4 ms·

GitHub got rid of their banners in 2020: https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ I believe there is

by fsh 4y ago

GitHub got rid of their banners in 2020: https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background.

Nextgrid 4y ago
> I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background. And an entire industry with companies like TrustArc built on pitching and selling this crap even if not required and/or if their solution wouldn't achieve compliance anyway.
- marssaxman 4y ago
  This is very convenient, because I can add this one line to my ublock origin config and thereby eliminate many cookie banners: ###onetrust-consent-sdk
baby 4y ago
That’s what happens when you add regulations to an industry of small players who can’t afford to spend time or money in understanding these things
- Nextgrid 4y ago
  The regulation is much easier to understand and comply with than many other laws you already need to comply with (taxation, etc) and nobody seems to complain about. The problem isn't the complexity of the regulation, it's that entire businesses and careers have been built on the fact that spyware became decriminalized in the last decade and they are fighting back with misinformation to try and preserve this status-quo.
- npteljes 4y ago
  I think it boils down to how service providers can manage the inconvenience. Since sites can pass the blame to the EU for the cookie things, and they can create a nice shiny button that makes the inconvenience go away in an instant, cookie modals are a good solution. They can perform that they are giving the users options for privacy, and also absolve themselves from the burden of the EU regulation, with one simple click on the Allow all button. I also think that it users don't mind the inconvenience too much. Complain, yes, but they are not really choosing a website that doesn't have the popup, over a website that does have. And so, businesses have no real incentive to change their ways.
- illiarian 4y ago
  The incessant "think of the small businesses" is becoming the new "think of the children". It's easier for small businesses to comply with GDPR.
  - LunaSea 4y ago
    This is hilariously wrong. Small companies have less code and complexity but don't have internal resources specialised in law, security and web development available to fix things. They usually also don't have the money to bring outsiders to do it for them.
    - illiarian 4y ago
      > Small companies have less code and complexity but don't have internal resources specialised in law, security and web development available to fix things. When you clamp all those things together, this sounds like a great burden. Please tell me, how these poor small businesses comply with, you know, actual laws, rules and regulations that they have to comply with? By breaking them? GDPR for small businesses is much easier because small businesses depend on much less data, and often don't even need to collect any (much less sell it to third parties).
      - LunaSea 4y ago
        > When you clamp all those things together, this sounds like a great burden. Please tell me, how these poor small businesses comply with, you know, actual laws, rules and regulations that they have to comply with? By breaking them? Most of the time they don't. Ever wonder why food health and safety inspections discover serious issues in basically all restaurants they inspect? It's because people owning and operating restaurants usually aren't knowledgable enough about these topics, don't have the time or don't have the money to things differently or all three at the same time. Most restaurants stay in business because the inspection are generally pretty lenient (issue warnings and don't close the business down) and are also understaffed compared to the number of businesses that have to be inspected. This is a simple example and I'm purposefully targeting a part of the law (food health and safety) that is directly linked to the core business (restaurants). I'm not even going into issues that could be found in other areas (accounting, human resources, etc.) of said business. Now let's try to imagine how a restaurant is going to approach GDPR compliance.
- acatton 4y ago
  > small players who can’t afford to spend time or money in understanding these things Most of them can afford it, since it's part of the cost of doing business. Most European businesses were already regulated by similar rules with the Loi informatique et libertés in France, and the Datenschutzgesetz in Germany. But since the maximum fines were smaller, everybody was breaking the law. The main issue is not that they can't afford it, the issue is that they don't want to do it. I've worked for 3 different small businesses which were happy to use free-of-charge AGPL libraries in their main SaaS product. And when I mentioned that we should remove AGPL libraries or release our entire codebase under AGPL, what I got was "we'll look into this later". This is not "i can't afford it", this is "i'm too lazy/incompetent to make time for it"
thecopy 4y ago
Indeed. I have many times mentioned this with business/product owners in my organization - but it is a nasty mix of complicated laws and regulation, pressure from legal, and a mentality of risk-minimizing. I usually only mention it in passing because fighting the requirement (which often is not actually needed) would take all my time and several weeks/months. I dont really care in the end.
the_gipsy 4y ago
> At GitHub, we want to protect developer privacy, and we find cookie banners quite irritating, so we decided to look for a solution. After a brief search, we found one: just don’t use any non-essential cookies. Pretty simple, really. Your Product Owner / Team must push against the ever-growing demands of Marketing Team. If the Marketing Team dictates what features Product should build instead of selling your product, then you are doomed. Saying yes to having a cookie banner is sadly an easy bargain for Product Team.

by fsh 4y ago

Nextgrid 4y ago

> I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background. And an entire industry with companies like TrustArc built on pitching and selling this crap even if not required and/or if their solution wouldn't achieve compliance anyway.

marssaxman 4y ago
This is very convenient, because I can add this one line to my ublock origin config and thereby eliminate many cookie banners: ###onetrust-consent-sdk

baby 4y ago

That’s what happens when you add regulations to an industry of small players who can’t afford to spend time or money in understanding these things

Nextgrid 4y ago
The regulation is much easier to understand and comply with than many other laws you already need to comply with (taxation, etc) and nobody seems to complain about. The problem isn't the complexity of the regulation, it's that entire businesses and careers have been built on the fact that spyware became decriminalized in the last decade and they are fighting back with misinformation to try and preserve this status-quo.
npteljes 4y ago
I think it boils down to how service providers can manage the inconvenience. Since sites can pass the blame to the EU for the cookie things, and they can create a nice shiny button that makes the inconvenience go away in an instant, cookie modals are a good solution. They can perform that they are giving the users options for privacy, and also absolve themselves from the burden of the EU regulation, with one simple click on the Allow all button. I also think that it users don't mind the inconvenience too much. Complain, yes, but they are not really choosing a website that doesn't have the popup, over a website that does have. And so, businesses have no real incentive to change their ways.
illiarian 4y ago
The incessant "think of the small businesses" is becoming the new "think of the children". It's easier for small businesses to comply with GDPR.
- LunaSea 4y ago
  This is hilariously wrong. Small companies have less code and complexity but don't have internal resources specialised in law, security and web development available to fix things. They usually also don't have the money to bring outsiders to do it for them.
  - illiarian 4y ago
    > Small companies have less code and complexity but don't have internal resources specialised in law, security and web development available to fix things. When you clamp all those things together, this sounds like a great burden. Please tell me, how these poor small businesses comply with, you know, actual laws, rules and regulations that they have to comply with? By breaking them? GDPR for small businesses is much easier because small businesses depend on much less data, and often don't even need to collect any (much less sell it to third parties).
    - LunaSea 4y ago
      > When you clamp all those things together, this sounds like a great burden. Please tell me, how these poor small businesses comply with, you know, actual laws, rules and regulations that they have to comply with? By breaking them? Most of the time they don't. Ever wonder why food health and safety inspections discover serious issues in basically all restaurants they inspect? It's because people owning and operating restaurants usually aren't knowledgable enough about these topics, don't have the time or don't have the money to things differently or all three at the same time. Most restaurants stay in business because the inspection are generally pretty lenient (issue warnings and don't close the business down) and are also understaffed compared to the number of businesses that have to be inspected. This is a simple example and I'm purposefully targeting a part of the law (food health and safety) that is directly linked to the core business (restaurants). I'm not even going into issues that could be found in other areas (accounting, human resources, etc.) of said business. Now let's try to imagine how a restaurant is going to approach GDPR compliance.
acatton 4y ago
> small players who can’t afford to spend time or money in understanding these things Most of them can afford it, since it's part of the cost of doing business. Most European businesses were already regulated by similar rules with the Loi informatique et libertés in France, and the Datenschutzgesetz in Germany. But since the maximum fines were smaller, everybody was breaking the law. The main issue is not that they can't afford it, the issue is that they don't want to do it. I've worked for 3 different small businesses which were happy to use free-of-charge AGPL libraries in their main SaaS product. And when I mentioned that we should remove AGPL libraries or release our entire codebase under AGPL, what I got was "we'll look into this later". This is not "i can't afford it", this is "i'm too lazy/incompetent to make time for it"

thecopy 4y ago

Indeed. I have many times mentioned this with business/product owners in my organization - but it is a nasty mix of complicated laws and regulation, pressure from legal, and a mentality of risk-minimizing. I usually only mention it in passing because fighting the requirement (which often is not actually needed) would take all my time and several weeks/months. I dont really care in the end.

the_gipsy 4y ago

> At GitHub, we want to protect developer privacy, and we find cookie banners quite irritating, so we decided to look for a solution. After a brief search, we found one: just don’t use any non-essential cookies. Pretty simple, really. Your Product Owner / Team must push against the ever-growing demands of Marketing Team. If the Marketing Team dictates what features Product should build instead of selling your product, then you are doomed. Saying yes to having a cookie banner is sadly an easy bargain for Product Team.