4 ms·

There are signs that it's getting better. I started seeing cookie dialogs with a Reject all button. Sometimes it's a big one, sometimes it's almost white on whi

There are signs that it's getting better. I started seeing cookie dialogs with a Reject all button. Sometimes it's a big one, sometimes it's almost white on white, but it's there. Anyway the vast majority of those dialogs is still misleading. The usual We care about your privacy, accept all, settings thing.

CaptainZapp 4y ago
Even YouTube now has a REJECT ALL button. Which is quite nice for folks like me, who always clear browsing data upon exit.
- jaywalk 4y ago
  If you always clear browsing data on exit, then what difference does having a reject all button make?
  - Nextgrid 4y ago
    In theory, declining data processing consent means they should not be using other kinds of tracking (that you can’t block/clear client-side) either. This of course relies on sufficient enforcement of the regulation to act as a deterrent which is currently not the case.
  - coffeeblack 4y ago
    If you have a /etc/hosts file that redirects 10000 tracker domains to 0.0.0.0 then you don’t even need to clear any browsing data. Plus, you don’t see ads anymore without any browser plugins.
    - 2Gkashmiri 4y ago
      pi-hole is much better and easier to maintain than a per device hosts file
      - coffeeblack 4y ago
        Sure, if your devices are always only in the same network. Or just run a script that pulls the newest version, cleans it up, and writes it to /etc/hosts. Whatever works best for your usecase.
    - Nextgrid 4y ago
      Until the service sends your data to the trackers server-side which is very common nowadays (in fact there are even legitimate reasons for doing it).
  - tinus_hn 4y ago
    Clearing browser data doesn’t help when the trackers are identifying you using fingerprinting, nor when they are associated with sources that remain or are reestablished every time, like a webmail login.
- Terry_Roll 4y ago
  But do you check your cookies have been wiped and not just blanked in MS Edge? I have noticed that despite having all the settings to wipe data, not just cookies, cookies are still left. These are my start page tabs in this order. edge://settings/clearBrowserData tab all I have to do is click "Choose What to Clear", get the popup window, Time Range - All Time, all options ticked. Once completed but this can hang the browser for upto several minutes once done I switch to the second tab. edge://settings/siteData tab hit refresh (F5) to see what cookies get left behind and thats when I see sometimes, cookies get left behind, usually youtube.com cookies, they will be blank but loads of youtube cookies. edge://favorites/ tab, positioned to Favourites bar and have nothing on there because the browser pulls down site icons so you can identify people (browser fingerprinting) from the icon combination that gets pulled down. edge://application-guard-internals/#status tab can see if its working properly, noticed when its on, youtube video's dont work its always trying to get get data, the stats for nerds show nothing comes downs or minimal 1kb amounts. edge://policy/ tab because I like to switch these around to create a different fingerprint from the devices that are accessible.
csunbird 4y ago
The malicious actors moved everything to "Legitimate Interest", which needs to be toggled off manually for each provider and very well hidden.
- Nextgrid 4y ago
  That's still not compliant so this problem should be resolved eventually.
coffeeblack 4y ago
Wasn’t there recently some ruling against the use of dark patterns in cookie banners?
- thayne 4y ago
  The big players can afford to pay the fine, and the small ones probably won't be taken to court, so it might not have enough impact.
  - Nextgrid 4y ago
    When a fine is issued they will also need to become compliant so it's not just a matter of paying the fine and then carrying on as usual. However enforcement is indeed severely lacking as this article describes.
  - DoughnutHole 4y ago
    The potential fines can get pretty enormous, enough to even make the big players worried - up to 4% of the company's global annual revenue. There's a reason Amazon, Google and Facebook haven't just eaten the fines and are paying a fortune fighting tooth and nail to appeal the fines that they've been issued so far.
icedchai 4y ago
"Better" would mean not seeing cookie dialogs at all.
- jka 4y ago
  The EU's ePrivacy Regulation[1] has (or had - it seems to fluctuate) a goal to move cookie consent into the user's browser settings. There has (perhaps predictably) been significant lobbying against that by entrenched industry players, so we'll see what emerges as a result. (I have to admit I'm not up-to-date on the latest happenings regarding this regulation) [1] - https://en.wikipedia.org/wiki/EPrivacy_Regulation https://en.wikipedia.org/wiki/EPrivacy_Regulation
  - icedchai 4y ago
    I meant not bothering with it at all. I, and many others, don't care about cookie tracking. These "cookie warnings" waste users' time, and, to a lesser extent, developer time (but at least we get paid to implement pointless stuff.) Every time I see one of those pop ups, it raises my blood pressure.
    - jka 4y ago
      Sorry, I was unclear: that's what I meant, too. You would find cookie consent options in your browser settings (for example, near "Privacy Settings"), and you would configure your rules there (with sensible defaults). You shouldn't see any cookie consent pop-ups while browsing the web, as a result of that -- your browser would communicate your preferences for you. As I said though: I'm unclear on the status of the ePrivacy Regulation.
      - icedchai 4y ago
        Agreed! A working "do not track" option would be ideal for everyone... I doubt that will ever happen.
buttscicles 4y ago
This seems to be a very common misconception, but the cookie consent dialogues are not part of GDPR.
- latchkey 4y ago
  https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Cookie compliance To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: Receive users’ consent before you use any cookies except strictly necessary cookies. Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received. Document and store consent received from users. Allow users to access your service even if they refuse to allow the use of certain cookies Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.
  - itslennysfault 4y ago
    Lucky for me it is "strictly necessary" that I track you. /s
    - icedchai 4y ago
      Online privacy is an illusion. At the basic level, your IP is getting logged all over the place.
  - jdlshore 4y ago
    Cookies aren't part of the GDPR, so they must be part of the ePrivacy Directive. Consent is part of the GDPR, but the way I've seen it operate in practice is widely out of compliance. You're supposed to ask for consent in each specific instance of data collection, not present a blanket approval, and default to "no."
    - latchkey 4y ago
      https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Cookies and the GDPR The General Data Protection Regulation (GDPR) is the most comprehensive data protection legislation that has been passed by any governing body to this point. However, throughout its’ 88 pages, it only mentions cookies directly once, in Recital 30. Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. What these two lines are stating is that cookies, insofar as they are used to identify users, qualify as personal data and are therefore subject to the GDPR. Companies do have a right to process their users’ data as long as they receive consent or if they have a legitimate interest.

CaptainZapp 4y ago

Even YouTube now has a REJECT ALL button. Which is quite nice for folks like me, who always clear browsing data upon exit.

jaywalk 4y ago
If you always clear browsing data on exit, then what difference does having a reject all button make?
- Nextgrid 4y ago
  In theory, declining data processing consent means they should not be using other kinds of tracking (that you can’t block/clear client-side) either. This of course relies on sufficient enforcement of the regulation to act as a deterrent which is currently not the case.
- coffeeblack 4y ago
  If you have a /etc/hosts file that redirects 10000 tracker domains to 0.0.0.0 then you don’t even need to clear any browsing data. Plus, you don’t see ads anymore without any browser plugins.
  - 2Gkashmiri 4y ago
    pi-hole is much better and easier to maintain than a per device hosts file
    - coffeeblack 4y ago
      Sure, if your devices are always only in the same network. Or just run a script that pulls the newest version, cleans it up, and writes it to /etc/hosts. Whatever works best for your usecase.
  - Nextgrid 4y ago
    Until the service sends your data to the trackers server-side which is very common nowadays (in fact there are even legitimate reasons for doing it).
- tinus_hn 4y ago
  Clearing browser data doesn’t help when the trackers are identifying you using fingerprinting, nor when they are associated with sources that remain or are reestablished every time, like a webmail login.
Terry_Roll 4y ago
But do you check your cookies have been wiped and not just blanked in MS Edge? I have noticed that despite having all the settings to wipe data, not just cookies, cookies are still left. These are my start page tabs in this order. edge://settings/clearBrowserData tab all I have to do is click "Choose What to Clear", get the popup window, Time Range - All Time, all options ticked. Once completed but this can hang the browser for upto several minutes once done I switch to the second tab. edge://settings/siteData tab hit refresh (F5) to see what cookies get left behind and thats when I see sometimes, cookies get left behind, usually youtube.com cookies, they will be blank but loads of youtube cookies. edge://favorites/ tab, positioned to Favourites bar and have nothing on there because the browser pulls down site icons so you can identify people (browser fingerprinting) from the icon combination that gets pulled down. edge://application-guard-internals/#status tab can see if its working properly, noticed when its on, youtube video's dont work its always trying to get get data, the stats for nerds show nothing comes downs or minimal 1kb amounts. edge://policy/ tab because I like to switch these around to create a different fingerprint from the devices that are accessible.

csunbird 4y ago

The malicious actors moved everything to "Legitimate Interest", which needs to be toggled off manually for each provider and very well hidden.

Nextgrid 4y ago
That's still not compliant so this problem should be resolved eventually.

coffeeblack 4y ago

Wasn’t there recently some ruling against the use of dark patterns in cookie banners?

thayne 4y ago
The big players can afford to pay the fine, and the small ones probably won't be taken to court, so it might not have enough impact.
- Nextgrid 4y ago
  When a fine is issued they will also need to become compliant so it's not just a matter of paying the fine and then carrying on as usual. However enforcement is indeed severely lacking as this article describes.
- DoughnutHole 4y ago
  The potential fines can get pretty enormous, enough to even make the big players worried - up to 4% of the company's global annual revenue. There's a reason Amazon, Google and Facebook haven't just eaten the fines and are paying a fortune fighting tooth and nail to appeal the fines that they've been issued so far.

icedchai 4y ago

"Better" would mean not seeing cookie dialogs at all.

jka 4y ago
The EU's ePrivacy Regulation[1] has (or had - it seems to fluctuate) a goal to move cookie consent into the user's browser settings. There has (perhaps predictably) been significant lobbying against that by entrenched industry players, so we'll see what emerges as a result. (I have to admit I'm not up-to-date on the latest happenings regarding this regulation) [1] - https://en.wikipedia.org/wiki/EPrivacy_Regulation https://en.wikipedia.org/wiki/EPrivacy_Regulation
- icedchai 4y ago
  I meant not bothering with it at all. I, and many others, don't care about cookie tracking. These "cookie warnings" waste users' time, and, to a lesser extent, developer time (but at least we get paid to implement pointless stuff.) Every time I see one of those pop ups, it raises my blood pressure.
  - jka 4y ago
    Sorry, I was unclear: that's what I meant, too. You would find cookie consent options in your browser settings (for example, near "Privacy Settings"), and you would configure your rules there (with sensible defaults). You shouldn't see any cookie consent pop-ups while browsing the web, as a result of that -- your browser would communicate your preferences for you. As I said though: I'm unclear on the status of the ePrivacy Regulation.
    - icedchai 4y ago
      Agreed! A working "do not track" option would be ideal for everyone... I doubt that will ever happen.

buttscicles 4y ago

This seems to be a very common misconception, but the cookie consent dialogues are not part of GDPR.

latchkey 4y ago
https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Cookie compliance To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: Receive users’ consent before you use any cookies except strictly necessary cookies. Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received. Document and store consent received from users. Allow users to access your service even if they refuse to allow the use of certain cookies Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.
- itslennysfault 4y ago
  Lucky for me it is "strictly necessary" that I track you. /s
  - icedchai 4y ago
    Online privacy is an illusion. At the basic level, your IP is getting logged all over the place.
- jdlshore 4y ago
  Cookies aren't part of the GDPR, so they must be part of the ePrivacy Directive. Consent is part of the GDPR, but the way I've seen it operate in practice is widely out of compliance. You're supposed to ask for consent in each specific instance of data collection, not present a blanket approval, and default to "no."
  - latchkey 4y ago
    https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Cookies and the GDPR The General Data Protection Regulation (GDPR) is the most comprehensive data protection legislation that has been passed by any governing body to this point. However, throughout its’ 88 pages, it only mentions cookies directly once, in Recital 30. Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. What these two lines are stating is that cookies, insofar as they are used to identify users, qualify as personal data and are therefore subject to the GDPR. Companies do have a right to process their users’ data as long as they receive consent or if they have a legitimate interest.