4 ms·

This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by ha

This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by hand and then some more on the hidden "legitimate interest" page. Instead, EU websites will now be forced to buy their cookie management from EU providers who adhere to EU privacy laws. So in effect, they are merely putting more of the spirit of the GDPR into laws. And for US providers, they can always open up a local EU subsidy, implement the relevant regulations, and then sell their service to EU customers again. So this is specifically to allow people to circumvent the EU rules by using "I'm an US provider" as an excuse. Also, I like how they called out that transmitting the visitor's IP and referrer URL to a US service might enable them to build a profile which would be legal under US law and illegal under EU law. That's why they now block the transfer of the visitor's information out of the EU in the first place.

IMTDb 5y ago
> This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by hand and then some more on the hidden "legitimate interest" page. As a (EU) user, I hate all cookie management popups. And those aren't brought by evil US companies. They a forced by dumb law that tries to "protect" me. This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) and specifically mentions that having a single setting I can tweak is not OK. The amount of thought that has gone in the law to ensure that people are nagged on every. single. page. they. visit. and. that. there. is. no. way. to. shortcut. this. boring. and. useless. process. is maddening...
- detaro 5y ago
  And behind every nag is a company whose employees decided they'd rather you have the nag experience than not use tracking cookies or respect Do Not Track settings.
  - IMTDb 5y ago
    My "Do Not Track" setting is set to "Authorise Tracking". So companies are respecting that, but they have no choice to still nag me.
- ratww 5y ago
  They are not forced by law, they are actually entirely unnecessary, and the ones nagging you are probably not following the law, since GDPR says that saying "No" should be as easy as saying "Yes". There is a way to shortcut this: Do-Not-Track header. But nobody follows it. There is also GPC (https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/) but browsers need to implement it. There are also several other ad-hoc ways of shortcutting it, like third-party cookies, for example. But that cookie would only allow "shortcutting" the "no" answer, not the "yes". So companies simply don't implement it. There is also the possibility of not tracking at all. So the ball is entirely on the businesses' court. The law is fine actually. The only issue is that it's not strict enough.
- bmn__ 5y ago
  > there is no way to shortcut this boring and useless process This is false, automated refusal (or consent, if one swings that way) of tracking exists. https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic > This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) and specifically mentions that having a single setting I can tweak is not OK. This is also false. But humour me, where in the law does it say that? Concrete citation, please.
- Griffinsauce 5y ago
  > This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) No it does not. The company behind the website decided that nagging you is worth it to get your data. They have the very simple option to not track you and provide a better user experience, save you data, save you battery power, save you time and respect you. They don't. Sidenote: I did laugh at "dozens", I'd urge you to keep count for a day or two. If true you are a strong outlier.
  - jefftk 5y ago
    There are 27 unique domains on the front page of HN right now, ~14 of which I've never visited before. I expect many visitors of this site visit dozens of new domains per day.
- raxxorrax 5y ago
  This is because of a law, but also because nearly all commercial websites try to track you. I would be completely fine with forbidding it in any case and destroying a very parasitic advertising industry if the popup is too much.
luckylion 5y ago
> Instead, EU websites will now be forced to buy their cookie management from EU providers who adhere to EU privacy laws. This is simply false. Cookiebot is an EU provider. They're a danish company. The ruling is about providers not being able to use CDNs that are subsidaries of US companies, e.g. Akamai, Cloudflare, AWS, Azure.
jefftk 5y ago
> This disallows EU websites from using those US cookie management popups The cookie management pop up here was Danish. The problem was that they were using (the German affiliate of) Akamai for their CDN.

IMTDb 5y ago

> This disallows EU websites from using those US cookie management popups that users universally hate. You know, the ones where you have to un-tick 20 items by hand and then some more on the hidden "legitimate interest" page. As a (EU) user, I hate all cookie management popups. And those aren't brought by evil US companies. They a forced by dumb law that tries to "protect" me. This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) and specifically mentions that having a single setting I can tweak is not OK. The amount of thought that has gone in the law to ensure that people are nagged on every. single. page. they. visit. and. that. there. is. no. way. to. shortcut. this. boring. and. useless. process. is maddening...

detaro 5y ago
And behind every nag is a company whose employees decided they'd rather you have the nag experience than not use tracking cookies or respect Do Not Track settings.
- IMTDb 5y ago
  My "Do Not Track" setting is set to "Authorise Tracking". So companies are respecting that, but they have no choice to still nag me.
ratww 5y ago
They are not forced by law, they are actually entirely unnecessary, and the ones nagging you are probably not following the law, since GDPR says that saying "No" should be as easy as saying "Yes". There is a way to shortcut this: Do-Not-Track header. But nobody follows it. There is also GPC (https://globalprivacycontrol.github.io/gpc-spec/ https://globalprivacycontrol.github.io/gpc-spec/) but browsers need to implement it. There are also several other ad-hoc ways of shortcutting it, like third-party cookies, for example. But that cookie would only allow "shortcutting" the "no" answer, not the "yes". So companies simply don't implement it. There is also the possibility of not tracking at all. So the ball is entirely on the businesses' court. The law is fine actually. The only issue is that it's not strict enough.
bmn__ 5y ago
> there is no way to shortcut this boring and useless process This is false, automated refusal (or consent, if one swings that way) of tracking exists. https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://addons.mozilla.org/firefox/addon/consent-o-matic/ https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic > This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) and specifically mentions that having a single setting I can tweak is not OK. This is also false. But humour me, where in the law does it say that? Concrete citation, please.
Griffinsauce 5y ago
> This law specifically mentions that I need to be nagged for every single new domain I visit (dozens per day) No it does not. The company behind the website decided that nagging you is worth it to get your data. They have the very simple option to not track you and provide a better user experience, save you data, save you battery power, save you time and respect you. They don't. Sidenote: I did laugh at "dozens", I'd urge you to keep count for a day or two. If true you are a strong outlier.
- jefftk 5y ago
  There are 27 unique domains on the front page of HN right now, ~14 of which I've never visited before. I expect many visitors of this site visit dozens of new domains per day.
raxxorrax 5y ago
This is because of a law, but also because nearly all commercial websites try to track you. I would be completely fine with forbidding it in any case and destroying a very parasitic advertising industry if the popup is too much.

luckylion 5y ago

> Instead, EU websites will now be forced to buy their cookie management from EU providers who adhere to EU privacy laws. This is simply false. Cookiebot is an EU provider. They're a danish company. The ruling is about providers not being able to use CDNs that are subsidaries of US companies, e.g. Akamai, Cloudflare, AWS, Azure.

jefftk 5y ago

> This disallows EU websites from using those US cookie management popups The cookie management pop up here was Danish. The problem was that they were using (the German affiliate of) Akamai for their CDN.