5 ms·

This is one of the marks of good product managers. Cut the cruft from the product. It's refreshing that in this case regulators are cutting things from the prod

This is one of the marks of good product managers. Cut the cruft from the product. It's refreshing that in this case regulators are cutting things from the product rather than enforcing things to be added like cookie banners.

ocdtrekkie 3y ago
Regulators didn't enforce cookie banners. Cookie banners are a form of malicious compliance. When you complain about them, you are doing the lobbying work of ad companies for free. The correct solution is to just not spy on people, and the problem is that the EU didn't go far enough and just ban the behavior altogether.
- 6510 3y ago
  Fun thought experiment: How would you disable access to your website after someone refuses your cookies? iow, you should always click NO.
  - scintill76 3y ago
    If they don’t send a cookie, pop up the banner. If they click No, redirect them to another site. If they click yes, save the cookie.
    - 6510 3y ago
      What if they visit the same site again? Can you just ask again and again?
  - zamadatix 3y ago
    By requiring a valid cookie be present and used when trying to actually use the functionality of the site. The law does not allow this kind of behaviour for any cookies that require consent though, so that's why you can get away with hitting no.
  - watermelon0 3y ago
    1.) In general, it's illegal to disable access to the website, if user rejects tracking cookies. 2.) You are allowed to save 'consent=given/rejected' cookie depending on user choice.
- lovepronmostly 3y ago
  What is the limit here? If I own a store and you walk into my store am I required to forget that you came into my store? Monday: Bill: "Hey Jane (store owner), do you have any X45 hammers?" Jane: "Sorry Bill, I'm out but might have some tomorrow" Tuesday: Bill "Did hammer come in I mentioned yesterday?" Jane: "What hammer? Sorry I'm not allowed to remember anything about people in my shop because that would be spying so whatever you said to me yesterday has been deleted from my memory" PS: I hate spying too. I'm just not sure how to design a law to prevent it that doesn't have unintended consequences.
  - superb_dev 3y ago
    Jane is tracking you from store to store, remembering everything you saw, everything you interacted with, everything you did, and selling that to the highest bidder
  - kmeisthax 3y ago
    Yes. In fact, you already do this most of the time. The right to be forgotten is so fundamental to humanity that humans have to expend extra effort to violate it and remember stuff. Machines with perfect memory violate the right to be forgotten by default and we have to tell them to forget things. Hence the regulation.
    - lovepronmostly 3y ago
      I don't do this most of the time. It keep a diary. I keep records of all kinds of stuff.
      - whatshisface 3y ago
        I would be uncomfortable if I had found out your diary contained as much about my daily travel and grocery errands as I know can be bought by marketing firms, or anyone with the right relationships in the industry. For that matter, the friendly greengrocer doesn't know what I bought at the shoe store.
      - yjftsjthsd-h 3y ago
- zamadatix 3y ago
  The rules are really surprisingly encouraging about notification of cookies to the point it's quite easy to legitimately need to notify and gain consent about something non-spying related requires consent. E.g. if you have a UI customization cookie which sets the results density preference and you want to store that more than a session (i.e. it should still save for a month later) then the official EU analysis of this is you must notify this is a cookie and that setting this will set this cookie. If the law didn't intend for users to be inundated with notification banners and consent checkboxes it sure is odd how much time they spent about writing how anything but the most basic connection cookies require said things.
  - handsclean 3y ago
    It’s trivial to implement this in a legal and user friendly way, just make the save button make clear that it’ll persist, or even add a persistence checkbox. Demanding consent as an aggressive popup when it isn’t necessary for anything but ad tracking is not a good faith compliance effort, it’s an attempt to avoid real compliance by just having the user just sign off on whatever they were already doing.
    - sureglymop 3y ago
      Add the cookie popup/banner into the browser so that the user can make a choice for _all_ the websites used. But honestly, something like that is much harder to achieve with such regulations because it's kind of not the browser vendors problem. The ad network companies are parasitic in a way.
      - janfoeh 3y ago
        We've had that twenty years ago, in Internet Explorer no less [1]. It just never gained traction, likely because it was quite convoluted. [1] https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P
  - mrweasel 3y ago
    > E.g. if you have a UI customization cookie which sets the results density preference and you want to store that more than a session I'm not entirely sure that this is true. You can implement a "shopping cart" on your site, with a session cookie without needing to have a "cookie notification", so depending on circumstance I'd argue that settings might be allowed as well. Or you can just display the cookie information along with the settings it self, it doesn't actually need to be a popup.
- eviks 3y ago
  Regulators are the ones accepting the malicious compliance as compliance! So they did enforce cookie banners. When you ignore that fact, you are doing the pro-gov propaganda for free.
  - mrweasel 3y ago
    > Regulators are the ones accepting the malicious compliance as compliance! Yeah, I had to read the first version of "the cookie law". The intend was super clear, at least in the Danish version, it was pretty easy to implement and wouldn't really bother anyone... Then came the marketing/SEO/retargting assholes who had a nice thing going tracking the everlasting crap out of everyone and they did NOT want things to change. Some of these people then came up with the "hosted cookie banner" and things went to hell from there. You are absolutely right that this should never in a million years be viewed as compliance. It mostly didn't, and still doesn't work. What should have happened is that the law should have been amended to prevent outsourcing responsibility.

ocdtrekkie 3y ago

Regulators didn't enforce cookie banners. Cookie banners are a form of malicious compliance. When you complain about them, you are doing the lobbying work of ad companies for free. The correct solution is to just not spy on people, and the problem is that the EU didn't go far enough and just ban the behavior altogether.

6510 3y ago
Fun thought experiment: How would you disable access to your website after someone refuses your cookies? iow, you should always click NO.
- scintill76 3y ago
  If they don’t send a cookie, pop up the banner. If they click No, redirect them to another site. If they click yes, save the cookie.
  - 6510 3y ago
    What if they visit the same site again? Can you just ask again and again?
- zamadatix 3y ago
  By requiring a valid cookie be present and used when trying to actually use the functionality of the site. The law does not allow this kind of behaviour for any cookies that require consent though, so that's why you can get away with hitting no.
- watermelon0 3y ago
  1.) In general, it's illegal to disable access to the website, if user rejects tracking cookies. 2.) You are allowed to save 'consent=given/rejected' cookie depending on user choice.
lovepronmostly 3y ago
What is the limit here? If I own a store and you walk into my store am I required to forget that you came into my store? Monday: Bill: "Hey Jane (store owner), do you have any X45 hammers?" Jane: "Sorry Bill, I'm out but might have some tomorrow" Tuesday: Bill "Did hammer come in I mentioned yesterday?" Jane: "What hammer? Sorry I'm not allowed to remember anything about people in my shop because that would be spying so whatever you said to me yesterday has been deleted from my memory" PS: I hate spying too. I'm just not sure how to design a law to prevent it that doesn't have unintended consequences.
- superb_dev 3y ago
  Jane is tracking you from store to store, remembering everything you saw, everything you interacted with, everything you did, and selling that to the highest bidder
- kmeisthax 3y ago
  Yes. In fact, you already do this most of the time. The right to be forgotten is so fundamental to humanity that humans have to expend extra effort to violate it and remember stuff. Machines with perfect memory violate the right to be forgotten by default and we have to tell them to forget things. Hence the regulation.
  - lovepronmostly 3y ago
    I don't do this most of the time. It keep a diary. I keep records of all kinds of stuff.
    - whatshisface 3y ago
      I would be uncomfortable if I had found out your diary contained as much about my daily travel and grocery errands as I know can be bought by marketing firms, or anyone with the right relationships in the industry. For that matter, the friendly greengrocer doesn't know what I bought at the shoe store.
    - yjftsjthsd-h 3y ago
zamadatix 3y ago
The rules are really surprisingly encouraging about notification of cookies to the point it's quite easy to legitimately need to notify and gain consent about something non-spying related requires consent. E.g. if you have a UI customization cookie which sets the results density preference and you want to store that more than a session (i.e. it should still save for a month later) then the official EU analysis of this is you must notify this is a cookie and that setting this will set this cookie. If the law didn't intend for users to be inundated with notification banners and consent checkboxes it sure is odd how much time they spent about writing how anything but the most basic connection cookies require said things.
- handsclean 3y ago
  It’s trivial to implement this in a legal and user friendly way, just make the save button make clear that it’ll persist, or even add a persistence checkbox. Demanding consent as an aggressive popup when it isn’t necessary for anything but ad tracking is not a good faith compliance effort, it’s an attempt to avoid real compliance by just having the user just sign off on whatever they were already doing.
  - sureglymop 3y ago
    Add the cookie popup/banner into the browser so that the user can make a choice for _all_ the websites used. But honestly, something like that is much harder to achieve with such regulations because it's kind of not the browser vendors problem. The ad network companies are parasitic in a way.
    - janfoeh 3y ago
      We've had that twenty years ago, in Internet Explorer no less [1]. It just never gained traction, likely because it was quite convoluted. [1] https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P
- mrweasel 3y ago
  > E.g. if you have a UI customization cookie which sets the results density preference and you want to store that more than a session I'm not entirely sure that this is true. You can implement a "shopping cart" on your site, with a session cookie without needing to have a "cookie notification", so depending on circumstance I'd argue that settings might be allowed as well. Or you can just display the cookie information along with the settings it self, it doesn't actually need to be a popup.
eviks 3y ago
Regulators are the ones accepting the malicious compliance as compliance! So they did enforce cookie banners. When you ignore that fact, you are doing the pro-gov propaganda for free.
- mrweasel 3y ago
  > Regulators are the ones accepting the malicious compliance as compliance! Yeah, I had to read the first version of "the cookie law". The intend was super clear, at least in the Danish version, it was pretty easy to implement and wouldn't really bother anyone... Then came the marketing/SEO/retargting assholes who had a nice thing going tracking the everlasting crap out of everyone and they did NOT want things to change. Some of these people then came up with the "hosted cookie banner" and things went to hell from there. You are absolutely right that this should never in a million years be viewed as compliance. It mostly didn't, and still doesn't work. What should have happened is that the law should have been amended to prevent outsourcing responsibility.