5 ms·

Have the EU cookie regulations actually bring any measurable improvement to anything at all? The only effect I see is that now I have to go through hundreds of

Have the EU cookie regulations actually bring any measurable improvement to anything at all? The only effect I see is that now I have to go through hundreds of cookie related popups that include contracts, ToS and pages of legalese that will never be understood or even read by anyone. I was building a simple website for my team recently and the biggest problem I had was ensuring the compliance of cookies - I had to spend days reading through all kinds of laws and regulations only to eventually end up going through a "Cookie Policy Generator" which produced a 10-page legal text that I dont understand. Apparently I'm not the only one since there are a lot of business that offer "cookie policy management" as a service for companies. Here is the generator if anyone wants to try it out for themselves: https://www.activemind.de/datenschutz/generatoren/datenschutzerklaerung/ https://www.activemind.de/datenschutz/generatoren/datenschut...

changoplatanero 5y ago
I wish there was a browser settings where I can indicate that I want to automatically accept all cookies
- luckylion 5y ago
  There's "I don't care about cookies", a plugin that does essentially that and will just accept all cookies from the common consent platforms. https://addons.mozilla.org/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/firefox/addon/i-dont-care-about-c... https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...
MayeulC 5y ago
That's absolutely not the spirit of the law. I suggest you read an intro to the GDPR, or GDPR itself, which is quite approachable. In short: you shouldn't track the user, unless the user opts into it. Cookies are one of the many ways that can be used for tracking. There are other regulation pertaining to data retention, processing, etc. But since you focus on cookies, that's the gist of it. You don't have to ask permission to deposit a login cookie, since that's functional and non-tracking. Using that cookie to track across websites requires consent. Depositing a Google Analytics cookie requires consent. Any website that shows me a cookie popup screams "we want to track you! We collect data on your online behavior and sell it to third parties!"
- slowmotiony 5y ago
  Here is just a part of the legal text that I had to put in the webpage because I have a contact form. Honestly I don't even know if that's all I was supposed to include or if there were any updates to the articles, so at this point it might even be noncompliant and therefore illegal. Trust me I couldn't care less about your data, I just wanted a contact form without possibly getting sued. Contact form Type and purpose of the processing The data you enter are used for individual communication with you. A valid e-mail address and your name are required for this communication, which serves to organize your inquiry and the respective subsequent reply. Providing additional information is optional. Legal basis The processing of the data entered in the contact form occurs on the basis of a legitimate interest (Art. 6 Para. 1 (f) GDPR). By providing the contact form, our aim is to facilitate an uncomplicated means for you to contact us. The information you enter will be used to process the inquiry and saved for possible follow-up questions. If you contact us to request an offer, the processing of the information provided in the contact form will occur in order to implement pre-contractual measures (Art. 6 Para. 1 (b) GDPR). Recipients Recipients of the data may be processors. Retention period The data will be deleted no later than 6 months after processing the inquiry. Provided that we enter into a contract together, we will use the statutory retention periods in the German Commercial Code (Handelsgesetzbuch) and delete your data according to the respective stipulated deadlines. Mandatory or required provision The provision of your personal data is voluntary. However, we can only process your inquiry if you provide us with your name, e-mail address and the reason for your inquiry.
IMTDb 5y ago
> Have the EU cookie regulations actually bring any measurable improvement to anything at all ? As a user ? No. As a business ? I brought additional costs and risks, but didn't change anything in the data we collect. But some pencil pusher is convinced he made the world a better place, so there is that.
speedgoose 5y ago
There is not really a EU cookie regulation. I guess you think about GDPR. Then yes improving privacy is an improvement, at least from my point of view. About your strugglings, cookie compliance is extremely simple if you plan to not track your users. Technical cookies for sessions and application states are allowed without requesting user consent. So just respect your users.
realityking 5y ago
> Have the EU cookie regulations actually bring any measurable improvement to anything at all? We do see companies assessing whether certain cookies are actually needed, e.g. Cloudflare[0]. Also products advertise themselves as cookie-free[1]. That probably wouldn‘t have happened without legislation adding a lot of friction to having cookies. 0: https://blog.cloudflare.com/deprecating-cfduid-cookie/ https://blog.cloudflare.com/deprecating-cfduid-cookie/ 1: https://plausible.io/ https://plausible.io/
foxfluff 5y ago
You were building a simple website that tracks users or what? You can totally make a simple website with zero legalese and no cookie popups.
- slowmotiony 5y ago
  I used cookies to remember the language of the site. In addition i used one free webfont and added a contact form. That alone required me to put 3 pages worth of "security policy" which I am now legally responsible for.
- DocTomoe 5y ago
  Show me such a simple website that's more than a static website with your postal address on it, and I will show you which rope it provides me to hang you with thanks to EU web regulation.
mellavora 5y ago
I made a small website, and didn't use any cookies because what are they good for? But then I thought to add a 'cookie consent' banner anyway because people expect one.
- slowmotiony 5y ago
  I'm sorry is your question really "what are cookies good for"? Many things I would imagine, we've been using them for decades for a reason.
- Dave3of5 5y ago
  > because what are they good for? Session cookies i.e. allow you to login to a website.
Griffinsauce 5y ago
Did you consider not tracking your users?
- slowmotiony 5y ago
  Ah yes, it's that simple. Clearly using a webfont and putting an email contact form is "tracking my users".
  - m-s 5y ago
    You can host the webfont yourself. And an email contact form doesn’t require a cookie banner.
    - slowmotiony 5y ago
      Imagine would it be like if anyone could just use free webfonts or contact forms without consulting with their legal department. I can't even imagine it. Absolute chaos. It would be like living in the jungle. Thank heavens for the regulations and the countless lives they saved.
      - Griffinsauce 5y ago
        You seem to have misinterpreted my tone and are being very antagonistic in return. You _can_ do those things just fine, just like most companies are running horrible non-compliant cookie banners without consulting with legal.
dmitriid 5y ago
> Apparently I'm not the only one since there are a lot of business that offer "cookie policy management" as a service for companies. Those companies exist solely to prey on people who can't find their way to a site like gdpr.eu Let me give you all of the law you couldn't understand in simple statements: 1. you don't track your users by default. period. no consent is needed 2. you need to store some data about a user because that is crucial to the core functionality of the website (e.g., keep user logged in, keep a user's shopping cart etc.), then you can use those cookies, and those cookies alone, for that functionality, and that functionality alone. 2.2. Do not store personally identifiable data. If you do, you're liable for protecting and not leaking it. When a user requests this, you must delete al of that user's data 3. For literally everything else you have to ask the user's consent. If you were actually building a simple website, you could've stopped at 1.

changoplatanero 5y ago

I wish there was a browser settings where I can indicate that I want to automatically accept all cookies

luckylion 5y ago
There's "I don't care about cookies", a plugin that does essentially that and will just accept all cookies from the common consent platforms. https://addons.mozilla.org/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/firefox/addon/i-dont-care-about-c... https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...

MayeulC 5y ago

That's absolutely not the spirit of the law. I suggest you read an intro to the GDPR, or GDPR itself, which is quite approachable. In short: you shouldn't track the user, unless the user opts into it. Cookies are one of the many ways that can be used for tracking. There are other regulation pertaining to data retention, processing, etc. But since you focus on cookies, that's the gist of it. You don't have to ask permission to deposit a login cookie, since that's functional and non-tracking. Using that cookie to track across websites requires consent. Depositing a Google Analytics cookie requires consent. Any website that shows me a cookie popup screams "we want to track you! We collect data on your online behavior and sell it to third parties!"

slowmotiony 5y ago
Here is just a part of the legal text that I had to put in the webpage because I have a contact form. Honestly I don't even know if that's all I was supposed to include or if there were any updates to the articles, so at this point it might even be noncompliant and therefore illegal. Trust me I couldn't care less about your data, I just wanted a contact form without possibly getting sued. Contact form Type and purpose of the processing The data you enter are used for individual communication with you. A valid e-mail address and your name are required for this communication, which serves to organize your inquiry and the respective subsequent reply. Providing additional information is optional. Legal basis The processing of the data entered in the contact form occurs on the basis of a legitimate interest (Art. 6 Para. 1 (f) GDPR). By providing the contact form, our aim is to facilitate an uncomplicated means for you to contact us. The information you enter will be used to process the inquiry and saved for possible follow-up questions. If you contact us to request an offer, the processing of the information provided in the contact form will occur in order to implement pre-contractual measures (Art. 6 Para. 1 (b) GDPR). Recipients Recipients of the data may be processors. Retention period The data will be deleted no later than 6 months after processing the inquiry. Provided that we enter into a contract together, we will use the statutory retention periods in the German Commercial Code (Handelsgesetzbuch) and delete your data according to the respective stipulated deadlines. Mandatory or required provision The provision of your personal data is voluntary. However, we can only process your inquiry if you provide us with your name, e-mail address and the reason for your inquiry.

IMTDb 5y ago

> Have the EU cookie regulations actually bring any measurable improvement to anything at all ? As a user ? No. As a business ? I brought additional costs and risks, but didn't change anything in the data we collect. But some pencil pusher is convinced he made the world a better place, so there is that.

speedgoose 5y ago

There is not really a EU cookie regulation. I guess you think about GDPR. Then yes improving privacy is an improvement, at least from my point of view. About your strugglings, cookie compliance is extremely simple if you plan to not track your users. Technical cookies for sessions and application states are allowed without requesting user consent. So just respect your users.

realityking 5y ago

> Have the EU cookie regulations actually bring any measurable improvement to anything at all? We do see companies assessing whether certain cookies are actually needed, e.g. Cloudflare[0]. Also products advertise themselves as cookie-free[1]. That probably wouldn‘t have happened without legislation adding a lot of friction to having cookies. 0: https://blog.cloudflare.com/deprecating-cfduid-cookie/ https://blog.cloudflare.com/deprecating-cfduid-cookie/ 1: https://plausible.io/ https://plausible.io/

foxfluff 5y ago

You were building a simple website that tracks users or what? You can totally make a simple website with zero legalese and no cookie popups.

slowmotiony 5y ago
I used cookies to remember the language of the site. In addition i used one free webfont and added a contact form. That alone required me to put 3 pages worth of "security policy" which I am now legally responsible for.
DocTomoe 5y ago
Show me such a simple website that's more than a static website with your postal address on it, and I will show you which rope it provides me to hang you with thanks to EU web regulation.

mellavora 5y ago

I made a small website, and didn't use any cookies because what are they good for? But then I thought to add a 'cookie consent' banner anyway because people expect one.

slowmotiony 5y ago
I'm sorry is your question really "what are cookies good for"? Many things I would imagine, we've been using them for decades for a reason.
Dave3of5 5y ago
> because what are they good for? Session cookies i.e. allow you to login to a website.

Griffinsauce 5y ago

Did you consider not tracking your users?

slowmotiony 5y ago
Ah yes, it's that simple. Clearly using a webfont and putting an email contact form is "tracking my users".
- m-s 5y ago
  You can host the webfont yourself. And an email contact form doesn’t require a cookie banner.
  - slowmotiony 5y ago
    Imagine would it be like if anyone could just use free webfonts or contact forms without consulting with their legal department. I can't even imagine it. Absolute chaos. It would be like living in the jungle. Thank heavens for the regulations and the countless lives they saved.
    - Griffinsauce 5y ago
      You seem to have misinterpreted my tone and are being very antagonistic in return. You _can_ do those things just fine, just like most companies are running horrible non-compliant cookie banners without consulting with legal.

dmitriid 5y ago

> Apparently I'm not the only one since there are a lot of business that offer "cookie policy management" as a service for companies. Those companies exist solely to prey on people who can't find their way to a site like gdpr.eu Let me give you all of the law you couldn't understand in simple statements: 1. you don't track your users by default. period. no consent is needed 2. you need to store some data about a user because that is crucial to the core functionality of the website (e.g., keep user logged in, keep a user's shopping cart etc.), then you can use those cookies, and those cookies alone, for that functionality, and that functionality alone. 2.2. Do not store personally identifiable data. If you do, you're liable for protecting and not leaking it. When a user requests this, you must delete al of that user's data 3. For literally everything else you have to ask the user's consent. If you were actually building a simple website, you could've stopped at 1.