17 ms·

People who press on cookie banners anything except “agree” – why do you do that?

93 points by eimrine 5y ago

I am from a generation that is familiar with banners showing dancing Flash animations from the internets of the 00s, usually some boobs and butts on the middle of the screen, and I still remember that pressing [x] or [close] could either close the banner or do it even bigger. So if the cookie banner's overlay is not hard enough, I am comfortable to read a text through the overlay, but it seems way more broken because the owners of that dancing nudes at least realized that they are disturbing people, and those in charge of the cookie banners really believe that they protect the interests of the user, so cookie banners are noticeable agressiver - nude banners never had an overlay and almost never made the content unreadable before paying attention to them. Some websites might require you to go through the jungle of odd choices about which cookies are acceptable and which are not. It's so similar to Italian strike (aka "work-to rule"). Imagine regular people who are forced to chose between the strange and even strangier. What can they choose but "agree to everything" or look at some gray text through a gray overlay? There are definitely people in the HN crowd who can understand the different options offered by cookie banners. I have an example of this product of thought, maybe not the best, but good enough to demonstrate what the jungle is [1], so if at least one person in the whole world uses this option - share your answers: 1. What will you do on your next visit if your browser forgets the cookie - click again, right? 2. On which websites do you use these custom cookies, maybe you know something about some special websites? 3. Do you know about some instruments like DO-NOT-TRACK but for cookie banners? Adblock or adblock-like extentions IMO miss the point of doing the conscious decision. 4. If you are such an advanced user of cookie-banners then it is natural for you to think they are somewhat useful for you - what are the advantages of this? [1] https://www.hull.ac.uk/

pleb_nz 5y ago
I don't care about cookies Works well for me
kzrdude 5y ago
Meta: why is that post's text gray and hard to read? This is how HN punishes low-voted comments, right? Yet it seems counterproductive to do so for submissions.
- salawat 5y ago
  That's just the formatting for this type of article. It isn't connected to any type of upvote or downvote in this case. You are correct in that downvoted pists are made harder to read, and eventually end up dead or invisible. In fact, those posts can be forced to render by activating show_dead in your profile if you're feeling adventurous.
  - kzrdude 5y ago
    The formatting of this type of article is counterproductive, it's hard to read and the emotional conditioning from using HN is that gray text = questionable comment. @dang: why? :)
mariuolo 5y ago
I delete everything on exit anyway.
bni 5y ago
I use Hush extension so I never see them anymore
deleted 5y ago
[deleted]
falcolas 5y ago
> why do you do that? To reclaim screen space. To provide a data point that I don't want to be tracked. To stop auto-playing videos that distract me.
kmeisthax 5y ago
>those in charge of the cookie banners really believe that they protect the interests of the user No, they're asking for consent to track because the EU demanded it. The easiest way to avoid having a banner on your site is to... just not have an analytics package on your site. They're aggressive because they don't want their data spigot turned off - hence the work-to-rule nonsense. You should not infer any benevolence on the part of the people implementing these banners. My personal habit is to always click whatever option denies the most amount of tracking, mostly because I can.
- tomc1985 5y ago
  At least in the EU most sites seem to automatically disable nonessential cookies if you don't click Accept. The American equivalents all force you to manually uncheck everything
  - martin_a 5y ago
    > At least in the EU most sites seem to automatically disable nonessential cookies if you don't click Accept. They have been well-advised by their lawyers. Anything else is just a bomb waiting to explode on you.
  - codedokode 5y ago
    And if someone wrote a browser extension that hides those popups (or makes them scrollable instead of sticky), the user would not need to do anything to reject cookies.
    - tpush 5y ago
      Exactly. This is an absolute key point I find most people miss in these discussions. GDPR fundamentally changes the default of whether tracking is allowed to occur or not. If a user browses the web automatically blocking (just deleting/blocking the element, not automatically clicking accept) every consent pop-up, the website is not allowed to track them nor is it allowed to block the user from using the website. If you had such a browser extension, and if websites were actually conforming to the law, all EU users could browse the web without ever seeing any popup and without ever getting tracked.
makepanic 5y ago
If I see a cookie banner on a website, I simply reopen it in an incognito window/tab and click whatever it wants. After I'm done reading I just close the website again.
- dijonman2 5y ago
  I have a bookmarklet to remove stickies, this gets rid of many cookie banners and signup prompts
  - salzig 5y ago
    Want to share your bookmarklet, maybe?
    - infinityio 5y ago
      uBlock Origin has a filter list (annoyances?) that gets most of the cookie warnings as well
- Tarq0n 5y ago
  They could still fingerprint your browser. Agreeing to the prompt doesn’t just mean consenting to the placement of cookies but potentially the combination, re-identification and sale of such data.
- boomlinde 5y ago
  This is a good time to remind people that these prompts not only concern cookies (or even all cookies), but any form of non-essential visitor tracking. Some tracking methods will more effectively be able to track you across the boundaries of your "incognito" sessions. For example, the modern browser has a huge API surface that makes accurate finger printing using tuples of individually only moderately narrowing information possible for as long as you allow it to execute JavaScript.
  - ramtatatam 5y ago
    I use separate and fresh isolated firefox (running within podman container) to make fingerprinting a bit more difficult, it's still fingerprintable and probably this new fingerprint can be easily associated with the other but I like to imagine I make it more difficult to track me. Every little helps :)
peter-m80 5y ago
I choose to accept the required cookies to use the site, not the tracking ones
fartcannon 5y ago
If they appear to be antagonistically designed, I find myself using ublock origins lightning bolt out of frustrated spite.
- kradeelav 5y ago
  This, but with every pop up. I suspect it's not legally binding when you never clicked agree or deny as well.
seba_dos1 5y ago
The more aggressive and dark-UX the banner is, the more likely I am to spend time figuring out how to reject everything or to just close the tab right away. If it doesn't try to trick me into accepting things, I sometimes actually consider doing that. Why don't I just accept them all? No idea. Out of spite? Principles? Because I have too much time? Because my mind is too eager to get distracted with the popup? The fact that the only reason to even show these popups is for the website to do non-essential things that aren't actually in my interest? All of the above? Use of tasteless dark UX patterns doesn't even instill trust in me that these choices are actually respected in any way, to put it lightly.
- thejackgoode 5y ago
  I do the same every time, except the most complex cases. Them I started to treat as paywalls -- just close the page, I wasn't so interested in this information anyway.
- Robotbeat 5y ago
  I do right-click -> inspect element and then delete the pop-up element in the browser source viewer thing on chrome. Sometimes I have to find where it says “overflow” and set it to “overflow: visible” or something like that. Remarkable how often that works.
  - seba_dos1 5y ago
    Yup, that's one of the strategies I sometimes employ as well :)
  - jeroenhd 5y ago
    This extension: https://addons.mozilla.org/en-US/firefox/addon/hide-fixed-elements/ https://addons.mozilla.org/en-US/firefox/addon/hide-fixed-el... has worked wonders for me for naive stalking popups. Some sites disable scrolling until the popup has sufficiently annoyed the user into clicking "accept all", though.
    - andrewaylett 5y ago
contravariant 5y ago
1. Sure. Though in my case this applies to both options, I'm not storing cookies for webpages I don't deliberately want to be remembered by. 2. If present I'll click 'Deny', but I'm not hunting it down. Blocking the prompt with an adblocker is my preferred option. 3. Cookie Autodelete is the only sensible way to manage cookies IMHO. Store cookies for webpages you trust, delete all others. Annoyingly there's no official way to tell webpages you don't care. 4. Cookie banners are entirely pointless since I'm fully in control of which cookies I am sharing.
- Nextgrid 5y ago
  > Cookie banners are entirely pointless since I'm fully in control of which cookies I am sharing. The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163 https://news.ycombinator.com/item?id=30964163
  - contravariant 5y ago
    I don't think the GDPR mandates cookie banners at all, but somehow I'm still subjected to them. Most of them don't (explicitly) ask to collect my data, they just ask if they can use cookies.
Kalanos 5y ago
lack of trust
bin_bash 5y ago
Using the AdGuard Annoyances filter I rarely see them anymore in the first place. I'd check your adblock to see if it has a similar ruleset.
nonamesleft 5y ago
Site settings, remove all cookies, then block all cookies.
binarymax 5y ago
As a consumer: I hate cookie banners. Ads are a menace to society and the banners are a manifestation of a toddler fighting against the rules by being a total nuisance. When there's something I need from a site, I will always go into the "manage" route and save the disabled cookies. I also use duckduckgo's privacy browser and burn my session often. As a provider: I don't use cookies. Here's my privacy policy: https://max.io/privacy.html https://max.io/privacy.html
- pempem 5y ago
  Fully agree! Thanks for including your own privacy policy. We're starting our own effort and our top line was "we won't make data or the user the product" and were trying to structure something as simple as your policy.
- Folcon 5y ago
  Upvoted, this viewpoint seriously needs to become the norm, thank you for providing it.
- jobs_throwaway 5y ago
  why are ads a menace to society? edit: thanks for the thoughtful response, downvoters!
  - tejtm 5y ago
    normalizes expectation of others inserting ideas in ones head instead of critically assessing concepts with available observations and deriving one's own opinion for starters
    - jobs_throwaway 5y ago
      why can't consumers critically assess ads the way they critically assess things like this post? what makes ads uniquely menacing?
      - deleted 5y ago
Aardwolf 5y ago
I use a plugin called "idontcareaboutcookies" to not see them because I don't want anything requiring interaction just to read stuff anywhere The internet used to have pop ups in the early 2000s, until popup blockers and then the Mozilla browser came. Then we had over a decade of no pop-ups. Then Europe decided to make the internet a worse place by requiring websites to put something that's essentially a pop-up (the cookie notices) on them by law. I've seen enough pop ups in the early 2000s, so no thank you to them today. I don't understand why Europe decided to make the web a worse place like this, because it's competing with apps, and apps can violate privacy much more than websites afaik
- enlyth 5y ago
  Completely agree, every website I visit now has an annoying cookie overlay, which requires interaction from the user. Just let me read the damn article! I don't care if you track a single visit to this website which I will never come back to. I can protect my privacy myself if I want to, the EU is not helping at all because there are just dark patterns everywhere to make not accepting cookies difficult or inconvenient.
  - eropple 5y ago
    "This law should fail because people who want this law to fail are complying maliciously" is one of the more out-there readings of reality I have seen in some time. Perhaps, rather than shrugging one's shoulders and saying "well, to hell with you, I've got mine," there are other things we as a functioning society can do. Like standardize how these cookie prompts must be displayed (small, inobtrusive) and standardize a set of accepted behaviors when the user ignores or closes it (reject all non-required).
    - tick_tock_tick 5y ago
      People can be complying maliciously and the law can be bad at the same time. I doubt most people actually thinks the EU struck a good balancing with the current laws.
  - 5y ago
pdpi 5y ago
I simply refuse to press "I accept" as a matter of principle. If the website doesn't have a relatively easy way to refuse all (anything that takes me more than, say, 3-4 clicks), I'll just close it.
gorjusborg 5y ago
I am someone who almost never clicks 'Agree'. There seems to be a pattern that 'Agree' grants access to use tracking cookies and other metric collection. So, I usually either not consent and see what happens, or I 'customize' and for most sites that leaves 'essential' cookies enabled. Why? Because I don't want to be harassed with targeted ads everywhere I go.
jokoon 5y ago
Because I suspect it is legally binding and that it can be used in court. I'm not sure, but I think that companies can legally protect themselves if they have records of people clicking accept. They can still delete the data of people who don't click. Simple as that. It is a dark pattern, I think, especially when there is no refuse button.
- Nextgrid 5y ago
  It is against the GDPR if there's no refuse button. The problem is that the regulation has yet to be enforced anywhere near enough so websites can get away with this kind of malicious pseudo-compliance.
pja 5y ago
> People who press on cookie banners anything except “agree” – why do you do that? Spite.
jenkstom 5y ago
I mostly only see these in websites found in a feed, like the Google Now feed on my android phone. If it's annoying enough I just block the website. If I can't trust them to track me then I don't really need to read whatever they are writing.
Nbox9 5y ago
* 75 percent of the time I leave the website and never return. * About 25 percent of the time I load the website in sandbox way —- a container or private mode. The website’s intentions are clear and I don’t trust them.
92g3r2ogr9asof 5y ago
Spite
Liquix 5y ago
No need to click anything nor be tracked across the web! I Don't Care About Cookies [0] combined with Cookie AutoDelete [1] will hide all cookie consent popups, deny permission/not click if possible, and auto-accept if required to use the site. IDCAC alone will hide all popups, but in cases where you must click accept to browse it will do so invisibly & the cookies will linger. CAD solves this problem by purging everything automatically (except your whitelist) when the tab is closed. [0] https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a... [1] https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...
- wedn3sday 5y ago
  Ive been using these two in combination for a little while and found it to be a significant improvement to my web experience. I also use the ekill[0] extension to remove annoying flashing elements or banners that wont go away. [0] https://addons.mozilla.org/en-US/firefox/addon/ekill/ https://addons.mozilla.org/en-US/firefox/addon/ekill/
  - anotherevan 5y ago
    I use the I Don't Care About Cookies and Cookie AutoDelete add-ons too. I also use Behind The Overlay Revival[0] for annoying overlays. I just have to click the toolbar button - not even aim at the elements I want to remove. That said, ekill's grudge mode looks interesting. And I use Unstick![1][2] which can get rid of annoying fixed headers and footers that chew into your vertical space. [0] https://addons.mozilla.org/en-US/firefox/addon/behind-the-overlay-revival/ https://addons.mozilla.org/en-US/firefox/addon/behind-the-ov... [1] https://addons.mozilla.org/en-US/firefox/addon/unstickall/ https://addons.mozilla.org/en-US/firefox/addon/unstickall/ [2] For some reason though, I always have to click it twice to make it work.
deleted 5y ago
[deleted]
ohyoutravel 5y ago
These banners have made me more aggressive about using DDG browser on phone. I do click “accept” because it’s the fastest path to read whatever article or view whatever picture I came to the site for, then use the DDG flamethrower to destroy everything. It’s a bit of a win-win because I get to read the site without having to figure out the site-specific cookie settings but the site also doesn’t get any of my data.
- rycomb 5y ago
  Many people here seem to forget that cookies aren't the only way to track, and fingerprinting a user is easy without having to use cookies (via UserAgent, IP, canvas data, and a myriad other techniques). Now, I wonder what does the GDPR and similar legislation say about those, but my uneducated guess is that a user accepting the site's policy regarding user data collection would approve the use of fingerprinting as well (and deleting the cookies would only work partially, privacy-wise).
  - Nextgrid 5y ago
    The GDPR indeed covers fingerprinting and anything data that can be used to identify someone - the idea that these consent forms are specifically about "cookies" is a lie that's being spread by stupidity or malice. See my other comment for more details: https://news.ycombinator.com/item?id=30964163 https://news.ycombinator.com/item?id=30964163 This is also why there is value in not clicking "accept" even if you already block cookies and/or run in private browsing mode.
gizajob 5y ago
We respect your privacy! Please click agree to allow us to disrespect it. I find it worth the trouble to find some way of disagreeing, either via "reject all", or clicking through the various radio-buttons offered and hitting save. It just seems worth the effort. While I admire the efforts to limit data collection, these privacy/cookie popups are now a plague across the internet, a 'net that had done a brilliant job of getting rid of the first wave of popups in the past that I well remember, along with the relief when they had been banished by sensible browser manufacturers. Even better than dealing with the privacy banner, I now often just hit "Back" and don't bother reading any articles that are only offered in exchange for collecting my data. It's a good filter, and time saver.
disruptiveink 5y ago
I click "Disagree" by default, because why would you click agree by default? If the site starts getting complicated due to my decision of clicking "Disagree", it signals to me the website doesn't really care about its users and is trying to make me go away. If I don't care much about the content, that's what I do. Hopefully they're measuring their bounce rate, happy to vote with my feet in those cases.
hdjjhhvvhga 5y ago
When I see such a page, I just leave. It's very simple: there is a huge number of websites competing with each other and it's not like someone if holding a gun to my head forcing me to visit a hostile one. I realized the ones I really care about (documentation, personal projects, etc.) never blackmail me with tracking buttons.
reportgunner 5y ago
Because it's like signing a contract without reading it's contents. I usually zap them with uBlock Origin or leave the website if I can't do that.
rhn_mk1 5y ago
I never have the problem of the browser forgetting the cookie. I pay the price once: if I see a cookie banner, I inspect the source and add a CSS ruleto Stylus to remove it permanently. My Stylus config is backed up. If, for some reason, it doesn't work, I close the page. Why do I do this? To send a big fuck you the big businesses that want to vacuum up everyone's data without any reciprocity. I'm a very spiteful person, even if it's not easy to get on my wrong side. There's no conscious decision needed to not be tracked. It's the status quo: by default, I'm not being tracked, and if a web page wants to change that, it should require a conscious decision. That's when I disable the hiding and think about clicking something on the banner.
Ekaros 5y ago
Purely out of spite...
Bancakes 5y ago
Because I don't agree. I don't know what I'm disagreeing to and I don't want to know. None of us do. Most of us use ad blockers anyway. If your website can work with the highest restrictions, then just make it the default option. It's the engineering thing to do. I don't want a EULA or some rules just to make a few HTTP requests.
ramtatatam 5y ago
I often pull out developer tools and delete anything I find annoying on the website. If that does not work (because, lets say, authors used fancy way of disabling scrolling) then I open separate firefox session running in podman container with different fingerprint. I do this because I don't want to be tracked (though, of course, refusing to play the cookie game will not prevent anybody from fingerprinting my browser..)
WelcomeShorty 5y ago
I use Brave in incognito modus and accept all your stinking cookies which will last for exactly the duration of my current browser session. My "serious" browser I use only for these "10" sites where I need state (authentication or preferences).
- Nextgrid 5y ago
  The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163 https://news.ycombinator.com/item?id=30964163
BackBlast 5y ago
It is curious to see how many inventive ways UI designers can come up with to create the urge to click a button that allows permission. I prefer to not have the trackers, but sometimes I'm just impatient to get on with things.
mc4ndr3 5y ago
The EU needs to just ban non-authentication use of cookies and client side marketing data collection altogether. I can't stand those annoying prompts, something out of a hellish carnival.
- Nextgrid 5y ago
  Good news: prompts that make it easier to accept than decline, or make it confusing or use dark patterns are already illegal and don't actually comply with the GDPR. Bad news: enforcement is nowhere near enough, so the problem remains. But when/if enforcement does finally pick up, this problem will be resolved.
rascul 5y ago
I use ublock origin and block the element.
timeon 5y ago
Most of the time, when I search for something and land on page with GDPR banner without 'reject all' option - I just click on back button and try luck with other page.
exfascist 5y ago
I never interact with cookie banners at all as some sites interpret that as consent (despite what the law says.) If it's in the way I delete it with the web inspector.
Cloudef 5y ago
I usually just close the page if i see such popup
micromacrofoot 5y ago
Spite. The banners are required by data privacy legislation and are often dark patterns that make it easy to agree to "all" but usually hide "only necessary" behind a couple additional clicks. If you don't respect me enough to give me a one-click "only necessary" button, then I'm going out of my way to give you as little data as possible. I already block ads and many trackers at my router.
throwawayboise 5y ago
I accept all of them, and my browser is set to clear all cookies and history when I close it. I also use an ad blocker. They may track me while I'm on their site, but not before or after so I don't really care.
- Nextgrid 5y ago
  The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163 https://news.ycombinator.com/item?id=30964163
godelski 5y ago
I'm mostly mad at the dark patterns used. The ones that are accept vs decline are fine and usually I just add them to ublock if I'm going to visit that site again. An example of annoying is stack overflow. There are "essential" cookies that I have to accept. And to get there I have to navigate a few places. Luckily they aren't as aggressive about covering up the content so usually I just ignore it. Unfortunately I haven't successfully added this to unlock. And I have an automatic cookie destroyer. Tell me again why your cookies are essential and I have to accept them? (Yes I know cookies are needed to save settings, but maybe only prompt at the time I would need them, like login. I don't need cookies to just browse SO)
rootusrootus 5y ago
I have found an upside to the cookie banners. They make me evaluate how much I care about the content hidden behind them. Especially when there is not a "deny all" button clearly visible. A significant amount of the time, I just close the browser window and go somewhere else.
ryandrake 5y ago
The "privacy banners" have become a clear signal to me that the given web site is (at best) too lazy to fix their site or (at worst) deliberately hostile to my privacy. The banner's presence is an easy up-front filter: I just click away and go to a different site. I usually don't care enough about your content to go through and click off a bunch of switches. Switches that you only have to show because you won't fix your web site and remove the tracking yourself. Imagine if the government passed a law that said restaurants had to warn you upfront that there might be poison in your food and you had to opt-out of it. I think I would just avoid restaurants with that sign altogether.
- z3t4 5y ago
  Businesses want to learn about their users in order to better serve them. however customers although they want to have their problems fixed, rarely tell the business about their problems. Restaurants have strict rules not to serve bad food. There are however no rule against serving bad solutions.
JoshTriplett 5y ago
> 4. If you are such an advanced user of cookie-banners then it is natural for you to think they are somewhat useful for you - what are the advantages of this? They're not useful, they're an unwanted annoyance. Nobody wants to fill out a cookie form, they want to browse the site. Delete the cookie banners and the associated tracking completely. Figuring out whatever tortuous process any particular cookie banner uses in lieu of what should be an equally prominent "reject all" button (or a completely absent banner and no tracking) does not make me an "advanced user of cookie banners". > 3. Do you know about some instruments like DO-NOT-TRACK but for cookie banners? Yes, Do-Not-Track is precisely that instrument. (And occasionally, some of the cookie banners seem to notice the do-not-track and use it to pre-populate all the checkboxes to "no".) If a site receives a Do-Not-Track, it should not show a cookie banner, and should just auto-reject all tracking. (If a site doesn't receive a Do-Not-Track, it should also not show a cookie banner, and should still auto-reject all tracking.) > Adblock or adblock-like extentions IMO miss the point of doing the conscious decision. There shouldn't need to be a conscious decision; all of the banners and tracking should be auto-rejected.
- dredmorbius 5y ago
  Since you mention "delete the cookie banners and associated tracking completely" without specifying methods: On browsers which support it, I use uMatrix and uBlock Origin, as well as the Stylus CSS manager. uBlock Origin has an element remover that will permanently remove elements from a website. It's point-and-click, though you may need to hunt a bit to find the full element responsible for annoyances. (There's also a "zapper", which is temporary only.) I'll typically remove cookie and all other nags, as well as social "link litter", recommendations, Taboola chumboxes, and the like, if my normal adblocking hasn't already addressed these. Under uMatrix, I'll simply globally deny cookies to the site. Since for most sites the only value I receive from cookies is to remove cookie nags ... this has zarro effect on any site functionality. (For a very small number of sites which I rely on authentication --- of which HN is a very large share --- I of course don't do this.) Where necessary, tracking hosts / domains are blocked via a DNS-based blocklist. DNT would of course be the proper way to achieve all of this. The advertisers and surveillance industry have chosen to ignore this. Turnabout is fair play. Another option, and one I rely on increasingly, is to view the site via alternative intervases such as the Internet Archive or Archive.Today, outline.com, 12ft.io, etc. On my e-ink tablet, I'll frequently save page as PDF or ePub and read that instead. (The EInkBro "save to ePub" feature is a bit of brilliant genius, as it permits saving multiple pages to a single document or "book", and is an excellent way of organising reading for a day or week. See: https://toot.cat/@dredmorbius/107958709435468728 https://toot.cat/@dredmorbius/107958709435468728) TL;DR: Nuke banners, block cookies, using browser extensions, or hit the content from an alternate service.
vladvasiliu 5y ago
As others have said, I usually click "refuse" or accept the very minimum possible, if it doesn't look fishy. If there's too much work, like I have to uncheck every one of a zillion boxes, or if there's the trustarc or what's-it-called that needs to "work on it" for 10 minutes, I just leave the site. I do this in the hopes that someone in marketing looks at the stats of people specifically refusing, takes note, and maybe comes up with something less invasive. Or at least realizes there's a market for that. There is one site on which I don't do this, jeuxvideo.com. It's a French video game review site. They present a choice: "accept tracking" or "pay for a subscription". I only go there once in a blue moon, so a subscription wouldn't make sense for me. Plus, their ads aren't particularly intrusive (with UBlock on, but on MS Edge - which I barely use, since it runs on my gaming PC) so I figure it's fair. Most sites that present the cookie banned don't usually have a subscription-based alternative.
- EEBio 5y ago
  Funnily enough, "accept tracking or pay subscription" is very much illegal under GDPR. Lack of consent to tracking may not alter functionality of the site. In other words, service providers are not allowed to discriminate against users based on their tracking preference.
  - ApolloFortyNine 5y ago
    Which is so messed up, since ads based off tracking pay so much more than ads with no tracking, many sites would be forced to provide content while losing money doing so. The argument 'for' this is that people think it's better that those sites just don't exist at all, which I would hate to see. Forcing companies to lose money will just lead to the big tech companies, that can simply tank the losses, will grow even larger, now with a moat built by the EU to protect them (good luck getting started making 90% less off your no tracking ads).
elorant 5y ago
Because 90% of the time cookies are used only for tracking. Unless a site has a login mechanism, and I have a profile on it I don't see the reason to consent on the use of cookies. Since I installed uMatrix I don't even get the annoying notification.
CivBase 5y ago
Why click anything on the banner at all? I either ignore it, leave the page, use Firefox's reader mode, or delete the DOM node. uBlock Origin has a nice "zapper" feature to do that last option quickly and painlessly. Even sites with full-page overlays usually load the actual page behind the overlay, so you can just delete the node if you really want to keep using the site.
darepublic 5y ago
I don't want to interact with a bunch of options, what I want is to have the minimum amount of tracking required to have the site work for me. The fact that most sites confront you with either accepting all tracking or having to manually disable all other forms is a dark design pattern imo. Also sites that seemingly forget what you stated and re-ask you every time is unacceptable. The stack exchange banner I find particularly vexing, and ublock rule to remove it is unreliable. And yes, of course I'm not going to object to them placing a cookie 'cookie-banner-accepted' or something to remember my decision. Again, not against ALL cookies, I just want the minimum required for site functionality, which I think would be almost a universal preference of most users but of course you wouldn't guess that from these ridiculous pop ups
chriswarbo 5y ago
> 3. Do you know about some instruments like DO-NOT-TRACK but for cookie banners? Adblock or adblock-like extentions IMO miss the point of doing the conscious decision. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P was the standard for this, and was implemented in IE for many years. However, back then there were no legal consequences to tracking without consent, so no sites bothered providing the metadata; and the support in user agents was dropped.
gzer0 5y ago
I just avoid them altogether. If you go to your uBlock origin plugin settings > filter lists > annoyances > checkmark "fanboy's annoyances", "adguard annoyances", and "uBlock annoyances" Never see cookie banners again.
- gcthomas 5y ago
  > If you go to your uBlock origin plugin settings > filter lists > annoyances > checkmark "fanboy's annoyances", "adguard annoyances", and "uBlock annoyances" This ^^ hits the spot. No need to accept the dark UI patterns (illegal but everywhere) without the pain of going through the options. Works brilliantly.
Beldin 5y ago
Re 3: try CookieBlock; it's part of the result of fairly recent research into blocking cookies: https://www.usenix.org/conference/usenixsecurity22/presentation/bollinger https://www.usenix.org/conference/usenixsecurity22/presentat...
zzo38computer 5y ago
Use CSS to get rid of the banner. If I do not want the cookies then I can disable the cookies in the browser.
bittercynic 5y ago
I use a ublock origin filter list that attempts to block cookie banners. If I could find a web-search tool that de-listed or harshly penalized sites with hostile features I would use that. Likely related to advertising/tracking: Many common categories of activity, like cooking, gardening, camping... are very hard to search for. The results are so polluted that I can't find the good web sites, and I'm certain people who love these activities have created great sites about them.
tejtm 5y ago
block element
hosh 5y ago
I'm from a generation when gopher was still in wide use. I remember those Flash animations from the 00s. I remember being optimistic in my youth about the internet and how it would change the world. Lots of thought leaders were writing about that. The way we live might have changed, but the world view from which we operate from did not. It should have been a red flag for me that the early commercialization of the Internet characterized it as a "land grab". I've come to the conclusion for myself that I don't like the internet as it is now. The advertising is annoying, but more importantly for me I don't like the idea of being defined by my user behavior, and getting sucked into a machine feedback loop with no real Purpose ... simply something that endlessly extracts value for no other reason than to extract value. So I find myself: 1. Repeatedly using the least amount of cookies every time I read it. When I come across papers posted here from _Nature_, I opt out of cookies. That means I do have to reselect those every time. 2. As a habit, I just do it out of all of the sites that offer this. I think part of this is that I have to pick and choose what I spend time reading 3. Yes, and there are workarounds for all of those. I also use adblock, but they are kinda like the mob and will let advertisers pay them to bypass the adblock. Sites that don't show me the content because they detect an adblock makes me think if I really want to read what is on there; if I do, I don't mind making a conscious choice to support the publication. If I am annoyed by it, I might try the Firefox Reader option. Or I don't read it. 4. It's not an advantage so much as aligning with how I have come to approach life. I've come to realize that much of our civilization is built upon Value Extraction. Whether that is for my limited time here on Earth, my focus and attention, very few businesses are built to give something back, or at least are value-adding (not "value added") -- something that contributes to and expands the capabilities and resources of the whole ecosystem beyond profitability.
- unregistereddev 5y ago
  > I also use adblock, but they are kinda like the mob and will let advertisers pay them to bypass the adblock. I agree with most of your observations. Just highlighting this point to say, that is the reason I switched from adblock to ublock. They are similar, but ublock is open source and refuses to accept money to bypass their filters. https://ublockorigin.com/ https://ublockorigin.com/
- 5y ago
Trias11 5y ago
Is there any solution to auto-dismiss these stupid things?
gnicholas 5y ago
I have wondered about this also. I do most of my browsing in incognito windows, where cookies are not remembered once the window is closed. Am I correct in thinking it does not matter if I accept everything, since it will all be nuked in short order? Or is there a chance I am unwittingly allowing cross-session tracking based on IP or other attributes?
- fastssd 5y ago
  In theory, it shouldn't matter whether you choose to accept the cookies, since they'll be flushed anyways. In practice, you most likely are being tracked across multiple sessions based on IP.
  - gnicholas 5y ago
    What's a good way to prevent the IP-based tracking?
deleted 5y ago
[deleted]
kkfx 5y ago
I use "I don't care about cookies" so in 99% of the case I have nothing to click, in any case my WebVM [1] start with a clean profile on any run (I have a small wrapper script to run the WebVM, via firejail, it wipe the profile restoring a pre-made one, re-built on weekly basis) so cookies do not last anyway even if fingerprint do not change. I do not have used so far custom cookies settings, nor I consider trustable what they say anyway. For ads, js etc I have NoScript + TPRB (with the policy of allowing just the minimum js needed on the sites I care, hoping FF Reader suffice in other cases) and uBlock origin + others. I just allow some ads on veeeeery few friendly websites/YT channels if they are not exaggerated. For cookies in general, I simply reject the idea of WebApps, for me the web MUST be just html+CSS. Desktops must be desktops not WebVM bootloaders and apps+data should be under MY control not under my WebVM and third parties control. Some simple examples: why the hell banks have websites that are more than just advertisements and contacts information? OpenBank is an example API mandatory between banks in SEPA area so not something built by a geek in a garage, and a client who talk OpenBank, a desktop one, that aggregate all my banks, with my digitally signed transactions stored locally, with the same UI and no crappy ads etc on my desktop is far better for me and far easier for the bank (far less bandwidth, far less infra development and maintenance costs etc). Similarly for maps. Similarly even for damn contact infos. An RFC to publish contact infos easy to download as vcards etc should be the norm and APIs makes integration in desktop apps easy and good environments, built as classic desktops (Xerox etc) can make such integration FAR more powerful for end users and far more cheap for anyone. WebApps are needed only by GAFAM and alike. [1] the monster improperly named by most "browser" for legacy reasons...
vbezhenar 5y ago
I press something like "more"/"accept" which usually has most of checkboxes turned off. I do it because it's easy. I don't really care that much about tracking, but if all it takes is one more click to prevent it, why not.
hooby 5y ago
I still remember the day, when the browser would show you a pop-up "Allow somesite.com to set a cookie? Yes - No"... Something like that (with a "remember this choice" checkbox) would be so much more economical, than making every single website implement it individually. When the browser does it, then websites also can't ignore it, cheat it, or use dark patterns to avoid it.
- andrewaylett 5y ago
  I use https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-a... with https://addons.mozilla.org/en-GB/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-GB/firefox/addon/cookie-autode... to avoid seeing the banner then drop any cookies the site might have set anyway. Firefox ETP is also quite good at avoiding common trackers.
- codazoda 5y ago
  I don't remember this and probably should. Did this have a name? What browsers had this behavior?
  - Nextgrid 5y ago
    Internet Explorer 6 (and prior versions presumably).
  - hooby 5y ago
    Netscape. Well, at least some versions of it. In the browser settings you could switch the "accept cookies" behavior between "never" - "ask" - "always". I believe it was set to "always" by default? It's been a long time ago, so I'm bit fuzzy on the details.
    - hooby 5y ago
      Found it - it actually was an extra checkbox. see: https://www.fabrica.cz/fabrica/img/netscape.jpg https://www.fabrica.cz/fabrica/img/netscape.jpg
- 5y ago
jokethrowaway 5y ago
I couldn't care less if a website is tracking me and Europe can rot in hell for ruining the internet. I just click anything that will get me to the content. Sometimes agree and disagree have the same style and I generally on what's nearer to my mouse. More often than not agree is the easiest option to click.
- dane-pgp 5y ago
  > ruining the internet You think it's the EU's fault, and not the fault of the companies that are ignoring the "Do Not Track" header and implementing all these Dark Pattern malicious compliance popups instead?
yakak 5y ago
I click "more info" "confirm my choices" which should give you only essential cookies. If that goes poorly, I close the tab and try to never revisit the domain.
deleted 5y ago
[deleted]
neoCrimeLabs 5y ago
I set Do Not Track (DNT) header on my browser. That is my answer, and any company who asks my consent for tracking cookies anyway is /already/ violating my consent by ignoring my my clear and standard communication. Anyone who repeatedly askes for consent when boundaries have clearly been established should never be trusted. So I ask, why would I ever accept? To get them to stop asking is never the right answer.
- autoexec 5y ago
  > I set Do Not Track (DNT) header on my browser. I never understood the point of that. Asking companies who want to collect your data to "pretty please don't" when there's no oversight or accountability should they decide to ignore your plea makes DNT a waste of bandwidth. It's worthless. Even the companies who would respect your choice have to track you long enough to remember that you've asked them not to track you. Don't bother asking them to stop tracking you, don't even give them the choice. Block JS, block 3rd party cookies, block ads and trackers, delete cookies on a regular basis.
  - neoCrimeLabs 5y ago
    It's your assumption that I don't do anything else. Imagine it like this: DNT is a "No Trespassing" sign. Do no trespassing signs actually stop anyone from trespassing? No. In this case, I use it as a tool to judge who clearly rejects my request to not be tracked, not stop them from tracking me.
egypturnash 5y ago
I was born in the early seventies and I don't find it much of a hassle to spend a couple of seconds looking for the deliberately-deemphasized "reject all cookies" or "reject all but essential cookies" that's usually next to the bright, shiny "accept all" button. I also have told Safari to "prevent cross-site tracking", and have sone adblock-type stuff going on to help with that. And yes, I will shrug and find the "reject all" button upon returning to a site if my decision hasn't been tracked because that would be stored in a cookie on another site or whatever. There is no advantage for me. The advantage is that it's a way for sites to cram in six hundred tracking services they've added for whatever reason, and still comply with the letter of anti-tracking laws. It is annoying and every now and then I miss the days when most sites weren't full of immensely sophisticated garbageware trying to build a profile on their viewers so as to serve them advertising they're more likely to click on.
dmortin 5y ago
What if one uses an extension which blocks cookie banners? Does that mean not agreeing to any tracking? Since the extension hides the cookie banner it's effectively the same as ignoring it, not pushing any buttons (nor accept, nor reject), so it means the site is not allowed to track me, because I did not agree to anything, right?
- Nextgrid 5y ago
  Assuming it's implemented correctly, yes. The tracking should be opt-in, so by default none of it should happen until a positive opt-in is received from the user. In practice, most are poorly implemented though so I wouldn't count on it. The solution is to lobby for proper GDPR enforcement and in the meantime defend yourself by using antimalware solutions such as uBlock Origin and blocking malicious domains/ASNs at the network level if you can (Facebook is entirely blocked on my network, so even if my blocker fails it won't be able to do anything).
autoexec 5y ago
I ignore cookie banners. If they get in the way of content I remove them. I don't interact with them at all. I handle cookies in my own way. First party cookies are accepted and kept for a little while, the rest are blocked.
humanwhosits 5y ago
It seems like a bizarre stance to treat 'agree' as a default.
pavlov 5y ago
The EU really should update the cookie law so that it applies to browsers, not sites. After all the browser's cooperation is needed to send cookies. This should be a mandatory standard part of the browser UI. Since there are just two browser engines in widespread consumer use, and the engines are made by two of the world's most valuable corporations (Google and Apple), requiring browsers to implement specific UI is both technically easy and politically convenient.
- Nextgrid 5y ago
  The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163 https://news.ycombinator.com/item?id=30964163
Findecanor 5y ago
If a site doesn't have a Reject button, what I do is: Copy URL. Open Private Browsing window. Paste and go. Right-click on banner. Choose Inspect. Select parent element. Right-Click. Select "Delete element" That is often less work than to have to go through some sites' cookie settings forms... ... but I wish I had a plug-in that did it in a more automated way. I'd want to just right-click and select "Remove this element" (but I'd name it something less polite...). And the next step: Collect statistics about clicks and display a public list of shame. Then each month, send a strongly worded letter (regular mail) to the operator of the next site that got the worst rating in the past month (and didn't get a letter less than six months before).
deleted 5y ago
[deleted]
forgotmypw17 5y ago
I almost always refuse to interact with the cookie banner, and continue using the site in its crippled state or leave. Even StackOverflow, I compensate by zooming out. If I really need the info and the banner is really in the way, I use element zapper. Fuck cookie banners.
Justsignedup 5y ago
I've recently started just relying on adblocking, and just agreeing. Its such a battle to keep the info up.
hawski 5y ago
I do one of those: - obtuse cookie consent, where it hides everything and does a redirect - I don't bother: I'll close the tab - quite easy to see "I agree", no easy way to reject things - depending on my mood or how much I feel the need to get the thing I want from this particular site, in order of probability: click agree, close the tab, do not click anything (try to see around the popover or remove it via inspector), search for a way to reject - easy to see a rejection button - click the button or close the tab if the popover seems too excessive anyway The reason I agree to any tracking is my belief I'm pretty safe with using uBlock Origin on Firefox, clearing cookies somewhat regularly and using first party isolation option of Firefox, also I use Tab Containers for important stuff. Maybe it doesn't cover me fully. Most sites I visit daily I could certainly do without.
hiq 5y ago
> those in charge of the cookie banners really believe that they protect the interests of the user As other commenters have pointed out, these are mostly legal requirements. In most cases, the user would be better off with no banner and less cookies. > What can they choose but "agree to everything" or look at some gray text through a gray overlay? You can leave the website. The intrusiveness of these banners correlates negatively with the quality of what you're trying to read, so in most cases it's a good reminder that you shouldn't even be on this website to begin with. In the rare cases where you do need the content, tools such as uBlock Origin can still help make it for this one time. Contrary to other commenters here, if a website is bad enough that I need to do that on a regular basis, I just stop visiting the website. > There are definitely people in the HN crowd who can understand the different options offered by cookie banners. You're assuming it's worth anybody's time to even read these. It's not.
troupe 5y ago
I figure (perhaps too optimistically) that if enough people say to turn the cookies off, they will eventually decide it is better to just leave them off and get rid of the decision banner.
clircle 5y ago
1. Cookie AutoDelete 2. I Don't Care About Cookies
tester756 5y ago
IIRC FYI: You don't have to show cookie consent banner if you use cookies just for technical (e.g auth) stuff
brundolf 5y ago
I do it out of spite
jurschreuder 5y ago
"a personalized experience" is the laymen's term for "we sell your data".
ChrisArchitect 5y ago
wordy wordy writeup I'm not even sure what you're asking, it's not the same question as your title. Except for the odd one like some retails sites and maybe just being in a bad mood and I'll click 'decline', I'll click Accept All for most sites just to get it away. The point is to get it off the screen as fast as possible and carry on with whatever content I'm trying to see without distraction. For the most part tend not to visit that many sites that have tons of ads or large cookie popups so it's not an issue and I'm not a paranoid ad-blocker user.
aspenmayer 5y ago
I block the banners outright without interacting with them with uBlock Origin usually, unless that causes site breakage. Usually doesn’t. TechCrunch doesn’t like this. They have some kind of Yahoo cookie consent thing you have to interact with. You can deny everything though.
datavirtue 5y ago
I hit the X. When the X is missing I just leave.
evilDagmar 5y ago
I click no because if your website is so tied to the existence of cookies that it can't display properly without them, I want to enjoy your failure.
onickpires 5y ago
I just use Brave, that blocks most tracking, and click whatever, for the majority o sites those banners in the "real" world, mostly likely dont't change anything behind the curtains anyways. Most sites probably just put it as a cosmetic to adhere to policy laws. I can trust much more my browser to block the tracking or data collection, than a"don't agree" button on any site".
nokya 5y ago
I only surf the web with my browser in private mode, using a virtual machine that boots a live Linux distribution and through a mainstream VPN service. Any banner that pops up to my face, I click "agree"and don't look backwards. I understand I can still be identified using some browser fingerprinting tricks, but I have absolutely zero trust in any of these privacy notices/policies. Disclaimer: part of my actual job is to assess whether my clients' systems/applications effectively comply with privacy laws and the policy shown to users/customers. I have never seen a company that does what it promises to its users and I've been doing this job since 2015.

JTbane 5y ago

>No, they're asking for consent to track because the EU demanded it. Given that you can completely block cookies and other tracking in the browser, why on earth did they bother? I despise bureaucrats writing laws when they don't understand technology.

Ekaros 5y ago
On other hand there could be an extension that sends tracking history and everything else to everyone. If you really want to share that information.
matheusmoreira 5y ago
Because cookies are useful functionality that should be used in our best interests, not to pad some corporation's bottom line via surveillance capitalism. We shouldn't have to block cookies or anything, they're the ones who have to stop creating software that is essentially malware.
kmeisthax 5y ago
I despise engineers writing code when they don't understand laws. Yes, we can play the tracker-removal cat-and-mouse game, but that involves a lot of time and effort, projected forever. This battle is going to be won by whoever has the most time and money to waste, and, spoiler alert: it's not the adblock vendors. It's Google. In the specific case of cookies, you need those to authenticate to web services, so you can't just block all of them. Instead you need to delicately allow or deny every cookie based on if it's purpose is holding a login token or tracking a user. In fact, sometimes it's both. Strictly speaking, if I log into Facebook, that shouldn't be considered consent to track. But right now, that's how it works. You know all those "login with Facebook" buttons all over the web? Those give Facebook third-party tracking capability. There is no browser extension in the world that will allow you to login with Facebook without also telling Facebook what site you were logging into. You need a law to force Facebook to split-brain themselves and silo off that data from their advertising operations. Yeah, sure. "Just don't use Login with Facebook". Except every third-party login system has this problem - and there are plenty of smaller companies that absolutely do not want to handle user credentials and require that you use a third-party login service. And given that using smaller providers are the easiest way to get your credentials stolen, it is entirely understandable and advisable that they not roll their own authentication. Furthermore, most users are not at all aware of all the technical stuff I mentioned above - and they shouldn't have to be in order to have privacy. Having a well-written law is a lot easier: you just tell Facebook, "no, really, if you use your login service to track people we're going to fine you". Corporations react to (sufficiently large) fines a lot more favorably than technical restrictions or circumvention. "Don't be evil" is a way bigger guarantee than "can't be evil".
- OminousWeapons 5y ago
  Preach! What we ultimately need is just a law that says it is illegal for companies to collect or store any data for marketing purposes, tracking, or resale. No opt ins, no exceptions. Unfortunately we can't fully kill targeted or unsolicited advertising at the root because of freedom of speech issues, but we can eliminate all the data it depends on.
  - jobs_throwaway 5y ago
    why do you dislike targeted advertising?
    - JamesBarney 5y ago
      I really don't mind targeted advertising. One the ads are more relevant. Two because the ads are more relevant the advertiser makes far more money on them and therefore doesn't have to show you as many to fund their service.
    - camgunz 5y ago
      I think it's less the targeted advertising, and more like I can't take 5 internet steps today without 40 people shouting at me to buy their diapers because my partner googled "diapers" last night.
    - remram 5y ago
      People see "targeted advertising" as "I was thinking about buying a bike and it shows me ads for bikes", ie. it's showing me what I want to see. That is not targeted advertising. Targeted advertising is showing you what they want you to see when they want you to see it, or showing you the same products in a light that makes you more likely to buy them. For example, showing you unlikely or imagined bike-related problems, to sell you useless protection gear or insurance after you get your bike. Showing you ads for motorcycles, because although you probably don't want one, someone who already likes bikes is more likely to buy a (more expensive) motorcycle, so that's where they'll direct their spam. Targeted advertising is about manipulation, using knowledge of the customer to change their behavior. No one is going through those efforts to show you what you already want and save you a quick Google.
ClumsyPilot 5y ago
"Given that you can completely block cookies" You can also hire oricate security to stop stalkers, and yet stalking is illegal
TheCoelacanth 5y ago
Because GDPR has nothing to do with cookies. You can have cookies without consent. Tracking requires consent even if it doesn't use cookies. You can block some tracking in the browser, but server-side tracking generally can't be blocked. GDPR cares about whether you are tracking, not about the means you use to accomplish it.

loceng 5y ago

Do you know if it is only third-party analytics being called that requires the prompt, or is setting any cookie for the website's use only requiring permission too?

gumby 5y ago
In house analytics and third party analytics are the same for the law. It’s all about user tracking.
shafyy 5y ago
Essential cookies that are necessary for the website to run do not need a permission from the user. For example, if you want to use cookies to save a selection or a language setting, you don't need to ask for permission.
- lucraft 5y ago
  Yep - but to clarify, the cookies must really be NECESSARY - i.e. your site or app would be unusable without the feature they implement. A cookie that saves, for instance, a preference may not be considered essential but a "Functional Cookie" that adds extra features, because your app is usable without it, and then you do need permission for it.
  - shafyy 5y ago
    Well, what does unusable mean? If my app offers a feature and the cookie is necessary for it to work, then it's essential. For example, a cart feature in an ecommerce app. Could you shop without a cart? Sure, still I would consider this cookie essential.
    - jonny_eh 5y ago
      A cart does sound essential, but I guess it's up to a judge to decide. Perhaps you should implement a cookie-less "buy now" option to avoid needing to go before a judge.
      - ipaddr 5y ago
        Like a session variable?
    - g_p 5y ago
      The UK implementation of ePrivacy makes this quite clear and the regulator uses this as an example [1] in their guidance. If you are setting the cookie in direct response to a user initiated action, for functionality, that doesn't require consent. [1] https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules9 https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...
  - olau 5y ago
    IANAL, but from my understanding the GDPR itself does not make this distinction. It's okay to store things to implement functionality, like login or shopping baskets. Tracking people is not okay. Now, there was a different directive preceeding the GDPR that tried to address the rampant abuse of cookies for tracking by regulating cookies directly. The intention of that directive was good, but the implementation really bad. I think this is where this distinction comes from. I don't think I've seen a case where someone who was not doing blatantly shady things with cookies got into trouble with that directive, though. It doesn't have to be obnoxious either - if you have a preferences page, you could add something like "we'll save these preferences in a cookie on your computer, okay?"
kioshix 5y ago
Regular cookies that are required for normal operation (to remember that you are logged in etc), does not require any permissions. But they try to make it seem that way, and they bug you as much as they can to get you to just agree to all cookies. Dark patterns everywhere.

logicalmonster 5y ago

> No, they're asking for consent to track because the EU demanded it. Personally, I think that despite seemingly good intentions, this common practice is counterintuitively harming user-privacy and security, especially on mobile where the banners take up a large chunk of the screen. Many normal people get something like "banner-blindness": they are so used to seeing banners requesting confirmation when they visit a website that they by default click any random buttons they see to try and hide them right away without reading what is requested. This practice doesn't really help anybody, IMO, and should probably be handled on the browser-level if people care about it.

kurthr 5y ago
On mobile, I often can not even check a box. Rotation sometimes solves the problem. Firefox -noscript always does, if I care that much.
- rob74 5y ago
  ...except for sites that completely stop working when JS is disabled.
  - kurthr 5y ago
    Ha! Yes, exactly... it "solves the problem", but not always as desired :^)
matheusmoreira 5y ago
I don't understand why they didn't use the Do-Not-Track header. It's perfect: a client sending DNT is explicitly denying consent to any form of tracking before the page is even rendered. The presence of such a header should cause web applications to automatically delete any and all tracking javascript from their pages at the very least. No idea why it turned into this cookie banner nonsense.
- kmeisthax 5y ago
  Microsoft pulled an Apple and turned DNT into opt-in. Advertisers were very clear that they would only honor DNT if it people were tracked by default. The EU then passed a bill that said you can't collect data unless it's for one of six reasons, one of which is "user consent". This basically mandated opt-in, so everyone went super-aggressive on consent banners (which, BTW, are probably illegal).
  - toxik 5y ago
    Consent popups are legal so long as agreeing is not easier than disagreeing. Iow, you cannot make it harder to disagree - which 99.95% of them do.
    - gnud 5y ago
      Also, "consent" has a specific meaning in GDPR, see article 4(11) [0]: > Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Which is why I suspect almost all "cookie banners" are worthless. They don't give a clear, informed consent, so the site operator is still not allowed to use the data for anything at all. 0: https://gdpr.eu/article-4-definitions/ https://gdpr.eu/article-4-definitions/
    - trompetenaccoun 5y ago
      Seems like a good case for a class action suit. Why hasn't this happened yet?
      - eurasiantiger 5y ago
        Because it would have hundreds of millions of people in it.
    - eurasiantiger 5y ago
      Revoking consent must also be as easy as consenting. Almost no site does this correctly.
  - AlexandrB 5y ago
    > Advertisers were very clear that they would only honor DNT if it people were tracked by default. It's ridiculous that Microsoft's response wasn't to just nuke trackers from space with some kind of adware blocker integration in Edge. This is the equivalent of a mugger saying he'll only honour your "do no mug" sign if the sign defaults to "mug me please" and has to be explicitly changed.
kodah 5y ago
> Personally, I think that despite seemingly good intentions Why do you think they have good intentions? Many of these banners employ some pretty slick dark patterns for you to opt-in to their most critical analytics. One of my favorites is when cookie selection is more than one click from the banner, or it causes a page reload.
- godelski 5y ago
  I've seen a few of those where you reject all and it causes a page reload, hence putting you in a loop where the banner comes back.
- logicalmonster 5y ago
  I think you're talking about the businesses' motivations and I'm talking about the random EU bureaucrats that imposed the regulations. Despite how skeptical I am of most government interventions, I'd tend to assign benign intentions on the bureaucrats part here as I'd have to guess that they genuinely wanted to do something good. But like any bureaucrats sitting in their ivory towers imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees that even when well-intentioned produce a mish-mash of inconsistent ideas, etc.
  - raverbashing 5y ago
    > imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees It's a valid critique, so here goes: how would you implement it to avoid those?
    - david422 5y ago
      Make it part of the browser, not the website.
      - Nextgrid 5y ago
        The "make it part of the browser" argument doesn't work in practice because the GDPR covers the intent and purpose of data collection/processing rather than any specific technical way of collecting or processing said data. Blocking cookies at the browser level doesn't prevent the website from using browser fingerprinting or the information you manually provided (your delivery address to make a purchase for example) in a way you didn't agree with.
shadowgovt 5y ago
It's a modern variant of the "this site is unsafe, continue using" click through that browsers gave for incorrectly configured SSL before the major browser vendors converged on the conclusion that they should make it actively hard to pass through insufficiently-secured SSL configuration because users would just click okay on the spooky dialog.
sowbug 5y ago
and should probably be handled on the browser-level if people care about it. Some of the original Chrome browser team have followed this line of thought: https://neeva.com/blog/introducing-cookie-cutter-by-neeva-a-free-chrome-browser-extension https://neeva.com/blog/introducing-cookie-cutter-by-neeva-a-...

shadowgovt 5y ago

Fortunately, we have replaced the tracker removal cat and mouse game with a consent banner cat and mouse game, projected forever. Problem solved, am I right? ;)

TheCoelacanth 5y ago
Well, yes, law enforcement in general is a cat-and-mouse game. That doesn't mean we shouldn't have any laws.
- shadowgovt 5y ago
  I 100% agree, but I feel like the proliferation of consent banners was predictable and if people didn't want it, the law should have initially accounted for it. Assuming people would just log less was hopelessly naive (especially given that apache defaults already do enough logging to run afoul of the GDPR).
  - dijit 5y ago
    A lot of GDPR is (intentionally) misrepresented. Apache logs for example do not run afoul of GDPR unless you: A) process them. (Correlate them with further identification) B) sell them. C) do nothing to secure them. Regardless. The law does have conditions for these cookie banners. Namely that if you do not present an easy 2 click opt out then you’re in violation. Many people are in violation in what I feel is an attempt at a sort of civil disobedience. “They can’t prosecute us if we all do it” mentality.
    - shadowgovt 5y ago
      I'm not sure a lawyer would agree with your assessment of the Apache logs. If they aren't actively being used to maintain site health, the mere collection of private IPs is enough to make them unnecessary private information. And that's the default for collection of Apache logs.
      - dijit 5y ago
        I guess it varies depending on the lawyer, mine agrees with my interpretation. Law depending on the opinion of lawyers is “useful”. If anyone wants to attempt to prosecute me for storing Apache logs then I’m happy to defend it in court. GDPR isn’t the boogeyman unless you’re selling data. I’m quite certain there are sympathetic judges to that end. Logs are necessary and even in some cases legally mandatory. I would talk to your lawyer.
        shadowgovt 5y ago
        With a 20 million euro minimum fine on the table, I don't think I'll feel comfortable on this topic until either the law is clarified or someone sets precedent. My lawyer's great, but he won't be paying the fine if he's wrong.
        TheCoelacanth 5y ago
        $20 million isn't the minimum fine. That's the maximum fine for companies with under $500 million in annual turnover. You aren't going to get the maximum fine unless you are doing something egregious. Collecting the default Apache logs and not using them for anything malicious isn't going to get you the maximum fine or likely any fine at all.
      - TheCoelacanth 5y ago
        You would be 100% in the clear on that as long as you apply a reasonable retention policy to your logs. Keeping them forever isn't reasonable. Keeping them for a year almost certainly is. You would be 99% in the clear if you do nothing. The worst that's likely to happen is that you're forced to adopt a retention policy and delete old logs, and even that is extremely unlikely unless you are Google/Facebook scale or are doing something significantly worse than industry standards.

Nextgrid 5y ago
Microsoft is part of "them" now though given their direction since Windows 10, so I find that very unlikely.
- noisem4ker 5y ago
  While you are right that Microsoft loosened their stance with privacy, let's not conflate data collection purposes: 1. telemetry, for diagnostics and health monitoring 2. usage analysis, for program improvement and personalization 3. content analysis, for advertising and marketing purposes Windows requires kind 1 and encourages kind 2*. Type 3 does not really apply, though, as I don't see Windows sniffing what I write in my text files so that I'm shown relevant ads later. It's all explained here: https://privacy.microsoft.com/en-us/data-collection-windows https://privacy.microsoft.com/en-us/data-collection-windows * Also note that the Customer Experience Improvement Program has been with us since Windows 7. Same thing, just not perceived as badly as Windows 10.
  - morelisp 5y ago
    Without a law like the GDPR, nothing stops them from using data collected for 1) and 2) for 3). Which they will do once some PM realizes it's worth something. (There's even 0), data collected for functional purposes like 2FA. Multiple companies have taken data straight from 0 to 3 once they see the possible revenue.)
kmeisthax 5y ago
Ad blocking is not a "nuke trackers from space" button. It's more like piloting a drone fleet to pick out and kill terrorists or insurgents in a not-so-friendly country. It requires lots of work to identify ads and create comprehensive filter rules to block ads, and periodic re-checking to make sure they haven't been broken by the advertising companies. Note how most ad blocking tech is either community-run FOSS projects or companies with not-so-savory business practices. It's really not the kind of work that browser vendors want to do. In fact, Apple went out of their way to create an extension type purely for delivering ad block lists to Safari all the way back in iOS 9. Ad blocking is that much of a pain that even Apple was willing to farm it out to third parties years before we got proper mobile extension support. Occasionally, browser vendors get lucky, and there's a tracker type that's "easy enough" to kill. Things like third-party cookies would be one of them - but even then this required a huge amount of testing to avoid breaking apps that relied on them for authentication. The only reason why ad block even works is because ad companies are incredibly paranoid and don't trust each other. The standard way to do display ads is to embed each other's `<iframe>`s or JS, which gives ad blockers a nice easy target to hit. Platforms like Facebook or Twitter that are trusted to do their own ad delivery and thus don't hotlink subresources are far harder to block. They can change how ads are styled basically every hour if they wanted, which would make any kind of rule-based ad blocking ineffective. If every ad platform did this, ad block as we know it would be dead.