5 ms·

The best thing one can do is not use cookies -> no need for a consent banner. If that's not an option, the next best thing is to have an overlay that is as hon

The best thing one can do is not use cookies -> no need for a consent banner. If that's not an option, the next best thing is to have an overlay that is as honest as possible and most importantly provides not only an "Accept all", but also a "Reject all" button. Don't use dark patterns, basically. That is, use the same color, style and size for each of those buttons. My experience is that most users are so used to these overlays by now, they just look for the button which gets rid of them most quickly. Marketing will typically push to tinker with the appearance of the buttons to increase the conversion rate in favor of the "Accept all" option.

bglazer 3y ago
Yes, if you put the “reject all”, button behind a “customize cookie settings” click, you’re a bad, anti-social person.
- diffeomorphism 3y ago
  Also probably illegal. That part of the law is not yet enforced very much, but there have been a few rulings.
  - starbugs 3y ago
    The question always is whether there's a negative consequence outweighing the "positive" incentive of trying to increase favorable consent decisions by using dark patterns. I had the pleasure to learn a lot about this while working in the higher levels of some german company with a somewhat questionable track record. Here's what you can do (only applies to Germany, but might be similar elsewhere): Complain to the data protection authority of your local state in writing. These complaints will be followed up by the authority and if enough of them accumulate, the company will have a bad time and the aforementioned incentive equation will be bent towards the end that favors user privacy. Don't write angry emails. Nobody cares and you waste time.
  - dcminter 3y ago
    > Also probably illegal. Pretty clearly so. It seems weird to me that so many companies put up a cookie banner in order to avoid breaking the law, and then break the law in order to make it less effective. I suppose the win here is that if the (fairly toothless) regulators notice you can say "oh we thought this was enough" and then tweak it. But in that case why not just have no banner at all, and wait until they notice in the first place? Just as daft as the extra-US sites that choose to show no content to EU geolocated origins instead of complying with the law. Which is... also illegal under the letter of the law, so why not just ignore the law. Presumably you're probably out of the jurisdiction anyway if you're bothering to do this.
    - hansvm 3y ago
      > Just as daft as the extra-US sites that choose to show no content to EU geolocated origins instead of complying with the law. Which is... also illegal under the letter of the law Since when? The GDPR explicitly only applies if you offer your shit to EU subjects or monitor EU subject behavior while they're in the EU. By actively rejecting those potential customers and not tracking them (because you refuse to provide them the product), does that not suffice to not have to worry about the rest of the terms? I know there are a few cases regarding linking to news articles and how the company in question can't stop providing that service, but in all such cases I'm aware of the offending company had other ties to the EU whereby the GDPR might have been enforceable.
    - dcminter 3y ago
      > extra-US extra-EU I mean.
- RobertRoberts 3y ago
  How would you save the "reject all" selection without using a cookie for that user's session?
  - starbugs 3y ago
    The cookie for saving the preference is technically required. Hence, it doesn't need consent.
  - Houssameddine 3y ago
    I think you don't need a cookie for that. You can use localStorage which is local to the user's device.
    - starbugs 3y ago
      It doesn't matter what method you use. Saving the information on the user's device and making them potentially identifiable is what counts.
  - markus92 3y ago
    It's not PII so you can just use a cookie.
YetAnotherNick 3y ago
Except this is not the question. Why is it so hard for people to understand cookies are absolutely needed even if you just want to calculate retention or number of unique visitors.
- Pet_Ant 3y ago
  > even if you just want to calculate retention or unique visitors. Why is it so hard to for people to understand that I just want you to serve me the page and bugger off? It's like justifying embedding GPS tracking in pamphlets that people hand out on the street. I don't want to be tracked period. Is it that hard?
  - ploum 3y ago
    Exactly. Is it your business to track people? There’s 90% chance that no, it’s not your business. There’s also a lot of chances that your website is about a product. In which case, it doesn’t make sense to know how many people come and read. People only need the information to know "will I buy that or not?" or, even more frequently "I’ve bought that but I don’t understand something". Tracking is counterproductive in most scenarios. (but very few understand that)
    - viraptor 3y ago
      You don't need cookies for it, but it very much makes a difference how many people come and read. Optimising the visitor-to-buyer pipeline is an important job for retail. To even begin doing that, you need to know what percentage of visitors bought something.
      - carlosjobim 3y ago
        > you need to know what percentage of visitors bought something. Why? What will you improve by knowing that, and why couldn't you improve that without knowing it?
    - YetAnotherNick 3y ago
mrgreenfur 3y ago
Actually not true, the regulation (eprivacy directive /pecr in uk) applies to all trackers including cookies, pixels, scripts,etc. if you can do with only “strictly necessary” across those then youre right. Also consider visitors are used to these prompts, without one they may wonder: does this site follow the law?
- deleted 3y ago
  [deleted]

bglazer 3y ago

Yes, if you put the “reject all”, button behind a “customize cookie settings” click, you’re a bad, anti-social person.

diffeomorphism 3y ago
Also probably illegal. That part of the law is not yet enforced very much, but there have been a few rulings.
- starbugs 3y ago
  The question always is whether there's a negative consequence outweighing the "positive" incentive of trying to increase favorable consent decisions by using dark patterns. I had the pleasure to learn a lot about this while working in the higher levels of some german company with a somewhat questionable track record. Here's what you can do (only applies to Germany, but might be similar elsewhere): Complain to the data protection authority of your local state in writing. These complaints will be followed up by the authority and if enough of them accumulate, the company will have a bad time and the aforementioned incentive equation will be bent towards the end that favors user privacy. Don't write angry emails. Nobody cares and you waste time.
- dcminter 3y ago
  > Also probably illegal. Pretty clearly so. It seems weird to me that so many companies put up a cookie banner in order to avoid breaking the law, and then break the law in order to make it less effective. I suppose the win here is that if the (fairly toothless) regulators notice you can say "oh we thought this was enough" and then tweak it. But in that case why not just have no banner at all, and wait until they notice in the first place? Just as daft as the extra-US sites that choose to show no content to EU geolocated origins instead of complying with the law. Which is... also illegal under the letter of the law, so why not just ignore the law. Presumably you're probably out of the jurisdiction anyway if you're bothering to do this.
  - hansvm 3y ago
    > Just as daft as the extra-US sites that choose to show no content to EU geolocated origins instead of complying with the law. Which is... also illegal under the letter of the law Since when? The GDPR explicitly only applies if you offer your shit to EU subjects or monitor EU subject behavior while they're in the EU. By actively rejecting those potential customers and not tracking them (because you refuse to provide them the product), does that not suffice to not have to worry about the rest of the terms? I know there are a few cases regarding linking to news articles and how the company in question can't stop providing that service, but in all such cases I'm aware of the offending company had other ties to the EU whereby the GDPR might have been enforceable.
  - dcminter 3y ago
    > extra-US extra-EU I mean.
RobertRoberts 3y ago
How would you save the "reject all" selection without using a cookie for that user's session?
- starbugs 3y ago
  The cookie for saving the preference is technically required. Hence, it doesn't need consent.
- Houssameddine 3y ago
  I think you don't need a cookie for that. You can use localStorage which is local to the user's device.
  - starbugs 3y ago
    It doesn't matter what method you use. Saving the information on the user's device and making them potentially identifiable is what counts.
- markus92 3y ago
  It's not PII so you can just use a cookie.

YetAnotherNick 3y ago

Except this is not the question. Why is it so hard for people to understand cookies are absolutely needed even if you just want to calculate retention or number of unique visitors.

Pet_Ant 3y ago
> even if you just want to calculate retention or unique visitors. Why is it so hard to for people to understand that I just want you to serve me the page and bugger off? It's like justifying embedding GPS tracking in pamphlets that people hand out on the street. I don't want to be tracked period. Is it that hard?
- ploum 3y ago
  Exactly. Is it your business to track people? There’s 90% chance that no, it’s not your business. There’s also a lot of chances that your website is about a product. In which case, it doesn’t make sense to know how many people come and read. People only need the information to know "will I buy that or not?" or, even more frequently "I’ve bought that but I don’t understand something". Tracking is counterproductive in most scenarios. (but very few understand that)
  - viraptor 3y ago
    You don't need cookies for it, but it very much makes a difference how many people come and read. Optimising the visitor-to-buyer pipeline is an important job for retail. To even begin doing that, you need to know what percentage of visitors bought something.
    - carlosjobim 3y ago
      > you need to know what percentage of visitors bought something. Why? What will you improve by knowing that, and why couldn't you improve that without knowing it?
  - YetAnotherNick 3y ago

mrgreenfur 3y ago

Actually not true, the regulation (eprivacy directive /pecr in uk) applies to all trackers including cookies, pixels, scripts,etc. if you can do with only “strictly necessary” across those then youre right. Also consider visitors are used to these prompts, without one they may wonder: does this site follow the law?

deleted 3y ago
[deleted]