5 ms·

Instead of hating the EU, how about directing your hate towards the bad players of the web? Cookie banners are not the fault of the EU, but the fault of compani

by Kovah 3y ago

Instead of hating the EU, how about directing your hate towards the bad players of the web? Cookie banners are not the fault of the EU, but the fault of companies disrespecting privacy rights and pushing data collection, ads and all possible shady growth hacking strategies towards the user. I am glad that a government body actually made this possible and made visible how horrible the internet is.

whalesalad 3y ago
A bad bandaid is still a bad thing, regardless of what it is covering up. Cookies are table stakes on the internet. This is the wrong solution to a completely different problem.
- nottorp 3y ago
  All they have to do is stop tracking us and only use login cookies if i log in. Simple enough. Any other cookies are not "table stakes".
  - danudey 3y ago
    Website analytics can be incredibly useful for designers and developers; giving those up would be a huge hit to a lot of companies, large and small, so it's understandable that they're not going to do so. Random example from more than a decade ago: I worked at an online retailer, and we did a nice redesign of our cart page. Looked great, much more readable, but we started losing sales. Did people hate the redesign? It was certainly easier to use and navigate. Our marketing guy looked at our analytics and saw that there was a massive drop in checkouts from users whose displays were set to 1024x768. He changed his resolution and, sure enough, the 'Checkout' button was something like four pixels below the bottom of the screen, if you were using Internet Explorer or Chrome and you had your browser maximized. I get that analytics can seem creepy and gross, and stuff like that is 'none of [retailers'] business' to a lot of people, but without those analytics we would have had no idea why we lost those sales, and would have had to simply revert the redesign with no real opportunity to change it.
    - madeofpalk 3y ago
      Analytics can be useful! They're not 'table stakes' though. The website will continue to work without them. If you want analytics, just get consent for be tracked.
      - skydhash 3y ago
        Doesn't HTTP has an header [0] for this? The user can opt easily in and out. I've just read the specs and find that it's being deprecated. Why? It may not be granular, but I believe anyone opting out of telemetry also does not want marketing tracking. [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
        madeofpalk 3y ago
        It was dropped because it made users more susceptible to be tracked. Requiring the opt-in to happen on the side creates an avenue to critique and dispute whether the website does the thing they say they do.
        Given_47 3y ago
        Yea websites straight up ignore it. Can’t currently find it but there was some wired/verge article detailing what they track of u and they actually mentioned as such too
        ElectricalUnion 3y ago
        It used to have several headers about site privacy compliance [1]. But because one really big early intenet player disrespected it [2] it became mostly useless. [1] https://www.w3.org/P3P/ https://www.w3.org/P3P/ > What is P3P? > The Platform for Privacy Preferences Project (P3P) enables Websites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents. P3P user agents will allow users to be informed of site practices (in both machine- and human-readable formats) and to automate decision-making based on these practices when appropriate. Thus users need not read the privacy policies at every site they visit. > Why is P3P useful? > P3P uses machine readable descriptions to describe the collection and use of data. Sites implementing such policies make their practises explicit and thus open them to public scrutiny. Browsers can help the user to understand those privacy practises with smart interfaces. Most importantly, Browsers can this way develop a predictable behavior when blocking content like cookies thus giving a real incentive to eCommerce sites to behave in a privacy friendly way. This avoids the current scattering of cookie-blocking behaviors based on individual heuristics imagined by the implementer of the blocking tool which will make the creation of stateful services on the web a pain because the state-retrievel will be unpredictable. [2] https://support.google.com/accounts/answer/151657?hl=en https://support.google.com/accounts/answer/151657?hl=en > P3P and Google's cookies > In some situations, the cookies we use to secure and authenticate your Google Account and store your preferences may be served from a different domain than the website you're visiting. This may happen, for example, if you visit websites with Google +1 buttons. > Some browsers require third party cookies to use the P3P protocol to state their privacy practices. However, the P3P protocol was not designed with situations like these in mind. As a result, we've inserted a link into our cookies that directs users to a page where they can learn more about the privacy practices associated with these cookies.
  - deleted 3y ago
    [deleted]
- madeofpalk 3y ago
  EU just requires explicit consent for non-table stakes/non-required persistent tracking. > The commonly seen method of using a checkbox and a simple information note such as “remember me (uses cookies)” next to the submit form would be an appropriate means of gaining consent therefore negating the need to apply an exemption in this case. If it is 'table stakes', like "remember me" checkbox, you don't need a separate cookie banner https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... via https://law.stackexchange.com/questions/32152/gdpr-cookie-for-login-management https://law.stackexchange.com/questions/32152/gdpr-cookie-fo...
  - deleted 3y ago
    [deleted]
hoorayimhelping 3y ago
It's not like this is limited to "bad players." It's standard procedure for almost every website. Whether that's good or bad is a separate topic - the point it's not just nefarious people using cookies to watch user behavior. Normal people use this information to make their websites better and create more effective products for people. Which is exactly what people said when this legislation was introduced. So instead of actually fixing anything, they made it worse. Now we're being tracked _and_ we have annoying nags that block content show up on every website, exactly like people said would happen when this legislation was introduced. It's the same tired nonsense as when regulators try to tax a business that's already operating on thin margins and act surprised when the business passes the cost to their customers instead of eating it. I'm not upset with the intent of what they were trying to do, which was noble; the upsetting thing is that it was patently obvious their hamfisted implementation would lead to this outcome, and they did it anyway, knowing they could count on people to deflect blame away from them.
qeternity 3y ago
> disrespecting privacy rights It's not as if these companies are kicking in your door and violating your right to privacy. You're accessing their site with a device that is configured to transmit whatever you have it set to. If you don't want cookies, disable cookies. If you want greater control, go and configure it yourself. Stop forcing your preferences on everyone. The reality is that outside of a vocal contingent on HN, most people simply do not care. They won't pay a cent for their ad supported services. And I for one hate the endless consent popups and GDPR hoops I have to jump through. As an expat in London, I can't read many local news stories in the US because those sites simply block the traffic instead of trying to comply with a foreign law.
- iamacyborg 3y ago
  > You're accessing their site with a device that is configured to transmit whatever you have it set to. This is not how it works. Me visiting a website does not mean I want that website to send my personal identifiers to hundreds of unknown (both to me and the website operator in question) third parties.
  - qeternity 3y ago
    Ok, so don’t go the site then?
- snehk 3y ago
  Tracking doesn't only happen through cookies. I thought this was well-known?
  - qeternity 3y ago
    I am using cookies as a catch all term, as many people do. I thought this was well known. If you don’t want fingerprinting, disable canvas, fonts, or JS entirely. My point is that you are downloading code and then executing it. You have control.
foobarian 3y ago
> how about directing your hate towards the bad players of the web? That's like hating a rock for rolling downhill. Regulation is the only way.
- mcphage 3y ago
  Rocks aren't made up of people; companies are.
RcouF1uZ4gsC 3y ago
This gets repeated a lot. However, even one of the pages on the official site of the EU has a cookie banner: https://commission.europa.eu/index_en https://commission.europa.eu/index_en Is the EU itself acting maliciously in putting up that cookie banner?
- ilyt 3y ago
  No because it is one click, not whatever dark patterns are other sites doing
- deleted 3y ago
  [deleted]
slotrans 3y ago
Cookie banners are absolutely the fault of the EU. Users have always been in control of whether they accept cookies. There have been settings in your browser since (at least) Netscape 3.0. It's only because of dumb EU laws that cookie control has been pushed up into "user space" with these idiotic banners that no one reads.
- turquoisevar 3y ago
  Really? Did Netscape 3.0 have per-site options to enable cookies and specifically allow/block third party cookies? If so, that’s impressive.
  - lkbm 3y ago
    IIRC, no, it wasn't per-site, but disallowing third-party cookies overall was a setting in 3.x. The more relevant aspect, I think, is that there's an essential/non-essential distinction in the law, which differs from 1st-party/3rd-party.
  - jamedjo 3y ago
    Our machines always had Cookie Pal [0] installed on them, and it allowed per domain settings for rejecting cookies and control over third party cookies [1]. > Cookie Pal includes the following features: > Automatically and transparently accepts or rejects cookies from all or specified servers without user interaction. > Cookies received from unspecified servers can be automatically accepted or rejected without user interaction, or the user can be asked for confirmation. > "On the fly" adding of servers to the accept from and reject from lists, allows you to manually accept or reject a cookie the first time it is received and then have it automatically accepted or rejected every time it is received thereafter. [0] https://web.archive.org/web/19971012223847/http://www.kburra.com/cpal.html https://web.archive.org/web/19971012223847/http://www.kburra... [1] https://web.archive.org/web/20010331050614/http://www.kburra.com/cptut/mainwin.html https://web.archive.org/web/20010331050614/http://www.kburra...
- dns_snek 3y ago
  It seems like you don't practice what you preach, seeing how Hacker News relies on cookies for authentication. Besides, GDPR isn't about cookies, it's about what companies are allowed to do with your personal information. Functional cookies don't require consent, abuse of your personal data does.
throw10920 3y ago
Enforcement is part of regulation. If the policymakers of the EU put regulation in place without enforcing it promptly and consistently, then it is indeed fair to blame them for this mess.

by Kovah 3y ago

whalesalad 3y ago

A bad bandaid is still a bad thing, regardless of what it is covering up. Cookies are table stakes on the internet. This is the wrong solution to a completely different problem.

nottorp 3y ago
All they have to do is stop tracking us and only use login cookies if i log in. Simple enough. Any other cookies are not "table stakes".
- danudey 3y ago
  Website analytics can be incredibly useful for designers and developers; giving those up would be a huge hit to a lot of companies, large and small, so it's understandable that they're not going to do so. Random example from more than a decade ago: I worked at an online retailer, and we did a nice redesign of our cart page. Looked great, much more readable, but we started losing sales. Did people hate the redesign? It was certainly easier to use and navigate. Our marketing guy looked at our analytics and saw that there was a massive drop in checkouts from users whose displays were set to 1024x768. He changed his resolution and, sure enough, the 'Checkout' button was something like four pixels below the bottom of the screen, if you were using Internet Explorer or Chrome and you had your browser maximized. I get that analytics can seem creepy and gross, and stuff like that is 'none of [retailers'] business' to a lot of people, but without those analytics we would have had no idea why we lost those sales, and would have had to simply revert the redesign with no real opportunity to change it.
  - madeofpalk 3y ago
    Analytics can be useful! They're not 'table stakes' though. The website will continue to work without them. If you want analytics, just get consent for be tracked.
    - skydhash 3y ago
      Doesn't HTTP has an header [0] for this? The user can opt easily in and out. I've just read the specs and find that it's being deprecated. Why? It may not be granular, but I believe anyone opting out of telemetry also does not want marketing tracking. [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
      - madeofpalk 3y ago
        It was dropped because it made users more susceptible to be tracked. Requiring the opt-in to happen on the side creates an avenue to critique and dispute whether the website does the thing they say they do.
      - Given_47 3y ago
        Yea websites straight up ignore it. Can’t currently find it but there was some wired/verge article detailing what they track of u and they actually mentioned as such too
      - ElectricalUnion 3y ago
        It used to have several headers about site privacy compliance [1]. But because one really big early intenet player disrespected it [2] it became mostly useless. [1] https://www.w3.org/P3P/ https://www.w3.org/P3P/ > What is P3P? > The Platform for Privacy Preferences Project (P3P) enables Websites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents. P3P user agents will allow users to be informed of site practices (in both machine- and human-readable formats) and to automate decision-making based on these practices when appropriate. Thus users need not read the privacy policies at every site they visit. > Why is P3P useful? > P3P uses machine readable descriptions to describe the collection and use of data. Sites implementing such policies make their practises explicit and thus open them to public scrutiny. Browsers can help the user to understand those privacy practises with smart interfaces. Most importantly, Browsers can this way develop a predictable behavior when blocking content like cookies thus giving a real incentive to eCommerce sites to behave in a privacy friendly way. This avoids the current scattering of cookie-blocking behaviors based on individual heuristics imagined by the implementer of the blocking tool which will make the creation of stateful services on the web a pain because the state-retrievel will be unpredictable. [2] https://support.google.com/accounts/answer/151657?hl=en https://support.google.com/accounts/answer/151657?hl=en > P3P and Google's cookies > In some situations, the cookies we use to secure and authenticate your Google Account and store your preferences may be served from a different domain than the website you're visiting. This may happen, for example, if you visit websites with Google +1 buttons. > Some browsers require third party cookies to use the P3P protocol to state their privacy practices. However, the P3P protocol was not designed with situations like these in mind. As a result, we've inserted a link into our cookies that directs users to a page where they can learn more about the privacy practices associated with these cookies.
- deleted 3y ago
  [deleted]
madeofpalk 3y ago
EU just requires explicit consent for non-table stakes/non-required persistent tracking. > The commonly seen method of using a checkbox and a simple information note such as “remember me (uses cookies)” next to the submit form would be an appropriate means of gaining consent therefore negating the need to apply an exemption in this case. If it is 'table stakes', like "remember me" checkbox, you don't need a separate cookie banner https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf https://ec.europa.eu/justice/article-29/documentation/opinio... via https://law.stackexchange.com/questions/32152/gdpr-cookie-for-login-management https://law.stackexchange.com/questions/32152/gdpr-cookie-fo...
- deleted 3y ago
  [deleted]

hoorayimhelping 3y ago

It's not like this is limited to "bad players." It's standard procedure for almost every website. Whether that's good or bad is a separate topic - the point it's not just nefarious people using cookies to watch user behavior. Normal people use this information to make their websites better and create more effective products for people. Which is exactly what people said when this legislation was introduced. So instead of actually fixing anything, they made it worse. Now we're being tracked _and_ we have annoying nags that block content show up on every website, exactly like people said would happen when this legislation was introduced. It's the same tired nonsense as when regulators try to tax a business that's already operating on thin margins and act surprised when the business passes the cost to their customers instead of eating it. I'm not upset with the intent of what they were trying to do, which was noble; the upsetting thing is that it was patently obvious their hamfisted implementation would lead to this outcome, and they did it anyway, knowing they could count on people to deflect blame away from them.

qeternity 3y ago

> disrespecting privacy rights It's not as if these companies are kicking in your door and violating your right to privacy. You're accessing their site with a device that is configured to transmit whatever you have it set to. If you don't want cookies, disable cookies. If you want greater control, go and configure it yourself. Stop forcing your preferences on everyone. The reality is that outside of a vocal contingent on HN, most people simply do not care. They won't pay a cent for their ad supported services. And I for one hate the endless consent popups and GDPR hoops I have to jump through. As an expat in London, I can't read many local news stories in the US because those sites simply block the traffic instead of trying to comply with a foreign law.

iamacyborg 3y ago
> You're accessing their site with a device that is configured to transmit whatever you have it set to. This is not how it works. Me visiting a website does not mean I want that website to send my personal identifiers to hundreds of unknown (both to me and the website operator in question) third parties.
- qeternity 3y ago
  Ok, so don’t go the site then?
snehk 3y ago
Tracking doesn't only happen through cookies. I thought this was well-known?
- qeternity 3y ago
  I am using cookies as a catch all term, as many people do. I thought this was well known. If you don’t want fingerprinting, disable canvas, fonts, or JS entirely. My point is that you are downloading code and then executing it. You have control.

foobarian 3y ago

> how about directing your hate towards the bad players of the web? That's like hating a rock for rolling downhill. Regulation is the only way.

mcphage 3y ago
Rocks aren't made up of people; companies are.

RcouF1uZ4gsC 3y ago

This gets repeated a lot. However, even one of the pages on the official site of the EU has a cookie banner: https://commission.europa.eu/index_en https://commission.europa.eu/index_en Is the EU itself acting maliciously in putting up that cookie banner?

ilyt 3y ago
No because it is one click, not whatever dark patterns are other sites doing
deleted 3y ago
[deleted]

slotrans 3y ago

Cookie banners are absolutely the fault of the EU. Users have always been in control of whether they accept cookies. There have been settings in your browser since (at least) Netscape 3.0. It's only because of dumb EU laws that cookie control has been pushed up into "user space" with these idiotic banners that no one reads.

turquoisevar 3y ago
Really? Did Netscape 3.0 have per-site options to enable cookies and specifically allow/block third party cookies? If so, that’s impressive.
- lkbm 3y ago
  IIRC, no, it wasn't per-site, but disallowing third-party cookies overall was a setting in 3.x. The more relevant aspect, I think, is that there's an essential/non-essential distinction in the law, which differs from 1st-party/3rd-party.
- jamedjo 3y ago
  Our machines always had Cookie Pal [0] installed on them, and it allowed per domain settings for rejecting cookies and control over third party cookies [1]. > Cookie Pal includes the following features: > Automatically and transparently accepts or rejects cookies from all or specified servers without user interaction. > Cookies received from unspecified servers can be automatically accepted or rejected without user interaction, or the user can be asked for confirmation. > "On the fly" adding of servers to the accept from and reject from lists, allows you to manually accept or reject a cookie the first time it is received and then have it automatically accepted or rejected every time it is received thereafter. [0] https://web.archive.org/web/19971012223847/http://www.kburra.com/cpal.html https://web.archive.org/web/19971012223847/http://www.kburra... [1] https://web.archive.org/web/20010331050614/http://www.kburra.com/cptut/mainwin.html https://web.archive.org/web/20010331050614/http://www.kburra...
dns_snek 3y ago
It seems like you don't practice what you preach, seeing how Hacker News relies on cookies for authentication. Besides, GDPR isn't about cookies, it's about what companies are allowed to do with your personal information. Functional cookies don't require consent, abuse of your personal data does.

throw10920 3y ago

Enforcement is part of regulation. If the policymakers of the EU put regulation in place without enforcing it promptly and consistently, then it is indeed fair to blame them for this mess.