4 ms·

I really think we should reject the law and make another one that requires the browser vendors to provide the appropriate notices (think of what currently happe

by tacone 5y ago

I really think we should reject the law and make another one that requires the browser vendors to provide the appropriate notices (think of what currently happens with non-https connections) and (browser enforced) choices. No added work for website developers, no lawyers required, no dark patterns. Common icons and warnings the user can recognize easily because they would be the same for every website.

tobr 5y ago
That makes no sense. How is the browser supposed to inform the user what they are consenting to? The point of the law is, among other things, that you need to have informed consent when you process personal information. That’s not a technical problem that you can solve with a new API. It requires organizations to work differently. Unfortunately it seems that very few orgs have been willing to put the necessary thought and care into this, instead they just slap these cargo cult consent dialogs across everything.
- timando 5y ago
  Put a cookies.txt (or json or xml or whatever) at the root of the website (or use a <link> element) with the name of the cookie and what it does. If the cookie isn't listed, the browser rejects it.
  - MauranKilom 5y ago
    The GDPR is not inherently about cookies, and it also does not stand in the way of the solution you describe. What is standing in the way is corporations considering it more profitable to hassle their users with antipattern-laden popups than to follow the spirit (and, ostensibly, letter) of the law.
dmitriid 5y ago
> I really think we should reject the law and make another one that requires the browser vendors 1. GDPR isn't just about browsers 2. Those "consent" popups are mostly illegal under GDPR. They are often provided by companies whose entire business is dark patterns. Thankfully, the EU is going after them, too: https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach-belgium/ https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...

by tacone 5y ago

tobr 5y ago

That makes no sense. How is the browser supposed to inform the user what they are consenting to? The point of the law is, among other things, that you need to have informed consent when you process personal information. That’s not a technical problem that you can solve with a new API. It requires organizations to work differently. Unfortunately it seems that very few orgs have been willing to put the necessary thought and care into this, instead they just slap these cargo cult consent dialogs across everything.

timando 5y ago
Put a cookies.txt (or json or xml or whatever) at the root of the website (or use a <link> element) with the name of the cookie and what it does. If the cookie isn't listed, the browser rejects it.
- MauranKilom 5y ago
  The GDPR is not inherently about cookies, and it also does not stand in the way of the solution you describe. What is standing in the way is corporations considering it more profitable to hassle their users with antipattern-laden popups than to follow the spirit (and, ostensibly, letter) of the law.

dmitriid 5y ago

> I really think we should reject the law and make another one that requires the browser vendors 1. GDPR isn't just about browsers 2. Those "consent" popups are mostly illegal under GDPR. They are often provided by companies whose entire business is dark patterns. Thankfully, the EU is going after them, too: https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach-belgium/ https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...