18 ms·

Cloudflare launches easy to set up consent manager that respects users

128 points by kuba-orlik 3y ago

PoignardAzur 3y ago
That's nice, but Cloudflare seems to be missing the point. No consumer is going to say "oh, now that you've provided me such a streamlined tracking consent experience, I'll give you consent to track me across sites to show me personalized ads". They'll just click the "reject all" option you're legally compelled to give them. Also, the example includes a consent option for anonimized pageview counts data, which under GDPR you don't need consent for. An approach that would really respect user would be to store traffic analytics anonymously (in a way that resists trivial de-anonimization, so with binning and stuff), and throw away the rest. There, no consent popup needed.
- creshal 3y ago
  There's still enough people who do not understand the consequences and just click "accept all", because they fear their computer will catch on fire and murder their pets otherwise. Coincidentally, those people are also the most susceptible to advertisement-driven brain washing and least likely to understand what adblockers are.
  - jnsaff2 3y ago
    I’ve seen hardcore developers telling others on calls to always click ‘accept all’ just because of the potential friction of an other click when rejecting. I don’t think they even had an adblocker in their Chrome.
    - anaganisk 3y ago
      Hardcore developers != A knowledge about the internet/how front end works. I don't think it's even a point to mention at all. I picked up programming 6 years before I got access to the internet, in 2015. Computing has developed so much these days, it's like expecting a Neuro to be your Oncologist. They may know basically how stuff works, but not everything related to a computer.
      - jnsaff2 3y ago
        Sure. It’s just that if developers (just adding these were web devs) don’t know or care then for the common folks this might be completely hopeless.
  - Semaphor 3y ago
    Or use an extension that does "accept all" for them, like I don’t care about cookies.
- lozenge 3y ago
  You need a consent popup to embed YouTube or Twitter or any ad platform. And if you have the popup, you might as well throw in Google Analytics etc as well, right? If sites use this because it's easy to set up, then Cloudflare has done something good for the internet. Compared to the alternative, which is where they choose a product that loads up dark patterns to get users to accept cookies.
  - cuu508 3y ago
    > And if you have the popup, you might as well throw in Google Analytics etc as well, right? Google Analytics is problematic[1], consent or no consent, unless you send anonymized analytics events through your own proxy server. [1] Austria: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... France: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... Denmark: https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... Finland: https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-huomautuksen-kirjastojen-aineistohakutietojen-valittymisesta-yhdysvaltalaisyritys-googlelle?languageId=en_US https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-h... Norway: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/ https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va...
    - deleted 3y ago
      [deleted]
  - PeterisP 3y ago
    > You need a consent popup to embed YouTube or Twitter Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused (under GDPR consent inherently is opt-in, not opt-out; and consent is valid only if it is freely given, i.e. if you don't refuse service to those who refuse consent), and for that you don't necessarily need a popup, because you're free to assume that noone opts in to anything where a choice is provided - if you just treat everyone as if they clicked 'I refuse any optional consent', you don't need to ask that question.
- pprotas 3y ago
  I showed my (young, tech literate) friends once that you can just click “reject” and their minds were blown! You overestimate how much a regular internet user cares about cookies and had the knowledge to even know what they are.
- yoavm 3y ago
  Cloudflare Zaraz does much of that actually. First, you can set some tools to not require consent - it's not like "Reject all" === "No javascript". It's up to the website owner to classify the different scripts and tools to the appropriate consent purposes. Second, Cloudflare Zaraz actually offers many options for anonymizing your data, such as masking IP addresses, hiding referrer URLs, user-agent strings and more. See this: https://blog.cloudflare.com/zaraz-privacy-features-in-response-to-cnil/ https://blog.cloudflare.com/zaraz-privacy-features-in-respon...
  - gingerlime 3y ago
    This looks useful, but the problem related to CNIL etc is that CF is a US company so then it can be compelled to deanonymize the data. Wouldn’t this just kick the can down the road? IANAL but interested in this space.
    - yoavm 3y ago
      IANAL myself and I'm not sure either how it works, but technically Zaraz doesn't save your data at all, and you can set your website to only be handled by EU servers. We wrote about it here: https://blog.cloudflare.com/keep-analytics-tracking-data-in-the-eu-cloudflare-zaraz/ https://blog.cloudflare.com/keep-analytics-tracking-data-in-... Again, don't take this as a legal advice or anything like that - this is just to say we're doing everything we can to help users comply.
TekMol 3y ago
Is anybody here monetizing their web projects with Google Adsense? If so, how do you manage consent? I tried to build a simple modal that asks the user if they agree to ads+cookies, with a link to a privacy policy which explains that I use Adsense and a link to their privacy policy. And only loaded Adsense if the user agreeed. But Google never accepted that. They never gave an explanation why.
- Semaphor 3y ago
  Google (and the downstream ad publishers) requires the Transparency & Consent Framework (TCF) v2.0 and the corresponding information. That means specifically which purposes have been consented to (explicitly or implicitly via legitimate concern). It’s a bottomless hole you can look into, created by the ad industry to mostly keep doing things as before.
- corobo 3y ago
  Not Adsense but analytics I load up all the tracking guff bizdev and marketing want with Google Tag Manager. Tag Manager's code isn't output to the page at all until the user has opted in to 3rd party tracking cookies. I'd do the same with ads (on an advertising toggle rather than tracking) if I were using them.
- nixcraft 3y ago
  Check https://support.google.com/adsense/answer/10924669?hl=en https://support.google.com/adsense/answer/10924669?hl=en
sylware 3y ago
Namely it defaults to supporting noscript/basic (x)html browsers?
harry8 3y ago
Does cloudflare respect users? They don't even respect the intent of "do not track" enable it and you can do cloudflare captchas in an infinite loop which doesn't seem so respectful in my understanding of that word.
- Spivak 3y ago
  This actually sounds like respecting DNT. If a site turns on the captcha feature and you have DNT then anything they do to mark your session as "person who did the captcha" is tracking.
  - hendi_ 3y ago
    No, it's not. That's not what "tracking" means.
    - davidmurdoch 3y ago
      It is to some people.
- brookst 3y ago
  It's not meaningful to talk about a large company's opinions. It's entirely possible that some Cloudflare products respect users while others don't. Better to evaluate the merits of each product than to make a blanket judgment about the company and force your opinions of each product to confirm.
  - simplotek 3y ago
    > Better to evaluate the merits of each product than to make a blanket judgment about the company and force your opinions of each product to confirm. I think that the point is that Cloudflare's business model lies largely on its ability to monitor individual end users. So when Cloudflare announces they are providing a service whose primary selling point is that it affects their ability to monitor users then this sounds like a blatant contradiction. I also think that begging people to blindly trust corporations, specially when it's without any rationale or reason, is to say the least very silly.
kotaKat 3y ago
Hold on, Cloudflare building a tool that respects users? Checking to see if that statement is secure. refreshes Checking to see if that statement is secure. refreshes Checking to see if that statement is secure.
- deleted 3y ago
  [deleted]
- anaganisk 3y ago
  Cloudflare doesn't magically put itself between you and the website. They're like the NRA/gun manufacturer, they build the tools, the usage is Up to the websites. And most of the web admins are lazy or not knowledgeable or just smart to not want to deal with negative stuff that comes with hosting a website. So the question is, does the website you are visiting respect its users? Irony is some of the most popular, "file download" sites use cloudflare to protect themselves from scraping and spam too.
  - dghlsakjg 3y ago
    The NRA is a massive lobbying and political organization with a media producing propaganda arm. They don’t make guns, although they are supported by many gun manufacturers. I don’t think that’s a good analogy.
jacquesm 3y ago
I would love an option that allows me to set defaults for all websites that I visit. Such as to reject marketing and tracking cookies and other mechanisms used for that purpose globally and to allow me to fine tune functional stuff on a per-site basis.
- slig 3y ago
  This should've been a browser option since the beginning.
- miohtama 3y ago
  Mozilla has this for Firefox https://www.ghacks.net/2022/12/24/configure-firefox-to-reject-cookie-banners-automatically/ https://www.ghacks.net/2022/12/24/configure-firefox-to-rejec...
  - jacquesm 3y ago
    Of course that page just had to pop up a modal consent banner first...
    - celsoazevedo 3y ago
      I use "I still don't care about cookies": https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies Rejects/Hides/Accepts depending on the situation. Not ideal, but hides a lot of these messages.
      - bkor 3y ago
        I use Consent-O-Matic. You can configure how it should behave. By default it'll reject things. For the websites it doesn't support I often use reader mode.
      - notRobot 3y ago
        You can also use the Anoyances filter in uBlock Origin to hide all cookie banners.
donohoe 3y ago
Many folks here asking about ads, AdSense, etc… The issue with this and all consent mangers is always ads. It is impossible to know all the potential ad vendors, ad tech, and what other devices ads will load in advance. Googled consent framework, the IAB framework, etc, all fail to address this.
skrebbel 3y ago
Is there any jurisdiction where you actually need a visitor's permission to count pageview stats? Seems pretty far-fetched to me.
- OJFord 3y ago
  If you want to use some PII to avoid double-countint Ps you do.
  - 5Qn8mNbc2FNCiVV 3y ago
    You can (mostly) avoid double counting without PII. Track the page view and store in local state that you tracked for this day and that's it. I opted out not mentioning the caveats but that's what the mostly is there for. Obviously you should not keep any other information with the page view events as to not be able to relate other events with the page view but it's definitely doable
- kuba-orlik 3y ago
  The ePrivacy directive dictates that you need to have consent for cookies that are not strictly necessary to serve the website and its basic functionality. If you were counting pageview stats without persisting any data on the client and without using any identifiers for users, I'd say you don't have to ask for consent, even under GDPR.
  - skrebbel 3y ago
    I think you forgot a “don’t” in your first sentence. Agree btw, all these “basic functionality” cookie consent toggles are FUD by marketers who want to confuse you into giving up.
blibble 3y ago
you're still proxying through servers/systems controlled by a US corporation and the US is not considered to have adequate data protection laws under the GDPR
evntdrvn 3y ago
If anyone from CF is here, could you please add a standard “X to close” button (reject all) at the top right?
- josephg 3y ago
  Or similarly I'd love a "Only necessary cookies" button on the dialog box. It always feels like a scammy dark pattern for "accept cookies" to be one obvious click when rejecting advertising cookies is buried in a menu.
  - wongarsu 3y ago
    Isn't that just the "reject all" button in the provided screenshots? The dark pattern you describe is shown in the first screenshot as an example of what not to do: they say it "can at best be frustrating to users and at worst draw enforcement actions from regulators in a number of jurisdictions", which is a nice way to say it's annoying and illegal.
    - josephg 3y ago
      Ah my mistake - I just skimmed the article looking for examples of what their system looks like.
  - kuba-orlik 3y ago
    This consent manager does not interfere with necessary cookies. As under GDPR you don't need to ask for consent to necessary cookies, we left it out of the consent modal (Disclaimer: I'm on the team behind this feature)
- kuba-orlik 3y ago
  The problem with the "X" button is twofold: 1. It's usually hard to find and to touch on a mobile device 2. Many websites use the dark pattern where clicking "X" is actually a way to give consent (or so they claim, as such "consent" is not valid under the GDPR rules). Due to that, many users are habitually confused about what will happen to their data choices if they press "X". (Disclaimer: I'm on the team behind this feature)
JCWasmx86 3y ago
Does it respect DNT headers? If no, it does not respect users.
- yoavm 3y ago
  We decided to not support DNT because it's deprecated (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...) and often used for more tracking. We're looking to support Global Privacy Control when it's more mature.
snowstormsun 3y ago
What's the difference between "Reject All" and "Confirm My Choices" (with nothing ticked)? Could be a subtle dark pattern...
- yoavm 3y ago
  Why is that a dark pattern? "Reject all" and "Confirm my choices" without checking anything does the same (I'm on the team behind this). Edit: to be clear because this gets downvoted - when I'm saying "does the same", I mean both options will be treated as "I do not give consent".
  - JoshuaEN 3y ago
    I'm not sure it is a dark pattern, but at first glance (to me) it reads a bit like the "Allow all" and "Reject all" buttons just toggle the options, and then one needs to press "Confirm my choices", particularly on mobile with how the stack. The confusion would probably be quickly resolved when the dialog closed after clicking Reject all, but perhaps changing the wording of "Confirm my choices" to something like "Allow checked" would make it more clear it is a sibling of the other two buttons (and that checked means allowed).
  - secret-noun 3y ago
    No, this is confusing. Please iterate on this. Two buttons shouldn't do the same thing depending on state. I get it: the intent is that there's always a quick, one-click way to broadly consent/not consent. But with how this is designed, after clicking Accept All or Reject All, I'm left wondering what Confirm My Choices did. (Maybe it persists my consent on subsequent visits? I dunno.) Perhaps, "Confirm My Choices" (or better put, simply "Submit") stays, but change the "Accept All" and "Reject All" buttons to "Select All" and "Deselect All" buttons, respectively. These buttons should only serve to change the state of the checkboxes without submitting.
    - yoavm 3y ago
      We actually started with having "Select All", "Deselect All" and "Submit", but users complained about the two clicks flow, and so we changed. UX is hard. I tend to think that the one click flow serves users and respects their time more, even if it comes at the cost of having confusion about the difference between "Confirm my choices" and "Reject all". It's bad when consent managers confuse users between agreeing and disagreeing, but if we're making users confused between two good options, I personally think it's an okay price for a one click and you're done experience.
codegeek 3y ago
We are betting more on Cloudflare as a company lately. Our static website was just moved to Cloudflare Pages and it is working really well (we have over 200 Pages and counting). We were trying to figure out how to handle the Cookie/Consent stuff and this comes along. Would love to try and see how it works out. Btw, if you haven't tried, give Cloudflare pages a shot if you are looking for a no nonsense static website tool. Combine it with Cloudflare workers, you can add dynamic features as needed. I don't work for them but just a happy customer.
- rs_rs_rs_rs_rs 3y ago
  Try Cloudflare Pages but be aware of quirks. For example a deal breaker for me is not being able to setup multiple Pages projects from the same git repo.
  - codegeek 3y ago
    Yes. For us, this wasn't an issue since we want to keep 1 website with 1 git repo. The only thing that we are not figuring out is minification of JS/HTML/CSS yet and if cloudflare does that automatically in production.
  - lopkeny12ko 3y ago
    The dealbreaker for me is the hard 25 MB file size limit. If they raised this to something more reasonable (like 100 MB for parity with Github Pages) I'd migrate in a heartbeat.
syndacks 3y ago
Anyone know if this can be used as replacement for OneTrust?
- yoavm 3y ago
  Depending on your use case and configuration complexity, it can be used instead of OneTrust.
hammyhavoc 3y ago
Has anybody switched from Complianz on WordPress to this? Any thoughts?
jacooper 3y ago
Even though I'm wary of the centralization of the internet under cloudflare, I can't deny their products are awesome My rule of thumb is just never to use them as a proxy, CDN through R2, static pages etc are okay. Unfortunately Zaraz requires your website to be behind CF proxy. > And if you've ever clicked something other than Approve you'll have noticed that the list of choices about which services should or should not be allowed to use cookies can be very, very long. There should be a reject all button, right?
- madeofpalk 3y ago
  > Even though I'm wary of the centralization of the internet under cloudflare What's Clourflare's share? I would guess that Akamai delivers a lot more traffic, and they've been around for a whole lot longer and no one really cared.
  - jacooper 3y ago
    20% of webservers according to W3C
- yoavm 3y ago
  > Unfortunately Zaraz requires your website to be behind CF proxy. Zaraz doesn't actually require your website to be behind CF proxy, see this: https://developers.cloudflare.com/zaraz/advanced/domains-not-proxied/ https://developers.cloudflare.com/zaraz/advanced/domains-not... > There should be a reject all button, right? I could be wrong about this, but I _think_ that the definition is that it should be as easy to reject as it is to agree.
  - jacooper 3y ago
    This is great!
mhils 3y ago
Not supporting GPC (the DNT successor) directly contradicts the "respecting users" marketing fluff. I suspect the main reason why there is a "reject all" button is that Cloudflare folks rightly figured out that they are too big to get away with not providing one. Otherwise noyb.eu will say hello. OneTrust etc. are doing the same, there's nothing more user respecting about this solution. If Cloudflare is serious about privacy here, they should at least respect GPC and not provide customers with an option to disable it.
- yoavm 3y ago
  We are definitely planning to support GPC. I'm not sure how not supporting contradicts respecting users, considering that neither Chrome, Firefox nor Safari supports it (without enabling experimental flags). We really want to see GPC succeed, but we haven't prioritized supporting it because it doesn't seem like it's going to benefit many users, yet.
- kuba-orlik 3y ago
  > I suspect the main reason why there is a "reject all" button is that Cloudflare folks rightly figured out that they are too big to get away with not providing one. Otherwise noyb.eu will say hello. (Disclaimer: I helped deliver this feature) We have never even for a minute considered not providing the "reject all" button. It was a user-respecting project from its conception. We actually consider being user-friendly a competitive advantage rather than something that we'd do out of fear of Noyb. For some context, I'm a co-founder of https://www.internet-czas-dzialac.pl/ https://www.internet-czas-dzialac.pl/, which can be described as a "Polish noyb" ;)
time4tea 3y ago
How about just use cookies for strictly necessary purposes. Then you don't need to ask, and the Web will become better It's only because sites are jam-packed with spyware that all these horrendous popups are everywhere. If you need a complex consent manager, it's a signal that you're doing the wrong thing. Ads are not strictly necessary, nor visitor tracking, btw.

128 points by kuba-orlik 3y ago

That's nice, but Cloudflare seems to be missing the point. No consumer is going to say "oh, now that you've provided me such a streamlined tracking consent experience, I'll give you consent to track me across sites to show me personalized ads". They'll just click the "reject all" option you're legally compelled to give them. Also, the example includes a consent option for anonimized pageview counts data, which under GDPR you don't need consent for. An approach that would really respect user would be to store traffic analytics anonymously (in a way that resists trivial de-anonimization, so with binning and stuff), and throw away the rest. There, no consent popup needed.

creshal 3y ago
There's still enough people who do not understand the consequences and just click "accept all", because they fear their computer will catch on fire and murder their pets otherwise. Coincidentally, those people are also the most susceptible to advertisement-driven brain washing and least likely to understand what adblockers are.
- jnsaff2 3y ago
  I’ve seen hardcore developers telling others on calls to always click ‘accept all’ just because of the potential friction of an other click when rejecting. I don’t think they even had an adblocker in their Chrome.
  - anaganisk 3y ago
    Hardcore developers != A knowledge about the internet/how front end works. I don't think it's even a point to mention at all. I picked up programming 6 years before I got access to the internet, in 2015. Computing has developed so much these days, it's like expecting a Neuro to be your Oncologist. They may know basically how stuff works, but not everything related to a computer.
    - jnsaff2 3y ago
      Sure. It’s just that if developers (just adding these were web devs) don’t know or care then for the common folks this might be completely hopeless.
- Semaphor 3y ago
  Or use an extension that does "accept all" for them, like I don’t care about cookies.
lozenge 3y ago
You need a consent popup to embed YouTube or Twitter or any ad platform. And if you have the popup, you might as well throw in Google Analytics etc as well, right? If sites use this because it's easy to set up, then Cloudflare has done something good for the internet. Compared to the alternative, which is where they choose a product that loads up dark patterns to get users to accept cookies.
- cuu508 3y ago
  > And if you have the popup, you might as well throw in Google Analytics etc as well, right? Google Analytics is problematic[1], consent or no consent, unless you send anonymized analytics events through your own proxy server. [1] Austria: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... France: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... Denmark: https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... Finland: https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-huomautuksen-kirjastojen-aineistohakutietojen-valittymisesta-yhdysvaltalaisyritys-googlelle?languageId=en_US https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-h... Norway: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/ https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va...
  - deleted 3y ago
    [deleted]
- PeterisP 3y ago
  > You need a consent popup to embed YouTube or Twitter Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused (under GDPR consent inherently is opt-in, not opt-out; and consent is valid only if it is freely given, i.e. if you don't refuse service to those who refuse consent), and for that you don't necessarily need a popup, because you're free to assume that noone opts in to anything where a choice is provided - if you just treat everyone as if they clicked 'I refuse any optional consent', you don't need to ask that question.
pprotas 3y ago
I showed my (young, tech literate) friends once that you can just click “reject” and their minds were blown! You overestimate how much a regular internet user cares about cookies and had the knowledge to even know what they are.
yoavm 3y ago
Cloudflare Zaraz does much of that actually. First, you can set some tools to not require consent - it's not like "Reject all" === "No javascript". It's up to the website owner to classify the different scripts and tools to the appropriate consent purposes. Second, Cloudflare Zaraz actually offers many options for anonymizing your data, such as masking IP addresses, hiding referrer URLs, user-agent strings and more. See this: https://blog.cloudflare.com/zaraz-privacy-features-in-response-to-cnil/ https://blog.cloudflare.com/zaraz-privacy-features-in-respon...
- gingerlime 3y ago
  This looks useful, but the problem related to CNIL etc is that CF is a US company so then it can be compelled to deanonymize the data. Wouldn’t this just kick the can down the road? IANAL but interested in this space.
  - yoavm 3y ago
    IANAL myself and I'm not sure either how it works, but technically Zaraz doesn't save your data at all, and you can set your website to only be handled by EU servers. We wrote about it here: https://blog.cloudflare.com/keep-analytics-tracking-data-in-the-eu-cloudflare-zaraz/ https://blog.cloudflare.com/keep-analytics-tracking-data-in-... Again, don't take this as a legal advice or anything like that - this is just to say we're doing everything we can to help users comply.

TekMol 3y ago

Is anybody here monetizing their web projects with Google Adsense? If so, how do you manage consent? I tried to build a simple modal that asks the user if they agree to ads+cookies, with a link to a privacy policy which explains that I use Adsense and a link to their privacy policy. And only loaded Adsense if the user agreeed. But Google never accepted that. They never gave an explanation why.

Semaphor 3y ago
Google (and the downstream ad publishers) requires the Transparency & Consent Framework (TCF) v2.0 and the corresponding information. That means specifically which purposes have been consented to (explicitly or implicitly via legitimate concern). It’s a bottomless hole you can look into, created by the ad industry to mostly keep doing things as before.
corobo 3y ago
Not Adsense but analytics I load up all the tracking guff bizdev and marketing want with Google Tag Manager. Tag Manager's code isn't output to the page at all until the user has opted in to 3rd party tracking cookies. I'd do the same with ads (on an advertising toggle rather than tracking) if I were using them.
nixcraft 3y ago
Check https://support.google.com/adsense/answer/10924669?hl=en https://support.google.com/adsense/answer/10924669?hl=en

sylware 3y ago

Namely it defaults to supporting noscript/basic (x)html browsers?

harry8 3y ago

Does cloudflare respect users? They don't even respect the intent of "do not track" enable it and you can do cloudflare captchas in an infinite loop which doesn't seem so respectful in my understanding of that word.

Spivak 3y ago
This actually sounds like respecting DNT. If a site turns on the captcha feature and you have DNT then anything they do to mark your session as "person who did the captcha" is tracking.
- hendi_ 3y ago
  No, it's not. That's not what "tracking" means.
  - davidmurdoch 3y ago
    It is to some people.
brookst 3y ago
It's not meaningful to talk about a large company's opinions. It's entirely possible that some Cloudflare products respect users while others don't. Better to evaluate the merits of each product than to make a blanket judgment about the company and force your opinions of each product to confirm.
- simplotek 3y ago
  > Better to evaluate the merits of each product than to make a blanket judgment about the company and force your opinions of each product to confirm. I think that the point is that Cloudflare's business model lies largely on its ability to monitor individual end users. So when Cloudflare announces they are providing a service whose primary selling point is that it affects their ability to monitor users then this sounds like a blatant contradiction. I also think that begging people to blindly trust corporations, specially when it's without any rationale or reason, is to say the least very silly.

kotaKat 3y ago

Hold on, Cloudflare building a tool that respects users? Checking to see if that statement is secure. refreshes Checking to see if that statement is secure. refreshes Checking to see if that statement is secure.

deleted 3y ago
[deleted]
anaganisk 3y ago
Cloudflare doesn't magically put itself between you and the website. They're like the NRA/gun manufacturer, they build the tools, the usage is Up to the websites. And most of the web admins are lazy or not knowledgeable or just smart to not want to deal with negative stuff that comes with hosting a website. So the question is, does the website you are visiting respect its users? Irony is some of the most popular, "file download" sites use cloudflare to protect themselves from scraping and spam too.
- dghlsakjg 3y ago
  The NRA is a massive lobbying and political organization with a media producing propaganda arm. They don’t make guns, although they are supported by many gun manufacturers. I don’t think that’s a good analogy.

jacquesm 3y ago

I would love an option that allows me to set defaults for all websites that I visit. Such as to reject marketing and tracking cookies and other mechanisms used for that purpose globally and to allow me to fine tune functional stuff on a per-site basis.

slig 3y ago
This should've been a browser option since the beginning.
miohtama 3y ago
Mozilla has this for Firefox https://www.ghacks.net/2022/12/24/configure-firefox-to-reject-cookie-banners-automatically/ https://www.ghacks.net/2022/12/24/configure-firefox-to-rejec...
- jacquesm 3y ago
  Of course that page just had to pop up a modal consent banner first...
  - celsoazevedo 3y ago
    I use "I still don't care about cookies": https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies Rejects/Hides/Accepts depending on the situation. Not ideal, but hides a lot of these messages.
    - bkor 3y ago
      I use Consent-O-Matic. You can configure how it should behave. By default it'll reject things. For the websites it doesn't support I often use reader mode.
    - notRobot 3y ago
      You can also use the Anoyances filter in uBlock Origin to hide all cookie banners.

donohoe 3y ago

Many folks here asking about ads, AdSense, etc… The issue with this and all consent mangers is always ads. It is impossible to know all the potential ad vendors, ad tech, and what other devices ads will load in advance. Googled consent framework, the IAB framework, etc, all fail to address this.

skrebbel 3y ago

Is there any jurisdiction where you actually need a visitor's permission to count pageview stats? Seems pretty far-fetched to me.

OJFord 3y ago
If you want to use some PII to avoid double-countint Ps you do.
- 5Qn8mNbc2FNCiVV 3y ago
  You can (mostly) avoid double counting without PII. Track the page view and store in local state that you tracked for this day and that's it. I opted out not mentioning the caveats but that's what the mostly is there for. Obviously you should not keep any other information with the page view events as to not be able to relate other events with the page view but it's definitely doable
kuba-orlik 3y ago
The ePrivacy directive dictates that you need to have consent for cookies that are not strictly necessary to serve the website and its basic functionality. If you were counting pageview stats without persisting any data on the client and without using any identifiers for users, I'd say you don't have to ask for consent, even under GDPR.
- skrebbel 3y ago
  I think you forgot a “don’t” in your first sentence. Agree btw, all these “basic functionality” cookie consent toggles are FUD by marketers who want to confuse you into giving up.

blibble 3y ago

you're still proxying through servers/systems controlled by a US corporation and the US is not considered to have adequate data protection laws under the GDPR

evntdrvn 3y ago

If anyone from CF is here, could you please add a standard “X to close” button (reject all) at the top right?

josephg 3y ago
Or similarly I'd love a "Only necessary cookies" button on the dialog box. It always feels like a scammy dark pattern for "accept cookies" to be one obvious click when rejecting advertising cookies is buried in a menu.
- wongarsu 3y ago
  Isn't that just the "reject all" button in the provided screenshots? The dark pattern you describe is shown in the first screenshot as an example of what not to do: they say it "can at best be frustrating to users and at worst draw enforcement actions from regulators in a number of jurisdictions", which is a nice way to say it's annoying and illegal.
  - josephg 3y ago
    Ah my mistake - I just skimmed the article looking for examples of what their system looks like.
- kuba-orlik 3y ago
  This consent manager does not interfere with necessary cookies. As under GDPR you don't need to ask for consent to necessary cookies, we left it out of the consent modal (Disclaimer: I'm on the team behind this feature)
kuba-orlik 3y ago
The problem with the "X" button is twofold: 1. It's usually hard to find and to touch on a mobile device 2. Many websites use the dark pattern where clicking "X" is actually a way to give consent (or so they claim, as such "consent" is not valid under the GDPR rules). Due to that, many users are habitually confused about what will happen to their data choices if they press "X". (Disclaimer: I'm on the team behind this feature)

JCWasmx86 3y ago

Does it respect DNT headers? If no, it does not respect users.

yoavm 3y ago
We decided to not support DNT because it's deprecated (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...) and often used for more tracking. We're looking to support Global Privacy Control when it's more mature.

snowstormsun 3y ago

What's the difference between "Reject All" and "Confirm My Choices" (with nothing ticked)? Could be a subtle dark pattern...

yoavm 3y ago
Why is that a dark pattern? "Reject all" and "Confirm my choices" without checking anything does the same (I'm on the team behind this). Edit: to be clear because this gets downvoted - when I'm saying "does the same", I mean both options will be treated as "I do not give consent".
- JoshuaEN 3y ago
  I'm not sure it is a dark pattern, but at first glance (to me) it reads a bit like the "Allow all" and "Reject all" buttons just toggle the options, and then one needs to press "Confirm my choices", particularly on mobile with how the stack. The confusion would probably be quickly resolved when the dialog closed after clicking Reject all, but perhaps changing the wording of "Confirm my choices" to something like "Allow checked" would make it more clear it is a sibling of the other two buttons (and that checked means allowed).
- secret-noun 3y ago
  No, this is confusing. Please iterate on this. Two buttons shouldn't do the same thing depending on state. I get it: the intent is that there's always a quick, one-click way to broadly consent/not consent. But with how this is designed, after clicking Accept All or Reject All, I'm left wondering what Confirm My Choices did. (Maybe it persists my consent on subsequent visits? I dunno.) Perhaps, "Confirm My Choices" (or better put, simply "Submit") stays, but change the "Accept All" and "Reject All" buttons to "Select All" and "Deselect All" buttons, respectively. These buttons should only serve to change the state of the checkboxes without submitting.
  - yoavm 3y ago
    We actually started with having "Select All", "Deselect All" and "Submit", but users complained about the two clicks flow, and so we changed. UX is hard. I tend to think that the one click flow serves users and respects their time more, even if it comes at the cost of having confusion about the difference between "Confirm my choices" and "Reject all". It's bad when consent managers confuse users between agreeing and disagreeing, but if we're making users confused between two good options, I personally think it's an okay price for a one click and you're done experience.

codegeek 3y ago

We are betting more on Cloudflare as a company lately. Our static website was just moved to Cloudflare Pages and it is working really well (we have over 200 Pages and counting). We were trying to figure out how to handle the Cookie/Consent stuff and this comes along. Would love to try and see how it works out. Btw, if you haven't tried, give Cloudflare pages a shot if you are looking for a no nonsense static website tool. Combine it with Cloudflare workers, you can add dynamic features as needed. I don't work for them but just a happy customer.

rs_rs_rs_rs_rs 3y ago
Try Cloudflare Pages but be aware of quirks. For example a deal breaker for me is not being able to setup multiple Pages projects from the same git repo.
- codegeek 3y ago
  Yes. For us, this wasn't an issue since we want to keep 1 website with 1 git repo. The only thing that we are not figuring out is minification of JS/HTML/CSS yet and if cloudflare does that automatically in production.
- lopkeny12ko 3y ago
  The dealbreaker for me is the hard 25 MB file size limit. If they raised this to something more reasonable (like 100 MB for parity with Github Pages) I'd migrate in a heartbeat.

syndacks 3y ago

Anyone know if this can be used as replacement for OneTrust?

yoavm 3y ago
Depending on your use case and configuration complexity, it can be used instead of OneTrust.

hammyhavoc 3y ago

Has anybody switched from Complianz on WordPress to this? Any thoughts?

jacooper 3y ago

Even though I'm wary of the centralization of the internet under cloudflare, I can't deny their products are awesome My rule of thumb is just never to use them as a proxy, CDN through R2, static pages etc are okay. Unfortunately Zaraz requires your website to be behind CF proxy. > And if you've ever clicked something other than Approve you'll have noticed that the list of choices about which services should or should not be allowed to use cookies can be very, very long. There should be a reject all button, right?

madeofpalk 3y ago
> Even though I'm wary of the centralization of the internet under cloudflare What's Clourflare's share? I would guess that Akamai delivers a lot more traffic, and they've been around for a whole lot longer and no one really cared.
- jacooper 3y ago
  20% of webservers according to W3C
yoavm 3y ago
> Unfortunately Zaraz requires your website to be behind CF proxy. Zaraz doesn't actually require your website to be behind CF proxy, see this: https://developers.cloudflare.com/zaraz/advanced/domains-not-proxied/ https://developers.cloudflare.com/zaraz/advanced/domains-not... > There should be a reject all button, right? I could be wrong about this, but I _think_ that the definition is that it should be as easy to reject as it is to agree.
- jacooper 3y ago
  This is great!

mhils 3y ago

Not supporting GPC (the DNT successor) directly contradicts the "respecting users" marketing fluff. I suspect the main reason why there is a "reject all" button is that Cloudflare folks rightly figured out that they are too big to get away with not providing one. Otherwise noyb.eu will say hello. OneTrust etc. are doing the same, there's nothing more user respecting about this solution. If Cloudflare is serious about privacy here, they should at least respect GPC and not provide customers with an option to disable it.

yoavm 3y ago
We are definitely planning to support GPC. I'm not sure how not supporting contradicts respecting users, considering that neither Chrome, Firefox nor Safari supports it (without enabling experimental flags). We really want to see GPC succeed, but we haven't prioritized supporting it because it doesn't seem like it's going to benefit many users, yet.
kuba-orlik 3y ago
> I suspect the main reason why there is a "reject all" button is that Cloudflare folks rightly figured out that they are too big to get away with not providing one. Otherwise noyb.eu will say hello. (Disclaimer: I helped deliver this feature) We have never even for a minute considered not providing the "reject all" button. It was a user-respecting project from its conception. We actually consider being user-friendly a competitive advantage rather than something that we'd do out of fear of Noyb. For some context, I'm a co-founder of https://www.internet-czas-dzialac.pl/ https://www.internet-czas-dzialac.pl/, which can be described as a "Polish noyb" ;)

time4tea 3y ago

How about just use cookies for strictly necessary purposes. Then you don't need to ask, and the Web will become better It's only because sites are jam-packed with spyware that all these horrendous popups are everywhere. If you need a complex consent manager, it's a signal that you're doing the wrong thing. Ads are not strictly necessary, nor visitor tracking, btw.