10 ms·

Everytime I read about this, it makes me think about this game: https://termsandconditions.game/ https://termsandconditions.game/ (SSL warning) These shenani

Everytime I read about this, it makes me think about this game: https://termsandconditions.game/ https://termsandconditions.game/ (SSL warning) These shenanigans are not required, they are very much designed on purpose. Indeed, corporations can follow the "Do Not Track" header. There is nothing in the EU law that requires a banner, only informed consent. So if I have DNT=1 set in my browser, pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that". Solved. I'm informed. I made my choice. But that's not what it's about. Because the vast majority of people would not consent. Who are you kidding? This tracking is not benefiting us. It's like when politician says it's "for the children" or "to fight terrorists". Everybody knows there are full of it. So the banner is just the most annoying way that is legally allowed to try to get people to force-accept tracking. In fact, some banner are crafted to make rejection the hardest path for this very reason. Those corps chose to make the web terrible a little bit more every day: tracking, auto play, scroll hijacking, dark patters, cookie banners... We should thank the UE a 1000 times to reveal who are the bad players.

deleted 4y ago
[deleted]
adhesive_wombat 4y ago
> In fact, some banner are crafted to make rejection the hardest path for this very reason. Something that's also illegal. National regulators don't seem to care though, which is a shame as a couple of fines and operators would mysteriously, simultaneously and suddenly realise there _was_ a way to make rejection at least as easy as acceptance all along.
- shaky-carrousel 4y ago
  Luckily for us, in this age of centralized internet, you only need to hit with fines a couple of cookie dialog providers and you are set.
  - adhesive_wombat 4y ago
    OneTrust, who seems to do a sizeable fraction, get it right on their own website. I have never seen a OneTrust dialog elsewhere have equal prominence given to the reject and accept pathways.
  - mananaysiempre 4y ago
    Nope. Apparently selling conconformant GDPR-compliance services is not against the law, only buying them is? Which makes some sense, but in any case OneTrust still sell dark-pattern banners to (at least) hundreds of websites even after a sizeable batch of them has been ruled illegal[1]. [1] https://noyb.eu/en/226-complaints-lodged-against-deceptive-cookie-banners https://noyb.eu/en/226-complaints-lodged-against-deceptive-c...
    - adhesive_wombat 4y ago
      Scummy as that is, I don't think that providing the banners should be illegal, as otherwise it's a hop and a step to "providing software that can be used illegally is in itself illegal". Which makes text editors illegal without "safeguards" baked in. However, if OneTrust are selling the software under the promise that if the customers configure it that way, then it's compliant, then that's some kind of misrepresentation (which is illegal, software or not). Just as if I sell a USB flash drive as an anti-5G-field dongle, that's illegal, but it'll not illegal to just sell the flash drive.
- seszett 4y ago
  I think they do care, but with limited means they cannot tackle the whole problem at once. So they go after one bad actor after another, and the others eventually adjust their practices to be a bit less illegal. On the French web you can see the evolution on newspaper websites, which used to have these popups with an easy accept button and difficult, hidden paths for refusal, which eventually moved to a simpler "reject" button with subdued colours or a "reject and read the article" a bit less visible than accept, but still easy enough to spot, and now many have two equal buttons... but "reject" leads to a page that says "you can reject cookies but then you can't read the newspaper, you can pay instead". You can really see how they try to go as far as they think they can, and adjust their behaviour even without having been targeted themselves. I have good expectations that everything will eventually get better even if it will take time.
  - mopsi 4y ago
    The same happened with Google and Youtube. They used to have pop-ups with large and obvious "Accept" button and a clicking game if you wanted to reject tracking. The EU put a pressure on them and now the popups have two equal "Reject" and "Accept" buttons.
    - hedora 4y ago
      The current situation is still a problem. If you disable cookies, you get the banner every single time. The law should outlaw that behavior so that people can continue to conveniently block cookies. Google is an ad network and controls chrome. They could come up with a universal opt out (like X-DO-NOT-TRACK) that works with such a law.
      - aembleton 4y ago
        It's up to your user agent what it displays and which cookies to store. It's the user agent that needs to change to stop bugging you. That's what brave are doing
        hedora 4y ago
kayxspre 4y ago
I remember that Medium (yes, the one that is now notorious about paywall) used to have banner to that wording when I set DNT in my browser to "On". This [1] shows how it actually appeared at that point. Medium also has an FAQ about its DNT at [2]. [1] https://www.eff.org/deeplinks/2017/10/do-not-track-implementation-guide-launched https://www.eff.org/deeplinks/2017/10/do-not-track-implement... [2] https://help.medium.com/hc/en-us/articles/213690167-Medium-s-Do-Not-Track-Policy https://help.medium.com/hc/en-us/articles/213690167-Medium-s...
PebblesRox 4y ago
I recently came across a cookie banner in real life that reminded me of that game. I'm still not sure whether I successfully refused cookies. https://soccerwhizz.com/if-i-speak-i-am-in-big-trouble-meaning/ https://soccerwhizz.com/if-i-speak-i-am-in-big-trouble-meani...
miracle2k 4y ago
> Because the vast majority of people would not consent. Many people would click No when asked "Can we track you?". Yet, fewer people would click No when asked "Can we show you ads that are closely related to your interests"? Likely even more people would agree with "Are you willing to share some data so we can improve our product?". And maybe most people would actually be ok with websites including Google Fonts [1]. Of course, when too many people agree with the proposition, then the question must be legally mandated to be more scary. The truth is that "people" are fundamentally not on the side of the privacy advocates. This is the whole reason for the GDPR. People are perfectly happy to share their data in exchange for using those services. Fundamentally, GDPR advocates are claiming that people just don't get it, and should not be allowed to make this choice. Which is why websites are not allowed to make their service conditioned on consent to tracking. > So if I have DNT=1 set in my browser, pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that". Solved. This is still an annoying banner somewhere. Please no. [1] https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f...
- Semaphor 4y ago
  > Which is why websites are not allowed to make their service conditioned on consent to tracking Is that clear yet? Because most bigger newspapers in Germany do exactly that, try Spiegel.de
  - hnbad 4y ago
    I wouldn't be surprised if German data protection agencies give news "publishers" more leeway given that they seem to be extremely influential in other domains of digital law in Germany. But yeah, it's debatable whether "my business model depends on showing you ads from services that harvest your data via those ads" is a legitimate interest. If it is, that sets a bad precedent IMO.
    - Semaphor 4y ago
      FWIW, many of the data protection agencies are nowhere near as corrupt as other places. But those things tend to require court decisions.
davidmurdoch 4y ago
> pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that" That's the same thing as a cookie banner. I don't care what the words say; don't show it to me at all.
- BiteCode_dev 4y ago
  - non modal - don't require action or decision on you - can be put at the bottom right on the corner - don't prevent accessing the main content It's the same thing as a cookie banner in the way a HN comment and a double blind study are the same thing.
  - n8cpdx 4y ago
    You’re describing the annoying cookie banners on half the sites I visit, including stack overflow. This solves nothing.
  - davidmurdoch 4y ago
    I think you underestimate how much of the world loathes that cookie law that applies itself across borders.
ApolloFortyNine 4y ago
>This tracking is not benefiting us. Well unless you don't consider free access to video streaming (YouTube) or free access to news a benefit. My honest opinion on all this has always been that the majority of people, if properly explained to that 'tracking' is never even viewed by a human, and even if it was, your identified as user 563758, would consider this a fair trade. People largely think you can remove the tracking and access all the same content for free. But when the ads pay 90% less, it becomes much more difficult for the free content to survive.
- jlkuester7 4y ago
  This is a fair point. If you don't want to be intrusively tracked, you should not expect "free" services. However, IMHO the answer here is to find a different model for funding online software/services. Letting advertising firms run the internet does not really seem to be taking software in a user/consumer-friendly direction.
  - naasking 4y ago
    Plenty of services were free prior to commercialization of the web because they generated nom-monetary value (community, knowledge, etc.). Plenty of creators and artists also make money directly via donations (Patreon, etc.). I'm not sure we need the existing ad model for either free content or to make money on the internet.
  - dmitriid 4y ago
    "Ads only work if they have intrusive tracking" is presented by you and others as fact. It's not.
- Retric 4y ago
  Advertising does not require tracking. Remember over the air television and all it’s free news broadcasts.
  - nalaz 4y ago
    Advertising with tracking barely covers costs, imagine without it.
MichaelCollins 4y ago
> reveal who are the bad players. This is one of the reason I don't use a cookie banner blocker. I would rather close the page upon seeing one, or circumventing it manually using ublock origin's element zapper. Generally, I think these discussions are poisoned by disingenuous web developers who pretend to be extremely annoyed by the banners as users, but really they're annoyed at the banners as website operators. They are the aforementioned 'bad players' who feel outed and targeted by the EU's regulations. Why are supposed user complaints about cookie banners so prevalent on this site, but virtually unheard of in 'normie' spheres of discussion?
syrrim 4y ago
The option for the company is between the "more money" and "less money" option. There is a general sense in which the average individual benefits from the "more money" option; websites are better funded, they can provide better services, etc. There is also a incredibly minor way that they are worse off, in that some of their data (consisting of a field that says when they viewed certain news articles) might show up in a data leak in the future. But when you put it as "do you want to be tracked", of course it sounds bad, so all else being equal most people will say "no". The "informed consent" framing of this issue is quite ridiculous. When someone is asked to pay for an item at the store, we don't say that they should also have the choice to take the item for free, and only pay for it if they want to. We recognize that, individually, most people would rather pay less, but that we collectively benefit when businesses are profitable. The situation with cookies is even worse, because unlike with money, most people have no idea what a website even uses their data for. Th EU trying to rewrite the issue as concerning "consent" is thus idiotic, and innevitably lead to the cookie banner issue. If you think tracking is bad, then ban it, and let websites figure out how to target ads and improve their product without it. If you recognize tracking as overall beneficial, then permit it, and throw out this charade of informed consent. The EU can't make this decision themselves, so they expect every single individual to make this decision for themselves, every time they visit a website. This despite the average individual having no idea what their data is even being used for. The issue is existential for websites, since it concerns their ability to remain profitable. As such, the website that stays in business longest is the one that can coax the most people to hand over their data. It is entirely inevitable that websites would go up to and beyond the letter of the law in pursuing this.
- catiopatio 4y ago
  That’s an extremely obtuse justification for immoral behavior. Consumers are informed, and they say “no” when given the choice. Respect their “no”. Tracking builds a massive, exploitative, dangerous information asymmetry. You claim the cost to consumers is small; the aggregate cost is very clearly not small. This should be an existential issue for websites, and it should force the closure of websites that can only exist through exploitative abuse of consumers. The cookie banners exist because of bad actors on the web who have become too dependent on abusing user’s data. The problem is with them, and their use of dark patterns to purposefully confuse and mislead consumers.
nmz 4y ago
This is the problem with mixing law with tech, the requirement should not have been with the websites. but each browser, should have come with the capability of auto destroying cookies and also making cookies isolated.
- Tarq0n 4y ago
  That would just make it a race between fingerprinting and fingerprinting resistance tech. The point is to prevent tracking without purpose / permission regardless of the technology used.
  - nmz 4y ago
    The race is already here, just look at all the extensions one has to use just to get some usability out of the web. There's no security panacea, just an endless game of whack-a-mole
charcircuit 4y ago
>Those corps chose to make the web terrible a little bit more every day: tracking Tracking can make sites better because it gives them data to improve the site.
- account42 4y ago
  You don't need tracking to find out that the million layers of javascript make the thing too slow to be useable.
Nextgrid 4y ago
> So the banner is just the most annoying way that is legally allowed to try to get people to force-accept tracking. In fact, some banner are crafted to make rejection the hardest path for this very reason. Just FYI, a banner that tries to skew a choice by using pre-ticked checkboxes, making one option more prominent than the other or makes it more difficult to decline than to accept is not "legally allowed". It's merely tolerated because nobody gives a shit about enforcing the GDPR, but it's not actually compliant with the regulation in any way.
wizofaus 4y ago
"In fact, some banner are crafted to make rejection the hardest path for this very reason." Some? I don't think I've seen a single banner where "accept only necessary cookies" was an obvious/upfront choice.

deleted 4y ago

[deleted]

adhesive_wombat 4y ago

> In fact, some banner are crafted to make rejection the hardest path for this very reason. Something that's also illegal. National regulators don't seem to care though, which is a shame as a couple of fines and operators would mysteriously, simultaneously and suddenly realise there _was_ a way to make rejection at least as easy as acceptance all along.

shaky-carrousel 4y ago
Luckily for us, in this age of centralized internet, you only need to hit with fines a couple of cookie dialog providers and you are set.
- adhesive_wombat 4y ago
  OneTrust, who seems to do a sizeable fraction, get it right on their own website. I have never seen a OneTrust dialog elsewhere have equal prominence given to the reject and accept pathways.
- mananaysiempre 4y ago
  Nope. Apparently selling conconformant GDPR-compliance services is not against the law, only buying them is? Which makes some sense, but in any case OneTrust still sell dark-pattern banners to (at least) hundreds of websites even after a sizeable batch of them has been ruled illegal[1]. [1] https://noyb.eu/en/226-complaints-lodged-against-deceptive-cookie-banners https://noyb.eu/en/226-complaints-lodged-against-deceptive-c...
  - adhesive_wombat 4y ago
    Scummy as that is, I don't think that providing the banners should be illegal, as otherwise it's a hop and a step to "providing software that can be used illegally is in itself illegal". Which makes text editors illegal without "safeguards" baked in. However, if OneTrust are selling the software under the promise that if the customers configure it that way, then it's compliant, then that's some kind of misrepresentation (which is illegal, software or not). Just as if I sell a USB flash drive as an anti-5G-field dongle, that's illegal, but it'll not illegal to just sell the flash drive.
seszett 4y ago
I think they do care, but with limited means they cannot tackle the whole problem at once. So they go after one bad actor after another, and the others eventually adjust their practices to be a bit less illegal. On the French web you can see the evolution on newspaper websites, which used to have these popups with an easy accept button and difficult, hidden paths for refusal, which eventually moved to a simpler "reject" button with subdued colours or a "reject and read the article" a bit less visible than accept, but still easy enough to spot, and now many have two equal buttons... but "reject" leads to a page that says "you can reject cookies but then you can't read the newspaper, you can pay instead". You can really see how they try to go as far as they think they can, and adjust their behaviour even without having been targeted themselves. I have good expectations that everything will eventually get better even if it will take time.
- mopsi 4y ago
  The same happened with Google and Youtube. They used to have pop-ups with large and obvious "Accept" button and a clicking game if you wanted to reject tracking. The EU put a pressure on them and now the popups have two equal "Reject" and "Accept" buttons.
  - hedora 4y ago
    The current situation is still a problem. If you disable cookies, you get the banner every single time. The law should outlaw that behavior so that people can continue to conveniently block cookies. Google is an ad network and controls chrome. They could come up with a universal opt out (like X-DO-NOT-TRACK) that works with such a law.
    - aembleton 4y ago
      It's up to your user agent what it displays and which cookies to store. It's the user agent that needs to change to stop bugging you. That's what brave are doing
      - hedora 4y ago

kayxspre 4y ago

I remember that Medium (yes, the one that is now notorious about paywall) used to have banner to that wording when I set DNT in my browser to "On". This [1] shows how it actually appeared at that point. Medium also has an FAQ about its DNT at [2]. [1] https://www.eff.org/deeplinks/2017/10/do-not-track-implementation-guide-launched https://www.eff.org/deeplinks/2017/10/do-not-track-implement... [2] https://help.medium.com/hc/en-us/articles/213690167-Medium-s-Do-Not-Track-Policy https://help.medium.com/hc/en-us/articles/213690167-Medium-s...

PebblesRox 4y ago

I recently came across a cookie banner in real life that reminded me of that game. I'm still not sure whether I successfully refused cookies. https://soccerwhizz.com/if-i-speak-i-am-in-big-trouble-meaning/ https://soccerwhizz.com/if-i-speak-i-am-in-big-trouble-meani...

miracle2k 4y ago

> Because the vast majority of people would not consent. Many people would click No when asked "Can we track you?". Yet, fewer people would click No when asked "Can we show you ads that are closely related to your interests"? Likely even more people would agree with "Are you willing to share some data so we can improve our product?". And maybe most people would actually be ok with websites including Google Fonts [1]. Of course, when too many people agree with the proposition, then the question must be legally mandated to be more scary. The truth is that "people" are fundamentally not on the side of the privacy advocates. This is the whole reason for the GDPR. People are perfectly happy to share their data in exchange for using those services. Fundamentally, GDPR advocates are claiming that people just don't get it, and should not be allowed to make this choice. Which is why websites are not allowed to make their service conditioned on consent to tracking. > So if I have DNT=1 set in my browser, pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that". Solved. This is still an annoying banner somewhere. Please no. [1] https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f...

Semaphor 4y ago
> Which is why websites are not allowed to make their service conditioned on consent to tracking Is that clear yet? Because most bigger newspapers in Germany do exactly that, try Spiegel.de
- hnbad 4y ago
  I wouldn't be surprised if German data protection agencies give news "publishers" more leeway given that they seem to be extremely influential in other domains of digital law in Germany. But yeah, it's debatable whether "my business model depends on showing you ads from services that harvest your data via those ads" is a legitimate interest. If it is, that sets a bad precedent IMO.
  - Semaphor 4y ago
    FWIW, many of the data protection agencies are nowhere near as corrupt as other places. But those things tend to require court decisions.

davidmurdoch 4y ago

> pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that" That's the same thing as a cookie banner. I don't care what the words say; don't show it to me at all.

BiteCode_dev 4y ago
- non modal - don't require action or decision on you - can be put at the bottom right on the corner - don't prevent accessing the main content It's the same thing as a cookie banner in the way a HN comment and a double blind study are the same thing.
- n8cpdx 4y ago
  You’re describing the annoying cookie banners on half the sites I visit, including stack overflow. This solves nothing.
- davidmurdoch 4y ago
  I think you underestimate how much of the world loathes that cookie law that applies itself across borders.

ApolloFortyNine 4y ago

>This tracking is not benefiting us. Well unless you don't consider free access to video streaming (YouTube) or free access to news a benefit. My honest opinion on all this has always been that the majority of people, if properly explained to that 'tracking' is never even viewed by a human, and even if it was, your identified as user 563758, would consider this a fair trade. People largely think you can remove the tracking and access all the same content for free. But when the ads pay 90% less, it becomes much more difficult for the free content to survive.

jlkuester7 4y ago
This is a fair point. If you don't want to be intrusively tracked, you should not expect "free" services. However, IMHO the answer here is to find a different model for funding online software/services. Letting advertising firms run the internet does not really seem to be taking software in a user/consumer-friendly direction.
- naasking 4y ago
  Plenty of services were free prior to commercialization of the web because they generated nom-monetary value (community, knowledge, etc.). Plenty of creators and artists also make money directly via donations (Patreon, etc.). I'm not sure we need the existing ad model for either free content or to make money on the internet.
- dmitriid 4y ago
  "Ads only work if they have intrusive tracking" is presented by you and others as fact. It's not.
Retric 4y ago
Advertising does not require tracking. Remember over the air television and all it’s free news broadcasts.
- nalaz 4y ago
  Advertising with tracking barely covers costs, imagine without it.

MichaelCollins 4y ago

> reveal who are the bad players. This is one of the reason I don't use a cookie banner blocker. I would rather close the page upon seeing one, or circumventing it manually using ublock origin's element zapper. Generally, I think these discussions are poisoned by disingenuous web developers who pretend to be extremely annoyed by the banners as users, but really they're annoyed at the banners as website operators. They are the aforementioned 'bad players' who feel outed and targeted by the EU's regulations. Why are supposed user complaints about cookie banners so prevalent on this site, but virtually unheard of in 'normie' spheres of discussion?

syrrim 4y ago

The option for the company is between the "more money" and "less money" option. There is a general sense in which the average individual benefits from the "more money" option; websites are better funded, they can provide better services, etc. There is also a incredibly minor way that they are worse off, in that some of their data (consisting of a field that says when they viewed certain news articles) might show up in a data leak in the future. But when you put it as "do you want to be tracked", of course it sounds bad, so all else being equal most people will say "no". The "informed consent" framing of this issue is quite ridiculous. When someone is asked to pay for an item at the store, we don't say that they should also have the choice to take the item for free, and only pay for it if they want to. We recognize that, individually, most people would rather pay less, but that we collectively benefit when businesses are profitable. The situation with cookies is even worse, because unlike with money, most people have no idea what a website even uses their data for. Th EU trying to rewrite the issue as concerning "consent" is thus idiotic, and innevitably lead to the cookie banner issue. If you think tracking is bad, then ban it, and let websites figure out how to target ads and improve their product without it. If you recognize tracking as overall beneficial, then permit it, and throw out this charade of informed consent. The EU can't make this decision themselves, so they expect every single individual to make this decision for themselves, every time they visit a website. This despite the average individual having no idea what their data is even being used for. The issue is existential for websites, since it concerns their ability to remain profitable. As such, the website that stays in business longest is the one that can coax the most people to hand over their data. It is entirely inevitable that websites would go up to and beyond the letter of the law in pursuing this.

catiopatio 4y ago
That’s an extremely obtuse justification for immoral behavior. Consumers are informed, and they say “no” when given the choice. Respect their “no”. Tracking builds a massive, exploitative, dangerous information asymmetry. You claim the cost to consumers is small; the aggregate cost is very clearly not small. This should be an existential issue for websites, and it should force the closure of websites that can only exist through exploitative abuse of consumers. The cookie banners exist because of bad actors on the web who have become too dependent on abusing user’s data. The problem is with them, and their use of dark patterns to purposefully confuse and mislead consumers.

nmz 4y ago

This is the problem with mixing law with tech, the requirement should not have been with the websites. but each browser, should have come with the capability of auto destroying cookies and also making cookies isolated.

Tarq0n 4y ago
That would just make it a race between fingerprinting and fingerprinting resistance tech. The point is to prevent tracking without purpose / permission regardless of the technology used.
- nmz 4y ago
  The race is already here, just look at all the extensions one has to use just to get some usability out of the web. There's no security panacea, just an endless game of whack-a-mole

charcircuit 4y ago

>Those corps chose to make the web terrible a little bit more every day: tracking Tracking can make sites better because it gives them data to improve the site.

account42 4y ago
You don't need tracking to find out that the million layers of javascript make the thing too slow to be useable.

Nextgrid 4y ago

> So the banner is just the most annoying way that is legally allowed to try to get people to force-accept tracking. In fact, some banner are crafted to make rejection the hardest path for this very reason. Just FYI, a banner that tries to skew a choice by using pre-ticked checkboxes, making one option more prominent than the other or makes it more difficult to decline than to accept is not "legally allowed". It's merely tolerated because nobody gives a shit about enforcing the GDPR, but it's not actually compliant with the regulation in any way.

wizofaus 4y ago

"In fact, some banner are crafted to make rejection the hardest path for this very reason." Some? I don't think I've seen a single banner where "accept only necessary cookies" was an obvious/upfront choice.