15 ms·

It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit.

It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. If that's not bad enough, having an "Accept all" button but requiring another click to have the option of refusing, then making us manually select each category to turn off, then confirming, is certainly not symmetric. These large sites know exactly what they're doing. They're hoping people will become fed up enough to just accept, or they're hoping there'll be enough accidents where people click "Accept all". It's rather shitty.

jason-phillips 5y ago
> ...shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. Easy solution: UBlock Origin > eye dropper tool > highlight cookie div in lower left corner > click Create button I agree that they're very annoying.
pmontra 5y ago
I selected the cookie dialog with the element picker of uBlock Origin and made it go away forever.
- bunnythefifth 5y ago
  https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
  - mlatu 5y ago
    "In most cases, it just blocks or hides cookie related pop-ups. When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do). It doesn't delete cookies. "
  - pmontra 5y ago
    Thank you. I forgot to mention that I'm also using Cookie Autodelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... I whitelist the sites which I need cookies for.
Raqbit 5y ago
If someone doesn't accept cookies, how exactly would a site remember that the person did not accept cookies?
- EtienneK 5y ago
  IANAL: Essential cookies (cookies that are needed for the correct working of the website) do not require consent.
  - sgt 5y ago
    A lot of people don't know that, and default to annoying cookie popups regardless. How do we create awareness around that?
    - OJFord 5y ago
      Punish bad pop-ups, so people are wary of them ('wait is this bad') and discover (and find attractive) the possibility of not having one (can't be fined for a bad thing that doesn't exist) & network effects ('wait how do they have no pop-up')?
    - Nextgrid 5y ago
      A lot of people's salaries depend on pretending to not know that. Slight difference! ;)
  - undecisive 5y ago
    A lot of this depends on personal definition. If the site allows you to visit it, is it working incorrectly? If a site works correctly, but would work even better with a cookie, is that cookie essential? Obviously this isn't the way the lawmakers intended the law to be interpreted, but it is probably considered a valid interpretation of the law.
    - Cthulhu_ 5y ago
      It's not about cookies. The legislation and the consent popups are not about cookies. They're not even about whether they're essential. The banners are there for you to opt-in to your activity on the website and beyond to be tracked by a 3rd party, possibly across multiple other websites. We do not need to discuss whether a cookie is essential, because it's a red herring. It's not about cookies, it's about behavioural tracking, it's about your browser activity being sent to 3rd parties, being collated and used to e.g. serve you advertisements to sell you shit.
EtienneK 5y ago
Or just be like Github which has no cookie banner since they only use essential cookies.
- grishka 5y ago
  IIRC Stackoverflow has ads and thus all the nastiness that comes with them.
  - Vinnl 5y ago
    Note that ads don't inherently need tracking. DuckDuckGo has ads, but no cookie banner - what ad to show is based purely on what you're searching for (and some other ephemeral data, like your location, I assume).
  - maccard 5y ago
    Third party targeted ads require cookie consent. Untargetted ads that are contextual to stackoverflow would not.
    - andreareina 5y ago
      I don't know the specific implementation of stack exchange/overflow ads, but given the blatant disregard they've shown for the community I'm not expecting they've done the privacy-preserving thing
  - nkrisc 5y ago
    You don’t need cookies to show ads. Newspapers did it before the internet, no invasive tracking required.
    - hackerfromthefu 5y ago
      Dear god yes - this is the answer. Display ads aligned to content on the page and thats it.
      - 5y ago
acer4666 5y ago
That's not my experience with StackOverflow, as long as you allow necessary cookies. Refusing all cookies would of course cause a prompt on every visit, because that's what cookies are for.
- bspammer 5y ago
  Necessary cookies are allowed by default, no consent required.
- dx034 5y ago
  Saving the decision is an example of a cookie which is technically necessary, you can have those without consent. Consent and the option for opt-out is only needed for cookies that are not needed to run the page. You also don't need permission for session cookies.
  - acer4666 5y ago
    The problem is that, even though they're not obliged to, they give the option to opt out of necessary cookies alongside the tracking ones, and I guess people de-select necessary cookies because they think all cookies are bad. Then the site has no memory of the user, displays another pop-up, and people complain about constant pop-ups. In a sense, StackOverflow are giving users too much control over the cookies being set!
    - sam_goody 5y ago
      Yes, they are giving users too much control over the cookies being set. Same as a site that sends you spam, and one of the opt-out options includes ALL emails, including password reset, etc. Users get scared that they don't know what they will miss, and don't opt out. It gives them plausible deniability for the wrong, while pretending to look good. The result is commonly as OP described - users eventually opting in. But I don't believe it is innocent, nor do I believe that they somehow have convinced themselves that this is good for the user. Perhaps I am just cynical, but I think that there exists reasonable doubt.
  - 5y ago
hda2 5y ago
I was also negatively effected by stackoverflow's refusal to comply with the law until I blocked the pop up using ublock orgin. Users shouldn't be forced to do this but here we are. Hopefully every EU state fines these companies and continues to do so until they comply.
- Silhouette 5y ago
  For most sites I find not accepting persistent cookies at all and using a blocker to hide the prompts is sufficient. This avoids tracking (at least via cookies) whether the site is compliant or not. The nasty ones are the likes of Google's more recent interstitial, which you can't easily hide with a blocker even if you've chosen to disallow cookies through your browser settings anyway, and which also requires several clicks to turn everything off explicitly before continuing, and which then redirects to a link on a domain most ad blockers will intercept causing further hassle for the user to override. I'd have some sympathy for sites being put in a difficult position if visitors have disabled cookies entirely because putting up some sort of prompt on every visit if they need one is probably then required to comply with the letter of the law. But there's really no need for the obnoxious many-clicks-to-clear-it things like Google is doing and I don't believe for a moment that they weren't fully aware of the implications when they made the change.
- shukantpal 5y ago
  You really aren’t entitled to stackOverflow so you were never “forced”
  - hda2 5y ago
    True. Feel free to word it better but my main point still stands.
mehdix 5y ago
As the sibling comment mentions, Stackoverflow would not know you have refused to save cookies on your previous visit, so it displays the banner again. That's precisely how it should be. If they want to know you without a cookie, they have to store your browser fingerprint, UA, IP,and more. I guess, that's not what you'd want.
- viraptor 5y ago
  If it has to be asked every time, then it could be easily classified as essential functionality and allowed. The rules are about sharing private / identifiable information, not about preventing client-side storage from working.
  - mehdix 5y ago
    Thanks for mentioning client side storage, I had not considered that.
lvice 5y ago
> like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit Well, not sure if that's fair. Until you accept at least the "strictly necessary" cookies, it makes sense that you get prompted the consent at every visit, since no cookies are saved.
- skrebbel 5y ago
  it doesn't. there's no law against cookies, there's a law against tracking. you can perfectly well store the cookie banner consent choice in a cookie. EDIT: the reality is that it should actually be a "can we track you?" consent box. sites using the word "cookie" instead of "tracking" in the consent banner/popup are using technobabble to confuse you into just clicking "ok". users are not supposed to understand what it means. it hurts me deeply that even programmers, who do understand what cookies are, have seen these misleading cookie banners so often that they think that's what GDPR prescribes. it's not, it's a lie.
  - dmurray 5y ago
    > it doesn't. there's no law against cookies, there's a law against tracking. you can perfectly well store the cookie banner consent choice in a cookie...they think that's what GDPR prescribes. it's not, it's a lie. This is just wrong. The Cookie Law (ePrivacy Directive of 2002 and 2009) is distinct from the GDPR. It really is a law against unconsented cookies: not just "tracking" ones but also anything that stores the user's preference: anything not "strictly necessary for the delivery of a service requested by the user". That said, websites could certainly do a bit better here and give users a clear option of "I request a service delivered without the use of cookies, apart from the one necessary to remember this request". [0]https://gdpr.eu/cookies/?cn-reloaded=1 https://gdpr.eu/cookies/?cn-reloaded=1 [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
    - skrebbel 5y ago
      This is just FUD. Storing the cookie consent in a cookie is obviously "strictly necessary" if that's all you do with the cookie. Strictly necessary cookies do not, themselves, require consent. You're saying that without obtaining consent, you can't store the cookie consent preference which is a ridiculous catch 22 explicitly rejected by the first link you shared (which states that the consent choice must be stored)
gadders 5y ago
>> If that's not bad enough, having an "Accept all" button but requiring another click to have the option of refusing, then making us manually select each category to turn off, then confirming, is certainly not symmetric. I'm sure the code they use to do this is throttled. It certainly seems to run more slowly than the "Accept All" option.
- Cthulhu_ 5y ago
  That's another dark pattern that some sites use (used?), making the process of "storing your cookie preferences" take a long time - you see a spinner for a long time, while the 'accept and dismiss' button stays active and available throughout. It should be illegal. Not accepting cookies is the default and should be a no-op. Accepting cookies is the one that should take a while, since only then do all the 3rd party scripts load in and do their thing.
  - gadders 5y ago
    I completely agree. Making options that the site doesn't want take longer is unacceptable.
fabian2k 5y ago
I just tried that, and Stack Overflow clearly saves the consent preference and doesn't ask again. It also doesn't ask to select each category individually, if you go to "customize settings" all optional categories are off by default. The current consent dialog doesn't behave at all as you describe, I'm not sure if there were previous versions that behaved in a different way.
- ygra 5y ago
  Perhaps the confusion stems from that StackExchange sites will ask once per site (which makes sense, as they're all different domains). So I've now seen probably half a dozen of those dialogs on their sites.
  - teh_klev 5y ago
    I've experienced the same, each SE site prompting me for my consent.
- f6v 5y ago
  I swear, I’ve seen a dialog like a dozen times over the last couple months.
  - Spare_account 5y ago
    This happens to me, but mainly because of aggressive privacy settings on my Browser and my addons (uMatrix etc).
  - xiconfjs 5y ago
    can agree, same here with stackoverflow.com
  - zaphar 5y ago
    I don't see the behavior you describe on those sites so it suggests it's something unique to your setup. For instance: if your browser is set to clear cookies then they won't be able to store the preference for you and will have to prompt every time.
signal11 5y ago
The EU legislation that mandated cookie consent popups has to take some “credit” for this state of affairs though. Custom cookie-consent UI per website has limitations. After years of experiencing cookie popup hell, I’d say that a better way forward would be allowing users to configure their browsers to automatically communicate cookie preferences and consent, but regulators would have to work with the tech industry to make that happen. And meanwhile companies will keep inventing workarounds like FLoC to track users without cookies.
- Puts 5y ago
  There is no EU legislation that mandates cookie consent. In fact with the GDPR the old cookie-banner law that required you to inform of the usage of cookies was abolished. The cookie banners is the industries own perverted solution to the problem of asking for consent when there is no other legal basis for processing personal information.
- dmitriid 5y ago
  > The EU legislation that mandated cookie consent popups has to take some “credit” for this state of affairs though No it doesn't. Such cookie popups are illegal under GDPR. What credit should EU legislation take? EU has been too slow in hitting these sites with fines though.
  - tomcooks 5y ago
    They can barely get them to pay taxes, let alone pay fines. Give it time and keep on avoiding sites which break the law
  - signal11 5y ago
    I’m not sure they’re illegal. If they are, EU institutions should be taking action against ... themselves. https://ec.europa.eu/info/law/law-topic/data-protection_en https://ec.europa.eu/info/law/law-topic/data-protection_en > This site uses cookies to offer you a better browsing experience. Find out more on how we use cookies. > Accept all cookies > Accept only essential cookies https://www.europarl.europa.eu https://www.europarl.europa.eu > Dear visitor, We use analytics cookies to offer you a better browsing experience. You have the choice to refuse or accept them. > I refuse analytics cookies > I accept analytics cookies https://www.echr.coe.int https://www.echr.coe.int has a small, non-intrusive banner about at the bottom (good), but their cookie policy does say they “generate anonymous analytics such as the number of documents downloaded.” Hopefully that’s not per user — if so that’s pretty much best-practice. But clearly there’s a lot of variation even among EU institutions in how they approach cookie prompts.
bilekas 5y ago
Its no surprise that they are trying this tactic when it works so well for their terms & conditions that they write up. Agreed about the fines though, but it is good to see that it will be 100k a day for non compliance. The article only mentions France though, is that excluding all other EU countries then ?
Helmut10001 5y ago
A fun micro-task: Specifically for stackoverflow.com I created a php-script on my site [1] to live-include a sample-iframe in a python lecture [2], with removed noiframe-header/cookies/login. [1]: https://alexanderdunkel.com/iframe.php?url=https://stackoverflow.com/questions/5710867/downloading-and-unzipping-a-zip-file-without-writing-to-disk&noredirect=1 https://alexanderdunkel.com/iframe.php?url=https://stackover... [2]: https://ad.vgiscience.org/lbsm-python-lecture/#/5/7 https://ad.vgiscience.org/lbsm-python-lecture/#/5/7
PontifexMinimus 5y ago
> It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. Agreed. The way the EU has handled this is naive at best. > These large sites know exactly what they're doing. They're hoping people will become fed up enough to just accept, or they're hoping there'll be enough accidents where people click "Accept all". It's rather shitty. Yes, and there need to be new regulations to prevent them from doing this. Something like: (1) all web browsers should have a setting allowing users to accept or reject advertising/tracking cookies. (2) this must default to not accepting them. (3) in headers of http GET/POST requests, if the user allows advertising/tracking cookies, it should indicate this; if the user doesn't allow such cookies, it should be silent. (4) all websites would be forbidden from using advertising/tracking cookies unless explicitly permitted (5) all websites and web browsers would be banned from nagging the user or giving them a worse user experience for not allowing advertising/tracking cookies (6) The spirit of these regulations is that users need do nothing and they will automatically have a tracking-free experience; any work-around by companies attempting to find a loophole in this is a violation of the regulations. (7) Violation of any of the above would result in heavy fines; and if infractions continue, further crippling fines would be levied.
- insomniacity 5y ago
  Like https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track ?
- joosters 5y ago
  Agreed. The way the EU has handled this is naive at best. How so? The law is explicit that it should be just as easy to refuse the cookies as it is to accept them. Companies are ignoring the letter of the law anyway.
  - danuker 5y ago
    By forcing every website to implement the same functionality for cookie prompts. They are legally enforcing the reinventing of the wheel. It could have been done at browser level, which would have been a relatively negligible cost of compliance.
sameerds 5y ago
Does it work to just "accept all" every time, and then rely on ad blockers to actually keep the cookies out?
- Macha 5y ago
  Cookies are not the only way of tracking, and you've just indicated your consent to whatever server side fingerprinting the ad platforms might be doing, so I would say no.
nojs 5y ago
The solution is not to rely on fining site owners, the solution is to support user agents that act in the interests of the user. Regulation will never keep up with the infinite ways sites can be shitty, browsers (and extensions) are much better placed to do this.
- tsimionescu 5y ago
  There are far too many ways of tracking users, automated solutions just perpetuate a continuous escalation. Making the behavior illegal in itself, as the GDPR does in absence of explicit opt-in consent, is a much better solution over the long term.
hoppla 5y ago
And the joy of having to go through the list of “legitimate interest” that contains every tracker and advertisement platform, with no button to reject all
ajsnigrutin 5y ago
Yep... but the only question here is, will those tracking cookies (and in turn, advertising to those people) earn them more than 60/150mio. Otherwise, IMHO, the cookie prompts are a huge pain in the ass, and this should be dealt with client-side - eg., browsers silently accepting cookies, and wiping them on tab/window close, with a special button/toggle for that specific website, to save cookies for longer than that session (eg. if you want to log in or stay logged in). I know there are extensions that do this, but this should be the default in browsers everywhere.
dspillett 5y ago
> having an “Accept all” button but requiring another click to have the option of refusing, then making us manually select each category to turn off, then confirming, is certainly not symmetric That, and if there is a “reject all” button it is often only equivalent to flicking all the base check-boxes off, leaving their mirror “legitimate interest” options enabled. In fact, the “legitimate interest” checks irritate on their own: they basically say to me “we see your preference, but fuck you we still wanna”.
- kleiba 5y ago
  It's also an admittance that, apparently, all the other cookies that they would like to set constitute "illegitimate interests".
twistedpair 5y ago
Why isn't there a browser setting that passes a standard header to declare what types of cookies you consent to? You set it up _once_ for your browser and you're done.
- KennyBlanken 5y ago
  Because an advertising company pays the bills at Firefox and fully controls the predominant browser. Google's ultimate move however is killing cookies, so they can push their own concept of a supercookie that only they will be able to access.
- olliej 5y ago
  Because they tried it, and it was ignored. Anyone who actually worked on browser engines knew it was bullshit that the big internet advertisers (google, Facebook, etc) were using to deflect whichever privacy disaster was in the press at the time. The rule required DNT not be enabled by default. It was optional for advertisers to follow it, and it was very clear that if there was any significant population that enabled DNT the advertisers would start ignoring it. And they did. They went even further: they used the DNT state to to track users. Nothing like this on the client side has any value unless it is made illegal to ignore such flags, and that is actually enforced.
Nasreddin_Hodja 5y ago
> It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. Cookie banners should be made as much annoying as possible so that people hate it and begin to protest that law.
- nulbyte 5y ago
  > Cookie banners should be made as much annoying as possible so that people hate it and begin to protest that law. This is exactly what the advertising industry wants: You are confusing GDPR requirements with advertisers' malicious interpretations. GDPR doesn't require annoying your users; advertisers have chosen to require that all on their own.
  - Nasreddin_Hodja 5y ago
    > This is exactly what the advertising industry wants Ads never were problem unlike GDPR.
quitit 5y ago
I'd be pretty happy if regulators followed these all the way down into other operators (especially as uneven application of law tends to look a little like a shakedown.) It would do a lot for the internet in general. The business model of generated content + algorithmic ads made the internet a worse place to find information/purchase products/etc. These sites crowd out small, specialist and hobbyist websites in search results and don't usually provide the content they advertise. They exist to earn microcents per impression and use any trick possible to look like a legitimate search result. It's these websites which are the worst offenders - opting out of tracking is drawn out and they prompt with every visit. On the topic of cleaning up the crud - I also think search engines could play a better role here, as there are many sites that will turn up in just about any search request, despite not really having meaningful content (e.g. pinterest, amazon, etc.)
5350-uiop-1130 5y ago
trying to check something on the web today: >giant cookie popup takes up half the window >figure out how to reject and close it >another popup "allow this webshit to access your location" >close it >another popup "allow this webshit to send you notifications" >close it >another popup, allow this webshit to login using your google account >close it >another popup, autoplaying video, screeching into my ears at max volume >scroll for 5 mins to find what i'm looking for buried deep at the bottom (and its probably not even there)
solarkraft 5y ago
I usually dig through the shit sites do to reject. But Facebook, Google and previously TechCrunch are so bad I actually accept on a whim (in private tabs, of course). Each time wishing for a strong punishment since it's clearly illegal. Finally the regulators do something.
dgellow 5y ago
Moralising the topic doesn't help. Talking of punishment for showing a cookie notice is just plain ridiculous. Stackoverflow.com makes it very simple to opt-out, everything is unselected by default and the list of options is very short.

jason-phillips 5y ago

> ...shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. Easy solution: UBlock Origin > eye dropper tool > highlight cookie div in lower left corner > click Create button I agree that they're very annoying.

pmontra 5y ago

I selected the cookie dialog with the element picker of uBlock Origin and made it go away forever.

bunnythefifth 5y ago
https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- mlatu 5y ago
  "In most cases, it just blocks or hides cookie related pop-ups. When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do). It doesn't delete cookies. "
- pmontra 5y ago
  Thank you. I forgot to mention that I'm also using Cookie Autodelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... I whitelist the sites which I need cookies for.

Raqbit 5y ago

If someone doesn't accept cookies, how exactly would a site remember that the person did not accept cookies?

EtienneK 5y ago
IANAL: Essential cookies (cookies that are needed for the correct working of the website) do not require consent.
- sgt 5y ago
  A lot of people don't know that, and default to annoying cookie popups regardless. How do we create awareness around that?
  - OJFord 5y ago
    Punish bad pop-ups, so people are wary of them ('wait is this bad') and discover (and find attractive) the possibility of not having one (can't be fined for a bad thing that doesn't exist) & network effects ('wait how do they have no pop-up')?
  - Nextgrid 5y ago
    A lot of people's salaries depend on pretending to not know that. Slight difference! ;)
- undecisive 5y ago
  A lot of this depends on personal definition. If the site allows you to visit it, is it working incorrectly? If a site works correctly, but would work even better with a cookie, is that cookie essential? Obviously this isn't the way the lawmakers intended the law to be interpreted, but it is probably considered a valid interpretation of the law.
  - Cthulhu_ 5y ago
    It's not about cookies. The legislation and the consent popups are not about cookies. They're not even about whether they're essential. The banners are there for you to opt-in to your activity on the website and beyond to be tracked by a 3rd party, possibly across multiple other websites. We do not need to discuss whether a cookie is essential, because it's a red herring. It's not about cookies, it's about behavioural tracking, it's about your browser activity being sent to 3rd parties, being collated and used to e.g. serve you advertisements to sell you shit.

EtienneK 5y ago

Or just be like Github which has no cookie banner since they only use essential cookies.

grishka 5y ago
IIRC Stackoverflow has ads and thus all the nastiness that comes with them.
- Vinnl 5y ago
  Note that ads don't inherently need tracking. DuckDuckGo has ads, but no cookie banner - what ad to show is based purely on what you're searching for (and some other ephemeral data, like your location, I assume).
- maccard 5y ago
  Third party targeted ads require cookie consent. Untargetted ads that are contextual to stackoverflow would not.
  - andreareina 5y ago
    I don't know the specific implementation of stack exchange/overflow ads, but given the blatant disregard they've shown for the community I'm not expecting they've done the privacy-preserving thing
- nkrisc 5y ago
  You don’t need cookies to show ads. Newspapers did it before the internet, no invasive tracking required.
  - hackerfromthefu 5y ago
    Dear god yes - this is the answer. Display ads aligned to content on the page and thats it.
    - 5y ago

acer4666 5y ago

That's not my experience with StackOverflow, as long as you allow necessary cookies. Refusing all cookies would of course cause a prompt on every visit, because that's what cookies are for.

bspammer 5y ago
Necessary cookies are allowed by default, no consent required.
dx034 5y ago
Saving the decision is an example of a cookie which is technically necessary, you can have those without consent. Consent and the option for opt-out is only needed for cookies that are not needed to run the page. You also don't need permission for session cookies.
- acer4666 5y ago
  The problem is that, even though they're not obliged to, they give the option to opt out of necessary cookies alongside the tracking ones, and I guess people de-select necessary cookies because they think all cookies are bad. Then the site has no memory of the user, displays another pop-up, and people complain about constant pop-ups. In a sense, StackOverflow are giving users too much control over the cookies being set!
  - sam_goody 5y ago
    Yes, they are giving users too much control over the cookies being set. Same as a site that sends you spam, and one of the opt-out options includes ALL emails, including password reset, etc. Users get scared that they don't know what they will miss, and don't opt out. It gives them plausible deniability for the wrong, while pretending to look good. The result is commonly as OP described - users eventually opting in. But I don't believe it is innocent, nor do I believe that they somehow have convinced themselves that this is good for the user. Perhaps I am just cynical, but I think that there exists reasonable doubt.
- 5y ago

hda2 5y ago

I was also negatively effected by stackoverflow's refusal to comply with the law until I blocked the pop up using ublock orgin. Users shouldn't be forced to do this but here we are. Hopefully every EU state fines these companies and continues to do so until they comply.

Silhouette 5y ago
For most sites I find not accepting persistent cookies at all and using a blocker to hide the prompts is sufficient. This avoids tracking (at least via cookies) whether the site is compliant or not. The nasty ones are the likes of Google's more recent interstitial, which you can't easily hide with a blocker even if you've chosen to disallow cookies through your browser settings anyway, and which also requires several clicks to turn everything off explicitly before continuing, and which then redirects to a link on a domain most ad blockers will intercept causing further hassle for the user to override. I'd have some sympathy for sites being put in a difficult position if visitors have disabled cookies entirely because putting up some sort of prompt on every visit if they need one is probably then required to comply with the letter of the law. But there's really no need for the obnoxious many-clicks-to-clear-it things like Google is doing and I don't believe for a moment that they weren't fully aware of the implications when they made the change.
shukantpal 5y ago
You really aren’t entitled to stackOverflow so you were never “forced”
- hda2 5y ago
  True. Feel free to word it better but my main point still stands.

mehdix 5y ago

As the sibling comment mentions, Stackoverflow would not know you have refused to save cookies on your previous visit, so it displays the banner again. That's precisely how it should be. If they want to know you without a cookie, they have to store your browser fingerprint, UA, IP,and more. I guess, that's not what you'd want.

viraptor 5y ago
If it has to be asked every time, then it could be easily classified as essential functionality and allowed. The rules are about sharing private / identifiable information, not about preventing client-side storage from working.
- mehdix 5y ago
  Thanks for mentioning client side storage, I had not considered that.

lvice 5y ago

> like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit Well, not sure if that's fair. Until you accept at least the "strictly necessary" cookies, it makes sense that you get prompted the consent at every visit, since no cookies are saved.

skrebbel 5y ago
it doesn't. there's no law against cookies, there's a law against tracking. you can perfectly well store the cookie banner consent choice in a cookie. EDIT: the reality is that it should actually be a "can we track you?" consent box. sites using the word "cookie" instead of "tracking" in the consent banner/popup are using technobabble to confuse you into just clicking "ok". users are not supposed to understand what it means. it hurts me deeply that even programmers, who do understand what cookies are, have seen these misleading cookie banners so often that they think that's what GDPR prescribes. it's not, it's a lie.
- dmurray 5y ago
  > it doesn't. there's no law against cookies, there's a law against tracking. you can perfectly well store the cookie banner consent choice in a cookie...they think that's what GDPR prescribes. it's not, it's a lie. This is just wrong. The Cookie Law (ePrivacy Directive of 2002 and 2009) is distinct from the GDPR. It really is a law against unconsented cookies: not just "tracking" ones but also anything that stores the user's preference: anything not "strictly necessary for the delivery of a service requested by the user". That said, websites could certainly do a bit better here and give users a clear option of "I request a service delivered without the use of cookies, apart from the one necessary to remember this request". [0]https://gdpr.eu/cookies/?cn-reloaded=1 https://gdpr.eu/cookies/?cn-reloaded=1 [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
  - skrebbel 5y ago
    This is just FUD. Storing the cookie consent in a cookie is obviously "strictly necessary" if that's all you do with the cookie. Strictly necessary cookies do not, themselves, require consent. You're saying that without obtaining consent, you can't store the cookie consent preference which is a ridiculous catch 22 explicitly rejected by the first link you shared (which states that the consent choice must be stored)

gadders 5y ago

>> If that's not bad enough, having an "Accept all" button but requiring another click to have the option of refusing, then making us manually select each category to turn off, then confirming, is certainly not symmetric. I'm sure the code they use to do this is throttled. It certainly seems to run more slowly than the "Accept All" option.

Cthulhu_ 5y ago
That's another dark pattern that some sites use (used?), making the process of "storing your cookie preferences" take a long time - you see a spinner for a long time, while the 'accept and dismiss' button stays active and available throughout. It should be illegal. Not accepting cookies is the default and should be a no-op. Accepting cookies is the one that should take a while, since only then do all the 3rd party scripts load in and do their thing.
- gadders 5y ago
  I completely agree. Making options that the site doesn't want take longer is unacceptable.

fabian2k 5y ago

I just tried that, and Stack Overflow clearly saves the consent preference and doesn't ask again. It also doesn't ask to select each category individually, if you go to "customize settings" all optional categories are off by default. The current consent dialog doesn't behave at all as you describe, I'm not sure if there were previous versions that behaved in a different way.

ygra 5y ago
Perhaps the confusion stems from that StackExchange sites will ask once per site (which makes sense, as they're all different domains). So I've now seen probably half a dozen of those dialogs on their sites.
- teh_klev 5y ago
  I've experienced the same, each SE site prompting me for my consent.
f6v 5y ago
I swear, I’ve seen a dialog like a dozen times over the last couple months.
- Spare_account 5y ago
  This happens to me, but mainly because of aggressive privacy settings on my Browser and my addons (uMatrix etc).
- xiconfjs 5y ago
  can agree, same here with stackoverflow.com
- zaphar 5y ago
  I don't see the behavior you describe on those sites so it suggests it's something unique to your setup. For instance: if your browser is set to clear cookies then they won't be able to store the preference for you and will have to prompt every time.

signal11 5y ago

The EU legislation that mandated cookie consent popups has to take some “credit” for this state of affairs though. Custom cookie-consent UI per website has limitations. After years of experiencing cookie popup hell, I’d say that a better way forward would be allowing users to configure their browsers to automatically communicate cookie preferences and consent, but regulators would have to work with the tech industry to make that happen. And meanwhile companies will keep inventing workarounds like FLoC to track users without cookies.

Puts 5y ago
There is no EU legislation that mandates cookie consent. In fact with the GDPR the old cookie-banner law that required you to inform of the usage of cookies was abolished. The cookie banners is the industries own perverted solution to the problem of asking for consent when there is no other legal basis for processing personal information.
dmitriid 5y ago
> The EU legislation that mandated cookie consent popups has to take some “credit” for this state of affairs though No it doesn't. Such cookie popups are illegal under GDPR. What credit should EU legislation take? EU has been too slow in hitting these sites with fines though.
- tomcooks 5y ago
  They can barely get them to pay taxes, let alone pay fines. Give it time and keep on avoiding sites which break the law
- signal11 5y ago
  I’m not sure they’re illegal. If they are, EU institutions should be taking action against ... themselves. https://ec.europa.eu/info/law/law-topic/data-protection_en https://ec.europa.eu/info/law/law-topic/data-protection_en > This site uses cookies to offer you a better browsing experience. Find out more on how we use cookies. > Accept all cookies > Accept only essential cookies https://www.europarl.europa.eu https://www.europarl.europa.eu > Dear visitor, We use analytics cookies to offer you a better browsing experience. You have the choice to refuse or accept them. > I refuse analytics cookies > I accept analytics cookies https://www.echr.coe.int https://www.echr.coe.int has a small, non-intrusive banner about at the bottom (good), but their cookie policy does say they “generate anonymous analytics such as the number of documents downloaded.” Hopefully that’s not per user — if so that’s pretty much best-practice. But clearly there’s a lot of variation even among EU institutions in how they approach cookie prompts.

bilekas 5y ago

Its no surprise that they are trying this tactic when it works so well for their terms & conditions that they write up. Agreed about the fines though, but it is good to see that it will be 100k a day for non compliance. The article only mentions France though, is that excluding all other EU countries then ?

Helmut10001 5y ago

A fun micro-task: Specifically for stackoverflow.com I created a php-script on my site [1] to live-include a sample-iframe in a python lecture [2], with removed noiframe-header/cookies/login. [1]: https://alexanderdunkel.com/iframe.php?url=https://stackoverflow.com/questions/5710867/downloading-and-unzipping-a-zip-file-without-writing-to-disk&noredirect=1 https://alexanderdunkel.com/iframe.php?url=https://stackover... [2]: https://ad.vgiscience.org/lbsm-python-lecture/#/5/7 https://ad.vgiscience.org/lbsm-python-lecture/#/5/7

PontifexMinimus 5y ago

> It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. Agreed. The way the EU has handled this is naive at best. > These large sites know exactly what they're doing. They're hoping people will become fed up enough to just accept, or they're hoping there'll be enough accidents where people click "Accept all". It's rather shitty. Yes, and there need to be new regulations to prevent them from doing this. Something like: (1) all web browsers should have a setting allowing users to accept or reject advertising/tracking cookies. (2) this must default to not accepting them. (3) in headers of http GET/POST requests, if the user allows advertising/tracking cookies, it should indicate this; if the user doesn't allow such cookies, it should be silent. (4) all websites would be forbidden from using advertising/tracking cookies unless explicitly permitted (5) all websites and web browsers would be banned from nagging the user or giving them a worse user experience for not allowing advertising/tracking cookies (6) The spirit of these regulations is that users need do nothing and they will automatically have a tracking-free experience; any work-around by companies attempting to find a loophole in this is a violation of the regulations. (7) Violation of any of the above would result in heavy fines; and if infractions continue, further crippling fines would be levied.

insomniacity 5y ago
Like https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track ?
joosters 5y ago
Agreed. The way the EU has handled this is naive at best. How so? The law is explicit that it should be just as easy to refuse the cookies as it is to accept them. Companies are ignoring the letter of the law anyway.
- danuker 5y ago
  By forcing every website to implement the same functionality for cookie prompts. They are legally enforcing the reinventing of the wheel. It could have been done at browser level, which would have been a relatively negligible cost of compliance.

sameerds 5y ago

Does it work to just "accept all" every time, and then rely on ad blockers to actually keep the cookies out?

Macha 5y ago
Cookies are not the only way of tracking, and you've just indicated your consent to whatever server side fingerprinting the ad platforms might be doing, so I would say no.

nojs 5y ago

The solution is not to rely on fining site owners, the solution is to support user agents that act in the interests of the user. Regulation will never keep up with the infinite ways sites can be shitty, browsers (and extensions) are much better placed to do this.

tsimionescu 5y ago
There are far too many ways of tracking users, automated solutions just perpetuate a continuous escalation. Making the behavior illegal in itself, as the GDPR does in absence of explicit opt-in consent, is a much better solution over the long term.

hoppla 5y ago

And the joy of having to go through the list of “legitimate interest” that contains every tracker and advertisement platform, with no button to reject all

ajsnigrutin 5y ago

Yep... but the only question here is, will those tracking cookies (and in turn, advertising to those people) earn them more than 60/150mio. Otherwise, IMHO, the cookie prompts are a huge pain in the ass, and this should be dealt with client-side - eg., browsers silently accepting cookies, and wiping them on tab/window close, with a special button/toggle for that specific website, to save cookies for longer than that session (eg. if you want to log in or stay logged in). I know there are extensions that do this, but this should be the default in browsers everywhere.

dspillett 5y ago

> having an “Accept all” button but requiring another click to have the option of refusing, then making us manually select each category to turn off, then confirming, is certainly not symmetric That, and if there is a “reject all” button it is often only equivalent to flicking all the base check-boxes off, leaving their mirror “legitimate interest” options enabled. In fact, the “legitimate interest” checks irritate on their own: they basically say to me “we see your preference, but fuck you we still wanna”.

kleiba 5y ago
It's also an admittance that, apparently, all the other cookies that they would like to set constitute "illegitimate interests".

twistedpair 5y ago

Why isn't there a browser setting that passes a standard header to declare what types of cookies you consent to? You set it up _once_ for your browser and you're done.

KennyBlanken 5y ago
Because an advertising company pays the bills at Firefox and fully controls the predominant browser. Google's ultimate move however is killing cookies, so they can push their own concept of a supercookie that only they will be able to access.
olliej 5y ago
Because they tried it, and it was ignored. Anyone who actually worked on browser engines knew it was bullshit that the big internet advertisers (google, Facebook, etc) were using to deflect whichever privacy disaster was in the press at the time. The rule required DNT not be enabled by default. It was optional for advertisers to follow it, and it was very clear that if there was any significant population that enabled DNT the advertisers would start ignoring it. And they did. They went even further: they used the DNT state to to track users. Nothing like this on the client side has any value unless it is made illegal to ignore such flags, and that is actually enforced.

Nasreddin_Hodja 5y ago

> It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. Cookie banners should be made as much annoying as possible so that people hate it and begin to protest that law.

nulbyte 5y ago
> Cookie banners should be made as much annoying as possible so that people hate it and begin to protest that law. This is exactly what the advertising industry wants: You are confusing GDPR requirements with advertisers' malicious interpretations. GDPR doesn't require annoying your users; advertisers have chosen to require that all on their own.
- Nasreddin_Hodja 5y ago
  > This is exactly what the advertising industry wants Ads never were problem unlike GDPR.

quitit 5y ago

I'd be pretty happy if regulators followed these all the way down into other operators (especially as uneven application of law tends to look a little like a shakedown.) It would do a lot for the internet in general. The business model of generated content + algorithmic ads made the internet a worse place to find information/purchase products/etc. These sites crowd out small, specialist and hobbyist websites in search results and don't usually provide the content they advertise. They exist to earn microcents per impression and use any trick possible to look like a legitimate search result. It's these websites which are the worst offenders - opting out of tracking is drawn out and they prompt with every visit. On the topic of cleaning up the crud - I also think search engines could play a better role here, as there are many sites that will turn up in just about any search request, despite not really having meaningful content (e.g. pinterest, amazon, etc.)

5350-uiop-1130 5y ago

trying to check something on the web today: >giant cookie popup takes up half the window >figure out how to reject and close it >another popup "allow this webshit to access your location" >close it >another popup "allow this webshit to send you notifications" >close it >another popup, allow this webshit to login using your google account >close it >another popup, autoplaying video, screeching into my ears at max volume >scroll for 5 mins to find what i'm looking for buried deep at the bottom (and its probably not even there)

solarkraft 5y ago

I usually dig through the shit sites do to reject. But Facebook, Google and previously TechCrunch are so bad I actually accept on a whim (in private tabs, of course). Each time wishing for a strong punishment since it's clearly illegal. Finally the regulators do something.

dgellow 5y ago

Moralising the topic doesn't help. Talking of punishment for showing a cookie notice is just plain ridiculous. Stackoverflow.com makes it very simple to opt-out, everything is unselected by default and the list of options is very short.