10 ms·
France fines Microsoft €60M for imposing advertising cookies
- deleted 4y ago[deleted]
- linhns 4y agoTime for other nations to do the same, albeit overdue
- shasts 4y agoI fail to understand why politicians thought the cookie dialogue was a good idea. Adds almost nothing to benefit user and huge annoyance from the UX perspective.
- janalsncm 4y agoThe alternative is unmitigated surveillance capitalism. Most people don’t want to be spied on.
- barbazoo 4y agoWas it policy prescribing the cookie banner or was the cookie banner just the implementation of a policy?
- jonas-w 4y ago> Adds almost nothing to benefit user[...] Care to elaborate why you think so?
- shasts 4y agoThe websites make it so hard to reject cookies or selectively accept to make the website work for your benefit. Quick google search about the effects of the law shows various studies done so far to assess the positive impact it brought. https://techcrunch.com/2019/08/10/most-eu-cookie-consent-notices-are-meaningless-or-manipulative-study-finds https://techcrunch.com/2019/08/10/most-eu-cookie-consent-not... I think the USB-C mandate also going to result in a similar implementation by companies. Apple already setting the trend by going to have only wireless charging for phones. https://youtu.be/jO83ARJiOfQ https://youtu.be/jO83ARJiOfQ
- eitland 4y ago> The websites make it so hard to reject cookies or selectively accept to make the website work for your benefit. Either I misread you or this is pure nonsense. I have read through many of these popups and there is no way 200-700 trackers are there for my benefit.
- jonas-w 4y agoA year or two ago i would have kind of agreed with you. But currently 70%-90% (based on what i see everyday) are just one click to reject everything.
- eitland 4y agoThen fines like this come along and will force Microsoft to simplify the ux of this down to where it should be: It should be absolutely trivial to reject tracking unless you actively want it.
- ElectricalUnion 4y ago> cookie dialogue (...) Adds almost nothing to benefit user and huge annoyance from the UX perspective. It's misinterpretation of the letter of the law (there's no such thing as a cookie dialog/banner) and the spirit of the law (disabling tracking should be easy default choice, not the convoluted, hard choice).
- legulere 4y agoCookie banners are simply the most annoying and spiteful way to fulfill the EU regulations. You don’t need to block access to the website until you accepted tracking. If you don’t track you don’t need any thing at all.
- robertlagrant 4y agoBanners don't block access.
- cbo100 4y agoProbably not strictly by the letter of law. But practically, when they take up a good 2/3 of the screen and are not dismissible without making a choice then they do.
- jacquesm 4y agoPoliticians never thought the 'cookie dialogue was a good idea'. Politicians aimed to reduce the use of cookies for tracking without consent. That the industry responded by either ignoring the directive and/or by harassing their users to give that consent forcibly isn't on the politicians but on the owners/operators of those websites.
- hericium 4y agoLawmaking is like chess. Politcians and their lawyers should anticipate what bigcorp will do in response to new law and inject countermeasures before the law is introduced. Cookie law was lame af from the beginning and did nothing but annoyed end-users.
- jacquesm 4y agoI disagree. If companies decide to take these laws in the worst possible way, far worse than any normal and sane person would anticipate the problem isn't with the law. Take into consideration that these companies annoyed their users but blamed it on the politicians, which is pretty irrational behavior. And here you are, still blaming the politicians. As a result the GDPR came into being which is far more strict, it too is being blamed as the reason why many companies have now decided to shut down service altogether as the easiest solution to comply, when obviously the alternative would be to simply stop tracking your users.
- jefftk 4y ago> If companies decide to take these laws in the worst possible way, far worse than any normal and sane person would anticipate the problem isn't with the law. Are you saying that before the 2002 ePrivacy Directive came out most people who thought about this wouldn't have predicted that companies would put up cookie banners?
- rightbyte 4y agoThe cookie nagging kinda worked for a while because EU bureaucrats bad. But I believe their was a general shift in realizing Google et al. spy on you where it backfired in the long term. Users were way more naive at the time of cookie banners being introduced. Internet were still not a real IRL thing.
- csydas 4y agoThat's because the cookie dialogues as they are now were never part of the original GDPR and other privacy related bills/acts/whatever. GDPR requires that consent is as easy to withdraw as it is to give. [0] That companies have dragged their feet and gone kicking and screaming with cookie banners is irrelevant to the actual law; the EU needs to start cracking down more and more on this to show what it actually means, since it's quite clear that companies are not going to willingly comply with the data consent laws. So don't blame the politicians on this one, they never gave any requirement for such banners, and in fact specifically mentioned that it must be simple to revoke/deny consent. Companies that didn't want to comply with GDPR and other privacy laws decided to make it as painful as possible for you and I and blame it on the privacy rules. [0] - https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
- the8472 4y agoThings that are technically necessary to facilitate functions requested by the user like shopping carts or login tokens are exempt under clause 22 of the ePrivacy directive. Don't set any other cookies and you won't need to ask for consent. Politicians aren't forcing websites to set more than the strictly necessary cookies, which require consent. It's marketing/advertising that does.
- ilyt 4y agoCookie law does need revision, but GDPR is much better written
- lakomen 4y ago[flagged]
- letrowekwel 4y agoLet me guess, Russia is the good guy?
- eitland 4y ago> And the USA allowed a vasall to fine a master nation's company? That might be how it works between Russia and "friends" but not here. We fine American companies as much as we want. > Otoh 60M for Microsoft is nothing. And the USA is raping the EU via weapon and energy sales because another US vasall "needs help" Say, did US rape Europe and Russia when they helped us/them in the WW2 as well? And by
- danuker 4y agoI am glad to see the cookie law, as misguided as it was, be enforced. Online advertising is an oligopoly with a stronghold on network effects. However, I wish the law were solely about sites working with cookies disabled. The prompt on every website is driving me crazy, to the point of installing extensions like https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ (though this has been acquired by Avast apparently, so I won't ever update from 3.3.2). Ever since the first browsers, cookie preferences were customizable in them. Websites should not duplicate that functionality, but merely respect it.
- ElectricalUnion 4y agoOne of the most important parts of a adblocker those days is cookie banner hiding. EasyList Cookie is one of the first lists I enable on any adblocker that allows it.
- eitland 4y agoThe thing is this is something we suffer through while we wait for companies to get enough, and large enough fines to actually read GDPR and respect it. Once that happens it will be almost as before, just with less battery usage, less network usage and less tracking. Will it happen? I think it will. I know see even Google - who I expect to have a small army of lawyers - have given up to certain extent and now lets me opt out directly without any extra steps.
- kombai 4y agoYou could try https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies if you don't trust avast.
- mnw21cam 4y agoTry consent-o-matic instead. It allows you to select the level of consent that you want to give web sites. I currently have it set to none, and I haven't seen a consent dialogue for a long time.
- dEnigma 4y ago
- adrr 4y agoCookie regulations have been a disaster. Cookie prompts are a huge annoyance but the bigger thing is that sites are locking their content with registration walls so they can track users by logged in state. Benefit to users is actually negative.
- eitland 4y ago> so they can track users by logged in state. This is not allowed either. GDPR, unlike the previous attempt isn't a cookie law but a data law.
- hericium 4y agoUsers accept vendor's conditions upon registering and are giving their consent.
- mnw21cam 4y agoTerms and conditions do not override law. Coerced consent is not consent. By law, the user experience must not be different based on whether the user has or has not given consent for tracking. Registration implies consent to process information (identity) for the purposes for which that information was provided, namely access to the content. It does not imply consent to use that information for other purposes such as tracking, and so any attempt to track a user around a site for advertising purposes using their login details would be in breach of the GDPR, unless the user has explicitly and freely given separate consent for that to be done. For that to be possible, the request for consent to track must be completely separate from the process of creating an account or logging in - it cannot be part of the terms and conditions.
- eitland 4y agoBut that consent is invalid according to the law if it was easier to give consent than to say no.
- deleted 4y ago[deleted]
- 4y ago
- jefftk 4y agoCNIL release: https://www.cnil.fr/fr/cookies-sanction-de-60-millions-deuros-lencontre-de-microsoft-ireland-operations-limited https://www.cnil.fr/fr/cookies-sanction-de-60-millions-deuro..., and decision: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989 https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989 Reading it in translation, seems they identified the following as breaches: 1. When you visited bing.com they always dropped an ad fraud detection cookie. 2. After clicking around on bing.com, without clicking yes on any of the banners, it would drop an ads cookie. 3. On their cookie banner, rejecting took two clicks while accepting took one. On 1, Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision). On 2, Microsoft said it was an accident and had already stopped, though not before CNIL asking them about it On 3, Microsoft argued that (a) rejecting was not actually required to be as easy as accepting and that (b) since the default was no cookies and it took a click to get cookies that rejecting was easier than accepting. The CNIL disagreed on both.
- Moissanite 4y ago> rejecting was not actually required to be as easy as accepting Nice of them to spell out "we don't actually care about the users, get fucked" in such a clear and succinct way.
- lprd 4y ago€60M is like a slap on the hand to a company like Microsoft. Where does that money go, anyways? Certainly not to the people.
- ynfnehf 4y agoWhat is the point in implementing a cookie banner if you are still breaking the law in an obvious way? Why not just break the law by not having a cookie banner? That way it would at least be less annoying for your users.
- guerrilla 4y agoI think a lot of companies comply with cookie banners the way that they do just to annoy users, as a protest against regulation. If they can irritate users as much as possible while complying, they think they can turn users against the regulation itself rather than the way that they comply. I don't know if this applies in this particular case, but I know at least some companies do that so it's worth considering. Other than that, maybe the answer is that they were just trying not to be obvious, or that it was totally different divisions responsible for each?
- ynfnehf 4y agoBut almost no company complies with the law anyways. They need to have a "reject all" button; a "more options" button is not enough. So any company that has a cookie banner without a "reject all" option might as well not have a banner at all.
- guerrilla 4y agoA lot of European companies do have a reject all button thank god :) But yeah more need that.
- aorth 4y agoAmerican companies are the worst: "Accept" and "More info". :)
- arlcode 4y agoWe do. At least for the part of the product I was responsible for I made sure that the tracking script is really only loaded if the user explicitly clicks yes. It's sometimes hard to make marketing understand why this is an issue in the first place but then we are B2B in a mostly offline industry so it doesn't matter as much.
- ht85 4y agoZoom "stay logged" is greyed out if you have moderate privacy settings. Only website I've ever had an issue with.
- deleted 4y ago[deleted]
- voytec 4y agoNow it would be great if the EU could start enforcing GDPR. Multiple sites of Polish government - main www.gov.pl among others - attempt to run Google's tracking code on visitors' devices without consent. This is basically illegal in the EU but Poland's GDPR body (Urząd Ochrony Danych Osobowych) dismissed the case opened by me against the Minister of Digital Affairs (Minister Cyfryzacji) who is responsible for those sites operation as baseless.
- siefaa 4y ago[dead]
- jeppester 4y agoCongratulations to France who are standing up for us all and reaping reward. I could only wish for the Danish authorities to be so couragious as to actually enforce the law - especially against the biggest offenders. This means that Bing will become a good example rather than a good excuse.
- endisneigh 4y agoit's interesting to see what the EU and France focuses their energy on. surely there's a technical solution that could be deployed by the government that all Europeans could use to preserve their privacy if they'd like and end the madness. alas, most of the top technical talent either has moved to the United States or works for US companies so fines it is.
- ilyt 4y ago"See how us Americans have freedom to be tracked by big tech at their whim? Up yours EU and your privacy protection and government standing behind people, not corporations!"
- endisneigh 4y agoAre people in the EU not surveilled?
- ilyt 4y agoIt is limited to a purpose and informed. But the most surveiled country left EU some time ago (and the survelliance was entirely due to their own laws, not EUs) and it's not as bad, and better since GDPR. So for example if you want to have cameras in your shop you have to write on the doors that you have it, who is processing that data and for what purpose. If say you as owner wanted to give that data to police, that's within the usage and fine. If you decided to make compilation of funny people in supermarket from it, or decide to train your AI models on it, that would be illegal. There is also limitation on storage period (3 months) that can be longer only if there is some crime being investigated related to that. More IT related example: we can log IP and stuff for security purposes but they can be used only for that; we don't need to get consent to save that for purpose of say preventing DDoS or spotting out attacks but we can't use that to do analytics without anonymizing data or consent. There are other laws that require storing data for longer, mostly tax and money related, can't exactly use GDPR to tell bank to stop storing your financial data. Most importantly that puts the burden of handling it on corporations; with GDPR the PII is basically "radioactive". I think it is in pretty good compromise between "freedom to do whatever you want" and "freedom for whoever else to fuck you without consequences because they can do whatever they want" althought EU is definitely overreaching in places (like the hard-on on EVs before infrastructure is ready)
- thiht 4y agoThere are a lot of misconceptions in the comments, this is honestly not what I expect from HN. - cookie banners are the result of the ePrivacy directive, NOT the GDPR. This directive is implemented in France in the law « informatique et libertés » which is honestly pretty good overall - cookie banners are NOT mandatory when you use cookies. If you use only technical cookies (session IDs, local settings, etc.), you do NOT need a cookie banner. The law simply states that you must ask consent before tracking users. Cookie banners just highlight the fact that tons of websites track their users and did it on the cover of unreadable ToS before. The fact that cookie banners are so annoying proves the law wasn’t misguided - cookies are not the only target of ePrivacy: it’s a law about consent to tracking, not about cookies - the law works. I personally go out of my way to click « reject non necessary » when I can. I also report websites violating the intent of the law when I see them
- 762236 4y agoI enable all the tracking, as it gives higher quality ads. If I have to suffer from ads, I want them relevant.
- davidguetta 4y ago* cookie banners are NOT mandatory when you use cookies. If you use only technical cookies (session IDs, local settings, etc.), Theres sort of a grey area where you need them to do basic website analytics, which IS a bit annoying as a developper since all website will ever do this until the end of times
- wlll 4y ago> need them to do basic website analytics This can be done without tracking users though. Also, in the context of "no-one owes you a business model", just because being able to do something can increase your bottom line by some % doesn't mean you can do it at the expense of individuals. The web industry (which I'm very much a part of) had years during which they could have voluntarily stopped being shitty to users, and they didn't, so now we have GDPR etc.
- zapzupnz 4y agoThat's one less ivory backscratcher for Microsoft.