5 ms·

> Because WebSession is dedicated to session maintenance and nothing else, a client could theoretically reject all cookies on any supporting site, ideally skipp

> Because WebSession is dedicated to session maintenance and nothing else, a client could theoretically reject all cookies on any supporting site, ideally skipping the jarring cookie banner experience. This has nothing to do with cookies, the banner is required if the site is processing data that is not just technically necessary. In this case the site needs to ask the user for consent or at least inform them of processing due to legitimate interests.

spiderfarmer 3y ago
Still lots of sites have cookie banners because the legal department demands them, even though they are not needed for the cookies they use.
- archerx 3y ago
  Maybe they need better legal departments that can actually read and understand laws?
  - jampekka 3y ago
    Nobody ever got fired for joining the cargo cult.
    - latexr 3y ago
      I wouldn’t be so sure. Joining the cargo cult doesn’t make you immune to the law. https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
      - jampekka 3y ago
        Very unlikely this will cause anybody to be fired. Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. E.g. a lot of sites used the IAB nag that was found illegal by the regulators. But IIUC only IAB had to pay a small fine and I'm quite sure nobody got fired for it because it was the "industry standard". NOYB is fighting the good fight, and without it GDPR would be even more useless. But it's a losing battle, and NYOB itself is sort of admitting that. https://noyb.eu/en/statement-4-years-gdpr https://noyb.eu/en/statement-4-years-gdpr GDPR is in theory a good law (although things like mandatory honoring of do-not-track headers should have been obviously included). But it's not being enforced almost at all probably due to regulatory agencies and EU being corrupt AF. Having a lot of money, lobbyists and lawyers makes you immune to the law.
        latexr 3y ago
        > Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. NOYB’s intervention has lead to fines and I’ve been seeing way more banners have a “Reject All” at the top level. I remember noticing that at the same time NOYB posted about it. Unfortunately I don’t remember any useful keyword to search their website and post the source. Though I’m not disagreeing with you. I have no doubt the dark patterns will continue and these companies will be as vampiric as they can get away with. My strategy is to use that as a useful signal: the more a company or website bends over backwards to try to get me to accept data collection, the more I know I can’t trust them and will simply leave.
        jampekka 3y ago
        Do you have a reference for the fines? Can't find much on the enforcement tracker [1], but seeing if the decision is about a nag or not is not easy to see quickly, so I may have missed them. NOYB also gave them a "grace period" before filing complaints, so I don't know how many complaints they actually made. A lot of the nags have indeed gotten less illegal lately. Although I have very little faith in that even clicking Reject All really prevents tracking and selling me out. There are still those "legitimate interests" etc loopholes. And probably no regulator actually checks that the Reject is honored at all. Nowadays I don't even care. Used to go private mode for those but don't bother anymore. Hopefully at least my aggressive ad blocking makes spying on me mostly worthless on them. Implementation of the GDPR consent was broken from the getgo (likely due to corruption). The spirit of the law is clearly that people shouldn't be tracked if they don't want it. Vast majority don't want to be tracked but vast majority are tracked. If EU would have actually wanted this to work it would have been something like DNT. Also the promised megafines have not (and will not be) materialized and the (widespread and blantant) violations are at best just cost of doing business. But making an actually effective implementation would have closed many revolving doors and fancy dinners. Sorry for being so negative on this but I think entertaining hopes for such a fundamentally broken system may prevent less broken ones from arising. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ (going through the cases also shows that the DPAs are mostly fiddling with small fish who don't have the corruption power and/or lawyer army)
  - 3c6bYDXLMj 3y ago
    [flagged]
    - archerx 3y ago
      That’s ironic because cookie banner feels soaked in deception. They should be called tracker banners instead of sugar coating it by calling it a cookie also the ask to try and extract data to be sold on a side market. Everytime I see a cookie banner I think I am not only a client but also a potential product and that makes me think less of the brand. Also it makes the site look ugly and cluttered. You’d think you’d try to avoid the above of you had the option.
- extraduder_ire 3y ago
  I recall a friend of mine worked support for some sass meeting software (oncehub-like) and got an email from a non-technical user asking if the booking invite page is missing a cookie notice. He had to explain that they re-engineered the page a while back to not collect any data besides what the person puts into the form (the page explains that collection, but inline) so they wouldn't need one. Don't know if it was an aesthetic choice or if they AB tested it.
- diggan 3y ago
  Yeah, companies tend to be over-careful. They trust the legal department knows what they're talking about but in this case they don't, but the company decides to listen to them anyway. Especially if the legal department is a part of a US company, thinking they adhere to some EU regulation they can't seem to quite understand fully. :shrug:
- Aachen 3y ago
  If they had asked a legal department whether a banner is needed for functional data storage (such as a cookie), they'd know it isn't demanded by them
- xctr94 3y ago
  And also because then users will automatically click “Accept All Cookies” as that’s the highlighted CTA. This reply is only mildly cynical.
- mpeg 3y ago
  I think it’s often the opposite, sites have cookie banners that are actually useless because they’re still not compliant. Often if it’s a custom cookie banner it will only have an “accept” button (no way to reject!) and usually with vague language like “ok” Even where they do have the right language and a way to reject cookies, sometimes the site sets cookies ahead of the user actually accepting them.
  - janosdebugs 3y ago
    IANAl, but this would still be compliant if they use legitimate interest as a justification. In that case the user just needs to be informed and have the opinion to object via separate means.
deleted 3y ago
[deleted]

spiderfarmer 3y ago

Still lots of sites have cookie banners because the legal department demands them, even though they are not needed for the cookies they use.

archerx 3y ago
Maybe they need better legal departments that can actually read and understand laws?
- jampekka 3y ago
  Nobody ever got fired for joining the cargo cult.
  - latexr 3y ago
    I wouldn’t be so sure. Joining the cargo cult doesn’t make you immune to the law. https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
    - jampekka 3y ago
      Very unlikely this will cause anybody to be fired. Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. E.g. a lot of sites used the IAB nag that was found illegal by the regulators. But IIUC only IAB had to pay a small fine and I'm quite sure nobody got fired for it because it was the "industry standard". NOYB is fighting the good fight, and without it GDPR would be even more useless. But it's a losing battle, and NYOB itself is sort of admitting that. https://noyb.eu/en/statement-4-years-gdpr https://noyb.eu/en/statement-4-years-gdpr GDPR is in theory a good law (although things like mandatory honoring of do-not-track headers should have been obviously included). But it's not being enforced almost at all probably due to regulatory agencies and EU being corrupt AF. Having a lot of money, lobbyists and lawyers makes you immune to the law.
      - latexr 3y ago
        > Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. NOYB’s intervention has lead to fines and I’ve been seeing way more banners have a “Reject All” at the top level. I remember noticing that at the same time NOYB posted about it. Unfortunately I don’t remember any useful keyword to search their website and post the source. Though I’m not disagreeing with you. I have no doubt the dark patterns will continue and these companies will be as vampiric as they can get away with. My strategy is to use that as a useful signal: the more a company or website bends over backwards to try to get me to accept data collection, the more I know I can’t trust them and will simply leave.
        jampekka 3y ago
        Do you have a reference for the fines? Can't find much on the enforcement tracker [1], but seeing if the decision is about a nag or not is not easy to see quickly, so I may have missed them. NOYB also gave them a "grace period" before filing complaints, so I don't know how many complaints they actually made. A lot of the nags have indeed gotten less illegal lately. Although I have very little faith in that even clicking Reject All really prevents tracking and selling me out. There are still those "legitimate interests" etc loopholes. And probably no regulator actually checks that the Reject is honored at all. Nowadays I don't even care. Used to go private mode for those but don't bother anymore. Hopefully at least my aggressive ad blocking makes spying on me mostly worthless on them. Implementation of the GDPR consent was broken from the getgo (likely due to corruption). The spirit of the law is clearly that people shouldn't be tracked if they don't want it. Vast majority don't want to be tracked but vast majority are tracked. If EU would have actually wanted this to work it would have been something like DNT. Also the promised megafines have not (and will not be) materialized and the (widespread and blantant) violations are at best just cost of doing business. But making an actually effective implementation would have closed many revolving doors and fancy dinners. Sorry for being so negative on this but I think entertaining hopes for such a fundamentally broken system may prevent less broken ones from arising. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ (going through the cases also shows that the DPAs are mostly fiddling with small fish who don't have the corruption power and/or lawyer army)
- 3c6bYDXLMj 3y ago
  [flagged]
  - archerx 3y ago
    That’s ironic because cookie banner feels soaked in deception. They should be called tracker banners instead of sugar coating it by calling it a cookie also the ask to try and extract data to be sold on a side market. Everytime I see a cookie banner I think I am not only a client but also a potential product and that makes me think less of the brand. Also it makes the site look ugly and cluttered. You’d think you’d try to avoid the above of you had the option.
extraduder_ire 3y ago
I recall a friend of mine worked support for some sass meeting software (oncehub-like) and got an email from a non-technical user asking if the booking invite page is missing a cookie notice. He had to explain that they re-engineered the page a while back to not collect any data besides what the person puts into the form (the page explains that collection, but inline) so they wouldn't need one. Don't know if it was an aesthetic choice or if they AB tested it.
diggan 3y ago
Yeah, companies tend to be over-careful. They trust the legal department knows what they're talking about but in this case they don't, but the company decides to listen to them anyway. Especially if the legal department is a part of a US company, thinking they adhere to some EU regulation they can't seem to quite understand fully. :shrug:
Aachen 3y ago
If they had asked a legal department whether a banner is needed for functional data storage (such as a cookie), they'd know it isn't demanded by them
xctr94 3y ago
And also because then users will automatically click “Accept All Cookies” as that’s the highlighted CTA. This reply is only mildly cynical.
mpeg 3y ago
I think it’s often the opposite, sites have cookie banners that are actually useless because they’re still not compliant. Often if it’s a custom cookie banner it will only have an “accept” button (no way to reject!) and usually with vague language like “ok” Even where they do have the right language and a way to reject cookies, sometimes the site sets cookies ahead of the user actually accepting them.
- janosdebugs 3y ago
  IANAl, but this would still be compliant if they use legitimate interest as a justification. In that case the user just needs to be informed and have the opinion to object via separate means.

deleted 3y ago

[deleted]