43 ms·

Who wants to be tracked?

189 points by jhpacker 3y ago

comprev 3y ago
They exist because they’re required to through applicable laws. The companies want tracking for additional business data and very rarely actually are about the users.
jonathanstrange 3y ago
So you can accidentally click them.
Gys 3y ago
Because they also want everything for free.
- hourago 3y ago
  > Because they also want everything for free. Maybe people just goes to the cheaper option available because increasing inequality has left millions with no disposable income. This is the same logic by which people prefers cheap furniture instead of high quality one. It is not a preference for cheap but it is just what they can afford, if they had more money most people will get the higher quality version and pay the price.
  - Gys 3y ago
    > Maybe people just goes to the cheaper option available because increasing inequality has left millions with no disposable income. No disposable income would mean not being able to spend money, meaning never buy anything. If this was true the ad industry would very quickly run bankrupt. And yet the revenues of Google and Facebook indicate otherwise.
    - hiatus 3y ago
      Even without disposable income, advertising can still lead to people choosing alternatives and directing their spend someplace else, so your conclusion does not follow. If someone is maxing out their income they can still be advertised to to get them to switch consumption habits.
BiteCode_dev 3y ago
Because in a society that is optimized for profit, it's not about people, it's about what you can get away with for money.
- eru 3y ago
  Alas, our society ain't optimised for profit.
gitgud 3y ago
“We value your privacy” is a very hollow statement, when the website is asking to track you…
- mjhagen 3y ago
  “But, not as much as our bottom line.”
- MaxikCZ 3y ago
  They value it, in exact amount of money.
  - etiam 3y ago
    "... at about 20¢" is how I usually read the implied part.
- devoutsalsa 3y ago
  We value your privacy because we can sell it!
- quickthrower2 3y ago
  Followed by [Accept all tracking] [Ritual Hazing]
s1k3s 3y ago
I don't know how the experience is in US, but in EU it's because GDPR is a complete failure of a law which doesn't actually solve any problem.
- hbossy 3y ago
  It solved my problems with exporting data from proprietary webapps such as spotify.
- kuschku 3y ago
  GDPR takes quite a while to get results, but even Google now has a "deny all tracking" button.
- newswasboring 3y ago
  GDPR is the law which at least gave us these prompts. Before that there was no rules for consent, they would just track you.
  - eska 3y ago
    There was a law just for cookies before. And no, companies don’t need to put up these prompts, IF they don’t do any UNNECESSARY tracking.
    - jruohonen 3y ago
      Cookies belong to the e-privacy directive.
    - newswasboring 3y ago
      I'm with you, these prompts are garbage. But they are better than no prompts, because companies are greedy af and they will track. Fixing that is a much larger issue than the bandaid of law.
- eska 3y ago
  What makes you think so? I’ve seen a lot of good come from it.
barbs 3y ago
Is there a browser extension to turn these off?
- MaxikCZ 3y ago
  uBlock origin with appropriate filter turner on.
  - BoxOfRain 3y ago
    This is what I do, it's pretty effective.
  - kruuuder 3y ago
    You still have to find filter lists that work though. I use uBlock origin and frequently run into problems where cookie popups are half-blocked - the dialog is no longer visible, but I still cannot interact with or scroll the website. To work around that, I have to deactivate uBlock's cosmetic filters so that I can see the dialog again, then deny cookies. Pretty annoying, I haven't found a setup that fixes that.
    - chrismorgan 3y ago
      Most of the time I have JavaScript disabled as well (only for specific sites and in Private Browsing windows do I have it enabled), which will slightly confound this anecdote, but I believe it was mid-2020 when I last encountered a site that uBlock Origin plus cookie-banner-blocking lists broke the page in the way you describe, and only ever a very few times before that.
    - MaxikCZ 3y ago
      Extension named something like Behind The Overlay fixes similar cases for me, it gets rid of anything overlaying the page blocking inputs. Exceptionally effective
  - nickthegreek 3y ago
    Which filter helps with this?
isoprophlex 3y ago
94% don't want tracking... and the remainder 6% of responses can be attributed to the lizardman constant https://gwern.net/note/lizardman https://gwern.net/note/lizardman
- quickthrower2 3y ago
  Heard this called flatlining. I.e. answer all "mostly agree" or whatever.
  - gwern 3y ago
    'acquiescence bias' is real but a different thing. Mischievous responders will flip their answer as necessary to screw with you, they don't just 'go down the line', so you can't simply reverse-code or use other such tricks.
- brookst 3y ago
  I wonder what percentages you'd get if you asked "do you want to eat for free at every restaurant?" My guess is about the same 94% / 6%. But I'm not sure it's the 6% that represents lizardman.
lawn 3y ago
Because companies prefer to track them?
ajsnigrutin 3y ago
Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it. Block third party cookies by default, delete other cookies on the last tab or window closed and prompt user to save cookies on a form submit ("do not delete cookies for this domain when leaving" type of prompt, for pages with logins, settings, etc). Also remove features that make easy fingerprinting possible, the site doesn't need to know every font I have installed, just have a "standard set" included with the browser, and use web fonts or whatever for other fonts.
- quickthrower2 3y ago
  The last thing a browser wants to do is break experience for older sites. If a site relies on 3rd party cookies for log in, it will no longer work on your browser. It makes your browser look shit. Same reason we allow unclosed tags, crossed tags, etc.
  - pavlov 3y ago
    Browsers already detect login forms to offer autocompletion and password storage. Surely it wouldn’t be insurmountable to detect cookies being set after a login flow, and let users confirm that they want this login to persist.
  - ajsnigrutin 3y ago
    We also had shockwave flash, blink tags, keygen tags for cert generation, etc., so yeah, we can change stuff if we need it. But since the biggest browser is owned by an ad company that earns money by tracking us, this will probably never happen. An alternative would be to have a cookie jar per domain.
  - ssdspoimdsjvv 3y ago
    Is this really different from disabling JavaScript, which will also break the majority of sites?
  - lloeki 3y ago
    Safari and Firefox block 3rd party cookies by default.
TekMol 3y ago
I have switched one of my sites to cookieless analytics and it is bad for everybody. I can't even say how many users this site has now. It could be the same user coming back over and over. Or many users. How would I know. Yes, I could track a ton of stats about every pageview like user agent, screen resolution etc and then try to stitch it back together. Trying to figure out how many different users there are. But this type of "stitching together" would probably also count as PII. I cannot test new features and see if it makes users happy so they come back more often. I cannot see if the site has issues on some hardware, software, language. Because I wouldn't see if users affected come back less often. I can't test if an introduction text at the beginning helps users discover important features. Because I can't make the connection between showing the text early on in the user journey and usage of features later on. Because I can't see a user journey. This is a site I run for the enjoyment of me and the other users. Probably a few thousand a month. And I can say the site was much easier to develop with a normal cookie approach to tracking. I have gone the cookieless way for about a year now. And I can say with certainty that it would be a better site now if I kept the cookie approach. When the developer flies blind, that's bad for everybody. I think for a commercial site, where a degradation of 10% in user experience can tank the business, there is no way around cookie tracking to figure out what works for users and what doesn't. This is another reason, why European internet companies do not stand a snowball's chance in hell to compete with their US competitors. European companies need to bug all users and beg for cookies. While US companies only need to do that with their European users.
- pelorat 3y ago
  Why would you need to know anything but hits/month and ad-revenue/month? Why don't you just hash the IP-address and count unique users that way?
  - kmlx 3y ago
    that's easy: to improve the service.
    - austinjp 3y ago
tourgen 3y ago
[dead]
Haga 3y ago
[dead]
phendrenad2 3y ago
94% of people want me to be president. Caveat: I did not define what it means for them to want me to be president. In other words, what does it mean to be "tracked"? How was the question worded? You can change this value from 1% all the way up to 99% depending on how you ask the question, because "being tracked" is open to interpretation. Truly a useless poll.
- jhpacker 3y ago
  Hi, the exact wording on the poll was "If given the option, I would prefer not to be tracked online." The reason why I didn't define "tracked" for the people taking the poll is that I think that's the most representative way to replicate the question that consent boxes are theoretical asking, but in an abstract way out of the context of a specific website. When a user sees that consent box, they have little to no idea of what tracking is actually happening.
  - phendrenad2 3y ago
    Hmm, I guess that's a good rationale, but unfortunately it's still useless. I believe that websites adopted the simplistic "don't track me" language because they want to appear to be embracing the law. I've asked a lot of people (> 100) what it means to them to be "tracked" and they have no idea what it means, but they're afraid of whatever it means.
sundvor 3y ago
Related: 99.999% of users don't read T&C's, so why do consent checkboxes exist? (I made the number up, but I'd be very surprised if I am off by magnitudes).
gsatic 3y ago
Cause the prob being solved by search rankings, newsfeeds, maps etc is info overload. People forget that all the time. There is too much info out there. Context about the user shrinks the ever growing info sphere.
arendtio 3y ago
Does someone know why it is legal that in some countries websites are allowed to offer layers that offer a paid version and a tracking enabled version (very popular among newspapers)? As far as I understand the GDPR, there should be no downside to rejecting the tracking technologies. And Websites relying on advertising, could do so with unpersonalized ads (granted with very different metrics). Nevertheless, to me it feels, like these paid vs tracked offers are not what the authors of the GDPR intended.
- tpxl 3y ago
  You mustn't reject service based on refusal of non-legitimate-reason data processing consent. Allowing paying to not have ads is orthogonal to the service being provided - in both cases the user gets the news, it's just flanked by ads in one case.
  - arendtio 3y ago
    Well, I don't have a problem with the paid version. What I have have a problem with, is the refusal of service if I don't consent to being tracked. So if there would be three versions, like 'personalized ads with tracking', 'tracking-free/unpersonalized ads' and 'paid ad-free', that would be fine with me. What I don't understand, is that it is okay to refuse the service if you don't consent for the ad-supported tracking version. I mean, not giving your consent, means you have to pay if you want to use the service. Doesn't feel like you have a free choice (pun intended).
    - layer8 3y ago
      I believe it’s for the same reason that a pay-only service is legal.
    - tpxl 3y ago
      Sorry, I misread your comment. It's not OK to refuse service if you refuse tracking. Paid service or ads without tracking is OK. Paid service with no free alternative is OK - you didn't refuse service based on refusing tracking, you refused it based on non-payment. Paid service or tracking is not OK.
kasperni 3y ago
My main problem is cross website tracking. I don't really have a problem with a website keeping track of all my visits to that particular website. I think it works similar in real life as well. You don't mind if a store clerk recognises you coming back to a shop. But you would be kind of creeped out if he also knew where and when you last visited your dentist.
- Ekaros 3y ago
  I'm fine with them keeping my purchase history for example. And then maybe even sending me offers based on that. Now tracking what I viewed or browsed on their site get bit harder. And sharing with anyone else is right out.
charcircuit 3y ago
This is a misleading statistic. Most people will not care if I implemented a view counter on my website that uses a cookie to prevent the same user as counting as multiple views.
- jhpacker 3y ago
  I agree that most people would not mind that scenario, the issue is that that scenario requires the same consent box that the most invasive adtech would use and it's far too onerous on the user as things are now to discern the difference.
dalbasal 3y ago
The model of regulation-compliance is this. It's not really about the specifics. Consent, privacy, kyc... Those may be initial motives for regulation, but by the time these exist in the world, they are a set of standard, rigid "compliance" protocols. From formulation stage, it allows two parallel realities. One in which "consent" or whatnot have an intuitive meaning. Politicians and activists live here. One in which "consent" is a specification for a compliant "3rd party solution." Businesses live here. Once functional, the bank, website or other complying business can claim the rules were made up by the regulator, and the regulator can either claim to be successful or blame businesses for problems. Being unremarkable, by copying or using 3rd party comliance plugins is more important than respecting the regulation's intent. By the time consumers are affected, "consent" has a technical specification. It no longer has much actual meaning. Think of the hoops, paperwork, informed consent signatures and such that you deal with at a bank. All those things had some regulatory logic behind them initially. Employees at the bank think this is government-required paperwork. What it is is compliance.
rcgs 3y ago
It still feels like these dialogues are really only something lawyers could think is a good solution to companies employing invasive/overbearing uses of customer data. My gut feel is that most users don't understand what "tracking" really means and simply want to enjoy digital experiences without having to engage with the "what & how" that comes with modern platforms. My partner (and I reckon many other "normal" people) loves the ads on Instagram and enjoys the personalisation on YouTube & Netflix. The current solution of "be transparent and it's okay" just forces decisions onto consumers that they do not want. The "good" solution outlined in this article (accept/reject) is a big yes or a big no – a green light for everything vs a red light for nothing. There needs to be further regulation in this space that defines legal vs illegal uses of user data beyond the principals laid out in GDPR. The regulation should aim to define the "what & how", relieving the burden of choice from users and removing this "consent and it's okay" loophole for invasive use of data.
nologic01 3y ago
the consent charade is a constant reminder that the modern digital economy is based on large scale deceit and is therefore fundamentally unstable. yet nothing is done about it, as if it is not important, as if digital tech is not the main, if not only, "driver of future economic growth". you cannot build a stable economy (well at least not of a democratic, free market kind) relying on complete ignorance and regulatory capture. anybody who has leverage on the matter and is not doing something about it is complicit in a gigantic, generational level misallocation of resources that will eventually have to be written of.
alex-moon 3y ago
Hi! It me, the hapless nerd who goes, "Sites need this data to use analytics to improve their services."
- jhpacker 3y ago
  Hey, 3x more people clicked that then "I've reviewed the site's terms and they are acceptable to me." :)
- chrismorgan 3y ago
  I would assign the probability of them using this data to improve their services at well under 1%.
Zealotux 3y ago
I don't understand why we still don't have a standard for a built-in tracking preferences system in browsers. We have that for the microphone, webcam, and location access... why do we let websites control tracking preferences with their own design they can make as obscure and manipulative as they wish?
- layer8 3y ago
  Because there are legitimate uses for cookies etc. that do not require consent, like for example for shopping carts. But you can’t distinguish them from consent-requiring tracking in an automated fashion. In addition, there are finger-printing techniques that are virtually impossible to prevent, so websites would just start to rely more on those. It’s a bit like asking “why don’t we just block spam mails?”
ajuc 3y ago
I recently tried to disable the consent to share my data with external companies on one website. There was "accept all" and "manage" buttons, and under the "manage" button there were 100s (yes, multiple 100s) of sites listed, each with consent on by default, and to disable everything I had to manually scroll through it all and click on each item.
gostsamo 3y ago
[flagged]
titzer 3y ago
FTA: > “We value your privacy…” There's a special place in hell for the originators of this Orwellian triple-speak. Three meanings overlapped: meant to give users the impression that "we respect your privacy" or "we protect your privacy"--but it doesn't say that. It says they value your privacy, which is literally true; they're happy to put a dollar amount on it and sell or mine it, because it's of value to them. That's two true senses; one inferred and one real. But the second gives rise to the third, Orwellian meaning: these people actually don't value your privacy at all. It's a lie, pure and simple. A special kind of lie that has such a flippant, corporate-speak, technically-accurate dry meaning that is meant for a court of law--it holds up when lawyers start arguing long technicalities before a judge--but just one level deeper it is despairingly careless and dystopian. When I see this phrase I just know I don't want whatever it is these people are going to do with my data. They benefit and I don't.
- aidenn0 3y ago
  As a rule, the more that marketing language tries to imply something, the less it is likely to be true. See e.g. "fat free" labels on sugar-candy.
- deleted 3y ago
  [deleted]
- jhpacker 3y ago
  This is a great way to unpack that phrase, thank you! I started the article with that phrase because of the insincere absurdity of it exactly as you describe.
- glitcher 3y ago
  Or said another way, they can't say "we take your privacy seriously" without first saying "we take your privacy"!
yalogin 3y ago
Because no one wants to give up the data, and the revenue that comes with it. They just annoy the hell out of the users until they cave in and just accept it. Since it’s a law and every website has to do it, there is no competition to think of. It’s a no brainer
sebastian_z 3y ago
As a successor of Do Not Track, there is Global Privacy Control (GPC) [1]. Sites must respect it by law in California. An increasing number of other states ---Colorado, Connecticut, Montana, and hopefully more soon --- also have provisions in their new privacy laws for privacy preference signals like GPC. You can check if a site respects GPC [2]. For example, lego.com and nfl.com are two bigger ones I recently came across. Disclosure: I am a privacy researcher and co-founder of GPC. [1] https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ [2] https://gpcsup.com/ https://gpcsup.com/
api_or_ipa 3y ago
Someone should do a talk a la "Birth and Death of Javascript"[0] on the topic of cookies. What started nearly 30 years ago as a crude means of storing state over a stateless protocol spawned an entire industrial ecosystem around systematically tracking and spying on internet users. Take a step back and it's an insane journey. 0 https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...
capkutay 3y ago
Anecdotal but my wife actually likes that she’s fed such relevant ads on instagram and ends up researching and buying many of the products.
todd8 3y ago
My spouse will sometimes mention in conversation with others that I invented the cookie. This always puts me on the spot, and I have to enter into a long explanation of the what and the why of cookies least they believe that I some sort of evil software hacker. (Now for a short explanation so that HN readers don’t think that I’m an evil hacker: I invented them, with the help of a colleague, while at IBM where we were designing a distributed file system. This was before the advent of the World Wide Web.)
- AbsoluteCabbage 3y ago
  There are likely dozens of others out there that can lay claim to the same. What specifically do you define as the innovation behind this “invention”?
  - todd8 3y ago
    I'm sure that many can make the same claim. In the 1980's, I was an operating systems architect working at IBM. I thought up many interesting (to me) innovations while working on the first couple of releases of the AIX on the IBM POWER hardware. It was a great job and I learned a lot doing it. I got to work with some really brilliant developers and computer scientists (a number from IBM Research). One project I was responsible for was the development of a distributed file system for AIX. The goal was a distributed file system that addressed some of the weaknesses found in other distributed file systems at the time. Our chief competitor was Sun's NFS distributed file system. NFS was a really nice design. It was well integrated into the operating system and quite reliable because it utilized a (mostly) stateless server. This had a number of performance and security implications along with some file system semantics over NFS that didn't match local file system semantics. We wanted to introduce state for the server to address these issues and thought of a number of complex protocols to manage it in the presence of unreliable clients. That's when I thought up the idea of making the clients keep their own state to be restored when they reconnected to the server. I protected this state from manipulation by the client by encrypting it. I didn't call them cookies, I called them tokens. This design was patented by IBM and I was one of the two inventors on the patent. This patent was owned by IBM and years later they gave a special award for this patent because it decided that it was one of IBM's most important patents. (They wouldn't have done this unless the patent had held up to scrutiny or legal challenges). Unfortunately, by that time I had already left IBM to start my own company--I was at the top of my game and had confidence that I could create a software product of some kind that would be successful--so I missed out on the financial award for the patent. By then, I was at my new company and already in competition with IBM. By now, the patent should be long expired. Interestingly, IBM ended up buying my company around seven years after I and a partner started it. I was very aware of the academic literature and industrial practice during this time so I do believe that my invention does reflect original work that ended up with a very significant impact. From a more personal perspective, the invention didn't financially benefit me. The work that I did at my company own was more creative, inventive, technically impactful, and financially important to me. For example, Austin Ventures has indicated that my company was the start of Austin becoming an important high-tech location, but none of that was related to the cookie.
denton-scratch 3y ago
I have a notion to test cookie banners, to check whether it makes any difference whether you [Accept] or [Reject]. I strongly suspect that for many sites, it doesn't. Many sites seem to be offering a choice of [Accept] or [Settings]. I've never clicked on [Settings]; it might as well lead to a goatse, as far as I care. I don't want to choose options on a cookie banner at all, so why would I opt to see a complete separate page of options?
anticristi 3y ago
We use zero cookies on our website, so we have no consent banner. But people got so used to seeing "cookie consent banners", that we are considering introducing a "no cookies here" banner.
- dspillett 3y ago
  For some cookies, basic session management for instance, you don't need a banner anyway. Many sites want people to believe it is needed for necessary cookies, but that is either because they want the public to be against all the warnings (so they can go back to silently tracking everything) or because they have a very skewed idea of what necessary means in this context. In most cases sites could just use necessary tracking without permission but seek explicit opt-in for the rest. They won't do it that way of course because most people won't op-in unless nagged or conned into doing so. (the other reason for consent questions where they are not really needed is people playing safe lest they have to defend the lack of a consent form in legal court or the court of public outrage)
glitcher 3y ago
"We value your privacy" is usually a true statement about the monetary value a company places on exploiting your privacy, masquerading as a moral value statement.
0xbadcafebee 3y ago
Why did nobody tell the GDPR folks to require websites and browsers use one standard interface for the permission updates? It could have been so simple. Just let the browser prompt me so I can tell the browser once and for all what I want. Instead it created a website UX virus.
anotheronebytes 3y ago
My question would be "who is able to NOT be tracked?"
ApolloFortyNine 3y ago
I'm more curious about the question of 'who wants free content'. Because that's really the question here. Would I prefer everything in my life was free with no strings attached? Obviously. But youtube/news/reddit/facebook/literally any website needs to make money somehow, and non tracked ads pay rediculously lower amounts(90+%). So the real question is, would you trade what is essentially anonymous tracking (literally no one at Google gives a damn who you are, it's just a unique id fed into an algorithm) for content, or would you rather pay for each and every site on the internet?
- nullc 3y ago
  Your dichotomy ignores other possibilities. To what extent are we stuck on costly distribution models specifically because those are the ones you can tap for a revenue stream, to what extent are the costs driven by the monetization itself? I used to help out with the technical infrastructure for wikipedia and even as the 8th most trafficked site on the internet the cost was radically lower than that of some of my dayjob customers with comparable levels of traffic. A non-trivial part of the reason for that was that it didn't need all the surveillance and realtime per-request bespoke generation that advertisement encumbered services require. Part of it was just that there is an awful lot of fat in big commercial operations, since they have enough revenue that it's not a concern. Some is probably because when you're chasing ad dollars the extra spend required to get a 30 ms response instead of a 60ms response might be justified on the basis of the marginal clicks it generates, but those costs shouldn't properly be considered part of the underlying distribution costs. I think "yes, I'd be happy to pay for all of it" would be significantly more attractive if paying meant just the component of the cost that actually went to the authors of the material -- on the order of a hundredth of a cent per view. Here is $1, that'll cover the authors share of all my household's youtube viewing for the next several years.
- neon_electro 3y ago
  For me, personally, I invest enough time watching YouTube for Premium to be worth it solely to avoid ads.
  - MathMonkeyMan 3y ago

189 points by jhpacker 3y ago

They exist because they’re required to through applicable laws. The companies want tracking for additional business data and very rarely actually are about the users.

jonathanstrange 3y ago

So you can accidentally click them.

Gys 3y ago

Because they also want everything for free.

hourago 3y ago
> Because they also want everything for free. Maybe people just goes to the cheaper option available because increasing inequality has left millions with no disposable income. This is the same logic by which people prefers cheap furniture instead of high quality one. It is not a preference for cheap but it is just what they can afford, if they had more money most people will get the higher quality version and pay the price.
- Gys 3y ago
  > Maybe people just goes to the cheaper option available because increasing inequality has left millions with no disposable income. No disposable income would mean not being able to spend money, meaning never buy anything. If this was true the ad industry would very quickly run bankrupt. And yet the revenues of Google and Facebook indicate otherwise.
  - hiatus 3y ago
    Even without disposable income, advertising can still lead to people choosing alternatives and directing their spend someplace else, so your conclusion does not follow. If someone is maxing out their income they can still be advertised to to get them to switch consumption habits.

BiteCode_dev 3y ago

Because in a society that is optimized for profit, it's not about people, it's about what you can get away with for money.

eru 3y ago
Alas, our society ain't optimised for profit.

gitgud 3y ago

“We value your privacy” is a very hollow statement, when the website is asking to track you…

mjhagen 3y ago
“But, not as much as our bottom line.”
MaxikCZ 3y ago
They value it, in exact amount of money.
- etiam 3y ago
  "... at about 20¢" is how I usually read the implied part.
devoutsalsa 3y ago
We value your privacy because we can sell it!
quickthrower2 3y ago
Followed by [Accept all tracking] [Ritual Hazing]

s1k3s 3y ago

I don't know how the experience is in US, but in EU it's because GDPR is a complete failure of a law which doesn't actually solve any problem.

hbossy 3y ago
It solved my problems with exporting data from proprietary webapps such as spotify.
kuschku 3y ago
GDPR takes quite a while to get results, but even Google now has a "deny all tracking" button.
newswasboring 3y ago
GDPR is the law which at least gave us these prompts. Before that there was no rules for consent, they would just track you.
- eska 3y ago
  There was a law just for cookies before. And no, companies don’t need to put up these prompts, IF they don’t do any UNNECESSARY tracking.
  - jruohonen 3y ago
    Cookies belong to the e-privacy directive.
  - newswasboring 3y ago
    I'm with you, these prompts are garbage. But they are better than no prompts, because companies are greedy af and they will track. Fixing that is a much larger issue than the bandaid of law.
eska 3y ago
What makes you think so? I’ve seen a lot of good come from it.

barbs 3y ago

Is there a browser extension to turn these off?

MaxikCZ 3y ago
uBlock origin with appropriate filter turner on.
- BoxOfRain 3y ago
  This is what I do, it's pretty effective.
- kruuuder 3y ago
  You still have to find filter lists that work though. I use uBlock origin and frequently run into problems where cookie popups are half-blocked - the dialog is no longer visible, but I still cannot interact with or scroll the website. To work around that, I have to deactivate uBlock's cosmetic filters so that I can see the dialog again, then deny cookies. Pretty annoying, I haven't found a setup that fixes that.
  - chrismorgan 3y ago
    Most of the time I have JavaScript disabled as well (only for specific sites and in Private Browsing windows do I have it enabled), which will slightly confound this anecdote, but I believe it was mid-2020 when I last encountered a site that uBlock Origin plus cookie-banner-blocking lists broke the page in the way you describe, and only ever a very few times before that.
  - MaxikCZ 3y ago
    Extension named something like Behind The Overlay fixes similar cases for me, it gets rid of anything overlaying the page blocking inputs. Exceptionally effective
- nickthegreek 3y ago
  Which filter helps with this?

isoprophlex 3y ago

94% don't want tracking... and the remainder 6% of responses can be attributed to the lizardman constant https://gwern.net/note/lizardman https://gwern.net/note/lizardman

quickthrower2 3y ago
Heard this called flatlining. I.e. answer all "mostly agree" or whatever.
- gwern 3y ago
  'acquiescence bias' is real but a different thing. Mischievous responders will flip their answer as necessary to screw with you, they don't just 'go down the line', so you can't simply reverse-code or use other such tricks.
brookst 3y ago
I wonder what percentages you'd get if you asked "do you want to eat for free at every restaurant?" My guess is about the same 94% / 6%. But I'm not sure it's the 6% that represents lizardman.

lawn 3y ago

Because companies prefer to track them?

ajsnigrutin 3y ago

Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it. Block third party cookies by default, delete other cookies on the last tab or window closed and prompt user to save cookies on a form submit ("do not delete cookies for this domain when leaving" type of prompt, for pages with logins, settings, etc). Also remove features that make easy fingerprinting possible, the site doesn't need to know every font I have installed, just have a "standard set" included with the browser, and use web fonts or whatever for other fonts.

quickthrower2 3y ago
The last thing a browser wants to do is break experience for older sites. If a site relies on 3rd party cookies for log in, it will no longer work on your browser. It makes your browser look shit. Same reason we allow unclosed tags, crossed tags, etc.
- pavlov 3y ago
  Browsers already detect login forms to offer autocompletion and password storage. Surely it wouldn’t be insurmountable to detect cookies being set after a login flow, and let users confirm that they want this login to persist.
- ajsnigrutin 3y ago
  We also had shockwave flash, blink tags, keygen tags for cert generation, etc., so yeah, we can change stuff if we need it. But since the biggest browser is owned by an ad company that earns money by tracking us, this will probably never happen. An alternative would be to have a cookie jar per domain.
- ssdspoimdsjvv 3y ago
  Is this really different from disabling JavaScript, which will also break the majority of sites?
- lloeki 3y ago
  Safari and Firefox block 3rd party cookies by default.

TekMol 3y ago

I have switched one of my sites to cookieless analytics and it is bad for everybody. I can't even say how many users this site has now. It could be the same user coming back over and over. Or many users. How would I know. Yes, I could track a ton of stats about every pageview like user agent, screen resolution etc and then try to stitch it back together. Trying to figure out how many different users there are. But this type of "stitching together" would probably also count as PII. I cannot test new features and see if it makes users happy so they come back more often. I cannot see if the site has issues on some hardware, software, language. Because I wouldn't see if users affected come back less often. I can't test if an introduction text at the beginning helps users discover important features. Because I can't make the connection between showing the text early on in the user journey and usage of features later on. Because I can't see a user journey. This is a site I run for the enjoyment of me and the other users. Probably a few thousand a month. And I can say the site was much easier to develop with a normal cookie approach to tracking. I have gone the cookieless way for about a year now. And I can say with certainty that it would be a better site now if I kept the cookie approach. When the developer flies blind, that's bad for everybody. I think for a commercial site, where a degradation of 10% in user experience can tank the business, there is no way around cookie tracking to figure out what works for users and what doesn't. This is another reason, why European internet companies do not stand a snowball's chance in hell to compete with their US competitors. European companies need to bug all users and beg for cookies. While US companies only need to do that with their European users.

pelorat 3y ago
Why would you need to know anything but hits/month and ad-revenue/month? Why don't you just hash the IP-address and count unique users that way?
- kmlx 3y ago
  that's easy: to improve the service.
  - austinjp 3y ago

tourgen 3y ago

[dead]

Haga 3y ago

[dead]

phendrenad2 3y ago

94% of people want me to be president. Caveat: I did not define what it means for them to want me to be president. In other words, what does it mean to be "tracked"? How was the question worded? You can change this value from 1% all the way up to 99% depending on how you ask the question, because "being tracked" is open to interpretation. Truly a useless poll.

jhpacker 3y ago
Hi, the exact wording on the poll was "If given the option, I would prefer not to be tracked online." The reason why I didn't define "tracked" for the people taking the poll is that I think that's the most representative way to replicate the question that consent boxes are theoretical asking, but in an abstract way out of the context of a specific website. When a user sees that consent box, they have little to no idea of what tracking is actually happening.
- phendrenad2 3y ago
  Hmm, I guess that's a good rationale, but unfortunately it's still useless. I believe that websites adopted the simplistic "don't track me" language because they want to appear to be embracing the law. I've asked a lot of people (> 100) what it means to them to be "tracked" and they have no idea what it means, but they're afraid of whatever it means.

sundvor 3y ago

Related: 99.999% of users don't read T&C's, so why do consent checkboxes exist? (I made the number up, but I'd be very surprised if I am off by magnitudes).

gsatic 3y ago

Cause the prob being solved by search rankings, newsfeeds, maps etc is info overload. People forget that all the time. There is too much info out there. Context about the user shrinks the ever growing info sphere.

arendtio 3y ago

Does someone know why it is legal that in some countries websites are allowed to offer layers that offer a paid version and a tracking enabled version (very popular among newspapers)? As far as I understand the GDPR, there should be no downside to rejecting the tracking technologies. And Websites relying on advertising, could do so with unpersonalized ads (granted with very different metrics). Nevertheless, to me it feels, like these paid vs tracked offers are not what the authors of the GDPR intended.

tpxl 3y ago
You mustn't reject service based on refusal of non-legitimate-reason data processing consent. Allowing paying to not have ads is orthogonal to the service being provided - in both cases the user gets the news, it's just flanked by ads in one case.
- arendtio 3y ago
  Well, I don't have a problem with the paid version. What I have have a problem with, is the refusal of service if I don't consent to being tracked. So if there would be three versions, like 'personalized ads with tracking', 'tracking-free/unpersonalized ads' and 'paid ad-free', that would be fine with me. What I don't understand, is that it is okay to refuse the service if you don't consent for the ad-supported tracking version. I mean, not giving your consent, means you have to pay if you want to use the service. Doesn't feel like you have a free choice (pun intended).
  - layer8 3y ago
    I believe it’s for the same reason that a pay-only service is legal.
  - tpxl 3y ago
    Sorry, I misread your comment. It's not OK to refuse service if you refuse tracking. Paid service or ads without tracking is OK. Paid service with no free alternative is OK - you didn't refuse service based on refusing tracking, you refused it based on non-payment. Paid service or tracking is not OK.

kasperni 3y ago

My main problem is cross website tracking. I don't really have a problem with a website keeping track of all my visits to that particular website. I think it works similar in real life as well. You don't mind if a store clerk recognises you coming back to a shop. But you would be kind of creeped out if he also knew where and when you last visited your dentist.

Ekaros 3y ago
I'm fine with them keeping my purchase history for example. And then maybe even sending me offers based on that. Now tracking what I viewed or browsed on their site get bit harder. And sharing with anyone else is right out.

charcircuit 3y ago

This is a misleading statistic. Most people will not care if I implemented a view counter on my website that uses a cookie to prevent the same user as counting as multiple views.

jhpacker 3y ago
I agree that most people would not mind that scenario, the issue is that that scenario requires the same consent box that the most invasive adtech would use and it's far too onerous on the user as things are now to discern the difference.

dalbasal 3y ago

The model of regulation-compliance is this. It's not really about the specifics. Consent, privacy, kyc... Those may be initial motives for regulation, but by the time these exist in the world, they are a set of standard, rigid "compliance" protocols. From formulation stage, it allows two parallel realities. One in which "consent" or whatnot have an intuitive meaning. Politicians and activists live here. One in which "consent" is a specification for a compliant "3rd party solution." Businesses live here. Once functional, the bank, website or other complying business can claim the rules were made up by the regulator, and the regulator can either claim to be successful or blame businesses for problems. Being unremarkable, by copying or using 3rd party comliance plugins is more important than respecting the regulation's intent. By the time consumers are affected, "consent" has a technical specification. It no longer has much actual meaning. Think of the hoops, paperwork, informed consent signatures and such that you deal with at a bank. All those things had some regulatory logic behind them initially. Employees at the bank think this is government-required paperwork. What it is is compliance.

rcgs 3y ago

It still feels like these dialogues are really only something lawyers could think is a good solution to companies employing invasive/overbearing uses of customer data. My gut feel is that most users don't understand what "tracking" really means and simply want to enjoy digital experiences without having to engage with the "what & how" that comes with modern platforms. My partner (and I reckon many other "normal" people) loves the ads on Instagram and enjoys the personalisation on YouTube & Netflix. The current solution of "be transparent and it's okay" just forces decisions onto consumers that they do not want. The "good" solution outlined in this article (accept/reject) is a big yes or a big no – a green light for everything vs a red light for nothing. There needs to be further regulation in this space that defines legal vs illegal uses of user data beyond the principals laid out in GDPR. The regulation should aim to define the "what & how", relieving the burden of choice from users and removing this "consent and it's okay" loophole for invasive use of data.

nologic01 3y ago

the consent charade is a constant reminder that the modern digital economy is based on large scale deceit and is therefore fundamentally unstable. yet nothing is done about it, as if it is not important, as if digital tech is not the main, if not only, "driver of future economic growth". you cannot build a stable economy (well at least not of a democratic, free market kind) relying on complete ignorance and regulatory capture. anybody who has leverage on the matter and is not doing something about it is complicit in a gigantic, generational level misallocation of resources that will eventually have to be written of.

alex-moon 3y ago

Hi! It me, the hapless nerd who goes, "Sites need this data to use analytics to improve their services."

jhpacker 3y ago
Hey, 3x more people clicked that then "I've reviewed the site's terms and they are acceptable to me." :)
chrismorgan 3y ago
I would assign the probability of them using this data to improve their services at well under 1%.

Zealotux 3y ago

I don't understand why we still don't have a standard for a built-in tracking preferences system in browsers. We have that for the microphone, webcam, and location access... why do we let websites control tracking preferences with their own design they can make as obscure and manipulative as they wish?

layer8 3y ago
Because there are legitimate uses for cookies etc. that do not require consent, like for example for shopping carts. But you can’t distinguish them from consent-requiring tracking in an automated fashion. In addition, there are finger-printing techniques that are virtually impossible to prevent, so websites would just start to rely more on those. It’s a bit like asking “why don’t we just block spam mails?”

ajuc 3y ago

I recently tried to disable the consent to share my data with external companies on one website. There was "accept all" and "manage" buttons, and under the "manage" button there were 100s (yes, multiple 100s) of sites listed, each with consent on by default, and to disable everything I had to manually scroll through it all and click on each item.

gostsamo 3y ago

[flagged]

titzer 3y ago

FTA: > “We value your privacy…” There's a special place in hell for the originators of this Orwellian triple-speak. Three meanings overlapped: meant to give users the impression that "we respect your privacy" or "we protect your privacy"--but it doesn't say that. It says they value your privacy, which is literally true; they're happy to put a dollar amount on it and sell or mine it, because it's of value to them. That's two true senses; one inferred and one real. But the second gives rise to the third, Orwellian meaning: these people actually don't value your privacy at all. It's a lie, pure and simple. A special kind of lie that has such a flippant, corporate-speak, technically-accurate dry meaning that is meant for a court of law--it holds up when lawyers start arguing long technicalities before a judge--but just one level deeper it is despairingly careless and dystopian. When I see this phrase I just know I don't want whatever it is these people are going to do with my data. They benefit and I don't.

aidenn0 3y ago
As a rule, the more that marketing language tries to imply something, the less it is likely to be true. See e.g. "fat free" labels on sugar-candy.
deleted 3y ago
[deleted]
jhpacker 3y ago
This is a great way to unpack that phrase, thank you! I started the article with that phrase because of the insincere absurdity of it exactly as you describe.
glitcher 3y ago
Or said another way, they can't say "we take your privacy seriously" without first saying "we take your privacy"!

yalogin 3y ago

Because no one wants to give up the data, and the revenue that comes with it. They just annoy the hell out of the users until they cave in and just accept it. Since it’s a law and every website has to do it, there is no competition to think of. It’s a no brainer

sebastian_z 3y ago

As a successor of Do Not Track, there is Global Privacy Control (GPC) [1]. Sites must respect it by law in California. An increasing number of other states ---Colorado, Connecticut, Montana, and hopefully more soon --- also have provisions in their new privacy laws for privacy preference signals like GPC. You can check if a site respects GPC [2]. For example, lego.com and nfl.com are two bigger ones I recently came across. Disclosure: I am a privacy researcher and co-founder of GPC. [1] https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ [2] https://gpcsup.com/ https://gpcsup.com/

api_or_ipa 3y ago

Someone should do a talk a la "Birth and Death of Javascript"[0] on the topic of cookies. What started nearly 30 years ago as a crude means of storing state over a stateless protocol spawned an entire industrial ecosystem around systematically tracking and spying on internet users. Take a step back and it's an insane journey. 0 https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...

capkutay 3y ago

Anecdotal but my wife actually likes that she’s fed such relevant ads on instagram and ends up researching and buying many of the products.

todd8 3y ago

My spouse will sometimes mention in conversation with others that I invented the cookie. This always puts me on the spot, and I have to enter into a long explanation of the what and the why of cookies least they believe that I some sort of evil software hacker. (Now for a short explanation so that HN readers don’t think that I’m an evil hacker: I invented them, with the help of a colleague, while at IBM where we were designing a distributed file system. This was before the advent of the World Wide Web.)

AbsoluteCabbage 3y ago
There are likely dozens of others out there that can lay claim to the same. What specifically do you define as the innovation behind this “invention”?
- todd8 3y ago
  I'm sure that many can make the same claim. In the 1980's, I was an operating systems architect working at IBM. I thought up many interesting (to me) innovations while working on the first couple of releases of the AIX on the IBM POWER hardware. It was a great job and I learned a lot doing it. I got to work with some really brilliant developers and computer scientists (a number from IBM Research). One project I was responsible for was the development of a distributed file system for AIX. The goal was a distributed file system that addressed some of the weaknesses found in other distributed file systems at the time. Our chief competitor was Sun's NFS distributed file system. NFS was a really nice design. It was well integrated into the operating system and quite reliable because it utilized a (mostly) stateless server. This had a number of performance and security implications along with some file system semantics over NFS that didn't match local file system semantics. We wanted to introduce state for the server to address these issues and thought of a number of complex protocols to manage it in the presence of unreliable clients. That's when I thought up the idea of making the clients keep their own state to be restored when they reconnected to the server. I protected this state from manipulation by the client by encrypting it. I didn't call them cookies, I called them tokens. This design was patented by IBM and I was one of the two inventors on the patent. This patent was owned by IBM and years later they gave a special award for this patent because it decided that it was one of IBM's most important patents. (They wouldn't have done this unless the patent had held up to scrutiny or legal challenges). Unfortunately, by that time I had already left IBM to start my own company--I was at the top of my game and had confidence that I could create a software product of some kind that would be successful--so I missed out on the financial award for the patent. By then, I was at my new company and already in competition with IBM. By now, the patent should be long expired. Interestingly, IBM ended up buying my company around seven years after I and a partner started it. I was very aware of the academic literature and industrial practice during this time so I do believe that my invention does reflect original work that ended up with a very significant impact. From a more personal perspective, the invention didn't financially benefit me. The work that I did at my company own was more creative, inventive, technically impactful, and financially important to me. For example, Austin Ventures has indicated that my company was the start of Austin becoming an important high-tech location, but none of that was related to the cookie.

denton-scratch 3y ago

I have a notion to test cookie banners, to check whether it makes any difference whether you [Accept] or [Reject]. I strongly suspect that for many sites, it doesn't. Many sites seem to be offering a choice of [Accept] or [Settings]. I've never clicked on [Settings]; it might as well lead to a goatse, as far as I care. I don't want to choose options on a cookie banner at all, so why would I opt to see a complete separate page of options?

anticristi 3y ago

We use zero cookies on our website, so we have no consent banner. But people got so used to seeing "cookie consent banners", that we are considering introducing a "no cookies here" banner.

dspillett 3y ago
For some cookies, basic session management for instance, you don't need a banner anyway. Many sites want people to believe it is needed for necessary cookies, but that is either because they want the public to be against all the warnings (so they can go back to silently tracking everything) or because they have a very skewed idea of what necessary means in this context. In most cases sites could just use necessary tracking without permission but seek explicit opt-in for the rest. They won't do it that way of course because most people won't op-in unless nagged or conned into doing so. (the other reason for consent questions where they are not really needed is people playing safe lest they have to defend the lack of a consent form in legal court or the court of public outrage)

glitcher 3y ago

"We value your privacy" is usually a true statement about the monetary value a company places on exploiting your privacy, masquerading as a moral value statement.

0xbadcafebee 3y ago

Why did nobody tell the GDPR folks to require websites and browsers use one standard interface for the permission updates? It could have been so simple. Just let the browser prompt me so I can tell the browser once and for all what I want. Instead it created a website UX virus.

anotheronebytes 3y ago

My question would be "who is able to NOT be tracked?"

ApolloFortyNine 3y ago

I'm more curious about the question of 'who wants free content'. Because that's really the question here. Would I prefer everything in my life was free with no strings attached? Obviously. But youtube/news/reddit/facebook/literally any website needs to make money somehow, and non tracked ads pay rediculously lower amounts(90+%). So the real question is, would you trade what is essentially anonymous tracking (literally no one at Google gives a damn who you are, it's just a unique id fed into an algorithm) for content, or would you rather pay for each and every site on the internet?

nullc 3y ago
Your dichotomy ignores other possibilities. To what extent are we stuck on costly distribution models specifically because those are the ones you can tap for a revenue stream, to what extent are the costs driven by the monetization itself? I used to help out with the technical infrastructure for wikipedia and even as the 8th most trafficked site on the internet the cost was radically lower than that of some of my dayjob customers with comparable levels of traffic. A non-trivial part of the reason for that was that it didn't need all the surveillance and realtime per-request bespoke generation that advertisement encumbered services require. Part of it was just that there is an awful lot of fat in big commercial operations, since they have enough revenue that it's not a concern. Some is probably because when you're chasing ad dollars the extra spend required to get a 30 ms response instead of a 60ms response might be justified on the basis of the marginal clicks it generates, but those costs shouldn't properly be considered part of the underlying distribution costs. I think "yes, I'd be happy to pay for all of it" would be significantly more attractive if paying meant just the component of the cost that actually went to the authors of the material -- on the order of a hundredth of a cent per view. Here is $1, that'll cover the authors share of all my household's youtube viewing for the next several years.
neon_electro 3y ago
For me, personally, I invest enough time watching YouTube for Premium to be worth it solely to avoid ads.
- MathMonkeyMan 3y ago