5 ms·

The EU cookie legislation was a mistake made by tech-illiterate bureaucrats that ruined the Web to a large degree. It's something that could've been built in to

The EU cookie legislation was a mistake made by tech-illiterate bureaucrats that ruined the Web to a large degree. It's something that could've been built in to the browser. I have a hard time understanding why one would dedicate their time to this.

theCrowing 4y ago
Because otherwise a business would be violating a law if they serve European customers?
- nailer 4y ago
  The post you’re replying to mentions many reasons why that law is ill considered.
  - theCrowing 4y ago
    It might be but it’s still the law?
  - happymellon 4y ago
    I don't see any reasons in that post as to why the law is ill conceived.
robin_reala 4y ago
The ePrivacy Directive originally included this, but was watered down after lobbying from ad vendors based on my understanding.
croes 4y ago
You are confusing the law with the intentionally bad implementation. And it was implemented in the browser as Do Not Track but websites ignored it https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track
- Vinnl 4y ago
  And the bad (and actually non-compliant) implementations are getting cracked down on, but that just takes time. But the article mentions an example: > the French CNIL introduced guidelines and required Google to introduce a "reject" button, which was also seen as a sign to many companies to adjust their banners and lead to major measuarable improvements in France.
- IshKebab 4y ago
  No he isn't. The law is precisely what allows the intentionally bad implementations. Anyone could have foreseen this. Hell we already knew this would happen based on the earlier cookie laws. The EU should have mandated an interaction-free solution like Do Not Track. They could have.
  - chriswarbo 4y ago
    There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it, since that would probably be considered over-reach: if Web sites want to break their UI and annoy their users, they're free to do so. Consent for personal data is implied when performing services for a user (e.g. logging in, shopping carts, remembering high-scores, etc.). Interactions are only needed when consent is not implied; i.e. when the personal data is not performing a service for a user; i.e. when the user is the product, not the customer.
    - coldtea 4y ago
      >There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it If it's not mandated it's not a solution, it's more like a pacifist asking for peace in the middle of WWII >The EU don't mandate it, since that would probably be considered over-reach I don't think that's the reason, as it wouldn't be any more overeach than mandating the current cookie notice (or, in another domain, USB-C for mobile phones).
      - viraptor 4y ago
baxtr 4y ago
100% I think the underlying reason is that most people don’t consider trade-offs. “Yes, great let’s do the cookie banner thing. But before, let’s also consider how this could be a bad idea?” “Yes, great let’s ban plastic straws. But also let’s consider what we get instead and if that alternative is really better.” These conversations rarely take place in my experience. You can still decide to do it, but at least you are aware of the consequences and are able to communicate them properly to the public, to your employees etc
- viraptor 4y ago
  "the cookie banner thing" was essentially created by the ad / tracking industry, so aim your annoyance in the right direction.
- rocqua 4y ago
  In this case, the 'dystopian' situation is not bad, if you consider tracking a bad (lets say 'evil' for exagerated effect) thing. It means that companies that want to do 'evil' are forced to ask their customers. For now most customers find the question annoying, and some go for the easy option of 'fine do some evil to me' out of convenience. But in the meantime, people are slowly building an awareness of this evil happening to them. For now the evil is profitable enough with the few people that click agree to evil out of convenience. But people are now being faced with these decisions and will slowly turn against this evil. As this awareness builds, people will start disliking the companies. And as the law gets enforced better, people will find it easier to say 'no' to evil. At some point, this will make the extra friction of cookie acceptance screens no longer worth it, and we will be in a better place. (Droping the 'evil' shtick here) All the law says is 'if you want to do this generally bad thing, you gotta ask people and you can't trick or coerce them'. This is slowly going to stop the generally bad thing from happening. The alternative "don't do this bad thing" would have a less annoying transition. But that would have been an over-reaching law that doesn't leave space for the few times where the thing is actually not bad. A more interesting question is 'without surveillance supported adds, how will the internet actually work'. Especially given that the EU laws are aimed at effectively killing the surveillance supported add industry. This is not something the EU laws have an answer to. I find this the most worrying question, though I see little room for a new way to finance the internet that is worse then surveillance supported adds.
the_gipsy 4y ago
The law was lacking in enforcement mostly. Sure, it could have been better. But if it had been as technically specific as enforcing a browser standard, then it might have been worse or less effective. After all, lawmakers are tech-illiterate.
viraptor 4y ago
There is no cookie legislation. There's data protection and privacy legislation. Cookies and banners are just how industry is dealing with it because they're dragged kicking and screaming towards what's actually slowly being enforced. If you really believe it's a cookie legislation from tech-illiterate, I recommend reading the document. You're in for a surprise. (in a good way)
deleted 4y ago
[deleted]
ptstomp 4y ago
One of the most painful parts is sites that don't even seem to remember your choices. The number of times i've said 'ok' to the canonical ubuntu cookies is infuriating. If i've accepted cookies, please at least use a long held one to remember it!
chriswarbo 4y ago
> It's something that could've been built in to the browser. It was; nobody cared (due to lack of any legislation/enforcement); it died. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P
- rogual 4y ago
  My favourite part of P3P was when Google started returning a P3P header that just had the string "This is not a P3P policy", intentionally letting browsers consider its presence a declaration of P3P compliance while declaring non-compliance in English. Real, refined, stylish evil. I couldn't help but be impressed.
ketzu 4y ago
The part I find funny about people calling the bureaucrats tech illiterate, is so many users on tech forums are illiterate on the topic themseleves, e.g., believing deleting cookies is a solution to tracking.
- Nextgrid 4y ago
  This is probably the second biggest win by the spyware industry, the first being making spyware effectively legal (by virtue of lack of enforcement - which persists even today with the GDPR) and socially-acceptable to begin with. They've now managed to convince a significant chunk of tech people that merely deleting cookies is totally enough to defeat tracking.

theCrowing 4y ago

Because otherwise a business would be violating a law if they serve European customers?

nailer 4y ago
The post you’re replying to mentions many reasons why that law is ill considered.
- theCrowing 4y ago
  It might be but it’s still the law?
- happymellon 4y ago
  I don't see any reasons in that post as to why the law is ill conceived.

robin_reala 4y ago

The ePrivacy Directive originally included this, but was watered down after lobbying from ad vendors based on my understanding.

croes 4y ago

You are confusing the law with the intentionally bad implementation. And it was implemented in the browser as Do Not Track but websites ignored it https://en.m.wikipedia.org/wiki/Do_Not_Track https://en.m.wikipedia.org/wiki/Do_Not_Track

Vinnl 4y ago
And the bad (and actually non-compliant) implementations are getting cracked down on, but that just takes time. But the article mentions an example: > the French CNIL introduced guidelines and required Google to introduce a "reject" button, which was also seen as a sign to many companies to adjust their banners and lead to major measuarable improvements in France.
IshKebab 4y ago
No he isn't. The law is precisely what allows the intentionally bad implementations. Anyone could have foreseen this. Hell we already knew this would happen based on the earlier cookie laws. The EU should have mandated an interaction-free solution like Do Not Track. They could have.
- chriswarbo 4y ago
  There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it, since that would probably be considered over-reach: if Web sites want to break their UI and annoy their users, they're free to do so. Consent for personal data is implied when performing services for a user (e.g. logging in, shopping carts, remembering high-scores, etc.). Interactions are only needed when consent is not implied; i.e. when the personal data is not performing a service for a user; i.e. when the user is the product, not the customer.
  - coldtea 4y ago
    >There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it If it's not mandated it's not a solution, it's more like a pacifist asking for peace in the middle of WWII >The EU don't mandate it, since that would probably be considered over-reach I don't think that's the reason, as it wouldn't be any more overeach than mandating the current cookie notice (or, in another domain, USB-C for mobile phones).
    - viraptor 4y ago

baxtr 4y ago

100% I think the underlying reason is that most people don’t consider trade-offs. “Yes, great let’s do the cookie banner thing. But before, let’s also consider how this could be a bad idea?” “Yes, great let’s ban plastic straws. But also let’s consider what we get instead and if that alternative is really better.” These conversations rarely take place in my experience. You can still decide to do it, but at least you are aware of the consequences and are able to communicate them properly to the public, to your employees etc

viraptor 4y ago
"the cookie banner thing" was essentially created by the ad / tracking industry, so aim your annoyance in the right direction.
rocqua 4y ago
In this case, the 'dystopian' situation is not bad, if you consider tracking a bad (lets say 'evil' for exagerated effect) thing. It means that companies that want to do 'evil' are forced to ask their customers. For now most customers find the question annoying, and some go for the easy option of 'fine do some evil to me' out of convenience. But in the meantime, people are slowly building an awareness of this evil happening to them. For now the evil is profitable enough with the few people that click agree to evil out of convenience. But people are now being faced with these decisions and will slowly turn against this evil. As this awareness builds, people will start disliking the companies. And as the law gets enforced better, people will find it easier to say 'no' to evil. At some point, this will make the extra friction of cookie acceptance screens no longer worth it, and we will be in a better place. (Droping the 'evil' shtick here) All the law says is 'if you want to do this generally bad thing, you gotta ask people and you can't trick or coerce them'. This is slowly going to stop the generally bad thing from happening. The alternative "don't do this bad thing" would have a less annoying transition. But that would have been an over-reaching law that doesn't leave space for the few times where the thing is actually not bad. A more interesting question is 'without surveillance supported adds, how will the internet actually work'. Especially given that the EU laws are aimed at effectively killing the surveillance supported add industry. This is not something the EU laws have an answer to. I find this the most worrying question, though I see little room for a new way to finance the internet that is worse then surveillance supported adds.

the_gipsy 4y ago

The law was lacking in enforcement mostly. Sure, it could have been better. But if it had been as technically specific as enforcing a browser standard, then it might have been worse or less effective. After all, lawmakers are tech-illiterate.

viraptor 4y ago

There is no cookie legislation. There's data protection and privacy legislation. Cookies and banners are just how industry is dealing with it because they're dragged kicking and screaming towards what's actually slowly being enforced. If you really believe it's a cookie legislation from tech-illiterate, I recommend reading the document. You're in for a surprise. (in a good way)

deleted 4y ago

[deleted]

ptstomp 4y ago

One of the most painful parts is sites that don't even seem to remember your choices. The number of times i've said 'ok' to the canonical ubuntu cookies is infuriating. If i've accepted cookies, please at least use a long held one to remember it!

chriswarbo 4y ago

> It's something that could've been built in to the browser. It was; nobody cared (due to lack of any legislation/enforcement); it died. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P

rogual 4y ago
My favourite part of P3P was when Google started returning a P3P header that just had the string "This is not a P3P policy", intentionally letting browsers consider its presence a declaration of P3P compliance while declaring non-compliance in English. Real, refined, stylish evil. I couldn't help but be impressed.

ketzu 4y ago

The part I find funny about people calling the bureaucrats tech illiterate, is so many users on tech forums are illiterate on the topic themseleves, e.g., believing deleting cookies is a solution to tracking.

Nextgrid 4y ago
This is probably the second biggest win by the spyware industry, the first being making spyware effectively legal (by virtue of lack of enforcement - which persists even today with the GDPR) and socially-acceptable to begin with. They've now managed to convince a significant chunk of tech people that merely deleting cookies is totally enough to defeat tracking.