26 ms·

That's nice, but Cloudflare seems to be missing the point. No consumer is going to say "oh, now that you've provided me such a streamlined tracking consent exp

That's nice, but Cloudflare seems to be missing the point. No consumer is going to say "oh, now that you've provided me such a streamlined tracking consent experience, I'll give you consent to track me across sites to show me personalized ads". They'll just click the "reject all" option you're legally compelled to give them. Also, the example includes a consent option for anonimized pageview counts data, which under GDPR you don't need consent for. An approach that would really respect user would be to store traffic analytics anonymously (in a way that resists trivial de-anonimization, so with binning and stuff), and throw away the rest. There, no consent popup needed.

creshal 4y ago
There's still enough people who do not understand the consequences and just click "accept all", because they fear their computer will catch on fire and murder their pets otherwise. Coincidentally, those people are also the most susceptible to advertisement-driven brain washing and least likely to understand what adblockers are.
- jnsaff2 4y ago
  I’ve seen hardcore developers telling others on calls to always click ‘accept all’ just because of the potential friction of an other click when rejecting. I don’t think they even had an adblocker in their Chrome.
  - anaganisk 4y ago
    Hardcore developers != A knowledge about the internet/how front end works. I don't think it's even a point to mention at all. I picked up programming 6 years before I got access to the internet, in 2015. Computing has developed so much these days, it's like expecting a Neuro to be your Oncologist. They may know basically how stuff works, but not everything related to a computer.
    - jnsaff2 4y ago
      Sure. It’s just that if developers (just adding these were web devs) don’t know or care then for the common folks this might be completely hopeless.
- Semaphor 4y ago
  Or use an extension that does "accept all" for them, like I don’t care about cookies.
lozenge 4y ago
You need a consent popup to embed YouTube or Twitter or any ad platform. And if you have the popup, you might as well throw in Google Analytics etc as well, right? If sites use this because it's easy to set up, then Cloudflare has done something good for the internet. Compared to the alternative, which is where they choose a product that loads up dark patterns to get users to accept cookies.
- cuu508 4y ago
  > And if you have the popup, you might as well throw in Google Analytics etc as well, right? Google Analytics is problematic[1], consent or no consent, unless you send anonymized analytics events through your own proxy server. [1] Austria: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... France: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... Denmark: https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... Finland: https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-huomautuksen-kirjastojen-aineistohakutietojen-valittymisesta-yhdysvaltalaisyritys-googlelle?languageId=en_US https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-h... Norway: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/ https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va...
  - deleted 4y ago
    [deleted]
- PeterisP 4y ago
  > You need a consent popup to embed YouTube or Twitter Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused (under GDPR consent inherently is opt-in, not opt-out; and consent is valid only if it is freely given, i.e. if you don't refuse service to those who refuse consent), and for that you don't necessarily need a popup, because you're free to assume that noone opts in to anything where a choice is provided - if you just treat everyone as if they clicked 'I refuse any optional consent', you don't need to ask that question.
pprotas 4y ago
I showed my (young, tech literate) friends once that you can just click “reject” and their minds were blown! You overestimate how much a regular internet user cares about cookies and had the knowledge to even know what they are.
yoavm 4y ago
Cloudflare Zaraz does much of that actually. First, you can set some tools to not require consent - it's not like "Reject all" === "No javascript". It's up to the website owner to classify the different scripts and tools to the appropriate consent purposes. Second, Cloudflare Zaraz actually offers many options for anonymizing your data, such as masking IP addresses, hiding referrer URLs, user-agent strings and more. See this: https://blog.cloudflare.com/zaraz-privacy-features-in-response-to-cnil/ https://blog.cloudflare.com/zaraz-privacy-features-in-respon...
- gingerlime 4y ago
  This looks useful, but the problem related to CNIL etc is that CF is a US company so then it can be compelled to deanonymize the data. Wouldn’t this just kick the can down the road? IANAL but interested in this space.
  - yoavm 4y ago
    IANAL myself and I'm not sure either how it works, but technically Zaraz doesn't save your data at all, and you can set your website to only be handled by EU servers. We wrote about it here: https://blog.cloudflare.com/keep-analytics-tracking-data-in-the-eu-cloudflare-zaraz/ https://blog.cloudflare.com/keep-analytics-tracking-data-in-... Again, don't take this as a legal advice or anything like that - this is just to say we're doing everything we can to help users comply.

creshal 4y ago

There's still enough people who do not understand the consequences and just click "accept all", because they fear their computer will catch on fire and murder their pets otherwise. Coincidentally, those people are also the most susceptible to advertisement-driven brain washing and least likely to understand what adblockers are.

jnsaff2 4y ago
I’ve seen hardcore developers telling others on calls to always click ‘accept all’ just because of the potential friction of an other click when rejecting. I don’t think they even had an adblocker in their Chrome.
- anaganisk 4y ago
  Hardcore developers != A knowledge about the internet/how front end works. I don't think it's even a point to mention at all. I picked up programming 6 years before I got access to the internet, in 2015. Computing has developed so much these days, it's like expecting a Neuro to be your Oncologist. They may know basically how stuff works, but not everything related to a computer.
  - jnsaff2 4y ago
    Sure. It’s just that if developers (just adding these were web devs) don’t know or care then for the common folks this might be completely hopeless.
Semaphor 4y ago
Or use an extension that does "accept all" for them, like I don’t care about cookies.

lozenge 4y ago

You need a consent popup to embed YouTube or Twitter or any ad platform. And if you have the popup, you might as well throw in Google Analytics etc as well, right? If sites use this because it's easy to set up, then Cloudflare has done something good for the internet. Compared to the alternative, which is where they choose a product that loads up dark patterns to get users to accept cookies.

cuu508 4y ago
> And if you have the popup, you might as well throw in Google Analytics etc as well, right? Google Analytics is problematic[1], consent or no consent, unless you send anonymized analytics events through your own proxy server. [1] Austria: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... France: https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr https://www.cnil.fr/en/google-analytics-and-data-transfers-h... Denmark: https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... Finland: https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-huomautuksen-kirjastojen-aineistohakutietojen-valittymisesta-yhdysvaltalaisyritys-googlelle?languageId=en_US https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-h... Norway: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/ https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va...
- deleted 4y ago
  [deleted]
PeterisP 4y ago
> You need a consent popup to embed YouTube or Twitter Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused (under GDPR consent inherently is opt-in, not opt-out; and consent is valid only if it is freely given, i.e. if you don't refuse service to those who refuse consent), and for that you don't necessarily need a popup, because you're free to assume that noone opts in to anything where a choice is provided - if you just treat everyone as if they clicked 'I refuse any optional consent', you don't need to ask that question.

pprotas 4y ago

I showed my (young, tech literate) friends once that you can just click “reject” and their minds were blown! You overestimate how much a regular internet user cares about cookies and had the knowledge to even know what they are.

yoavm 4y ago

Cloudflare Zaraz does much of that actually. First, you can set some tools to not require consent - it's not like "Reject all" === "No javascript". It's up to the website owner to classify the different scripts and tools to the appropriate consent purposes. Second, Cloudflare Zaraz actually offers many options for anonymizing your data, such as masking IP addresses, hiding referrer URLs, user-agent strings and more. See this: https://blog.cloudflare.com/zaraz-privacy-features-in-response-to-cnil/ https://blog.cloudflare.com/zaraz-privacy-features-in-respon...

gingerlime 4y ago
This looks useful, but the problem related to CNIL etc is that CF is a US company so then it can be compelled to deanonymize the data. Wouldn’t this just kick the can down the road? IANAL but interested in this space.
- yoavm 4y ago
  IANAL myself and I'm not sure either how it works, but technically Zaraz doesn't save your data at all, and you can set your website to only be handled by EU servers. We wrote about it here: https://blog.cloudflare.com/keep-analytics-tracking-data-in-the-eu-cloudflare-zaraz/ https://blog.cloudflare.com/keep-analytics-tracking-data-in-... Again, don't take this as a legal advice or anything like that - this is just to say we're doing everything we can to help users comply.