3 ms·

I'm less likely to use a site that offers obnoxious cookie consent forms, and I think I'm better off without them. so yeah, it made the world better for me. My

I'm less likely to use a site that offers obnoxious cookie consent forms, and I think I'm better off without them. so yeah, it made the world better for me. My anger is directed towards the criminal websites that seek to circumvent the spirit of the law (most if the web today)

shadowgovt 5y ago
To my observation, there are no sites with more than a dram of content on them that haven't been compelled by GDPR compliance to put an obnoxious cookie banner up. If you've found some, please share.
- denton-scratch 5y ago
  If you need to set a cookie for the correct operation of your site, then you don't need a cookie banner. The banners are a middle-finger to the GDPR.
  - shadowgovt 5y ago
    ... but "correct operation of your site" is in the eye of a judge and can't be evaluated before someone brings suit, so "better safe than sorry" behavior (at the cost of user time) is completely predictable. ... It's not even clear that it's safe to log IP addresses in the style of a default Apache configuration on a static website without user consent.
    - denton-scratch 5y ago
      > completely predictable It's completely predictable that there are people who don't want to comply. Collecting personal information is a lucrative business. Re. Website logs: in fact it's perfectly clear that a website log retained for the purposes of site management is fine. It's on the face of the regulation.
      - shadowgovt 5y ago
        > It's on the face of the regulation. Right, collection for the purpose of running the site and all that. But does that mean "I run my site without having ever configured apache's HTTP access logs off the default, but I never read the logs" is fine? Because that sounds like collecting more PII (in the form of stored IP addresses) than is strictly needed to run the site. https://law.stackexchange.com/questions/42438/do-default-apache-logs-violate-the-gdpr https://law.stackexchange.com/questions/42438/do-default-apa... ... and that's the problem and the reason that it's probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner. Because the answer to that question is on the other side of a judge's ruling after a very expensive lawsuit. Better safe than sorry. The law, as written, has entirely too many "The resolution of that ambiguity is on the other side of a judge's ruling after a very expensive lawsuit" for people to have not predicted a million banners. The defaults of the most ancient tools we use to host websites are, under the GDPR, ambiguously compliant.
        denton-scratch 5y ago
        > probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner. I disagree. As far as I can see, GDPR enforcement is not heavy-handed. You get a warning before any attempt at enforcement; then you get a modest "warning" fine. Also, I'm not aware that the silly cookie banners provide any protection against GDPR enforcement; it's how you handle the data that matters, not a two-liner banner offering [OK] [Later] buttons. If you want to "be on the safe side", handling data correctly will help; cookie banners won't.
        shadowgovt 5y ago
        Handling data correctly may not be feasible, especially for smaller users on shared-hosting solutions. https://news.ycombinator.com/item?id=30402052 https://news.ycombinator.com/item?id=30402052 ... and again, the problem is "correctly" is in the eye of a judge after an alleged violation has occurred.

shadowgovt 5y ago

To my observation, there are no sites with more than a dram of content on them that haven't been compelled by GDPR compliance to put an obnoxious cookie banner up. If you've found some, please share.

denton-scratch 5y ago
If you need to set a cookie for the correct operation of your site, then you don't need a cookie banner. The banners are a middle-finger to the GDPR.
- shadowgovt 5y ago
  ... but "correct operation of your site" is in the eye of a judge and can't be evaluated before someone brings suit, so "better safe than sorry" behavior (at the cost of user time) is completely predictable. ... It's not even clear that it's safe to log IP addresses in the style of a default Apache configuration on a static website without user consent.
  - denton-scratch 5y ago
    > completely predictable It's completely predictable that there are people who don't want to comply. Collecting personal information is a lucrative business. Re. Website logs: in fact it's perfectly clear that a website log retained for the purposes of site management is fine. It's on the face of the regulation.
    - shadowgovt 5y ago
      > It's on the face of the regulation. Right, collection for the purpose of running the site and all that. But does that mean "I run my site without having ever configured apache's HTTP access logs off the default, but I never read the logs" is fine? Because that sounds like collecting more PII (in the form of stored IP addresses) than is strictly needed to run the site. https://law.stackexchange.com/questions/42438/do-default-apache-logs-violate-the-gdpr https://law.stackexchange.com/questions/42438/do-default-apa... ... and that's the problem and the reason that it's probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner. Because the answer to that question is on the other side of a judge's ruling after a very expensive lawsuit. Better safe than sorry. The law, as written, has entirely too many "The resolution of that ambiguity is on the other side of a judge's ruling after a very expensive lawsuit" for people to have not predicted a million banners. The defaults of the most ancient tools we use to host websites are, under the GDPR, ambiguously compliant.
      - denton-scratch 5y ago
        > probably wise for even site administrators who aren't doing advertising-related data collection to pop the banner. I disagree. As far as I can see, GDPR enforcement is not heavy-handed. You get a warning before any attempt at enforcement; then you get a modest "warning" fine. Also, I'm not aware that the silly cookie banners provide any protection against GDPR enforcement; it's how you handle the data that matters, not a two-liner banner offering [OK] [Later] buttons. If you want to "be on the safe side", handling data correctly will help; cookie banners won't.
        shadowgovt 5y ago
        Handling data correctly may not be feasible, especially for smaller users on shared-hosting solutions. https://news.ycombinator.com/item?id=30402052 https://news.ycombinator.com/item?id=30402052 ... and again, the problem is "correctly" is in the eye of a judge after an alleged violation has occurred.