6 ms·

First thing I notice while browsing from EU is that there's only one option regarding cookies. Accept all! Even if I click "Learn more" there's no "accept neces

First thing I notice while browsing from EU is that there's only one option regarding cookies. Accept all! Even if I click "Learn more" there's no "accept necessary cookies" or "Reject cookies". First time I encounter something like this.

anthonyskipper 3y ago
That's a common dark pattern.
- constantly 3y ago
  It’s not really a dark pattern because they’re not tricking you into accepting or coercing more than is acceptable into doing so, they’re just not allowing you to decline. Which means if not accepting cookies is a dealbreaker for you, no problem, just: move along.
  - deleted 3y ago
    [deleted]
- master-lincoln 3y ago
  Dark pattern is a term normally used for legal, but immoral user experience. In this case legality is questionable as they redirect you to other external sites to manage your "consent" https://optout.aboutads.info https://optout.aboutads.info (at least from a European GDPR perspective)
otikik 3y ago
Yep, closed it down immediately. IANAL but that might not be legal in Europe
coldpie 3y ago
I have to admit, for technical folks like ourselves, I don't understand why you care what options the dialog presents. Just use a "Kill Sticky" plugin to nuke the stupid dialog so you can read the page, or even Accept them, and then instruct your browser to do whatever you like with the cookies the site creates (i.e. delete them). It's all in your hands, the popup dialog doesn't do anything you can't do yourself.
- master-lincoln 3y ago
  you should care because often this agreement is not about the technical detail of cookies, but allowing the company you are interacting with to share data about you with 3rd parties.
  - coldpie 3y ago
    If you think which HTML div element you click on to dismiss a sticky banner has any bearing whatsoever on how your data is handled server-side, I've got a trip to the Titanic in an Oceangate submersible to sell you.
    - Etheryte 3y ago
      Legally it does, at least if you're in the EU. The only reason websites are slow on the uptake around this is that the legal gears are slow, however we have seen many considerable fines in this space in the last few years and things are improving.
  - bad_username 3y ago
    It's also in direct violation of GDPR.
- explaininjs 3y ago
  Learned helplessness. Teach the citizens that the only thing protecting them from the Big Scary Internet is their benevolent government. Meanwhile the politicians collect millions from the mass media companies that lobbied for the god-awful implementation of the law we all ended up with, and as everyone gets worn down into Accepting All always, they simultaneously forget that their User Agent holds all the cards (or in this case, cookies), and it can be instructed to do anything the User wants with them.
  - ethbr0 3y ago
    Did you just take a problem that free market tech created and blame it on the government? ;) User agent sovereignty would be nice... except the most used browser and 1/2 of smartphones are controlled by Google, the largest ad tracking company on the planet. We're way past the 90s.
marcinzm 3y ago
Isn't that a GDPR violation since they're not allowed to prevent access if you refuse to share data not necessary for the service to function? Since it's from Meta I suspect regulators would enjoy another thing to add to the list for future fine calculations.
- dspillett 3y ago
  It depends. If everything stored & tracked is genuinely necessary (as defined by the regulations) then consent is not required. If they are just telling you that they are storing & tracking necessary things like session information, then all is good (unless the things they store & track are not, in fact, strictly necessary and non-privacy-affecting). Of course if they don't need consent, then why are they making a song & dance about it having us click an accept button?
  - IanCal 3y ago
    They explicitly say a use is for ads on and off this site.
- mike_d 3y ago
  Not at all. You can have a single prompt with a single accept button if you are only using functional cookies on a site.
  - capableweb 3y ago
    In that case, you don't need anything, no notice nor consent required at all, get rid of the entire modal/popup/banner.
littlestymaar 3y ago
> First time I encounter something like this. Facebook itself use to have this exact banner with no alternative until they were strong-armed to properly comply with GDPR.
WhackyIdeas 3y ago
Noticed the same thing as I always select ‘necessary only’ or something like that. Instead, I just closed the page and clicked on HN comments to see what it was about.
nightpool 3y ago
This is common on many, many sites like this because they do not have any tracking cookies or anything else that they would need consent for, but they're still required to display a cookie banner "notifying" you that cookies are "in use" as per the terms of the old 2009 ePrivacy Directive. In this case, it appears that projectaria.com sets 1) one cookie for the user's DPR (1 or 2) so that the backend can serve optimized images, 2) one cookie for the user's locale, and 3) one cookie for a CSRF token for form submission.
- capableweb 3y ago
  > but they're still required to display a cookie banner "notifying" you that cookies are "in use" Common misconception but this is not true. If you use cookies only for functional purposes (not for tracking for example), you do not need to show any cookie banners. Like if you have a shopping cart and you have a cookie for keeping track of what's in it, it's for functional purposes for the user and hence needs no notice to be used. The UK's ICO made a handy summary for people who are curious about what the directive actually says: https://ico.org.uk/media/for-organisations/documents/1545/cookies_guidance.pdf https://ico.org.uk/media/for-organisations/documents/1545/co... Specifically: > Exceptions from the requirement to provide information and obtain consent > Activities likely to fall within the exception: [...] Some cookies help ensure that the content of your page loads quickly [...] Certain cookies providing security that is essential to comply with the security requirements [...]
  - sanderjd 3y ago
    But it's easier and less risky to just always put in the standard language that everyone ignores and mindlessly clicks through anyway. Which is why this was very silly legislation. People helping develop future legislation (in the EU and elsewhere) should be aware of this as a cautionary tale of incentivizing theater with only cost and no benefit.
  - nightpool 3y ago
    > Common misconception but this is not true. If you use cookies only for functional purposes (not for tracking for example), you do not need to show any cookie banners. Like if you have a shopping cart and you have a cookie for keeping track of what's in it, it's for functional purposes for the user and hence needs no notice to be used. Personally, I would not put a cookie banner of any kind on my website. However, given this text: The term 'strictly necessary' means that such storage of or access to information should be essential, rather than reasonably necessary, for this exemption to apply. However, it will also be restricted to what is essential to provide the service requested by the user, rather than what might be essential for any other uses the service provider might wish to make of that data. It will also include what is required to comply with any other legislation the person using the cookie might be subject to, for example, the security requirements of the seventh data protection principle. Where the setting of a cookie is deemed 'important' rather than 'strictly necessary', those collecting the information are still obliged to provide information about the device to the potential service recipient and obtain consent. I think it's clear why a more risk-conscious organization like Meta might take a more conservative reading of "Strictly necessary" that does not apply to e.g. bandwidth optimizations related to a device's DPI
cutler 3y ago
This one is tame compared with a whole industry of "data privacy" popups which hide "Legitimate Interest" opt-outs within Vendor lists containing hundreds of entries. Someone needs to slap some serious lawsuits on these gangsters.
mensetmanusman 3y ago
It’s amazing how much worse browsing the web has gotten after all these pop-ups everywhere.
- kaffeeringe 3y ago
  You mean how much worse surfing the web got after it became visible, how much companies are tracking us? The problem is the tracking, not the banner. If you don't sell your readers data, you don't need a banner.
Dirak 3y ago
This is a perfect example of how GDPR can present challenges to innovation. The fact the top comment in this announcement revolves around GDPR compliance and associated fines raises questions about whether companies will be motivated to share research and open source datasets in the future.

anthonyskipper 3y ago

That's a common dark pattern.

constantly 3y ago
It’s not really a dark pattern because they’re not tricking you into accepting or coercing more than is acceptable into doing so, they’re just not allowing you to decline. Which means if not accepting cookies is a dealbreaker for you, no problem, just: move along.
- deleted 3y ago
  [deleted]
master-lincoln 3y ago
Dark pattern is a term normally used for legal, but immoral user experience. In this case legality is questionable as they redirect you to other external sites to manage your "consent" https://optout.aboutads.info https://optout.aboutads.info (at least from a European GDPR perspective)

otikik 3y ago

Yep, closed it down immediately. IANAL but that might not be legal in Europe

coldpie 3y ago

I have to admit, for technical folks like ourselves, I don't understand why you care what options the dialog presents. Just use a "Kill Sticky" plugin to nuke the stupid dialog so you can read the page, or even Accept them, and then instruct your browser to do whatever you like with the cookies the site creates (i.e. delete them). It's all in your hands, the popup dialog doesn't do anything you can't do yourself.

master-lincoln 3y ago
you should care because often this agreement is not about the technical detail of cookies, but allowing the company you are interacting with to share data about you with 3rd parties.
- coldpie 3y ago
  If you think which HTML div element you click on to dismiss a sticky banner has any bearing whatsoever on how your data is handled server-side, I've got a trip to the Titanic in an Oceangate submersible to sell you.
  - Etheryte 3y ago
    Legally it does, at least if you're in the EU. The only reason websites are slow on the uptake around this is that the legal gears are slow, however we have seen many considerable fines in this space in the last few years and things are improving.
- bad_username 3y ago
  It's also in direct violation of GDPR.
explaininjs 3y ago
Learned helplessness. Teach the citizens that the only thing protecting them from the Big Scary Internet is their benevolent government. Meanwhile the politicians collect millions from the mass media companies that lobbied for the god-awful implementation of the law we all ended up with, and as everyone gets worn down into Accepting All always, they simultaneously forget that their User Agent holds all the cards (or in this case, cookies), and it can be instructed to do anything the User wants with them.
- ethbr0 3y ago
  Did you just take a problem that free market tech created and blame it on the government? ;) User agent sovereignty would be nice... except the most used browser and 1/2 of smartphones are controlled by Google, the largest ad tracking company on the planet. We're way past the 90s.

marcinzm 3y ago

Isn't that a GDPR violation since they're not allowed to prevent access if you refuse to share data not necessary for the service to function? Since it's from Meta I suspect regulators would enjoy another thing to add to the list for future fine calculations.

dspillett 3y ago
It depends. If everything stored & tracked is genuinely necessary (as defined by the regulations) then consent is not required. If they are just telling you that they are storing & tracking necessary things like session information, then all is good (unless the things they store & track are not, in fact, strictly necessary and non-privacy-affecting). Of course if they don't need consent, then why are they making a song & dance about it having us click an accept button?
- IanCal 3y ago
  They explicitly say a use is for ads on and off this site.
mike_d 3y ago
Not at all. You can have a single prompt with a single accept button if you are only using functional cookies on a site.
- capableweb 3y ago
  In that case, you don't need anything, no notice nor consent required at all, get rid of the entire modal/popup/banner.

littlestymaar 3y ago

> First time I encounter something like this. Facebook itself use to have this exact banner with no alternative until they were strong-armed to properly comply with GDPR.

WhackyIdeas 3y ago

Noticed the same thing as I always select ‘necessary only’ or something like that. Instead, I just closed the page and clicked on HN comments to see what it was about.

nightpool 3y ago

This is common on many, many sites like this because they do not have any tracking cookies or anything else that they would need consent for, but they're still required to display a cookie banner "notifying" you that cookies are "in use" as per the terms of the old 2009 ePrivacy Directive. In this case, it appears that projectaria.com sets 1) one cookie for the user's DPR (1 or 2) so that the backend can serve optimized images, 2) one cookie for the user's locale, and 3) one cookie for a CSRF token for form submission.

capableweb 3y ago
> but they're still required to display a cookie banner "notifying" you that cookies are "in use" Common misconception but this is not true. If you use cookies only for functional purposes (not for tracking for example), you do not need to show any cookie banners. Like if you have a shopping cart and you have a cookie for keeping track of what's in it, it's for functional purposes for the user and hence needs no notice to be used. The UK's ICO made a handy summary for people who are curious about what the directive actually says: https://ico.org.uk/media/for-organisations/documents/1545/cookies_guidance.pdf https://ico.org.uk/media/for-organisations/documents/1545/co... Specifically: > Exceptions from the requirement to provide information and obtain consent > Activities likely to fall within the exception: [...] Some cookies help ensure that the content of your page loads quickly [...] Certain cookies providing security that is essential to comply with the security requirements [...]
- sanderjd 3y ago
  But it's easier and less risky to just always put in the standard language that everyone ignores and mindlessly clicks through anyway. Which is why this was very silly legislation. People helping develop future legislation (in the EU and elsewhere) should be aware of this as a cautionary tale of incentivizing theater with only cost and no benefit.
- nightpool 3y ago
  > Common misconception but this is not true. If you use cookies only for functional purposes (not for tracking for example), you do not need to show any cookie banners. Like if you have a shopping cart and you have a cookie for keeping track of what's in it, it's for functional purposes for the user and hence needs no notice to be used. Personally, I would not put a cookie banner of any kind on my website. However, given this text: The term 'strictly necessary' means that such storage of or access to information should be essential, rather than reasonably necessary, for this exemption to apply. However, it will also be restricted to what is essential to provide the service requested by the user, rather than what might be essential for any other uses the service provider might wish to make of that data. It will also include what is required to comply with any other legislation the person using the cookie might be subject to, for example, the security requirements of the seventh data protection principle. Where the setting of a cookie is deemed 'important' rather than 'strictly necessary', those collecting the information are still obliged to provide information about the device to the potential service recipient and obtain consent. I think it's clear why a more risk-conscious organization like Meta might take a more conservative reading of "Strictly necessary" that does not apply to e.g. bandwidth optimizations related to a device's DPI

cutler 3y ago

This one is tame compared with a whole industry of "data privacy" popups which hide "Legitimate Interest" opt-outs within Vendor lists containing hundreds of entries. Someone needs to slap some serious lawsuits on these gangsters.

mensetmanusman 3y ago

It’s amazing how much worse browsing the web has gotten after all these pop-ups everywhere.

kaffeeringe 3y ago
You mean how much worse surfing the web got after it became visible, how much companies are tracking us? The problem is the tracking, not the banner. If you don't sell your readers data, you don't need a banner.

Dirak 3y ago

This is a perfect example of how GDPR can present challenges to innovation. The fact the top comment in this announcement revolves around GDPR compliance and associated fines raises questions about whether companies will be motivated to share research and open source datasets in the future.