4 ms·

God, I would HATE if the US follows the EU with this craziness. I'm already sick of the cookie popups, now layer on the GDPR insanity and we will definitely los

God, I would HATE if the US follows the EU with this craziness. I'm already sick of the cookie popups, now layer on the GDPR insanity and we will definitely lose the privacy fight to users who will be sick of this nonsense as well. I've seen studies that show crap like GDPR (which makes basically all normal interaction cumbersome) has like 10% of folks clicking around to "opt-out" while 90% can't be bothered. And of course, you COULD just clear your own cookies. There is no more real security in the EU. Your mental health records will be leaked there. The EU will spy on you like crazy. And more.

arvindamirtaa 5y ago
Is there a point to this...? Or did you just want to crap on GDPR? Not saying it's good or bad. But just...relevance?
cmeacham98 5y ago
GDPR cookie consent banners that make it more difficult to opt out than opt in are illegal, and only continue to exist because the GDPR is poorly and inconsistently enforced.
- thatswrong0 5y ago
  Most of the cookie consent banners I see are illegal in that case..
  - rcMgD2BwE72F 5y ago
    That's right.
  - maccard 5y ago
    And how many have you reported to your local data commissioner?
- throwawayswede 5y ago
  That's the point. GDPR without good enforcement is useless and meaningless. I'd even argue that all this time since GDPR and until something is done about enforcement if ever (that is not just a random fine, which is considered cost of doing business) all that GDPR is doing is allowing these companies to come up with more elaborate ways to scam (I'm looking at whoever the assholes who work, run, or are remotely involved with trustarc.com).
- Reventlov 5y ago
  Cookie consent banners have nothing to do with GDPR, but with the ePrivacy directive. GDPR clarifies what is "consent", but this is not what leaded to the proliferation of cookie banners. Please note if you have strictly necessary cookies, you don't need to have cookie banners, and if your cookies are anonymous, you don't need them either ! The proliferation of cookie banners just means that people running such websites are usually terrible with regards to consent, personally identifiable information, and so on.
  - cmeacham98 5y ago
    Non-essential cookies are personal data as regulated by the GDPR. It is true the EPD started the cookie consent popup craze though.
  - RamblingCTO 5y ago
    Finally, at least one person in this thread who understands that GDPR is not cookie banners. I mean WTF, we're on hacker news. Oh wait, yeah, we're on hacker news.
  - mr_toad 5y ago
    I routinely delete these “strictly necessary” cookies and the world doesn’t end. Worst case scenario is I have to log in again.
- rndgermandude 5y ago
  Correct. The vast majority of such cookie banners you see are illegal according to the GDPR, i.e. whenever you see one that doesn't have equal prominent "Accept"/"Reject" options next to each other. The only reason these illegal banners still get used is a lack of enforcement. Right now, the enforcement process is rather slow, which is in part due to all this stuff being "new" (the cookie ePrivacy is technically from 2009 already, but regulatory bodies with a clear focused mandate to enforce infractions only really came into existence with the GDPR) and thus regulatory bodies and sometimes courts still trying to figure out the legal details, and acting slow and (overly) cautious in order not to embarrass themselves by issuing fines that are later thrown out in a high court. (And then there is Ireland...). And more generally, the law is rather slow regardless; the time it takes to conclude any "important" case is measured in years, and sometimes decades. There are civil organizations such as noyb[1] trying to get things going and "nudge" regulators into action, but even with that it will be a few more years at least until the legal questions around "what is an acceptable cookie banner" are settled. [1] https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
howaboutnope 5y ago
> crap like GDPR (which makes basically all normal interaction cumbersome) Only if you count "tracking users on first visit before they do anything else" as normal. Otherwise, there isn't a banner needed; sites could simply have a link to opt-in to tracking in the header or footer, and not track unless the user opts in. This is like passing a law making it illegal to just hit people in the street, requiring you have to ask them for consent first. So most of the people who want to hit others up come up with some gish gallop that most people fall for, and then hit them. And people bitch about the law, and claim it "makes it necessary for people to chew off the ear of other people they pass by in the streets"... with a straight face, that's what they twist it into, with an air of indignation even... and not just for a few weeks, until they read up and the initial misunderstandings are cleared up, but year in and year out, because they never read up, and the falsehoods you just posted keep getting repeated.
- filleokus 5y ago
  >> crap like GDPR (which makes basically all normal interaction cumbersome) GDPR do make a lot of things cumbersome, not only if you are doing "bad" things. Remember that GDPR covers information gathered and stored on paper as well. And it covers not only companies but also organisations, like children's soccer clubs. So let's say you have a printed list where kids and their parents signup with name and phone numbers, you should probably have a data integrity policy and someone akin to a DPO. In your small non-profit soccer club! (My problem with GDPR is that it doesn't really, at least so far, hinder the worst trackers, but incur large cost all across society, even where handling personal data isn't really a problem)
  - howaboutnope 5y ago
    > GDPR do make a lot of things cumbersome, not only if you are doing "bad" things. That's a far cry from "they make these cookie banners necessary". Tracking people without consent on first visit is what makes them necessary. The anger is consistently misdirected at the people who violate the boundaries of others, not the law that requires consent for it. > So let's say you have a printed list where kids and their parents signup with name and phone numbers, you should probably have a data integrity policy and someone akin to a DPO. In your small non-profit soccer club! "We'll ask them if it's okay to store it, and once they leave the club we delete their contact information after N months." Now you have a policy. The person who does everything else, the person who is already secretary, receptionist, accountant, project manager, janitor, coach, counselor, CEO, is now also the PDO. Human rights being trampled on with an ever increasing mesh of surveillance by big agencies and corporations as well as little informants are such gross violations, such a terrible trajectory we put society on, that mere complication and discomfort is not something that can ever trump them in my book. I would even say if you can't put food on the table without ignoring the human rights of others, just don't put food on the table -- because that's the negotiable part, while the preservation of human rights is not. We need human righs, we don't need ad-hoc low-effort soccer clubs. Like, at all. Just get a ball and some friends in that case.
mmarq 5y ago
The only interactions made cumbersome by GDPR are those with organizations that abuse their users/customers’ data. Otherwise you don’t even need a cookie banner.
- tonypace 5y ago
  So, all of them.
  - Nextgrid 5y ago
    Doesn't mean the law is bad.
  - neon_electro 5y ago
    Given that, is the law bad, or is the default behavior of companies?
arghwhat 5y ago
The cookie popup is something else, and the result of misinterpreted legislation and companies trying to cry foul that they can't do whatever they want anymore. It's not at all needed for common cookie usage - just the unexpected soul-selling kind. GDPR restricts companies from using data however they want, makes you able to obtain a copy, and makes you able to require it deleted. It also required the company to document, provide a person responsible to contact, etc. It only benefits you as a consumer, and the downside in proper uses is that the webpage/app might have a page somewhere with data processing information should you be curious. Nothing major. Any nuisance are poor implementations or because companies can no longer do terrible unexpected things, like selling your data to hundreds of companies just by accessing a page, without permission, because it is nonsense no one would expect or want. And with everyone clicking "no" (which must be at least as easy as clicking "yes" as determined in court), the practice would die eventually.

arvindamirtaa 5y ago

Is there a point to this...? Or did you just want to crap on GDPR? Not saying it's good or bad. But just...relevance?

cmeacham98 5y ago

GDPR cookie consent banners that make it more difficult to opt out than opt in are illegal, and only continue to exist because the GDPR is poorly and inconsistently enforced.

thatswrong0 5y ago
Most of the cookie consent banners I see are illegal in that case..
- rcMgD2BwE72F 5y ago
  That's right.
- maccard 5y ago
  And how many have you reported to your local data commissioner?
throwawayswede 5y ago
That's the point. GDPR without good enforcement is useless and meaningless. I'd even argue that all this time since GDPR and until something is done about enforcement if ever (that is not just a random fine, which is considered cost of doing business) all that GDPR is doing is allowing these companies to come up with more elaborate ways to scam (I'm looking at whoever the assholes who work, run, or are remotely involved with trustarc.com).
Reventlov 5y ago
Cookie consent banners have nothing to do with GDPR, but with the ePrivacy directive. GDPR clarifies what is "consent", but this is not what leaded to the proliferation of cookie banners. Please note if you have strictly necessary cookies, you don't need to have cookie banners, and if your cookies are anonymous, you don't need them either ! The proliferation of cookie banners just means that people running such websites are usually terrible with regards to consent, personally identifiable information, and so on.
- cmeacham98 5y ago
  Non-essential cookies are personal data as regulated by the GDPR. It is true the EPD started the cookie consent popup craze though.
- RamblingCTO 5y ago
  Finally, at least one person in this thread who understands that GDPR is not cookie banners. I mean WTF, we're on hacker news. Oh wait, yeah, we're on hacker news.
- mr_toad 5y ago
  I routinely delete these “strictly necessary” cookies and the world doesn’t end. Worst case scenario is I have to log in again.
rndgermandude 5y ago
Correct. The vast majority of such cookie banners you see are illegal according to the GDPR, i.e. whenever you see one that doesn't have equal prominent "Accept"/"Reject" options next to each other. The only reason these illegal banners still get used is a lack of enforcement. Right now, the enforcement process is rather slow, which is in part due to all this stuff being "new" (the cookie ePrivacy is technically from 2009 already, but regulatory bodies with a clear focused mandate to enforce infractions only really came into existence with the GDPR) and thus regulatory bodies and sometimes courts still trying to figure out the legal details, and acting slow and (overly) cautious in order not to embarrass themselves by issuing fines that are later thrown out in a high court. (And then there is Ireland...). And more generally, the law is rather slow regardless; the time it takes to conclude any "important" case is measured in years, and sometimes decades. There are civil organizations such as noyb[1] trying to get things going and "nudge" regulators into action, but even with that it will be a few more years at least until the legal questions around "what is an acceptable cookie banner" are settled. [1] https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...

howaboutnope 5y ago

> crap like GDPR (which makes basically all normal interaction cumbersome) Only if you count "tracking users on first visit before they do anything else" as normal. Otherwise, there isn't a banner needed; sites could simply have a link to opt-in to tracking in the header or footer, and not track unless the user opts in. This is like passing a law making it illegal to just hit people in the street, requiring you have to ask them for consent first. So most of the people who want to hit others up come up with some gish gallop that most people fall for, and then hit them. And people bitch about the law, and claim it "makes it necessary for people to chew off the ear of other people they pass by in the streets"... with a straight face, that's what they twist it into, with an air of indignation even... and not just for a few weeks, until they read up and the initial misunderstandings are cleared up, but year in and year out, because they never read up, and the falsehoods you just posted keep getting repeated.

filleokus 5y ago
>> crap like GDPR (which makes basically all normal interaction cumbersome) GDPR do make a lot of things cumbersome, not only if you are doing "bad" things. Remember that GDPR covers information gathered and stored on paper as well. And it covers not only companies but also organisations, like children's soccer clubs. So let's say you have a printed list where kids and their parents signup with name and phone numbers, you should probably have a data integrity policy and someone akin to a DPO. In your small non-profit soccer club! (My problem with GDPR is that it doesn't really, at least so far, hinder the worst trackers, but incur large cost all across society, even where handling personal data isn't really a problem)
- howaboutnope 5y ago
  > GDPR do make a lot of things cumbersome, not only if you are doing "bad" things. That's a far cry from "they make these cookie banners necessary". Tracking people without consent on first visit is what makes them necessary. The anger is consistently misdirected at the people who violate the boundaries of others, not the law that requires consent for it. > So let's say you have a printed list where kids and their parents signup with name and phone numbers, you should probably have a data integrity policy and someone akin to a DPO. In your small non-profit soccer club! "We'll ask them if it's okay to store it, and once they leave the club we delete their contact information after N months." Now you have a policy. The person who does everything else, the person who is already secretary, receptionist, accountant, project manager, janitor, coach, counselor, CEO, is now also the PDO. Human rights being trampled on with an ever increasing mesh of surveillance by big agencies and corporations as well as little informants are such gross violations, such a terrible trajectory we put society on, that mere complication and discomfort is not something that can ever trump them in my book. I would even say if you can't put food on the table without ignoring the human rights of others, just don't put food on the table -- because that's the negotiable part, while the preservation of human rights is not. We need human righs, we don't need ad-hoc low-effort soccer clubs. Like, at all. Just get a ball and some friends in that case.

mmarq 5y ago

The only interactions made cumbersome by GDPR are those with organizations that abuse their users/customers’ data. Otherwise you don’t even need a cookie banner.

tonypace 5y ago
So, all of them.
- Nextgrid 5y ago
  Doesn't mean the law is bad.
- neon_electro 5y ago
  Given that, is the law bad, or is the default behavior of companies?

arghwhat 5y ago

The cookie popup is something else, and the result of misinterpreted legislation and companies trying to cry foul that they can't do whatever they want anymore. It's not at all needed for common cookie usage - just the unexpected soul-selling kind. GDPR restricts companies from using data however they want, makes you able to obtain a copy, and makes you able to require it deleted. It also required the company to document, provide a person responsible to contact, etc. It only benefits you as a consumer, and the downside in proper uses is that the webpage/app might have a page somewhere with data processing information should you be curious. Nothing major. Any nuisance are poor implementations or because companies can no longer do terrible unexpected things, like selling your data to hundreds of companies just by accessing a page, without permission, because it is nonsense no one would expect or want. And with everyone clicking "no" (which must be at least as easy as clicking "yes" as determined in court), the practice would die eventually.