7 ms·

> No, they're asking for consent to track because the EU demanded it. Personally, I think that despite seemingly good intentions, this common practice is count

> No, they're asking for consent to track because the EU demanded it. Personally, I think that despite seemingly good intentions, this common practice is counterintuitively harming user-privacy and security, especially on mobile where the banners take up a large chunk of the screen. Many normal people get something like "banner-blindness": they are so used to seeing banners requesting confirmation when they visit a website that they by default click any random buttons they see to try and hide them right away without reading what is requested. This practice doesn't really help anybody, IMO, and should probably be handled on the browser-level if people care about it.

kurthr 5y ago
On mobile, I often can not even check a box. Rotation sometimes solves the problem. Firefox -noscript always does, if I care that much.
- rob74 5y ago
  ...except for sites that completely stop working when JS is disabled.
  - kurthr 5y ago
    Ha! Yes, exactly... it "solves the problem", but not always as desired :^)
matheusmoreira 5y ago
I don't understand why they didn't use the Do-Not-Track header. It's perfect: a client sending DNT is explicitly denying consent to any form of tracking before the page is even rendered. The presence of such a header should cause web applications to automatically delete any and all tracking javascript from their pages at the very least. No idea why it turned into this cookie banner nonsense.
- kmeisthax 5y ago
  Microsoft pulled an Apple and turned DNT into opt-in. Advertisers were very clear that they would only honor DNT if it people were tracked by default. The EU then passed a bill that said you can't collect data unless it's for one of six reasons, one of which is "user consent". This basically mandated opt-in, so everyone went super-aggressive on consent banners (which, BTW, are probably illegal).
  - toxik 5y ago
    Consent popups are legal so long as agreeing is not easier than disagreeing. Iow, you cannot make it harder to disagree - which 99.95% of them do.
    - gnud 5y ago
      Also, "consent" has a specific meaning in GDPR, see article 4(11) [0]: > Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Which is why I suspect almost all "cookie banners" are worthless. They don't give a clear, informed consent, so the site operator is still not allowed to use the data for anything at all. 0: https://gdpr.eu/article-4-definitions/ https://gdpr.eu/article-4-definitions/
    - trompetenaccoun 5y ago
      Seems like a good case for a class action suit. Why hasn't this happened yet?
      - eurasiantiger 5y ago
        Because it would have hundreds of millions of people in it.
    - eurasiantiger 5y ago
      Revoking consent must also be as easy as consenting. Almost no site does this correctly.
kodah 5y ago
> Personally, I think that despite seemingly good intentions Why do you think they have good intentions? Many of these banners employ some pretty slick dark patterns for you to opt-in to their most critical analytics. One of my favorites is when cookie selection is more than one click from the banner, or it causes a page reload.
- godelski 5y ago
  I've seen a few of those where you reject all and it causes a page reload, hence putting you in a loop where the banner comes back.
- logicalmonster 5y ago
  I think you're talking about the businesses' motivations and I'm talking about the random EU bureaucrats that imposed the regulations. Despite how skeptical I am of most government interventions, I'd tend to assign benign intentions on the bureaucrats part here as I'd have to guess that they genuinely wanted to do something good. But like any bureaucrats sitting in their ivory towers imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees that even when well-intentioned produce a mish-mash of inconsistent ideas, etc.
  - raverbashing 5y ago
    > imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees It's a valid critique, so here goes: how would you implement it to avoid those?
    - david422 5y ago
      Make it part of the browser, not the website.
      - Nextgrid 5y ago
        The "make it part of the browser" argument doesn't work in practice because the GDPR covers the intent and purpose of data collection/processing rather than any specific technical way of collecting or processing said data. Blocking cookies at the browser level doesn't prevent the website from using browser fingerprinting or the information you manually provided (your delivery address to make a purchase for example) in a way you didn't agree with.
shadowgovt 5y ago
It's a modern variant of the "this site is unsafe, continue using" click through that browsers gave for incorrectly configured SSL before the major browser vendors converged on the conclusion that they should make it actively hard to pass through insufficiently-secured SSL configuration because users would just click okay on the spooky dialog.
sowbug 5y ago
and should probably be handled on the browser-level if people care about it. Some of the original Chrome browser team have followed this line of thought: https://neeva.com/blog/introducing-cookie-cutter-by-neeva-a-free-chrome-browser-extension https://neeva.com/blog/introducing-cookie-cutter-by-neeva-a-...

kurthr 5y ago

On mobile, I often can not even check a box. Rotation sometimes solves the problem. Firefox -noscript always does, if I care that much.

rob74 5y ago
...except for sites that completely stop working when JS is disabled.
- kurthr 5y ago
  Ha! Yes, exactly... it "solves the problem", but not always as desired :^)

matheusmoreira 5y ago

I don't understand why they didn't use the Do-Not-Track header. It's perfect: a client sending DNT is explicitly denying consent to any form of tracking before the page is even rendered. The presence of such a header should cause web applications to automatically delete any and all tracking javascript from their pages at the very least. No idea why it turned into this cookie banner nonsense.

kmeisthax 5y ago
Microsoft pulled an Apple and turned DNT into opt-in. Advertisers were very clear that they would only honor DNT if it people were tracked by default. The EU then passed a bill that said you can't collect data unless it's for one of six reasons, one of which is "user consent". This basically mandated opt-in, so everyone went super-aggressive on consent banners (which, BTW, are probably illegal).
- toxik 5y ago
  Consent popups are legal so long as agreeing is not easier than disagreeing. Iow, you cannot make it harder to disagree - which 99.95% of them do.
  - gnud 5y ago
    Also, "consent" has a specific meaning in GDPR, see article 4(11) [0]: > Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Which is why I suspect almost all "cookie banners" are worthless. They don't give a clear, informed consent, so the site operator is still not allowed to use the data for anything at all. 0: https://gdpr.eu/article-4-definitions/ https://gdpr.eu/article-4-definitions/
  - trompetenaccoun 5y ago
    Seems like a good case for a class action suit. Why hasn't this happened yet?
    - eurasiantiger 5y ago
      Because it would have hundreds of millions of people in it.
  - eurasiantiger 5y ago
    Revoking consent must also be as easy as consenting. Almost no site does this correctly.

kodah 5y ago

> Personally, I think that despite seemingly good intentions Why do you think they have good intentions? Many of these banners employ some pretty slick dark patterns for you to opt-in to their most critical analytics. One of my favorites is when cookie selection is more than one click from the banner, or it causes a page reload.

godelski 5y ago
I've seen a few of those where you reject all and it causes a page reload, hence putting you in a loop where the banner comes back.
logicalmonster 5y ago
I think you're talking about the businesses' motivations and I'm talking about the random EU bureaucrats that imposed the regulations. Despite how skeptical I am of most government interventions, I'd tend to assign benign intentions on the bureaucrats part here as I'd have to guess that they genuinely wanted to do something good. But like any bureaucrats sitting in their ivory towers imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees that even when well-intentioned produce a mish-mash of inconsistent ideas, etc.
- raverbashing 5y ago
  > imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees It's a valid critique, so here goes: how would you implement it to avoid those?
  - david422 5y ago
    Make it part of the browser, not the website.
    - Nextgrid 5y ago
      The "make it part of the browser" argument doesn't work in practice because the GDPR covers the intent and purpose of data collection/processing rather than any specific technical way of collecting or processing said data. Blocking cookies at the browser level doesn't prevent the website from using browser fingerprinting or the information you manually provided (your delivery address to make a purchase for example) in a way you didn't agree with.

shadowgovt 5y ago

It's a modern variant of the "this site is unsafe, continue using" click through that browsers gave for incorrectly configured SSL before the major browser vendors converged on the conclusion that they should make it actively hard to pass through insufficiently-secured SSL configuration because users would just click okay on the spooky dialog.

sowbug 5y ago

and should probably be handled on the browser-level if people care about it. Some of the original Chrome browser team have followed this line of thought: https://neeva.com/blog/introducing-cookie-cutter-by-neeva-a-free-chrome-browser-extension https://neeva.com/blog/introducing-cookie-cutter-by-neeva-a-...