5 ms·

> It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit

> It's a shame there aren't more big fines for shitty sites, like stackoverflow.com, that punish people who don't accept all cookies by prompting on every visit. Agreed. The way the EU has handled this is naive at best. > These large sites know exactly what they're doing. They're hoping people will become fed up enough to just accept, or they're hoping there'll be enough accidents where people click "Accept all". It's rather shitty. Yes, and there need to be new regulations to prevent them from doing this. Something like: (1) all web browsers should have a setting allowing users to accept or reject advertising/tracking cookies. (2) this must default to not accepting them. (3) in headers of http GET/POST requests, if the user allows advertising/tracking cookies, it should indicate this; if the user doesn't allow such cookies, it should be silent. (4) all websites would be forbidden from using advertising/tracking cookies unless explicitly permitted (5) all websites and web browsers would be banned from nagging the user or giving them a worse user experience for not allowing advertising/tracking cookies (6) The spirit of these regulations is that users need do nothing and they will automatically have a tracking-free experience; any work-around by companies attempting to find a loophole in this is a violation of the regulations. (7) Violation of any of the above would result in heavy fines; and if infractions continue, further crippling fines would be levied.

insomniacity 5y ago
Like https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track ?
joosters 5y ago
Agreed. The way the EU has handled this is naive at best. How so? The law is explicit that it should be just as easy to refuse the cookies as it is to accept them. Companies are ignoring the letter of the law anyway.
- danuker 5y ago
  By forcing every website to implement the same functionality for cookie prompts. They are legally enforcing the reinventing of the wheel. It could have been done at browser level, which would have been a relatively negligible cost of compliance.
  - foepys 5y ago
    The EU does not want to say how it has to be done. It's a bad idea to put something into law because changing the law is incredibly slow. They only do that when the market failed over a long time. See smartphone connectors where they will demand USB-C soon. When the news hit HN quite a few people were calling EU anti innovation.
    - PontifexMinimus 5y ago
      > The EU does not want to say how it has to be done. This is a massive loophole that the likes of Google can drive a coach and horses though. Doing it per website means that in practice 99% of web uses just press the "accept cookies" button without thinking.
    - jokethrowaway 5y ago
      Of course, demanding a specific format is the definition of being anti-innovation. Same with peddling with the web. They ruined the browsing experience for everyone and they're messing up with the market model of allowing people to sell their activity information in exchange for free stuff online. The advertising model is what made the web possible. The more restrictions you apply to how websites finance themselves the more you constrain the web to be built by big actors with money and stifle innovation.
  - Filligree 5y ago
    It could have been, and doing so would have been perfectly compliant. It's not the EU that made them not do that.
  - rendall 5y ago
    > By forcing every website to implement the same functionality for cookie prompts. Can you expand on that? If you mean the GDPR, my reading is that it is unlawful to collect identifiable user data without informed consent. If a website does not collect data, then no problem. If a website wants to collect data, it must ask permission and give control to the user over the data. How the website implements this is not mandated.
  - 5y ago
isbvhodnvemrwvn 5y ago
Accepting by automated means should not be an option. To accept processing of personal data you should be fully aware of the scope.
mmarq 5y ago
> Agreed. The way the EU has handled this is naive at best. The EU could have started fining everybody and unleash hell at unseen levels. They would have ended up bankrupting companies and people who added google analytics or AdWords to their site in good faith, without understanding the privacy implications. So the regulators initially notified companies and gave them time to implement whatever change they were required to. To this day, if they aren’t satisfied with the changes, they contact the company again, they don’t just issue fines. This happened to a company I used to work for, that initially just added a cookie banner, then was asked to make the “deny all” and “accept all” buttons of equal size and with equal accessibility.
- PontifexMinimus 5y ago
  > They would have ended up bankrupting companies and people who added google analytics or AdWords to their site in good faith, People who run websites really should know what they're doing, at least in broad strokes. > without understanding the privacy implications. Regarding Adwords, maybe the EU could've just mandated Google to serve ads based only on the web page and not on the visitor? That would've allowed websites to continue with minimal disruption. Google's profits might be a few billion less, but frankly I'd count that as a plus.
  - mmarq 5y ago
    > People who run websites really should know what they're doing, at least in broad strokes. You can't just change a law and start issuing fines as if everybody was a criminal. You need to allow time for people to adapt, especially the guy who set up his personal site, installed Google Analytics because everybody used to do that, and forgot about it. > Regarding Adwords, maybe the EU could've just mandated Google to serve ads based only on the web page and not on the visitor? That would've allowed websites to continue with minimal disruption. That would be a ban of targeted ads, which I'm all for, but it's not what GDPR is about.

insomniacity 5y ago

Like https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track ?

joosters 5y ago

Agreed. The way the EU has handled this is naive at best. How so? The law is explicit that it should be just as easy to refuse the cookies as it is to accept them. Companies are ignoring the letter of the law anyway.

danuker 5y ago
By forcing every website to implement the same functionality for cookie prompts. They are legally enforcing the reinventing of the wheel. It could have been done at browser level, which would have been a relatively negligible cost of compliance.
- foepys 5y ago
  The EU does not want to say how it has to be done. It's a bad idea to put something into law because changing the law is incredibly slow. They only do that when the market failed over a long time. See smartphone connectors where they will demand USB-C soon. When the news hit HN quite a few people were calling EU anti innovation.
  - PontifexMinimus 5y ago
    > The EU does not want to say how it has to be done. This is a massive loophole that the likes of Google can drive a coach and horses though. Doing it per website means that in practice 99% of web uses just press the "accept cookies" button without thinking.
  - jokethrowaway 5y ago
    Of course, demanding a specific format is the definition of being anti-innovation. Same with peddling with the web. They ruined the browsing experience for everyone and they're messing up with the market model of allowing people to sell their activity information in exchange for free stuff online. The advertising model is what made the web possible. The more restrictions you apply to how websites finance themselves the more you constrain the web to be built by big actors with money and stifle innovation.
- Filligree 5y ago
  It could have been, and doing so would have been perfectly compliant. It's not the EU that made them not do that.
- rendall 5y ago
  > By forcing every website to implement the same functionality for cookie prompts. Can you expand on that? If you mean the GDPR, my reading is that it is unlawful to collect identifiable user data without informed consent. If a website does not collect data, then no problem. If a website wants to collect data, it must ask permission and give control to the user over the data. How the website implements this is not mandated.
- 5y ago

isbvhodnvemrwvn 5y ago

Accepting by automated means should not be an option. To accept processing of personal data you should be fully aware of the scope.

mmarq 5y ago

> Agreed. The way the EU has handled this is naive at best. The EU could have started fining everybody and unleash hell at unseen levels. They would have ended up bankrupting companies and people who added google analytics or AdWords to their site in good faith, without understanding the privacy implications. So the regulators initially notified companies and gave them time to implement whatever change they were required to. To this day, if they aren’t satisfied with the changes, they contact the company again, they don’t just issue fines. This happened to a company I used to work for, that initially just added a cookie banner, then was asked to make the “deny all” and “accept all” buttons of equal size and with equal accessibility.

PontifexMinimus 5y ago
> They would have ended up bankrupting companies and people who added google analytics or AdWords to their site in good faith, People who run websites really should know what they're doing, at least in broad strokes. > without understanding the privacy implications. Regarding Adwords, maybe the EU could've just mandated Google to serve ads based only on the web page and not on the visitor? That would've allowed websites to continue with minimal disruption. Google's profits might be a few billion less, but frankly I'd count that as a plus.
- mmarq 5y ago
  > People who run websites really should know what they're doing, at least in broad strokes. You can't just change a law and start issuing fines as if everybody was a criminal. You need to allow time for people to adapt, especially the guy who set up his personal site, installed Google Analytics because everybody used to do that, and forgot about it. > Regarding Adwords, maybe the EU could've just mandated Google to serve ads based only on the web page and not on the visitor? That would've allowed websites to continue with minimal disruption. That would be a ban of targeted ads, which I'm all for, but it's not what GDPR is about.