dark pattern.
- g_p 5y ago
  Not excusing their dark patterns (which don't play nice if you block double-click at DNS level, but just as an observation, googleusercontent.com itself is actually a legitimate and valid (at least IMO) security precaution. By serving up all user generated content from a separate domain, it gives defense-in-depth against any kind of uploaded content getting script execution - it's served up from a domain that is completely separate from any authentication tokens or valuable cookies etc. That way, a user-uploaded HTML file (if someone found an endpoint that would render it) shouldn't be able to be served up from a first-party domain.
deleted 5y ago
[deleted]
billpg 5y ago
"10.000 websites" A lot of fuss over ten websites.
no_time 5y ago
If only there was a http header I could toggle to show websites I do not wish to be tracked...

189 points by hosteur 5y ago

Max Schrems, Chairperson of noyb: > “We saw a lot of improvements on many websites and are very happy with the first results. Some major players like Seat, Mastercard or Nikon have instantly changed their practices. However, many other websites have only stopped the most problematic practices. For example, they may have added a ‘reject’ option, but still make it hard to read. The requirement to show a prominent withdrawal option clearly faced the biggest resistance from website owners.”

hyperman1 5y ago

Nice. Keep up the good work

zibzab 5y ago

It feels as if the companies are working hard to make it annoying and complex to opt out. Every iteration makes things a bit worse. We need people like Max to stop this annoying trend. Edit: while at it, i have to get this off my chest: Legitimate Interest is probably illegal and violates GDPR. Max should go after that next.

deleted 5y ago
[deleted]
tcldr 5y ago
Legitimate interest is one of the six legal bases for processing personal data under the GDPR, alongside: consent, performance of a contract, a vital interest, a legal requirement, and a public interest. I don’t think we’ve seen much in the way of precedent being set here, but theoretically if you can demonstrate and document a measured approach to the way you collect and process data it should be fine. (Objection not withstanding.) On the other hand, a drag net approach to collecting and sharing data won’t stand up to legitimate interest claims no matter how many toggles you put on your cookie banners.
- zibzab 5y ago
  My personal take is that there is no real legitimate interest here and these companies are just testing to see how far they can push this.
- xg15 5y ago
  In the dialogs I have seen so far, the "legitimate interest" page was always a perfect carbon-copy of the "consent" page - with the only difference that the "consent" options were off by default while the "legimate interest" options were on by default. I understand that, legally, the buttons represent different actions (not giving consent vs objecting a legitimate interest claim) but practically, the only purpose the "legitimate interest" page seems to serve is as a way to have on-by-default options that are still borderline legal. I can't imagine this is in the spirit of the law.
  - pieno 5y ago
    I think a lot of sites are conflating cookie consent and GDPR consent. You only need GDPR consent when processing personal data, so you don’t need consent just for storing settings in a cookie (as long as those settings do not contain personal data or identifiers linked to personal data). But many sites will ask “GDPR consent” or claim “GDPR legitimate interest” for those settings cookies in any case (in my view that’s a dark pattern in itself because you’re actually making the side harder or impossible to use and thereby inducing visitors to just click the big green “accept all” button to get it over with already…)
    - M2Ys4U 5y ago
      >I think a lot of sites are conflating cookie consent and GDPR consent. They are doing that, however the the legal standard of consent under the ePrivacy Directive is the same as the GDPR. The ePD initially referenced the definition in the Data Protection Directive, but that was replaced by the GDPR.
      - tcldr 5y ago
        As I understand, there's currently an update to the ePD working its way through which aims to clarify some of these points and unify it with the GDPR. Here's what they say about analytics for example: > Audience measurement shall be limited to non-intrusive practices that are not likely to create a privacy risk for users > The Council’s position creates a new exception for audience measurement as suggested by the Article 29 Working Party6. However, the derogation for audience measurement as proposed by the Council is worded too broadly and could lead to an overly broad interpretation of what could fall under the scope of the derogation and consequently lower the level of protection of end users’ terminals. > Therefore, the EDPB stresses that the derogation for audience measurement should be limited to low level analytics necessary for the analysis of the performance of the service requested by the user and should be solely limited to providing statistics to the service operator, and must be put in place by the operator or their processors. Therefore, this processing operation cannot give rise, by itself or in combination with other tracking solutions, to any singling-out or any profiling of users by the provider or other data controllers. Moreover, the audience measurement service should not allow to collect navigation information related to users across distinct websites/applications and should include a user-friendly mechanism to opt-out from any data collection. https://edpb.europa.eu/system/files/2021-03/edpb_statement_032021_eprivacy_regulation_en_0.pdf https://edpb.europa.eu/system/files/2021-03/edpb_statement_0...
glitchcrab 5y ago
Of all the major players in this space, Trustarc are by far the worst imo. "Please wait while we save your preferences. This may take a few minutes". No it shouldn't, you're just taking punitive action because I didn't opt in to all the tracking. I guarantee that if I just accepted all cookies then the popup would disappear immediately.
- zibzab 5y ago
  Can HN readers do an analysis of trustarcs code and publish it here? Is that thing doing anything or communicating with any servers while we are waiting?
  - isbvhodnvemrwvn 5y ago
    It is, but it shouldn't have to in the first place.
- heckerhut 5y ago
  100% correct. I tested both options.
xg15 5y ago
Based on the occasional comments here, some analytics sites seem to track how many % of visitors actually accept cookies through the banners. It's not a surprising thing to do, but it pretty quickly leads to the percentage becoming yet another metric to "optimize". I think it's save to assume there is no practical way to make more visitors want to accept more cookies. That leaves only one way to optimize that metric, and that is dark patterns.
- thewebcount 5y ago
  I have to ask, do people really click on these things? I have never once clicked on a cookie banner. I mostly leave them alone neither accepting nor denying. In most cases I read the page using Reader mode, so other than seeing them flash in at the bottom for a second, I don't even see them. When a page doesn't work in Reader mode, I still ignore it and don't interact with it, even when it takes up half the page. If I'm prohibited from viewing the page without it and Reader view doesn't work, I hit the back button and leave the page. Who is clicking on these things and accepting them? Can anyone share their acceptance rate? I'm seriously curious how many people accept them and why. I've almost never had any bad consequence of ignoring them other than poor website design, which is usually a given even without them.
  - jlokier 5y ago
    On my phone I use a browser, Firefox Focus, that wipes all saved state every time it's used. That means no cookies and the banners are always there fresh. I didn't pick it specifically out of concern for tracking. I just tried it and found it nice to use, and it gives a little more peace of mind, so I made it the default So like you, I browse with the banners because they are always there anyway and there's no point clicking them. If a big one is in the way, I'm reluctant to take the easy route and pseudo-"agree" even knowing that all local state is wiped when I finish reading that page. Just because the insidious trackers might take it as pseudo-"consent" to use other tracking techniques that go beyond browser state. But who am I kidding. Such trackers are unlikely to respect the law or the stated intentions of people browsing anyway.
aspyct 5y ago
Yeah, legitimate interest toggles have become a nightmare recently. Dozens of teeny tiny switches to click, it's infuriating. Let alone the fact that "selling my data to make money" hardly qualifies ad "legitimate" in my book. Come on, that's exactly why GDPR exists in the first place! I'm hitting the back button more and more these days.

ckastner 5y ago

Max Schrems is just amazing. Big Tech has been steamrolling over privacy for more than a decade, but Schrems keeps pushing back on them through courts. With major success (in the EU, at least). And he's not some hard-line activist with extreme demands, all he's doing is asking for reasonable stuff. [1] https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems

DavideNL 5y ago
Agreed, which is why i decided to donate to Noyb to help support privacy in general; https://support.noyb.eu/join https://support.noyb.eu/join

solarkraft 5y ago

Take my money. I hate these banners, among the other common GDPR violations.

slownews45 5y ago
The banners are not GDPR violation, they are GDPR requirement. Check out the .eu govs own websites!
- M2Ys4U 5y ago
  It's not a case that banner => GDPR compliance. A site can have a banner and still be in violation, hence Noyb's actions here.

eberkund 5y ago

What if the EU had a tech team which produced widgets that were mandatory to be used by companies rather than every company creating their own custom cookie prompt filled with dark patterns? Kind of like the standardized Facebook like buttons which used to be so popular. But instead it's a JavaScript snippet or web component provided by the EU that Google would be legally mandated to integrate into their site? Alternatively, could we just go back to using the DNT header? I liked this solution a lot better anyways, just set it once and forget about it. The problem was that sites would just ignore it, but if the EU adds some legal weight behind this functionality it could actually be meaningful.

qwerty456127 5y ago
We don't need damn widget. All we need is every web site to respect the standard do-not-track flag. And this can only work if the flag is off by default so only those who actually care set it. Things like Google Analytics should also check and respect the flag. Requiring every webmaster to ask every visitor if they don't mind Google Analytics being injected is nonsensical. We should also exclude remembering a user which has signed in from the tracking definition. It's absurd to warn the user about cookies when they sign in. I also don't want classic (no-choice) cookie warning banners, regardless to whether I am tracked or not. Almost everybody already knows cookies are always there (and we can just introduce a browser extension indicating cookies usage for those who don't). The banners serve no purpose other than annoying people.
- rhn_mk1 5y ago
  > this can only work if the flag is off by default so only those who actually care set it. As the effort in the article is attempting to establish, this can also work when there is a legal stick against those who don't comply. All we need is companies to stop tracking people by default. A side benefit is that webmasters don't need to ask about Google Analytics if it's not being used.
  - qwerty456127 5y ago
    This is utopian. I want this but don't believe this is possible. Perhaps they might agree to stop tracking a portion of users who opt out but forcing them to stop tracking anybody is unlikely to succeed, and even if it succeeds they will just track everybody secretly. I also am not confident in total elimination of tracking being a good idea from the economical point of view - many small businesses rely on precise targeting today.

AlanYx 5y ago

Doesn't this approach put the cart before the horse? The GDPR contains a lot of aspirational language, but European data protection authorities haven't yet articulated clear, binding common standards in this area. In the linked article, Max acknowledges this ("Others said that they want a clear ruling by the authorities, before they start complying.") There's also the reality that different DPAs have different interpretations of what the GDPR requires. In the linked article, Max also acknowledges this: "We need clear pan-European rules. Right now, a German company feels that the French authorities’ interpretation of the GDPR only applies to France, even though they operate under the same law within the same European market." This may be an unpopular take, but Noyb is essentially harassing hundreds of companies with his organization's particular interpretation of the GDPR. Wouldn't it be more appropriate to first push authorities to develop common, clear, technically detailed, and legally binding interpretations of the GDPR, rather than going after companies to take action in what is still a grey area? It's not even clear at this point that the changes Noyb is pushing for are either legally required or, on the flipside, legally sufficient.

WesolyKubeczek 5y ago
Oh, just stop it right there. GDPR is already quite clear, the companies just keep pretending it’s more complicated than it actually is because they want to continue to look out for number one, is all.
- AlanYx 5y ago
  But the GDPR is not clear -- I gave two examples from the linked article to support my point. The same thing is true across the GDPR... I'm more familiar with the academic literature around whether there is a "right to an explanation" for AI systems embedded in the GDPR, for example. There are dozens of academic papers arguing both sides of that specific question, with no clear conclusion or consensus.
  - zibzab 5y ago
    Your mistake is that you belive that (1) the law is not clear and (2) these poor companies end up with these crazy solutions because the law is unclear. The thing is that the _intent_ of the law is very clear. You could search for loopholes and come up with all kinds of creative solutions to go around it, but then you can't pretend it is a decision you made in good fate.

stavros 5y ago

NOYB is great for our liberties, please make sure to support them with a recurring donation: https://support.noyb.eu/join https://support.noyb.eu/join

hhlbf 5y ago

How can I file a formal complaint against the EU for this stupid cookie law?

dt3ft 5y ago
I would like to know this as well.
mook 5y ago
The cookie law is fine, the problem is with companies who maliciously comply with it (and often "comply" with it in a way that doesn't actually comply at all). It's sort of like how telcos in America like to comply with various sales taxes by… making something up and adding a line item to your bill purporting to be taxes, but really it's just them charging you for no reason.
- IMTDb 5y ago
  Is it fine ? As a user, I consider that it's OK for websites to track my activity. This is true for every single website in the world. Is there any way for me to indicate that preference anywhere in the current framework ? The complain here is that it's too complex to opt out of the tracking. But I have no way of opting out of that fake "protection" framework, which I consider to be useless and wrong. None at all. As made extensively clear by the pencil pusher who came up with this grand idea of mandating an interruption for every single website I visit: those are my data. I want to have the freedom of letting websites track me if they want to, I don't need them to ask me. Give me any way to do that, and I'll be happy. But that was explicitly prevented. The EU seems to think they know what's best for me, and won't let me make my own choices. It really doesn't, and rather than accepting that fact and giving me the freedom they claim to defend, they would rather annoy me. So I'll keep on clicking on "Accept All" for the years to come cursing the hours of brain time lost to make a dude feel important.
  - jlokier 5y ago
    Then you should consider supporting NOYB, as they want to make what you want easier for you. "Advanced Data Protection Control": https://www.dataprotectioncontrol.org/ https://www.dataprotectioncontrol.org/ If you did try to pursue the EU, I think you would quickly meet the counter argument that there are many people who are unhappy being tracked in detail systematically without consent, and would be even more if they knew the extent of it, so it would not be ok to make your preference just be how it is for everyone.

tester756 5y ago

Just out of curiosity Do you know how many websites are there that show cookie banners when they don't have to? e.g they have only auth/technical cookies

7952 5y ago
Don't know how many. But I have a few times where we used external APIs that could conceivably set a cookie.
g_p 5y ago
An interesting question as many don't understand the rules for when consent is required. I'd wager it is far fewer sites than who don't show one, or show a meaningless pop-up saying they use cookies and you agree by browsing to the site. These sites almost invariably are using GTM to load all sorts of third party scripts and cookies.... Heck even sites that show cookie prompts often don't link the prompt to the actual script placing the cookies! Cookies dumped before the consent box has even loaded...

pentagrama 5y ago

I didn't remember the site, but the other day I saw one of this deceptive cookie banners that tries to trick you to accept all cookies and make you do many steps to reject. I noticed that the banner was made by "One Trust", and if you go to One Trust site, the examples showed are not deceptive at all [1], all the examples have a clear "Reject all"/"Accept all" buttons. One Trust marketing page is hiding that has deceptive designs built in. I guess the OP can make GDPR complaints to One Trust and services like that, and fix in bulk the sites that are using those services (or make it lose clients and shut down). [1] https://www.onetrust.com/cookie-banner-gallery/ https://www.onetrust.com/cookie-banner-gallery/

Macha 5y ago
The CMP vendors claimed defense is that they make their widgets configurable so sites can judge for themselves what they think they need to legally ask users for and give a default maximally compliant interface, but conveniently with lots of knobs to twiddle to maximise "consent" rates by making alternatives harder. That said, even that preview page gives the option to see the "Legitimate Interests" interface by selecting "IAB TCF 2.0" under the regulations section, rather than just "GDPR".

trangus_1985 5y ago

I use a Firefox extension (self deleting cookies). Clicking "accept" and then having the browser delete all of those trackers when I leave the site? Pretty good.

zibzab 5y ago
But that means they can do whatever they want with your data during that session? Furthermore, some store it externally (e.g Trustarc) and maybe they can recover your consent later somehow?
tinus_hn 5y ago
In a world where browser fingerprinting doesn’t exist this is a great solution.
- trangus_1985 5y ago
  browser fingerprinting hasn't been deployed in the wild, and I use the firefox built in anti-fingerprinting as well as extensive privacy protecting extensions. Of course, that's not perfect. On the other hand, it took 30% of people using adblock for anti-adblock measures to be enforced. I have yet to see practical, wide spread fingerprinting be deployed (although I don't doubt it's out there). Self Deleting Cookies are, of course, one component of online privacy. Sadly.

Aerroon 5y ago

https://europa.eu/ https://europa.eu/ If the European Union's own main website cannot do without a pop-up then what are we even talking about? They have effectively limitless resources to make it work. Their website doesn't even have to earn money and yet even they use a consent pop-up.

PhasmaFelis 5y ago
I'm not sure what you're trying to say. It seems perfectly reasonable for the EU's website to adhere to its own rules.
- latexr 5y ago
  The goal of the law shouldn’t be for you to implement a banner asking for permission, but for you to build a website which does not need it because it respects and doesn’t gobble user data. The EU’s website is setting a bad example by not embodying the optimal result of the law they created.
  - tinus_hn 5y ago
    I agree with the sentiment but if you read the statement that comes with the banner, you’ll find that it is mostly reasonable. It’s just a problem that if you embed tweets on your website, or a YouTube video or something, your visitors will get the associated cookies.
    - thewebcount 5y ago
      > ... if you read ... Nobody reads them. They either completely ignore them like me, or search for the "get the fuck out of my way and let me do the thing I came here to do" button. > It’s just a problem that if you embed tweets on your website, or a YouTube video or something, your visitors will get the associated cookies. Then don't do that on a government website! Why should I have to consent to that shit when visiting my government's websites? I don't want to use Twitter or YouTube and participating in government shouldn't force me to! WTF?

kevin_thibedeau 5y ago

I rarely use my GDrive but today I had to download an image sent from my phone and wasn't allowed because third party cookies were disabled. It seems like they've added a new dark pattern to force 3PC on but nobody's been complaining about it. It seems absolutely ridiculous that a Google property depends on a separate domain for access. After enabling, there were network requests to googleusercontent.com which really has no reason to exist other than to serve as a wedge for the dark pattern.

g_p 5y ago
Not excusing their dark patterns (which don't play nice if you block double-click at DNS level, but just as an observation, googleusercontent.com itself is actually a legitimate and valid (at least IMO) security precaution. By serving up all user generated content from a separate domain, it gives defense-in-depth against any kind of uploaded content getting script execution - it's served up from a domain that is completely separate from any authentication tokens or valuable cookies etc. That way, a user-uploaded HTML file (if someone found an endpoint that would render it) shouldn't be able to be served up from a first-party domain.

deleted 5y ago

[deleted]

billpg 5y ago

"10.000 websites" A lot of fuss over ten websites.

no_time 5y ago

If only there was a http header I could toggle to show websites I do not wish to be tracked...