4 ms·

Wouldn't that be illegal though? Purely from a Devils Advocate perspective those banners are legally required, so pro-actively blocking them seems like a bad i

Wouldn't that be illegal though? Purely from a Devils Advocate perspective those banners are legally required, so pro-actively blocking them seems like a bad idea.

dustedcodes 4y ago
I think the cookie consent was great in intention, but naively executed/enforced by the EU. I believe there must be a strong push back on those banners from browser vendors to force the EU to reconsider the current law and modify it. IMHO it would be much better if they'd revise the current law to require browser vendors to have a global cookie setting (accept functional, marketing, etc.) and then websites having to obey to a user's preference based on their browser setting.
- secondcoming 4y ago
  There used be the option of using a global cookie but website no used it. It was then deprecated. See the field 'IsServiceSpecific' in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...
- hnbad 4y ago
  There's nothing in any of the relevant EU laws forcing websites to have consent banners. They could simply handle consent like mobile apps are supposed to handle permissions (i.e. prompt once for a single purpose when it becomes relevant for a user interaction). But they want to shovel a ton of trackers and tracking ads and analytics and other garbage into every page load, so they need to obtain consent before those can be loaded and then they try to be clever (read: illegal) and trick you into giving them a blank check by making it harder to opt out and continue than to opt in to everything and give up. There's also nothing in the law saying the cookie banner has to be a modal dialog. The same sites happily went for actual "banners" rather than popups when the first EU cookie law was passed and only required notice rather than consent. They only went for modal popups because this forces users to make a choice before they can access the content. Ironically, if a data protection agency were particularly spicy that day, it could be argued that putting a site behind a modal consent popup rather than defaulting to opt-out and merely informing the user about other options violates the GDPR's requirement not to make the use of a website conditional to unrelated data processing because the popup is intended as a form of light coersion.
  - dustedcodes 4y ago
    > There's nothing in any of the relevant EU laws... Sure, my pet peeve is not that THERE IS something in EU law that makes these banners so annoying. My issue is that THERE ISN'T anything in the EU law that specifically prescribes HOW it should be handled so that it's not such an absolute fecking annoyance. As I said, I think they should revise the law so that it specifically states that the cookie options must be a browser option and websites MUST respect that preference, and that the browser preference trumps anything else which a user might have consented elsewhere, rendering attempts to workaround it as useless.
- denton-scratch 4y ago
  > force the EU to reconsider the current law and modify it. That's like bank-robbers demanding that the law against armed robbery needs to be modified. I like the law. I don't like the bank-robbers throwing up banners in the hope that the blame will stick to GDPR.
brodock 4y ago
The requirement is to acquire consent not to reply to the attempt to acquire consent
- rikroots 4y ago
  Yes - this is my understanding of the requirement. When I was coding up my poetry website I decided I wanted to give users the chance to share the poem they were reading on Facebook or Twitter - both of which require their cookies on the user's browser to make the functionality work. But I didn't want to ruin the user experience of visiting the site (that comes later, when they're reading the poem) by shoving a consent banner onto the screen as soon as the site loaded. The solution I came up with was to redirect the users to the site's cookie consents page[1] only after they clicked on the FB/Twitter share buttons, and only load the relevant cookies onto their browsers after they explicitly agree to them. [1] - https://rikverse2020.rikweb.org.uk/cookies https://rikverse2020.rikweb.org.uk/cookies - because cookie consent pages can be fun too!
Maxburn 4y ago
The sites have to send them and the user is simply automating the response. IANAL but I don’t see an issue here.
PeterisP 4y ago
No, the banners aren't required, the user consent is required. If the users do not want to accept the proposal, they aren't required to, and they aren't required to even view and consider the proposal - there is nothing illegal if the users preemptively block and ignore it.
jemmyw 4y ago
I don't see how it can be illegal. The website is showing it and it's the user who has decided to use a browser that blocks it. You may as well say is illegal for me to not read the pop-up. Another way to look at it, if I disable JavaScript and therefore the pop-ups don't show is that illegal?
- denton-scratch 4y ago
  Good luck with that - the popups usually don't depend on Javascript (at least, not to display them).
johncoltrane 4y ago
The banners themselves are not legally required, neither by the GDPR nor by the EPR. What is required (at least from a EU standpoint) is (taken from https://gdpr.eu/cookies/ https://gdpr.eu/cookies/): - Receive users’ consent before you use any cookies except strictly necessary cookies. - Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received. - Document and store consent received from users. - Allow users to access your service even if they refuse to allow the use of certain cookies - Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place. Site owners don't have to use obnoxious banners to comply with any of these obligations: - User consent can be collected _when the cookie is used_ rather than preemptively. - Information can be provided when consent is asked and/or at a specific URL linked from the footer. - Documenting and storing is a no-brainer. - Allowing users to access the service without certain cookies is also a no-brainer. - Allowing the user to change their mind can also be a simple form at a specific URL linked from the footer. So-called cookie banners exist because they are simpler and cheaper than designing online services properly.
- secondcoming 4y ago
  There’s more to these than just the usage of cookies.
  - johncoltrane 4y ago
    Yes. The GDPR only mentions cookies once, as something that could contain user data, and the EPR is about _many_ things, including cookies. What to actually do with cookies, in terms of user experience and technical implementation is never explicitly mentioned so it is perceived as enough trouble for site owners to consider punting to those pesky banners. FWIW, I don't remember ever explicitly setting a cookie or reading from it in the last 6-8 years or so and I don't think I am the only one. Third party integrations have been the only source of cookies in all the projects I have been involved with in that timespan: YouTube embeds and tracking, mostly.
denton-scratch 4y ago
No law requires those banners.
logicalmonster 4y ago
> Purely from a Devils Advocate perspective those banners are legally required, so pro-actively blocking them seems like a bad idea. Not a European or a lawyer, but I think "legally required" might be a slight question mark. I could be very wrong, but I think the issue is that the requirements of these laws are all vaguely worded, so companies started putting in place these giant consent forms on load purely to cover their ass legally.

Wouldn't that be illegal though? Purely from a Devils Advocate perspective those banners are legally required, so pro-actively blocking them seems like a bad idea.

dustedcodes 4y ago

I think the cookie consent was great in intention, but naively executed/enforced by the EU. I believe there must be a strong push back on those banners from browser vendors to force the EU to reconsider the current law and modify it. IMHO it would be much better if they'd revise the current law to require browser vendors to have a global cookie setting (accept functional, marketing, etc.) and then websites having to obey to a user's preference based on their browser setting.

secondcoming 4y ago
There used be the option of using a global cookie but website no used it. It was then deprecated. See the field 'IsServiceSpecific' in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...
hnbad 4y ago
There's nothing in any of the relevant EU laws forcing websites to have consent banners. They could simply handle consent like mobile apps are supposed to handle permissions (i.e. prompt once for a single purpose when it becomes relevant for a user interaction). But they want to shovel a ton of trackers and tracking ads and analytics and other garbage into every page load, so they need to obtain consent before those can be loaded and then they try to be clever (read: illegal) and trick you into giving them a blank check by making it harder to opt out and continue than to opt in to everything and give up. There's also nothing in the law saying the cookie banner has to be a modal dialog. The same sites happily went for actual "banners" rather than popups when the first EU cookie law was passed and only required notice rather than consent. They only went for modal popups because this forces users to make a choice before they can access the content. Ironically, if a data protection agency were particularly spicy that day, it could be argued that putting a site behind a modal consent popup rather than defaulting to opt-out and merely informing the user about other options violates the GDPR's requirement not to make the use of a website conditional to unrelated data processing because the popup is intended as a form of light coersion.
- dustedcodes 4y ago
  > There's nothing in any of the relevant EU laws... Sure, my pet peeve is not that THERE IS something in EU law that makes these banners so annoying. My issue is that THERE ISN'T anything in the EU law that specifically prescribes HOW it should be handled so that it's not such an absolute fecking annoyance. As I said, I think they should revise the law so that it specifically states that the cookie options must be a browser option and websites MUST respect that preference, and that the browser preference trumps anything else which a user might have consented elsewhere, rendering attempts to workaround it as useless.
denton-scratch 4y ago
> force the EU to reconsider the current law and modify it. That's like bank-robbers demanding that the law against armed robbery needs to be modified. I like the law. I don't like the bank-robbers throwing up banners in the hope that the blame will stick to GDPR.

brodock 4y ago

The requirement is to acquire consent not to reply to the attempt to acquire consent

rikroots 4y ago
Yes - this is my understanding of the requirement. When I was coding up my poetry website I decided I wanted to give users the chance to share the poem they were reading on Facebook or Twitter - both of which require their cookies on the user's browser to make the functionality work. But I didn't want to ruin the user experience of visiting the site (that comes later, when they're reading the poem) by shoving a consent banner onto the screen as soon as the site loaded. The solution I came up with was to redirect the users to the site's cookie consents page[1] only after they clicked on the FB/Twitter share buttons, and only load the relevant cookies onto their browsers after they explicitly agree to them. [1] - https://rikverse2020.rikweb.org.uk/cookies https://rikverse2020.rikweb.org.uk/cookies - because cookie consent pages can be fun too!

Maxburn 4y ago

The sites have to send them and the user is simply automating the response. IANAL but I don’t see an issue here.

PeterisP 4y ago

No, the banners aren't required, the user consent is required. If the users do not want to accept the proposal, they aren't required to, and they aren't required to even view and consider the proposal - there is nothing illegal if the users preemptively block and ignore it.

jemmyw 4y ago

I don't see how it can be illegal. The website is showing it and it's the user who has decided to use a browser that blocks it. You may as well say is illegal for me to not read the pop-up. Another way to look at it, if I disable JavaScript and therefore the pop-ups don't show is that illegal?

denton-scratch 4y ago
Good luck with that - the popups usually don't depend on Javascript (at least, not to display them).

johncoltrane 4y ago

The banners themselves are not legally required, neither by the GDPR nor by the EPR. What is required (at least from a EU standpoint) is (taken from https://gdpr.eu/cookies/ https://gdpr.eu/cookies/): - Receive users’ consent before you use any cookies except strictly necessary cookies. - Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received. - Document and store consent received from users. - Allow users to access your service even if they refuse to allow the use of certain cookies - Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place. Site owners don't have to use obnoxious banners to comply with any of these obligations: - User consent can be collected _when the cookie is used_ rather than preemptively. - Information can be provided when consent is asked and/or at a specific URL linked from the footer. - Documenting and storing is a no-brainer. - Allowing users to access the service without certain cookies is also a no-brainer. - Allowing the user to change their mind can also be a simple form at a specific URL linked from the footer. So-called cookie banners exist because they are simpler and cheaper than designing online services properly.

secondcoming 4y ago
There’s more to these than just the usage of cookies.
- johncoltrane 4y ago
  Yes. The GDPR only mentions cookies once, as something that could contain user data, and the EPR is about _many_ things, including cookies. What to actually do with cookies, in terms of user experience and technical implementation is never explicitly mentioned so it is perceived as enough trouble for site owners to consider punting to those pesky banners. FWIW, I don't remember ever explicitly setting a cookie or reading from it in the last 6-8 years or so and I don't think I am the only one. Third party integrations have been the only source of cookies in all the projects I have been involved with in that timespan: YouTube embeds and tracking, mostly.

denton-scratch 4y ago

No law requires those banners.

logicalmonster 4y ago

> Purely from a Devils Advocate perspective those banners are legally required, so pro-actively blocking them seems like a bad idea. Not a European or a lawyer, but I think "legally required" might be a slight question mark. I could be very wrong, but I think the issue is that the requirements of these laws are all vaguely worded, so companies started putting in place these giant consent forms on load purely to cover their ass legally.