21 ms·

Google gives Europe a ‘reject all’ button for tracking cookies

blue_box 4y ago
I’m hoping that Apple will bring this reject all tracking cookies option to Safari so websites read that instead of asking all the time.
- JadeNB 4y ago
  We've already encountered that with "Do Not Track"—as soon as you have anything that doesn't require user intervention, websites start arguing that it doesn't reflect the users' intention, and so they have to protect us from the nasty browsers by tracking us.
  - guiambros 4y ago
    To be fair, the DNT launch was botched from the beginning, starting more as hack than an industry-wide consensus [1]. While it eventually got implemented by browsers, it lacked adoption, and had risks with fingerprinting [2]. The nail in the coffin was when Internet Explorer 10 decided to enable it by default [3], completely disregarding user intent. [1] http://paranoia.dubfire.net/2011/01/history-of-do-not-track-header.html http://paranoia.dubfire.net/2011/01/history-of-do-not-track-... [2] https://www.macworld.com/article/232426/apple-safari-removing-do-not-track.html https://www.macworld.com/article/232426/apple-safari-removin... [3] https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...
    - nfoz 4y ago
      "Do not track me" IS the reasonable default expectation of user intent, to be fair.
      - Macha 4y ago
        And is what the GDPR is trying to establish as the legal baseline, though things are moving slowly (this article is showing they _are_ moving though)
    - ahtihn 4y ago
      > The nail in the coffin was when Internet Explorer 10 decided to enable it by default [3], completely disregarding user intent. User intent? Really? Because user intent is to allow tracking by default?
      - Sargos 4y ago
        Certainly not at the near 100% level that the default setting suggests. Microsoft poisoned the well with DNT and worsened privacy on the web for everyone.
        JadeNB 4y ago
        I can believe that there are some people who don't care if they're tracked, but do you believe that there's anyone who wants to be tracked? Maybe someone out there somewhere does, but surely such people, who actively want to be tracked, are in the distinctly small minority. In that case, why should the onus be on everyone else to communicate their intent, rather than on the few users affected to communicate their intent?
        Sargos 4y ago
        >why should the onus be on everyone else to communicate their intent, rather than on the few users affected to communicate their intent? Because this effectively bans any kind of tracking cookies which, while most are kind of awful, there are legitimate reasons for their existence. Shifting the conversation from a user choice to an effective ban is a completely different conversation with pros and cons that must be considered separately.
        JadeNB 4y ago
        > Because this effectively bans any kind of tracking cookies which, while most are kind of awful, there are legitimate reasons for their existence. Shifting the conversation from a user choice to an effective ban is a completely different conversation with pros and cons that must be considered separately. It doesn't at all ban them—it just makes them only effective for users who explicitly opt in. And if that's too much of a burden to impose on those very few users, then why is it reasonable to impose the burden on the vast majority of users who don't want to be tracked?
- axg11 4y ago
  Cookies are just completely broken. The EU should never have got involved in the way that it did. No matter how positive the intentions, the web is a worse experience as a result, with marginal privacy gains.
  - zasdffaa 4y ago
    > Cookies are just completely broken In what way? > The EU should never have got involved in the way that it did Maybe, can you explain where it failed. > the web is a worse experience as a result That's debatable > with marginal privacy gains can you quantify that? Myself, I turn off all JS and nix all cookies (with about the only temporary exceptions being for posting on HN). WFM.
  - dmitriid 4y ago
    > the web is a worse experience as a result, with marginal privacy gains. The web is a worse experience because of companies like Google and IAB willingly breaking the law. But sure, blame the law.
    - hedora 4y ago
      I'm really hoping Do Not Track becomes legally binding. (Also, how is it not already treated like a piece of a contract negotiation? It is machine readable and sent on every request. Hidden website EULA's are already treated like contracts.)
      - dmitriid 4y ago
        DNT is deprecated and now removed from all browsers because it was ironically used for fingerprinting and tracking.
  - Jon_Lowtek 4y ago
    The focus on cookies was always a bit off and more a result of too much technical detail resulting in laws missing their intent. The legislative moves slowly, over time, this will be fixed. However the legislative regulating how webservices have to handle data privacy was very necessary (and the people of the USA should really consider amending their constitution by also demanding a basic human right to data privacy). The key elements are "informed choice" and "consent to data gathering/processing" which have little to do with cookies. Let's say you buy a smartphone from china and it comes with a keyboard app that sends all your inputs to a chinese company so they can make predictions and offer autocompletion. You kind of want that app to display a banner asking you if that is okay. And you kind of want a privacy policy attached that explains they will create user specific profiles and sell them to advertisers and share them with the chinese ministry of state security. I think you want that banner. Now google analytics isn't much different. It tracks you all over the web, creates profiles of your browsing habits, sells those to advertisers and shares them with the american national security agency. Sure it also shows statistics to the website owners, the same way that keyboard app has an autocomplete function, but you kind of want to be informed about those other functions and have the option to say no, don't you? That is why 'consent management' is so important for data privacy.
- kemayo 4y ago
  I use a Safari extension for that: https://www.super-agent.com https://www.super-agent.com
  - SebastianKra 4y ago
    I've seen them before. Do you have any idea what their game is? They claim to be completely free and completely privacy respecting. No mention of a business model. Do they hope to make some deal with advertisers later on?
    - jpalomaki 4y ago
      ”We make money by selling a snippet of code to websites that integrates with Super Agent. Essentially, websites can have a JS snippet unique to them so that when a user with Super Agent visits, cookie preferences are applied automatically without having to ask anything.” https://www.super-agent.com/faq https://www.super-agent.com/faq
      - SebastianKra 4y ago
        Thanks that 's the part I forgot: Why would website owners actually go for that? They need the annoying popup to get consent.
martin_a 4y ago
Somewhat ironic that the cookie banner of theverge.com is using the same tactics/patterns (or even worse, according to UBlock Origin) that Google was fined for.
werid 4y ago
i just wish i could tell the browser to auto accept all
- tgsovlerkhgsel 4y ago
  Or better, auto reject all?
  - IceWreck 4y ago
    Rejecting all cookies would be disastrous. You wouldn't be able to log in to any website (unless they use JavaScript storage for logging in, which is less secure that cookies) And btw, you can already disable all cookies for a particular website, or all websites in both FF and Chromium. Just click the lock https icon > more info and choose the cookie setting.
    - tgsovlerkhgsel 4y ago
      No, auto-reject what the sites let you reject. Because surprise surprise, actually necessary cookies like you describe don't require consent.
      - IceWreck 4y ago
        > No, auto-reject what the sites let you reject That would require sites to implement some kind of yet-to-exist browser API telling it which cookies are used for tracking and which are not. And why would any website implement that ? The EU can't force websites to implement feature X.
        aaomidi 4y ago
        I mean the EU can force websites to do whatever. That includes implementing a feature. As we saw with cookie consent law and GDPR. And as we're going to see with interop requirements for chat apps. And the DNT header can be used exactly for that.
    - 4y ago
14 4y ago
When will North America get the same luxury? Or do we have to trick google into thinking we are in Europe?
- bdefore 4y ago
  Are there noticeable benefits right now for telling Google you live in Europe?
  - Nextgrid 4y ago
    More privacy if you assume they actually respect the GDPR internally (but this occurrence is just yet another example of bad faith that suggests that the entire thing might be a charade and they stalk you anyway regardless of your settings).
- pkaye 4y ago
  California has CCPA which seems to be going in a similar direction for easy optout. https://www.jdsupra.com/legalnews/ccpa-regulations-update-and-the-opt-out-3518221/#:~:text=Methods%20for%20submitting%20requests%20to,consumer's%20right%20to%20opt%2Dout https://www.jdsupra.com/legalnews/ccpa-regulations-update-an....
kqvamxurcagg 4y ago
Google of course would have known this UX was likely to be illegal but made the decision that any fine would be much less than the commercial benefit.
- axg11 4y ago
  It would be fascinating to see the design review document and resulting launch metrics for this. Somewhere deep in Google there is a written justification for the previous dark pattern.
  - tgsovlerkhgsel 4y ago
    If the people responsible for the decision listened to the lawyers, I doubt there will be any written notes on this...
    - robonerd 4y ago
      Or they CC'd lawyers in all the discussions, ostensibly to receive legal review but actually so they could later try to hide those discussions from discovery under the pretext of it being privileged attorney-client communication. "Google routinely hides emails from litigation by CCing attorneys, DOJ alleges" https://arstechnica.com/tech-policy/2022/03/google-routinely-hides-emails-from-litigation-by-ccing-attorneys-doj-alleges/ https://arstechnica.com/tech-policy/2022/03/google-routinely...
      - anticensor 4y ago
        As soon as you add a third party as a carbon-copy recipient, you lose the privacy privilege of the attorney-client communication.
kerng 4y ago
Good! Now can Google please also respect the DNT header and automatically reject all cookies if present? That would demonstrate real leadership and putting the user experience first.
- bouke 4y ago
  DNT is dead, sadly.
- LunaSea 4y ago
  As soon as user start paying subscription.
  - Nextgrid 4y ago
    Where can I buy a subscription that gives me all of Google's services with no ads & stalking? As far as I know you can pay for some stuff such as Workspace or YT Premium but some services such as Search or Maps are still ad-supported and no doubt stalk you anyway (since there's at least one ad-supported service, the incentive to stalk the user remains).
tgsovlerkhgsel 4y ago
Background (which also explains why it's being rolled out in France first): https://www.theguardian.com/technology/2022/jan/06/france-fines-google-and-facebook-210m-over-user-tracking-cookies https://www.theguardian.com/technology/2022/jan/06/france-fi... - on January 6, Google was given 3 months to fix this, with a 100k fine for each additional day. I'm wondering why it took slightly but not significantly more than the 3 months. On one hand, adding a button doesn't have to take 3 months despite all the necessary reviews etc., not if it's actually considered a priority. On the other hand, if the benefits were considered worth the fine/fee, you'd expect a bigger delay.
- ______-_-______ 4y ago
  They'll gladly pay (maybe) 2 million in fines so that later they can pretend complying was extremely difficult for them. Drop in the bucket in the long run.
  - whitesilhouette 4y ago
    Just came here to say I really liked your userid (or whatever is called nowadays).
    - deleted 4y ago
      [deleted]
- remus 4y ago
  Personally I wouldn't read too much in to the timing. Although the end result looks small the change affects multiple large projects, each with hundreds of millions of users, and likely has knock on effects in other parts of google. Sprinkle in a bit of legal review + big company bureaucracy and I can easily imagine it taking 3 months.
- ratww 4y ago
  They are definitely already A/B testing this. I'm in Germany and sometimes I see the "Decline" button when opening Google in an incognito window.
jdrc 4y ago
"we will track your ass via other means"
- mirntyfirty 4y ago
  mwahahahahahah Yes, now if Android had a button for shutting off telemetry, that’d be even better.
- nicbou 4y ago
  LeGiTiMaTe InTeReSt!
- simion314 4y ago
  >"we will track your ass via other means" GDPR applies even if you use pen and paper, you still need to ask for permissions. But in this case it was a dark pattern, Google had no choice then to ask for permission but made it hard to deny them.
  - Tomte 4y ago
    No. "This Regulation applies to the processing of personal data wholly or partly by automated means […]" Sure, if a machine uses a plotter, but not if a human being is writing stuff down.
    - PeterisP 4y ago
      The [...] you omitted is "and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system." - if your company takes notes on your customers with pen and paper and puts these notes in a drawer for further use in your business processes, GDPR definitely does apply. A random real example is that I used to work in a building which had a paper logbook where people sign the time and name when taking/returning keys for the meeting rooms. That logbook falls under GDPR as it has personally identifiable information - there's the legitimate need use case justifying it; but if the company suddenly wanted to use the stored data for some other purpose, that might be restricted.
    - 4y ago
tjoff 4y ago
The linked source: https://blog.google/around-the-globe/google-europe/new-cookie-choices-in-europe/ https://blog.google/around-the-globe/google-europe/new-cooki... It is "funny" reading that, the amount of energy they spend to be illegal but only just so that they can squeeze as much dark patterns on their users before they get a fine. Rinse and repeat. For normal companies / webmasters it is quite simple though. You don't have anything to gain from extorting your users. So please respect your users instead. Don't use shady practices that require you to bring up a cookie-banner in the first place. Just don't.
- nicbou 4y ago
  Shady practices like knowing how many visitors you get on your website? Don't get me wrong, there's the excellent Plausible for that, but collecting usage statistics is far from shady.
  - throwaway5371 4y ago
    you can do that without selling out your users
    - nicbou 4y ago
      Yep, and we clever HN people know that. But the web isn't all clever hackers. There are lots of small businesses with WordPress websites who just want to see a graph on a page. They will keep adding cookie banner plugins so long as they can keep seeing that graph. I switched to plausible because the added privacy is also a major UX benefit: there's no GDPR banner on my website.
      - belorn 4y ago
        I would claim, based exclusively on experience, that most small businesses websites are built by web design companies. It is people working in the web shop industry that make decision about build tools. Also in my experience, there isn't usually a GDPR banner on small businesses websites built on wordpress. A pizzeria, barber, local grocery store, or some other small businesses don't really have or need much on their website. A few images, a page for location/contact, a page about the employees/founders, and for the more advanced ones a web shop. No GDPR needed for any of that, and for those web shops, once a person is registered all the consent are usually given as part of the registration processing. The typical model that I see for small businesses is also one where no one need or want a graph over visitors. The customer pay the web shops a one-time fee to build the site, and then it mostly sits there until the customer decide to build a completely new website because the old one is getting too old. No A-B testing, no optimization for user retention, no frontend interactions, no user flows. Mostly all the customer want is to not be paying a web developer any more money. This is why some shops will utilize "proprietary modules" in order to keep the customer on their (usually partners) servers, in case the customer might get ideas of moving the site to a better/cheaper hosting provider. The most common situation that I know of when people are requesting visitor graphs is either when customer apply an marketing campaign and want to see the effect on their website, or when a conglomerate has acquired a bunch of smaller companies and want to make decision about closing down/merging specific website. In those cases the analytics usually get added when that need arrive.
tintedfireglass 4y ago
Only Europe. Sigh.
- jeroenhd 4y ago
  Though the current state of the web is depressing, the rise of piracy and TOS-breaking VPNs for the general public made it quite easy and inconspicuous for people to use VPN services. You can effectively get the protection of any EU based citizen by setting up a VPN with an endpoint in Europe. There are dirt cheap options thanks to the man youtube sponsor discounts, and there are privacy-first VPN providers like Mullvad who are pricier but better if you care about your traffic.
Raed667 4y ago
Still no button in France, any ETA on the release? https://imgur.com/a/6gQUoBK https://imgur.com/a/6gQUoBK
- unicornporn 4y ago
  Got it in Sweden today.
hedora 4y ago
OK, so there's a single button, and if you press it, all Google properties will stop tracking you across all sites? Bulls@#t. Next they'll be claiming they never monetize user data.
- Nextgrid 4y ago
  That's the intent of the law/regulation, but indeed I very much doubt they will just comply and call it a day. Most likely in a couple years it will emerge that there's one more way of stalking that conveniently wasn't being disabled by this "disable all" button. It's sad that even several instances of bad faith along with a business model based on breaching the GDPR is still not enough for the record-breaking "4% of global turnover" fines to actually appear.
fallingknife 4y ago
okamiueru 4y ago
Does this "reject all" accept the "legitimate uses" which very clearly break GDPR? Most GDPR dialog windows I've encountered have made it harder to opt out of what they incorrectly claim to be "legitimate interests". According to GDPR, a "legitimate interest" has very clear requirements, which are by no means met. This "legitimate interests" very often includes things like "creating a personalized add profile and tying it to external data lakes and devices", which is by no means necessary in order to provide the service. I'm waiting for what has become the de-facto abuse of GDPR to have a serious reckoning.
- jeroenhd 4y ago
  The legitimate interest ticks are just another way for the scum of the web to break the law. I hope the makers of these popups will at some point get fined to hell because of their sneaky attempts to smuggle tracking into the browsers of people who click the "fuck you and fuck your cookies" button.
- Macha 4y ago
  The warning shot for "legimate interests" has been fired in the IAB Europe lawsuit, in IAB Europe's position as the advertising interest body which endorsed it for advertising uses: https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-euros-over-consent-framework-gdpr-violations/ https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-eu... I assume if France was breathing down Google's neck in the design of this feature (or as Google puts it "Providing specific direction"), I assume this does not have legitimate interest bullshit.
ckastner 4y ago
What an amazing win for Europe, and the GDPR. This isn't about just the button. Until a few years, "you're not the customer; you're the product" was the norm for a typical user's interaction with the internet, and they were powerless to change that. Then the GDPR came along, declaring that users have fundamental right to their data, and as such, they no longer can be forced to be "the product" without their consent. One of its most empowering rules, however, is in Article 7 (4): "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." So consent must be (1) freely given, and (2) it's not free if you're blocking access to service A by requiring consent for service B, when B is unnecessary for performing A. Hence, a search engine cannot force you to consent to tracking for advertising purposes, because technically, the search engine doesn't need it. So how can the search engine make money? One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking).
- jsnell 4y ago
  > One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking). Where has that been ruled legal, and do you have a link to the ruling? I've only seen German newspapers do this, so my assumption has been that it's just the German authorities turning a blind eye to it. If it's really a legit option, it seems like a miracle that nobody else is using this.
  - ckastner 4y ago
    > Where has that been ruled legal, and do you have a link to the ruling? This was communicated to me by a law firm specializing this area. This was with regards to the newspaper "derstandard.at". Here's a source in German which includes the ruling as a PDF [1]. I see that in the meantime, this "pay or okay" model has been questioned again, but in any case, a ruling exists. And, as I was told, the national DPAs don't just rule as they see fit, but rather coordinate with other DPAs, in order to harmonize the enforcement across the EU. [1] https://www.dataprotect.at/2018/12/07/payortrack-die-entscheidung-der-dsb-nicht-rechtskr%C3%A4ftig/ https://www.dataprotect.at/2018/12/07/payortrack-die-entsche... > If it's really a legit option, it seems like a miracle that nobody else is using this. None of the big sites are using it because it's frequently far more profitable to track people. Just look at various revenue-per-user stats. And the users most willing to spend money for no-tracking tend to be the users who also spend money on other things, so their the users you'd want to advertise to the most.
NelsonMinar 4y ago
I've noticed when I go to configure my cookies on European sites, most of them default to all the tracking stuff turned off. Is that typical? Is it required by the law? They still do everything they can in the UI to encourage you to "accept all", but there's generally a single button to click to "reject all" and it'd be more work to pick and choose.
- U1F984 4y ago
  Yeah, it's a requirement by law, tracking must be disabled unless explicitly allowed. Accepting all must be as easy as denying. However a lot of sites offer an easy one-click accept all and the deny all is behind a two step "configure" + "confirm selection", sometimes even with a fake save timer.
  - NelsonMinar 4y ago
    Thanks! I looked for info on this and failed; is there some reference I can share with people about how this part of the law works? Maybe it's not completely obvious, apparently Google had failed to comply with it.
    - matsemann 4y ago
      Gdpr article 7 says it should be as easy to withdraw consent as to give it. The rules are pretty straightforward, really, it's just Google banking on the fines for not doing it correctly would be less than the profit made.
      - NelsonMinar 4y ago
        Article 7 is pretty non-specific and does not discuss defaults. Recital 32, however, is quite specific and gives me the answer I was looking for https://gdpr.eu/recital-32-conditions-for-consent/ https://gdpr.eu/recital-32-conditions-for-consent/ "Consent should be given by a clear affirmative act ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent."
kgbcia 4y ago
someone needs to step up to Google on this side of the Atlantic. They are constantly in the news regarding their tracking. tracking should be off by default. all cookies should be ban except session cookies that expire when browser closes. we already have saved passwords and logins for browsers
TaylorAlexander 4y ago
It’s so offensive when companies offer the two options “let us track you, or: go through this weird menu to disable tracking”. You know wouldn’t it just be kind to the user to make it easy to go un tracked? Upsetting that they have to be compelled to do it.
- mdaniel 4y ago
  Worse, it's actually just a request to disable tracking, just like the unsubscribe link is a "if you get around to it in 6-8 weeks put my address on a do-not-contact list" Without the very real fear of meaningful fines for tracking after rejection, it's just lip service
- alkonaut 4y ago
  Yes and it’s also not confirming to the regulations that made them add the banner in the first place! I have no idea why anyone chooses to add a banner and then add one that is obviously in violation. Why not then just not add one? Is it because these cases are not yet enforced/fined so they think “let’s put an obnoxious non-compliant one for now, so we keep ad revenue, and only switch to a compliant one if we are actually sanctioned to do so, or the company across the street is fined to oblivion for doing it?” Anyone here working at a site that did this? Why?
  - DangitBobby 4y ago
    They probably don't actually realize it's not compliant. They just saw everyone else doing it and mindlessly followed the herd. Users probably also think they are compliant and blame the EU.
    - Nextgrid 4y ago
      I can believe this argument for a handmade mom & pop site. I will absolutely not believe it for any large tech company such as Google or Facebook or "consent management platform" providers such as TrustArc - that scum knowingly breaches the regulation because their entire business relies on it.
scarface74 4y ago
So because of the government, I now have to deal with a clearer obtrusive cookie banner all over the internet… Thanks???? Where would we be without big government? It definitely made the internet a much better experience. Next law they are probably going to try to pass is force all app makers to use cross platform frameworks like Electron to prevent monopoles.
- hddherman 4y ago
  Cookie banners only exist because websites want to collect data and track users. The banner is a symptom of the real issue, which is what the regulation aims to fix.
  - scarface74 4y ago
    So the regulation both didn’t fix the issue and made the user experience worse…
zeroz 4y ago
In my opinion the whole 'cookie banner industry' sucks. From a customer perspective I'm completely annoyed with different types of banners wasting my time with searching the right button, waiting because of artificial delays, clicking through layers of fake settings to find the reject option and other dark patterns. However, from a provider perspective things a not better. Unnecessary waste of time and money to look for plugins and services to deal with cookie walls to avoid GDPR problems. Best thing would be a EU enforcing the use of a standard browser API to ask for tracking. Just as simple as asking me if I want to share my location or webcam with an option to remember for this domain.
- jeroenhd 4y ago
  I really want the web browser industry to come together and form a new kind of P3P standard, complete with some example libraries for people to use on the backend. Sadly, the browser market is dominated by Google, who has a direct interest in tracking people, Apple, who operates in proprietary protocols unless they absolutely have to, Microsoft, whose stalking exceeds even Google's at this point, and then a tiny slither of well-meaning but overall badly-managed open source projects. Relying on the DNT header is difficult as "tracking" can be interpreted in a number of ways, especially by the data vampires of the advertising industry where they have developed many nice words to make their business so sound harmless. We need a better protocol, implemented across the board, for this to automate away these ridiculous popups. If a sufficiently flexible protocol exists, I'm sure it'll be taken up by either Europe's DPAs or even new legislation, though existing legislation should already be sufficient. The EU should not, and generally doesn't want to, specify which technologies get used because technologies develop faster than bureaucracy. The hastily thrown together Brexit accords mention Netscape Navigator and ancient, insecure, outdated cryptography because they decided to include that in legislation many years ago and the accord was just a combination of existing EU and UK laws thrown together. We don't want that to happen again, especially on a larger scale.
etotolkoya 4y ago
At least in the past, I remember to see the same youtube recommendations even after deleting all cookies etc from the browser. So google was fingerprinting you in one way or the other. I doubt this changed. So what is the point of not using cookies? They are tracking you anyway.
Terry_Roll 4y ago
I saw this the other day on youtube, it appeared, saw the middle Reject All button, clicked it, closed and reset the browser, tried again and it didnt appear! Were they testing bots?!? Regarding the Reject All button, its about bloody time, these tech giants have plenty of other surveillance methods at their disposal if they want to go down that creepy criminal online stalking route, exploiting people's lack of knowledge to make sure shareholders and employees are getting their top dollar.
- aembleton 4y ago
  They're probably a/b testing it
  - Terry_Roll 4y ago
    No there is more surveillance than meets the eye and more hacking in plain site than most people realise, after all when is a company not organised crime?
    - ranguna 4y ago
      Dude chill. As the parent comment said, it was probably just an A/B test. Google does that a lot, even with their old consent dialog, sometimes they used buttons and sometimes they used radio checkboxes.
drdaeman 4y ago
I still don't understand why this is a website thing and not an user-agent^W^W webbrowser thing. EU could have requested browser vendors to implement a mechanism to accept or reject cookies. We wouldn't have those oddly designed (and infrequently infested with dark patterns in attempt to sway users towards accepting everything) bars and popups, and it would've been 100% reliable (and even the reject decision would be remembered correctly) instead of hoping that website actually respects the choice instead of having a banner that does absolutely nothing.
- HWR_14 4y ago
  This sounds an awful lot like the Do Not Track setting in every browser.
  - drdaeman 4y ago
    Yes and no. "Do Not Track" setting does not do anything but sending a header to all websites you visit. Plus, it was blamed to have an unfavorable default. The whole popup mess those days is essentially about those facts - there are no easy per-site controls with no default state (with a possible default if user consciously and explicitly configures their system as "accept all everywhere" or "reject all everywhere" - but this can't be out-of-the-box). Cookie prompts are just like that: per-site and without a default (you have to actively make a decision every time - accept or reject). I'm arguing that it would've been better if all those consent prompts would've been unified and a part of browser UI (rather than website UI). Because of two reasons: 1) the UI and UX would be uniform, consistent, and not prone to design whims and dark patterns; and 2) because this way browsers would be able to guarantee that the choice is partially respected by actually not accepting cookies. DNT header would be still needed to tell website to disable server-side tracking (and one has to believe that website respects it - turning this into a legal matter), but the whole design is different. (Just not like that annoying geolocation or camera popup prompts lol. A bar on top of the webpage would've been a sane option, I guess.)
    - PeterisP 4y ago
      Since the law requires it to be opt-in, having Do Not Track be the automated default without any prompts is not problematic but the whole point of the thing.
bongoman37 4y ago
throwaways85989 4y ago
These consent forms are such a sabotage on the original idea. The idea being, as far as i remember, you set your preferences once. In a container on your machines under your control. Then the site and the container negotiate. Either the side is willing to accept your preferences - or it denies showing to you - or presents you a "negotiated" down version. No clicking. No visible banners. No large forms and lawyer legalese. Just a privacy level setting for the web via standardized API. Europe at least tried but dropped the ball.
- alkonaut 4y ago
  If the site shows something else (I.e not the service the visitor would see if comsenting) then it’s in violation?
bldk 4y ago
they have added it
bldk 4y ago
update: they added it and with EU vpn you can press the reject button! A. will other websites follow? (its so stupid that we had accept all or "more information" button, but never reject and its crazy) B. does it do anything really? i never save cookies in the first place.
LightG 4y ago
Any company that didn't have this set up already can reside at the bottom of the ocean with the rest of the bottom feeders (no disrespect to the mussels)

I’m hoping that Apple will bring this reject all tracking cookies option to Safari so websites read that instead of asking all the time.

JadeNB 4y ago
We've already encountered that with "Do Not Track"—as soon as you have anything that doesn't require user intervention, websites start arguing that it doesn't reflect the users' intention, and so they have to protect us from the nasty browsers by tracking us.
- guiambros 4y ago
  To be fair, the DNT launch was botched from the beginning, starting more as hack than an industry-wide consensus [1]. While it eventually got implemented by browsers, it lacked adoption, and had risks with fingerprinting [2]. The nail in the coffin was when Internet Explorer 10 decided to enable it by default [3], completely disregarding user intent. [1] http://paranoia.dubfire.net/2011/01/history-of-do-not-track-header.html http://paranoia.dubfire.net/2011/01/history-of-do-not-track-... [2] https://www.macworld.com/article/232426/apple-safari-removing-do-not-track.html https://www.macworld.com/article/232426/apple-safari-removin... [3] https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...
  - nfoz 4y ago
    "Do not track me" IS the reasonable default expectation of user intent, to be fair.
    - Macha 4y ago
      And is what the GDPR is trying to establish as the legal baseline, though things are moving slowly (this article is showing they _are_ moving though)
  - ahtihn 4y ago
    > The nail in the coffin was when Internet Explorer 10 decided to enable it by default [3], completely disregarding user intent. User intent? Really? Because user intent is to allow tracking by default?
    - Sargos 4y ago
      Certainly not at the near 100% level that the default setting suggests. Microsoft poisoned the well with DNT and worsened privacy on the web for everyone.
      - JadeNB 4y ago
        I can believe that there are some people who don't care if they're tracked, but do you believe that there's anyone who wants to be tracked? Maybe someone out there somewhere does, but surely such people, who actively want to be tracked, are in the distinctly small minority. In that case, why should the onus be on everyone else to communicate their intent, rather than on the few users affected to communicate their intent?
        Sargos 4y ago
        >why should the onus be on everyone else to communicate their intent, rather than on the few users affected to communicate their intent? Because this effectively bans any kind of tracking cookies which, while most are kind of awful, there are legitimate reasons for their existence. Shifting the conversation from a user choice to an effective ban is a completely different conversation with pros and cons that must be considered separately.
        JadeNB 4y ago
        > Because this effectively bans any kind of tracking cookies which, while most are kind of awful, there are legitimate reasons for their existence. Shifting the conversation from a user choice to an effective ban is a completely different conversation with pros and cons that must be considered separately. It doesn't at all ban them—it just makes them only effective for users who explicitly opt in. And if that's too much of a burden to impose on those very few users, then why is it reasonable to impose the burden on the vast majority of users who don't want to be tracked?
axg11 4y ago
Cookies are just completely broken. The EU should never have got involved in the way that it did. No matter how positive the intentions, the web is a worse experience as a result, with marginal privacy gains.
- zasdffaa 4y ago
  > Cookies are just completely broken In what way? > The EU should never have got involved in the way that it did Maybe, can you explain where it failed. > the web is a worse experience as a result That's debatable > with marginal privacy gains can you quantify that? Myself, I turn off all JS and nix all cookies (with about the only temporary exceptions being for posting on HN). WFM.
- dmitriid 4y ago
  > the web is a worse experience as a result, with marginal privacy gains. The web is a worse experience because of companies like Google and IAB willingly breaking the law. But sure, blame the law.
  - hedora 4y ago
    I'm really hoping Do Not Track becomes legally binding. (Also, how is it not already treated like a piece of a contract negotiation? It is machine readable and sent on every request. Hidden website EULA's are already treated like contracts.)
    - dmitriid 4y ago
      DNT is deprecated and now removed from all browsers because it was ironically used for fingerprinting and tracking.
- Jon_Lowtek 4y ago
  The focus on cookies was always a bit off and more a result of too much technical detail resulting in laws missing their intent. The legislative moves slowly, over time, this will be fixed. However the legislative regulating how webservices have to handle data privacy was very necessary (and the people of the USA should really consider amending their constitution by also demanding a basic human right to data privacy). The key elements are "informed choice" and "consent to data gathering/processing" which have little to do with cookies. Let's say you buy a smartphone from china and it comes with a keyboard app that sends all your inputs to a chinese company so they can make predictions and offer autocompletion. You kind of want that app to display a banner asking you if that is okay. And you kind of want a privacy policy attached that explains they will create user specific profiles and sell them to advertisers and share them with the chinese ministry of state security. I think you want that banner. Now google analytics isn't much different. It tracks you all over the web, creates profiles of your browsing habits, sells those to advertisers and shares them with the american national security agency. Sure it also shows statistics to the website owners, the same way that keyboard app has an autocomplete function, but you kind of want to be informed about those other functions and have the option to say no, don't you? That is why 'consent management' is so important for data privacy.
kemayo 4y ago
I use a Safari extension for that: https://www.super-agent.com https://www.super-agent.com
- SebastianKra 4y ago
  I've seen them before. Do you have any idea what their game is? They claim to be completely free and completely privacy respecting. No mention of a business model. Do they hope to make some deal with advertisers later on?
  - jpalomaki 4y ago
    ”We make money by selling a snippet of code to websites that integrates with Super Agent. Essentially, websites can have a JS snippet unique to them so that when a user with Super Agent visits, cookie preferences are applied automatically without having to ask anything.” https://www.super-agent.com/faq https://www.super-agent.com/faq
    - SebastianKra 4y ago
      Thanks that 's the part I forgot: Why would website owners actually go for that? They need the annoying popup to get consent.

martin_a 4y ago

Somewhat ironic that the cookie banner of theverge.com is using the same tactics/patterns (or even worse, according to UBlock Origin) that Google was fined for.

werid 4y ago

i just wish i could tell the browser to auto accept all

tgsovlerkhgsel 4y ago
Or better, auto reject all?
- IceWreck 4y ago
  Rejecting all cookies would be disastrous. You wouldn't be able to log in to any website (unless they use JavaScript storage for logging in, which is less secure that cookies) And btw, you can already disable all cookies for a particular website, or all websites in both FF and Chromium. Just click the lock https icon > more info and choose the cookie setting.
  - tgsovlerkhgsel 4y ago
    No, auto-reject what the sites let you reject. Because surprise surprise, actually necessary cookies like you describe don't require consent.
    - IceWreck 4y ago
      > No, auto-reject what the sites let you reject That would require sites to implement some kind of yet-to-exist browser API telling it which cookies are used for tracking and which are not. And why would any website implement that ? The EU can't force websites to implement feature X.
      - aaomidi 4y ago
        I mean the EU can force websites to do whatever. That includes implementing a feature. As we saw with cookie consent law and GDPR. And as we're going to see with interop requirements for chat apps. And the DNT header can be used exactly for that.
  - 4y ago

14 4y ago

When will North America get the same luxury? Or do we have to trick google into thinking we are in Europe?

bdefore 4y ago
Are there noticeable benefits right now for telling Google you live in Europe?
- Nextgrid 4y ago
  More privacy if you assume they actually respect the GDPR internally (but this occurrence is just yet another example of bad faith that suggests that the entire thing might be a charade and they stalk you anyway regardless of your settings).
pkaye 4y ago
California has CCPA which seems to be going in a similar direction for easy optout. https://www.jdsupra.com/legalnews/ccpa-regulations-update-and-the-opt-out-3518221/#:~:text=Methods%20for%20submitting%20requests%20to,consumer's%20right%20to%20opt%2Dout https://www.jdsupra.com/legalnews/ccpa-regulations-update-an....

kqvamxurcagg 4y ago

Google of course would have known this UX was likely to be illegal but made the decision that any fine would be much less than the commercial benefit.

axg11 4y ago
It would be fascinating to see the design review document and resulting launch metrics for this. Somewhere deep in Google there is a written justification for the previous dark pattern.
- tgsovlerkhgsel 4y ago
  If the people responsible for the decision listened to the lawyers, I doubt there will be any written notes on this...
  - robonerd 4y ago
    Or they CC'd lawyers in all the discussions, ostensibly to receive legal review but actually so they could later try to hide those discussions from discovery under the pretext of it being privileged attorney-client communication. "Google routinely hides emails from litigation by CCing attorneys, DOJ alleges" https://arstechnica.com/tech-policy/2022/03/google-routinely-hides-emails-from-litigation-by-ccing-attorneys-doj-alleges/ https://arstechnica.com/tech-policy/2022/03/google-routinely...
    - anticensor 4y ago
      As soon as you add a third party as a carbon-copy recipient, you lose the privacy privilege of the attorney-client communication.

kerng 4y ago

Good! Now can Google please also respect the DNT header and automatically reject all cookies if present? That would demonstrate real leadership and putting the user experience first.

bouke 4y ago
DNT is dead, sadly.
LunaSea 4y ago
As soon as user start paying subscription.
- Nextgrid 4y ago
  Where can I buy a subscription that gives me all of Google's services with no ads & stalking? As far as I know you can pay for some stuff such as Workspace or YT Premium but some services such as Search or Maps are still ad-supported and no doubt stalk you anyway (since there's at least one ad-supported service, the incentive to stalk the user remains).

tgsovlerkhgsel 4y ago

Background (which also explains why it's being rolled out in France first): https://www.theguardian.com/technology/2022/jan/06/france-fines-google-and-facebook-210m-over-user-tracking-cookies https://www.theguardian.com/technology/2022/jan/06/france-fi... - on January 6, Google was given 3 months to fix this, with a 100k fine for each additional day. I'm wondering why it took slightly but not significantly more than the 3 months. On one hand, adding a button doesn't have to take 3 months despite all the necessary reviews etc., not if it's actually considered a priority. On the other hand, if the benefits were considered worth the fine/fee, you'd expect a bigger delay.

______-_-______ 4y ago
They'll gladly pay (maybe) 2 million in fines so that later they can pretend complying was extremely difficult for them. Drop in the bucket in the long run.
- whitesilhouette 4y ago
  Just came here to say I really liked your userid (or whatever is called nowadays).
  - deleted 4y ago
    [deleted]
remus 4y ago
Personally I wouldn't read too much in to the timing. Although the end result looks small the change affects multiple large projects, each with hundreds of millions of users, and likely has knock on effects in other parts of google. Sprinkle in a bit of legal review + big company bureaucracy and I can easily imagine it taking 3 months.
ratww 4y ago
They are definitely already A/B testing this. I'm in Germany and sometimes I see the "Decline" button when opening Google in an incognito window.

jdrc 4y ago

"we will track your ass via other means"

mirntyfirty 4y ago
mwahahahahahah Yes, now if Android had a button for shutting off telemetry, that’d be even better.
nicbou 4y ago
LeGiTiMaTe InTeReSt!
simion314 4y ago
>"we will track your ass via other means" GDPR applies even if you use pen and paper, you still need to ask for permissions. But in this case it was a dark pattern, Google had no choice then to ask for permission but made it hard to deny them.
- Tomte 4y ago
  No. "This Regulation applies to the processing of personal data wholly or partly by automated means […]" Sure, if a machine uses a plotter, but not if a human being is writing stuff down.
  - PeterisP 4y ago
    The [...] you omitted is "and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system." - if your company takes notes on your customers with pen and paper and puts these notes in a drawer for further use in your business processes, GDPR definitely does apply. A random real example is that I used to work in a building which had a paper logbook where people sign the time and name when taking/returning keys for the meeting rooms. That logbook falls under GDPR as it has personally identifiable information - there's the legitimate need use case justifying it; but if the company suddenly wanted to use the stored data for some other purpose, that might be restricted.
  - 4y ago

tjoff 4y ago

The linked source: https://blog.google/around-the-globe/google-europe/new-cookie-choices-in-europe/ https://blog.google/around-the-globe/google-europe/new-cooki... It is "funny" reading that, the amount of energy they spend to be illegal but only just so that they can squeeze as much dark patterns on their users before they get a fine. Rinse and repeat. For normal companies / webmasters it is quite simple though. You don't have anything to gain from extorting your users. So please respect your users instead. Don't use shady practices that require you to bring up a cookie-banner in the first place. Just don't.

nicbou 4y ago
Shady practices like knowing how many visitors you get on your website? Don't get me wrong, there's the excellent Plausible for that, but collecting usage statistics is far from shady.
- throwaway5371 4y ago
  you can do that without selling out your users
  - nicbou 4y ago
    Yep, and we clever HN people know that. But the web isn't all clever hackers. There are lots of small businesses with WordPress websites who just want to see a graph on a page. They will keep adding cookie banner plugins so long as they can keep seeing that graph. I switched to plausible because the added privacy is also a major UX benefit: there's no GDPR banner on my website.
    - belorn 4y ago
      I would claim, based exclusively on experience, that most small businesses websites are built by web design companies. It is people working in the web shop industry that make decision about build tools. Also in my experience, there isn't usually a GDPR banner on small businesses websites built on wordpress. A pizzeria, barber, local grocery store, or some other small businesses don't really have or need much on their website. A few images, a page for location/contact, a page about the employees/founders, and for the more advanced ones a web shop. No GDPR needed for any of that, and for those web shops, once a person is registered all the consent are usually given as part of the registration processing. The typical model that I see for small businesses is also one where no one need or want a graph over visitors. The customer pay the web shops a one-time fee to build the site, and then it mostly sits there until the customer decide to build a completely new website because the old one is getting too old. No A-B testing, no optimization for user retention, no frontend interactions, no user flows. Mostly all the customer want is to not be paying a web developer any more money. This is why some shops will utilize "proprietary modules" in order to keep the customer on their (usually partners) servers, in case the customer might get ideas of moving the site to a better/cheaper hosting provider. The most common situation that I know of when people are requesting visitor graphs is either when customer apply an marketing campaign and want to see the effect on their website, or when a conglomerate has acquired a bunch of smaller companies and want to make decision about closing down/merging specific website. In those cases the analytics usually get added when that need arrive.

tintedfireglass 4y ago

Only Europe. Sigh.

jeroenhd 4y ago
Though the current state of the web is depressing, the rise of piracy and TOS-breaking VPNs for the general public made it quite easy and inconspicuous for people to use VPN services. You can effectively get the protection of any EU based citizen by setting up a VPN with an endpoint in Europe. There are dirt cheap options thanks to the man youtube sponsor discounts, and there are privacy-first VPN providers like Mullvad who are pricier but better if you care about your traffic.

Raed667 4y ago

Still no button in France, any ETA on the release? https://imgur.com/a/6gQUoBK https://imgur.com/a/6gQUoBK

unicornporn 4y ago
Got it in Sweden today.

hedora 4y ago

OK, so there's a single button, and if you press it, all Google properties will stop tracking you across all sites? Bulls@#t. Next they'll be claiming they never monetize user data.

Nextgrid 4y ago
That's the intent of the law/regulation, but indeed I very much doubt they will just comply and call it a day. Most likely in a couple years it will emerge that there's one more way of stalking that conveniently wasn't being disabled by this "disable all" button. It's sad that even several instances of bad faith along with a business model based on breaching the GDPR is still not enough for the record-breaking "4% of global turnover" fines to actually appear.

fallingknife 4y ago

okamiueru 4y ago

Does this "reject all" accept the "legitimate uses" which very clearly break GDPR? Most GDPR dialog windows I've encountered have made it harder to opt out of what they incorrectly claim to be "legitimate interests". According to GDPR, a "legitimate interest" has very clear requirements, which are by no means met. This "legitimate interests" very often includes things like "creating a personalized add profile and tying it to external data lakes and devices", which is by no means necessary in order to provide the service. I'm waiting for what has become the de-facto abuse of GDPR to have a serious reckoning.

jeroenhd 4y ago
The legitimate interest ticks are just another way for the scum of the web to break the law. I hope the makers of these popups will at some point get fined to hell because of their sneaky attempts to smuggle tracking into the browsers of people who click the "fuck you and fuck your cookies" button.
Macha 4y ago
The warning shot for "legimate interests" has been fired in the IAB Europe lawsuit, in IAB Europe's position as the advertising interest body which endorsed it for advertising uses: https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-euros-over-consent-framework-gdpr-violations/ https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-eu... I assume if France was breathing down Google's neck in the design of this feature (or as Google puts it "Providing specific direction"), I assume this does not have legitimate interest bullshit.

ckastner 4y ago

What an amazing win for Europe, and the GDPR. This isn't about just the button. Until a few years, "you're not the customer; you're the product" was the norm for a typical user's interaction with the internet, and they were powerless to change that. Then the GDPR came along, declaring that users have fundamental right to their data, and as such, they no longer can be forced to be "the product" without their consent. One of its most empowering rules, however, is in Article 7 (4): "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." So consent must be (1) freely given, and (2) it's not free if you're blocking access to service A by requiring consent for service B, when B is unnecessary for performing A. Hence, a search engine cannot force you to consent to tracking for advertising purposes, because technically, the search engine doesn't need it. So how can the search engine make money? One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking).

jsnell 4y ago
> One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking). Where has that been ruled legal, and do you have a link to the ruling? I've only seen German newspapers do this, so my assumption has been that it's just the German authorities turning a blind eye to it. If it's really a legit option, it seems like a miracle that nobody else is using this.
- ckastner 4y ago
  > Where has that been ruled legal, and do you have a link to the ruling? This was communicated to me by a law firm specializing this area. This was with regards to the newspaper "derstandard.at". Here's a source in German which includes the ruling as a PDF [1]. I see that in the meantime, this "pay or okay" model has been questioned again, but in any case, a ruling exists. And, as I was told, the national DPAs don't just rule as they see fit, but rather coordinate with other DPAs, in order to harmonize the enforcement across the EU. [1] https://www.dataprotect.at/2018/12/07/payortrack-die-entscheidung-der-dsb-nicht-rechtskr%C3%A4ftig/ https://www.dataprotect.at/2018/12/07/payortrack-die-entsche... > If it's really a legit option, it seems like a miracle that nobody else is using this. None of the big sites are using it because it's frequently far more profitable to track people. Just look at various revenue-per-user stats. And the users most willing to spend money for no-tracking tend to be the users who also spend money on other things, so their the users you'd want to advertise to the most.

NelsonMinar 4y ago

I've noticed when I go to configure my cookies on European sites, most of them default to all the tracking stuff turned off. Is that typical? Is it required by the law? They still do everything they can in the UI to encourage you to "accept all", but there's generally a single button to click to "reject all" and it'd be more work to pick and choose.

U1F984 4y ago
Yeah, it's a requirement by law, tracking must be disabled unless explicitly allowed. Accepting all must be as easy as denying. However a lot of sites offer an easy one-click accept all and the deny all is behind a two step "configure" + "confirm selection", sometimes even with a fake save timer.
- NelsonMinar 4y ago
  Thanks! I looked for info on this and failed; is there some reference I can share with people about how this part of the law works? Maybe it's not completely obvious, apparently Google had failed to comply with it.
  - matsemann 4y ago
    Gdpr article 7 says it should be as easy to withdraw consent as to give it. The rules are pretty straightforward, really, it's just Google banking on the fines for not doing it correctly would be less than the profit made.
    - NelsonMinar 4y ago
      Article 7 is pretty non-specific and does not discuss defaults. Recital 32, however, is quite specific and gives me the answer I was looking for https://gdpr.eu/recital-32-conditions-for-consent/ https://gdpr.eu/recital-32-conditions-for-consent/ "Consent should be given by a clear affirmative act ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

kgbcia 4y ago

someone needs to step up to Google on this side of the Atlantic. They are constantly in the news regarding their tracking. tracking should be off by default. all cookies should be ban except session cookies that expire when browser closes. we already have saved passwords and logins for browsers

TaylorAlexander 4y ago

It’s so offensive when companies offer the two options “let us track you, or: go through this weird menu to disable tracking”. You know wouldn’t it just be kind to the user to make it easy to go un tracked? Upsetting that they have to be compelled to do it.

mdaniel 4y ago
Worse, it's actually just a request to disable tracking, just like the unsubscribe link is a "if you get around to it in 6-8 weeks put my address on a do-not-contact list" Without the very real fear of meaningful fines for tracking after rejection, it's just lip service
alkonaut 4y ago
Yes and it’s also not confirming to the regulations that made them add the banner in the first place! I have no idea why anyone chooses to add a banner and then add one that is obviously in violation. Why not then just not add one? Is it because these cases are not yet enforced/fined so they think “let’s put an obnoxious non-compliant one for now, so we keep ad revenue, and only switch to a compliant one if we are actually sanctioned to do so, or the company across the street is fined to oblivion for doing it?” Anyone here working at a site that did this? Why?
- DangitBobby 4y ago
  They probably don't actually realize it's not compliant. They just saw everyone else doing it and mindlessly followed the herd. Users probably also think they are compliant and blame the EU.
  - Nextgrid 4y ago
    I can believe this argument for a handmade mom & pop site. I will absolutely not believe it for any large tech company such as Google or Facebook or "consent management platform" providers such as TrustArc - that scum knowingly breaches the regulation because their entire business relies on it.

scarface74 4y ago

So because of the government, I now have to deal with a clearer obtrusive cookie banner all over the internet… Thanks???? Where would we be without big government? It definitely made the internet a much better experience. Next law they are probably going to try to pass is force all app makers to use cross platform frameworks like Electron to prevent monopoles.

hddherman 4y ago
Cookie banners only exist because websites want to collect data and track users. The banner is a symptom of the real issue, which is what the regulation aims to fix.
- scarface74 4y ago
  So the regulation both didn’t fix the issue and made the user experience worse…

zeroz 4y ago

In my opinion the whole 'cookie banner industry' sucks. From a customer perspective I'm completely annoyed with different types of banners wasting my time with searching the right button, waiting because of artificial delays, clicking through layers of fake settings to find the reject option and other dark patterns. However, from a provider perspective things a not better. Unnecessary waste of time and money to look for plugins and services to deal with cookie walls to avoid GDPR problems. Best thing would be a EU enforcing the use of a standard browser API to ask for tracking. Just as simple as asking me if I want to share my location or webcam with an option to remember for this domain.

jeroenhd 4y ago
I really want the web browser industry to come together and form a new kind of P3P standard, complete with some example libraries for people to use on the backend. Sadly, the browser market is dominated by Google, who has a direct interest in tracking people, Apple, who operates in proprietary protocols unless they absolutely have to, Microsoft, whose stalking exceeds even Google's at this point, and then a tiny slither of well-meaning but overall badly-managed open source projects. Relying on the DNT header is difficult as "tracking" can be interpreted in a number of ways, especially by the data vampires of the advertising industry where they have developed many nice words to make their business so sound harmless. We need a better protocol, implemented across the board, for this to automate away these ridiculous popups. If a sufficiently flexible protocol exists, I'm sure it'll be taken up by either Europe's DPAs or even new legislation, though existing legislation should already be sufficient. The EU should not, and generally doesn't want to, specify which technologies get used because technologies develop faster than bureaucracy. The hastily thrown together Brexit accords mention Netscape Navigator and ancient, insecure, outdated cryptography because they decided to include that in legislation many years ago and the accord was just a combination of existing EU and UK laws thrown together. We don't want that to happen again, especially on a larger scale.

etotolkoya 4y ago

At least in the past, I remember to see the same youtube recommendations even after deleting all cookies etc from the browser. So google was fingerprinting you in one way or the other. I doubt this changed. So what is the point of not using cookies? They are tracking you anyway.

Terry_Roll 4y ago

I saw this the other day on youtube, it appeared, saw the middle Reject All button, clicked it, closed and reset the browser, tried again and it didnt appear! Were they testing bots?!? Regarding the Reject All button, its about bloody time, these tech giants have plenty of other surveillance methods at their disposal if they want to go down that creepy criminal online stalking route, exploiting people's lack of knowledge to make sure shareholders and employees are getting their top dollar.

aembleton 4y ago
They're probably a/b testing it
- Terry_Roll 4y ago
  No there is more surveillance than meets the eye and more hacking in plain site than most people realise, after all when is a company not organised crime?
  - ranguna 4y ago
    Dude chill. As the parent comment said, it was probably just an A/B test. Google does that a lot, even with their old consent dialog, sometimes they used buttons and sometimes they used radio checkboxes.

drdaeman 4y ago

I still don't understand why this is a website thing and not an user-agent^W^W webbrowser thing. EU could have requested browser vendors to implement a mechanism to accept or reject cookies. We wouldn't have those oddly designed (and infrequently infested with dark patterns in attempt to sway users towards accepting everything) bars and popups, and it would've been 100% reliable (and even the reject decision would be remembered correctly) instead of hoping that website actually respects the choice instead of having a banner that does absolutely nothing.

HWR_14 4y ago
This sounds an awful lot like the Do Not Track setting in every browser.
- drdaeman 4y ago
  Yes and no. "Do Not Track" setting does not do anything but sending a header to all websites you visit. Plus, it was blamed to have an unfavorable default. The whole popup mess those days is essentially about those facts - there are no easy per-site controls with no default state (with a possible default if user consciously and explicitly configures their system as "accept all everywhere" or "reject all everywhere" - but this can't be out-of-the-box). Cookie prompts are just like that: per-site and without a default (you have to actively make a decision every time - accept or reject). I'm arguing that it would've been better if all those consent prompts would've been unified and a part of browser UI (rather than website UI). Because of two reasons: 1) the UI and UX would be uniform, consistent, and not prone to design whims and dark patterns; and 2) because this way browsers would be able to guarantee that the choice is partially respected by actually not accepting cookies. DNT header would be still needed to tell website to disable server-side tracking (and one has to believe that website respects it - turning this into a legal matter), but the whole design is different. (Just not like that annoying geolocation or camera popup prompts lol. A bar on top of the webpage would've been a sane option, I guess.)
  - PeterisP 4y ago
    Since the law requires it to be opt-in, having Do Not Track be the automated default without any prompts is not problematic but the whole point of the thing.

bongoman37 4y ago

throwaways85989 4y ago

These consent forms are such a sabotage on the original idea. The idea being, as far as i remember, you set your preferences once. In a container on your machines under your control. Then the site and the container negotiate. Either the side is willing to accept your preferences - or it denies showing to you - or presents you a "negotiated" down version. No clicking. No visible banners. No large forms and lawyer legalese. Just a privacy level setting for the web via standardized API. Europe at least tried but dropped the ball.

alkonaut 4y ago
If the site shows something else (I.e not the service the visitor would see if comsenting) then it’s in violation?

bldk 4y ago

they have added it

bldk 4y ago

update: they added it and with EU vpn you can press the reject button! A. will other websites follow? (its so stupid that we had accept all or "more information" button, but never reject and its crazy) B. does it do anything really? i never save cookies in the first place.

LightG 4y ago

Any company that didn't have this set up already can reside at the bottom of the ocean with the rest of the bottom feeders (no disrespect to the mussels)