4 ms·

How did they not include this to begin with? It’s so obvious as to be poking you in the eye that this would be necessary. How many cumulative wasted hours have

How did they not include this to begin with? It’s so obvious as to be poking you in the eye that this would be necessary. How many cumulative wasted hours have been spent tapping through cookie pop ups? I made a game about it if you feel like wasting even more of your precious life on pop ups. http://termsandconditions.game http://termsandconditions.game

rlpb 4y ago
It was included. The rule hasn't been changed. The interpretation of the rule in one specific case has been confirmed, without having changed the rule. That means that, as written, this dark pattern was always illegal.
zeven7 4y ago
> How many cumulative wasted hours have been spent tapping through cookie pop ups? Maybe not quite as privacy conscious, but a quick workaround: (1) Open in incognito (2) Click big, easy to find "Accept" button
- pornel 4y ago
  Note that "cookie" popups are about tracking, not cookies. If you agree in incognito, they might fingerprint your browser and track you outside of incognito too, since you've agreed.
hutzlibu 4y ago
Thanks for that. This game should probably be mandatory, for anyone involved with the cookie legislation. If they succed, they may propose a new draft.
lucideer 4y ago
On one hand, this was required from the beginning (this is just a clarification of original intent, not a change or addition) However it's deeper since the popups we see today were never recommended nor required by the original regs. The laborious nonsense we endure was invented by websites as a workaround for the regs. So it wasn't obvious that consent parity would ever need to be clarified like this because it wasn't even obvious that the industry would come up with such an awful popup pattern to begin with (though in retrospect we should've known I guess). The fact the popups were never even compliant anyway is just a combination of wilful ignorance, dark patterns, consulting companies wanting to sell something and - yes - an added set of people innocently misinterpreting regulation.
- phendrenad2 4y ago
  This is nonsense talk. How do you differentiate between compliance with the regulation, and a "workaround" to the regulation? I guess it's at each of our discretion, right? It's subjective? Or are they the same thing? You can keep calling them "workarounds" but that distinction only exists in your own mind.
  - unaindz 4y ago
    It's a workaround if a website manages to make users accept cookies that would otherwise refuse just by making it so inconvenient UI wise to refuse them. The limits and edge cases on this may be subjective but then again so are most laws.
  - ncallaway 4y ago
    Why do you consider something nonsense just because it’s a subjective judgement call? Lots of things are subjective judgement calls. They are not all nonsense.
    - Defletter 4y ago
      Many people sadly have this mindset that if something is not explicitly and comprehensively spelt out then anything goes, therefore any complaints for bad implementations is purely on the regulations for not being explicit and comprehensive enough. Now, obviously, there's SOME truth to this, but too often people think in black and white.
      - ncallaway 4y ago
        I often think it usually goes the other way. If a regulation is too specifically defined, it often ends up having gaping holes and other issues. Most of our longest standing torts and crimes have subjectivity right at their core, and I'd argue that's not a coincidence but survivorship bias. The world just isn't black and white, and attempts to legislatively render it so inevitably cause problems (though, obviously too much subjectivity and something because uselessly vague; it's a tricky balancing act for sure).
amelius 4y ago
> How did they not include this to begin with? A bigger question is: why didn't they go with the DoNotTrack header.
- ElectricalUnion 4y ago
  A bigger question is: why didn't they go with the Platform for Privacy Preferences (P3P) header? > P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 http://www.google.com/support/accounts/bin/answer.py?hl=en&a... for more info."
- MereInterest 4y ago
  Because the absence of a "DoNotTrack" header does not imply that a user has consented to being tracked, as a user may be using a browser that doesn't support "DoNotTrack". Nor does the setting of a "DoNotTrack" header necessarily correspond to a specific user, as it may have been set by a administrator policy. Nor would it be informed consent, as it is configured before the user has been informed as to the uses for which private data will be applied. The GDPR requires that consent be informed, explicit, freely-given, and limited to a specific use case. Of these, the "DoNotTrack" header could be at most freely-given. Its design as a binary yes/no that can be configured across all sites prevents it from ever being used as a way to grant permission to track. While the presence of "DoNotTrack=1" could be used to assume that no permission to track has been granted, this is already the default assumption that the GDPR requires companies to make.
  - amelius 4y ago
    > as a user may be using a browser that doesn't support "DoNotTrack" There are at least two solutions for that: 1. Force browsers to support the header. 2. Always send the header "DoNotTrack=boolean", then force websites to take action (show a popup) when there is no header.
bar000n 4y ago
i really don’t understand how it came to this anyway. the industry is so stubborn. what is not clear here? you should not spy on your site visitors for marketing purposes. when you join a poll you do so with consent, when a market/social/political research entity invites you to a focus group (for example) you get at least a coffee and snack if not real money. websites just get this for granted? it’s like stealing. it will never stop until the industry gets some understanding of these concepts.
- marksmith2996 4y ago
  understanding is not the issue, caring is
- imiric 4y ago
  We're talking about the advertising industry here. Calling these companies stubborn is a gross understatement. This is the industry that perfected psychological manipulation in the pursuit of profits. It's built on decades of research into the best ways to associate brand names with positive feelings, and plant a desire to make a purchase in the subconscious mind of consumers. They will do anything humanly possible to deliver ads to your senses, and they've corrupted every media technology to do so since the existence of public broadcasting. The internet has just given them the most profitable delivery mechanism, and in turn has made technology companies insanely rich. These adtech giants rule the internet, and can build the playground they need to make ad delivery more efficient than ever. Now these profits can trickle down to website owners, which will in turn take the path of least legal resistance, and employ every dark pattern imaginable in order to maximize _their_ profits. And if this corrupt business model wasn't enough, adtech companies can perpetually multi-dip by selling the data they collect on shady data broker markets. So, no, it's not just stubbornness, or lack of understanding. Deceit is built into this industry, and these cookie consent forms are just the tip of the iceberg. The solution requires much stronger regulation than the GDPR. Unfortunately, this is very unlikely to pass given the influence advertisers have on governments.
- sumedh 4y ago
  > websites just get this for granted? it’s like stealing. Isnt the user getting free content in return?
shadowgovt 4y ago
It became painfully obvious over time that the people who drafted the legislation did not think through either the ways malicious compliance could work against their goals or the incentives of all actors in this story.
- MereInterest 4y ago
  I think the possible forms of malicious compliance were considered, and are explicitly forbidden by the GDPR. The GDPR requires that consent be freely given, and be as easy to withdraw as to provide. The various end-runs around that requirement, such as redirects on rejected consent, click-through to privacy policy, click-through to a list of 3rd-parties, and so on, are all violations of the GDPR. They aren't a form of malicious compliance at all, because they aren't compliant at all.
  - shadowgovt 4y ago
    Naively, I'd expect a lot more enforcement action if so many sites were non-compliant. Did the EU create a policy it couldn't enforce, and that's the larger issue here?
    - MereInterest 4y ago
      From the gradual ramp-up of enforcement, my optimistic view is that they are closing out the deliberate "misunderstandings", establishing precedent for each one. I really should start collecting links as they come out, as they're a pain to track down later, but they've established things like "Targeted advertising is not a legitimate interest for the purpose of Act 6, and requires consent."
SergeAx 4y ago
This is because their goal is to get a consent, not to give the user a choice.

rlpb 4y ago

It was included. The rule hasn't been changed. The interpretation of the rule in one specific case has been confirmed, without having changed the rule. That means that, as written, this dark pattern was always illegal.

zeven7 4y ago

> How many cumulative wasted hours have been spent tapping through cookie pop ups? Maybe not quite as privacy conscious, but a quick workaround: (1) Open in incognito (2) Click big, easy to find "Accept" button

pornel 4y ago
Note that "cookie" popups are about tracking, not cookies. If you agree in incognito, they might fingerprint your browser and track you outside of incognito too, since you've agreed.

hutzlibu 4y ago

Thanks for that. This game should probably be mandatory, for anyone involved with the cookie legislation. If they succed, they may propose a new draft.

lucideer 4y ago

On one hand, this was required from the beginning (this is just a clarification of original intent, not a change or addition) However it's deeper since the popups we see today were never recommended nor required by the original regs. The laborious nonsense we endure was invented by websites as a workaround for the regs. So it wasn't obvious that consent parity would ever need to be clarified like this because it wasn't even obvious that the industry would come up with such an awful popup pattern to begin with (though in retrospect we should've known I guess). The fact the popups were never even compliant anyway is just a combination of wilful ignorance, dark patterns, consulting companies wanting to sell something and - yes - an added set of people innocently misinterpreting regulation.

phendrenad2 4y ago
This is nonsense talk. How do you differentiate between compliance with the regulation, and a "workaround" to the regulation? I guess it's at each of our discretion, right? It's subjective? Or are they the same thing? You can keep calling them "workarounds" but that distinction only exists in your own mind.
- unaindz 4y ago
  It's a workaround if a website manages to make users accept cookies that would otherwise refuse just by making it so inconvenient UI wise to refuse them. The limits and edge cases on this may be subjective but then again so are most laws.
- ncallaway 4y ago
  Why do you consider something nonsense just because it’s a subjective judgement call? Lots of things are subjective judgement calls. They are not all nonsense.
  - Defletter 4y ago
    Many people sadly have this mindset that if something is not explicitly and comprehensively spelt out then anything goes, therefore any complaints for bad implementations is purely on the regulations for not being explicit and comprehensive enough. Now, obviously, there's SOME truth to this, but too often people think in black and white.
    - ncallaway 4y ago
      I often think it usually goes the other way. If a regulation is too specifically defined, it often ends up having gaping holes and other issues. Most of our longest standing torts and crimes have subjectivity right at their core, and I'd argue that's not a coincidence but survivorship bias. The world just isn't black and white, and attempts to legislatively render it so inevitably cause problems (though, obviously too much subjectivity and something because uselessly vague; it's a tricky balancing act for sure).

amelius 4y ago

> How did they not include this to begin with? A bigger question is: why didn't they go with the DoNotTrack header.

ElectricalUnion 4y ago
A bigger question is: why didn't they go with the Platform for Privacy Preferences (P3P) header? > P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 http://www.google.com/support/accounts/bin/answer.py?hl=en&a... for more info."
MereInterest 4y ago
Because the absence of a "DoNotTrack" header does not imply that a user has consented to being tracked, as a user may be using a browser that doesn't support "DoNotTrack". Nor does the setting of a "DoNotTrack" header necessarily correspond to a specific user, as it may have been set by a administrator policy. Nor would it be informed consent, as it is configured before the user has been informed as to the uses for which private data will be applied. The GDPR requires that consent be informed, explicit, freely-given, and limited to a specific use case. Of these, the "DoNotTrack" header could be at most freely-given. Its design as a binary yes/no that can be configured across all sites prevents it from ever being used as a way to grant permission to track. While the presence of "DoNotTrack=1" could be used to assume that no permission to track has been granted, this is already the default assumption that the GDPR requires companies to make.
- amelius 4y ago
  > as a user may be using a browser that doesn't support "DoNotTrack" There are at least two solutions for that: 1. Force browsers to support the header. 2. Always send the header "DoNotTrack=boolean", then force websites to take action (show a popup) when there is no header.

bar000n 4y ago

i really don’t understand how it came to this anyway. the industry is so stubborn. what is not clear here? you should not spy on your site visitors for marketing purposes. when you join a poll you do so with consent, when a market/social/political research entity invites you to a focus group (for example) you get at least a coffee and snack if not real money. websites just get this for granted? it’s like stealing. it will never stop until the industry gets some understanding of these concepts.

marksmith2996 4y ago
understanding is not the issue, caring is
imiric 4y ago
We're talking about the advertising industry here. Calling these companies stubborn is a gross understatement. This is the industry that perfected psychological manipulation in the pursuit of profits. It's built on decades of research into the best ways to associate brand names with positive feelings, and plant a desire to make a purchase in the subconscious mind of consumers. They will do anything humanly possible to deliver ads to your senses, and they've corrupted every media technology to do so since the existence of public broadcasting. The internet has just given them the most profitable delivery mechanism, and in turn has made technology companies insanely rich. These adtech giants rule the internet, and can build the playground they need to make ad delivery more efficient than ever. Now these profits can trickle down to website owners, which will in turn take the path of least legal resistance, and employ every dark pattern imaginable in order to maximize _their_ profits. And if this corrupt business model wasn't enough, adtech companies can perpetually multi-dip by selling the data they collect on shady data broker markets. So, no, it's not just stubbornness, or lack of understanding. Deceit is built into this industry, and these cookie consent forms are just the tip of the iceberg. The solution requires much stronger regulation than the GDPR. Unfortunately, this is very unlikely to pass given the influence advertisers have on governments.
sumedh 4y ago
> websites just get this for granted? it’s like stealing. Isnt the user getting free content in return?

shadowgovt 4y ago

It became painfully obvious over time that the people who drafted the legislation did not think through either the ways malicious compliance could work against their goals or the incentives of all actors in this story.

MereInterest 4y ago
I think the possible forms of malicious compliance were considered, and are explicitly forbidden by the GDPR. The GDPR requires that consent be freely given, and be as easy to withdraw as to provide. The various end-runs around that requirement, such as redirects on rejected consent, click-through to privacy policy, click-through to a list of 3rd-parties, and so on, are all violations of the GDPR. They aren't a form of malicious compliance at all, because they aren't compliant at all.
- shadowgovt 4y ago
  Naively, I'd expect a lot more enforcement action if so many sites were non-compliant. Did the EU create a policy it couldn't enforce, and that's the larger issue here?
  - MereInterest 4y ago
    From the gradual ramp-up of enforcement, my optimistic view is that they are closing out the deliberate "misunderstandings", establishing precedent for each one. I really should start collecting links as they come out, as they're a pain to track down later, but they've established things like "Targeted advertising is not a legitimate interest for the purpose of Act 6, and requires consent."

SergeAx 4y ago

This is because their goal is to get a consent, not to give the user a choice.