19 ms·
Starbucks and TrustArc add fake cookie processing delay if you don't click agree
- avnigo 5y agoHere it is in action: https://twitter.com/pixelscript/status/1436711732152504326 https://twitter.com/pixelscript/status/1436711732152504326
- deleted 5y ago[deleted]
- alkonaut 5y agoWish regulators could hijack their domain and force visitors to a 15 second delay landing page explaining that they were found in violation of the GDPR and “you will be redirected to Starbucks shortly”. Second infringement make it a two minute delay.
- dannyw 5y agoJust fine Starbucks 1% of their global turnover.
- JumpCrisscross 5y ago> Just fine Starbucks 1% of their global turnover Why? They’re literally adding friction to their purchasing process. Nothing they sell is critical. Nobody’s privacy is being violated. They aren’t lying. They’re just being annoying. This is the most trivial non-issue one could possibly get hysterical over.
- capableweb 5y ago> Nothing they sell is critical Does that mean the law doesn't apply to them? You do business in Europe, you follow European laws + the laws of the specific country you're doing business with, doesn't matter what the type of business is.
- JumpCrisscross 5y ago> Does that mean the law doesn't apply to them? The ePD is notoriously ignored and unenforced [1]. It is also not clear what part of the law a simple delay would violate. (Most of the sparing enforcement has been around dropping cookies after someone opts out.) [1] https://petsymposium.org/2019/files/papers/issue2/popets-2019-0023.pdf https://petsymposium.org/2019/files/papers/issue2/popets-201... Figure 5
- Nextgrid 5y agoNot sure about the ePrivacy directive but this flow would be in breach of the GDPR and I’m pretty sure you have to comply with both.
- JumpCrisscross 5y ago> this flow would be in breach of the GDPR How, precisely? It's a one and a half second delay. Functionality is not changed one iota. No cookies are loaded. Would it be better if there were an energy-burning inefficient server-side algorithm spinning away?
- Nextgrid 5y agoSee my other comment for reasons why this would be in breach: https://news.ycombinator.com/item?id=28501088 https://news.ycombinator.com/item?id=28501088
- JumpCrisscross 5y ago> my other comment for reasons why this would be in breach: https://news.ycombinator.com/item?id=28501088 https://news.ycombinator.com/item?id=28501088 It's a decent attempt at an argument, but far from convincing. One could argue it's to dissuade opting out. One could also argue it's being presented to show the opt out has teeth. (Non-technical people ascribe meaning to fantasy progress meters. A number of UI studies have shown that.) As for opt out needing to be instant in comparison to opt in, the argument holds no water. If a legacy system were patched for GDPR, it's reasonable for the opt-out to involve more code, not less, as an extra routine undoes the defaults. That or making a record of the opt out is done tediously. (In this case, the argument is moot since the delay is fake.) The toughest argument one could make from the ICO checklist [1] is that a one and a half second spinner delay constitutes a material "detriment" or penalization of withdrawal of consent. Those are technically true to a trivial degree, but immaterial. Far from meriting a 1% fine per the original comment. These kinds of arguments hurt everyone working for privacy by trivializing it to a sympathetically mockable degree. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- matheusmoreira 5y agoOne percent? Make it something significant like 50%. Better yet, figure out how much money they made with their surveillance capitalism, including any investments and profits derived from such capital. Fine them exactly that and then some for good measure.
- Tijdreiziger 5y agoIME this isn't unique to Starbucks, every single site that uses TrustArc does this. Thankfully, I haven't had to deal with any of these stupid pop-ups since installing the 'I don't care about cookies' add-on. [1] Related question: Does anyone have experience using 'Stardust Cookie Cutter'? [2] Is it better than 'I don't care about cookies' or does it do the same thing? [1] https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ [2] https://get.stardust.today/ https://get.stardust.today/
- junon 5y agoForbes does this, too. It was the first site I noticed it on, years ago at this point. I don't know how it's not illegal.
- tbihl 5y agoPlease stop doing this. Not everything you don't like needs to be illegal, and taking your business elsewhere has literally never been easier in the history of the world. I don't want to live in a world where the criminalization of everything that ever happened that you didn't like means that I'm always breaking the law.
- Nextgrid 5y agoThe problem with spyware is that it stalks you regardless of whether you give “business” to the site or not.
- A_non_e-moose 5y agoHow many people not liking murder or theft did it take to make it into a law? How many people not liking gaslighting personal-data-theft dark patterns will it take to make it into a law? We're transitioning from purely physical beings to having a more virtual presence. Virtual crimes are much less visible and have much greater impact at scale than their physical counterparts, identity theft by Equifax breach or a hack, VS physical force or pickpocketing, for example.
- GordonS 5y agoI see the TrustArc in use at quite a lot of sites - the fake delay, and the whole UX in general, is intensely irritating, and it just feels like the darkest of dark patterns. Really gives me a bad feeling about sites that use it.
- the_third_wave 5y agoI don't see them anywhere other than as a light red rectangle in the uBlock popup - they're not in my whitelist so they end up blocked by default. Things tend to work just fine without it, the same goes for many other "trust"-related sites. Some sites won't work at all without them but, fortunately, the web is a large place full of choice.
- wibagusto 5y agoI find less and less I want to use the internet to browse sites anymore. Not just because of these dark patterns, but usability is messed up. The web should be redesigned to force standards compliant requiring websites to allow a “no script” support where you just go for information. Cookies are not even remotely the largest problem on the fucked UX web we have today. It’s less about data delivery and ubiquity of the original WWW concept and more about “how do we force users to stay on our platform” or “how do we extract data on our users and sell it to the highest bidder.” They also need to pass laws forcing companies who sign up users for services to have a graceful way to sign down and delete their account instead of these stupid cookie banners.
- vasilegoian 5y agoAs a web developer I can only agree with all that you said. It's like some companies are actively trying to make visitors leave their websites and never come back. Or at least avoid them as much as possible.
- guntars 5y agoAlso as a web developer, agreed, but unfortunately it’s like spam. I’d never buy fake sunglasses or penis enlargement pills from some email that appeared in my inbox, but the fact that I still get these means it’s profitable. As long as dark patterns are profitable, they’ll be around.
- Aeolun 5y agoThe worst thing about this is that someone was asked to implement this, and instead of saying ‘fuck no’. They went ahead and did it anyway. There’s a few hills worth dying on and I feel this is one of them. It is just unambiguously evil.
- grishka 5y agoIf you tell them you aren't doing it, they'll fire you and find someone who will. It'll end up existing either way.
- Engineering-MD 5y agoThis argument can justify anything on that basis, from fraud to murder or slavery. By withdrawing your services to do it, you reduce supply, increasing prices and providing a financial penalty for trying to enact it.
- hdjjhhvvhga 5y agoAm I the only one seeing the irony of it? You are asking the guy who already added a ton of JavaScript junk to the website to have concerns about one delay function?
- grishka 5y agoThere's plenty of people who would do whatever they're told, regardless of their own principles, as long as they're paid for it. I'm not one of them, sure, but as long as there's just ONE person like this, we can't have nice things in the long run.
- inetknght 5y ago> This argument can justify anything on that basis, from fraud to murder or slavery. Interestingly there are laws and whistleblower protections against murder and slavery.
- moron4hire 5y agoAnother poster mentioned H1B visa holders, and I'm sure that is a valid concern there, given how poorly H1B holders are treated. But as a citizen, I've heard this many times, been told it to my face during sit downs with my boss while refusing to do something shady, and it has never happened. On two occasions, the threat was idle. On two more, I quit and they never did find anyone to replace me. But regardless, even if it were true, you still need to protect your own soul. Better to let someone else corrupt themselves.
- realusername 5y agoThat's also why I like the web, instantly anybody can pull the inspector and see right through their crap and dark patterns, good luck doing that on mobile.
- kolmel 5y agoI feel like someone should be fined over this...
- warent 5y agoThey're trying to be clever and punish people who enjoy their rights of GDPR. The EU will not find these patterns cute or acceptable, and fortunately their fines are large enough to cause the offending business real pain. It's only a matter of time!
- the_third_wave 5y agoI seem to recall a relation between loading time and visitor retention? A quick search gives dozens of statements along the lines of.. A 1 second delay in page response can result in a 7% reduction in conversions. [1] 47% of consumers expect a web page to load in 2 seconds or less. [2] 40% of people abandon a website that takes more than 3 seconds to load. [3] ...etc Either those cookies make up for the lost business, these statements only hold for the initial page load or these statements are factually incorrect. I suspect the statements only hold for the initial page load, that spinner and the slowly but surely updating fake counter holds visitors enthralled for the final outcome. Anyway, the path is clear: close that Starbucks tab after ~2 seconds of faked cookie setting time and get your caffeine kick elsewhere. [1,2,3] just search for it - most results are commercial entities trying to sell some "marketing" or "website enhancement" service which I do not feel like boosting by linking to them. Much of the original research seems to come from Google and can be found in a report titled “The Need for Mobile Speed".
- JumpCrisscross 5y ago> Either those cookies make up for the lost business, these statements only hold for the initial page load or these statements are factually incorrect It’s likely TrustArc trying to make their widget look muscular to an idiot executive at Starbucks.
- Nextgrid 5y agoThe delay is not specific to Starbucks' implementation. Every TrustArc popup has such a delay. Considering everything else about it also screams bad faith, I think it's a deliberate tactic to train people to click "accept" on these so they can then boast about how their "consent" management platform provides better conversion, which in turn somewhat justifies the salaries of the oxygen wasters in the marketing/advertising departments.
- didgeoridoo 5y agoThere’s a big ol’ “Cancel” button that stays live during the “processing time”. They’re trying to get you to click it in frustration, which will reset your cookies to maximum intrusion levels before you go about your business on the site.
- Sebb767 5y ago1.5 seconds seem to low for me to be for user annoyance, especially since this comes after the point where the user would change his mind. I'd bet someone had to implement this and needed this to look like it's doing something.
- ceejayoz 5y agoIt's not 1.5 seconds, though. https://twitter.com/pixelscript/status/1436711732152504326 https://twitter.com/pixelscript/status/1436711732152504326 shows it taking nearly a minute.
- boomboomsubban 5y agoThough the practice is always deplorable, I don't get why Starbucks would want this kind of thing. Sure they might be able to sell your data for a little extra cash, but why would they make it harder to buy coffee on their site?
- mmmBacon 5y agoI am very tired of having to deal with cookies on just about every site I go to. Almost nobody wants tracking cookies. I’ve noticed many sites it’s hard to tell whether the tracking cookies are enabled or disabled.
- dehrmann 5y agoThe legislation should have been that sites honor DNT (or something similar) better, and you're promoted by your browser. Doing it site-by-site is a headache for both users and companies. > Almost nobody wants tracking cookies. It's complicated because a lot of people do want to stay logged into certain websites. Even if that's not "tracking," what about recommendations? Youtube does recommendations for logged-out users, and I suspect a lot of people find some value in that.
- Aulig 5y agoI don't remember the site, but one single time so far a website told me "we picked minimal cookie settings for you, since you sent a Do Not Track order". Very nice.
- ksaj 5y agoI have seen this in distant times as well. The one I remember most provided a link to view your opt-in choices. Clicking on it showed what the "minimal" cookies were, that actually did affect how the page worked, or fed other "features" that were non-tracking, and what ones were not included so that you could opt in to some things if you were interested in them (which I'm sure was always never). I thought it was clever and unusually honest.
- matheusmoreira 5y agoThey figure out some way to spin it as "essential" or "required". They say it lets them "improve their services". As if some tracking bullshit could ever be essential to anything.
- fnord77 5y agoI've seen punitive patterns like this elsewhere. some newspaper sites start autoplaying a little video window, and it you click the "close" X, the player will keep playing for several more seconds with a phony subtitle saying "shutting down" or "closing" btw why do some many sites do whatever they can to force a video to play when you click on them?
- antifa 5y agoAlso then the video still crawls all over the webpage as you scroll.
- perceptronas 5y agoI noticed Docker hub has exactly the same dark pattern
- aembleton 5y agoThey also use trustarc.
- yodon 5y agoThe fake "processing" delay is likely there because averaged across all visitors (not just averaged across HN commentors and voters) it increases visitor confidence that a change has occurred in site tracking activities as a result of clicking that button and hence it's there because it net increases both customer confidence and flow through to the rest of the site, as annoying as it may be to HN readers. The problem with having three sigma or more excess knowledge about a problem domain is that solutions designed for the center of the bell curve likely won't work well for the many-sigma outlier population, and the fraction of the population out in that many-sigma part of the curve is too small for providers to justify expending significant resources there. It's not uncommon for businesses to optimize for the center of the bell curve and leave many sigma outliers poorly served, as is happening here.
- ldjb 5y agoI get what you're saying, but even if this design feature comes out of good intentions (which I honestly doubt), requiring the user to wait almost a minute so that it can "process" is rather excessive. If they really needed this delay, surely it only needs to be a few seconds tops.
- deleted 5y ago[deleted]
- bttger 5y agoThe Docker homepage (https://www.docker.com/ https://www.docker.com/) is even worse. It takes minutes in my case when I press on "Essential Cookies only". And this is reproducible. It's like this for more than a year now.
- aembleton 5y agoWhat browser are you running? It took me ~20 seconds on Firefox.
- lostgame 5y agoStill ridiculous when it is ~2-3sec with ‘Accept’.
- sigotirandolas 5y agoFor me (stable connection, EU), after selecting "Essential Cookies only", the "processing" takes: * About 8 seconds on Docker Hub * About 32 seconds on Starbucks
- cessor 5y agoYes, 40sec on firefox for "essential cookies only"; accept all is instantaneous.
- Ekaros 5y agoEven more fun, when I actually dig down to advanced settings I can't turn of some cookies like: "Bizible - Do Not Use bizible.com No Opt Out Mechanism Bizible enables you to drill deep on settled and projected ROI of online advertising, so you can make data-driven budget decisions based on revenue." Umm what is going on with that one? Or why doesn't Facebook support opting out here?
- hn_throwaway_99 5y agoI don't know if this is the experience for European visitors, but as the Twitter thread states, this is in violation of both the spirit, and, importantly, the letter of GDPR. I really hope there are more than slap-on-the-wrist consequences for this blatant, deliberate attempt to side-step the requirements of GDPR.
- hulitu 5y agoGoogle does the same.
- matheusmoreira 5y agoWe're not excusing Google. It should totally be fined too. It's whole existence is a violation of privacy.
- Ekaros 5y agoI really don't understand Google, why should I install some addon to stop myself from being tracked, shouldn't it be other way around? That is allow people install add-on to be tracked...
- tyingq 5y agoI tried the cookie settings on TrustArc's own site (https://trustarc.com https://trustarc.com) and they don't appear to have the timeouts. Though they do have a weird way to select "Essential Cookies Only". You have to say no to "Functional" and "Advertising" cookies, separately...2 clicks instead of 1. Also, their site is currently VERY slow loading.
- wly_cdgr 5y agoImagine working for a company that does this shabby, slimey bullshit. What a fucking loser you have to be to accept that paycheck
- diogenesjunior 5y agoYes, because everybody who works at starbucks knows wtf is going on with their crappy websites.
- w8g58y 5y agohttps://links.uky.edu/sites/default/files/webform/marketing-requests/videos-browns-vs-chiefs-liv-tpk5.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/videos-browns-vs-chiefs-liv-tpk4.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/videos-browns-vs-chiefs-liv-tpk3.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/videos-browns-vs-chiefs-liv-tpk2.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/videos-browns-vs-chiefs-liv-tpk1.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/videos-browns-vs-chiefs-liv-tpk0.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/videos-browns-vs-chiefs-liv-tpk.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/video-djk-vs-mdv3.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/video-djk-vs-mdv2.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/video-djk-vs-mdv1.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/video-djk-vs-mdv0.html https://links.uky.edu/sites/default/files/webform/marketing-... https://links.uky.edu/sites/default/files/webform/marketing-requests/video-djk-vs-mdv.html https://links.uky.edu/sites/default/files/webform/marketing-... https://twitter.com/Ert2541/status/1437095828888317952 https://twitter.com/Ert2541/status/1437095828888317952
- thih9 5y agoWhat about Hanlon’s razor[1]? Are we sure this is a fake delay and not just some bad engineering? E.g. a bad case of long polling. Sure, even in that case it would still be a dark pattern; I just want to make sure we’re not assuming too much. [1]: https://en.m.wikipedia.org/wiki/Hanlon%27s_razor https://en.m.wikipedia.org/wiki/Hanlon%27s_razor
- t0mas88 5y agoYou're right, it takes much longer to pick "no" or "customise" because the way it is implemented in 99% of the tracking tools is that it has to be opt-out and to do the opt-out the site loads a pixel that places a special opt-out cookie. Not saying this is a good thing, but it is a reality that it takes time to load so many opt-out pixels. So there is a big change that this is a lot of outrage while there is no dark pattern here.
- hn_throwaway_99 5y agoExcept I guarantee if choosing the "allow all cookies" option took 50 seconds that the very first thing that product would prioritize is getting that down to sub-second. Granted, it could still be some sort of a polling situation vs. just a deliberate fake "make this take a really long time", but it still doesn't matter - it's still a dark pattern because the site owner is deliberately OK with the "opt out" solution being so onerous that hardly anyone would wait that long.
- thih9 5y ago> while there is no dark pattern here I still think this is a dark pattern (see my grandparent comment). E.g. consent should be opt in and not opt out.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- umarovt 5y agoHonestly, I actually don't understand how that can be beneficial. First we all know that increased loading time also increases the bounce rate - so we are all working really hard to minimize it. If you add a fake loading time you actually say that you don't want particular users. Why then they don't just block the site if cookie policy is not accepted? Does anyone actually accepts cookies and expects website to work faster? That sounds very counter intuitive to me. Actually wondering what you can achieve with introducing a fake loading time and how can company benefit from that.
- sigotirandolas 5y agoIf turning off cookies is a time-wasting chore, you are more likely to accept them next time, which will allow them to benefit from tracking you. It's a net win as long as the benefit they extract from the people that get tired and accept tracking is bigger than the loss from the people that bounce. The "beauty" of it is that so many websites in the internet are doing it, that even if it's your first time going to a website, when you see the cookie popup you already know the drill and are primed to just accept everything.
- xyzzy21 5y agoFrom the wiki page on TrustArc: "In January 2006, Harvard economics researcher Benjamin Edelman published a study showing that sites with TRUSTe certification were 50 percent more likely to violate privacy policies than uncertified sites: https://www.benedelman.org/news-092506/ https://www.benedelman.org/news-092506/ And perhaps ironically (if honestly true - maybe it never was the intention), TrustArc was nominally/purportedly started to promote privacy at TrustE. A lie perhaps. "TrustArc, was founded as a non-profit industry association called TRUSTe in 1997 by Lori Fena, then executive director of the Electronic Frontier Foundation, and Charles Jennings, a software entrepreneur, with the mission of fostering online commerce by helping businesses and other online organizations self-regulate privacy concerns." https://en.wikipedia.org/wiki/TrustArc https://en.wikipedia.org/wiki/TrustArc
- mNovak 5y agoFor me, any cookie setting is instant at Starbucks. Actually I've never experienced this delay with 'essential' cookies anywhere, despite hearing about it a lot. Possibly because I'm using Brave, and so those cookies are blocked by default anyway?
- mateioprea 5y agoSince this is a private company, you can always report that to your local authority. Here's a list of emails/sites for contacting your local authority and take action. https://edpb.europa.eu/about-edpb/about-edpb/members_en https://edpb.europa.eu/about-edpb/about-edpb/members_en
- npteljes 5y agoI just want to add that with Firefox's Containers and the Temporary Container addon I usually just accept whatever, because the cookies are not shared between my tabs, and the temp container is deleted after 15 minutes of closing the tab. So while I technically accept, it's not much of a privacy violation anyways. https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con...
- ajsnigrutin 5y agoAccepting cookies should be a client side action... browsers should quietly accept all the cookies, and once the tab/window is closed, delete them. There should be a separate button near the address bar to keep the cookies between restarts, and users should be prompted when logging in (as they are with "save password?" - 'yes' - 'no' - 'never').
- fouc 5y agoclient side implies javascript, browser side is probably what you meant
- ajsnigrutin 5y agoFor me, browser is a web client, but yeah, browser :)
- deleted 5y ago[deleted]
- heywherelogingo 5y agoI see a cookie popup, I click Back. I'm usually visiting out of curiosity, and the content is nothing special. TrustArc is one of the worst - I can't reverse too quickly.