5 ms·

IME this isn't unique to Starbucks, every single site that uses TrustArc does this. Thankfully, I haven't had to deal with any of these stupid pop-ups since in

IME this isn't unique to Starbucks, every single site that uses TrustArc does this. Thankfully, I haven't had to deal with any of these stupid pop-ups since installing the 'I don't care about cookies' add-on. [1] Related question: Does anyone have experience using 'Stardust Cookie Cutter'? [2] Is it better than 'I don't care about cookies' or does it do the same thing? [1] https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ [2] https://get.stardust.today/ https://get.stardust.today/

junon 5y ago
Forbes does this, too. It was the first site I noticed it on, years ago at this point. I don't know how it's not illegal.
- tbihl 5y ago
  Please stop doing this. Not everything you don't like needs to be illegal, and taking your business elsewhere has literally never been easier in the history of the world. I don't want to live in a world where the criminalization of everything that ever happened that you didn't like means that I'm always breaking the law.
  - Nextgrid 5y ago
    The problem with spyware is that it stalks you regardless of whether you give “business” to the site or not.
  - A_non_e-moose 5y ago
    How many people not liking murder or theft did it take to make it into a law? How many people not liking gaslighting personal-data-theft dark patterns will it take to make it into a law? We're transitioning from purely physical beings to having a more virtual presence. Virtual crimes are much less visible and have much greater impact at scale than their physical counterparts, identity theft by Equifax breach or a hack, VS physical force or pickpocketing, for example.
    - hcykb 5y ago
      You are equating a website setting a cookie in your device (which you could disable in your browser settings, btw) with theft and murder.
      - scrollaway 5y ago
        "Cookie banners" are a misnomer. GDPR rules apply to all persistent personal identifiers, not just cookies. (And likewise, they do not apply to cookies which are not personal identifiers or are critical for site functionality)
      - csydas 5y ago
        No, they are equation that previously both items were socially acceptable until society demanded change and made both illegal and provided services to enforce such laws. The impact of violating privacy is neither increased nor decreased by the impact of theft and/or murder. If we compare theft and murder, theft «in general» is less impactful than murder, as I'm deprived of property and potentially physically injured with theft, with murder I am deprived of life itself. That murder is generally more impactful doesn't make theft more acceptable/less bad; we should have laws for both.
  - nkingsy 5y ago
    If hn is not the place to discuss web regulation, I don’t know what is. New things pose new and unexpected harms and nuisances. Regulation is the cure. On the flip side, this particular dark pattern was caused by regulation. As usual, shades of gray
    - xondono 5y ago
      > Regulation is the cure Regulation is a possible cure. Call me crazy, but if some place would be weary of going straight up for the “let’s ban things with lawyers ” approach, I would think is HN.
  - junon 5y ago
    You're right, why even have consumer protection laws amirite?
  - Grakel 5y ago
    Normally I would agree with you but if there's anything that we can all agree to ban it's annoying, unnecessary practices like this.
  - sellyme 5y ago
    > I don't want to live in a world where the criminalization of everything that ever happened that you didn't like means that I'm always breaking the law. You'll be fine as long as you're not in the habit of doing things like this that are clearly outwardly hostile to everyone you come into contact with.
- Nextgrid 5y ago
  It is illegal, at least from the point of view of the GDPR which is what these pop ups are supposed to comply with. You could argue that the artificial delay is implemented as a way to dissuade people from declining which would fail the idea that data processing consent should be freely given (you can’t force people to opt-in). You could also argue that even if there was a legitimate technical reason for the delay then it wouldn't be compliant because it would prove that data processing is enabled by default before the user opts-in (otherwise the delay should be on opt-in and opt-out should be instant as it's essentially a no-op). Here are the ICO’s guidelines on the subject - you’ll see that this TrustArc trash fails on multiple points: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... TrustArc essentially provides "breaching the GDPR as a service" and their continued existence proves the incompetence of the data/privacy regulators in all EU countries.
  - junon 5y ago
    Thanks, I figured this was the case.
  - bjelkeman-again 5y ago
    > proves the incompetence of the data/privacy regulators in all EU countries Or maybe it shows that they are underfunded relative to the task set them. Which is actually true of many government departments.
    - dane-pgp 5y ago
      It may also be a sign of how much national governments care about privacy, compared to the EU parliament which voted for the e-Privacy Directive. I suppose the counter-argument would be that passing legislation is cheap, but enforcing it costs money, and governments have other priorities, but, for example, in the UK there can be fines of up to £500,000 for breaches of the e-Privacy Directive[0], which should be more than enough to cover the cost of the investigation. [0] https://www.pinsentmasons.com/out-law/news/gdpr-e-privacy-breaches-factored-into-fines https://www.pinsentmasons.com/out-law/news/gdpr-e-privacy-br...
alickz 5y ago
I've been using PrivacyBadger, made by the EFF. https://privacybadger.org/ https://privacybadger.org/
tyingq 5y ago
>IME this isn't unique to Starbucks Of course, still a good strategy to name/shame a well known party that may care more about their public image than "TrustArc" does.
ajdude 5y ago
My issue with the I don’t care about cookies add-on is that it auto accepts all of the marketing and tracking cookies, doesn’t it? I would love something that auto declines everything.
- smichel17 5y ago
  uMatrix. You can configure it to allow everything else by default if cookies is all you care about. Then, also enable uBlock origin's "annoyances" filter.
- pxeboot 5y ago
  If you add their list to uBlock, my understanding is that it only hides the notices, never accepts anything.
  - Nextgrid 5y ago
    Most of the notices are implemented in such a way that the tracking is enabled by default and clicking "decline" in the notice sets a cookie saying "opt out" to all the trackers (whose effectiveness is probably equivalent to the "evil bit" in IPv4). Blocking the notice (or ignoring it) is technically equivalent to opting in. Of course, if you're using a competent ad blocker it's likely that the trackers themselves were also blocked, making this a non-issue.
    - sluukkonen 5y ago
      Isn’t that kind of implementation blatantly illegal, though?
      - Nextgrid 5y ago
        It is, but: * it's hard/impossible to prove - given how many factors go into ad targeting there isn't a conclusive way to prove whether an ad was targeted because of illicitly-collected data. * as you see here even blatant GDPR breaches and acting in bad faith doesn't actually land you in trouble, so although it's "illegal", the law isn't enforced. Experian (or Equifax) got caught by the ICO knowingly misusing people's credit data for marketing purposes and all they got was a warning, so clearly the message is that "breaching the GDPR does pay".
bmn__ 5y ago
You should not use "I don't care about cookies", it is broken by design and chooses the wrong policy. Instead, use Consent-O-Matic. This kills consent banners but preserves privacy to its best ability. https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
- Shank 5y ago
  You could also block the trackers with uBlock Origin. I use “I don’t care about cookies” because I don’t care about cookies. Not because I care about what settings are being set. I trust uBlock and other privacy protecting settings to actually protect privacy instead of the cookie prompts.
  - bmn__ 5y ago
    uBO + IDCAC is still worse than uBO + Consent-O-Matic. Not the right solution.

junon 5y ago

Forbes does this, too. It was the first site I noticed it on, years ago at this point. I don't know how it's not illegal.

tbihl 5y ago
Please stop doing this. Not everything you don't like needs to be illegal, and taking your business elsewhere has literally never been easier in the history of the world. I don't want to live in a world where the criminalization of everything that ever happened that you didn't like means that I'm always breaking the law.
- Nextgrid 5y ago
  The problem with spyware is that it stalks you regardless of whether you give “business” to the site or not.
- A_non_e-moose 5y ago
  How many people not liking murder or theft did it take to make it into a law? How many people not liking gaslighting personal-data-theft dark patterns will it take to make it into a law? We're transitioning from purely physical beings to having a more virtual presence. Virtual crimes are much less visible and have much greater impact at scale than their physical counterparts, identity theft by Equifax breach or a hack, VS physical force or pickpocketing, for example.
  - hcykb 5y ago
    You are equating a website setting a cookie in your device (which you could disable in your browser settings, btw) with theft and murder.
    - scrollaway 5y ago
      "Cookie banners" are a misnomer. GDPR rules apply to all persistent personal identifiers, not just cookies. (And likewise, they do not apply to cookies which are not personal identifiers or are critical for site functionality)
    - csydas 5y ago
      No, they are equation that previously both items were socially acceptable until society demanded change and made both illegal and provided services to enforce such laws. The impact of violating privacy is neither increased nor decreased by the impact of theft and/or murder. If we compare theft and murder, theft «in general» is less impactful than murder, as I'm deprived of property and potentially physically injured with theft, with murder I am deprived of life itself. That murder is generally more impactful doesn't make theft more acceptable/less bad; we should have laws for both.
- nkingsy 5y ago
  If hn is not the place to discuss web regulation, I don’t know what is. New things pose new and unexpected harms and nuisances. Regulation is the cure. On the flip side, this particular dark pattern was caused by regulation. As usual, shades of gray
  - xondono 5y ago
    > Regulation is the cure Regulation is a possible cure. Call me crazy, but if some place would be weary of going straight up for the “let’s ban things with lawyers ” approach, I would think is HN.
- junon 5y ago
  You're right, why even have consumer protection laws amirite?
- Grakel 5y ago
  Normally I would agree with you but if there's anything that we can all agree to ban it's annoying, unnecessary practices like this.
- sellyme 5y ago
  > I don't want to live in a world where the criminalization of everything that ever happened that you didn't like means that I'm always breaking the law. You'll be fine as long as you're not in the habit of doing things like this that are clearly outwardly hostile to everyone you come into contact with.
Nextgrid 5y ago
It is illegal, at least from the point of view of the GDPR which is what these pop ups are supposed to comply with. You could argue that the artificial delay is implemented as a way to dissuade people from declining which would fail the idea that data processing consent should be freely given (you can’t force people to opt-in). You could also argue that even if there was a legitimate technical reason for the delay then it wouldn't be compliant because it would prove that data processing is enabled by default before the user opts-in (otherwise the delay should be on opt-in and opt-out should be instant as it's essentially a no-op). Here are the ICO’s guidelines on the subject - you’ll see that this TrustArc trash fails on multiple points: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... TrustArc essentially provides "breaching the GDPR as a service" and their continued existence proves the incompetence of the data/privacy regulators in all EU countries.
- junon 5y ago
  Thanks, I figured this was the case.
- bjelkeman-again 5y ago
  > proves the incompetence of the data/privacy regulators in all EU countries Or maybe it shows that they are underfunded relative to the task set them. Which is actually true of many government departments.
  - dane-pgp 5y ago
    It may also be a sign of how much national governments care about privacy, compared to the EU parliament which voted for the e-Privacy Directive. I suppose the counter-argument would be that passing legislation is cheap, but enforcing it costs money, and governments have other priorities, but, for example, in the UK there can be fines of up to £500,000 for breaches of the e-Privacy Directive[0], which should be more than enough to cover the cost of the investigation. [0] https://www.pinsentmasons.com/out-law/news/gdpr-e-privacy-breaches-factored-into-fines https://www.pinsentmasons.com/out-law/news/gdpr-e-privacy-br...

alickz 5y ago

I've been using PrivacyBadger, made by the EFF. https://privacybadger.org/ https://privacybadger.org/

tyingq 5y ago

>IME this isn't unique to Starbucks Of course, still a good strategy to name/shame a well known party that may care more about their public image than "TrustArc" does.

ajdude 5y ago

My issue with the I don’t care about cookies add-on is that it auto accepts all of the marketing and tracking cookies, doesn’t it? I would love something that auto declines everything.

smichel17 5y ago
uMatrix. You can configure it to allow everything else by default if cookies is all you care about. Then, also enable uBlock origin's "annoyances" filter.
pxeboot 5y ago
If you add their list to uBlock, my understanding is that it only hides the notices, never accepts anything.
- Nextgrid 5y ago
  Most of the notices are implemented in such a way that the tracking is enabled by default and clicking "decline" in the notice sets a cookie saying "opt out" to all the trackers (whose effectiveness is probably equivalent to the "evil bit" in IPv4). Blocking the notice (or ignoring it) is technically equivalent to opting in. Of course, if you're using a competent ad blocker it's likely that the trackers themselves were also blocked, making this a non-issue.
  - sluukkonen 5y ago
    Isn’t that kind of implementation blatantly illegal, though?
    - Nextgrid 5y ago
      It is, but: * it's hard/impossible to prove - given how many factors go into ad targeting there isn't a conclusive way to prove whether an ad was targeted because of illicitly-collected data. * as you see here even blatant GDPR breaches and acting in bad faith doesn't actually land you in trouble, so although it's "illegal", the law isn't enforced. Experian (or Equifax) got caught by the ICO knowingly misusing people's credit data for marketing purposes and all they got was a warning, so clearly the message is that "breaching the GDPR does pay".

bmn__ 5y ago

You should not use "I don't care about cookies", it is broken by design and chooses the wrong policy. Instead, use Consent-O-Matic. This kills consent banners but preserves privacy to its best ability. https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic

Shank 5y ago
You could also block the trackers with uBlock Origin. I use “I don’t care about cookies” because I don’t care about cookies. Not because I care about what settings are being set. I trust uBlock and other privacy protecting settings to actually protect privacy instead of the cookie prompts.
- bmn__ 5y ago
  uBO + IDCAC is still worse than uBO + Consent-O-Matic. Not the right solution.