7 ms·

There are also downside for European regulations. There is no free lunch and some toll needs to be paid. Some examples include - Banning encrypted messaging (

There are also downside for European regulations. There is no free lunch and some toll needs to be paid. Some examples include - Banning encrypted messaging (almost passed) - Cookie pop ups - Various regulations harming open source (discussed before on HN) Also due to how Europe is wired up, the cost of doing startup business is higher, why there are fewer and fewer successful European software growth companies.

flohofwoe 3y ago
The cookie banner isn't required if the web page isn't doing shady things with cookies though.
- poszlem 3y ago
  "shady things"
airstrike 3y ago
Cookie popups are a net positive because users are given a choice. Besides, in the US we often still get the popups but they're just useless, with the only option being "accept"
- alwayslikethis 3y ago
  Unpopular opinion: the proper place to controll cookies is from the browser, not from the website. Browsers should show a prominent way to disable or otherwise restrict persistent storage to websites to inhibit tracking.
  - xigoi 3y ago
    The problem is that you can’t tell if the site actually needs the cookies to work properly. And it does not help against other kinds of tracking.
  - _v7gu 3y ago
    DNT exists, and the cookie banners did not need to be regulated into existence if the websites did not strategically ignore the DNT header.
    - whatshisface 3y ago
      Why not regulate the DNT header into expressing the user's cookie banner preferences?
      - progval 3y ago
        GDPR does not specify what technology to use to acquire consent [1], as long as the user consent. Trackers could honor the DNT header if they wanted to, and show the banner as a fallback for browsers not sending the header. [1] You can read the text: https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj there is a single instance of "cookie" (in the preamble) and no instance of "banner".
        Aloisius 3y ago
        > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. While DNT could potentially be used for opt-out, it wouldn't comply for opt-in because it is not specific or informed as the user does not know what specific data processing activities will be done, can't opt-in or out of specific data processing activities, doesn't know the identity of those doing them or that they can withdraw consent at any time.
        progval 3y ago
  - tgv 3y ago
    Tell that to the Chrome team.
    - summerlight 3y ago
      https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf https://assets.publishing.service.gov.uk/media/62052c52e90e0... You probably want to tell that to CMA first.
  - shortsunblack 3y ago
    Neither GDPR nor ePrivacy directive demands cookie walls. ePrivacy directive demands consent. That consent can be given programmatically by browser APIs. There's even acknowledgement of such possibillity in the legal text (see point 7 in the directive). GDPR itself does not demand cookie banners, either. It merely demands there to be a legal basis for processing of data that constitutes personal data. One of those bases is consent. It's not the only basis. Other notable basis includes contractual necessity (includes all the cookies that are necessary for user experience, i.e sth like PHP placed session cookie). Browsers do not have automated means to give consent/not give consent under ePrivacy because the largest browser is ran by an ad company. Monetarily speaking, the ad company earns more if it coerces its users with dark patterns into giving consent under ePrivacy than it does offering pro-user choice technologies to give a blanket not consent. And ePrivacy itself is not just about cookies. EDPB recently released binding recommendations that severely expanded the perceived scope of ePrivacy (the true scope was always as it is, the adtech industry just ignored it). ePrivacy includes JavaScript side tracking, fingerprinting with various APIs and so on. It's not just cookies.
  - weberer 3y ago
    I use uMatrix for that. I have it set to block all cross-domain cookies by default.
  - miohtama 3y ago
    Your opinion should be more popular. Seems like even a lot of technically savvy readers on HN miss this.
  - EasyMark 3y ago
    I mean there are extensions like "consent-o-matic" that auto answer for you, but the law doesn't require any functions like that in a browser. I suppose it was a compromise between business interests and consumer advocates when they worked out the law for the EU?
  - Xelbair 3y ago
    It was done, and turns out that piece of info was just used as an additional data point for tracking.
- mderazon 3y ago
  I don't know. The web is pretty unbearable here in the EU due to the cookies consent. Even more, many times I find myself wondering why a site is not responsive to my clicks just to find out there's some hidden cookie consent that didn't fire up properly and now I have to inspect the DOM to remove it manually.
gherkinnn 3y ago
Obtrusive cookie banners are somewhere between malicious compliance or a sign of shady business practices. Now that I see it spelt out like this, they are always a sign of scumbag companies.
- shp0ngle 3y ago
  They are present even literally on the pages of the EU organs that proposed them. Go to European Commision page - bam, cookie banner.
  - deleted 3y ago
    [deleted]
  - troupo 3y ago
    Compare a clear "allow cookies/allow only essential" to the industry standard wall of "we care about your privacy, so we sell your data to thousands of trackers that you have to opt out of manually" Though yes, government services shouldn't use anything but essential cookies (for which you don't need a cookie popup)
    - shp0ngle 3y ago
      That's switching goalposts. You said only scammy businesses have cookie banners... no, all websites have cookie banners now in EU, and it's majorly annoying, unless you use extensions that click it for you. (The most popular one is owned by Avast. Which is a horrible company that sells users data. So... yay?)
      - troupo 3y ago
        > You said only scammy businesses have cookie banners I didn't > all websites have cookie banners now in EU All the sites that collect more data than strictly necessary, yes. Here's an example of a website that spent need a cookie banner: https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ > The most popular one is owned by Avast. Which is a horrible company that sells users data Indeed. This should tell you all you need to know about these cookie popups and companies that use Avast's, or IAB's or Admiral's cookie popups.
sofixa 3y ago
> Various regulations harming open source (discussed before on HN) But coming from a good idea - make vendors responsible for the software they put out, to prevent tons of abusive practices like shutting of cloud services making paperweights, or never updating massively holed software harder. The ramifications for open source were then realised, and the legislation which is still under planning/review has been drastically updated to make it more applicable for open source software. > Banning encrypted messaging (almost passed) But didn't? > Also due to how Europe is wired up, the cost of doing startup business is higher, why there are fewer and fewer successful European software growth companies. Which has little to do with regulations, much more to do with the size and wealth of the potential markets. > why there are fewer and fewer successful European software growth companies Is that bad though? Are software "growth" companies a requirement for something? There are tons of successful software companies in various European countries, just not at the level of their American counterparts. Again, with quote obvious reasoning - there are 4x the people in the US compared to France (which is top 2 by population in the EU), and Americans both earn and spend more in USD not adjusted for anything.
akie 3y ago
> Also due to how Europe is wired up, the cost of doing startup business is higher, why there are fewer and fewer successful European software growth companies. I really believe the primary reason is that Europe is not one culturally homogeneous area that speaks one language - like the US. Having that is such a huge benefit. Doing marketing, promo, getting traction, legal documents, taxes, - anything - for your startup in your ONE country is already difficult. Now imagine doing it in 25 countries before you get to have scale benefits equal to the US or China.
- berkes 3y ago
  Exactly. We are building a platform that helps founders generate a sales strategy in the EU. We're half a year in and almost tackled "how to write good emails to Dutch prospects". Next up is Flemish, which has the same language, but a very different business culture. With luck, we have then captured a few percent of the EU tech market. Germany is so different, that we'll need to hire several experts for the different regions in Germany. France too. Italy and Spain, unattainable (we are told) without at least a local branch and solid local staff. That's still only a portion of the EU. "Cookie banners" are not the reason tech is hard in Europe. If you believe that, you really don't know anything about Europe or the EU.
- dataking 3y ago
  > I really believe the primary reason is that Europe is not one culturally homogeneous area that speaks one language There are likely several reasons at play, culture being a big one. However, there are other reasons at play such as differences in law, financing, immigration, the job market. Bert Huber, an entrepreneur in the EU has given this some thought: https://berthub.eu/articles/posts/is-europe-just-not-good-at-innovating/ https://berthub.eu/articles/posts/is-europe-just-not-good-at...
ko27 3y ago
Your examples are terrible, which probably proves the point that EU users are getting more than they are losing. Btw Europe != EU. > Banning encrypted messaging (almost passed) It's a positive thing that it was brought up and struck down. EU is the actually the one you should be thanking because most European countries would ban it. > Cookie pop ups Malicious compliance by websites, but at least users have a choice of opting out of tracking. Again, a positive thing. > Various regulations harming open source (discussed before on HN) The most recent changes are so watered down that it basically only applies to commercial open source companies that are turning a profit. It's helping users more than it's harming the open source community.
- whywhywhywhy 3y ago
  > Malicious compliance by websites If the legislation had been written correctly then the current nightmare wouldn’t exist. Should have been a browser level setting the sites are forced to comply with. The pop-up per site with free rein how obtuse it can work was always gonna suck. Pure incompetence from the politicians involved.
  - imiric 3y ago
    This is always brought up when EU cookie regulations are discussed. If only the EU consulted HN readers... It's true, though. The technical language could've been written in a way that makes it more difficult for websites to circumvent, and less annoying for users. Or the regulation could've been amended to clarify and improve the technical aspects. That said, getting to a regulation at all was probably a bigger nightmare, with Big Tech lobbying against it every step of the way. So I'm glad that we even have the current GDPR, and that the EU is still leading the way in privacy regulations globally.
    - varispeed 3y ago
      The cookie regulation was designed to train people to "Agree" without reading. It was a prerequisite step for GDPR that was designed to legalise data collection and trading. Before GDPR it was a gray area, now companies can easily get consent as users mindlessly click "Agree" to data processing and selling and they have a legal basis to do so. These are corrupt laws, but most people blindly believe EU is good and totally not in bed with big corporations.
deleted 3y ago
[deleted]
TheCoreh 3y ago
What's frustrating is that we get the annoying things like the cookie popups everywhere but the beneficial stuff is somehow properly region locked to inside the EU?
tester756 3y ago
>- Cookie pop ups Websites do not have to show cookie pop ups if they are using only technical cookies like auth tokens.
mderazon 3y ago
Also lately, getting the newest LLMs features much later than the rest of the world, or not getting them at all
troupo 3y ago
> fewer and fewer successful European software growth companies. It's funny how you slipped in "growth companies" in there. How about... profitable companies? In the past 10-15 years most "successful" US companies have been fueled by unlimited investor money with zero expectations of profits. I mean, look at YC's "top startups list". They lose billions of dollars every year. But sure, they grow. Like cancer
EasyMark 3y ago
I've always been curious if you offer a service for profit, but don't want to adhere to EU laws (obviously just avoiding EU customers at all). Is it enough to block EU country IP addresses so that Interpol doesn't get the Feds to kick in your door and turn you over to them for prosecution or freeze all your bank accounts for not sticking to the many Internet laws that you might not be familiar with? Is anyone aware of how to deal with fire walling off countries where you don't want to deal with the legalese?
camillomiller 3y ago
Or, there are fewer overinflated unicorns that produce no societal value at all and exist solely as a marketing-fueled VC bet that will make a limited amount of people ultrarich relatively fast while the rest of us shoulders the social, economic, and financial burden of their efforts. Potato, potato.

flohofwoe 3y ago

The cookie banner isn't required if the web page isn't doing shady things with cookies though.

poszlem 3y ago
"shady things"

airstrike 3y ago

Cookie popups are a net positive because users are given a choice. Besides, in the US we often still get the popups but they're just useless, with the only option being "accept"

alwayslikethis 3y ago
Unpopular opinion: the proper place to controll cookies is from the browser, not from the website. Browsers should show a prominent way to disable or otherwise restrict persistent storage to websites to inhibit tracking.
- xigoi 3y ago
  The problem is that you can’t tell if the site actually needs the cookies to work properly. And it does not help against other kinds of tracking.
- _v7gu 3y ago
  DNT exists, and the cookie banners did not need to be regulated into existence if the websites did not strategically ignore the DNT header.
  - whatshisface 3y ago
    Why not regulate the DNT header into expressing the user's cookie banner preferences?
    - progval 3y ago
      GDPR does not specify what technology to use to acquire consent [1], as long as the user consent. Trackers could honor the DNT header if they wanted to, and show the banner as a fallback for browsers not sending the header. [1] You can read the text: https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj there is a single instance of "cookie" (in the preamble) and no instance of "banner".
      - Aloisius 3y ago
        > Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. While DNT could potentially be used for opt-out, it wouldn't comply for opt-in because it is not specific or informed as the user does not know what specific data processing activities will be done, can't opt-in or out of specific data processing activities, doesn't know the identity of those doing them or that they can withdraw consent at any time.
        progval 3y ago
- tgv 3y ago
  Tell that to the Chrome team.
  - summerlight 3y ago
    https://assets.publishing.service.gov.uk/media/62052c52e90e077f7881c975/Google_Sandbox_.pdf https://assets.publishing.service.gov.uk/media/62052c52e90e0... You probably want to tell that to CMA first.
- shortsunblack 3y ago
  Neither GDPR nor ePrivacy directive demands cookie walls. ePrivacy directive demands consent. That consent can be given programmatically by browser APIs. There's even acknowledgement of such possibillity in the legal text (see point 7 in the directive). GDPR itself does not demand cookie banners, either. It merely demands there to be a legal basis for processing of data that constitutes personal data. One of those bases is consent. It's not the only basis. Other notable basis includes contractual necessity (includes all the cookies that are necessary for user experience, i.e sth like PHP placed session cookie). Browsers do not have automated means to give consent/not give consent under ePrivacy because the largest browser is ran by an ad company. Monetarily speaking, the ad company earns more if it coerces its users with dark patterns into giving consent under ePrivacy than it does offering pro-user choice technologies to give a blanket not consent. And ePrivacy itself is not just about cookies. EDPB recently released binding recommendations that severely expanded the perceived scope of ePrivacy (the true scope was always as it is, the adtech industry just ignored it). ePrivacy includes JavaScript side tracking, fingerprinting with various APIs and so on. It's not just cookies.
- weberer 3y ago
  I use uMatrix for that. I have it set to block all cross-domain cookies by default.
- miohtama 3y ago
  Your opinion should be more popular. Seems like even a lot of technically savvy readers on HN miss this.
- EasyMark 3y ago
  I mean there are extensions like "consent-o-matic" that auto answer for you, but the law doesn't require any functions like that in a browser. I suppose it was a compromise between business interests and consumer advocates when they worked out the law for the EU?
- Xelbair 3y ago
  It was done, and turns out that piece of info was just used as an additional data point for tracking.
mderazon 3y ago
I don't know. The web is pretty unbearable here in the EU due to the cookies consent. Even more, many times I find myself wondering why a site is not responsive to my clicks just to find out there's some hidden cookie consent that didn't fire up properly and now I have to inspect the DOM to remove it manually.

gherkinnn 3y ago

Obtrusive cookie banners are somewhere between malicious compliance or a sign of shady business practices. Now that I see it spelt out like this, they are always a sign of scumbag companies.

shp0ngle 3y ago
They are present even literally on the pages of the EU organs that proposed them. Go to European Commision page - bam, cookie banner.
- deleted 3y ago
  [deleted]
- troupo 3y ago
  Compare a clear "allow cookies/allow only essential" to the industry standard wall of "we care about your privacy, so we sell your data to thousands of trackers that you have to opt out of manually" Though yes, government services shouldn't use anything but essential cookies (for which you don't need a cookie popup)
  - shp0ngle 3y ago
    That's switching goalposts. You said only scammy businesses have cookie banners... no, all websites have cookie banners now in EU, and it's majorly annoying, unless you use extensions that click it for you. (The most popular one is owned by Avast. Which is a horrible company that sells users data. So... yay?)
    - troupo 3y ago
      > You said only scammy businesses have cookie banners I didn't > all websites have cookie banners now in EU All the sites that collect more data than strictly necessary, yes. Here's an example of a website that spent need a cookie banner: https://github.blog/2020-12-17-no-cookie-for-you/ https://github.blog/2020-12-17-no-cookie-for-you/ > The most popular one is owned by Avast. Which is a horrible company that sells users data Indeed. This should tell you all you need to know about these cookie popups and companies that use Avast's, or IAB's or Admiral's cookie popups.

sofixa 3y ago

> Various regulations harming open source (discussed before on HN) But coming from a good idea - make vendors responsible for the software they put out, to prevent tons of abusive practices like shutting of cloud services making paperweights, or never updating massively holed software harder. The ramifications for open source were then realised, and the legislation which is still under planning/review has been drastically updated to make it more applicable for open source software. > Banning encrypted messaging (almost passed) But didn't? > Also due to how Europe is wired up, the cost of doing startup business is higher, why there are fewer and fewer successful European software growth companies. Which has little to do with regulations, much more to do with the size and wealth of the potential markets. > why there are fewer and fewer successful European software growth companies Is that bad though? Are software "growth" companies a requirement for something? There are tons of successful software companies in various European countries, just not at the level of their American counterparts. Again, with quote obvious reasoning - there are 4x the people in the US compared to France (which is top 2 by population in the EU), and Americans both earn and spend more in USD not adjusted for anything.

akie 3y ago

> Also due to how Europe is wired up, the cost of doing startup business is higher, why there are fewer and fewer successful European software growth companies. I really believe the primary reason is that Europe is not one culturally homogeneous area that speaks one language - like the US. Having that is such a huge benefit. Doing marketing, promo, getting traction, legal documents, taxes, - anything - for your startup in your ONE country is already difficult. Now imagine doing it in 25 countries before you get to have scale benefits equal to the US or China.

berkes 3y ago
Exactly. We are building a platform that helps founders generate a sales strategy in the EU. We're half a year in and almost tackled "how to write good emails to Dutch prospects". Next up is Flemish, which has the same language, but a very different business culture. With luck, we have then captured a few percent of the EU tech market. Germany is so different, that we'll need to hire several experts for the different regions in Germany. France too. Italy and Spain, unattainable (we are told) without at least a local branch and solid local staff. That's still only a portion of the EU. "Cookie banners" are not the reason tech is hard in Europe. If you believe that, you really don't know anything about Europe or the EU.
dataking 3y ago
> I really believe the primary reason is that Europe is not one culturally homogeneous area that speaks one language There are likely several reasons at play, culture being a big one. However, there are other reasons at play such as differences in law, financing, immigration, the job market. Bert Huber, an entrepreneur in the EU has given this some thought: https://berthub.eu/articles/posts/is-europe-just-not-good-at-innovating/ https://berthub.eu/articles/posts/is-europe-just-not-good-at...

ko27 3y ago

Your examples are terrible, which probably proves the point that EU users are getting more than they are losing. Btw Europe != EU. > Banning encrypted messaging (almost passed) It's a positive thing that it was brought up and struck down. EU is the actually the one you should be thanking because most European countries would ban it. > Cookie pop ups Malicious compliance by websites, but at least users have a choice of opting out of tracking. Again, a positive thing. > Various regulations harming open source (discussed before on HN) The most recent changes are so watered down that it basically only applies to commercial open source companies that are turning a profit. It's helping users more than it's harming the open source community.

whywhywhywhy 3y ago
> Malicious compliance by websites If the legislation had been written correctly then the current nightmare wouldn’t exist. Should have been a browser level setting the sites are forced to comply with. The pop-up per site with free rein how obtuse it can work was always gonna suck. Pure incompetence from the politicians involved.
- imiric 3y ago
  This is always brought up when EU cookie regulations are discussed. If only the EU consulted HN readers... It's true, though. The technical language could've been written in a way that makes it more difficult for websites to circumvent, and less annoying for users. Or the regulation could've been amended to clarify and improve the technical aspects. That said, getting to a regulation at all was probably a bigger nightmare, with Big Tech lobbying against it every step of the way. So I'm glad that we even have the current GDPR, and that the EU is still leading the way in privacy regulations globally.
  - varispeed 3y ago
    The cookie regulation was designed to train people to "Agree" without reading. It was a prerequisite step for GDPR that was designed to legalise data collection and trading. Before GDPR it was a gray area, now companies can easily get consent as users mindlessly click "Agree" to data processing and selling and they have a legal basis to do so. These are corrupt laws, but most people blindly believe EU is good and totally not in bed with big corporations.

deleted 3y ago

[deleted]

TheCoreh 3y ago

What's frustrating is that we get the annoying things like the cookie popups everywhere but the beneficial stuff is somehow properly region locked to inside the EU?

tester756 3y ago

>- Cookie pop ups Websites do not have to show cookie pop ups if they are using only technical cookies like auth tokens.

mderazon 3y ago

Also lately, getting the newest LLMs features much later than the rest of the world, or not getting them at all

troupo 3y ago

> fewer and fewer successful European software growth companies. It's funny how you slipped in "growth companies" in there. How about... profitable companies? In the past 10-15 years most "successful" US companies have been fueled by unlimited investor money with zero expectations of profits. I mean, look at YC's "top startups list". They lose billions of dollars every year. But sure, they grow. Like cancer

EasyMark 3y ago

I've always been curious if you offer a service for profit, but don't want to adhere to EU laws (obviously just avoiding EU customers at all). Is it enough to block EU country IP addresses so that Interpol doesn't get the Feds to kick in your door and turn you over to them for prosecution or freeze all your bank accounts for not sticking to the many Internet laws that you might not be familiar with? Is anyone aware of how to deal with fire walling off countries where you don't want to deal with the legalese?

camillomiller 3y ago

Or, there are fewer overinflated unicorns that produce no societal value at all and exist solely as a marketing-fueled VC bet that will make a limited amount of people ultrarich relatively fast while the rest of us shoulders the social, economic, and financial burden of their efforts. Potato, potato.