3 ms·

> I'm not suggesting that consent shouldn't still be asked for in cases where it's legitimate, like storing actual user personal data that they provide when sig

> I'm not suggesting that consent shouldn't still be asked for in cases where it's legitimate, like storing actual user personal data that they provide when signing up for an account, for example. Guess what. In this case the you don't have to ask for user consent. Because this data is strictly essential to site functionality. > But simply visiting a website should not be considered a legitimate reason to obtain or store a user's data. Guess what. It's exactly what GDPR is saying.

Reason077 4y ago
> "Guess what. It's exactly what GDPR is saying." But that is not how it is being interpreted in practice. Clearly we just need to go one step further and explicitly say "it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website". Problem solved.
- dmitriid 4y ago
  > But that is not how it is being interpreted in practice. No. In practice it's actually being interpreted correctly. What is being willfully misinterpreted is how easily a user can opt-out. Because the industry wants to remain exactly the same: it wants to siphon user data and sell it en masse. The existing pop ups that use dark patterns to make the user click "accept" are already illegal. > it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website So it won't be a pop-up. It will be an interstitial page. You keep focusing in the entirely wrong issue and blaming the law for it. So, we've banned pop ups. Now what? Now every time you visit a web site, you get a full page asking for your consent. Then you'll blame the law and ask to ban interstitials. Ok. We'll ban interstitials. Now it will be banners. Or every second paragraph in text. Videos. Images. Where the law just says: do not collect user data without user's consent, and the user isn't obliged to give you that consent. And the industry replies: screw this, we demand this data and make users' life hell for it. Somehow gullible devs are now fully convinced that the law requires all this.
  - Reason077 4y ago
    I’m not necessarily blaming the law, but saying that a new law (or change to the existing one) is needed to ban cookie pop-ups. It’s clear at this point that the problem is not going to go away without intervention. The industry isn’t going to fix itself. Also, it’s unfair to blame developers here. Devs don’t have some perverse desire to create annoying pop-ups. They’re being told to do it by management and legal teams, because that’s how the GDPR has been interpreted. > ”So it won't be a pop-up. It will be an interstitial page.” Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website”
    - dmitriid 4y ago
      > It’s clear at this point that the problem is not going to go away without intervention. The industry isn’t going to fix itself. Indeed. The main problem with GDPR is that enforcement has been slow. And that the industry has blamed its own behavior on the law. As the article shows, the tide is ever so slowly turning. > Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website” And how, in this case, do you ask for consent for legitimate reasons?
      - Reason077 4y ago
        This would be specifically for tracking cookies (“cookie pop-ups”). Consent for legitimate reasons is given, for example, when you sign up for an account on a website or conduct some sort of transaction with a business. Just not the act of anonymously visiting a web page.
        dmitriid 4y ago
        > This would be specifically for tracking cookies (“cookie pop-ups”). Those pop-ups are not "specific for tracking cookies". Because the issue, and the law, isn't about "tracking cookies". The issue, and the law, is about user data. So, they will replace the question about cookies with question about localStorage. Then about indexed db. Then about storing data in service workers. Why do you keep focusing on the one issue that is 100% the result of industries actions and pretending it's about the law? > Consent for legitimate reasons is given, for example, when you sign up for an account on a website or conduct some sort of transaction with a business. Again. Even when you sign up for something, for some of the data consent isn't required. And for other data consent is required. I give up. I cannot put it in simpler terms that I already have.

Reason077 4y ago

> "Guess what. It's exactly what GDPR is saying." But that is not how it is being interpreted in practice. Clearly we just need to go one step further and explicitly say "it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website". Problem solved.

dmitriid 4y ago
> But that is not how it is being interpreted in practice. No. In practice it's actually being interpreted correctly. What is being willfully misinterpreted is how easily a user can opt-out. Because the industry wants to remain exactly the same: it wants to siphon user data and sell it en masse. The existing pop ups that use dark patterns to make the user click "accept" are already illegal. > it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website So it won't be a pop-up. It will be an interstitial page. You keep focusing in the entirely wrong issue and blaming the law for it. So, we've banned pop ups. Now what? Now every time you visit a web site, you get a full page asking for your consent. Then you'll blame the law and ask to ban interstitials. Ok. We'll ban interstitials. Now it will be banners. Or every second paragraph in text. Videos. Images. Where the law just says: do not collect user data without user's consent, and the user isn't obliged to give you that consent. And the industry replies: screw this, we demand this data and make users' life hell for it. Somehow gullible devs are now fully convinced that the law requires all this.
- Reason077 4y ago
  I’m not necessarily blaming the law, but saying that a new law (or change to the existing one) is needed to ban cookie pop-ups. It’s clear at this point that the problem is not going to go away without intervention. The industry isn’t going to fix itself. Also, it’s unfair to blame developers here. Devs don’t have some perverse desire to create annoying pop-ups. They’re being told to do it by management and legal teams, because that’s how the GDPR has been interpreted. > ”So it won't be a pop-up. It will be an interstitial page.” Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website”
  - dmitriid 4y ago
    > It’s clear at this point that the problem is not going to go away without intervention. The industry isn’t going to fix itself. Indeed. The main problem with GDPR is that enforcement has been slow. And that the industry has blamed its own behavior on the law. As the article shows, the tide is ever so slowly turning. > Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website” And how, in this case, do you ask for consent for legitimate reasons?
    - Reason077 4y ago
      This would be specifically for tracking cookies (“cookie pop-ups”). Consent for legitimate reasons is given, for example, when you sign up for an account on a website or conduct some sort of transaction with a business. Just not the act of anonymously visiting a web page.
      - dmitriid 4y ago
        > This would be specifically for tracking cookies (“cookie pop-ups”). Those pop-ups are not "specific for tracking cookies". Because the issue, and the law, isn't about "tracking cookies". The issue, and the law, is about user data. So, they will replace the question about cookies with question about localStorage. Then about indexed db. Then about storing data in service workers. Why do you keep focusing on the one issue that is 100% the result of industries actions and pretending it's about the law? > Consent for legitimate reasons is given, for example, when you sign up for an account on a website or conduct some sort of transaction with a business. Again. Even when you sign up for something, for some of the data consent isn't required. And for other data consent is required. I give up. I cannot put it in simpler terms that I already have.