17 ms·

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I s

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

rsstack 5y ago
https://en.wikipedia.org/wiki/Desuetude https://en.wikipedia.org/wiki/Desuetude Three years later, randomly enforced and generally ignored: should GDPR-for-anonymous-browsing be regarded as obsolete by the EU's courts?
throwaway_sb666 5y ago
> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?
- whatshisface 5y ago
  What's the definition of minimum cookies?
  - robin_reala 5y ago
    Obviously there’s no definition, but I’d say a reasonable baseline is when a user expects a stateful interaction on the stateless medium that is the web. So for example, a multistage checkout process.
  - throwaway_sb666 5y ago
    Those that don't require opt-out according to the law. Too lazy to look up the legal definition right now. Edit: by law I mean the GDPR. Edit2: Get rid of the "cookie banner law" entirely, actually make it illegal, but require easily found links to privacy statement
  - andai 5y ago
    Necessary site functionality, without the spyware. Unfortunately, most websites sites are funded by spyware, so the minimum cookies to keep the internet economy running would have to include the spyware.
    - deleted 5y ago
      [deleted]
    - throwaway_sb666 5y ago
      Disagree. Let it burn, it's the only way. (change my mind?) This made me think of the Ukraine war, and how the sanctions may turn out to be a bigger help to climate crisis than any political entity could muster on the basis of the impeding climate snafu. Sometimes radical action is the right course of action; for democracy-(pre)serving reasons our governance systems often inhibit change unless most of the population is rallied around a specific cause as we see with Ukraine. That is the time for radical change to happen, or democracies would never progress. End of sidetrack :) EDIT: I mean, Strong agree with "Necessary site functionality, without the spyware. ", but disagree with last part
      - andai 5y ago
        I was just asserting out that a law that banned spyware-based advertising would harm the current website ecomomy which is largely based around spyware. I would like to see an end to mass spying, and therefore the creation of a different kind of funding mechanism. That could indeed be brought about by law, but that seems a bit too violent to me. I think what we're missing is a better alternative. I read an interesting article (from the mid 2000s? Will update if I can find it) arguing that microtransactions will never work due to the cognitive burden of paying for hundreds (or thousands!) of tiny things a day. Brave's BAT seems to solve this part of the problem by automating the payments based on how much time the user spends on each site. It would require everyone to switch to Brave and use their crypto thing to make it work, so it's obviously "suboptimal".
        throwaway_sb666 5y ago
  - zeruch 5y ago
    As close to none as possible.
    - zelphirkalt 5y ago
      And, to make it even more precise, I would call cookies, which are for login, also as non-essential, unless a visitor really wants to log in, meaning they navigate to the login page. This means, that be default, I don't need any cookies, because I don't want to log in to most websites I visit. Only if I want to log in, I have need for such cookies.
      - zeruch 5y ago
        ...hit the nail on the head. By 'as close to none' I pretty much meant "any cookie that isn't about authentication and/or holding state of something as an authenticated user that would matter"
  - teawrecks 5y ago
    For each cookie present, an independent third party expert would be willing to testify that the cookie is required in order for the website to operate as the user expects.
- rcgs 5y ago
  As much as this may really damage the sector I work in, I’d cherish the clarity a stance like this could provide. There are many businesses trying to be compliant whilst maintaining access to metrics their business depends on. Compliance is very difficult at this time as the legal advice is shifting in different territories and there is conflicting guidance when you start to dig into it. Id rather see a selection of activities and tactics entirely banned/regulated rather than this directive which is clearly too open to interpretation.
  - throwaway_sb666 5y ago
    Appreciate the sentiment. Policy changes will probably always hurt somebody. The expectation is the the economy will realign around new goals. In this case it's even simpler since a software company would like be able to develop a new product with hopefully more value to society than the vast majority of data collecting companies provide. I'm also not too afraid for tech workers being able to find other jobs, although I'm sorry for any other collateral damage.
- zauguin 5y ago
  Isn't this already the case? Does anyone actually think that you give voluntary informed consent to something by being annoyed into pressing a button? No, if you show a cookie banner your users do not opt-in. So a cookie banner is pointless since it doesn't actually give you permission to store cookies you couldn't store before. So we already have the law, we just don't enforce it.
  - throwaway_sb666 5y ago
    I agree that a cookie banner is pointless. But they are even on government websites, so obviously something has gone terribly wrong along they way (hint: lobbyism). My thinking goes like this: 1. The law explicitly talks of requesting consent. 2. Incentives will drive actors to request additional permissions if possible (you always get some legal, can claim ignorance, etc) 3. People get constant intrusions wasting our collective time and attention on an enormous scale. The current law is encouraging this type of user-hostile behavior. This is stating an objective fact, since the current situation is clearly a result of the current law. If any type of consent-banner or opt-in method is allowed, industry groups will lobby for loopholes they can use to trick users using whatever mechanism the law leaves at their disposal. Just outright ban the use of cross-site tracking and user profiling. We don't have a societal need for this to be legal.
    - anaccountexists 5y ago
      The most common use of “tracking” cookies is just to be able to count unique views for your site, which I think is a perfectly reasonable thing to want to do. Knowing the impact of your site is something pretty much every website producer (including governments, individuals, and businesses) wants to do. Other examples of where cross-site tracking is useful is for preventing online payments fraud. You have a similar IRL version of this where your bank will freeze your card if it sees purchases being made in different countries simultaneously. Somewhere along the line, counting views or helping reduce fraud for customers turned into “store full demographic information about someone who never signed up for our service”, which is where everything went wrong in my mind. The cookies themselves aren’t the problem, it’s how they’re being used.
goodpoint 5y ago
> Did we consider that if everyone is breaking the law, the law itself might need a rework? No, GDPR is doing tons of good works. The whole web is a privacy and security nightmare and we've been tolerating this mess long enough. Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR. The reality is that 99% of websites need zero cookies, zero popups and no logging of IP addresses. The ones requiring login can set a login cookie without pestering the user.
- robin_reala 5y ago
  Exactly, everyone’s still breaking the law, but it’s not a binary thing. They’re breaking the law much less now, and they’re being much better about documenting the ways in which they’re breaking it than they were previously.
- aidos 5y ago
  Sure, but you have to also accept that there are aspects that have made the internet a worse experience without actually improving the situation from a privacy point of view.
  - mpweiher 5y ago
    Yes, there are aspects that have gotten worse, but all those aspects are companies breaking the law in question. And no, privacy actually is improving. And enforcement is ramping up. We still have a way to go, but we're moving in the right direction.
  - Nextgrid 5y ago
    To be fair, the GDPR does outlaw all the things we find annoying with the cookie banners (or rather, data processing consent flows, as they cover more than just cookies). The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead people into hating the GDPR. This problem would be resolved overnight (and everyone's privacy increased by orders of magnitude, since spyware would become illegal again) if those fines actually started coming down.
oefrha 5y ago
It’s a conference submission. It’s not like the authors are responsible for or affiliated with the usenix.org website. It wouldn’t be ironic if I published a GitHub UI dark patterns study on github.com.
geon 5y ago
The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality. You can not use them to track users on third party sites, or store personally identifiable info without explicit consent, and in that case, denying consent should be as easy, and not affect other functionality, such as blocking content.
- lp0_on_fire 5y ago
  > developers misunderstand it. Then maybe the law needs some adjusting to make compliance more manageable.
  - Teever 5y ago
    Why? maybe developers beed some adjusting to make compliance numbers higher.
    - lp0_on_fire 5y ago
      Because GDPR has been around for a few years and its still unmanageable. Laws need to be realistic to make compliance easy and widespread. Maybe there needs to be resources for training or something. There are lots of things you can tweak while still getting the benefits.
      - LordDragonfang 5y ago
        Compliance is easy and manageable, for the most part. It's just that companies want to still do the things the law is trying to disincentivize, and want to put as many dark patterns as they can in the way of users avoiding it. So the "unmanageable" part is trying to figure out how close you can come to breaking the law without being blatant.
  - krageon 5y ago
isodev 5y ago
> Did we consider that if everyone is breaking the law, the law itself might need a rework? I think GDPR assumed companies would like to do right by their visitors. I guess the only way to do that is to increase the severity of the consequences for violating user trust. GDPR itself offers a guideline that many seem to misunderstand... you don't need a popup for every kind of cookie. I'm not against enforcing minimal tracking as default, and opting into cookies should be similar to going through a purchase flow... because it is one, just using "data" as a currency. So yes, convince me to click the "Buy cookies" button.
- LordDragonfang 5y ago
  >GDPR itself offers a guideline that many seem to misunderstand... you don't need a popup for every kind of cookie. Cookie banners predate the GDPR, most of them are from the "cookie law"[1] that predates it. They're two entirely separate laws that don't supercede each other. [1] https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communications_Directive_2002 https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
- Ekaros 5y ago
  The possible consequences are already sever enough. It is just that enforcement is either underfunded or not taking active enough action.
alkonaut 5y ago
> Did we consider that if everyone is breaking the law, the law itself might need a rework? The law is fine, the enforcement is not. If the enforcement had any teeth, then people wouldn't be breaking it. So long as managers try to get away with dark patterns rather than just take their business off the internet, the penalties are clearly not stiff enough. But I'm fine with this taking a few years to get in place. It's better to ramp up penalties once the law has matured a bit, than to have the kind of business-ending penalties I'd like to see, for a very new law.

rsstack 5y ago

https://en.wikipedia.org/wiki/Desuetude https://en.wikipedia.org/wiki/Desuetude Three years later, randomly enforced and generally ignored: should GDPR-for-anonymous-browsing be regarded as obsolete by the EU's courts?

throwaway_sb666 5y ago

> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?

whatshisface 5y ago
What's the definition of minimum cookies?
- robin_reala 5y ago
  Obviously there’s no definition, but I’d say a reasonable baseline is when a user expects a stateful interaction on the stateless medium that is the web. So for example, a multistage checkout process.
- throwaway_sb666 5y ago
  Those that don't require opt-out according to the law. Too lazy to look up the legal definition right now. Edit: by law I mean the GDPR. Edit2: Get rid of the "cookie banner law" entirely, actually make it illegal, but require easily found links to privacy statement
- andai 5y ago
  Necessary site functionality, without the spyware. Unfortunately, most websites sites are funded by spyware, so the minimum cookies to keep the internet economy running would have to include the spyware.
  - deleted 5y ago
    [deleted]
  - throwaway_sb666 5y ago
    Disagree. Let it burn, it's the only way. (change my mind?) This made me think of the Ukraine war, and how the sanctions may turn out to be a bigger help to climate crisis than any political entity could muster on the basis of the impeding climate snafu. Sometimes radical action is the right course of action; for democracy-(pre)serving reasons our governance systems often inhibit change unless most of the population is rallied around a specific cause as we see with Ukraine. That is the time for radical change to happen, or democracies would never progress. End of sidetrack :) EDIT: I mean, Strong agree with "Necessary site functionality, without the spyware. ", but disagree with last part
    - andai 5y ago
      I was just asserting out that a law that banned spyware-based advertising would harm the current website ecomomy which is largely based around spyware. I would like to see an end to mass spying, and therefore the creation of a different kind of funding mechanism. That could indeed be brought about by law, but that seems a bit too violent to me. I think what we're missing is a better alternative. I read an interesting article (from the mid 2000s? Will update if I can find it) arguing that microtransactions will never work due to the cognitive burden of paying for hundreds (or thousands!) of tiny things a day. Brave's BAT seems to solve this part of the problem by automating the payments based on how much time the user spends on each site. It would require everyone to switch to Brave and use their crypto thing to make it work, so it's obviously "suboptimal".
      - throwaway_sb666 5y ago
- zeruch 5y ago
  As close to none as possible.
  - zelphirkalt 5y ago
    And, to make it even more precise, I would call cookies, which are for login, also as non-essential, unless a visitor really wants to log in, meaning they navigate to the login page. This means, that be default, I don't need any cookies, because I don't want to log in to most websites I visit. Only if I want to log in, I have need for such cookies.
    - zeruch 5y ago
      ...hit the nail on the head. By 'as close to none' I pretty much meant "any cookie that isn't about authentication and/or holding state of something as an authenticated user that would matter"
- teawrecks 5y ago
  For each cookie present, an independent third party expert would be willing to testify that the cookie is required in order for the website to operate as the user expects.
rcgs 5y ago
As much as this may really damage the sector I work in, I’d cherish the clarity a stance like this could provide. There are many businesses trying to be compliant whilst maintaining access to metrics their business depends on. Compliance is very difficult at this time as the legal advice is shifting in different territories and there is conflicting guidance when you start to dig into it. Id rather see a selection of activities and tactics entirely banned/regulated rather than this directive which is clearly too open to interpretation.
- throwaway_sb666 5y ago
  Appreciate the sentiment. Policy changes will probably always hurt somebody. The expectation is the the economy will realign around new goals. In this case it's even simpler since a software company would like be able to develop a new product with hopefully more value to society than the vast majority of data collecting companies provide. I'm also not too afraid for tech workers being able to find other jobs, although I'm sorry for any other collateral damage.
zauguin 5y ago
Isn't this already the case? Does anyone actually think that you give voluntary informed consent to something by being annoyed into pressing a button? No, if you show a cookie banner your users do not opt-in. So a cookie banner is pointless since it doesn't actually give you permission to store cookies you couldn't store before. So we already have the law, we just don't enforce it.
- throwaway_sb666 5y ago
  I agree that a cookie banner is pointless. But they are even on government websites, so obviously something has gone terribly wrong along they way (hint: lobbyism). My thinking goes like this: 1. The law explicitly talks of requesting consent. 2. Incentives will drive actors to request additional permissions if possible (you always get some legal, can claim ignorance, etc) 3. People get constant intrusions wasting our collective time and attention on an enormous scale. The current law is encouraging this type of user-hostile behavior. This is stating an objective fact, since the current situation is clearly a result of the current law. If any type of consent-banner or opt-in method is allowed, industry groups will lobby for loopholes they can use to trick users using whatever mechanism the law leaves at their disposal. Just outright ban the use of cross-site tracking and user profiling. We don't have a societal need for this to be legal.
  - anaccountexists 5y ago
    The most common use of “tracking” cookies is just to be able to count unique views for your site, which I think is a perfectly reasonable thing to want to do. Knowing the impact of your site is something pretty much every website producer (including governments, individuals, and businesses) wants to do. Other examples of where cross-site tracking is useful is for preventing online payments fraud. You have a similar IRL version of this where your bank will freeze your card if it sees purchases being made in different countries simultaneously. Somewhere along the line, counting views or helping reduce fraud for customers turned into “store full demographic information about someone who never signed up for our service”, which is where everything went wrong in my mind. The cookies themselves aren’t the problem, it’s how they’re being used.

goodpoint 5y ago

> Did we consider that if everyone is breaking the law, the law itself might need a rework? No, GDPR is doing tons of good works. The whole web is a privacy and security nightmare and we've been tolerating this mess long enough. Many companies are engaging in malicious compliance by annoying users with popups and push the blame onto GDPR. The reality is that 99% of websites need zero cookies, zero popups and no logging of IP addresses. The ones requiring login can set a login cookie without pestering the user.

robin_reala 5y ago
Exactly, everyone’s still breaking the law, but it’s not a binary thing. They’re breaking the law much less now, and they’re being much better about documenting the ways in which they’re breaking it than they were previously.
aidos 5y ago
Sure, but you have to also accept that there are aspects that have made the internet a worse experience without actually improving the situation from a privacy point of view.
- mpweiher 5y ago
  Yes, there are aspects that have gotten worse, but all those aspects are companies breaking the law in question. And no, privacy actually is improving. And enforcement is ramping up. We still have a way to go, but we're moving in the right direction.
- Nextgrid 5y ago
  To be fair, the GDPR does outlaw all the things we find annoying with the cookie banners (or rather, data processing consent flows, as they cover more than just cookies). The problem is continuous lack of enforcement and distinct lack of billion-dollar fines everyone was fear mongering about, which allows companies to passively-aggressively pretend to comply by making their banners annoying on purpose to mislead people into hating the GDPR. This problem would be resolved overnight (and everyone's privacy increased by orders of magnitude, since spyware would become illegal again) if those fines actually started coming down.

oefrha 5y ago

It’s a conference submission. It’s not like the authors are responsible for or affiliated with the usenix.org website. It wouldn’t be ironic if I published a GitHub UI dark patterns study on github.com.

geon 5y ago

The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality. You can not use them to track users on third party sites, or store personally identifiable info without explicit consent, and in that case, denying consent should be as easy, and not affect other functionality, such as blocking content.

lp0_on_fire 5y ago
> developers misunderstand it. Then maybe the law needs some adjusting to make compliance more manageable.
- Teever 5y ago
  Why? maybe developers beed some adjusting to make compliance numbers higher.
  - lp0_on_fire 5y ago
    Because GDPR has been around for a few years and its still unmanageable. Laws need to be realistic to make compliance easy and widespread. Maybe there needs to be resources for training or something. There are lots of things you can tweak while still getting the benefits.
    - LordDragonfang 5y ago
      Compliance is easy and manageable, for the most part. It's just that companies want to still do the things the law is trying to disincentivize, and want to put as many dark patterns as they can in the way of users avoiding it. So the "unmanageable" part is trying to figure out how close you can come to breaking the law without being blatant.
- krageon 5y ago

isodev 5y ago

> Did we consider that if everyone is breaking the law, the law itself might need a rework? I think GDPR assumed companies would like to do right by their visitors. I guess the only way to do that is to increase the severity of the consequences for violating user trust. GDPR itself offers a guideline that many seem to misunderstand... you don't need a popup for every kind of cookie. I'm not against enforcing minimal tracking as default, and opting into cookies should be similar to going through a purchase flow... because it is one, just using "data" as a currency. So yes, convince me to click the "Buy cookies" button.

LordDragonfang 5y ago
>GDPR itself offers a guideline that many seem to misunderstand... you don't need a popup for every kind of cookie. Cookie banners predate the GDPR, most of them are from the "cookie law"[1] that predates it. They're two entirely separate laws that don't supercede each other. [1] https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communications_Directive_2002 https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
Ekaros 5y ago
The possible consequences are already sever enough. It is just that enforcement is either underfunded or not taking active enough action.

alkonaut 5y ago

> Did we consider that if everyone is breaking the law, the law itself might need a rework? The law is fine, the enforcement is not. If the enforcement had any teeth, then people wouldn't be breaking it. So long as managers try to get away with dark patterns rather than just take their business off the internet, the penalties are clearly not stiff enough. But I'm fine with this taking a few years to get in place. It's better to ramp up penalties once the law has matured a bit, than to have the kind of business-ending penalties I'd like to see, for a very new law.