11 ms·

Stop whining about “The EU Cookie Policy” and improve your ways

155 points by rapnie 4y ago

senttoschool 4y ago
The vast majority of people DO NOT care about cookies nor do they care about trackers. However, there is a very real productivity loss with all the cookie prompts - both trying to implement them, getting around them, and the billions of people who have to click on them every single day. We've got to come up with a better solution.
- rapnie 4y ago
  The author states this: > To make this very clear: user/visitor consent is only needed for data going to 3rd parties. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions. So your session tracking cookie on your site DOES NOT need a consent popup AT ALL. Most consent dialogs can be avoided, were it not that the surveillance capitalist services need your data, and shove these dialogs full of deceptive design in your face. In hopes to have as many people as possible complain about the regulations, and use that pressure to lobby them away again.
  - 4ad 4y ago
    My bank doesn't use 3rd party cookies, but they have a modal wall you have to click through anyway that explains that they DO NOT use cookies. This is insanity. Their explanation is that users are so accustomed to these cookie walls that a site without one would feel suspicious and unsafe. I very much blame the EU on this, because the EU policy has solved NOTHING, tracking still happens just as before, except now users just have to go through more friction. Of course I am also pissed at the websites and entities that sell my data, but that is irrelevant to my gripe with the EU.
    - illiarian 4y ago
      Businesses: want to track users and collect their data with reckless abandon Businesses: implement rampant dark patterns to trick people into accepting tracking and data collection Businesses: flood the internet with inane, obnoxious and blatantly illegal cookie dialogs ... 4ad: I blame the EU (Hint: show me where GDPR says anything about cookies)
      - qtzfz 4y ago
        Most internet businesses need tracking to survive, so it's more like either you click past a cookie banner or you don't get to see the content at all.
        illiarian 4y ago
        > Most internet businesses need tracking to survive Of course they don't.
        Nextgrid 4y ago
        > Most internet businesses need tracking to survive Most criminal gangs need to steal/rob/etc to survive too.
      - 4ad 4y ago
        I blame the businesses for destroying the social fabric of the internet, and I simultaneously blame the EU for implementing pointless regulations that do not solve the first problem while making life miserable for its subjects.
        illiarian 4y ago
        Businesses: destroy the social fabric of the internet Regulation, literally: do not collect people's data without their consent if you don't require that data for services you provide. Applies in equal measure to websites, banks, grocery stores, shit processing plants and nuclear power stations. ... 4ad: I still blame the EU, and it's a pointless regulation. Edit: This comment really says it much better: https://news.ycombinator.com/item?id=35567507 https://news.ycombinator.com/item?id=35567507
  - Hermel 4y ago
    So why do even the official website of the European commission and the European parliament have a cookie consent button? One would assume that they are not "capitalist services".
    - rapnie 4y ago
      Unfortunately big tech surveillance capitalists (which is different than "capitalist services", mind you) are court suppliers of IT services that EU institutions depend upon. Edit: And as the sibling said, in many cases it may be restricted to analytics and simple 'reject' suffices, which is at least better than some of the intricate dialog designs.
    - illiarian 4y ago
      I mean, you could literally read what their banner says. E.g. Eu Paarliament "We use analytics cookies to offer you a better browsing experience. You have the choice to refuse or accept them. Reject. Accept". Those analytic cookies are not required for the functioning of the website, and those web sites are required to ask for your consent to gather any additional data.
  - luckylion 4y ago
    Is he right though? I work with affiliate people a lot, and they hate cookie-consent popups. Even when you do all your analytics inhouse with self-hosted matomo, if you want to use a cookie, you need consent is what the lawyers say unanimously. And these aren't "we want you to ask for consent because we secretly want more privacy" lawyers, these are "I get paid to find a way for you to do your tracking in the easiest way possible and I don't care about privacy" lawyers. Maybe they're all wrong, but I have doubts.
    - gbalduzzi 4y ago
      > Even when you do all your analytics inhouse with self-hosted matomo, if you want to use a cookie, you need consent is what the lawyers say unanimously If you use a cookie for Matomo tracking than yes, you need consent. You are using a cookie for a non essential service (analytics), so you need to ask consent. But you can use Matomo as cookieless: https://matomo.org/cookie-consent-banners/ https://matomo.org/cookie-consent-banners/ If matomo gathers data without a cookie, you can still use technical / essential cookies without consent. As an example Github.com, owned by Microsoft, does not have a cookie consent popup and sets at least 5 cookies as soon as you open it: - color mode (dark / light) - user timezone - whether the user is logged or guest - a session cookie - _octo, that I don't understand.
      - luckylion 4y ago
        But that primarily says that Github doesn't care about cookies (or consent), not that you (not being a multinational corporations with an army of lawyers and millions in lobbying spending) can do the same. I'm pretty sure those cookies are non-compliant if you look at them closely, because none of them are necessary for the operation of the service. a) a default value doesn't need to be stored in a cookie -- and it has to be a default value, because you haven't selected a color scheme or a timezone b) login-state does not require a cookie: either you're logged in and have a session, or you aren't, and you don't, c) there's no reason for a session on the public facing side that doesn't contain any private/individualized data, unless you want to use these session cookies to track users -- and it's only about users as bots will typically ignore cookies. My money is on "Microsoft knows that cookie consent is optional if you're not a small European company".
  - nicbou 4y ago
    That's completely false though. Tracking your users without consent is still not allowed, even if you store the data on your own servers.
- shmde 4y ago
  Also accepting them cookies is one single click but rejecting them feels like entering the dark realm with multiple options and not knowing where to click. I am software dev but still have to use just enough mental resources to reject all of the non essential ones. How the fuck is this legal.
  - germanier 4y ago
    It's not legal. It's just not rigorously enforced. It was promised that things get better with the proposed ePrivacy regulation. Let's see.
  - Anduia 4y ago
    It is not legal for webs to make rejecting cookies more complicated than accepting them. In fact, the French data protection authority CNIL has issued orders to around sixty players that do not make refusing cookies as easily as accepting them. They have also fined companies such as Google and Facebook for making it harder to reject cookies than to accept them. The CNIL has ordered these companies to provide a means of refusing cookies as simple as the existing means of accepting them. Also, under GDPR, it is not legal for websites to make rejecting cookies more complicated than accepting them. In May 2020, the EU updated its GDPR guidance to clarify that cookie walls do not offer users a genuine choice because if you reject cookies you’re blocked from accessing content. It confirms that cookie walls should not be used. Companies such as Google have introduced new options to reject tracking cookies in Europe after their existing dialog boxes were found to be in violation of EU data laws. Now what I don't know is if users outside of EU get the evil-twin version of those popups when visiting websites. My experience browsing the www is just not as bad as many people describe because I usually get a "reject all" button or when "managing" the cookies, they are all disabled by default and I can simply save the options.
- submeta 4y ago
  > vast majority of people DO NOT care about cookies nor do they care about trackers I highly doubt that. Do give people simpler ways to opt-out of all tracking, and they‘d happily chose that. Currently we have two problems: 1) The consent button is one click for cookies, the other is several clicks away. 2) The layman does not now how to choose a setting to always opt-out of tracking.
- dre_bot 4y ago
  Most don't even know what the hell a cookie is or any of the shit in those prompts.
  - pelorat 4y ago
    I mean Gen-Z barely knows what an operating system is.
- illiarian 4y ago
  >The vast majority of people DO NOT care about cookies nor do they care about trackers. When presented with "Ask app to not track" on iOS, 96% users clicked "do not track" https://arstechnica.com/gadgets/2021/05/96-of-us-users-opt-out-of-app-tracking-in-ios-14-5-analytics-find/ https://arstechnica.com/gadgets/2021/05/96-of-us-users-opt-o...
  - boffinism 4y ago
    These two statements are not incompatible.
  - shmde 4y ago
    Having a clear cut "CALL TO ACTION" dialogue option which presents one positive ( don't track me ) and one negative ( track me ) option. People choose the positive one. Cookies/tracking banners on website completely obfuscates the choice. Negative option ( track me ) is presented as the pearly gates to heaven and easy to click. Positive option ( don't track me ) is presented as these mathematical puzzle where you must know what to click or your dog gets executed. So yeah people care about not being tracked when presented with clear instructions to which one is bad and which one is good.
    - illiarian 4y ago
      > Having a clear cut "CALL TO ACTION" dialogue option which presents one positive ( don't track me ) and one negative ( track me ) option. That is literally the requirement by GDPR > Cookies/tracking banners on website completely obfuscates the choice. On purpose. In violation of GDPR.
  - ssss11 4y ago
    That “most users don’t care” line is tossed around by people all over the place and you righty point out that it isn’t true. If my job relied on people giving up their data privacy I would probably continue telling everyone that line as well.
- no_time 4y ago
  >We've got to come up with a better solution. I've got an easy one for you: stop embedding google analytics and others. You don't need a cookie banner when you only have operational ones or better yet, none at all.
  - oneeyedpigeon 4y ago
    Are you sure that out-of-the-box GA requires it? I thought the only info it recorded was anonymised.
    - matsemann 4y ago
      Even with consent and configuration, GA might be illegal in the EU. It's currently in a grey area after some latest rulings.
    - illiarian 4y ago
      GA collects insane amounts of data. And you might have to disable a lot of that collection manually https://support.google.com/analytics/answer/9019185?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/9019185?hl=en#zi... And even then it might not be strictly compliant due to Schrems II ruling
    - boffinism 4y ago
      Don't confuse cookie laws with data laws
    - progval 4y ago
      According to the French data protection authority, "out-of-the-box" GA requires consent because they aren't anonymised: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h...
      - oneeyedpigeon 4y ago
        Well, I'm glad I don't use GA on my personal site, then, even if it means I have no idea what traffic levels it gets. GA is incredibly popular though - I would guess the vast majority of blogs etc. use it and have no consent to do so.
- mabedan 4y ago
  You’re missing the point of the article. The banner is only needed if your business relies on handing over info about the user to 3rd party. And yes, it’s reasonable to make sure user knows about it. The fact that these pop ups are annoying is the fault of the creator, not the regulation. Try accessing Apple.com or iCloud.com. No cookie pop up, yet one of the most successful businesses in history. You don’t have to be annoying
  - qtzfz 4y ago
    What info? My IP address and the pages I've visited inside their site? By visiting a site I know I'm giving that info to them, they can do whatever they want with it.
    - jeltz 4y ago
      Not without breaking the law.
      - qtzfz 4y ago
        Which is why it's a stupid law that has made everybody's lives worse, both the businesses and the users.
        hammyhavoc 4y ago
        Why is it a stupid law? Why should businesses be free to look up the IP and figure out who is looking at their page? An IP can reveal a lot of information, especially if there's servers hanging off of it.
    - illiarian 4y ago
      > What info? Any personally identifiable information. GDPR is not a complex law no matter how shady businesses and clueless devs are trying to tell you. It's also been in effect for 7 years. You'd think it's enough time to have at least some clue on what it's about. And yet we still have these inane threads on HN claiming it's about cookie popups, and people having no idea what info trackers collect.
- wongarsu 4y ago
  At least part of the intent of the law was that websites would reduce the amount of tracking if they have to explicitly ask for consent. You can build your website with just functional cookies (session cookie, storing preferences like dark mode, etc) and cookie-less tracking, and go without any cookie popups. Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the most in-your-face popup possible to cause users to reflexively hit consent instead.
  - Nextgrid 4y ago
    > Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the most in-your-face popup possible to cause users to reflexively hit consent instead. GDPR actually has provisions against this kind of malicious compliance - the problem is a chronic lack of enforcement, despite it being trivial to detect with a web crawler.
- datkirby 4y ago
  People are definitely aware of them. The trouble lies with how easy opting-out is. Many websites have included options to just opt for the "compulsory" option. The only concern now is how many of them would willingly provide that option.
- ssss11 4y ago
  Of course the simple solution that we all know is to not collect the damn data in the first place. But marketing boffins the world over will never willingly do this unless it’s enforced by law, so we’re left with the user’s taking on the burden of clicking deliberately confusing stuff and not knowing whether they’ve ended up consenting or not.
- maeln 4y ago
  Most people do not care because they don't really see/understand how it affect them. Just like most people probably don't care about HVAC regulation, welding regulation for system under pressure and other very technical field. They will see the issue and care about it when something happen. We have a lot of regulation about welding under high pressure because we know from experience what happen when we have no rules (things go boom). What happen when we have no regulation about tracker ? We get massive data leaks from poorly secured data hoarding company (hello Equifax). This is dangerous in many many ways: Identity theft, scam & spam, identifying people with certain political view, from a minority of some sort, etc... GDPR does not solve all this issue, some company can still hoard massive amount of data about you (it is always scary to ask for a data extraction from Meta, Twitter, ... and how you have a "profile") and have bad security, but it does limit in how many hand this data circulate and how easy it is to gain access to.
ge96 4y ago
Soon as I see the cookie prompt I either abandon the site or read past it. Maybe I write a thing that specifically removes it by an extension.
- clnq 4y ago
  There are already lists for ad blockers that remove those cookie notices.
  - ge96 4y ago
    I don't know how people can use the internet without an adblocker.
    - irusensei 4y ago
      I'm not a fan of attaching third party things that work by reading the contents of what I'm browsing. I'd rather run a DNS based blocker but unfortunately those can't prevent cookie modal monsters.
      - npteljes 4y ago
        I see the point in that, but wrt browsing, what counts as a third party? There's a million of points where the browsing data leaks already, running the most trusted adblocker extension doesn't really change that. ISPs track and sell DNS and other metadata, VPNs do god knows what, each website is a third party basically, every website with a Facebook Like button reports your visit to Facebook, most websites are using a large CDN like Cloudflare, some browsers use their own CDN / service to do things like compress images, ... In the sea of all these things happening, the user is much better served with uBo than going in without it. It gives the mind some peace not seeing all the advertisements, for one.
    - sgt 4y ago
      I tried adblock but I turned it off as it was blocking things that weren't supposed to be blocked. Very rarely though. I don't know, it's like I almost don't see the ads, my eyes just scroll past it.
olivierduval 4y ago
Actually it's a bit more complex (but not much) than what is described: 1st party may need user consent when they will use personal datas for something that is not the intended service (legitimate use). For example, for a shopping cart: cookies are necessary for the service, so no problem. For fraud detection : no problem because it's a legitimate use. But if you start tracking with a user cookie what pages your users are viewing (statistics collection), then... you need the user consent ! Because it's not necessary for the service... (even if it might be in your interest) EDIT: if your statistics are not bound to personal informations (so you dont need statistics for INDIVIDUAL users but only the your users AS A WHOLE) then... no problem for RGPD and no need for consent. Actually, that's what a lot of RGPD-compatible statistics do (like Matomo and others...)
- oneeyedpigeon 4y ago
  I think the vast majority of sites that use cookie popups DO need to do so because they use targeted advertising. It's only a tiny number that have been 'too aggressive', although I'm personally aware of such an example.
- olivierduval 4y ago
  As a side note: cookie management is just A PART of RGPD, that is based on personal information. So RGPD implies to inform the user about the ways their information is used, how it can be accessed, modified, deleted and so...
  - Circuitstorm513 4y ago
    It's GDPR as in General Data Protection Regulation.
    - teekert 4y ago
      I guess OP is French, they use different word orders for almost anything, ie: DNA: AND.
      - 4y ago
mschuetz 4y ago
The problem is that GDPR doesn't go far enough. It should completely prohibit third party tracking without the possibility to agree to it. Third party cookies/tracking simply should not exist.
- goodluckchuck 4y ago
  The problem is they picked the wrong parties to be responsible. It’s not the websites that are doing the tracking. The websites are merely asking to save a cookie. It is the users’ own web browser that is storing the cookie and sending the cookie back to these websites. It’s the browsers that should be regulated if anybody but it’s a lot easier to regulate the little guy than to regulate Google and apple.
  - martin_a 4y ago
    Who integrated the tracking scripts and tools that want to set a cookie? The "little guy" or the browser?
- Nextgrid 4y ago
  The GDPR goes far enough and even prohibits dark patterns and annoying the user into accepting. Making the "decline" option harder to find is not compliant for example. The problem is a chronic lack of enforcement that allowed websites (and entire companies such as TrustArc/etc) to implement these malicious pseudo-compliant solutions and get away with it, at the expense of everyone's privacy and sanity.
- ActorNightly 4y ago
  Id be willing to bet that there is a large overlap of people who dislike tech company layoffs and people who have this sentiment about 3d party tracking.
irusensei 4y ago
I live in the EU but have a VPN setup for a non-EU country so that I see less cookie modals and overall have a better experience.
- Lurkars 4y ago
  Does that mean you autoaccept everything and automatically handing your data to 3rd parties?
  - irusensei 4y ago
    What data?
fsh 4y ago
GitHub got rid of their banners in 2020: https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background.
- Nextgrid 4y ago
  > I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background. And an entire industry with companies like TrustArc built on pitching and selling this crap even if not required and/or if their solution wouldn't achieve compliance anyway.
  - marssaxman 4y ago
    This is very convenient, because I can add this one line to my ublock origin config and thereby eliminate many cookie banners: ###onetrust-consent-sdk
- baby 4y ago
  That’s what happens when you add regulations to an industry of small players who can’t afford to spend time or money in understanding these things
  - Nextgrid 4y ago
    The regulation is much easier to understand and comply with than many other laws you already need to comply with (taxation, etc) and nobody seems to complain about. The problem isn't the complexity of the regulation, it's that entire businesses and careers have been built on the fact that spyware became decriminalized in the last decade and they are fighting back with misinformation to try and preserve this status-quo.
  - npteljes 4y ago
    I think it boils down to how service providers can manage the inconvenience. Since sites can pass the blame to the EU for the cookie things, and they can create a nice shiny button that makes the inconvenience go away in an instant, cookie modals are a good solution. They can perform that they are giving the users options for privacy, and also absolve themselves from the burden of the EU regulation, with one simple click on the Allow all button. I also think that it users don't mind the inconvenience too much. Complain, yes, but they are not really choosing a website that doesn't have the popup, over a website that does have. And so, businesses have no real incentive to change their ways.
veltas 4y ago
>Tech bros love to whine about "The EU cookie policy" that simply doesn't exist the way they imagine it. All these popups are the most radical way to interpret the explicit consent demanded by regulations when sending data to a 3rd party. An ongoing provocation by the ad/tracker industry to blame their ruthless data hoarding on the EU. The official EU website has one of these annoying pop-ups. Are they part of the provocation? https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en
- gizmo 4y ago
  If you click on the cookies explainer you'll see that they actually use a shitton of cookies: https://european-union.europa.eu/cookies_en https://european-union.europa.eu/cookies_en Instead of that cookie banner they could just not have visitors connect to all those 3rd party services that use cookies to track users!
- ginko 4y ago
  That one's the pretty much the optimal implementation though. * it's a small bar on the bottom * the site works without clicking on the consent buttons * it has clear "opt-in" or "opt-out" options * no annoying "customize my permissions" sub-menu with tons of enabled switches and dark patterns
  - Machado117 4y ago
    * No loading screen when you don’t accept all cookies
  - dkersten 4y ago
    It’s also fast. I clicked the don’t allow button and it responded instantaneously. Many cookie banners are (probably purposely, at least when should don’t allow) slow as hell.
  - nonethewiser 4y ago
    > That one's the pretty much the optimal implementation though. Takes up 40% of my screen on mobile
febeling 4y ago
This should have been solved technically, not politically. Why not set cookie rules in the browser settings, and handle at http standard level?
- jeltz 4y ago
  Because Google owns the largest browser. The problem could only be solved politically.
  - goodluckchuck 4y ago
    No, that proves the problem could not be solved politically, because regulators lacked the political power needed to regulate google
    - regularjack 4y ago
      If they would try to regulate google, that would be a political measure. How would they "regulate google" in a technical way?
    - jeltz 4y ago
      But GDPR was their way of regulating Google. It is not perfect but it was a huge step in the right direction.
      - goodluckchuck 4y ago
        I thought GDPR regulated the cookies that websites are allowed to request to store on users devices. Does it also cover tracking built into browsers by Google, Microsoft, etc.?
- Nextgrid 4y ago
  GDPR and those data processing consent flows are about data collection and processing in general and not a specific technical means of doing so - it would also apply to IP addresses, browser fingerprinting, information manually entered (such as delivery address when placing an e-commerce order) or a hypothetical crystal ball that actually worked.
Guid_NewGuid 4y ago
No one likes these consent modals, not the EU, not the companies, not the end users. But they're good. They're making the negative externality visible. We had developed an ecosystem where as soon as you clicked on a webpage it would spaff your personal data to third party brokers and infest you with tracking across the entire internet. All driven by marketing and sales departments. All driven by a capitalist free market. The regulations changed nothing other than to make people annoyed by this. Good. Take that anger and direct it against the god damn companies building this stuff, many of the employees of which are on this site. Stop whining about the EU, they're just holding up a mirror to the abject horror of tech.
- flangola7 4y ago
  Couldn't have said it better myself.
- lofaszvanitt 4y ago
  No, they are not good in any way. Imagine you have to press buttons whenever you start your car and have to give promises you are not going to go above the speed limit... It's just plain NONSENSE. This consent madness should be implemented in the browser. You set it once, and then you just forget about it. Poof, problem gone. If
  - Kalium 4y ago
    I cannot imagine that the legal systems in question would consider setting a consent setting in your browser, once, to be explicit positive and informed opt-in.
  - berkes 4y ago
    It was in the browser (still is?) called DNT, and it didn't work because the industry ignored, circumvented and even actively opposed it. Your idea has been tried and was found to not work.
    - lofaszvanitt 4y ago
      Nah, it should be like notifications. You can set a global block on those. Same should apply to these cookie consent things. You set what you want to keep and enjoy a popup free web.
teekert 4y ago
I use Matomo on Wordpress. Turned of cookie based tracking. It means sometimes a revisting visitor can not be discriminated from a new one. I don't care. But, now he is saying, I can enable the cookie if I want, without needing the consent banner? And what about a privacy page? Indeed it does make whipping up a blog or so more complex. Although I usually use Hugo of WP, keep them vanilla: Now cookies required for just viewing content. Some kind of tool would be handy.
- Hamuko 4y ago
  >But, now he is saying, I can enable the cookie if I want, without needing the consent banner? No? It's clearly not an essential cookie considering your site is currently working without it.
ActorNightly 4y ago
>So stop blaming "the EU" and ask yourself if this is the internet we want. ...Yes, thats exactly the internet "we" want. I don't get why it so hard to accept that people simply dgaf about privacy, and much prefer free products online paid for by ads. And there is nothing wrong with that, because for those that actually care about privacy, there are plenty of tools.
- germanier 4y ago
  It's hard to accept because many, many people won't agree with you and do give a fuck.
  - ActorNightly 4y ago
    To anyone that doesn't agree with me, please show me your rooted android phone that has no popular apps installed that collect any data, and doesn't use a sim card. Because if you say you give a fuck about privacy, and use a modern android phone with OEM rom or an iPhone, you either don't understand what privacy is and shouldn't be talking about it in the first place, or you are a hypocrite.
    - scrollaway 4y ago
      Someone can give a fuck about privacy in the areas they can, while not going overboard or trying too hard, you know. what you are describing is no true Scotsman nonsense. “You dgaf about privacy unless you wear a balaclava all the time”. It’s also possible they understand the trade off with privacy wrt, say, google and their isps/mobile providers, versus the trade off with random websites on the internet.
      - ActorNightly 4y ago
        There is no "areas" here. What you do online is tracked if you use windows, mac os on laptop or phone, or android. Who is tracking that is irrelevant. Claiming that its ok that Apple gets your data, a company who literally allowed the iCloud photo hacks to happen, but not 3d party advertisers is like olympic level mental gymnastics.
iamnotsure 4y ago
Cookies invade privacy, cookie prompts invade both privacy and attention.
- hammyhavoc 4y ago
  Is the purpose of the prompt itself not to invade your attention to make a decision on whether you want them or not? Likewise, how does the prompt invade your privacy if you don't act upon it?
  - iamnotsure 4y ago
    Before the prompts, situation was not good, but I could delete browser history and what not. After the prompts, I still need to delete browser history, but I can't delete memories of prompts from my mind. Every time I see a cookie prompt, I get traumatized. Prompt blockers do not work reliably. I don't want to read about cookies, GDPR, EU, whatever every time I see a random web page. I remember the old internet.
GranularRecipe 4y ago
> "To make this very clear: user/visitor consent is only needed for data going to 3rd parties." I think this statement is categorically false. Art. 6 GDPR (https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/) lists exhausively the reasons for lawful processing of personal data which applies not only to cookies, but also IP addresses etc. The "cookie consent" addresses Art. 6 Point 1(a). Whether third-parties (data processors) are involved is irrelevant, e.g. if I need to transfer personal data to my accountant, it falls under b, c (or d).
- mnw21cam 4y ago
  Agreed. It isn't the third party that is the issue - it is the separate purpose. For example, if I access a web page, I'm giving my IP address to the server, so that it knows how to sent the data I just asked for back. That IP address is personal information, but it is necessary for the server to fulfil the purpose of the task I just asked for. That server also gives the IP address to a third party - the router in between it and me. That's also necessary, because otherwise the packets can't be routed, and it's fine legally. However, if the company running the web page were to take that IP address and store it and use it for deep analytics, matching my request up to other requests from the same IP address, then the personal data has not been handed over to a third party, but it is being used for a purpose which requires consent, and would be illegal unless that consent had been obtained. That data use isn't necessary for the original purpose of the task I asked for, which is to serve me a web page - it is a separate purpose.
  - ThunderSizzle 4y ago
    Wouldn't that depend on perspective? Wouldn't the router e.g. cloudflares purpose be to ensure fast delivery and that it's not an attack. Both require capturing the ip address and analyzing behavior. A faster road where no one wants to go isn't a faster way, so the router needs to capture it so they know where to build their roads.
    - GranularRecipe 4y ago
      Good point. Sounds like the start of a fun conversation between data protection officers (DPO) and data protection agencies (DPA).
jillesvangurp 4y ago
This is correct. Bad UX with modal popups and very ambiguous/deliberately vague verbose language designed to make you click some ok button are a choice not a legal requirement. Being deliberately obnoxious is of course a weird choice if you are trying to actually get people to engage with your website. The more obnoxious the UX, the less you should trust websites to do the right things when it comes to your privacy and rights. If someone puts a "reject all" button in the cookie thing, I click it on principle. Every time. I go out of my way to find it and click it. The harder websites try to hide that button, the harder I try to find it and click it. It's usually there. But you have to wade through a lot of bullshit and deal with some offensively stupid UX to get to that button. I'm not going to mico-manage all the various ways you want to sell my data / abuse me. Does anyone actually do that? The engagement on UI like that must be absolutely terrible. What does that say about your brand if you are trying to be deliberately misleading, manipulative, and offensive like that? It's not a good look. Advertising your web design incompetence and malice/corporate stupidity like that is a choice. A bad and odd choice. But it's a choice. The more visually offensive the cookie experience, the less likely I am to provide consent and the more annoyed I get. It's that simple. Maybe I'm weird. Or maybe lots of people are exactly like me and don't provide consent either. So why even bother with this level of abuse? I also have an ad blocker (I don't even remember the web before ad blockers), I use firefox containers, and firefox cleans up cookies and blocks trackers really aggressively. So, not only is this stupid. It's also futile.
- Nextgrid 4y ago
  Dark patterns aren't actually a valid approach of complying with the regulation - if you do that, you may as well just track and collect data without consent, because any consent obtained by misleading or annoying the user does not count as valid anyway. Here's what the UK legislation has to say (which is still identical to the EU GDPR as far as I know, though subject to change post-Brexit): https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Explicit consent requires a very clear and specific statement of consent. > Keep your consent requests separate from other terms and conditions. > Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. > Be clear and concise. > Make it easy for people to withdraw consent and tell them how. > Avoid making consent to processing a precondition of a service.
openplatypus 4y ago
Cookie Banner is just a term for consent for data processing. It is not exclusive to 3rd party cookie or tracker. If you have no legitimate interest in doing something with the data, you must ask the user first.
hammyhavoc 4y ago
Both CloudFlare and Jetpack on WordPress insert a tracking cookie as a part of using their service, right? (I may be wrong, things may have changed) For a lot of folks, that's what they have to use, otherwise delivering the page resource-wise isn't viable. Ergo, they need those banner popups to be in compliance, right?
- remus 4y ago
  It depends on what the cookies are being used for. If they're "essential for site functionality" (e.g. fraud prevention) then consent is not necessary.
  - hammyhavoc 4y ago
    Well, here's the thing though, it could be argued that they are essential for site functionality (if you conflate functionality with availability for example), however, you are revealing the IP of the user to those third-party services, which is no bueno. Loading Google Fonts via Google's CDN is non-compliant, ergo why would Jetpack be any different? https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... However, CloudFlare is an odd one. They're also the reverse proxy and DNS for the site, ergo they can collect that IP if they intend to, which they apparently don't. Where is the line drawn? If an asset loaded via a third-party CDN is "leaking the IP", surely CloudFlare also is? Surely any kind of DNS is? I'm asking big questions, I know, but have always been curious, and have been waiting for a good opportunity to put them in front of others.
    - orwin 4y ago
      What we did was basically ignore GDPR and send a mail to our watchdog about the points we weren't sure would pass as legitimate use. Basically: if you in good faith think it's legitimate, it's probably legitimate. The watchdog will propose you ways to remove PII from your data if he think you're misguided, and they drafted us an architecture that worked for data protection (like half a day of work for an architect, i think they already have these kind of drafts as our issue was quite common). We spent 20 minutes to write the email and basically earned 500$ (or whatever is the cost of half a day of an architect is). We also had prior contact with the watchdogs for unrelated reasons (trying to get certified to handle sensitive data).
3dfan 4y ago
The problem with the GDPR is that it is a monster of a legalese text: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... Which nobody understands. Which, depending on how you read it, might make participating on the internet practically impossible. An IP is considered personal data, so in theory you cannot use foreign infrastructure like a CDN. Which certainly makes the internet as we know it impossoble. An internet where everybody builds tools on their site that everybody else can embed on their site. Because that would mean IPs flowing around between sites. Which gives a huge disadvantage to Euroeans. Because Europreans have to show cookie banners and stuff to everybody around the world. While the rest of the world has to only show them to Europeans. Look at your favorite website through a proxy inside/outside the EU. It starts with an annoying popup only in the EU. Which cements the stronghold of Google and Co, who 1) only have to bug their European users and 2) have the legal resources to cope with this insanity. Startups and indiemakers don't. So there will be even less of them in the EU. And the ones who exist will have to waste their time on this instead of building their products.
- Tarq0n 4y ago
  This is way off base. Using PI to fulfill a request someone has made of you is the happy path of GDPR, you just can't retain or reuse that information more than you have 1) a contract or 2) permission or 3) a lawful task For. Having other parties process PI for you is fine as long as it's done under an agreement that binds them to the same terms.
  - 3dfan 4y ago
    First, no, you cannot reduce a thousands of words long legal document to a few words like you did and say "Easy, this is how it works". Those thousands of words are there for a reason. Second, good luck, figuring out what you have "a contract, permission or a lawful task" for under the specific circumstances of your site. Third, good luck, making and understanding an "agreement that binds them" with every provider of every piece of infrastrcuture you use. Good luck doing that for even a single piece of infrastructure.
- 4y ago
ivanhoe 4y ago
Ideally browsers would have an API to handle GDPR requests natively, the way they do for hardware access, and users would be able to set the default level of access, as well as lists of exceptions for some domains. Of course, Google will never provide such API in Chrome as it would be bad for their core business of spying on people in order to sell them more stuff.
- CactusBlue 4y ago
  It exists, and it's called the DNT header. It was deprecated because ironically, it was used for user fingerprinting.
  - soneil 4y ago
    It was also widely ignored. Not much has changed since browsers had to remove the capability to create popup windows (and pop-unders, which only existed because users were getting too proficient at the game of whackamole). At every single step, the industry has shown it will only behave anywhere near reasonably when externally forced to do so. DNT should have solved this problem, but the leopard couldn't change its spots, and used it to further its attacks on users instead. And this is why we have over-reaching regulation. Not because we want it, but because we earned it.
  - Sephr 4y ago
    DNT isn't deprecated in Firefox or Chrome.
hardware2win 4y ago
Also many web masters dont realize that consent is not needed for technical cookies like auth.
jwildeboer 4y ago
Toot/thread author here. I have added more clarifications and explanations, based on the feedback in the comments here. Thank you for that! It was an angry rant written down in a very short burst of productivity ;) I had to simplify a lot if things to get the main point across — that these pop-up banners are NOT what GDPR demands, that they deliberately are designed to exaggerate and intrude on users.
deleted 4y ago
[deleted]
theoriginaldave 4y ago
[flagged]
PaulKeeble 4y ago
Arguably most of these cookie popups are not compliant with GDPR law anyway as all cookie acceptance has to default to opt out, its only if the user wants to opt in that the data can be collected. Almost all of the popups default the wrong way and use dark patterns including making you wait minutes to avoid the popups. This is all by design, they will happily show you that popup everytime you come to the site and you'll never see it again if you accept them. When you see such a pop up you know what sort of entity you are dealing with, one that is willing to fight with the EU and the law to get that data as well as enormously hurting its customers in preference.
exabrial 4y ago
The only scoring thing about the EUs cookie policy was fucking noticed on every site for functional cookies. And let’s be real, the other cookie content popups are probably theater.
qikInNdOutReply 4y ago
It needs a API, to talk with a user preference tresor and auto-negotiate site access. If a agreement can not be reached, the site remains privacy paywalled, else its just there and the site owner has consent.
Havoc 4y ago
How much simple analytics are considered reasonable? Simple example counting users and say what country they’re from. Technically not required to make the site work but might count as legitimate use?
SergeAx 4y ago
I want to stop whining about cookies popups. Any actionable items, besides browser extension to eliminate them for good?
zkid18 4y ago
> A 1st party cookie for tracking a session that stays on the site doesn't need consent/popups. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions I'd love to hear some legal or DPA opinion on this. From what I know, per the ePrivacy Directive in the version from 2009, any access or storage to information on the end user's device needs consent unless that access/storage is strictly necessary for a service explicitly requested by the user. This is known as the “cookie law”, but is not technology-specific and will also apply to equivalent client-side approaches such as LocalStorage, tracking IDs in URLs, or fingerprinting. The consent requirement is also independent of the question of whether the stored information qualifies as personal data. The GDPR didn't change anything with these rules. It only changed the definition of consent, invalidating “implied consent” approaches like “by continuing to use this site, you consent to …”. Consent means opt-in. Consent must be easy to decline and withdraw, and users must understand what precisely they are consenting to. This has led to a decrease in the percentage of people who consent to the storage of analytics IDs. So the question is whether we can be considered as a strictly necessary for a service
more_corn 4y ago
Except from the usability and privacy perspective the EU cookie rule is objectively bullshit. Don’t require notification for every fucking site I visit. Also there are no circumstances where “functional cookies are required”. Painting a webpage doesn’t require a cookie. If you really cared about customer privacy you’d make a rule that allowed me to set my privacy setting in my browser and require the sites to respect it. And one of the options better be “none ever, just do what you can without it” What moron thought the current rules were sane? What a useless waste of air to defend an obviously broken and constantly annoying and useless rule. In conclusion a four year old could have come up with a better rule. So stop whining about people’s legitimate objections.

155 points by rapnie 4y ago

The vast majority of people DO NOT care about cookies nor do they care about trackers. However, there is a very real productivity loss with all the cookie prompts - both trying to implement them, getting around them, and the billions of people who have to click on them every single day. We've got to come up with a better solution.

rapnie 4y ago
The author states this: > To make this very clear: user/visitor consent is only needed for data going to 3rd parties. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions. So your session tracking cookie on your site DOES NOT need a consent popup AT ALL. Most consent dialogs can be avoided, were it not that the surveillance capitalist services need your data, and shove these dialogs full of deceptive design in your face. In hopes to have as many people as possible complain about the regulations, and use that pressure to lobby them away again.
- 4ad 4y ago
  My bank doesn't use 3rd party cookies, but they have a modal wall you have to click through anyway that explains that they DO NOT use cookies. This is insanity. Their explanation is that users are so accustomed to these cookie walls that a site without one would feel suspicious and unsafe. I very much blame the EU on this, because the EU policy has solved NOTHING, tracking still happens just as before, except now users just have to go through more friction. Of course I am also pissed at the websites and entities that sell my data, but that is irrelevant to my gripe with the EU.
  - illiarian 4y ago
    Businesses: want to track users and collect their data with reckless abandon Businesses: implement rampant dark patterns to trick people into accepting tracking and data collection Businesses: flood the internet with inane, obnoxious and blatantly illegal cookie dialogs ... 4ad: I blame the EU (Hint: show me where GDPR says anything about cookies)
    - qtzfz 4y ago
      Most internet businesses need tracking to survive, so it's more like either you click past a cookie banner or you don't get to see the content at all.
      - illiarian 4y ago
        > Most internet businesses need tracking to survive Of course they don't.
      - Nextgrid 4y ago
        > Most internet businesses need tracking to survive Most criminal gangs need to steal/rob/etc to survive too.
    - 4ad 4y ago
      I blame the businesses for destroying the social fabric of the internet, and I simultaneously blame the EU for implementing pointless regulations that do not solve the first problem while making life miserable for its subjects.
      - illiarian 4y ago
        Businesses: destroy the social fabric of the internet Regulation, literally: do not collect people's data without their consent if you don't require that data for services you provide. Applies in equal measure to websites, banks, grocery stores, shit processing plants and nuclear power stations. ... 4ad: I still blame the EU, and it's a pointless regulation. Edit: This comment really says it much better: https://news.ycombinator.com/item?id=35567507 https://news.ycombinator.com/item?id=35567507
- Hermel 4y ago
  So why do even the official website of the European commission and the European parliament have a cookie consent button? One would assume that they are not "capitalist services".
  - rapnie 4y ago
    Unfortunately big tech surveillance capitalists (which is different than "capitalist services", mind you) are court suppliers of IT services that EU institutions depend upon. Edit: And as the sibling said, in many cases it may be restricted to analytics and simple 'reject' suffices, which is at least better than some of the intricate dialog designs.
  - illiarian 4y ago
    I mean, you could literally read what their banner says. E.g. Eu Paarliament "We use analytics cookies to offer you a better browsing experience. You have the choice to refuse or accept them. Reject. Accept". Those analytic cookies are not required for the functioning of the website, and those web sites are required to ask for your consent to gather any additional data.
- luckylion 4y ago
  Is he right though? I work with affiliate people a lot, and they hate cookie-consent popups. Even when you do all your analytics inhouse with self-hosted matomo, if you want to use a cookie, you need consent is what the lawyers say unanimously. And these aren't "we want you to ask for consent because we secretly want more privacy" lawyers, these are "I get paid to find a way for you to do your tracking in the easiest way possible and I don't care about privacy" lawyers. Maybe they're all wrong, but I have doubts.
  - gbalduzzi 4y ago
    > Even when you do all your analytics inhouse with self-hosted matomo, if you want to use a cookie, you need consent is what the lawyers say unanimously If you use a cookie for Matomo tracking than yes, you need consent. You are using a cookie for a non essential service (analytics), so you need to ask consent. But you can use Matomo as cookieless: https://matomo.org/cookie-consent-banners/ https://matomo.org/cookie-consent-banners/ If matomo gathers data without a cookie, you can still use technical / essential cookies without consent. As an example Github.com, owned by Microsoft, does not have a cookie consent popup and sets at least 5 cookies as soon as you open it: - color mode (dark / light) - user timezone - whether the user is logged or guest - a session cookie - _octo, that I don't understand.
    - luckylion 4y ago
      But that primarily says that Github doesn't care about cookies (or consent), not that you (not being a multinational corporations with an army of lawyers and millions in lobbying spending) can do the same. I'm pretty sure those cookies are non-compliant if you look at them closely, because none of them are necessary for the operation of the service. a) a default value doesn't need to be stored in a cookie -- and it has to be a default value, because you haven't selected a color scheme or a timezone b) login-state does not require a cookie: either you're logged in and have a session, or you aren't, and you don't, c) there's no reason for a session on the public facing side that doesn't contain any private/individualized data, unless you want to use these session cookies to track users -- and it's only about users as bots will typically ignore cookies. My money is on "Microsoft knows that cookie consent is optional if you're not a small European company".
- nicbou 4y ago
  That's completely false though. Tracking your users without consent is still not allowed, even if you store the data on your own servers.
shmde 4y ago
Also accepting them cookies is one single click but rejecting them feels like entering the dark realm with multiple options and not knowing where to click. I am software dev but still have to use just enough mental resources to reject all of the non essential ones. How the fuck is this legal.
- germanier 4y ago
  It's not legal. It's just not rigorously enforced. It was promised that things get better with the proposed ePrivacy regulation. Let's see.
- Anduia 4y ago
  It is not legal for webs to make rejecting cookies more complicated than accepting them. In fact, the French data protection authority CNIL has issued orders to around sixty players that do not make refusing cookies as easily as accepting them. They have also fined companies such as Google and Facebook for making it harder to reject cookies than to accept them. The CNIL has ordered these companies to provide a means of refusing cookies as simple as the existing means of accepting them. Also, under GDPR, it is not legal for websites to make rejecting cookies more complicated than accepting them. In May 2020, the EU updated its GDPR guidance to clarify that cookie walls do not offer users a genuine choice because if you reject cookies you’re blocked from accessing content. It confirms that cookie walls should not be used. Companies such as Google have introduced new options to reject tracking cookies in Europe after their existing dialog boxes were found to be in violation of EU data laws. Now what I don't know is if users outside of EU get the evil-twin version of those popups when visiting websites. My experience browsing the www is just not as bad as many people describe because I usually get a "reject all" button or when "managing" the cookies, they are all disabled by default and I can simply save the options.
submeta 4y ago
> vast majority of people DO NOT care about cookies nor do they care about trackers I highly doubt that. Do give people simpler ways to opt-out of all tracking, and they‘d happily chose that. Currently we have two problems: 1) The consent button is one click for cookies, the other is several clicks away. 2) The layman does not now how to choose a setting to always opt-out of tracking.
dre_bot 4y ago
Most don't even know what the hell a cookie is or any of the shit in those prompts.
- pelorat 4y ago
  I mean Gen-Z barely knows what an operating system is.
illiarian 4y ago
>The vast majority of people DO NOT care about cookies nor do they care about trackers. When presented with "Ask app to not track" on iOS, 96% users clicked "do not track" https://arstechnica.com/gadgets/2021/05/96-of-us-users-opt-out-of-app-tracking-in-ios-14-5-analytics-find/ https://arstechnica.com/gadgets/2021/05/96-of-us-users-opt-o...
- boffinism 4y ago
  These two statements are not incompatible.
- shmde 4y ago
  Having a clear cut "CALL TO ACTION" dialogue option which presents one positive ( don't track me ) and one negative ( track me ) option. People choose the positive one. Cookies/tracking banners on website completely obfuscates the choice. Negative option ( track me ) is presented as the pearly gates to heaven and easy to click. Positive option ( don't track me ) is presented as these mathematical puzzle where you must know what to click or your dog gets executed. So yeah people care about not being tracked when presented with clear instructions to which one is bad and which one is good.
  - illiarian 4y ago
    > Having a clear cut "CALL TO ACTION" dialogue option which presents one positive ( don't track me ) and one negative ( track me ) option. That is literally the requirement by GDPR > Cookies/tracking banners on website completely obfuscates the choice. On purpose. In violation of GDPR.
- ssss11 4y ago
  That “most users don’t care” line is tossed around by people all over the place and you righty point out that it isn’t true. If my job relied on people giving up their data privacy I would probably continue telling everyone that line as well.
no_time 4y ago
>We've got to come up with a better solution. I've got an easy one for you: stop embedding google analytics and others. You don't need a cookie banner when you only have operational ones or better yet, none at all.
- oneeyedpigeon 4y ago
  Are you sure that out-of-the-box GA requires it? I thought the only info it recorded was anonymised.
  - matsemann 4y ago
    Even with consent and configuration, GA might be illegal in the EU. It's currently in a grey area after some latest rulings.
  - illiarian 4y ago
    GA collects insane amounts of data. And you might have to disable a lot of that collection manually https://support.google.com/analytics/answer/9019185?hl=en#zippy=%2Cin-this-article https://support.google.com/analytics/answer/9019185?hl=en#zi... And even then it might not be strictly compliant due to Schrems II ruling
  - boffinism 4y ago
    Don't confuse cookie laws with data laws
  - progval 4y ago
    According to the French data protection authority, "out-of-the-box" GA requires consent because they aren't anonymised: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h...
    - oneeyedpigeon 4y ago
      Well, I'm glad I don't use GA on my personal site, then, even if it means I have no idea what traffic levels it gets. GA is incredibly popular though - I would guess the vast majority of blogs etc. use it and have no consent to do so.
mabedan 4y ago
You’re missing the point of the article. The banner is only needed if your business relies on handing over info about the user to 3rd party. And yes, it’s reasonable to make sure user knows about it. The fact that these pop ups are annoying is the fault of the creator, not the regulation. Try accessing Apple.com or iCloud.com. No cookie pop up, yet one of the most successful businesses in history. You don’t have to be annoying
- qtzfz 4y ago
  What info? My IP address and the pages I've visited inside their site? By visiting a site I know I'm giving that info to them, they can do whatever they want with it.
  - jeltz 4y ago
    Not without breaking the law.
    - qtzfz 4y ago
      Which is why it's a stupid law that has made everybody's lives worse, both the businesses and the users.
      - hammyhavoc 4y ago
        Why is it a stupid law? Why should businesses be free to look up the IP and figure out who is looking at their page? An IP can reveal a lot of information, especially if there's servers hanging off of it.
  - illiarian 4y ago
    > What info? Any personally identifiable information. GDPR is not a complex law no matter how shady businesses and clueless devs are trying to tell you. It's also been in effect for 7 years. You'd think it's enough time to have at least some clue on what it's about. And yet we still have these inane threads on HN claiming it's about cookie popups, and people having no idea what info trackers collect.
wongarsu 4y ago
At least part of the intent of the law was that websites would reduce the amount of tracking if they have to explicitly ask for consent. You can build your website with just functional cookies (session cookie, storing preferences like dark mode, etc) and cookie-less tracking, and go without any cookie popups. Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the most in-your-face popup possible to cause users to reflexively hit consent instead.
- Nextgrid 4y ago
  > Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the most in-your-face popup possible to cause users to reflexively hit consent instead. GDPR actually has provisions against this kind of malicious compliance - the problem is a chronic lack of enforcement, despite it being trivial to detect with a web crawler.
datkirby 4y ago
People are definitely aware of them. The trouble lies with how easy opting-out is. Many websites have included options to just opt for the "compulsory" option. The only concern now is how many of them would willingly provide that option.
ssss11 4y ago
Of course the simple solution that we all know is to not collect the damn data in the first place. But marketing boffins the world over will never willingly do this unless it’s enforced by law, so we’re left with the user’s taking on the burden of clicking deliberately confusing stuff and not knowing whether they’ve ended up consenting or not.
maeln 4y ago
Most people do not care because they don't really see/understand how it affect them. Just like most people probably don't care about HVAC regulation, welding regulation for system under pressure and other very technical field. They will see the issue and care about it when something happen. We have a lot of regulation about welding under high pressure because we know from experience what happen when we have no rules (things go boom). What happen when we have no regulation about tracker ? We get massive data leaks from poorly secured data hoarding company (hello Equifax). This is dangerous in many many ways: Identity theft, scam & spam, identifying people with certain political view, from a minority of some sort, etc... GDPR does not solve all this issue, some company can still hoard massive amount of data about you (it is always scary to ask for a data extraction from Meta, Twitter, ... and how you have a "profile") and have bad security, but it does limit in how many hand this data circulate and how easy it is to gain access to.

ge96 4y ago

Soon as I see the cookie prompt I either abandon the site or read past it. Maybe I write a thing that specifically removes it by an extension.

clnq 4y ago
There are already lists for ad blockers that remove those cookie notices.
- ge96 4y ago
  I don't know how people can use the internet without an adblocker.
  - irusensei 4y ago
    I'm not a fan of attaching third party things that work by reading the contents of what I'm browsing. I'd rather run a DNS based blocker but unfortunately those can't prevent cookie modal monsters.
    - npteljes 4y ago
      I see the point in that, but wrt browsing, what counts as a third party? There's a million of points where the browsing data leaks already, running the most trusted adblocker extension doesn't really change that. ISPs track and sell DNS and other metadata, VPNs do god knows what, each website is a third party basically, every website with a Facebook Like button reports your visit to Facebook, most websites are using a large CDN like Cloudflare, some browsers use their own CDN / service to do things like compress images, ... In the sea of all these things happening, the user is much better served with uBo than going in without it. It gives the mind some peace not seeing all the advertisements, for one.
  - sgt 4y ago
    I tried adblock but I turned it off as it was blocking things that weren't supposed to be blocked. Very rarely though. I don't know, it's like I almost don't see the ads, my eyes just scroll past it.

olivierduval 4y ago

Actually it's a bit more complex (but not much) than what is described: 1st party may need user consent when they will use personal datas for something that is not the intended service (legitimate use). For example, for a shopping cart: cookies are necessary for the service, so no problem. For fraud detection : no problem because it's a legitimate use. But if you start tracking with a user cookie what pages your users are viewing (statistics collection), then... you need the user consent ! Because it's not necessary for the service... (even if it might be in your interest) EDIT: if your statistics are not bound to personal informations (so you dont need statistics for INDIVIDUAL users but only the your users AS A WHOLE) then... no problem for RGPD and no need for consent. Actually, that's what a lot of RGPD-compatible statistics do (like Matomo and others...)

oneeyedpigeon 4y ago
I think the vast majority of sites that use cookie popups DO need to do so because they use targeted advertising. It's only a tiny number that have been 'too aggressive', although I'm personally aware of such an example.
olivierduval 4y ago
As a side note: cookie management is just A PART of RGPD, that is based on personal information. So RGPD implies to inform the user about the ways their information is used, how it can be accessed, modified, deleted and so...
- Circuitstorm513 4y ago
  It's GDPR as in General Data Protection Regulation.
  - teekert 4y ago
    I guess OP is French, they use different word orders for almost anything, ie: DNA: AND.
    - 4y ago

mschuetz 4y ago

The problem is that GDPR doesn't go far enough. It should completely prohibit third party tracking without the possibility to agree to it. Third party cookies/tracking simply should not exist.

goodluckchuck 4y ago
The problem is they picked the wrong parties to be responsible. It’s not the websites that are doing the tracking. The websites are merely asking to save a cookie. It is the users’ own web browser that is storing the cookie and sending the cookie back to these websites. It’s the browsers that should be regulated if anybody but it’s a lot easier to regulate the little guy than to regulate Google and apple.
- martin_a 4y ago
  Who integrated the tracking scripts and tools that want to set a cookie? The "little guy" or the browser?
Nextgrid 4y ago
The GDPR goes far enough and even prohibits dark patterns and annoying the user into accepting. Making the "decline" option harder to find is not compliant for example. The problem is a chronic lack of enforcement that allowed websites (and entire companies such as TrustArc/etc) to implement these malicious pseudo-compliant solutions and get away with it, at the expense of everyone's privacy and sanity.
ActorNightly 4y ago
Id be willing to bet that there is a large overlap of people who dislike tech company layoffs and people who have this sentiment about 3d party tracking.

irusensei 4y ago

I live in the EU but have a VPN setup for a non-EU country so that I see less cookie modals and overall have a better experience.

Lurkars 4y ago
Does that mean you autoaccept everything and automatically handing your data to 3rd parties?
- irusensei 4y ago
  What data?

fsh 4y ago

GitHub got rid of their banners in 2020: https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background.

Nextgrid 4y ago
> I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background. And an entire industry with companies like TrustArc built on pitching and selling this crap even if not required and/or if their solution wouldn't achieve compliance anyway.
- marssaxman 4y ago
  This is very convenient, because I can add this one line to my ublock origin config and thereby eliminate many cookie banners: ###onetrust-consent-sdk
baby 4y ago
That’s what happens when you add regulations to an industry of small players who can’t afford to spend time or money in understanding these things
- Nextgrid 4y ago
  The regulation is much easier to understand and comply with than many other laws you already need to comply with (taxation, etc) and nobody seems to complain about. The problem isn't the complexity of the regulation, it's that entire businesses and careers have been built on the fact that spyware became decriminalized in the last decade and they are fighting back with misinformation to try and preserve this status-quo.
- npteljes 4y ago
  I think it boils down to how service providers can manage the inconvenience. Since sites can pass the blame to the EU for the cookie things, and they can create a nice shiny button that makes the inconvenience go away in an instant, cookie modals are a good solution. They can perform that they are giving the users options for privacy, and also absolve themselves from the burden of the EU regulation, with one simple click on the Allow all button. I also think that it users don't mind the inconvenience too much. Complain, yes, but they are not really choosing a website that doesn't have the popup, over a website that does have. And so, businesses have no real incentive to change their ways.

veltas 4y ago

>Tech bros love to whine about "The EU cookie policy" that simply doesn't exist the way they imagine it. All these popups are the most radical way to interpret the explicit consent demanded by regulations when sending data to a 3rd party. An ongoing provocation by the ad/tracker industry to blame their ruthless data hoarding on the EU. The official EU website has one of these annoying pop-ups. Are they part of the provocation? https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en

gizmo 4y ago
If you click on the cookies explainer you'll see that they actually use a shitton of cookies: https://european-union.europa.eu/cookies_en https://european-union.europa.eu/cookies_en Instead of that cookie banner they could just not have visitors connect to all those 3rd party services that use cookies to track users!
ginko 4y ago
That one's the pretty much the optimal implementation though. * it's a small bar on the bottom * the site works without clicking on the consent buttons * it has clear "opt-in" or "opt-out" options * no annoying "customize my permissions" sub-menu with tons of enabled switches and dark patterns
- Machado117 4y ago
  * No loading screen when you don’t accept all cookies
- dkersten 4y ago
  It’s also fast. I clicked the don’t allow button and it responded instantaneously. Many cookie banners are (probably purposely, at least when should don’t allow) slow as hell.
- nonethewiser 4y ago
  > That one's the pretty much the optimal implementation though. Takes up 40% of my screen on mobile

febeling 4y ago

This should have been solved technically, not politically. Why not set cookie rules in the browser settings, and handle at http standard level?

jeltz 4y ago
Because Google owns the largest browser. The problem could only be solved politically.
- goodluckchuck 4y ago
  No, that proves the problem could not be solved politically, because regulators lacked the political power needed to regulate google
  - regularjack 4y ago
    If they would try to regulate google, that would be a political measure. How would they "regulate google" in a technical way?
  - jeltz 4y ago
    But GDPR was their way of regulating Google. It is not perfect but it was a huge step in the right direction.
    - goodluckchuck 4y ago
      I thought GDPR regulated the cookies that websites are allowed to request to store on users devices. Does it also cover tracking built into browsers by Google, Microsoft, etc.?
Nextgrid 4y ago
GDPR and those data processing consent flows are about data collection and processing in general and not a specific technical means of doing so - it would also apply to IP addresses, browser fingerprinting, information manually entered (such as delivery address when placing an e-commerce order) or a hypothetical crystal ball that actually worked.

Guid_NewGuid 4y ago

No one likes these consent modals, not the EU, not the companies, not the end users. But they're good. They're making the negative externality visible. We had developed an ecosystem where as soon as you clicked on a webpage it would spaff your personal data to third party brokers and infest you with tracking across the entire internet. All driven by marketing and sales departments. All driven by a capitalist free market. The regulations changed nothing other than to make people annoyed by this. Good. Take that anger and direct it against the god damn companies building this stuff, many of the employees of which are on this site. Stop whining about the EU, they're just holding up a mirror to the abject horror of tech.

flangola7 4y ago
Couldn't have said it better myself.
lofaszvanitt 4y ago
No, they are not good in any way. Imagine you have to press buttons whenever you start your car and have to give promises you are not going to go above the speed limit... It's just plain NONSENSE. This consent madness should be implemented in the browser. You set it once, and then you just forget about it. Poof, problem gone. If
- Kalium 4y ago
  I cannot imagine that the legal systems in question would consider setting a consent setting in your browser, once, to be explicit positive and informed opt-in.
- berkes 4y ago
  It was in the browser (still is?) called DNT, and it didn't work because the industry ignored, circumvented and even actively opposed it. Your idea has been tried and was found to not work.
  - lofaszvanitt 4y ago
    Nah, it should be like notifications. You can set a global block on those. Same should apply to these cookie consent things. You set what you want to keep and enjoy a popup free web.

teekert 4y ago

I use Matomo on Wordpress. Turned of cookie based tracking. It means sometimes a revisting visitor can not be discriminated from a new one. I don't care. But, now he is saying, I can enable the cookie if I want, without needing the consent banner? And what about a privacy page? Indeed it does make whipping up a blog or so more complex. Although I usually use Hugo of WP, keep them vanilla: Now cookies required for just viewing content. Some kind of tool would be handy.

Hamuko 4y ago
>But, now he is saying, I can enable the cookie if I want, without needing the consent banner? No? It's clearly not an essential cookie considering your site is currently working without it.

ActorNightly 4y ago

>So stop blaming "the EU" and ask yourself if this is the internet we want. ...Yes, thats exactly the internet "we" want. I don't get why it so hard to accept that people simply dgaf about privacy, and much prefer free products online paid for by ads. And there is nothing wrong with that, because for those that actually care about privacy, there are plenty of tools.

germanier 4y ago
It's hard to accept because many, many people won't agree with you and do give a fuck.
- ActorNightly 4y ago
  To anyone that doesn't agree with me, please show me your rooted android phone that has no popular apps installed that collect any data, and doesn't use a sim card. Because if you say you give a fuck about privacy, and use a modern android phone with OEM rom or an iPhone, you either don't understand what privacy is and shouldn't be talking about it in the first place, or you are a hypocrite.
  - scrollaway 4y ago
    Someone can give a fuck about privacy in the areas they can, while not going overboard or trying too hard, you know. what you are describing is no true Scotsman nonsense. “You dgaf about privacy unless you wear a balaclava all the time”. It’s also possible they understand the trade off with privacy wrt, say, google and their isps/mobile providers, versus the trade off with random websites on the internet.
    - ActorNightly 4y ago
      There is no "areas" here. What you do online is tracked if you use windows, mac os on laptop or phone, or android. Who is tracking that is irrelevant. Claiming that its ok that Apple gets your data, a company who literally allowed the iCloud photo hacks to happen, but not 3d party advertisers is like olympic level mental gymnastics.

iamnotsure 4y ago

Cookies invade privacy, cookie prompts invade both privacy and attention.

hammyhavoc 4y ago
Is the purpose of the prompt itself not to invade your attention to make a decision on whether you want them or not? Likewise, how does the prompt invade your privacy if you don't act upon it?
- iamnotsure 4y ago
  Before the prompts, situation was not good, but I could delete browser history and what not. After the prompts, I still need to delete browser history, but I can't delete memories of prompts from my mind. Every time I see a cookie prompt, I get traumatized. Prompt blockers do not work reliably. I don't want to read about cookies, GDPR, EU, whatever every time I see a random web page. I remember the old internet.

GranularRecipe 4y ago

> "To make this very clear: user/visitor consent is only needed for data going to 3rd parties." I think this statement is categorically false. Art. 6 GDPR (https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/) lists exhausively the reasons for lawful processing of personal data which applies not only to cookies, but also IP addresses etc. The "cookie consent" addresses Art. 6 Point 1(a). Whether third-parties (data processors) are involved is irrelevant, e.g. if I need to transfer personal data to my accountant, it falls under b, c (or d).

mnw21cam 4y ago
Agreed. It isn't the third party that is the issue - it is the separate purpose. For example, if I access a web page, I'm giving my IP address to the server, so that it knows how to sent the data I just asked for back. That IP address is personal information, but it is necessary for the server to fulfil the purpose of the task I just asked for. That server also gives the IP address to a third party - the router in between it and me. That's also necessary, because otherwise the packets can't be routed, and it's fine legally. However, if the company running the web page were to take that IP address and store it and use it for deep analytics, matching my request up to other requests from the same IP address, then the personal data has not been handed over to a third party, but it is being used for a purpose which requires consent, and would be illegal unless that consent had been obtained. That data use isn't necessary for the original purpose of the task I asked for, which is to serve me a web page - it is a separate purpose.
- ThunderSizzle 4y ago
  Wouldn't that depend on perspective? Wouldn't the router e.g. cloudflares purpose be to ensure fast delivery and that it's not an attack. Both require capturing the ip address and analyzing behavior. A faster road where no one wants to go isn't a faster way, so the router needs to capture it so they know where to build their roads.
  - GranularRecipe 4y ago
    Good point. Sounds like the start of a fun conversation between data protection officers (DPO) and data protection agencies (DPA).

jillesvangurp 4y ago

This is correct. Bad UX with modal popups and very ambiguous/deliberately vague verbose language designed to make you click some ok button are a choice not a legal requirement. Being deliberately obnoxious is of course a weird choice if you are trying to actually get people to engage with your website. The more obnoxious the UX, the less you should trust websites to do the right things when it comes to your privacy and rights. If someone puts a "reject all" button in the cookie thing, I click it on principle. Every time. I go out of my way to find it and click it. The harder websites try to hide that button, the harder I try to find it and click it. It's usually there. But you have to wade through a lot of bullshit and deal with some offensively stupid UX to get to that button. I'm not going to mico-manage all the various ways you want to sell my data / abuse me. Does anyone actually do that? The engagement on UI like that must be absolutely terrible. What does that say about your brand if you are trying to be deliberately misleading, manipulative, and offensive like that? It's not a good look. Advertising your web design incompetence and malice/corporate stupidity like that is a choice. A bad and odd choice. But it's a choice. The more visually offensive the cookie experience, the less likely I am to provide consent and the more annoyed I get. It's that simple. Maybe I'm weird. Or maybe lots of people are exactly like me and don't provide consent either. So why even bother with this level of abuse? I also have an ad blocker (I don't even remember the web before ad blockers), I use firefox containers, and firefox cleans up cookies and blocks trackers really aggressively. So, not only is this stupid. It's also futile.

Nextgrid 4y ago
Dark patterns aren't actually a valid approach of complying with the regulation - if you do that, you may as well just track and collect data without consent, because any consent obtained by misleading or annoying the user does not count as valid anyway. Here's what the UK legislation has to say (which is still identical to the EU GDPR as far as I know, though subject to change post-Brexit): https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Explicit consent requires a very clear and specific statement of consent. > Keep your consent requests separate from other terms and conditions. > Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. > Be clear and concise. > Make it easy for people to withdraw consent and tell them how. > Avoid making consent to processing a precondition of a service.

openplatypus 4y ago

Cookie Banner is just a term for consent for data processing. It is not exclusive to 3rd party cookie or tracker. If you have no legitimate interest in doing something with the data, you must ask the user first.

hammyhavoc 4y ago

Both CloudFlare and Jetpack on WordPress insert a tracking cookie as a part of using their service, right? (I may be wrong, things may have changed) For a lot of folks, that's what they have to use, otherwise delivering the page resource-wise isn't viable. Ergo, they need those banner popups to be in compliance, right?

remus 4y ago
It depends on what the cookies are being used for. If they're "essential for site functionality" (e.g. fraud prevention) then consent is not necessary.
- hammyhavoc 4y ago
  Well, here's the thing though, it could be argued that they are essential for site functionality (if you conflate functionality with availability for example), however, you are revealing the IP of the user to those third-party services, which is no bueno. Loading Google Fonts via Google's CDN is non-compliant, ergo why would Jetpack be any different? https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... However, CloudFlare is an odd one. They're also the reverse proxy and DNS for the site, ergo they can collect that IP if they intend to, which they apparently don't. Where is the line drawn? If an asset loaded via a third-party CDN is "leaking the IP", surely CloudFlare also is? Surely any kind of DNS is? I'm asking big questions, I know, but have always been curious, and have been waiting for a good opportunity to put them in front of others.
  - orwin 4y ago
    What we did was basically ignore GDPR and send a mail to our watchdog about the points we weren't sure would pass as legitimate use. Basically: if you in good faith think it's legitimate, it's probably legitimate. The watchdog will propose you ways to remove PII from your data if he think you're misguided, and they drafted us an architecture that worked for data protection (like half a day of work for an architect, i think they already have these kind of drafts as our issue was quite common). We spent 20 minutes to write the email and basically earned 500$ (or whatever is the cost of half a day of an architect is). We also had prior contact with the watchdogs for unrelated reasons (trying to get certified to handle sensitive data).

3dfan 4y ago

The problem with the GDPR is that it is a monster of a legalese text: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... Which nobody understands. Which, depending on how you read it, might make participating on the internet practically impossible. An IP is considered personal data, so in theory you cannot use foreign infrastructure like a CDN. Which certainly makes the internet as we know it impossoble. An internet where everybody builds tools on their site that everybody else can embed on their site. Because that would mean IPs flowing around between sites. Which gives a huge disadvantage to Euroeans. Because Europreans have to show cookie banners and stuff to everybody around the world. While the rest of the world has to only show them to Europeans. Look at your favorite website through a proxy inside/outside the EU. It starts with an annoying popup only in the EU. Which cements the stronghold of Google and Co, who 1) only have to bug their European users and 2) have the legal resources to cope with this insanity. Startups and indiemakers don't. So there will be even less of them in the EU. And the ones who exist will have to waste their time on this instead of building their products.

Tarq0n 4y ago
This is way off base. Using PI to fulfill a request someone has made of you is the happy path of GDPR, you just can't retain or reuse that information more than you have 1) a contract or 2) permission or 3) a lawful task For. Having other parties process PI for you is fine as long as it's done under an agreement that binds them to the same terms.
- 3dfan 4y ago
  First, no, you cannot reduce a thousands of words long legal document to a few words like you did and say "Easy, this is how it works". Those thousands of words are there for a reason. Second, good luck, figuring out what you have "a contract, permission or a lawful task" for under the specific circumstances of your site. Third, good luck, making and understanding an "agreement that binds them" with every provider of every piece of infrastrcuture you use. Good luck doing that for even a single piece of infrastructure.
4y ago

ivanhoe 4y ago

Ideally browsers would have an API to handle GDPR requests natively, the way they do for hardware access, and users would be able to set the default level of access, as well as lists of exceptions for some domains. Of course, Google will never provide such API in Chrome as it would be bad for their core business of spying on people in order to sell them more stuff.

CactusBlue 4y ago
It exists, and it's called the DNT header. It was deprecated because ironically, it was used for user fingerprinting.
- soneil 4y ago
  It was also widely ignored. Not much has changed since browsers had to remove the capability to create popup windows (and pop-unders, which only existed because users were getting too proficient at the game of whackamole). At every single step, the industry has shown it will only behave anywhere near reasonably when externally forced to do so. DNT should have solved this problem, but the leopard couldn't change its spots, and used it to further its attacks on users instead. And this is why we have over-reaching regulation. Not because we want it, but because we earned it.
- Sephr 4y ago
  DNT isn't deprecated in Firefox or Chrome.

hardware2win 4y ago

Also many web masters dont realize that consent is not needed for technical cookies like auth.

jwildeboer 4y ago

Toot/thread author here. I have added more clarifications and explanations, based on the feedback in the comments here. Thank you for that! It was an angry rant written down in a very short burst of productivity ;) I had to simplify a lot if things to get the main point across — that these pop-up banners are NOT what GDPR demands, that they deliberately are designed to exaggerate and intrude on users.

deleted 4y ago

[deleted]

theoriginaldave 4y ago

[flagged]

PaulKeeble 4y ago

Arguably most of these cookie popups are not compliant with GDPR law anyway as all cookie acceptance has to default to opt out, its only if the user wants to opt in that the data can be collected. Almost all of the popups default the wrong way and use dark patterns including making you wait minutes to avoid the popups. This is all by design, they will happily show you that popup everytime you come to the site and you'll never see it again if you accept them. When you see such a pop up you know what sort of entity you are dealing with, one that is willing to fight with the EU and the law to get that data as well as enormously hurting its customers in preference.

exabrial 4y ago

The only scoring thing about the EUs cookie policy was fucking noticed on every site for functional cookies. And let’s be real, the other cookie content popups are probably theater.

qikInNdOutReply 4y ago

It needs a API, to talk with a user preference tresor and auto-negotiate site access. If a agreement can not be reached, the site remains privacy paywalled, else its just there and the site owner has consent.

Havoc 4y ago

How much simple analytics are considered reasonable? Simple example counting users and say what country they’re from. Technically not required to make the site work but might count as legitimate use?

SergeAx 4y ago

I want to stop whining about cookies popups. Any actionable items, besides browser extension to eliminate them for good?

zkid18 4y ago

> A 1st party cookie for tracking a session that stays on the site doesn't need consent/popups. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions I'd love to hear some legal or DPA opinion on this. From what I know, per the ePrivacy Directive in the version from 2009, any access or storage to information on the end user's device needs consent unless that access/storage is strictly necessary for a service explicitly requested by the user. This is known as the “cookie law”, but is not technology-specific and will also apply to equivalent client-side approaches such as LocalStorage, tracking IDs in URLs, or fingerprinting. The consent requirement is also independent of the question of whether the stored information qualifies as personal data. The GDPR didn't change anything with these rules. It only changed the definition of consent, invalidating “implied consent” approaches like “by continuing to use this site, you consent to …”. Consent means opt-in. Consent must be easy to decline and withdraw, and users must understand what precisely they are consenting to. This has led to a decrease in the percentage of people who consent to the storage of analytics IDs. So the question is whether we can be considered as a strictly necessary for a service

more_corn 4y ago

Except from the usability and privacy perspective the EU cookie rule is objectively bullshit. Don’t require notification for every fucking site I visit. Also there are no circumstances where “functional cookies are required”. Painting a webpage doesn’t require a cookie. If you really cared about customer privacy you’d make a rule that allowed me to set my privacy setting in my browser and require the sites to respect it. And one of the options better be “none ever, just do what you can without it” What moron thought the current rules were sane? What a useless waste of air to defend an obviously broken and constantly annoying and useless rule. In conclusion a four year old could have come up with a better rule. So stop whining about people’s legitimate objections.