7 ms·

I interpret cookie law for a tech co. Imo the law should be structured such that people who care can opt out of cookies programmatically, but every day people

I interpret cookie law for a tech co. Imo the law should be structured such that people who care can opt out of cookies programmatically, but every day people who don't care don't need to see a pop up on every site. That causes psychic load and makes us hate the internet. Also, people should get together and vote on what constitutes "strictly necessary" cookies that don't require consent and "non-essential" cookies that do. It's currently up to some nerds in EU. Why can't we have people make these calls?

shadowgovt 4y ago
Because behavioral psychology tests reveal that the public is both super-paranoid about being spied on and will sell their PII to anyone who asks in exchange for a $5 discount at a store. It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide.
- johndhi 4y ago
  Well put. We were given Facebook for free on the basis that they can advertise to us. We voted for behavioral advertising with our feet. Yet, we consume documentaries about how evil zuck is and love to hate him. But shouldn't we take both into account or just think about it hard once and then be done with it? We're wasting a lot of time and energy.
  - shadowgovt 4y ago
    History suggests that trying to fit a "once and for all" solution atop a populace in disagreement results in disaster.
- dybber 4y ago
  It shouldn't be by law, it should just be part of web standards that you can set your cookies preferences once and for all and all websites should respect that setting. I guess browser vendors and whoever else sits in these W3 consortiums like their cookies too much.
  - johndhi 4y ago
    Agreed, though the issue is that the very same technology can be used for perfectly acceptable and desired use cases (online shopping cart) or distasteful ones (behavioral advertising). So it's hard to set a strict standard.
  - rolph 4y ago
    always poison your cookies when your done with them.
  - shadowgovt 4y ago
    This was attempted with the "Do Not Track" header, but that initiative collapsed (lack of vendor support, lack of clarity in the spec regarding what it meant to not "track" someone, and ultimately it got yanked from Safari because it was yet another bit that malicious site operators could use for browser fingerprinting purposes). The "Global Privacy Control" header is apparently the second attempt to cook this goose.
    - shkkmo 4y ago
      The fundamental flaw to the DNT was the lack of any sort of penalty for non-compliance. There was no penalty for individual advertisers from either the government or from industry bodies. There was also no penalty to the advertising industry as a whole in the form of more stringent privacy laws.
  - cush 4y ago
    Absolutely should have been built into the browser
  - Xelbair 4y ago
    If only there was such thing, maybe call it 'do not track', and put it in the header of request. Oh wait - it was a thing, and was used as just another data point for tracking.
- nonrandomstring 4y ago
  > that the public is both super-paranoid about being spied on and will sell their PII to anyone who asks in exchange for a $5 discount You raise an interesting point about this apparent disconnect. > Because behavioural psychology tests reveal What do you know abot these "psychology tests"? Isn't the reality that both things you assert are really inferences based on anecdotal tales on forums like this one? Do you know of any large-scale cross cultural, long term studies that show who will part with sensitive private data for small compensation? How are these studies controlled for situation, perceived reward, time pressure, trust levels? What do we really know about widespread beliefs regarding the misuse of data? What are people's threat models? How do they assess harm? I'm not disputing the truth of what you say - both ring true. I think we instinctively know all rational people are strongly anti-surveillance. For complex social reasons we humans dislike creeps and snoops and treat them as social outcasts. But we also know that many people will sell their grandmother for a slight convenience or advantage. Do these two facets really clash, and if so why? > It's hard to craft good law when the mismatch between public stated desire and public behaviour is so wide. Is is though? Aren't both positions reconcilable if people make no causal link between the two? What if people just don't have the capacity to make that connection? Could good laws still protect them in the way that laws about asbestos protect people from harms related to chemistry and disease they cannot possibly understand?
  - gretch 4y ago
    > Could good laws still protect them in the way that laws about asbestos protect people from harms related to chemistry and disease they cannot possibly understand? They may not understand the chemical mechanisms, but the end effect is super easy to understand: “hey if you breath this in you get cancer”; “hey if you eat this, you die” Compared to the threat of something like cookies… “hey if you let these companies spy on you then…?”
    - nonrandomstring 4y ago
      > hey if you let these companies spy on you then.... Then you'll suffer multiple digital, and eventually physical harms; - You'll lose money on bandwidth that's robbed from you - you'll lose access to goods and services on the basis of calculated prejudice - you risk identity theft, impersonation, having loans taken out in your name... - you'll be exposed to manipulation, targeted disinformation - you'll experience increased targeted attacks like phishing - friends, relatives, spouse and others close to you will also be targeted - your time will be wasted dealing with more spam and nuisance - you will lose CPU, memory and battery life as the concrete resources of your devices are given over to the advertising burden - you will eventually suffer tangible harms, loss of employment, impacted credit score, loss of medical access... Sure, it needs more words to explain. Not quite so punchy and succinct as the real deal. But digital cancer caused by these companies' products can well be explained to the average "consumer" if they just stuck an ugly picture on the carton of a destitute homeless guy and the message "Surveillance capitalism can ruin your life".
- hackernewds 4y ago
  Additionally there's also a mismatch between what is good for the public versus what the public will end up choosing (due to ignorance or carelessness). This is illustrated in your first example. Good laws will protect the public from themselves, even at the cost of supposed freedoms (think schedule A drugs, production, revenge porn, tobacco).
  - shadowgovt 4y ago
    Should I think alcohol and marijuana also?
- chickenimprint 4y ago
  My carrier literally bugs me about giving away more and more personal info for 5 bucks every 2 months. They must have heard of the same research. They also ask for consent to receive "advice" and term it "our gift to you". I wonder how many people must fall for it.
- Matumio 4y ago
  > It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide. Some people would also sell their right to vote for $5 if that was legal. It's not hard to make such a law. You simply could make it illegal e.g. to offer money for PII during a purchase that doesn't strictly require it. Or to not respect the automatically transmitted cookie choice. Those who oppose such laws are the lobbyists of the big companies, not "the people".
  - shadowgovt 4y ago
    The last time a state tried to outlaw "selling your right to vote," the consequence is they banned people providing food and water to folks standing in too-long lines at the polls. This was not good law. Badly-thought-out law has unintended consequences (or even maliciously-crafted intentional consequences at the cost to the public). https://thehill.com/homenews/nexstar_media_wire/3709676-is-it-illegal-to-hand-out-water-or-food-outside-your-polling-place/ https://thehill.com/homenews/nexstar_media_wire/3709676-is-i...
jokoon 4y ago
If an user is not logged in, there should be zero cookie, there is no need to differentiate cookies.
- johndhi 4y ago
  What if you want to support shopping carts or chat bots for anonymous users? Or what about ddos prevention? Isn't a cookie (or local or session storage) needed in those cases?
  - anankaie 4y ago
    DDoS prevention does not need cookies, though they can certainly be useful to attempt to track honest users. Dishonest ones will prevent cookies from being set in the first place, or, if you only use cookies to mark 'good' sessions, will learn to spoof your cookie. Never rely on your security adversary not doing something to break your security for its efficacy. It is the same thing with KM AntiCheat (which is best handled by the OS, and even then virtualization breaks it) - unlike an antivirus the target user is adversarial to the application. For shopping carts, you can have a season token as a query parameter, like jsessionid used to be for ages. Does not help across browser sessions, but a session cookie would not help there either, much. Not sure why the chat bot would need the cookie. To track across sessions? If so, I would posit that this is no longer anonymous access. The identity of the user is defined as the cookie you use to track her. Edit: Typos. Typos everywhere!
    - johndhi 4y ago
      I'm not quite as technical as you but what do you think of Cloudflare's explanations for why they use cookies for security and load balancing purposes here? https://developers.cloudflare.com/fundamentals/get-started/reference/cloudflare-cookies/ https://developers.cloudflare.com/fundamentals/get-started/r... The law says cookies that aren't "necessary" are illegal without explicit consent. Perhaps there's room for "necessary" to include cookies that are helpful technically even if not absolutely the only way things could be done.
TechBro8615 4y ago
The Do-Not-Track header is a perfect solution to this, but unfortunately the largest browser vendor is also the largest advertising network, so the implementation of DNT devolved into a farce.
- johndhi 4y ago
  Yeah.
- astrange 4y ago
  DNT, like all other configurable browser features (including script blockers), can be used to fingerprint you too.
  - loeg 4y ago
    The ePD/GDPR are not about technical barriers for bad actors, but about compliance for good actors. Technical mechanisms like DNT would be a reasonable way to get rid of cookie banners while complying with ePD/GDPR.
- lern_too_spel 4y ago
  It has nothing to do with the browser vendor being in the ads industry. It's up to the website operator to respect it. If a website operator doesn't like a browser vendor's DNT defaults, it won't respect it, and that is why DNT failed. Regulatory backing could fix it.
- jnky 4y ago
  I disagree that the "Do-Not-Track header is a perfect solution to this", because it implies that the default (i.e. the header being absent) should allow sites to track you. I (and apparently EU legislators) think opting in to privacy is wrong. You should have privacy by default. If anything, there should be a "Creepily-Track-My-Activity-Over-The-Entire-Internet" header, that, when present, allows tracking. There also used to be another standard called "P3P" that tried to integrate privacy into browser UIs with a more or less standardized interface and that, too, failed. Among other reasons because companies wanting to track people subverted it.
danhor 4y ago
GDPR doesn't require popups, it also allows for programmatic solutions. For some reason (lookin' at you DNT) online advertisement companies, publishers and browser vendors never came together to specify one after GDPR was passed. Some sites like geizhals.de respond to DNT and only use the bare minimum, but that's the exception, not the norm (for some reason hint hint). Usually laws don't prescribe some specific technical implementation unless absolutely necessary because they're often not optimal and go out of date quickly.
chpatrick 4y ago
It's intentionally annoying so that companies that want to track people have to live with inconveniencing their users.
- SquareWheel 4y ago
  Well that's every company. So now every website is annoying.
  - chpatrick 4y ago
    Well, if you don't want your website to be annoying there's a straightforward solution.
    - vntok 4y ago
      Tracking is how many sites measure change on their quest to improve and become less annoying.
      - corney91 4y ago
        Most sites don't need to know who I am to know which parts of their site are most used and/or broken. You can track app usage without tracking personal data.
- layer8 4y ago
  This is incorrect. Companies choose to make it annoying in order to trick people into accepting cookies who otherwise wouldn’t.
pyrale 4y ago
> Imo the law should be structured such that people who care can opt out of cookies programmatically, but every day people who don't care don't need to see a pop up on every site. That causes psychic load and makes us hate the internet. Make it opt-in programatically rather than opt-out and we may agree.
somat 4y ago
This may be a stupid question. but I have not seen it discussed so I will ask it. Cookies are already under the control of the end-user, why does the site operator need to ask/worry at all? if the user does not like the cookies can't they just delete them?
- frenchy 4y ago
  Because 'cookie law' isn't just about cookies. This is an intentional confusion on behave of the advertisers. It's really about using cookies for the specific purpose of tracking. There's alotof uses for cookies and it's not obvious to users what cookies are for what.

shadowgovt 4y ago

Because behavioral psychology tests reveal that the public is both super-paranoid about being spied on and will sell their PII to anyone who asks in exchange for a $5 discount at a store. It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide.

johndhi 4y ago
Well put. We were given Facebook for free on the basis that they can advertise to us. We voted for behavioral advertising with our feet. Yet, we consume documentaries about how evil zuck is and love to hate him. But shouldn't we take both into account or just think about it hard once and then be done with it? We're wasting a lot of time and energy.
- shadowgovt 4y ago
  History suggests that trying to fit a "once and for all" solution atop a populace in disagreement results in disaster.
dybber 4y ago
It shouldn't be by law, it should just be part of web standards that you can set your cookies preferences once and for all and all websites should respect that setting. I guess browser vendors and whoever else sits in these W3 consortiums like their cookies too much.
- johndhi 4y ago
  Agreed, though the issue is that the very same technology can be used for perfectly acceptable and desired use cases (online shopping cart) or distasteful ones (behavioral advertising). So it's hard to set a strict standard.
- rolph 4y ago
  always poison your cookies when your done with them.
- shadowgovt 4y ago
  This was attempted with the "Do Not Track" header, but that initiative collapsed (lack of vendor support, lack of clarity in the spec regarding what it meant to not "track" someone, and ultimately it got yanked from Safari because it was yet another bit that malicious site operators could use for browser fingerprinting purposes). The "Global Privacy Control" header is apparently the second attempt to cook this goose.
  - shkkmo 4y ago
    The fundamental flaw to the DNT was the lack of any sort of penalty for non-compliance. There was no penalty for individual advertisers from either the government or from industry bodies. There was also no penalty to the advertising industry as a whole in the form of more stringent privacy laws.
- cush 4y ago
  Absolutely should have been built into the browser
- Xelbair 4y ago
  If only there was such thing, maybe call it 'do not track', and put it in the header of request. Oh wait - it was a thing, and was used as just another data point for tracking.
nonrandomstring 4y ago
> that the public is both super-paranoid about being spied on and will sell their PII to anyone who asks in exchange for a $5 discount You raise an interesting point about this apparent disconnect. > Because behavioural psychology tests reveal What do you know abot these "psychology tests"? Isn't the reality that both things you assert are really inferences based on anecdotal tales on forums like this one? Do you know of any large-scale cross cultural, long term studies that show who will part with sensitive private data for small compensation? How are these studies controlled for situation, perceived reward, time pressure, trust levels? What do we really know about widespread beliefs regarding the misuse of data? What are people's threat models? How do they assess harm? I'm not disputing the truth of what you say - both ring true. I think we instinctively know all rational people are strongly anti-surveillance. For complex social reasons we humans dislike creeps and snoops and treat them as social outcasts. But we also know that many people will sell their grandmother for a slight convenience or advantage. Do these two facets really clash, and if so why? > It's hard to craft good law when the mismatch between public stated desire and public behaviour is so wide. Is is though? Aren't both positions reconcilable if people make no causal link between the two? What if people just don't have the capacity to make that connection? Could good laws still protect them in the way that laws about asbestos protect people from harms related to chemistry and disease they cannot possibly understand?
- gretch 4y ago
  > Could good laws still protect them in the way that laws about asbestos protect people from harms related to chemistry and disease they cannot possibly understand? They may not understand the chemical mechanisms, but the end effect is super easy to understand: “hey if you breath this in you get cancer”; “hey if you eat this, you die” Compared to the threat of something like cookies… “hey if you let these companies spy on you then…?”
  - nonrandomstring 4y ago
    > hey if you let these companies spy on you then.... Then you'll suffer multiple digital, and eventually physical harms; - You'll lose money on bandwidth that's robbed from you - you'll lose access to goods and services on the basis of calculated prejudice - you risk identity theft, impersonation, having loans taken out in your name... - you'll be exposed to manipulation, targeted disinformation - you'll experience increased targeted attacks like phishing - friends, relatives, spouse and others close to you will also be targeted - your time will be wasted dealing with more spam and nuisance - you will lose CPU, memory and battery life as the concrete resources of your devices are given over to the advertising burden - you will eventually suffer tangible harms, loss of employment, impacted credit score, loss of medical access... Sure, it needs more words to explain. Not quite so punchy and succinct as the real deal. But digital cancer caused by these companies' products can well be explained to the average "consumer" if they just stuck an ugly picture on the carton of a destitute homeless guy and the message "Surveillance capitalism can ruin your life".
hackernewds 4y ago
Additionally there's also a mismatch between what is good for the public versus what the public will end up choosing (due to ignorance or carelessness). This is illustrated in your first example. Good laws will protect the public from themselves, even at the cost of supposed freedoms (think schedule A drugs, production, revenge porn, tobacco).
- shadowgovt 4y ago
  Should I think alcohol and marijuana also?
chickenimprint 4y ago
My carrier literally bugs me about giving away more and more personal info for 5 bucks every 2 months. They must have heard of the same research. They also ask for consent to receive "advice" and term it "our gift to you". I wonder how many people must fall for it.
Matumio 4y ago
> It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide. Some people would also sell their right to vote for $5 if that was legal. It's not hard to make such a law. You simply could make it illegal e.g. to offer money for PII during a purchase that doesn't strictly require it. Or to not respect the automatically transmitted cookie choice. Those who oppose such laws are the lobbyists of the big companies, not "the people".
- shadowgovt 4y ago
  The last time a state tried to outlaw "selling your right to vote," the consequence is they banned people providing food and water to folks standing in too-long lines at the polls. This was not good law. Badly-thought-out law has unintended consequences (or even maliciously-crafted intentional consequences at the cost to the public). https://thehill.com/homenews/nexstar_media_wire/3709676-is-it-illegal-to-hand-out-water-or-food-outside-your-polling-place/ https://thehill.com/homenews/nexstar_media_wire/3709676-is-i...

jokoon 4y ago

If an user is not logged in, there should be zero cookie, there is no need to differentiate cookies.

johndhi 4y ago
What if you want to support shopping carts or chat bots for anonymous users? Or what about ddos prevention? Isn't a cookie (or local or session storage) needed in those cases?
- anankaie 4y ago
  DDoS prevention does not need cookies, though they can certainly be useful to attempt to track honest users. Dishonest ones will prevent cookies from being set in the first place, or, if you only use cookies to mark 'good' sessions, will learn to spoof your cookie. Never rely on your security adversary not doing something to break your security for its efficacy. It is the same thing with KM AntiCheat (which is best handled by the OS, and even then virtualization breaks it) - unlike an antivirus the target user is adversarial to the application. For shopping carts, you can have a season token as a query parameter, like jsessionid used to be for ages. Does not help across browser sessions, but a session cookie would not help there either, much. Not sure why the chat bot would need the cookie. To track across sessions? If so, I would posit that this is no longer anonymous access. The identity of the user is defined as the cookie you use to track her. Edit: Typos. Typos everywhere!
  - johndhi 4y ago
    I'm not quite as technical as you but what do you think of Cloudflare's explanations for why they use cookies for security and load balancing purposes here? https://developers.cloudflare.com/fundamentals/get-started/reference/cloudflare-cookies/ https://developers.cloudflare.com/fundamentals/get-started/r... The law says cookies that aren't "necessary" are illegal without explicit consent. Perhaps there's room for "necessary" to include cookies that are helpful technically even if not absolutely the only way things could be done.

TechBro8615 4y ago

The Do-Not-Track header is a perfect solution to this, but unfortunately the largest browser vendor is also the largest advertising network, so the implementation of DNT devolved into a farce.

johndhi 4y ago
Yeah.
astrange 4y ago
DNT, like all other configurable browser features (including script blockers), can be used to fingerprint you too.
- loeg 4y ago
  The ePD/GDPR are not about technical barriers for bad actors, but about compliance for good actors. Technical mechanisms like DNT would be a reasonable way to get rid of cookie banners while complying with ePD/GDPR.
lern_too_spel 4y ago
It has nothing to do with the browser vendor being in the ads industry. It's up to the website operator to respect it. If a website operator doesn't like a browser vendor's DNT defaults, it won't respect it, and that is why DNT failed. Regulatory backing could fix it.
jnky 4y ago
I disagree that the "Do-Not-Track header is a perfect solution to this", because it implies that the default (i.e. the header being absent) should allow sites to track you. I (and apparently EU legislators) think opting in to privacy is wrong. You should have privacy by default. If anything, there should be a "Creepily-Track-My-Activity-Over-The-Entire-Internet" header, that, when present, allows tracking. There also used to be another standard called "P3P" that tried to integrate privacy into browser UIs with a more or less standardized interface and that, too, failed. Among other reasons because companies wanting to track people subverted it.

danhor 4y ago

GDPR doesn't require popups, it also allows for programmatic solutions. For some reason (lookin' at you DNT) online advertisement companies, publishers and browser vendors never came together to specify one after GDPR was passed. Some sites like geizhals.de respond to DNT and only use the bare minimum, but that's the exception, not the norm (for some reason hint hint). Usually laws don't prescribe some specific technical implementation unless absolutely necessary because they're often not optimal and go out of date quickly.

chpatrick 4y ago

It's intentionally annoying so that companies that want to track people have to live with inconveniencing their users.

SquareWheel 4y ago
Well that's every company. So now every website is annoying.
- chpatrick 4y ago
  Well, if you don't want your website to be annoying there's a straightforward solution.
  - vntok 4y ago
    Tracking is how many sites measure change on their quest to improve and become less annoying.
    - corney91 4y ago
      Most sites don't need to know who I am to know which parts of their site are most used and/or broken. You can track app usage without tracking personal data.
layer8 4y ago
This is incorrect. Companies choose to make it annoying in order to trick people into accepting cookies who otherwise wouldn’t.

pyrale 4y ago

> Imo the law should be structured such that people who care can opt out of cookies programmatically, but every day people who don't care don't need to see a pop up on every site. That causes psychic load and makes us hate the internet. Make it opt-in programatically rather than opt-out and we may agree.

somat 4y ago

This may be a stupid question. but I have not seen it discussed so I will ask it. Cookies are already under the control of the end-user, why does the site operator need to ask/worry at all? if the user does not like the cookies can't they just delete them?

frenchy 4y ago
Because 'cookie law' isn't just about cookies. This is an intentional confusion on behave of the advertisers. It's really about using cookies for the specific purpose of tracking. There's alotof uses for cookies and it's not obvious to users what cookies are for what.