20 ms·

Where did all the “reject” buttons come from?

103 points by dotcoma 4y ago

thomas-st 4y ago
I wish cookie settings were part of the browser (e.g. I want to reject all marketing cookies but not essential ones), have a way in JS/HTTP to indicate the type of the cookie, and never see those cookie popups again.
- joking 4y ago
  Just be able to block the popups would be enough, block third parties, whitelist your auth provider that’s almost the only legitimate use of third party cookies and call it a day.
- nikeee 4y ago
  It's not just cookies, it affects all client-side storage that can be used to track people. This means that this kind of API would also be needed for localStorage etc. This is where it things will get complicated. I don't know if it exists, but it would probably be a good thing to have aria labels for those common buttons on these popups. It would benefit a11y and pave the way for a better automatic approve/reject by the browser (or some plugins). I think it won't end up in a disaster like the DNT header. There are (at least) two problems with this approach: it requires that the banners actually use these labels (which they might not want to) and if it requires some kind of browser support, the largest browser vendor is also in the tracking business.
  - ketzu 4y ago
    It is not just client storage either, it could also be ephemereal computed fingerprinting with server side tracking.
    - M2Ys4U 4y ago
      No, it is just client storage. The law is explicitly only about client storage: >Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. -- Article 5(3) of the Privacy and Electronic Communications Directive 2002 ("Directive 95/46/EC" being the old Data Protection Directive, which has been replaced by the GDPR)
      - Macha 4y ago
        It is GDPR and not PECR that sites responded to with the cookie banners that we deal with today, and GDPR covers a much broader surface area ("processing of personal data")
        M2Ys4U 4y ago
        Sort of, but it's still the ePD, really. The ePD was always there, but largely ignored by both companies and regulators. What happened when the GDPR came in was twofold: 1. Everyone became acutely aware of data protection legislation, because the GDPR actually had teeth when it came to enforcement. 2. The ePD referenced the Data Protection Directive, and when the GDPR came in to force all references to the DPD became references to the GDPR. The consequence of #2 is that the hand-wavy "implicit consent" that sites relied on to avoid cookie banners (why show a banner asking for consent if you can just assert you do have consent?) went away - the GDPR made it clear that consent must be explicit.
      - ketzu 4y ago
        Sorry for the misunderstanding on my part. I didn't correctly parse the previous responses. * Grandparent was talking about getting rid of cookie banners. * Parent was talking about API to prevent tracking needing an extension for all local storage. Of course to get rid of the original cookie banners, preventing tracking through other means is irrelevant. But nowadays most sites I visited got rid of the original cookie banners, so in my mind the complaints extend to those, even if it's not correct.
- syspec 4y ago
  The most widely used browser is run by the company that serves most of the ads. So that's pretty unlikely
- rocqua 4y ago
  Many of these cookies settings can be 'unset' by browser-settings. The HTTP server can set cookies all it wants, but if your browser throws them away between sessions, they can't be used to track you between sessions. (They still can aid tracking you within sessions, to what degree that is bad depends on the specific definition of 'sessions'). Firefox has a pretty decent system for this I believe. They also try to go against alternatives like 'local-storage' and a whole slew of other attempts at fingerprinting / creating super-cookies.
- jacooper 4y ago
  It already exists. https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ But websites will never use it because they make it annoying on purpose.
fredsted 4y ago
The EU cookie legislation was a mistake made by tech-illiterate bureaucrats that ruined the Web to a large degree. It's something that could've been built in to the browser. I have a hard time understanding why one would dedicate their time to this.
- theCrowing 4y ago
  Because otherwise a business would be violating a law if they serve European customers?
  - nailer 4y ago
    The post you’re replying to mentions many reasons why that law is ill considered.
    - theCrowing 4y ago
      It might be but it’s still the law?
    - happymellon 4y ago
      I don't see any reasons in that post as to why the law is ill conceived.
- robin_reala 4y ago
  The ePrivacy Directive originally included this, but was watered down after lobbying from ad vendors based on my understanding.
- croes 4y ago
  You are confusing the law with the intentionally bad implementation. And it was implemented in the browser as Do Not Track but websites ignored it https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track
  - Vinnl 4y ago
kybernetyk 4y ago
- asib 4y ago
  I’m extremely grateful to this person. The number of high profile organisations with blatantly and boldly anti-user cookie popups was disgraceful, but at this point I almost believe it’s my fault for expecting better.
- Bayart 4y ago
  I genuinely find it wonderful. Companies implementing malicious banners are scum.
isaacfrond 4y ago
I've set my browser to delete cookies at close. You can accept all cookies without problem, and after lunch everything is forgotten. A few websites that I go to often get special treatment (Hacker News!), because I'm to lazy to press ok each time.
- blkhawk 4y ago
  Cookie Autodelete is the plugin for that :)
- fsflover 4y ago
  This is not just about cookies. When you accept tracking, you accept all kinds of it, including those that are not deleted on browser closing.
- croes 4y ago
  That's not the same. This forces you to close the browser regularly and they can still track you while your browsing session. Your approach doesn't say no, it's a yes with expiration date.
  - Macha 4y ago
    In the case of server side fingerprinting (used by any vendor offering cross device linking), it's likely not even providing the time limit people using this strategy believe it does
- d12bb 4y ago
  That would mean they get deleted every few months when an OS update forces me to reboot only. Why would I ever close my browser?
  - itake 4y ago
    I reboot my browser weekly to service browser security patches.
    - 4y ago
nailer 4y ago
Just remove cookie banners unless you’re using an ad network (this includes keeping them if you’re using google products). Users want to use your website rather than look it through a porthole, understand that websites remember you, and cookie banners are killing the web in favour of closed app stores.
- stoltzmann 4y ago
  >Just remove cookie banners unless you’re using an ad network You also need a cookie banner in EU in case your website uses any cookies that are not necessary to serve the content. This includes analytics, telemetry, and so on. It's not only ads. You can remove the cookie banner if your website uses cookies only for required functionality like log-on.
  - chriswarbo 4y ago
    > You also need a cookie banner in EU in case your website uses any cookies that are not necessary to serve the content. Not quite, for two reasons: - The law doesn't care about cookies, it cares about personal data, which includes any data which can individually identify someone (like a cookie associating them with a user account). If you're collecting or processing any personal data, that requires consent; even if you have no cookies. - The law doesn't care about serving-as-in-content; it cares about providing a service, which could be showing content on a Web site, or could be dispatching orders from a warehouse, or whatever. If someone's personal data is required to provide a service for them, then their consent is implied. The reason analytics, tracking, ad networks, etc. do not have implied consent, is because the people receiving the service (e.g. those buying ad space) are not the people who the personal data is about (i.e. ad companies cannot consent on my behalf!)
    - M2Ys4U 4y ago
      You're only talking about the GDPR. But the cookie banners aren't there because of the GDPR, they're there because of the ePrivacy Directive. It's this directive (which pre-dates the GDPR) that makes it illegal to store or access data on the end user's devices without consent unless it is strictly necessary for the provision of the service.
TuringTest 4y ago
The button is more prominent, yes. And it's still useless. Most tracking now comes from the "legitimate interest" purposes that you need to actively object to, which is buried in a tertiary hidden panel or not available at all, or even forces you to object to several dozens of trackers one by one.
- TrianguloY 4y ago
  At least most websites still offer an object to all button. not fandom.com, there you need to click on 175 enabled-by-default switches: div[data-tracking-opt-in-overlay=true] input[type=checkbox][id^=switch]:checked
- Vinnl 4y ago
  I just expect that to be the next step in the long-ish road to improvements. The inaccessibility of the "Reject all" button was the most prominent issue, but as that gets addressed, the next step will probably be court battles to more clearly define what legitimate interest is and isn't, and if the advertisers win that, I'd expect the legislation to be updated to narrow that category down.
- rocqua 4y ago
  What are these 'legitimate interest' things, and is it even possible to object to them, legally speaking? I have never seen these I believe, unless you mean 'analytics cookies' and 'functional cookies', which I never saw hidden. I did presume that a 'reject all' included rejecting these cookies, if not it would be great to know.
  - nirimda 4y ago
    There's some weird thing in the law. You can accept or reject data collection, but they can collect data for which a legitimate business interest exists unless you object - so if the law makes it default to no, you reject, but if it's default yes, you have to object. As far as I know, you have a right to object, so yes, legally speaking, it is possible to object to them. This means that there's frequently a second page of third-party/'legitimate interest' cookies, which might have an additional "Object all" button, or it might be that you have to click object one by one. One example is https://www.bbc.com https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right. This is because the BBC hates you and wants you to be unhappy.
Reason077 4y ago
Cookie pop-ups are incredibly annoying and greatly harm the usability of the web. Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere, or the consent UI should be moved to the browser where defaults (accept/reject/ask) can be set for all websites.
- Eisenstein 4y ago
  The nightly build of Brave will automatically manage the banners for you.
  - Reason077 4y ago
    Great! I hope all browsers get this feature.
- dmitriid 4y ago
  > Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere That is literally in the law. Article 7.3 https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers... --- start quote, emphasis mine --- The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. --- end quote --- Also, Recital 32: https://gdpr.eu/Recital-32-Conditions-for-consent https://gdpr.eu/Recital-32-Conditions-for-consent And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments.
  - Reason077 4y ago
    > "That is literally in the law." No, the law does the opposite. It effectively requires the use of pop-ups to "gain consent", it doesn't ban them. At least, that's how it's been interpreted in practice. > "And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments." Absolutely. In general the GDPR is a good thing. But it needs a rework to fix the cookie consent situation.
nonrandomstring 4y ago
This cookie malarkey is about a breakdown of protocol. If two entities no longer intend to cooperate and honour each others signals, all bets are off for building reliable economies on that technology. What's holding "web" together right now is the monopoly of a few browsers that more or less force users to accept insecure settings against their interests in order to keep them talking to hostile services.
fazfq 4y ago
noyb bragging about having forced sites to add a "reject all" button when it was partly their fault that cookie banners exist in the first place.
mihaic 4y ago
"Reject" being now an options is an improvement of sorts but honestly, the cookie laws in the current form are terrible long-term for privacy. Like recycling plastic, it's a red herring that benefits the big companies, and where everyone else loses. The burden being on the user to manage everything reminds me more of the dysfunctional US healthcare pricing system, where the uninsured have no negotiating power and are hit with absurd prices.
- 93po 4y ago
  The issue isn't isn't the law. The issue is every single website tracking you in a privacy invading way. The annoying cookie banners are a side effect of these companies rightfully having to now inform us of when they're invading our privacy.
  - mihaic 4y ago
    I think that's the wrong framing. Any one small site tracking me doesn't do anything. It's the shadow profiles that are built by correlating this data accross the web that actually is the issue. The fact that an information market exists is a legal issue at heart to me.
jussivee 4y ago
The thing that really bothers me with these privacy discussions is that everybody talks about cookies. The "no cookies, no consent" -mantra is false and does not respect user privacy because there are other ways to track people, like browser fingerprinting, which is even harder to block for an average internet user. The other thing, GDPR is not about cookies. The ePrivacy Directive regulates the use of cookies, but it's not about cookies either. Article 5.3. in the ePrivacy Directive says: "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ..." So whatever technology you use, you need consent to use web analytics tools. At least at the moment. A draft online suggests there might be a consent exception for audience measurement if the technology used complies with GDPR - again, this has nothing to do with cookies. The point is that the personal information collected, stored, and processed does not violate GDPR. Another thing is that all the "GA is illegal" cases have nothing to do with cookies. It's about data transfers between the EU and the US and how Google handles the data. GDPR came into force in 2018, and we will see many more legal privacy cases in the future regarding the ePrivacy Directive. The bulletproof solution at the moment for any web analytics product is to ask for consent in the EU. I've had talks with EU-based privacy gurus; some think everything is clear, and companies are mean just and reluctant to comply. But most of us agree that the messaging is done very poorly - what to do, how to comply etc. And yes, giant consent banners break the UX. But at the same time, it's important to remember this data privacy regulation stuff is not about companies. It's about the users. And companies who build tracking tools shouldn't be motivated by the idea, "how can we ignore user consent?".
anonbrowser 4y ago
I read 90% of the comments on this and everyone seems unanimously onboard with these annoying banners. The claim is they save the web. I can’t be the only one that feels these banners are destroying the web experience. There has to be a better way to improve privacy without simultaneously nuking user experience.
- willi59549879 4y ago
  the banners hinder reading. Mostly i try to ignore the banners and if it is too obtrusive i'll just leave the site again. The banners are a dark pattern.
- krfsm 4y ago
  Improved privacy without bad UX is super simple: Have privacy by default, and don't use personal information for things which the user hasn't asked for. But the metrics/tracking crowd - especially the ad vendors - hate that, and they are more important to most companies/websites than the users. (It also limits what methods you can use for site improvement, so it's a bit inconvenient for you too.)
- Macha 4y ago
  I think you're actually running into and mixing up two opposing requirements: 1. Those who support the tracking and see the banners an imposition of the law. They may come across as supporting the banners because they feel companies should be allowed require customers agree to this, though ultimately they'd rather no banners and to just track as done in the wild west days. 2. Those who support the privacy legislation and feel users should be able to prevent tracking and see the banners as dark pattern coercion so companies can claim compliance. They may come across as supporting the banners because of their stance that companies shouldn't track by default, but ultimately they'd rather there are no banners and either: (2a) companies just deal with the resulting non-viability of privacy invading business models (2b) advertising returns to a less privacy invading model as its a zero sum game so if everyone is tracking then you feel you must, but if no one is then advertisers have proven their willingness to accept less invasive models in other fields where more intrusive models are already infeasible (broadcast TV ads aren't yet trying to determine who specifically is watching, the viewability rates of "the side of a bus" must be miniscule compared to web ads, etc.)

103 points by dotcoma 4y ago

I wish cookie settings were part of the browser (e.g. I want to reject all marketing cookies but not essential ones), have a way in JS/HTTP to indicate the type of the cookie, and never see those cookie popups again.

joking 4y ago
Just be able to block the popups would be enough, block third parties, whitelist your auth provider that’s almost the only legitimate use of third party cookies and call it a day.
nikeee 4y ago
It's not just cookies, it affects all client-side storage that can be used to track people. This means that this kind of API would also be needed for localStorage etc. This is where it things will get complicated. I don't know if it exists, but it would probably be a good thing to have aria labels for those common buttons on these popups. It would benefit a11y and pave the way for a better automatic approve/reject by the browser (or some plugins). I think it won't end up in a disaster like the DNT header. There are (at least) two problems with this approach: it requires that the banners actually use these labels (which they might not want to) and if it requires some kind of browser support, the largest browser vendor is also in the tracking business.
- ketzu 4y ago
  It is not just client storage either, it could also be ephemereal computed fingerprinting with server side tracking.
  - M2Ys4U 4y ago
    No, it is just client storage. The law is explicitly only about client storage: >Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. -- Article 5(3) of the Privacy and Electronic Communications Directive 2002 ("Directive 95/46/EC" being the old Data Protection Directive, which has been replaced by the GDPR)
    - Macha 4y ago
      It is GDPR and not PECR that sites responded to with the cookie banners that we deal with today, and GDPR covers a much broader surface area ("processing of personal data")
      - M2Ys4U 4y ago
        Sort of, but it's still the ePD, really. The ePD was always there, but largely ignored by both companies and regulators. What happened when the GDPR came in was twofold: 1. Everyone became acutely aware of data protection legislation, because the GDPR actually had teeth when it came to enforcement. 2. The ePD referenced the Data Protection Directive, and when the GDPR came in to force all references to the DPD became references to the GDPR. The consequence of #2 is that the hand-wavy "implicit consent" that sites relied on to avoid cookie banners (why show a banner asking for consent if you can just assert you do have consent?) went away - the GDPR made it clear that consent must be explicit.
    - ketzu 4y ago
      Sorry for the misunderstanding on my part. I didn't correctly parse the previous responses. * Grandparent was talking about getting rid of cookie banners. * Parent was talking about API to prevent tracking needing an extension for all local storage. Of course to get rid of the original cookie banners, preventing tracking through other means is irrelevant. But nowadays most sites I visited got rid of the original cookie banners, so in my mind the complaints extend to those, even if it's not correct.
syspec 4y ago
The most widely used browser is run by the company that serves most of the ads. So that's pretty unlikely
rocqua 4y ago
Many of these cookies settings can be 'unset' by browser-settings. The HTTP server can set cookies all it wants, but if your browser throws them away between sessions, they can't be used to track you between sessions. (They still can aid tracking you within sessions, to what degree that is bad depends on the specific definition of 'sessions'). Firefox has a pretty decent system for this I believe. They also try to go against alternatives like 'local-storage' and a whole slew of other attempts at fingerprinting / creating super-cookies.
jacooper 4y ago
It already exists. https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ But websites will never use it because they make it annoying on purpose.

fredsted 4y ago

The EU cookie legislation was a mistake made by tech-illiterate bureaucrats that ruined the Web to a large degree. It's something that could've been built in to the browser. I have a hard time understanding why one would dedicate their time to this.

theCrowing 4y ago
Because otherwise a business would be violating a law if they serve European customers?
- nailer 4y ago
  The post you’re replying to mentions many reasons why that law is ill considered.
  - theCrowing 4y ago
    It might be but it’s still the law?
  - happymellon 4y ago
    I don't see any reasons in that post as to why the law is ill conceived.
robin_reala 4y ago
The ePrivacy Directive originally included this, but was watered down after lobbying from ad vendors based on my understanding.
croes 4y ago
You are confusing the law with the intentionally bad implementation. And it was implemented in the browser as Do Not Track but websites ignored it https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track
- Vinnl 4y ago

kybernetyk 4y ago

asib 4y ago
I’m extremely grateful to this person. The number of high profile organisations with blatantly and boldly anti-user cookie popups was disgraceful, but at this point I almost believe it’s my fault for expecting better.
Bayart 4y ago
I genuinely find it wonderful. Companies implementing malicious banners are scum.

isaacfrond 4y ago

I've set my browser to delete cookies at close. You can accept all cookies without problem, and after lunch everything is forgotten. A few websites that I go to often get special treatment (Hacker News!), because I'm to lazy to press ok each time.

blkhawk 4y ago
Cookie Autodelete is the plugin for that :)
fsflover 4y ago
This is not just about cookies. When you accept tracking, you accept all kinds of it, including those that are not deleted on browser closing.
croes 4y ago
That's not the same. This forces you to close the browser regularly and they can still track you while your browsing session. Your approach doesn't say no, it's a yes with expiration date.
- Macha 4y ago
  In the case of server side fingerprinting (used by any vendor offering cross device linking), it's likely not even providing the time limit people using this strategy believe it does
d12bb 4y ago
That would mean they get deleted every few months when an OS update forces me to reboot only. Why would I ever close my browser?
- itake 4y ago
  I reboot my browser weekly to service browser security patches.
  - 4y ago

nailer 4y ago

Just remove cookie banners unless you’re using an ad network (this includes keeping them if you’re using google products). Users want to use your website rather than look it through a porthole, understand that websites remember you, and cookie banners are killing the web in favour of closed app stores.

stoltzmann 4y ago
>Just remove cookie banners unless you’re using an ad network You also need a cookie banner in EU in case your website uses any cookies that are not necessary to serve the content. This includes analytics, telemetry, and so on. It's not only ads. You can remove the cookie banner if your website uses cookies only for required functionality like log-on.
- chriswarbo 4y ago
  > You also need a cookie banner in EU in case your website uses any cookies that are not necessary to serve the content. Not quite, for two reasons: - The law doesn't care about cookies, it cares about personal data, which includes any data which can individually identify someone (like a cookie associating them with a user account). If you're collecting or processing any personal data, that requires consent; even if you have no cookies. - The law doesn't care about serving-as-in-content; it cares about providing a service, which could be showing content on a Web site, or could be dispatching orders from a warehouse, or whatever. If someone's personal data is required to provide a service for them, then their consent is implied. The reason analytics, tracking, ad networks, etc. do not have implied consent, is because the people receiving the service (e.g. those buying ad space) are not the people who the personal data is about (i.e. ad companies cannot consent on my behalf!)
  - M2Ys4U 4y ago
    You're only talking about the GDPR. But the cookie banners aren't there because of the GDPR, they're there because of the ePrivacy Directive. It's this directive (which pre-dates the GDPR) that makes it illegal to store or access data on the end user's devices without consent unless it is strictly necessary for the provision of the service.

TuringTest 4y ago

The button is more prominent, yes. And it's still useless. Most tracking now comes from the "legitimate interest" purposes that you need to actively object to, which is buried in a tertiary hidden panel or not available at all, or even forces you to object to several dozens of trackers one by one.

TrianguloY 4y ago
At least most websites still offer an object to all button. not fandom.com, there you need to click on 175 enabled-by-default switches: div[data-tracking-opt-in-overlay=true] input[type=checkbox][id^=switch]:checked
Vinnl 4y ago
I just expect that to be the next step in the long-ish road to improvements. The inaccessibility of the "Reject all" button was the most prominent issue, but as that gets addressed, the next step will probably be court battles to more clearly define what legitimate interest is and isn't, and if the advertisers win that, I'd expect the legislation to be updated to narrow that category down.
rocqua 4y ago
What are these 'legitimate interest' things, and is it even possible to object to them, legally speaking? I have never seen these I believe, unless you mean 'analytics cookies' and 'functional cookies', which I never saw hidden. I did presume that a 'reject all' included rejecting these cookies, if not it would be great to know.
- nirimda 4y ago
  There's some weird thing in the law. You can accept or reject data collection, but they can collect data for which a legitimate business interest exists unless you object - so if the law makes it default to no, you reject, but if it's default yes, you have to object. As far as I know, you have a right to object, so yes, legally speaking, it is possible to object to them. This means that there's frequently a second page of third-party/'legitimate interest' cookies, which might have an additional "Object all" button, or it might be that you have to click object one by one. One example is https://www.bbc.com https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right. This is because the BBC hates you and wants you to be unhappy.

Reason077 4y ago

Cookie pop-ups are incredibly annoying and greatly harm the usability of the web. Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere, or the consent UI should be moved to the browser where defaults (accept/reject/ask) can be set for all websites.

Eisenstein 4y ago
The nightly build of Brave will automatically manage the banners for you.
- Reason077 4y ago
  Great! I hope all browsers get this feature.
dmitriid 4y ago
> Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere That is literally in the law. Article 7.3 https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers... --- start quote, emphasis mine --- The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. --- end quote --- Also, Recital 32: https://gdpr.eu/Recital-32-Conditions-for-consent https://gdpr.eu/Recital-32-Conditions-for-consent And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments.
- Reason077 4y ago
  > "That is literally in the law." No, the law does the opposite. It effectively requires the use of pop-ups to "gain consent", it doesn't ban them. At least, that's how it's been interpreted in practice. > "And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments." Absolutely. In general the GDPR is a good thing. But it needs a rework to fix the cookie consent situation.

nonrandomstring 4y ago

This cookie malarkey is about a breakdown of protocol. If two entities no longer intend to cooperate and honour each others signals, all bets are off for building reliable economies on that technology. What's holding "web" together right now is the monopoly of a few browsers that more or less force users to accept insecure settings against their interests in order to keep them talking to hostile services.

fazfq 4y ago

noyb bragging about having forced sites to add a "reject all" button when it was partly their fault that cookie banners exist in the first place.

mihaic 4y ago

"Reject" being now an options is an improvement of sorts but honestly, the cookie laws in the current form are terrible long-term for privacy. Like recycling plastic, it's a red herring that benefits the big companies, and where everyone else loses. The burden being on the user to manage everything reminds me more of the dysfunctional US healthcare pricing system, where the uninsured have no negotiating power and are hit with absurd prices.

93po 4y ago
The issue isn't isn't the law. The issue is every single website tracking you in a privacy invading way. The annoying cookie banners are a side effect of these companies rightfully having to now inform us of when they're invading our privacy.
- mihaic 4y ago
  I think that's the wrong framing. Any one small site tracking me doesn't do anything. It's the shadow profiles that are built by correlating this data accross the web that actually is the issue. The fact that an information market exists is a legal issue at heart to me.

jussivee 4y ago

The thing that really bothers me with these privacy discussions is that everybody talks about cookies. The "no cookies, no consent" -mantra is false and does not respect user privacy because there are other ways to track people, like browser fingerprinting, which is even harder to block for an average internet user. The other thing, GDPR is not about cookies. The ePrivacy Directive regulates the use of cookies, but it's not about cookies either. Article 5.3. in the ePrivacy Directive says: "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ..." So whatever technology you use, you need consent to use web analytics tools. At least at the moment. A draft online suggests there might be a consent exception for audience measurement if the technology used complies with GDPR - again, this has nothing to do with cookies. The point is that the personal information collected, stored, and processed does not violate GDPR. Another thing is that all the "GA is illegal" cases have nothing to do with cookies. It's about data transfers between the EU and the US and how Google handles the data. GDPR came into force in 2018, and we will see many more legal privacy cases in the future regarding the ePrivacy Directive. The bulletproof solution at the moment for any web analytics product is to ask for consent in the EU. I've had talks with EU-based privacy gurus; some think everything is clear, and companies are mean just and reluctant to comply. But most of us agree that the messaging is done very poorly - what to do, how to comply etc. And yes, giant consent banners break the UX. But at the same time, it's important to remember this data privacy regulation stuff is not about companies. It's about the users. And companies who build tracking tools shouldn't be motivated by the idea, "how can we ignore user consent?".

anonbrowser 4y ago

I read 90% of the comments on this and everyone seems unanimously onboard with these annoying banners. The claim is they save the web. I can’t be the only one that feels these banners are destroying the web experience. There has to be a better way to improve privacy without simultaneously nuking user experience.

willi59549879 4y ago
the banners hinder reading. Mostly i try to ignore the banners and if it is too obtrusive i'll just leave the site again. The banners are a dark pattern.
krfsm 4y ago
Improved privacy without bad UX is super simple: Have privacy by default, and don't use personal information for things which the user hasn't asked for. But the metrics/tracking crowd - especially the ad vendors - hate that, and they are more important to most companies/websites than the users. (It also limits what methods you can use for site improvement, so it's a bit inconvenient for you too.)
Macha 4y ago
I think you're actually running into and mixing up two opposing requirements: 1. Those who support the tracking and see the banners an imposition of the law. They may come across as supporting the banners because they feel companies should be allowed require customers agree to this, though ultimately they'd rather no banners and to just track as done in the wild west days. 2. Those who support the privacy legislation and feel users should be able to prevent tracking and see the banners as dark pattern coercion so companies can claim compliance. They may come across as supporting the banners because of their stance that companies shouldn't track by default, but ultimately they'd rather there are no banners and either: (2a) companies just deal with the resulting non-viability of privacy invading business models (2b) advertising returns to a less privacy invading model as its a zero sum game so if everyone is tracking then you feel you must, but if no one is then advertisers have proven their willingness to accept less invasive models in other fields where more intrusive models are already infeasible (broadcast TV ads aren't yet trying to determine who specifically is watching, the viewability rates of "the side of a bus" must be miniscule compared to web ads, etc.)