25 ms·

Ask HN: Why have we accepted the cookie pop-up situation across the web?

445 points by LightG 5y ago

You know what I'm talking about. Even at their best, the pop-ups for every single website to accept or choose cookies is ridicuous. Can you imagine how much time in total we all lose to this? And yet, these "solutions" to the data privacy questions have become widespread. It's bad enough at normal times, let alone those who double triple quadruple bluff you into choosing the wrong setting. This is a tech board. Why have we all accepted this ridiculous situation? Isn't there a better solution?

zeristor 5y ago
Yes, changing the colours so green means no, dark patterns within dark patterns. Perhaps a plug-in to go via archive.is, but that’s a slippery slope and really people would need to contribute to archive.is to keep it alive.
southerntofu 5y ago
I haven't accepted it. Out of all the websites i've designed over the years, exactly 0 have cookies for visitors. When there is login for members, then there is a cookie which is not used for tracking (but rather for providing the service the member asked for) and therefore legally does not require a consent banner.
- Hnrobert42 5y ago
  Would that I could give you more than an upvote. Are these your personal or business sites, or for employers and clients? If the latter, how do you combat the hunger for analytics that drive non-users into users?
  - southerntofu 5y ago
    It's not all personal, but it's all unrelated to business. As an anarchist, I refuse to work on projects i find unethical, which includes any form of profit-driven project. Sorry i can't give you pointers on how to hack around capitalism, my only solution is pure abolition :-) I should note that i'm also not a professional hacker. Programming/sysadmin is more of a passion than a trade to me, and i'm just a lowly amateur unworthy of much praise. But to be fair, there's amazing non-profits and worker cooperatives building cool software (Framasoft comes to mind). If only more fellow hackers stopped working for evil bosses and started to work for public interest...
    - monodot 5y ago
      How does one find out more about this scene, and more importantly does it actually provide you with enough income to live on? (Rent is expensive in cities)
      - southerntofu 5y ago
        There's not exactly a centralized directory of cool tech coops, but there's a few places that list some or where they hang out. [1] There's also a fair bunch of coop orientation in the XMPP/ActivityPub ecosystems. Some projects are driven by direct donations, some others via grants (all NLNet-supported projects) and business partnerships (Blender foundation), some provide paid services to fund R&D (SourceHut). Overall, it's technically possible to derive a decent income from such schemes, but that's not exactly widespread. Many dedicated hackers will work for minimum wage or less, but some will arrange either: - to reduce their expenses, by moving to cheaper places [2] or living in shared flats or communities; if you're organized as a collective even food and furniture can have close-to-zero cost [3] - or to have a high-wage part-time job on the side, or support contracts to pay the bills; if you get half-time to work on your pet projects, that's already quite an achievement Overall, building a cooperative economy asks the question of where does the money go? The more autonomy we can achieve, and the more money we can "recycle" into other cooperatives, the less of our resources leak into the pockets of the 1%. So yes, if you make a really cool project people appreciate and/or can depend on for their business, you can sure make a living out of it: just be sure to use copyleft licenses (eg. aGPLv3) so you're not scammed out of your work by big businesses. But personally, i'm more interested in non-profits driving R&D with a vision (like Framasoft does with the Degooglize Internet campaign and eg. Peertube/Mobilizon project). [1] for example libreho.st, chatons.org (french-speaking) for hosting coops [2] for example in France, if you don't insist on living in the big cities, you can find places to rent for close to free once you subtract housing support from the rent ; i guess the same is true in many places [3] skipping unsold food from (super)markets or growing food in the backyard; we could also mention utility hacking for free electricity/water but i can't say most devs i know do that
        monodot 5y ago
- nicbou 5y ago
  I use Plausible, which gives me enough useful information to run my website, but doesn't collect any more than needed. It's a lot less useful than Google Analytics, but it's a big privacy and UX improvement for my readers. My personal website has no tracking at all.
Sephr 5y ago
There is a solution which balances site owners' need to track with a respectful consent UX (e.g. no immediate consent prompt): https://transcend.io/blog/defeating-cookie-banners https://transcend.io/blog/defeating-cookie-banners Many sites prompt right away because they want to begin tracking right away. Transcend Consent transparently converts all unconsented web tracker emissions into local tracking, which can be replayed later with consent. Instead of prompting for consent on first visit, these prompts could be integrated into the sign up or checkout flow in a website.
cblconfederate 5y ago
people like to think they are "doing something" even if it clearly does nothing. Kind of a collective guilt complex The solution is to use they "i don't care about cookies" chrome extension
- xxs 5y ago
  That's not it at all - the banners are not required unless they intend to track you - stuff like sessions data or theme selection does not pertain to the 'cookie law', itself. The way most popup exist does not constitute an affirmative choice, which makes their existence & purpose misleading on purpose.
pawelmurias 5y ago
The solution is to stop voting corrupt idiots into the EU parliament.
- mritzmann 5y ago
  No, the solution is: Don't save unnecessary data about your visitors. Then you don't need any Cookie banner.
- deleted 5y ago
  [deleted]
- dane-pgp 5y ago
  The EU directive actually requires that opting out of cookies be as simple as opting in, which hardly any of these pop-up systems allow. Unfortunately, because of the limited power of the EU, it is up to members states to actually enforce these rules. So the corrupt idiots you should stop voting for are members of your own national assembly.
- rlpb 5y ago
  The problem is not the EU directive; it's the lack of enforcement. See https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner...
  - nuthacker 5y ago
    I have a user agent that don't accept cookies. So I do not care what the sites tries to give me, they just go to /dev/null. Why oh why do I need to see those stupid banners then?
- southerntofu 5y ago
  If you follow EU politics closely, you'll notice the corrupt idiots are mostly (though not exclusively) in national politics and in the European Commission (which is nominated by member States, not elected). The European Parliament is by far the most progressive and humane legal institution we have across Europe, if only any government cared to apply the laws they pass. We have this pattern in Western Europe (eg. France/Germany) where everything is blamed on the EU when in fact the most malicious legal interpretations come from national politics. Example: EU regulations state network service operators MAY keep logs for a maximum of one year, FR regulations claim they MUST for minimum two years.
fouc 5y ago
There is too much to gain from tracking website visitors. Most companies that run websites would rather subject visitors to the pop-up in order to satisfy the law, than to remove tracking.
- swiftcoder 5y ago
  The blame is at least partly on the economic models of the modern web. Tracking increases the payout of ads, ads are the main source of revenue... cookie popups allow this all to continue. Without a fundamental reshaping of the web economy, this isn't likely to change.
  - ReleaseCandidat 5y ago
    > Without a fundamental reshaping of the web economy That's actually quite easy: leave any webpage with cookie banners as fast as possible. Or at least disable everything.
    - necovek 5y ago
      That's exactly what makes it hard: you need everybody to do the same (ok, a majority, but that's not as dramatic :)).
      - ReleaseCandidat 5y ago
        Of course that's true too :) The problem is that most people blame 'the EU'.
- tunap 5y ago
  To add to that, the world's economy depends on capital growth, at any cost(pun intended). Considering the blow to GDP if those trillions disappeared, the governments & policy makers would never let that happen.
y4mi 5y ago
Well, it's basically malicious compliance. They're supposed to be super annoying because the people which need them do things which have been deemed unacceptable from the legislature. Instead of complying, they choose this obnoxious practice so they could continue with what they've been doing for years, which is monitoring every action a visitor does. You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking. A session cookie, selected theme etc is all fine without that banner
- jameslk 5y ago
  Not malice, just lazy ass covering. It's easier to throw up a cookie banner and not get fined rather than reading laws and changing business practices instead and potentially get fined. Also lawyers are expensive and many of them will just tell you to add a cookie banner to your site. They're also lazy and just trying to cover their asses too.
- _Microft 5y ago
  This is the correct answer. Nobody needs to ask for cookies that are required for providing the service. They choose to annoy people.
  - dageshi 5y ago
    Nobody is thinking about it that hard. Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side because throwing a plugin on that adds it is about a 2 minute job and actually figuring out if they need it requires a lot more work. Path of least resistance wins.
    - rendall 5y ago
      > Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side... That's a pretty bold claim, even steel-manning it. I personally only ever see it on sketchy sites. If you're right, then it would just take a campaign of education to halve the annoyingness rate of the internet.
triska 5y ago
I have not accepted it: I immediately close the tab almost every time I see the first pop-up on a website. For example, I no longer use Stackoverflow since they started showing these pop-ups, ostensibly to force me to accept what I regard as an invasion of privacy. When reading a web page, I would like to be able to concentrate on the content without any distractions, and my feeling is that a site that shows pop-ups does not respect this sufficiently. As to solutions: Wherever I can, I support all measures that let a website get rid of any existing pop-ups, for example by advocating for less tracking and more respect for users' privacy and ability to quickly obtain the information they want.
- unbanned 5y ago
  How do you get any work done?
  - marginalia_nu 5y ago
    I've never used SO. Why are people so reliant on it?
    - xxs 5y ago
      SO is useful for entry level work mostly - topic that I'd be barely familiar with. At some point SO was so prevalent even w/o a search bubble that I had to exclude it from my searches...
    - pi7h3n 5y ago
      Curious what kind of work you do?
      - marginalia_nu 5y ago
        Java development, mostly. I've also built this search engine from scratch: https://search.marginalia.nu/ https://search.marginalia.nu/ , not once did I consult SO.
    - necovek 5y ago
ReleaseCandidat 5y ago
I like them. They are a sure signal which websites to avoid. Same as 'allow notification' banners. Although, to be honest, some (smaller) sites do it just because 'everybody does that' and they think they have to to comply to the law.
- nuthacker 5y ago
  I hate them. But yes, whenever I see a banner, I close the browser tab. And that happens to more and more sites, which tell me: more and more sites are crap. I'm better off living without them.
- hdjjhhvvhga 5y ago
  > I like them. They are a sure signal which websites to avoid. Same as 'allow notification' banners. Agreed. I learned to ignore banners, but when I see a modal forcing me to do an action before proceeding, I can be 100% sure they're up to something slimy. So most of the time I just give up, I don't care that much about your website to lose my precious time clicking on stupid buttons.
- simonjgreen 5y ago
  It's a checklist item in marketing agencies
- SomeBoolshit 5y ago
  It hasn't made me stop visiting any sites because the banners are almost omnipresent, but I've started using incognito mode way more, so I can blindly accept whatever the site wants me to.
  - netmare 5y ago
    A clickbaitey site I visited recently detected incognito mode and would not let me in. I don't remember if it had a simple overlay or missing content, since I immediately went away.
  - thih9 5y ago
    An ad provider might connect your incognito session with your regular session. Especially if you blindly click “accept”, since then you might agree to being tracked across sessions and devices.
j_san 5y ago
Well non-profits like NOYB are starting to create automatic systems to send GDPR complaints to non-compliant websites. "Blame it on the GDPR? Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR." See: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
mrtksn 5y ago
Theoretically, you should have UX advantage by not showing annoying cookie pop-ups. The catch is, you are not allowed to share their data with 3rd parties, therefore if you like to have no cookie pop-up's you should respect your visitors privacy. These cookie warnings are not compulsory or anything like that, what is compulsory is to inform the user and let them choose what information you are going to share with others about them. My only guess is, those who operate the websites value the returns from data sharing more than the returns of a good user experience. They even engineer those pop-ups to be as annoying as possible to opt-out so that the users compel to share their data.
codeflo 5y ago
Laws that require software companies to implement a user choice should really contain some wording against dark patterns. EU lawmakers could have been warned: A similar thing happened back when Microsoft was forced to give users in the EU a choice of browsers, when they created the most confusing dialog possible and hoped that users would just click OK to Internet Explorer out of desperation. For me personally, when those data protection laws where implemented, seeing the extent of the market for user tracking was a shock to me. The respect that I lost for actually quite a lot of companies as a consequence has informed some purchasing decisions. And I don’t think anybody would mind those banners if the opt-out option you want to click is reachable with a single, easily visible button. Edit: Responses suggest that the GDPR already contains something to that effect. Glad to know. If that’s true, then I guess it’s time for court cases to sort this out.
- kuschku 5y ago
  > Laws that require software companies to implement a user choice should really contain some wording against dark patterns They do. GDPR explicitly requires - that denying is easier than accept - that all choices are denied by default - that there has to be a single "no" button, but individual "yes" buttons for every single choice Just everyone breaks the law.
  - MinorTom 5y ago
    > - that denying is easier than accept > - that there has to be a single "no" button, but individual "yes" buttons for every single choice GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners. > but individual "yes" buttons for every single choice This is misleading at best - there can be an "Accept All" Button.
    - kuschku 5y ago
      You wrote: > GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners. No. https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/ says: > When the processing has multiple purposes, consent should be given for all of them You wrote: > This is misleading at best - there can be an "Accept All" Button. No. https://gdpr-info.eu/recitals/no-32/ https://gdpr-info.eu/recitals/no-32/ says: > Silence, pre-ticked boxes or inactivity should not therefore constitute consent. The legal text of the GDPR explicitly bans pre-ticked boxes for types of consent. You have to manually tick each box individually.
timdaub 5y ago
I also don't know why we have accepted them. I would have wished that browser vendors made these dialogues a part of the web specification so that the UX/UI is at least streamlined.
rlpb 5y ago
It's important to understand that while people might think that the pop-ups are required by the law, this is not true and most pop-ups today have no legal effect regardless of what you click. The GDPR requires express consent. If the pop-up uses a dark pattern to make "refusing consent" difficult, then clicking on whatever it takes to make the pop-up go away isn't consent. And just setting a cookie doesn't necessarily need consent either, if it's used directly to provide the service (eg. a cookie to track your login session or your shopping basket). A change requires the authorities to actually start enforcing this. https://noyb.eu https://noyb.eu is campaigning for this.
- littlecranky67 5y ago
  I wish this "wilful consent" was more often challenged in court as it has become ubiquitous in todays IT landscape. The most offending example outside of the web is WhatsApp in the EU: They show me a "We need your consent for our new privacy policy" banner every day, with only two options: Accept, and the "x" in the corner, which basically is a "nag me again tomorrow" button. There is no "deny" option. I would seriously think that any nudging/nagging dialogs like this should not be considered wilful consent.
  - MinorTom 5y ago
    That isn't consent under Art. 5 (1) Sentence 1 a GDPR, only acknowledgement of a new Privacy Policy. There needn't be an option to deny it.
pembrook 5y ago
There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it. Trying to regulate the option for cookie preferences at the individual site level was always a stupid idea. The average person visits thousands of websites every year. Of course nobody is going to take the time to do that. If the lawmakers in the EU were intelligent, they would have created a law that forced all web browsers to provide "X" privacy setting features for EU-domiciled users (where X is what they were aiming to achieve). In addition to not burdening the entire world with time wasting popups all day, this option would have also had the bonus of not burdening millions of small businesses around the globe with complex regulation and legal liability. Not to mention the total lack of enforceability of the current law when it comes to websites operated outside of the EU. If done at the browser-level you really only have to police <10 companies.
- Hnrobert42 5y ago
  Haha. Exactly. I just commented above that the better way to have written the regulation was to say, “Thou shalt honor Do Not Track.”
- hawk_ 5y ago
  > If the lawmakers in the EU were intelligent If bureaucrats helping create these laws were less out of touch. I think they are reasonably intelligent, they just don't know anything about technology. The criteria for selecting them is outdated.
  - peoplefromibiza 5y ago
    Honestly this legend needs to die. I've worked as a consultant for the EU Parliament and they are a lot more knowledgeable than you think and for things they are not, they hire consultants (like me) There are a number of people directly elected in EU Parliament that have a background in technology, I personally know a couple or computer scientists, with lots of publications in their curricula. Problem is the law cannot be written the way you are arguing about, that could be in the form of a directive not as a regulation[1], the regulation must be general enough and cannot address issues that have different legal bindings in the 24 EU countries. [1] A "Regulation" is defined as a binding legislative act. It is immediately applicable in its entirety in all Member States and it overrules national laws. A "Directive" is a legislative act setting objectives that all EU countries must reach and translate into their national legislation within a defined time frame.
jeroenhd 5y ago
Have we accepted the popups? The tracking agencies have clearly set the goal to make the user experience as bad as possible if you want to deny the prompts. As far as I'm concerned, we should just blanket ban these trackers all together. The industry has been given the chance to play nicely and to care about the people they're collecting data from, and they chose war on consent. Fuck it, make the DNT header a legally binding way to deny consent. I consider every company with these invasive popups to be antisocial. Not enough people care enough for the practice to disappear, but I definitely don't just accept it. I accept the simple prompts that go yes/no/specify, with the yes and no equally easy to use, but that's the best you'll get from me. Any website claiming that trackers have "legitimate interest" is made by absolute assholes.
arjunbajaj 5y ago
There's a great Safari extension for this called Hush[1]. After installing this, I rarely see any cookie popups. [1] https://oblador.github.io/hush/ https://oblador.github.io/hush/
- Kelamir 5y ago
  And this https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ for a number of other platforms like Firefox and Chrome, and it's recommended by Firefox.
- littlecranky67 5y ago
  uBlock Origin will take care of blocking tracking popups/banners for you if you enable the "EasyList cookie" filterlist in the settings. It is not activated by default.
  - execat 5y ago
    My life became so much better when I activated EasyList. Makes me wonder why is it not activated by default.
bambax 5y ago
uBlock Origin blocks cookie pop-up modals, and also prevents most tracking so even if you accept something you shouldn't, it won't have any effect (or so I believe -- I have not actually tested this myself). Anyway it's not perfect, but it's good enough for my needs.
SomeBoolshit 5y ago
"We" in the EU haven't, really. Lawsuits are taking place regarding how the dialogs are designed but they take forever to go anywhere.
zaptheimpaler 5y ago
The solution is to click "deny" and stop visiting those websites. Another solution is to attempt to reform governments to pass laws much faster and amend them quickly when workarounds like this come up. It took 4-5 years for this law to go from being first proposed to passed, and about 1 week for every website to throw up the banner. Another is to directly pay for the services that these websites currently use ads to fund. All solutions require significant effort or sacrifice on our part, so they probably won't happen.
th3iedkid 5y ago
Has to be a browser preference and not a site preference.
mrich 5y ago
Are there any good browser extensions for dealing with these banners? (auto clicking or blocking?) On a side note, recently I built a website and did not need cookies at all (even though you can buy stuff, but there's not shopping cart)
- JimWestergren 5y ago
  uBlock Origin but default off. You need to enable it using: Filter lists -> Annoyances -> EasyList Cookie
  - mrich 5y ago
    Great, thank you!
nicopappl 5y ago
I use the "I don't care about cookies" browser extension with "Cookie AutoDelete". Cookies are managed client-side, those banners are redundant. The purpose of open standards is that you can have a user-agent that does whatever you want it to do, so take advantage of that. Cookie banners are the dictionary definition of a meme. They give the site makers a piece of mind, helping them sleep better at night, even if they may have no other practical purpose. Other site makers see them and reproduce them because it gives them the same piece of mind, exposing the banners to more site makers. Obviously, there are better ways to get a piece of mind as webmaster, but you'd need first to explain the problem to a lot of people before anything changes.
- fooyc 5y ago
  Cookies are not the only way to tack you. Websites can track you with localStorage, ETag headers and other cache-based methods, etc. Some methods don’t event require any persistence on the client side, e.g. fingerprinting.
  - contravariant 5y ago
    Cookie Autodelete also takes care of things like local storage and various caches. There's not much you can do about fingerprinting though. You can try to limit it in firefox with the resist-fingerprinting option, but that has its limits.
    - DavideNL 5y ago
      And besides all that, most people use the same public IP address anyway…
- marcofatica 5y ago
  peace of mind, not a piece of mind
taf2 5y ago
I agree, if anything we should have one accept banner when you open a web browser. I'd prefer to have a single prompt for all websites read something like: "You are about to browser the internet. The internet can track you, just like a native application but transparently such that you can inspect and see who and how it is done easily using built in tools to the web browser. Click accept to keep it this way? Otherwise, expect vendors find harder to understand and detect methods." [Proceed to the Internet, Stay home Instead]
dash2 5y ago
Here's how it works: 1. Privacy advocates are worked up about cookies. 2. Lawmakers decide to do something, it'll look good. 3. Web depends on ads, so they find workarounds. 4. Everyone suffers. 5. Return to step 1. <-- You are here.
c0nfused 5y ago
I have just given up and disabled JavaScript on mobile. It has made browsing the mobile web much less awful even if I occasionally run into a site that doesn't work with js. It's reasonably trivial to enable on a per site basis if you need it. Most sites are semi broken, but at least you can read them. Most search engines are hilariously broken though which is sort of a bonus. Bing can't search from the input in the page. Google infinite redirects.
wffurr 5y ago
What do you mean by “we” have “accepted” any such situation? Most of the people working on sites with those banners aren’t here on this board. Even if they were, what do you want them to do? Refuse to work? Quit on principle? It’s not like we’re talking about unsafe bridges that are going to kill people. Users? Plenty of users are annoyed by these things but obviously not enough to dent traffic numbers or encourage the rise of alternatives. Plenty of technical hacks throughout the comments here if you’re looking for a solution for yourself, but nothing scalable is really possible. Regulatory agencies? They take a very long time to work and can only go after so many websites at a time. As others have mentioned, lawsuits are happening but it will take time for it to work through the courts and agencies and even more time beyond that to propagate through industry as “doing this will can get your company sued” for those companies that even care about such things.
- hvdijk 5y ago
  > Even if they were, what do you want them to do? Refuse to work? Yes, if an employer asks an employee to help violate any law, the employee has the legal right to refuse to do so. (I'm sure there'll be some country where that's not true, but generally...) The responsible thing to do there would be to work with the employer to come up with a different design that does not have the same issues. If the employer explicitly insists on an illegal design, be sure to save proof that you informed the employer that it's illegal. Beyond that, it's tough and not everyone will be up for continuing the fight, and I don't blame the employees if they don't. A decent employer, however, of which there are many, will be okay with a legal alternative.
claviska 5y ago
The worst part is, after all this time, most users are desensitized by all the banners and ads that pop up so they click whatever button they can to get rid of it. I’m guilty of it myself. This isn’t the privacy solution we needed. It hasn’t changed the way users are tracked — it’s only annoyed people. The law needs to be reshaped to punish abusive companies, not users.
- beej71 5y ago
  California has a warning for cancer-causing chemicals and sites. It's called the Prop 65 Warning. And it's _everywhere_. Turns out there are qualifying cancer-causing agents around every corner. Including gas stations, and no one doesn't go to the gas station because of the posted Prop 65 Warning. So everyone ignores it. It has no effect for all the trouble they took to implement it.
notorandit 5y ago
Accepted? Do you have a choice to opt-out?
js4ever 5y ago
I have not accepted the situation and there is zero cookies popups on any of my sites / apps (some of them are huge businesses in EU). Guess what, no legal issues at all :)
sto_hristo 5y ago
Of course not. But the popup situation is a mere aftereffect from the base cause - abuse of user's private data. It is there that all anger and frustration should be directed at.
kordlessagain 5y ago
> Why have we all accepted this ridiculous situation? Because we have JavaScript turned on by default?
cursedclock 5y ago
Not really related to the question but I find it amusing that we have cookie popup blockers similar to ad blockers now.
snovv_crash 5y ago
The funny thing is, the tracking cookies aren't even necessary. There is plenty of data in things like canvas, fonts, GPU capabilities, IP address etc which are perfectly capable of de-anonymising anybody on the web, and the storage for the tracking could be done entirely server side. Cookies are just used for this because devs are lazy.
- p_l 5y ago
  Well, GDPR superseded the cookie banner thing and the banners are now trying to gain dubious "consent" about being tracked in all kind of ways, since GDPR is trying to make PII into "radioactive waste" in a way - i.e. the plan is that the best way to avoid dealing with GDPR is to minimize contact (and thus gathering of) with PII.
beebeepka 5y ago
Ha! I think the real question is whether LightG is on advertiser's payroll, or just really ignorant. I am betting on evil
buzzwords 5y ago
I think the cookies acceptance should be done by browser settings.
orblivion 5y ago
Wait why doesn't logged-out YouTube have a cookie consent popup?
- seszett 5y ago
  It does, a very long one that gives an easy option to accept everything, but a complicated dialogue for rejecting things.
usrbinbash 5y ago
What's much worse: These popups have basically trained the average user to simply click the biggest, most colorful button with "OK" | "Accept All" on it, whenever something suddenly pops up on a website. This is what happens when politicians, completely divorced from technical realities design "solutions" to something...
thih9 5y ago
I guess this is because most people never clear their cookies and visit mostly the same sites, so they see these popups infrequently enough.
ttttity 5y ago
In Norway it's super strict. We have a very non-intrusive popup on our site https://tvangssalgbolig.com/ https://tvangssalgbolig.com/
JeremyNT 5y ago
I love the banners! Sites don't need them for basic functionality, so when you see one you know that you're at a site out to sell your data and violate your privacy. I feel like I can immediately tell how shady a site is by how annoying and passive aggressive their cookie banners are.
- rendall 5y ago
  I am bitterly disappointed by Atlas Obscura in that respect. I really liked them before their GDPR malicious compliance dark pattern revealed themselves to be sketchy. https://news.ycombinator.com/item?id=29348637 https://news.ycombinator.com/item?id=29348637
- nulbyte 5y ago
  You can't, really. Analytics, and the type of compliance that comes with it, may be the responsibility of site operators, but it is usually never in the operators' wheelhouse. So instead of tailoring a solution for their specific sites, operators outsource this to an industry leader. The banners tell you little about the site operators, and a lot about the adjacent industry.
- vimy 5y ago
  But 99 % of websites use cookie banners, even when it’s unnecessary, so it doesn’t really tell you anything.
- YetAnotherNick 5y ago
  What do you generally do when you get faced by a popup and the site has the content you need? If you just click yes, then it would have been better if EU just regulated privacy policy to be more readable. It would be easier for sites and better for users who don't care about privacy, and in some ways better for users like you who care about privacy.
gerash 5y ago
There must be a better solution. Basically the legislative body needs to be more nimble and adjust a law based on its real world effects. If you think these pop ups "solve" user privacy in any way, let me suggest you another wonderful measure to "solve" climate change: all light switches will need to have a tiny touchscreen display next to them and if their energy source is not 100% renewable then you'll need to tap through a bunch of warning popups to agree to the terms. Each light switch manufacturer can also design this however they see fit. That will totally solve climate change, right? Based on some comments here I'm sure some would love it and would wear headlamps to places and won't turn on the lights that have those tiny touch screens.
AmosLightnin 5y ago
Why don't we make browser plugins that automagically click through the popups and reject as many cookies as possible? It seems like this could be crowdsourced such that when the plugin doesn't already know the site, it asks the user to manually go through the process of rejecting as many cookies as possible, and then submits those actions to a database such that future visitors don't need to go through all the clicks.
- ketzu 5y ago
  consent-o-matic is an attepmt at this i believe.
  - AmosLightnin 5y ago
    Awesome! Made in my own university and I never even heard of it. Thanks for the tip!
  - bizzleDawg 5y ago
    Link: https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
- penjelly 5y ago
  there are extensions that click through already though im pretty sure they "accept" because if you dont accept cookies sites will limit their functionality... try - i don't care about cookies and - cookie auto delete pair those and no more popups but your cookies arent preserved. I havent thought about the implications of this yet so if you have any detractions lemme know
noxer 5y ago
>Why have we all accepted this ridiculous situation? Because we use blockers? I hope yall do. >Isn't there a better solution? You decide what cookies you want to store. No one needs to aks you and you dont need to comply with any nonsense someone puts up and "forces" you to read.
nuthacker 5y ago
I have not accepted them. Thank you advertisers and legislators for destroying the web! People seem to just click accept on those banners. And. it. sucks! It's alienating me from the web, and I avoid it more and more. Sucks that our society relies on it so much, so one is effectively forced to use it. I will use email, IRC, and Emacs for coding, as much as I can. The rest sucks. Sucks to be me. Thanks for asking.
tomcooks 5y ago
The call for help for "isn't there a better solution" and "this is a tech board" make me want to say what follows, hoping it doesn't sound too nasty: Vote, that's the best solution when it comes to stuff that affects everyone around you.
aristofun 5y ago
Because some people at some point just didn’t have balls to put stupid people (it’s not a world of geeks anymore) in place, while others didn’t care. Same pattern is happening everywhere and has been happening since the beginning of times.
enz 5y ago
> Why have we accepted the cookie pop-up situation across the web? I've never accepted that. When I stumble upon a website harassing me with obnoxious cookie (or whatever) pop-ups right away, I just feel overwhelmed and oppressed, and then I hit the 'Back' button in a second without even thinking about it because it seems so natural to react like that. (Just imagine the same situation IRL: you enter in a shop and suddenly someone rushes at you to get you to sign some papers: naturally, you'd leave the place without thinking about it.)
alkonaut 5y ago
This should be temporary. The popups are basically just dark patterns. Once there has been a few fines for sites using dark patterns, it will hopefully be better. These fines though have to be making a proper example, using all the available opportunity to impose penalties. We need to see a few proper company-ending fines dealt before it gets better. If a couple of massive sites are wiped off the face of the internet for using a generic pre-packaged cookie wall, that should (hopefully!) scare everyone into compliance. Cookie questions should be unobtrusive and single click to be without tracking, never limit the service provided (no “we need to show tracking ads to pay the bills”).
voidfunc 5y ago
see: GDPR, law of unintended consequences.
TheBigSalad 5y ago
My company has these banners even though we don't share information with 3rd parties. We are too scared of lawsuits based on the vague language of the law. Seems silly to me, but it's above my pay grade.
deleted 5y ago
[deleted]
biz90 5y ago
would someone be able to explain what are cookies? and how they work? -Bz
biz90 5y ago
can someone explain what are cookies and how they are useful in a wed svr?
acqbu 5y ago
https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- JimWestergren 5y ago
  I prefer uBlock Origin that I am anyway using and not having another extension for this. But you need to enable it using: Filter lists -> Annoyances -> EasyList Cookie
luxuryballs 5y ago
I agree, I always thought that simply using a web browser should be considered consent to accept cookies since it’s part of how they work.
conductr 5y ago
Is there really any enforcement taking place? What happens if sites just refuse to implement the cookie banner/question and go on with business as usual? I’m more interested in the 99% of websites that are relatively low volume. It just simply wouldn’t be a regulatory priority for me if I was launching a new site, yet I see newly launched sites/MVPs/etc that already have the banners implemented.
- TheCoelacanth 5y ago
  There is enforcement going on, but they don't have enough resources to go after every single violation. They are focusing on the biggest violators and the most flagrant violators. Right now, most companies can get away with giving lip service to following the law, but not really following it, e.g. having a cookie banner but one that doesn't really comply with the law. You probably can't get away with openly refusing to follow the law.
SergeAx 5y ago
Do we need cookies at all in a modern web browsers with LocalStorage and SessionStorage? I beleive it is time to selectively turn on cookies on relevant websites, like we do with camera, geolocation and notification access in browser. Whitelist, problem solved.
mikewarot 5y ago
It's just like clicking "Accept" when installing something, a fact of life we're all stuck with. We all realize that this is the law in Europe, and the pop-ups are consistent enough that its safe to just accept the cookies. If enough people (not in the EU) break this pattern in a bad way, the shit will fly. You could do something like that, but reputation points will be lost in the process.
GekkePrutser 5y ago
It should have been mandatory to obey the do not track flag.. Then that flag would have made actual sense and the cookie popups could have been done away with. Just one setting in the browser itself. I think it's legislators that messed this one up.
MarkMc 5y ago
Isn't this the fault of EU regulators? GDPR says that a website cannot degrade the service for users who decline to be tracked, yet almost all these popups make it harder to reject cookies than to accept.
Ajnasz 5y ago
Usually I don't accept cookies. Sometimes it's not that hard, but sometimes you would need to click through like hundreds(!) of checkboxes, so you don't want the cookie from them, which is ridiculous. I would accept only one cookie, that I don't want to accept any other cookie, but surprisingly usually they don't store this information. :(
sproketboy 5y ago
I blame the stupid EU.
immnn 5y ago
This question really bothers me as well. I remember the time when designers came in and taught developers not to use pop ups, because pop up annoy and scare users. I prefer browsing the web using uBlock Origin just to get rid of all the bloat. However there are several sites that are not compatible. And I’m pretty much directly closing the browser tab. I wonder, whether it’s just me staying away from sites that annoy me to hell, because all the sites still use such pop ups. Following I wonder, whether site maintainers use all the analytics crap tools anyway. I mean, all the pop ups must have some sort of impact? Honest question: are there any site maintainers analyzing there logs and might answer my questions?
Trias11 5y ago
That's what happens when we glorify the legal system and let lawyers inflict the nonsense upon people. This absolutely has no useful utility and causes moderate harm on everyone.
notinty 5y ago
I actually like a lot of them, and they've improved a ton since the start in general. I'm fine with measuring performance, and sometimes tailoring content, but prefer to opt-out of ad targeting and offline matching. Most all of them are missing proper opt-outs that really should be there, however it's a good start. Thinking about it, the one I have the most disdain for is The Guardian's; it has a quick UI but the accept-all button is labelled "Yes I'm Happy".
littlecranky67 5y ago
Being pedantic here, but please stop calling them cookie popups. You are only helping the industry which uses this terms to disguise their intentions. They were never about cookies, they are only about tracking. You don't need consent to use cookies, you just need consent for using them for tracking. If you were not using any cookies at all, but would rather use Etag/Canvas/AdId etc., you would still need the consent popup. So please everyone, lets call them what they actually are, they are tracking popups.
leshenka 5y ago
The solution is to build cookie confirmation dialog into browser. Exactly the way we're dealing with camera/microphone/geolocation/notification permissions. This will provide a stnadardized way and then you can have a big red "no cookies unless absolutely necessary" button that or https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
blooalien 5y ago
It's a combination of a certain group of people who will fight to the death for their "right" to maintain complete ignorance of all things "computer" (beyond the absolute requirement of locating the power button to get started, and knowing that "(e)" icon for "Explorer"/"Edge" means "Internet"), and an out of control advertising industry who will fight to the death for their "right" to abuse such people's lack of understanding of everything "computer" in order to monetize and spy upon every little detail of everyone's every single move upon the Internet that the advertising industry has inexplicably and arbitrarily decided that they alone own and control all the rules and operations thereof.

mchusma 5y ago

Hmmm...so you are an anarchist (so don't want government) but also think profit seeking is unethical? I'm genuinely curious what mechanism you would like society to function under? Like why would people...do stuff if not for value in exchange? Honestly the only thing I came up with is basically if you forcibly modified humans in one generation, making people want to help each other for no benefit to themselves. Then, abolish the government I'm the next generation so this group of modified-humans runs with no profit motive or government. So it's like super dark and authoritarian, but only for a little bit? Anyway, this was a fun thought exercise for me so thanks!

southerntofu 5y ago
> Like why would people...do stuff if not for value in exchange? People do stuff because they're curious or bored. Because they want to help and feel useful. Sure if you've worked all your life, you may spend a few months just doing nothing and just reconnecting with your inner feelings and environment. But after a while i can assure you you won't be able to stand lying around: pathological laziness is very rare. [0] Many people without employment suffer from not having a sense of purpose. But what about the tasks nobody wants to do, like collecting garbage? Why can't we distribute those tasks? Why would a certain caste of people have to do the unpleasant tasks for others? If some task is a burden to the community, it's only fair the unpleasantness is distributed somewhat-equally. If i lived in a big city, i personally wouldn't mind collecting garbage once or twice a year, and the value i would derive from that would be that all garbage including mine is duly collected. [1] Likewise, why would i help another person with some task i'm competent with? It can come out of simple empathy, but there's another way to look at it. The capitalist system treats exchanges as a zero-sum game where if i don't get my share at every step of the way i'm getting screwed because someone else will have it. A Commune without private property [2] treats exchanges as some form of creative process: the more we share, the more we have, and the more we can share... the better off everyone is in the end. > Honestly the only thing I came up with is basically if you forcibly modified humans in one generation, making people want to help each other for no benefit to themselves. Haha, that sounds like a pretty cool scenario for a movie in which you're not sure if it's a utopia or dystopia. Can't wait for the trailer to come out ;) > Anyway, this was a fun thought exercise for me so thanks! Cool! It can be more than a thought experiment, though. No person (myself included) is going to come up with the solutions to all our problems. The point of anarchism is that distributing power (so that everyone has a voice) is a prerequisite for finding the better outcomes for everyone. This can be practiced in every field of life on a daily basis. If you enjoyed the thought experiment, i can only recommend to read some more anarchist literature: i've personally profoundly enjoyed Emma Goldman's autobiography, among others. Submedia's Trouble [3], in video form, documents various questions/practices related to anarchism. [0] I hear Devon Price has some good works lately on that topic, but i haven't given it a read yet. [1] Of course in a better world, we wouldn't have a garbage-oriented society. Capitalism produces waste on so many levels it's hard to imagine a less-efficient system. I take this example because that's something all people who live in cities can relate to. [2] Private property does not designate personal belongings. Of course in a free Commune everyone still has personal stuff. Property is the authority derived from a piece of paper over resources you have no use of. [3] https://sub.media/c/trouble https://sub.media/c/trouble

qq4 5y ago

Why do you find profits unethical as an anarchist? Capitalism is not a form of government.

southerntofu 5y ago
TLDR: Capitalism is a form of government historically and in the present. Even if it was not (as suggested by right-wing libertarians like Ayn Randt), anarchism stands against all power over others (read authority/domination/privilege/exploitation) not just government. "Property is theft" is a famous quote by Proudhon [0], who was the first person to coin the term "anarchist" to describe a desire for Freedom & Equality as complementary goals which should never be opposed. By this, he means that profit is always derived from someone else's exploitation downstream: for example, as computer people, even by working "ethical" jobs, we still widely profit from the exploitation of miners and factory workers in the Global South who produce our devices, and from the pollution and climate change (that also mostly affects the Global South) derived from that. It's also worth noting, as we've seen at the height of the COVID lockdowns, that the people the most essential to society (food/health, logistics, maintenance/construction workers) are also those who get the smallest share of the pie. Private property is the State religion that makes it possible to have homeless people yet millions of empty dwellings, and that core tenet of capitalism is enforced by the Nation State and its police/military forces [1]. This, despite the fact that many jurisdiction (including the law in France since the liberation in 1945) explicitly allows authorities to requisition empty dwellings to prevent civil disorder ("trouble à l'ordre public"). Capitalism relies on early indoctrination (via childhood education) and a great amount of physical force/threats in order to perpetuate itself. Why do we have to pay to live? Because if you don't pay rent, some psychopaths with guns are gonna knock down your door and kick you out. Would there be equality without a centralized government? Sure, some influential person could employ a militia (as already happens despite our having a central police [2]), but: - the scale of that would be fairly limited to crush popular unrest, compared to a Nation State's forces - without a central State to indoctrinate since childhood (preparing us for competition in a cruel world) and ensure millions of people live in misery (and have to take the job) it would be harder to mount such schemes - the incentives would be more balanced: if we can live decently and quietly (as most people desire), what interest would i have to attack someone else's community for a corrupt overlord? - power would be more balanced: in many parts of the world (including France), the State has a legal monopoly on justified violence which makes community vulnerable by not having a right to arm and defend themselves Both outcomes are possible if we abolish the State from one day to the next (anarcho-capitalism and anarcho-communism). However, given the history of capitalism and the sheer amount of national force it took to set that up (eg. armies colonizing foreign countries, public schools to teach the young to fuck other people before they fuck you and that "copying is cheating"), i would argue that tearing down such centralized structures may bring us closer to our tendencies for empathy and mutual aid which are common throughout animal societies. [3] Overall, anarchism is focused on distribution of power, responsibilities, and resources: in society at large, in the family, in the workplace, in interpersonal relationships... It's not focused on "rights" as a legal construct but on the practical power you can yield as an individual. Sure, in a capitalist society we are all "free" to own a castle just like we are all "free" to get decent healthcare: but if we aren't given the practical means to achieve this "right", it's entirely meaningless. Or, as Bakunin put it: "liberty without socialism is privilege, injustice; socialism without liberty is slavery and brutality.” To finally answer your question, i'm not morally opposed to making a profit in this profit-driven society in order to survive. I'm also not morally opposed to cooperatives making a profit in order to build a parallel economy. What matters to me is the next step: how to build a society based on needs and desires, not profit. Or, as the old anarchist saying goes: "To each according to their needs, from each according to their capacity". On a high-level, you need money because everybody else needs money: the carpenter needs to pay the peasant, who needs to pay the plumber, who needs to pay the baker... Workers cooperatives, when they have a sense of revolutionary purpose [4], can be a trojan horse that extracts money form our overlords in order to build material autonomy that can lead to the irrelevance of profit. Money is an abstract layer of indirection, and at each step leaks into the pockets of the owners. Having lived for quite a while in communities where money is irrelevant [5], I personally feel that in order to achieve our goals, it's much more efficient to base the discussion on actual needs and how to build concrete autonomy [6] rather than center the talk about monetary goals in which we can loose sight of what we were trying to accomplish in the first place. I hope to have answered your question. [0] If you're interested in cooperative economy and don't read what he has to say about women and the jews, his writings are sound. Fortunately the more recent anarchist movement (since the last quarter of the 19th century) has evolved to be fundamentally incompatible with misogyny and racist sentiment and to be on the frontlines against such power structures (see for example the rise of anarcha-feminism since the 1930s). [1] The military is not just a construct against foreign invasion, as seen throughout the history of the workers emancipation movement and the many times armies have been called to bloodily suppress strikes and other forms of popular uprising. Although since the second half of the 20th century, modern Nation States have developed "counter-insurgency" techniques in which the military becomes a last resort, and focus is placed on both propaganda and cooptation on one hand, and more vicious political repression on the other hand (targeted assassinations, legal proceedings, mutilation by police forces, etc). [2] In the squatting scene, that's not unheard of. Bigger landlords often have ties to different strains of mafia. In other spheres of life, you could probably read about Pinkerton (the history as well as modern occurrences such as Amazon's anti-union campaign), about the Coca-Cola murders in South America, or about companies such as Ikea mounting their own intelligence agency. [3] See also the recent HN threads about Kropotkin and his studies on mutual aid. [4] Unlike recent straits of workers coops who have been coopted by capitalism (so-called social economy) which is only concerned about working conditions and not about broader social questions. [5] We do use money to interface with some segments of society, but in a squat/Commune you can as an individual live without money if you don't have any, and still find purpose and access to resources. Also worth noting, some interactions with neighboring structures is not necessarily based on money: it's not uncommon for a local market/bakery to give away "dying" foods, for neighbors to help out one another on construction work, etc. [6] Autonomy is not independence. Noone is truly independent, and autonomy accepts and accounts for inter-dependence relationships.
- qq4 5y ago
  I was worried by the size of this reply that it was some kind of copy-pasta at first. That doesn't seem the case. I am genuinely interested in digesting this and giving you a thoughtful reply, but it will take some time.

dane-pgp 5y ago

> Well, it's basically malicious compliance. Agreed. I can't think of a more widespread and effective campaign by an entire industry to gaslight their customers into hating a regulation more than the invasive practice that is being regulated.

bsanr2 5y ago
Tangentially-related, but it's funny that you should say that, and in as many words. https://youtu.be/hX2aZUav-54 https://youtu.be/hX2aZUav-54
mhaberl 5y ago
Exactly. We should attack the core issue here; tracking is a form of invaison of privacy and should be banned in general.
- quest88 5y ago
  The core issue is people want free shit.
  - tomcooks 5y ago
    You're posting this as a HN contributor or as a freeloader?
    - mam4 5y ago
      Hese right tho
  - mhaberl 5y ago
    Nothing is free. So people pay with their privacy, some because they are tricked into it, some because they don't care. Point is that invaison of privacy is bad and you should not have even an option to trade it for "free shit".
  - atoav 5y ago
    No, the core issue is that advertisments are not enough for them, they want personal data too. Giving someone with a website an image that they put up there is simple and requires zero cookies. If your goal is to have people see that banner this is literally all you need to do. But of course advertisers want targeted ads, they want to get metrics (they don't care how truthful those metrics are, but who cares right?).
    - throwtheacctawy 5y ago
      Part of the issue is how business models are built in the internet era; there are only so many sources of revenue for a free website. The internet has a fundamental problem. People want stuff (content), but they don't want to pay for it. I think the internet needs some sort of payment/chargeback system in place to bring sanity back to it. Like what Medium.com, or Apple News has. One subscription, that reimburses content providers, based on usage. The reason all this invasive ad-tech exists is to generate revenue.
    - kinnth 5y ago
      I don't think most websites honestly care about personal data. What most sites want to know is what anonymous users are doing on their sites so they can improve them. I for one need this data on a daily basis to help me decide how to make products better. I think the legislation doesn't do it's job properly. Why not force it so that like apple, the browser informs the websites that they don't want to be tracked, then it is the websites issue if they are caught tracking. Or all browsers forcibly obscure a users PII.
      - ScoobleDoodle 5y ago
        The advertisers who’s advertisements are shown care. And because they pay more for targeted ads the website cares. The ad industry believes targeted ads are cheaper and more effective in aggregate than un-targeted ads. Also if the website is selling PII to “partners” as another revenue stream the the website cares.
        naravara 5y ago
        The ad industry used to target ads by aiming at a publication’s audience or subscriber base. The publication would conduct surveys or do Nielsen rating type measures to get a sense who their audience was. When publications online went from trying to build an audience to trying to drive traffic we ended up with the situation we have now. They don’t have audiences anymore, they have atomized bits of content without much in the way of editorial voice or culture to tie it together. They care not one whit about making their site a destination, just trying to chum the waters for whatever will bring in a catch of fresh eyeballs.
  - f6v 5y ago
    Or maybe billions of venture funding created unrealistic growth expectations. This turned otherwise good businesses into data hogs.
  - largbae 5y ago
    That is far from certain. I happily pay for Netflix and other services that provide high quality content without ads. Consider reading Jaron Lanier's books or content, there is another way.
    - kova12 5y ago
      And there lies problem. You pay 10 bucks a month to behemoth, but would you pay 1 cent to the site which gives you less value than Netflix? That would be way impractical. So the smaller sites have to turn to ads and tracking to keep the lights on
      - spurgu 5y ago
        That's the problem Brave is trying to solve. Micropayments have been a potential niche for cryptocurrencies, it just hasn't taken off (yet), even though there's a lot of crypto related "innovations" (DeFi, NFT's, whatnot).
  - dTal 5y ago
    That's so weird, I don't pay any money to Ycombinator. And yet, no cookie popups!
    - rocketbop 5y ago
      That's because Hacker News _is_ the ad. It helps promote YCombinator itself, by adding prestige.
      - dTal 5y ago
        We're talking about tracking cookies, not ads.
        ghaff 5y ago
        You're being pedantic. Tracking cookies are, in general, in support of ads.
        dTal 5y ago
        Which is irrelevant, since the converse does not need to be true - we are talking about tracking cookies. Postulate 1: This website is free. Postulate 2: This website does not use tracking cookies. Theorem 1: Tracking cookies are not required for free websites to exist. Postulate 3: This website is an ad. Theorem 2: Ads do not require tracking cookies. Note that my original comment asserted Theorem 1 only.
      - behnamoh 5y ago
        I'm not sure if that was their goal when launching HN, but it definitely helps their brand image now.
      - GekkePrutser 5y ago
        But as ads go its really benign. No tracking, no constant in your face reminders, no retargeting etc...
    - ghaff 5y ago
  - laumars 5y ago
    It was advertising companies that started this trend of giving shit away for “free”. Before then people were used to paying for services.
    - blooalien 5y ago
      > "Before then people were used to paying for services." … and/or were more often genuinely grateful for things that were given freely and generously …
  - wpietri 5y ago
    Nah. People have always wanted free shit. I once volunteered at an event for fancy people. Occasionally we would put out some moderately cool free shit. I saw a lot people worth millions to hundreds of millions leaping into the scrum for things that they could buy for $50-100. People wanting free shit is a constant. The problem is how we channel that desire, which is very much in our control.
    - behnamoh 5y ago
      Man, that's so "unclassy" of those millionaires.
      - wpietri 5y ago
        It was a surprise to me for sure. On the other hand, maybe being aggressively, pathologically grabby is how a lot of people become millionaires.
        tekknik 5y ago
        Exactly. I know at least one that bought a box of paper clips 30+ years ago and still uses the same ones today.
    - ghusto 5y ago
      This "you can't have free stuff" argument I've seen way too many times now is based on a false premise. You _absolutely_ can have free stuff. I remember the web when it was run by hobbyists, and that's exactly how it worked. What people who use the "no free stuff" argument really mean is that there are those who are on the web to make money, and you can't have their stuff for free. To that I'd say; take your stuff and go home. Your stuff is exactly what ruined the web in the first place.
      - 5560675260 5y ago
        That stuff that you've consumed wasn't free, those hobbyists paid for it out of the pocket. Sure, some can afford to do this to this day, but this doesn't scale. Nowadays internet is too populous and expectations are set too high for this to keep working.
raverbashing 5y ago
Sounds like the McDonald's character assassination of that woman that got burned Gotta love American's way of doing business
- deleted 5y ago
  [deleted]
aantix 5y ago
What’s a better design for asking for consent?
ajmurmann 5y ago
Hah, as a European I feel that way about how sales tax is handled by businesses in the US.
cyanydeez 5y ago
the us tax system would like a word with you.

ckastner 5y ago

Exactly. My favorite example are sites which require you to opt out of hundreds of third party processors individually (advertising partners who may receive data). That's as dark a pattern as it gets. It's also in clear violation of how opt-out is actually supposed to work, at least in the EU. And with the Do Not Track header, I shouldn't even have to opt out in the first place. A GDPR decision to that effect could solve this banner madness once and for all.

Nursie 5y ago
Do Not Track was a joke from the word go. "Let's ask these bad actors to play nice, I'm sure they'll respect that, I mean, they probably think we all want to be tracked so let's just tell them we don't and it'll all be fixed. And make sure the option isn't obvious enough that normal people start to use it and ruin the whole thing".
necovek 5y ago
IIRC, DNT header was such a failure that not even Firefox has it anymore: I think it's an abandoned feature.
- ugjka 5y ago
  No, Firefox still has it
  - necovek 5y ago
    Thanks for the correction! At the very least, I've stopped setting it since no website respects it.
    - jffry 5y ago
      With DNT on, Medium actually behaves differently! When viewing an article with embeds (like an iframed YT video), each embed is replaced with a small privacy warning, then clicking it loads the embed.
lozenge 5y ago
I don't remember the exact timeline but MS decision to enable DNT header by default was basically a poison pill for the entire concept before it had a chance. It would have failed one way or another though. Adtech industry doesn't give up that easily.
- MereInterest 5y ago
  That's the argument I've heard from the ad industry, but I don't really buy it. Previously, the DNT header was missing by default, so it's presence could be seen as user intent to forbid tracked, while its absence is ambiguous. Afterwards, the DNT header was present by default, so its absence could be seen as user intent to allow tracking, while its presence is ambiguous. That's exactly what should be the case should be, where only explicit consent to be tracked counts.
- croes 5y ago
  Or in others word, opt-in is not an option for the ad industry.
- 323 5y ago
  Safari/Chrome/Firefox enable by default some ad-blocking today, just like they disable popups or screen for phishing sites. The whole "users didn't opt in" thing was a false narrative manufactured by the ad industry. You don't need to ask a customer to disable bad behaviors without asking.
Deukhoofd 5y ago
> And with the Do Not Track header, I shouldn't even have to opt out in the first place. A GDPR decision to that effect could solve this banner madness once and for all. Enforced DNT is part of the ePrivacy Regulation, which was supposed to launch alongside GDPR, but got delayed. Expect it to arrive somewhat soon. https://digital-strategy.ec.europa.eu/en/policies/eprivacy-regulation https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r...

camillomiller 5y ago

Unfortunately in Germany that’s not true. Putting anything in someone’s computer without their approval is now considered illegal. Therefore even if you’re just using Matomo stats or anything that isn’t tracking and just functional you need to ask for permission. That is idiotic and doesn’t solve the issue at hand at all

karol 5y ago
That sounds nonsensical, when people visit your website they run your code using their CPUs and electricity. You also get their attention and may even influence their heart rates and breathing patterns.
rad_gruchalski 5y ago
> Putting anything in someone’s computer without their approval is now considered illegal. Citation needed.
- enumjorge 5y ago
  Agreed that doesn’t make a lot of sense. You need to “put” html, css, images in the visitor’s computer just as much as you do a session cookie. How is one allowed and not the other?
  - number6 5y ago
    It doesn't make a lot of sense. Now we have to interpret what was intended with the law. What about In Browser databases? Or Javascript? It's much more than just cookies that are stored on computers.
- number6 5y ago
  Art 25 TTDSG "The storage of information in the end-user's terminal equipment or the access to information already stored in the terminal equipment shall only be allowed if the end-user has consented on the basis of clear and comprehensive information. The information to the end-user and the consent shall be provided in accordance with Regulation (EU) 2016/679."
  - welterde 5y ago
    There is a second paragraph to this article that contains exceptions to this. If it is absolutely necessary for the requested functionality then it is allowed. Therefore it doesn't really change anything.
    - number6 5y ago
      I bet this will be settled in court
      - welterde 5y ago
        Why do you think this would result in a different outcome in Germany? The language of the new law in Germany is virtually identical to the language of the EU directive. So why would it be different in Germany versus other countries in the EU that also have to implement the directive?
        number6 5y ago
        Following the German debate the courts and watchdogs interpretation of the law is that strictly necessary means that the functionality is not possible without cookies or other technology and the consent has to be of the same quality as per GDPR. Privacy law in Germany is usually stricter than in other EU country's even if the text is identical.
        welterde 5y ago
        Which is exactly what the EU directive intends. You are literally just stating the acceptable exceptions from the EU directive. And the main argument of this thread initially was that you don't need to ask if you are only using cookies for such use cases.
        number6 5y ago
        I assume from your handle that you understand German (?): This Podcast explains the topic much better than I could: Rechtsbelehrung - Recht, Technik & Gesellschaft: TTDSG – Cookies unter Aufsicht – Rechtsbelehrung 102 https://rechtsbelehrung.com/102-ttdsg-cookies/ https://rechtsbelehrung.com/102-ttdsg-cookies/
cmeacham98 5y ago
Don't get me wrong, I love self-hosted analytics like Matomo, but there is never a situation where a cookie for any form of analytics is "functional".
- XCSme 5y ago
  What about affiliate systems? Knowing who referred you to the site when you purchase so they can get their cut.
  - cmeacham98 5y ago
    Arguable either way in my opinion, but irrelevent because not analytics
Nursie 5y ago
"Therefore even if you’re just using Matomo stats" That's not functional though, is it? I understand entirely the desire to use such a thing, to understand how your site is being used, but it's not functional in a "delivering service to the end user" way. (Personally I like the way it sounds, analytics without signing over the world to Google, but it's still not functional)
franciscop 5y ago
Matomo calls its cookies "tracking cookies": > It’s possible to disable tracking cookies in Matomo by adding a line on the javascript code. When cookies are disabled, Matomo data will become slightly less accurate So it seems there's no "functional cookies" in Matomo, and so all cookies from Matomo without consent popup is not in compliance. You can disable all Matomo cookies and allow for compliance: > By disabling tracking cookies, you may also use Matomo without needing to display a cookie consent screen.
ReleaseCandidat 5y ago
> Unfortunately in Germany that’s not true. It is. There is no other law about cookies. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. English version of the response from the EU court: https://curia.europa.eu/juris/document/document.jsf?docid=218462&doclang=EN https://curia.europa.eu/juris/document/document.jsf?docid=21... Part of this case at the german 'Bundesgerichtshof'. https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilungen/DE/2020/2020067.html?nn=10690868 https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilung...
- number6 5y ago
  There is now Art 25 TTDSG Deals with it. The law Was passes this month
  - latk 5y ago
    TTDSG is finally a correct implementation of the 2005 ePrivacy directive. § 25 TTDSG literally just rephrases the exact ePrivacy requirements. The pendant to the above quote is § 25 Abs 2 Nr 1: > Die Einwilligung nach Absatz 1 ist nicht erforderlich, wenn der alleinige Zweck [der Speicherung oder des Zugriffs] die Durchführung der Übertragung einer Nachricht über ein öffentliches Telekommunikationsnetz ist oder wenn [sie] unbedingt erforderlich ist, damit der Anbieter eines Telemediendienstes einen vom Nutzer ausdrücklich gewünschten Telemediendienst zur Verfügung stellen kann.
    - number6 5y ago
      This shifts the consent down to the the feature: >vom Nutzer ausdrücklich >gewünschten Telemediendienst >zur Verfügung stellen kann. Now we have to document that the user wanted the feature that needs the cookie...
SamBam 5y ago
When you load a webpage you're putting images, text, and other files "in someone's computer." I don't think it's as simple as that.
croes 5y ago
False, since the BGH ruling in the "Planet49" case (judgment dated May 28, 2020 - I ZR 7/16), the following applies: Cookies and comparable technologies may only be used with consent in Germany as well, regardless of the processing of personal data. This is only different if the cookies are "absolutely necessary" for the technical provision of the respective service or they serve solely to transmit a message via a public telecommunications network. So technically necessary cookies still don't need consent.
cardanome 5y ago
That is a common misconception in the industry here in Germany but that doesn't make it true. I was often told to add a Cookie Consent banner even for sites that don't use any Cookies at all. Fact is, you don't need a Cookie Consent banner for functional cookies. The issue with Matomo is that even though nicer than Google Analytics it is optional for the working of the website, so it should only activate if the user consents. There is some serious cargo culting regarding these kind of laws going on. I remember back in the day that you would add "I don't take responsibility for the external links" kind of disclaimers on every website. Or everyone thinking they need a Impressum (legal info/contact info) page on their website because it is required by law. (No only for commercial sites, which is reasonable.)
- summm 5y ago
  I largely agree. An Impressum/Imprint is however not only needed for explicitly commercial sites, but also for sites that are not purely personal. E.g. just earning some cents with an ad banner on your personal site means you need an imprint. There have been lots of lawsuits, it's really ugly, and I totally can understand that people want to be on the safe side.
  - number6 5y ago
    Even if you don't earn a cent but the website is not only intended for close friends and family...
  - cardanome 5y ago
    Yeah it still good style to always provide Imprint. I just listed it as an example where people don't understand the nuance around an issue. "You better provide some Imprint if you are in doubt" becomes "You are required by law to always have an Imprint"
ekianjo 5y ago
> Putting anything in someone’s computer without their approval is now considered illegal Selling Windows by default with every computer is now illegal in Germany then?
- bmn__ 5y ago
  I wish it was, but no, selling a computer system with Windows installed is consensual, either by explicit customer request or by the customer agreeing to a sale offer as advertised. No one gets tricked into approval (here: buying) because every customer is able to request a different or no OS, or to reject an immutable sale offer; except if you think that not knowing what an operating system is and what it implies constitutes a trick, but that does not meet the legal definition.

jefftk 5y ago

> You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking. That is a common misunderstanding of the ePrivacy Directive [1][2]. It applies to all cookies (and "similar devices") that are not "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user". And "strictly necessary" is quite a high bar. (not a lawyer) [1] https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communications_Directive_2002 https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi... [2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... See especially (25).

raverbashing 5y ago
Yeah, item 25 is interesting, but the way I read this it's more about the informative links instead of the click-to-allow ones > strictly necessary in order to provide an information society service explicitly requested by the subscriber or user". Sounds to me then that login/customizations are allowed
snek_case 5y ago
I've been wondering about that. I have a simple web app and I'd like to gather some basic statistics about what users do, which pages they visit... Not to spy on people, not to share with anyone else, just to have some insight on how to make the app better. The app is just a toy program people use for fun, you couldn't possibly argue that any stats I'd be collecting could be used maliciously. It seems to be difficult to do that while respecting the GDPR and without some annoying pop-up though?
- number6 5y ago
  Do you really need cookies for this or could you also use your server logs for this? Per default you could not gather statistics but ask inside you app if people are willing to participate in making the app better and if they would agree to accept some cookies for this reason.
  - snek_case 5y ago
    I don't need cookies for this. However, AFAIK the GDPR doesn't just apply to cookies, it applies to any data retention, or at least anything that could be tied to an IP address or a certain user. Maybe the key is to have stats that are purely anonymous, eg, how many people visited this page.
    - number6 5y ago
      Right, I focused on cookies here. Yes you could just cut the IP out of the logs and check the visited sites and requested resources.
    - jefftk 5y ago
      If you're using server logs, without any cookies or other client-side storage, then the ePrivacy Directive is not relevant and you're thinking about the GDPR. Unlike ePrivacy, the GDPR is specifically concerned with personal data, so if you are careful in how you set up your logs you can generally still collect good analytics on how people use your site without accidentally collecting data on how a specific person uses your site. (still not a lawyer)
- jefftk 5y ago
  Cookie banners predate the GDPR: they were initially for the (much older) ePrivacy Directive, though many sites now have combination consent gathering flows for ePrivacy+GFPR. For your specific question, I think the Planet49 ruling gets pretty close. "It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual's device." [1] (still not a lawyer) [1] https://www.twobirds.com/en/news/articles/2019/global/planet49-cjeu-rules-on-cookie-consent https://www.twobirds.com/en/news/articles/2019/global/planet...
- namdnay 5y ago
  Just do it server side, with a unique session token.
  - ErikCorry 5y ago
    How do you assign individual web requests to a session without cookies?
    - namdnay 5y ago
      generate a random ID in js when your page starts, set it in the context and send it as a header on every request
    - notreallyserio 5y ago
      Add a session id to the URL and all generated links, I'd guess. Still probably not any more legit than a cookie, though.
      - jefftk 5y ago
        I wouldn't be surprised if that fell under "similar devices", just like localStorage.
  - lixtra 5y ago
    While might not be caught easily, you‘r still not compliant with GDPR by doing it all on the server without consent.
    - namdnay 5y ago
      GDPR only applies to PII. If you're just collecting anonymous session tokens you're fine (it's what comes "out of the box" if you host your webapp on AWS for example, you'll see an AWS correlator ID in the request headers)
- NavinF 5y ago
  Technical answer: You can use Differential Privacy[1] to collect such data (“what percentage of users used this feature?”, “What is the distribution of time between visits?”, etc) without collecting any data about individuals. Some projects already do this and there are open source libraries that do the math for you. However, I don’t think the regulations have an explicit safe harbor along the lines of “You’re fine as long as the math checks out”. Perhaps if it did, we wouldn’t be in such a mess. (A passive observer that sees a JSON POST wouldn’t know that you’re using differential privacy. It would look like typical telemetry. They’d have to read your code or look at multiple samples and notice that the data looks random) https://en.m.wikipedia.org/wiki/Differential_privacy https://en.m.wikipedia.org/wiki/Differential_privacy
- tlarkworthy 5y ago
  plausible analytics claims to not need consent as it does not do user level tracking or issue clienside state. https://plausible.io/ https://plausible.io/
- gpm 5y ago
  Do you really need to know which pages a particular user visits, or just which pages are visited frequently. The latter is easily gathered from web server logs, the former sounds like a case of "I want to do this bad thing (spying on users) for good reasons", and the law only cares that it's a bad thing, not about your reasons (or arguably it does care slightly about your reasons, but not in enough detail to accommodate your use case). Laws being rather blunt tools and reasons being rather hard to divine.
  - jefftk 5y ago
    You might want to know, in aggregate, which paths users take through your site so you can make it better. This requires cookies, and the cookies are not, in my reading, essential for the site to function.
    - gpm 5y ago
      Yes... Agreed on both points. You can get a bit of that via referrers, but not as much as you would like.
rozab 5y ago
Surely if someone has instructed the website to remember a setting, then that cookie was explicitly requested by the user?
- jefftk 5y ago
  Storing something in response to an explicit user request seems fine without additional consent, though you still need to explain to users how the cookies are used to fulfill their request. [1] On the other hand, there are many things that sites do that are not fully explicit. For example, shopping sites often show you items you have recently viewed to facilitate comparisons, or a news site showing ads might want to make sure they don't show you the same one over and over. That doesn't sound to me like it is strictly necessary for the functioning of the site? [1] "users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using"
  - notreallyserio 5y ago
    Couldn't sites wait to ask for cookie permission until the actually user tries to do something that may benefit from a cookie? Like put text and a link with an explanation next to buttons to change the theme or regions which may contain recently viewed items.
    - q3k 5y ago
      Yes.
    - DangitBobby 5y ago
      Preferably this would use a browser cookie setting. I know you use cookies to store my settings, I don't need you to ask. Please stop asking.
jamil7 5y ago
I was under the impression that for something like a session token stored in a first-party cookie you don't need consent. The second paragraph refers to both GDPR and ePrivacy directive. > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. [1] > Receive users’ consent before you use any cookies except strictly necessary cookies. [1] [1] https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
- jefftk 5y ago
  It depends on what you're doing with the session cookie. If it is just for holding shopping cart items or tracking whether you are logged in, I agree with you. But there are many first-party things sites want to do which are probably not "strictly necessary".
q3k 5y ago
It’s not that high. Here’s an official opinion on some usecases that meet the bar and some that don’t: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... Generally, it matches my expectations. Shopping carts, sessions, and even most user preferences are fine and don’t need a banner. Worst case a small “uses cookies” text next to a language change button is enough.
- jefftk 5y ago
  It is still very strict. For example, here is what the document you link has to say about cookie lifetimes for shopping carts: "A cookie that is exempted from consent should have a lifespan that is in direct relation to the purpose it is used for, and must be set to expire once it is not needed, taking into account the reasonable expectations of the average user or subscriber. This suggests that cookies that match CRITERION A and B will likely be cookies that are set to expire when the browser session ends or even earlier. However, this is not always the case. For example, in the shopping basket scenario presented in the following section, a merchant could set the cookie either to persist past the end of the browser session or for a couple of hours in the future to take into account the fact that the user may accidentally close his browser and could have a reasonable expectation to recover the contents of his shopping basket when he returns to the merchant’s website in the following minutes."
  - Freak_NL 5y ago
    So? That's totally what I'd expect from a shopping cart cookie. I don't expect something I put in a cart to be there the next day (I will have bought it somewhere else). I was using the website for a Dutch big box hardware store (Gamma) today, and it had a door stopper I was looking to purchase half a year ago in my shopping cart. I never finished that transaction. That kind of retention is just pointless.
    - jefftk 5y ago
      While I do agree keeping items in the cart for a year is not what users expect, if someone puts something in their cart, closes the browser, and then comes back the next day, I think most e-commerce sites would still list the item. And I think that's generally something users want.

ketzu 5y ago
Especially because many people that consider themseleves tech savy are more out of touch, e.g., thinking the privacy aspects could be solved through local cookie policies only, or that it would be a suitable solution to solve even just the cookie aspect in a nuanced, non-techie friendly manner.
- recursive 5y ago
  Cookie consent should be the responsibility of user-agent cookie policy. And virtually all of the consent banners I've seen are about cookies. And I certainly think it has a better shot of being comprehensible by users in general than having a separate UI for consent for every site. Especially when it's in those sites' interest to confuse or annoy users into allowing the cookies.
  - ketzu 5y ago
    In this thread I had the impression that the discussion widened to more than just cookie-banners, more general privacy on the web. One of the problems I have with the pure-local approach is that I want certain cookies (or certain cookie functionality) of sites but not others. Some functionality I want and some I don't want can be implemented with the same cookie. I think I would need tagged cookies (so I can disallow those that are used for things I don't want) as well as an assurance to not use the other cookies in the "wrong" ways. That's why I think purely local cookie management is severly lacking and not suitable to tackle the problem in a user-friendly and nuanced manner - beyond an all-or-nothing approach. I personally do not think a browser level approach can enforce the privacy goals without cooperation of (and therefore enforcement against the companies providing) the serverside implementation. That, of course, does not mean that a browser level setting that has to be honored by the server side and can be transfered between sites would not be preferable to clicklists and banners.
pembrook 5y ago
So if the law couldn't be written in a rational way without creating bizarre outcomes, then why create it at all? When you create legislation, you're implicitly saying; "these rules we're writing down are important enough to enforce with the full monopoly on violence given the powers of government." The cookie popups seem extremely silly in that context. I don't doubt you've run across some well-intentioned people. But as the saying goes, the road to hell is paved with good intentions. Seeing a structurally dysfunctional system from the inside, and being able to empathize with the individuals in it, does not make the design of the system any less dysfunctional.
- peoplefromibiza 5y ago
  > So if the law couldn't be written in a rational way without creating bizarre outcomes, then why create it all? Nobody said that, I don't know why you're saying it, because it also makes no sense. Do you also believe that we shouldn't have made murder illegal because murderer still exist? There are always gonna be bizzare outcomes, pop-ups only speak about how lousy advertisers and tracking freaks are, but there have been certainly more bizzare outcomes, think about people refusing vaccines... Compared to that pop-ups are just an annoyance that we can avoid by punishing the perpetrators directly not visiting their websites. > But as the saying goes, the road to hell is paved with good intentions it's all simple, until you have to convince hundreds of politicians to agree on a law that's gonna be enforced on 450 million people from 27 different countries, with 27 different legal systems.
- muzani 5y ago
  Cookie popups are bad, but they're pretty similar to a no smoking or no parking sign. In this case, it's the reverse. The whole internet bans cookies, but it informs you that you're entering a cookie zone. These companies may think they're protesting the cookie law with popups but it's achieved what I expected it to achieve. It's given me fair warning that the site intends to track and monetize me, so I can walk away if I don't think it's worth it. And it adds a higher cost to it too.

simion314 5y ago

>There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it GDPR is not only about browsers , it applies outside our web dev bubble. Then if the law was is only about cookie some "smart" webdev would use localStorage , if then we add localStorage then some other dev (probably working on Google Chrome) would create something new... so maybe those EU politicians and consultants are a bit smarter then you(no offense, maybe you are a smart person but either you are having the wrong perspective or you did not really thought more then 5 seconds about the problem).

pembrook 5y ago
Sorry, you’re mistaken. Cookie popups weren’t the result of GDPR. They were the result of the earlier “ePrivacy” directive from 2002 and revised in 2009. Many people confuse these two pieces of legislation, but cookie popups were already an endemic problem long before GDPR.
- simion314 5y ago
  I know that, my point still relevant because it was related to: >There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it. This is really not a solution, browser already had a black and white option to allow cookies or not, or allow JS or not. The proposed idea is to give only 1 place where you can accept or not accept tracking, then you want to really read a website or your work/bank forces you to read a page and you have no choice then allow cookies for everything and accept all possible tracking because some HN web dev did thinks is mmuch smarter then a group of consultants. lawers and privacy advocates. If tracking is legal then Allow/Disallow tracking should be per website and always should be 100% transparency on what is tracked and shared with, Tech people could create browser APIs for example, you could have a in browser cookie popup where web devs could populate the text message about "We care about privacy" , an array where web devs can populate with the names, links and terms of use for the 100+ partners. Then all websites will share same native popup, and implement it correctly with no dark patterns, there could be a 3 line extension to click allow or not allow for people that really want to accept or not accept. But this browser APIs won't happen because Google controls the web , Mozilla is on it's last breath and Safari is still screwing around with missing JS and Webgl features and other bullshit. Edit: Also a simple law as propsed with "make cookies a setting for all websites per browser) is not good since you can use the localstorage,fingerprinting or other tricks to go around the law, so proposed idea is bad.
- M2Ys4U 5y ago
  That true, but simion314 is still right that the law doesn't specifically target browsers.

bmn__ 5y ago
You are supposed to know what civil law and common law is, this is part of general school education. The same goes for the difference between regulation, directive and national law, in case you are an EU resident. <https://upload.wikimedia.org/wikipedia/commons/9/92/Map_of_the_Legal_systems_of_the_world_%28en%29.png https://upload.wikimedia.org/wikipedia/commons/9/92/Map_of_t...> You don't appear to have the aptitude to educate yourself when you notice that something confuses you or you are ignorant about a topic, c.f. post id=29529880.
- dotancohen 5y ago
  I actually don't mind the personal attack, as I also believe that we should encourage a higher bar to entry than is currently acceptable for software developers. I do not live in the EU. I did not learn what civil law nor common law is, neither did I learn the difference between regulation, directive and national law. Out of interest, I work with people who grew up in France, Russia, the United States, and Argentina in addition to locals. I'll ask them if these terms are familiar to them. Perhaps in fact I don't have the aptitude. Or more likely, I see the tradeoff between "understanding every nuance of a 50,000 word document in a field I'm unfamiliar with that carries severe penalties for my client" vs. "implement cookie warning" differently than you do.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
  - CRConrad 5y ago
    OTOH, enlightenment about both terms is a simple Internet search away. Literally at your fingertips. I could give you layman definitions good enough for this discussion in about half a dozen words each... But, hey, let's not reward auotingrained helplessness.
- bryanrasmussen 5y ago
  I think it would be reasonably charitable to assume that when the poster uses I in that post they are using it as shorthand for a hypothetical person that needs to decide whether or not they should implement cookie popup, and not a complete admission of ignorance or disinterest in learning anything on their part.
  - bmn__ 5y ago
    To me it reads GGP meant exactly as he wrote it. You have given no reason to back the assumption that the pronoun "I" refers not to himself, but to some other hypothetical person. Therefore I find that unreasonably charitable.
    - dotancohen 5y ago
      You are correct, I am using the literal "I" to refer to myself specifically.

tsuujin 5y ago
It’s worth noting that you do not need cookies to store shopping cart details if you have a user account system. You can store their cart in a database and associate it with a user account. A session based cookie can then be used to store your identity in a short term session, and the server can easily gather long-term storage on its own. I think it’s a fair compromise to say “if you want to save this cart, please log in”, which satisfies opt-in data tracking in a user friendly way. You aren’t mandating a user account, but if you opt in you get something potentially useful. My principle complaint about most of the discourse on this topic is that it is superficial. There are reasonable workarounds for most user-friendly tracking that allow for tacit opt-in via responsible and clear UX. The “hard parts” seem to generally concern the type of tracking that isn’t so clearly user-friendly, such as behavior tracking and PII collection, which is a conversation we should be having anyways without obfuscating the issue by pretending it’s about the easy stuff.
- DangitBobby 5y ago
  I think just about the only "essential" cookies to ensure functionality would be session cookies. But I would be surprised to learn that the point is to eliminate useful cookies. Shopping cart cookies, when designed so they are not shared with 3rd parties, are benign and should not require an opt-in. That's my opinion on most cookie-based functionality, really. Client-side state is useful for a lot of user-friendly functionality. For example, remembering things like Dark Mode, pop-up re-sizing, slider locations (volume for example) are all legitimate use cases that I would prefer as a user to be isolated per client.
  - jefftk 5y ago
    I think that works if the site clearly says that your preference will be stored. On the other hand, if it's just a "dark mode" checkbox or something, my reading of the directive is that isn't enough?
- jefftk 5y ago
  I don't want to have to make accounts on websites just for them to remember what is in my cart for my next visit. I don't like having more accounts, especially if I'm not yet sure if I'm going to buy from them. Since the site does not know you are leaving, it doesn't have any opportunity to prompt you and ask whether you would like to save your cart (and if it did I would find it pretty annoying)
  - 9935c101ab17a66 5y ago
    Also, you initially asserted that the regulations were strict for any and all cookie usage. The person replying to you provided plenty of evidence to the contrary, and now you’re bringing up incredibly niche edge cases, to what end I’m not sure. I think it would be more productive to just concede that the regulations aren’t as strict as you stated.
    - jefftk 5y ago
      Most companies will not be compliant unless they do one of (a) get consent from users or (b) hire a lawyer to review each of the things they do in the context of ePrivacy, and make corresponding changes to keep everything within the bounds of "strictly necessary". I'm bringing up these 'edge cases' as part of showing that most sites would have changes they would need to make if they wanted to stop asking for consent from users, and that these changes are not obvious and go beyond removing tracking.
  - 9935c101ab17a66 5y ago
    If I go to an e-commerce website and I am not signed in to, add a bunch of stuff to my cart and leave, I have absolutely no expectation the cart will persist until the next day, and I really don’t think you should either. Not only is it in an unreasonable expectation as an end user, but also it sounds like an absolute nightmare for businesses (Do you hold physical inventory for things in the cart? What about price changes or products are discontinued? Etc).
    - jefftk 5y ago
      In practice, sellers do deal with this. The most common approach is that putting something in the cart does not reserve it or maintain a fixed price. Then if availability or pricing changes, they flag that to the user when viewing the cart.