13 ms·

This is fantastic, and I hope it stands up on the presumably inevitable appeal. It's the most obvious way of eventually getting rid of per-site cookie notices -

• mdiesel 3y ago
  It's a sad state of affairs that if I saw that message I would think positively of the website... Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor
  • littlestymaar 3y ago
    As long as you use the cookie for nothing else, this counts as a technical cookie that's allowed by GDPR.
    • M2Ys4U 3y ago
      This is nothing to do with the GDPR. It's the ePrivacy Directive that deals with cookies.
  • louis-lau 3y ago
    That's not really what anyone means when they say tracking...
    • youngtaff 3y ago
      The recent case against Criteo in the Netherlands has some interesting definitions of cookie types: This case revolves around (third party) tracking cookies. The Dutch Data Protection Authority (AP) defines 2 cookies as follows: “Cookies are small files that a website owner places on a visitor’s device. For example on a computer, laptop, smartphone or tablet. For example, the owner can collect or store information about the website visit or about (the device of) the visitor. Bottom of form There are 3 types of cookies: - functional cookies; - analytical cookies; - tracking cookies.” The AP says about tracking cookies 3 : “If cookies can also be read when you visit another website, we call these tracking cookies. These cookies allow organizations to track people’s internet behavior over time. Tracking cookies make it possible to draw up profiles of people ( profiling ) and treat them differently. Tracking cookies usually process personal data. Personal interests can be derived from the information about visited websites. This allows organizations to, for example, show their website visitors targeted advertisements. (…) Do you process personal data of visitors to your website with tracking cookies? Then you must comply with the rules of the General Data Protection Regulation (GDPR).” https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp&_x_tr_hist=true#!/details?id=ECLI:NL:RBAMS:2023:6530 https://uitspraken-rechtspraak-nl.translate.goog/?_x_tr_sl=a...
      • noirscape 3y ago
        For anyone wondering what the Dutch DPA (called the Autoriteit Persoonsgegevens, or Authority personal data) itself says about cookies (and user tracking in general really): https://www.autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies https://www.autoriteitpersoonsgegevens.nl/themas/internet-sl... (It's in dutch, translate at your own liberty, I'll give my own below + the stuff the authority for consumers and the market demands, which is linked from their page.) Basically of the three cookie types, functional cookies require no consent whatsoever. A cookie to set up a user session (the page uses a shopping cart in a webshop as an example and the details mention things like saved passwords and language choices) is totally fine. The AP still recommends informing the users, but it's not required. Analytical cookies are permissible insofar that they aren't used to profile the user. You're not required to ask for permission as long as they don't contain any uniquely identifying information. You are required to inform the visitor that you are placing these cookies though. The final category are tracking cookies. These fall under the full scope of the GDPR; you must ask for consent before placing them, you must tell people how you are collecting their data (cookies, scripts or beacons are listed as examples) and you need to tell people what you do with them. Pre-checking consent forms in general is expressly forbidden (on the same logic that you can't pre-check people into signing up for physical spam mail or paid subscriptions) and consent must be clearly stated, not hidden in some terms of services page or privacy statement. Those are all requirements on top of the rights the GDPR (in Dutch called the AVG) grants consumers, although obviously most of this overlaps with the GDPR already.
  • Macha 3y ago
    Storing previous_visitor=1 into local storage is not the type of tracking most people are objecting to, nor is it against the gdpr until you start having user specific indicators or trying to use a collection of values as a fingerprint.
    • hartator 3y ago
      And it is enough to get you in trouble if it’s a website you are not supposed to see.
      • norman784 3y ago
        Is that so? Event if you check that on the client side without sending that data to the server?
        • hartator 3y ago
          A wife can find out a husband is trying to cheat on them for example.
      • lupire 3y ago
        The data you choose to store with your software on your local machine is your responsibility. Tracking is server side behavior. 3P cookies aren't a problem, per se. Using 3rd party cookies to join data with other server side data is the problem.
        • hartator 3y ago
          Well you can still reject all cookies then, making all of these cookies popup nonsense.
    • closewith 3y ago
      Not GDPR, but probably does require consent under the ePrivacy Directive.
    • account42 3y ago
  • wkat4242 3y ago
    > Except that of you're only showing it once that means you're tracking me to know I'm a repeat visitor It is arguably tracking required for the functioning of the site which is a clear exception to the ban.
    • nvm0n2 3y ago
      It's clearly not required. The site would function without it. Therefore an activist will eventually argue to a court that it's a GDPR violation and win, meaning you have to pay up a fraction of your revenue (possibly sending you under). GDPR threads on HN are always like this. Tons of people saying "no no it doesn't work that way it wouldn't be reasonable" and then when that thing ends up being ruled illegal, "of course it's illegal everyone knew that it's all very clear". GDPR is written in such a way that you can't ever know what is or isn't allowed.
      • deleted 3y ago
        [deleted]
  • dkersten 3y ago
    That’s setting a cookie/local storage that can be used purely client side to determine whether to show the message or not. No tracking required because the server never has to see or store this.
    • cowl 3y ago
      local storage maybe, but cookies are sent on every request. there are no purely client side cookies.
  • smolder 3y ago
    Tracking cookies identify you across multiple sites. If some front-end JavaScript sets and checks a cookie for "has visited" on a single site, that's not considered tracking. It's non-identifying and harmless.
• DocTomoe 3y ago
  You are one of the good people. Unfortunately, many will go the easy route: What it will do is that even more websites won't be available over here, and direct to a 451 ("Unavailable due to legal restrictions") error. This fragmentises the net.
  • account42 3y ago
    The best way to fix that is for other countries to start improving their consumer protection laws so cutting off "problem" countries becomes less and less feasible for unscrupulous businesses. Meanwhile (slightly) more ethical companies can take over the EU market.
  • pbmonster 3y ago
    Do you have any examples for that phenomenon? I use a lot of news aggregators, and never once got a link to a 451. I think part of that is also that it's not foolproof to identify where a user is connecting from. Because I think legally, you can't use "but that user had an US IP address" as an excuse why you broke EU law against an EU citizen connecting from inside the EU.
    • BlueTemplar 3y ago
      Why not ?
      • lupire 3y ago
        Because if you're not sure where a user is, you can do the right thing instead of guessing.
  • hawk_ 3y ago
    EU is a massive market. If some unscrupulous businesses don't provide their services here, I'd say good riddance. If there's enough demand, other businesses will take over.
    • nvm0n2 3y ago
• account42 3y ago
  > and not even displaying the cookie notice Better would be to not (try to) do anything that requires cookie notices in the first place. Might not always be your decision but at least try to push back on the notion that this kind of tracking is needed at all.
  • lisper 3y ago
    Need can only be assessed relative to one's goals. Many business models depend on tracking, so if your goal is to run such a business, then it's needed.
    • JoshTriplett 3y ago
      If your business model depends on tracking, you should go out of business.
      • Almondsetat 3y ago
        My parking lot business depends on tracking the license plates of who enters and who exits
        • polygamous_bat 3y ago
          Cool, as long as you’re not tracking them everywhere else out in the world, shouldn’t be an issue.
        • sensanaty 3y ago
          Does it then proceed to track each license plate and their movements once outside the parking lot, keeping a note of every single place where the license plate goes and parks in order to build a profile on that license plate so that you can sell that info off and shove ads down their throats?
          • gonzan 3y ago
            That’s not how most people use cookies, just google & co. I’m using an in-house analytics app platform that uses cookies to track how often visitors use the app but we do no tracking at all outside of our website, we just want to know how often people use our site
• gsich 3y ago
  Technical cookies don't need a cookie banner anyway. Sadly not all website operators know this.
  • kioshix 3y ago
    They know this very well, but marketing/legal etc. force them to display it anyway, because they want to annoy you into just clicking "Accept all".
    • shadowgovt 3y ago
      And because the law is written so unaccountable bureaucrats (often in another country) get to decide what is a "technical cookie," so better safe than sorry.
      • tremon 3y ago
        often in another country Stop spouting nonsense. Enforcement is done by the DPA of the country where the company is located, hence why everyone is annoyed with how Ireland is handling Facebook but can't do anything about it.
        • shadowgovt 3y ago
          My company is located in the United States; which DPA has authority over the way my site handles Europeans' private data?
• sushibowl 3y ago
  > It's the most obvious way of eventually getting rid of per-site cookie notices - make DNT legally enforceable and cookie notices become irrelevant for people who have it switched on. I think this is unlikely to happen, because most websites actually want to track you. So they will display the banner anyway, or perhaps a slightly modified version like "we noticed you have your DNT turned on, but are you willing to make an exception just for us?" That gives them a chance users will consent anyway to get rid of the cookie banner. And they will argue that a specific consent given on their website overrides the generic non-consent represented by DNT.
• philipwhiuk 3y ago
  > The only thing I've wondered about is whether we show a one-off notice saying "we note your DNT setting and we've disabled tracking" How would you make it one-off?
  • plagiarist 3y ago
    Store a cookie that notes it has been displayed, but with no ID which can link between sessions.
    • wwalexander 3y ago
      Enough ID-less cookies become a de facto ID pretty quickly. ID cookies are just the easiest method of fingerprinting users.
      • mafuy 3y ago
        This is one of the most harmless uses of a cookie one could imagine. It can only be used to identify someone in combination with other fingerprinting techniques, but applying those without consent would be illegal. Accordingly, its danger can be entirely dismissed here.
      • plagiarist 3y ago
        Only if one actively uses them that way, in defiance of the laws in question.
  • lexicality 3y ago
    purely functional cookies (eg dismissed_banner=true) don't require consent
• EGreg 3y ago
  We should get rid of cookies in general! And the web. Hear me out. The Web makes it so that there is one server and lots of customers. It has to be hardened against SPAM, DDOS, etc. It pays all the costs. But also recoups them by tracking, it’s called surveillance capitalism. Every site should have no idea how many people visited, actually. Just a bunch of static front-end content that gets passed around. If people want to store their data, they can pay dumb pipes to store encrypted data. Get rid of email too. Anyone who gets ahold of your email address can spam you. Instead people should pay for the dumb pipes to store messages, and you can give out capabilities for your attention. They can be transferable but if they are abused then you cut off the root of that tree. And you should charge for using them, too. Just cause someone has your public address doesn’t mean they can reach you. In short, DNS and the Web and Email promote a certain dynamic where people invest in an upfront service and then take advantage of extreme power disparities forever, to recoup costs. And if they take on equity investors in a ponzi scheme until they IPO then they have more and more costs to recoup. There is no end to it. Wall street earnings depend on surveillance capitalism to continue.
• emptysongglass 3y ago
  This is how the cookie law should have been implemented and it was absolutely one hundred percent the fault of the lawmakers for not implementing it this way. The millions of hours bureaucracy has wasted having people click through banner pop-ups is entirely on the makers of the law, not the offenders.
  • anigbrowl 3y ago
    Are you being sarcastic? Cultural mores are different in the EU, lawmakers there began with a presumption of basic good faith on the part of business which turned out to be lamentably lacking in the international market. This is 50% the fault of the people trying to circumvent/undermine the law rather than cooperate with it.
    • emptysongglass 3y ago
      That is pure naivete and I'm saying this as a person who lives and works in the EU. It's time to get off our ethical high horse and treat corporations exactly as they expect to be treated.
    • shadowgovt 3y ago
      > lawmakers there began with a presumption of basic good faith on the part of business which turned out to be lamentably lacking in the international market Did they learn their lesson? Because that was an incredibly foolish assumption out of the starting gate; from old-guard developers and companies' points of view, they were stomping into a sandbox they hadn't built and upsetting the status quo that was working; of course malicious compliance should have been anticipated.
    • mcpackieh 3y ago
      > EU, lawmakers there began with a presumption of basic good faith on the part of business Are you telling me that EU lawmakers were utterly naive to common left wing critiques of capitalism? That beggars belief.
  • alkonaut 3y ago
    There is no “cookie law” and no mandate that banners are used etc. Regulation should try to avoid languages in specific technology as much as possible - and the GDPR does.
• shadowgovt 3y ago
  I wouldn't worry about that last concern. The overwhelming signal from users is that they don't actively think about tracking most of the time. If you show no banner, they'll assume nothing one way or the other. Just put up a `Privacy` link for those actually conscious of the topic to give them details; you'd be doing both categories of users a solid tucking that info out of the way.
• oliwarner 3y ago
  It's important to note that Cookie banners and GDPR are separate things and that these pop-ups are covering both purposes in a lot of cases. So even with a DNT flag, many sites will still need explicit, advance permission to process data, and cookies will still be a method for technical enablement. In an ideal world, respecting DNT would instantly bin 95% of the cookies and data processing requests, but I'm still getting automatic (and permissionless) marketing subscriptions from companies when I make purchases, and the British ICO seems unwilling to intervene, so it seems unlikely that DNT being case law is going to have any quick effect on things.
• bakuninsbart 3y ago
  My mom actually texted me once that she didn't like a site I shared with her, because it did not allow her to disable cookies... After a quick investigation it was because they weren't collecting any.