10 ms·
>those in charge of the cookie banners really believe that they protect the interests of the user No, they're asking for consent to track because the EU demand
by kmeisthax 5y ago
>those in charge of the cookie banners really believe that they protect the interests of the user
No, they're asking for consent to track because the EU demanded it. The easiest way to avoid having a banner on your site is to... just not have an analytics package on your site. They're aggressive because they don't want their data spigot turned off - hence the work-to-rule nonsense. You should not infer any benevolence on the part of the people implementing these banners.
My personal habit is to always click whatever option denies the most amount of tracking, mostly because I can.
- tomc1985 5y agoAt least in the EU most sites seem to automatically disable nonessential cookies if you don't click Accept. The American equivalents all force you to manually uncheck everything
- martin_a 5y ago> At least in the EU most sites seem to automatically disable nonessential cookies if you don't click Accept. They have been well-advised by their lawyers. Anything else is just a bomb waiting to explode on you.
- codedokode 5y agoAnd if someone wrote a browser extension that hides those popups (or makes them scrollable instead of sticky), the user would not need to do anything to reject cookies.
- tpush 5y agoExactly. This is an absolute key point I find most people miss in these discussions. GDPR fundamentally changes the default of whether tracking is allowed to occur or not. If a user browses the web automatically blocking (just deleting/blocking the element, not automatically clicking accept) every consent pop-up, the website is not allowed to track them nor is it allowed to block the user from using the website. If you had such a browser extension, and if websites were actually conforming to the law, all EU users could browse the web without ever seeing any popup and without ever getting tracked.
- andrewaylett 5y agoThis one: https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-a... Works brilliantly :).
- adhesive_wombat 5y agoNote that sometimes that may accept cookies (not sure when it does that, but it does say it can do).
- JTbane 5y ago>No, they're asking for consent to track because the EU demanded it. Given that you can completely block cookies and other tracking in the browser, why on earth did they bother? I despise bureaucrats writing laws when they don't understand technology.
- Ekaros 5y agoOn other hand there could be an extension that sends tracking history and everything else to everyone. If you really want to share that information.
- matheusmoreira 5y agoBecause cookies are useful functionality that should be used in our best interests, not to pad some corporation's bottom line via surveillance capitalism. We shouldn't have to block cookies or anything, they're the ones who have to stop creating software that is essentially malware.
- kmeisthax 5y agoI despise engineers writing code when they don't understand laws. Yes, we can play the tracker-removal cat-and-mouse game, but that involves a lot of time and effort, projected forever. This battle is going to be won by whoever has the most time and money to waste, and, spoiler alert: it's not the adblock vendors. It's Google. In the specific case of cookies, you need those to authenticate to web services, so you can't just block all of them. Instead you need to delicately allow or deny every cookie based on if it's purpose is holding a login token or tracking a user. In fact, sometimes it's both. Strictly speaking, if I log into Facebook, that shouldn't be considered consent to track. But right now, that's how it works. You know all those "login with Facebook" buttons all over the web? Those give Facebook third-party tracking capability. There is no browser extension in the world that will allow you to login with Facebook without also telling Facebook what site you were logging into. You need a law to force Facebook to split-brain themselves and silo off that data from their advertising operations. Yeah, sure. "Just don't use Login with Facebook". Except every third-party login system has this problem - and there are plenty of smaller companies that absolutely do not want to handle user credentials and require that you use a third-party login service. And given that using smaller providers are the easiest way to get your credentials stolen, it is entirely understandable and advisable that they not roll their own authentication. Furthermore, most users are not at all aware of all the technical stuff I mentioned above - and they shouldn't have to be in order to have privacy. Having a well-written law is a lot easier: you just tell Facebook, "no, really, if you use your login service to track people we're going to fine you". Corporations react to (sufficiently large) fines a lot more favorably than technical restrictions or circumvention. "Don't be evil" is a way bigger guarantee than "can't be evil".
- peter-m80 5y agowell said
- loceng 5y agoDo you know if it is only third-party analytics being called that requires the prompt, or is setting any cookie for the website's use only requiring permission too?
- gumby 5y agoIn house analytics and third party analytics are the same for the law. It’s all about user tracking.
- shafyy 5y agoEssential cookies that are necessary for the website to run do not need a permission from the user. For example, if you want to use cookies to save a selection or a language setting, you don't need to ask for permission.
- lucraft 5y agoYep - but to clarify, the cookies must really be NECESSARY - i.e. your site or app would be unusable without the feature they implement. A cookie that saves, for instance, a preference may not be considered essential but a "Functional Cookie" that adds extra features, because your app is usable without it, and then you do need permission for it.
- shafyy 5y agoWell, what does unusable mean? If my app offers a feature and the cookie is necessary for it to work, then it's essential. For example, a cart feature in an ecommerce app. Could you shop without a cart? Sure, still I would consider this cookie essential.
- jonny_eh 5y agoA cart does sound essential, but I guess it's up to a judge to decide. Perhaps you should implement a cookie-less "buy now" option to avoid needing to go before a judge.
- logicalmonster 5y ago> No, they're asking for consent to track because the EU demanded it. Personally, I think that despite seemingly good intentions, this common practice is counterintuitively harming user-privacy and security, especially on mobile where the banners take up a large chunk of the screen. Many normal people get something like "banner-blindness": they are so used to seeing banners requesting confirmation when they visit a website that they by default click any random buttons they see to try and hide them right away without reading what is requested. This practice doesn't really help anybody, IMO, and should probably be handled on the browser-level if people care about it.
- kurthr 5y agoOn mobile, I often can not even check a box. Rotation sometimes solves the problem. Firefox -noscript always does, if I care that much.
- matheusmoreira 5y agoI don't understand why they didn't use the Do-Not-Track header. It's perfect: a client sending DNT is explicitly denying consent to any form of tracking before the page is even rendered. The presence of such a header should cause web applications to automatically delete any and all tracking javascript from their pages at the very least. No idea why it turned into this cookie banner nonsense.
- kmeisthax 5y agoMicrosoft pulled an Apple and turned DNT into opt-in. Advertisers were very clear that they would only honor DNT if it people were tracked by default. The EU then passed a bill that said you can't collect data unless it's for one of six reasons, one of which is "user consent". This basically mandated opt-in, so everyone went super-aggressive on consent banners (which, BTW, are probably illegal).
- omnicognate 5y ago> My personal habit is to always click whatever option denies the most amount of tracking, mostly because I can. Likewise, except: * If for any reason I can't easily deny all the unnecessary stuff (eg. there isn't a way or they have something like the Daily Mail where to disable all the "legitimate interest" you have to click literally hundreds of individual boxes) I don't click anything and leave the site immediately. * I don't do it because I can. I do it because by clicking OK I would be explicitly consenting to being tracked and I don't want to be tracked. The content is pretty much never worth it. ("It" being falsely telling people I'm fine with being tracked. I'm perfectly aware it will happen anyway.)
- eurasiantiger 5y agoThose consent boxes are nowadays used to blanket consent to things like telemarketing. I would never tell anyone to click agree on anything they haven’t thoroughly read, except proprietary software EULAs.
- jonny_eh 5y ago> The easiest way to avoid having a banner on your site is to... just not have an analytics package on your site. What if there's back-end only analytics? Does that require a banner?
- morelisp 5y agoIf you're storing personal data, you need consent. A banner would be the least intrusive way to do that. (If your backend analytics don't store a cookie and don't store IPs, you may not be storing personal data to begin with.)
- Beldin 5y agoNo. You only need consent if there is absolutely no reason for you to have that data. Consent is the emergency hatch, only to be used in exceptional circumstances. "But what gives?!", I hear you think. As a law professor said (roughly): it was truly amazing to see how an entire industry colluded so swiftly and completely to undermine legislation.
- deleted 5y ago[deleted]
- morelisp 5y ago> You only need consent if there is absolutely no reason for you to have that data. Also no. There are specific acceptable reasons to have the data. LI is a weak one and does not apply in many situations (there are a lot of balancing factors applied, including a "reasonable person" standard on the data subject). As you say, consent is a very strong one, if received it can virtually always apply. The ones in-between only apply in limited situations genuinely necessary for business (company management of employee data, addresses of customers you need to ship to) or to a small set of companies (hospital management of health data, AML/KYC for banks), and rarely to general web / app analytics. "I would like that data to serve ads better" (or "to sell to someone who wants to serve ads better") is not "absolutely no reason", but it is also rarely one of the other reasons. And conversely, even if in some case if you have a legitimate business interest i.e. would go bankrupt without it, it is not LI in the sense of GDPR if it cannot meet other factors. The modern adtech ecosystem more or less requires "consent-strength" allowances.
- shadowgovt 5y agoKeeping in mind, of course, that Apache access logging in its default configuration probably counts as "an analytics package." If you're running a site, it's just safer to ask than to assume that you know your site is not tracking users.
- hedora 5y agoAt this point, I'd be happy with a service that has my browser send a "do not track" header on each request, and also open a proxy connection to a black hat server each time the page decided to make a request to a known tracking domain.
- remram 5y agoA "black hat server"?
- salawat 5y agoSomeone is trying to convey that a plugin should report sites that are detected ignoring DNT to ne'er'do'wells to invite horrible things to happen to them. It's a newbie, be nice. They don't get how it works yet.
- hedora 5y agoNot a newbie. Let 'em use a MiB or so from my legimate browsing session with legitimate IP to perpetrate click fraud or auction fraud or whatever. That'll make it harder for fraud detection to work (the traffic is legitimate, organic traffic after all). If enough people do it, tracking firms that ignore DNT will have garbage datasets or worse. I've worked on systems for detecting this sort of fraud. Systematically injecting malicious traffic into legitimate click streams would defeat most anti-abuse measures that I've seen.
- remram 5y agoYou want to let people commit whatever fraud they want using your computer? Knowingly? How will you defend yourself in court? "I didn't do it, I just let somebody else use my machine, yes I knew they were up to no good that was the point, but to my defense I was shown an ad"?
- hedora 5y agoThe tracking servers are using my computer without authorization. (The "do not track" header specifically told them so.) So, their complaint is what, exactly? They tried to run unauthorized code on my machine, it noticed, and forwarded the unauthorized logic/connection/nonce/etc to a honeypot? This isn't an actual service I plan to build. If someone else does, and prevails in court, rest assured I'll be cheering them on.
- adhesive_wombat 5y ago> hence the work-to-rule nonsense It's not even work-to-rule. It's illegal if the button to refuse consent is in any way less obvious than the button to grant it, which it nearly always is. Notably, OneTrust, which provides a lot of the banner solutions which are illegal gets it right on their own website. So they do know the rules, but they knowingly provide a solution that's illegal.
- cplusplusfellow 5y agoIt’s an absolute pity that the legislature didn’t require : deny everything : remember my selection : if the same analytics package exists on other sites, remember my g’d selection