4 ms·

I recently spent an inordinate amount of time implementing effective self-hosted cookie control (as in: actually deferring loading of offending scripts until af

I recently spent an inordinate amount of time implementing effective self-hosted cookie control (as in: actually deferring loading of offending scripts until after being accepted, and then loading and executing after being accepted without having to trigger a page reload) It would be absolutely asinine to assume that a layman could understand, much less implement the currently available solutions in an effective manner, so here are the two scenarios that small businesses are faced with: a) They still wanna make use of cookie powered tech and just do it without consent, which opens them up to legal trouble b) They don't do it and give up on functionality, which big biz will be able to provide, putting them at a disadvantage and making the web less democratic in the process once again. While I have no particular thoughts about the type of providers targeted here, I am certain that the last thing the current setup needs is additional complication.

tommek4077 5y ago
What functionality would that be? Anything else than targeted ads?
- jstummbillig 5y ago
  Whatever you want to use Cookies for. Analytics probably most of the time. I don't think small businesses typically run targeted ads on their own websites.
  - smarx007 5y ago
    I think that could actually be a problem. NOYB, a nonprofit GDPR watchdog in Austria, has firmly set its sights in enforcement on Google Analytics and Facebook/Twitter buttons because they are easy to remove. I think small mom&pop shops would have to go back to getting analytics via web server logs. Even small hosters like https://www.dogado.de/website/hosting https://www.dogado.de/website/hosting (wanted to actually link to CampusSpeicher but they seem to have been acquired) offer this (see under Highlights > Website-Statistiken). To be clear, NOYB allows 60 days after notification for removal (instead of 30 allowed by the law) before complaining to the national data protection agency and even then agencies rarely give out serious fines if you are ready to comply and did not grossly misuse the data, at least in Sweden: https://www.enforcementtracker.com https://www.enforcementtracker.com.
milicat 5y ago
Getting consent for functionality is pretty easy. EU data regulations specifically allow you to set cookies in a scenario that this enables functionality that would otherwise not be possible to provide to a user. Like a classic session cookie, for example. What's affected negatively is the UX for tracking and spying on users – and so it should be. If this forces companies out of business who rely on that for their business model, good.
- jstummbillig 5y ago
  As long as we are clear, that the businesses who can (and absolutely will) find the narrowest way around any legislation and continue to work in the slimmest legal margins are FANG and increasingly not your local businesses, cool. Everything tech and privacy is pretty easy looking from the HN ivory tower. Meanwhile half the world runs WP installations that date back to 2016 and can't change a paragraph on their "about us" page without contacting "the web guy".
  - ATsch 5y ago
    This whole "won't someone think of the small businesses" shtick is so transparent. I don't want "my" local businesses tracking me any more than the non local ones. I don't want a fiercely competitive market of data leeches any more than five big ones. Big tech can and should still be felled once the bulk of the weeds are chopped.
    - jstummbillig 5y ago
      > I don't want "my" local businesses tracking me any more than the non local ones. I get that. Seems we have a good news/bad news situation. The good news is that 99% of local businesses do no systematic privacy invasive tracking of anything, because they have no fucking clue how to do it. Really. That might be hard to believe in a crowd that is fluent in SQL JOINS but in the real world people look at a Google Analytics accounts and learn... well, round about nothing. It turns out that at small scale it's actually quite hard to invade peoples privacy in a way that you end up with positive ROI: You need enough data AND you need to be competent enough to analyze the data AND you need to be agile enough to act on your findings. You will be hard pressed to find local businesses that check even one of these boxes. So most privacy "invasion" at this level happens because people are bad with complicated stuff and also at dealing with increasingly complicated regulations, and privacy regulations check both boxes (despite HN claiming otherwise, but alas, the ivory tower strikes again). The bad news is that that is increasingly less relevant, because while the above is going on, the big businesses are exploiting any of the increasingly hard to catch openings and advancing their market position.
smarx007 5y ago
There is legitimate business concern. Amazon can collect my home address without consent (i.e. I type in my address but don't need to tick any consent checkbox; see [1]) and even pass it to DHL but without consent they can only use it to deliver me the package, not train ML models in the future. If you have a feature that needs data and the user understands the need AND the user themselves want to use the feature (excluding the legal acrobatics like FB claiming that users sign up to watch ads), you don't need consent (unless the data is biometric, which is another chapter in GDPR). [1] In fact, I try to use a lot of services without consent while providing my personal data. The trick is that I want to ensure it will ONLY be processed for a legitimate business need.
- jstummbillig 5y ago
  Absolutely. You will find that I was very specific about the unfairness these regulations impose on the ill equipped. Amazon is always going to find a way to work within the limits of whatever the EU throws at them. Begrudgingly, certainly, but eventually in strides, and with the confidence that an army of lawyers and other smart people does offer. They can even willingly chose to work outside of it, because heck, breaking the law is just another business expense. Your typical local mom and pop store is likely unaware of what the boundaries are, where they are, what it all means, how to implement any of it. They are mostly looking in horror at the incomprehensible monster that is GDPR. The point being: Restrictions on SaaS solutions are not gonna hit Amazon. Amazon does not need a SaaS cookie banner. They can have their own team that does nothing but build well tailored cookie banners for any country in the world and update them daily to whatever standards are required today. Alas, a small business can not. The rules are the same, and thus the burden is distributed incredibly unfairly.

tommek4077 5y ago

What functionality would that be? Anything else than targeted ads?

jstummbillig 5y ago
Whatever you want to use Cookies for. Analytics probably most of the time. I don't think small businesses typically run targeted ads on their own websites.
- smarx007 5y ago
  I think that could actually be a problem. NOYB, a nonprofit GDPR watchdog in Austria, has firmly set its sights in enforcement on Google Analytics and Facebook/Twitter buttons because they are easy to remove. I think small mom&pop shops would have to go back to getting analytics via web server logs. Even small hosters like https://www.dogado.de/website/hosting https://www.dogado.de/website/hosting (wanted to actually link to CampusSpeicher but they seem to have been acquired) offer this (see under Highlights > Website-Statistiken). To be clear, NOYB allows 60 days after notification for removal (instead of 30 allowed by the law) before complaining to the national data protection agency and even then agencies rarely give out serious fines if you are ready to comply and did not grossly misuse the data, at least in Sweden: https://www.enforcementtracker.com https://www.enforcementtracker.com.

milicat 5y ago

Getting consent for functionality is pretty easy. EU data regulations specifically allow you to set cookies in a scenario that this enables functionality that would otherwise not be possible to provide to a user. Like a classic session cookie, for example. What's affected negatively is the UX for tracking and spying on users – and so it should be. If this forces companies out of business who rely on that for their business model, good.

jstummbillig 5y ago
As long as we are clear, that the businesses who can (and absolutely will) find the narrowest way around any legislation and continue to work in the slimmest legal margins are FANG and increasingly not your local businesses, cool. Everything tech and privacy is pretty easy looking from the HN ivory tower. Meanwhile half the world runs WP installations that date back to 2016 and can't change a paragraph on their "about us" page without contacting "the web guy".
- ATsch 5y ago
  This whole "won't someone think of the small businesses" shtick is so transparent. I don't want "my" local businesses tracking me any more than the non local ones. I don't want a fiercely competitive market of data leeches any more than five big ones. Big tech can and should still be felled once the bulk of the weeds are chopped.
  - jstummbillig 5y ago
    > I don't want "my" local businesses tracking me any more than the non local ones. I get that. Seems we have a good news/bad news situation. The good news is that 99% of local businesses do no systematic privacy invasive tracking of anything, because they have no fucking clue how to do it. Really. That might be hard to believe in a crowd that is fluent in SQL JOINS but in the real world people look at a Google Analytics accounts and learn... well, round about nothing. It turns out that at small scale it's actually quite hard to invade peoples privacy in a way that you end up with positive ROI: You need enough data AND you need to be competent enough to analyze the data AND you need to be agile enough to act on your findings. You will be hard pressed to find local businesses that check even one of these boxes. So most privacy "invasion" at this level happens because people are bad with complicated stuff and also at dealing with increasingly complicated regulations, and privacy regulations check both boxes (despite HN claiming otherwise, but alas, the ivory tower strikes again). The bad news is that that is increasingly less relevant, because while the above is going on, the big businesses are exploiting any of the increasingly hard to catch openings and advancing their market position.

smarx007 5y ago

There is legitimate business concern. Amazon can collect my home address without consent (i.e. I type in my address but don't need to tick any consent checkbox; see [1]) and even pass it to DHL but without consent they can only use it to deliver me the package, not train ML models in the future. If you have a feature that needs data and the user understands the need AND the user themselves want to use the feature (excluding the legal acrobatics like FB claiming that users sign up to watch ads), you don't need consent (unless the data is biometric, which is another chapter in GDPR). [1] In fact, I try to use a lot of services without consent while providing my personal data. The trick is that I want to ensure it will ONLY be processed for a legitimate business need.

jstummbillig 5y ago
Absolutely. You will find that I was very specific about the unfairness these regulations impose on the ill equipped. Amazon is always going to find a way to work within the limits of whatever the EU throws at them. Begrudgingly, certainly, but eventually in strides, and with the confidence that an army of lawyers and other smart people does offer. They can even willingly chose to work outside of it, because heck, breaking the law is just another business expense. Your typical local mom and pop store is likely unaware of what the boundaries are, where they are, what it all means, how to implement any of it. They are mostly looking in horror at the incomprehensible monster that is GDPR. The point being: Restrictions on SaaS solutions are not gonna hit Amazon. Amazon does not need a SaaS cookie banner. They can have their own team that does nothing but build well tailored cookie banners for any country in the world and update them daily to whatever standards are required today. Alas, a small business can not. The rules are the same, and thus the burden is distributed incredibly unfairly.