5 ms·

GDPR in Europe is what started it all. The law says that you must get explicit user consent for all kinds of data tracking. However it doesn't say how that sho

by gtowey 3y ago

GDPR in Europe is what started it all. The law says that you must get explicit user consent for all kinds of data tracking. However it doesn't say how that should happen. The annoying banners are completely a decision the industry has made. It's so weird to me that pretty much everyone adopted a near identical way to implement this. It also feels like retaliation -- a way to punish users by making these banners as disruptive as possible, and then blame it on regulations. It's like companies would rather destroy the web than give in and actually make it better.

tikkun 3y ago
What are some better ways to do it?
- lnxg33k1 3y ago
  Respect DNT header
  - IggleSniggle 3y ago
    Without a law to enforce that, it's a race to the bottom as the more effective monetization is to use DNT as a signal for improved tracking.
    - lnxg33k1 3y ago
      Maybe its a good time to reshare this to check own trackability https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
- deleted 3y ago
  [deleted]
- JKCalhoun 3y ago
  Don't track users? Magazines, tvs never did. Advertisers seemed to survive somehow.
  - mrweasel 3y ago
    I would love to see an A/B test that shows any significant difference in revenue if you just go whole hog on tracking, vs. tracking nothing for a campaign on any given product.
_5ygc 3y ago
It’s also a remarkably stupid implementation. If you follow the rules [1] in a strict way, the website should be usable if the user denied consent to non-essential cookie usage. You don’t need consent for strictly necessary cookies. So a bunch of websites don’t actually need a cookie banner, as long as they’re not using non-essential cookies. You could easily get consent for marketing/tracking cookies in an unobtrusive way. Instead, a lot of websites must have seen a drop in conversion because no one wants to interact with these awful cookie popups that have a hundred toggles. AFAIK the page-blocking cookie banners don’t just convert worse, they’re actually not permitted (you can’t block the experience to force consent). On my end: unless your website is very important to me, I’ll just refuse the cookies or hit the back button and load the next search result. 1: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
- corbezzoli 3y ago
  > you can’t block the experience That doesn’t sound right. I think interstitial are permitted by the law, I don’t think it actually says anything about “the experience.” > to force consent The vast majority of website will work after clicking No, so that’s not forced. Only rarely I see “accept cookie or subscribe” banners. I’m not even sure that this is not allowed either; user is technically forced to accept either because the “close tab” button is always available.
  - _5ygc 3y ago
    Technically speaking (I enforce GDPR on a technical level, not legal), you’re right on both counts. The interstitial isn’t forcing anyone to accept the cookies, and isn’t preventing the experience. But… in real-life UX, we all know the users will just hit the most obvious CTA to accept all cookies because their experience is being effectively blocked. The implementation is technically okay, but reminds me of r/MaliciousCompliance.
egypturnash 3y ago
Most of the "turn off a zillion different switches" banners say something like "Powered by OneTrust". There's like 3-4 names I've seen on them, that's just the only one I remember. There is now an entire sector of the adtech industry devoted to making a GDPR-compliance solution that is carefully designed to make it just frustrating enough that most people hit "sure gimme all the cookies, whatever, I just wanna read this stupid link". Someone was paid well to build these despite any moral qualms they may have had about making the entire Web a little bit shittier.
- mrweasel 3y ago
  Exactly, these all look and feel the same, because they are all a third-party "add-on" that websites simply load in via a JavaScript snippet. There a handful of providers, many of which got their start with the original cookie banners. I worked with one of these original cookie banners and the company behind it was absolute shit and understood nothing about how the internet works. You'd slap their JavaScript snippet on your site, they'd then "scan" your site and figure out which cookies appeared and what they did and display that to your customers, so you'd be complaint, technically. Except they didn't recognize half the cookies (and funnily enough still don't 10+ years later), they didn't understand that you don't need to display the session cookie, if it's just used to keep track of your basket or if you're authenticate, and they didn't scan behind authenticated pages. These same bozos just extended their business when GDPR was enacted. They still understand nothing, they still do not care about why the law was created. All they do is provide a service that companies can buy and then continue to not change their business practices. This what these popup and banners are for, their are designed to avoid having to change an industry that has zero interest in your privacy. It's actually remarkable that websites will accept a shitty user experience, if it means that they can track whatever percentage click accept.
lnxg33k1 3y ago
Like DNT didn’t exist, and idiots take it to EU instead of companies
- charcircuit 3y ago
  The problem with DNT was that it was a global setting as opposed to one that was per website.
  - adastra22 3y ago
    How is that a problem?
    - charcircuit 3y ago
      Because sites want users to judge them independently. Some users want to avoid shady sites tracking them, but may allow reputable businesses to track them. Reputable businesses being taken out as collateral from a global DNT is not good for them.
      - agos 3y ago
        in reality any user which is savvy enough to turn on DNT knows that all tracking is shady
  - Bu9818 3y ago
    Surely, browsers could create a setting to toggle DNT per hostname?
JKCalhoun 3y ago
> It's like companies would rather destroy the web Weirdly they're only destroying their own sites though.
doublepg23 3y ago
Why does the official EU site use them then? https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en
thiht 3y ago
> GDPR in Europe is what started it all Cookie banners are a result of the ePrivacy directive, not GDPR. Also we could have had something better than cookie banners if browser vendors and companies had collaborated on a standard. Imagine if cookie banners were implemented like the permission system, via <meta> tags or headers, we could get: - automatic blocking by the browser of cookies not declared explicitly - ability for websites to mark technical cookies (these are allowed with no consent) - a global settings view in the browser of all the cookies allowed or denied - and a uniform implementation everywhere Instead we ended up with this shit. It’s definitely not the EU’s fault, the directive doesn’t say to use crappy banners.
28304283409234 3y ago
That's victim blaming. The problem started with massive surveillance by tech companies.

by gtowey 3y ago

tikkun 3y ago

What are some better ways to do it?

lnxg33k1 3y ago
Respect DNT header
- IggleSniggle 3y ago
  Without a law to enforce that, it's a race to the bottom as the more effective monetization is to use DNT as a signal for improved tracking.
  - lnxg33k1 3y ago
    Maybe its a good time to reshare this to check own trackability https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
deleted 3y ago
[deleted]
JKCalhoun 3y ago
Don't track users? Magazines, tvs never did. Advertisers seemed to survive somehow.
- mrweasel 3y ago
  I would love to see an A/B test that shows any significant difference in revenue if you just go whole hog on tracking, vs. tracking nothing for a campaign on any given product.

_5ygc 3y ago

It’s also a remarkably stupid implementation. If you follow the rules [1] in a strict way, the website should be usable if the user denied consent to non-essential cookie usage. You don’t need consent for strictly necessary cookies. So a bunch of websites don’t actually need a cookie banner, as long as they’re not using non-essential cookies. You could easily get consent for marketing/tracking cookies in an unobtrusive way. Instead, a lot of websites must have seen a drop in conversion because no one wants to interact with these awful cookie popups that have a hundred toggles. AFAIK the page-blocking cookie banners don’t just convert worse, they’re actually not permitted (you can’t block the experience to force consent). On my end: unless your website is very important to me, I’ll just refuse the cookies or hit the back button and load the next search result. 1: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/

corbezzoli 3y ago
> you can’t block the experience That doesn’t sound right. I think interstitial are permitted by the law, I don’t think it actually says anything about “the experience.” > to force consent The vast majority of website will work after clicking No, so that’s not forced. Only rarely I see “accept cookie or subscribe” banners. I’m not even sure that this is not allowed either; user is technically forced to accept either because the “close tab” button is always available.
- _5ygc 3y ago
  Technically speaking (I enforce GDPR on a technical level, not legal), you’re right on both counts. The interstitial isn’t forcing anyone to accept the cookies, and isn’t preventing the experience. But… in real-life UX, we all know the users will just hit the most obvious CTA to accept all cookies because their experience is being effectively blocked. The implementation is technically okay, but reminds me of r/MaliciousCompliance.

egypturnash 3y ago

Most of the "turn off a zillion different switches" banners say something like "Powered by OneTrust". There's like 3-4 names I've seen on them, that's just the only one I remember. There is now an entire sector of the adtech industry devoted to making a GDPR-compliance solution that is carefully designed to make it just frustrating enough that most people hit "sure gimme all the cookies, whatever, I just wanna read this stupid link". Someone was paid well to build these despite any moral qualms they may have had about making the entire Web a little bit shittier.

mrweasel 3y ago
Exactly, these all look and feel the same, because they are all a third-party "add-on" that websites simply load in via a JavaScript snippet. There a handful of providers, many of which got their start with the original cookie banners. I worked with one of these original cookie banners and the company behind it was absolute shit and understood nothing about how the internet works. You'd slap their JavaScript snippet on your site, they'd then "scan" your site and figure out which cookies appeared and what they did and display that to your customers, so you'd be complaint, technically. Except they didn't recognize half the cookies (and funnily enough still don't 10+ years later), they didn't understand that you don't need to display the session cookie, if it's just used to keep track of your basket or if you're authenticate, and they didn't scan behind authenticated pages. These same bozos just extended their business when GDPR was enacted. They still understand nothing, they still do not care about why the law was created. All they do is provide a service that companies can buy and then continue to not change their business practices. This what these popup and banners are for, their are designed to avoid having to change an industry that has zero interest in your privacy. It's actually remarkable that websites will accept a shitty user experience, if it means that they can track whatever percentage click accept.

lnxg33k1 3y ago

Like DNT didn’t exist, and idiots take it to EU instead of companies

charcircuit 3y ago
The problem with DNT was that it was a global setting as opposed to one that was per website.
- adastra22 3y ago
  How is that a problem?
  - charcircuit 3y ago
    Because sites want users to judge them independently. Some users want to avoid shady sites tracking them, but may allow reputable businesses to track them. Reputable businesses being taken out as collateral from a global DNT is not good for them.
    - agos 3y ago
      in reality any user which is savvy enough to turn on DNT knows that all tracking is shady
- Bu9818 3y ago
  Surely, browsers could create a setting to toggle DNT per hostname?

JKCalhoun 3y ago

> It's like companies would rather destroy the web Weirdly they're only destroying their own sites though.

doublepg23 3y ago

Why does the official EU site use them then? https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en

thiht 3y ago

> GDPR in Europe is what started it all Cookie banners are a result of the ePrivacy directive, not GDPR. Also we could have had something better than cookie banners if browser vendors and companies had collaborated on a standard. Imagine if cookie banners were implemented like the permission system, via <meta> tags or headers, we could get: - automatic blocking by the browser of cookies not declared explicitly - ability for websites to mark technical cookies (these are allowed with no consent) - a global settings view in the browser of all the cookies allowed or denied - and a uniform implementation everywhere Instead we ended up with this shit. It’s definitely not the EU’s fault, the directive doesn’t say to use crappy banners.

28304283409234 3y ago

That's victim blaming. The problem started with massive surveillance by tech companies.