4 ms·

This is the correct answer. Nobody needs to ask for cookies that are required for providing the service. They choose to annoy people.

dageshi 5y ago
Nobody is thinking about it that hard. Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side because throwing a plugin on that adds it is about a 2 minute job and actually figuring out if they need it requires a lot more work. Path of least resistance wins.
- rendall 5y ago
  > Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side... That's a pretty bold claim, even steel-manning it. I personally only ever see it on sketchy sites. If you're right, then it would just take a campaign of education to halve the annoyingness rate of the internet.
  - dotancohen 5y ago
    OK, so where is this education? I've read this entire thread and I still don't know when I would need to prompt for cookies, or even if I need to prompt if I store everything serverside and id the visitors with a session token in URLs. There is no easy-to-understand definitive answer for the common use cases.
    - rendall 5y ago
      > I've read this entire thread and I still don't know when I would need to prompt for cookies... Well that's the problem, right there! You're reading random HN threads to get this information. Why not go to the source? https://ec.europa.eu/info/law/law-topic/data-protection_en https://ec.europa.eu/info/law/law-topic/data-protection_en The law itself is fairly easy to read and understand if you're a software developer. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1374-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Here is what looks to be pretty respectable commentary on when it triggers. Essentially, if you collect any sort of personal data whatsoever: https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/ If you store information that can identify the user, e.g. if you collate a user's IP address, you are almost certainly collecting personal data. Don't, if you can help it. If you must, that same site has some general guidance on how to collect consent: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ Read there more info on how to comply with the data collection. Essentially, if it is personal data, you must give the person informed control over their data, including the ability to withdraw consent at any time, in which case you must delete it.
      - dotancohen 5y ago
        $ wc cookie-regs 4198 54871 354380 cookie-regs 54,000 words? Significant fines for non-compliance, even in the form of errors? And this is a legal spec, not a software spec, so there's no validating my implementation? And the terms are subject to possible change and different interpretations as one could get sued in any country? Or just put up the cookie notice and not worry.
        rendall 5y ago
        Dotan, I'm dropping into this thread after all that drama. I'm upset that you were insulted like that. That was unnecessary. Anyway, if you feel the need to implement a cookie pop-up to feel safe, I get it. The GDPR is really meant to protect users' rights to control their own data. If you implement that single principle in good faith, there won't be any gotcha moments where the EU cyber police fines you over some obscure clause in 50 thousand words of legalese. It's really the people who ignore or circumvent that principle who will be crushed. In my opinion, you will be serving your clients better if you take the time to understand the GDPR rather than annoying your client's users by cargo-culting UX from companies that are skirting or ignoring the law. If you do want to cargo-cult anyway, you could do worse than to crib from the EU website itself. Just saying. https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data...
        dotancohen 5y ago
        Thanks, but I don't mind the insult. Quite the opposite, I do think that those who display an inability or unwillingness to learn should be shunned from the profession. I should have invested the time to write a response that clarified my position that legal compliance should be taken liberally, rather than just declaring that I don't understand law. For what it's worth, I completely agree with the spirit of the GDPR and don't really have an issue with the implementation - it's far better than not having it.
        bryanrasmussen 5y ago
        >And the terms are subject to possible change and different interpretations as one could get sued in any country? Do you have examples of this? I mean the different interpretations meaning that one country could sue you for an implementation that was deemed fine in another one.
  - mattcwilson 5y ago
    StackOverflow and the StackExchange sites have one. Not sure how you define “sketchy sites” but the practice is pretty widespread among sites that are regularly linked on HN.
    - rendall 5y ago
      Not sure what you're getting at? I looked just now on StackOverflow in incognito and saw no obnoxious pop-up. Agreed. The practice is widespread among sites regularly linked on HN.
      - squeaky-clean 5y ago
        I get a popup every single time I visit Stackoverflow because I click reject all every time. Just checked again (not even incognito) and it's there. Your privacy By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. Accept all cookies Customize settings
      - rz2k 5y ago
        They are the worst of any collection of sites I regularly use. They take up a quarter of the screen, refuse to remember your opt out choices from day to day, regardless of whether you are signed in or not, and don't respect your choice when you go between different StackExchange communities.

dageshi 5y ago

Nobody is thinking about it that hard. Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side because throwing a plugin on that adds it is about a 2 minute job and actually figuring out if they need it requires a lot more work. Path of least resistance wins.

rendall 5y ago
> Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side... That's a pretty bold claim, even steel-manning it. I personally only ever see it on sketchy sites. If you're right, then it would just take a campaign of education to halve the annoyingness rate of the internet.
- dotancohen 5y ago
  OK, so where is this education? I've read this entire thread and I still don't know when I would need to prompt for cookies, or even if I need to prompt if I store everything serverside and id the visitors with a session token in URLs. There is no easy-to-understand definitive answer for the common use cases.
  - rendall 5y ago
    > I've read this entire thread and I still don't know when I would need to prompt for cookies... Well that's the problem, right there! You're reading random HN threads to get this information. Why not go to the source? https://ec.europa.eu/info/law/law-topic/data-protection_en https://ec.europa.eu/info/law/law-topic/data-protection_en The law itself is fairly easy to read and understand if you're a software developer. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1374-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Here is what looks to be pretty respectable commentary on when it triggers. Essentially, if you collect any sort of personal data whatsoever: https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/ If you store information that can identify the user, e.g. if you collate a user's IP address, you are almost certainly collecting personal data. Don't, if you can help it. If you must, that same site has some general guidance on how to collect consent: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ Read there more info on how to comply with the data collection. Essentially, if it is personal data, you must give the person informed control over their data, including the ability to withdraw consent at any time, in which case you must delete it.
    - dotancohen 5y ago
      $ wc cookie-regs 4198 54871 354380 cookie-regs 54,000 words? Significant fines for non-compliance, even in the form of errors? And this is a legal spec, not a software spec, so there's no validating my implementation? And the terms are subject to possible change and different interpretations as one could get sued in any country? Or just put up the cookie notice and not worry.
      - rendall 5y ago
        Dotan, I'm dropping into this thread after all that drama. I'm upset that you were insulted like that. That was unnecessary. Anyway, if you feel the need to implement a cookie pop-up to feel safe, I get it. The GDPR is really meant to protect users' rights to control their own data. If you implement that single principle in good faith, there won't be any gotcha moments where the EU cyber police fines you over some obscure clause in 50 thousand words of legalese. It's really the people who ignore or circumvent that principle who will be crushed. In my opinion, you will be serving your clients better if you take the time to understand the GDPR rather than annoying your client's users by cargo-culting UX from companies that are skirting or ignoring the law. If you do want to cargo-cult anyway, you could do worse than to crib from the EU website itself. Just saying. https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en https://ec.europa.eu/info/law/law-topic/data-protection/data...
        dotancohen 5y ago
        Thanks, but I don't mind the insult. Quite the opposite, I do think that those who display an inability or unwillingness to learn should be shunned from the profession. I should have invested the time to write a response that clarified my position that legal compliance should be taken liberally, rather than just declaring that I don't understand law. For what it's worth, I completely agree with the spirit of the GDPR and don't really have an issue with the implementation - it's far better than not having it.
      - bryanrasmussen 5y ago
        >And the terms are subject to possible change and different interpretations as one could get sued in any country? Do you have examples of this? I mean the different interpretations meaning that one country could sue you for an implementation that was deemed fine in another one.
- mattcwilson 5y ago
  StackOverflow and the StackExchange sites have one. Not sure how you define “sketchy sites” but the practice is pretty widespread among sites that are regularly linked on HN.
  - rendall 5y ago
    Not sure what you're getting at? I looked just now on StackOverflow in incognito and saw no obnoxious pop-up. Agreed. The practice is widespread among sites regularly linked on HN.
    - squeaky-clean 5y ago
      I get a popup every single time I visit Stackoverflow because I click reject all every time. Just checked again (not even incognito) and it's there. Your privacy By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. Accept all cookies Customize settings
    - rz2k 5y ago
      They are the worst of any collection of sites I regularly use. They take up a quarter of the screen, refuse to remember your opt out choices from day to day, regardless of whether you are signed in or not, and don't respect your choice when you go between different StackExchange communities.