4 ms·

IIRC: At least in Europe, they needn't ask for essential cookies. They need to ask for cookies used for tracking, profiling, fingerprinting and consent to share

IIRC: At least in Europe, they needn't ask for essential cookies. They need to ask for cookies used for tracking, profiling, fingerprinting and consent to share collected info with third parties. The rules also state that the path to reject those cookies must be as easy as it is to accept them, so if they have "accept all" button, they are required to also provide "reject all" button, that has similar visibility and accessibility to the "accept" button. IIRC At least in EU, what they do is illegal and dark pattern, and hence personally I have no reason to believe their side of story on any topic.

dwaite 4y ago
> The rules also state that the path to reject those cookies must be as easy as it is to accept them, so if they have "accept all" button, they are required to also provide "reject all" button, that has similar visibility and accessibility to the "accept" button. The rules also say that you have to be able to _withdraw_ your consent as easily as you provided it, which IMHO 99% of cookie banners fail to provide for.
- hedora 4y ago
  Easy solution: Don’t dismiss the cookie banner until the user clicks “deny all”. It might be hard to sell a product that behaves that way to websites though.
Traubenfuchs 4y ago
That‘s what I thought. I just started a prolonged burnout vacation. How do I hold them accountable / sue them? I will look it up.
- Nextgrid 4y ago
  You can't sue them. That's the reason so many non-compliant consent flows are out there, and entire businesses have been built on providing them as a service. The best you can do is to complain to your country's data protection agency (in the UK this would be the ICO, in France the CNIL, etc). The problem is that they aren't enforcing the regulation enough to deter non-compliance. It's cheaper (in fact, free most of the time, the worst you will get is be asked to get into compliance despite breaching the regulation for years) to breach it for as long as you can than to respect it.
- jeroenhd 4y ago
  You report them to your local DPA. The DPA will look into the complaint, ask the company to fix the problem and/or start an investigation, and maybe eventually, hand out a fine. How long this takes depends on the problem and the capacity for the DPA. If Google or Facebook are involved in a new data sharing scheme, their cases will get priority over a website not setting cookies right.
- drstewart 4y ago
  Is there somewhere I can bet money on this not happening? Anyone who has to ask whether something is allowed or not and then how they can "sue" based on the one line comment to their question they couldn't be bothered to search for isn't suing anyone. Enjoy your vacation.

dwaite 4y ago

> The rules also state that the path to reject those cookies must be as easy as it is to accept them, so if they have "accept all" button, they are required to also provide "reject all" button, that has similar visibility and accessibility to the "accept" button. The rules also say that you have to be able to _withdraw_ your consent as easily as you provided it, which IMHO 99% of cookie banners fail to provide for.

hedora 4y ago
Easy solution: Don’t dismiss the cookie banner until the user clicks “deny all”. It might be hard to sell a product that behaves that way to websites though.

Traubenfuchs 4y ago

That‘s what I thought. I just started a prolonged burnout vacation. How do I hold them accountable / sue them? I will look it up.

Nextgrid 4y ago
You can't sue them. That's the reason so many non-compliant consent flows are out there, and entire businesses have been built on providing them as a service. The best you can do is to complain to your country's data protection agency (in the UK this would be the ICO, in France the CNIL, etc). The problem is that they aren't enforcing the regulation enough to deter non-compliance. It's cheaper (in fact, free most of the time, the worst you will get is be asked to get into compliance despite breaching the regulation for years) to breach it for as long as you can than to respect it.
jeroenhd 4y ago
You report them to your local DPA. The DPA will look into the complaint, ask the company to fix the problem and/or start an investigation, and maybe eventually, hand out a fine. How long this takes depends on the problem and the capacity for the DPA. If Google or Facebook are involved in a new data sharing scheme, their cases will get priority over a website not setting cookies right.
drstewart 4y ago
Is there somewhere I can bet money on this not happening? Anyone who has to ask whether something is allowed or not and then how they can "sue" based on the one line comment to their question they couldn't be bothered to search for isn't suing anyone. Enjoy your vacation.