5 ms·

Popups everywhere that waste people's time.

mschuster91 3y ago
That's not the fault of the GDPR. The point of the GDPR was to force companies to expose just how much they sell your data, and thus incentivize people to vote with their wallet and choose services that value protecting your data. Unfortunately, corporate greed was too high, and the result are cookie banners listing sometimes >1k third-party entities.
- jstummbillig 3y ago
  That is not unfortunate. That is bad design.
  - ben_w 3y ago
    Deliberate bad design by the websites; I'm not sure how the law could be rewritten except to just say "you had your chance to do this right, now you're all just banned from collecting anything unless it's strictly necessary, just as if every user had said 'deny'."
    - piva00 3y ago
      The law is already explicit about requiring that acceptance and refusal should be equally easy to access, the vast majority of these banners are actually illegal.
      - ben_w 3y ago
        Also correct, but even with that modification to the popups, I think they may want to go further.
- mcv 3y ago
  Well, it is informative to see to just how many entities they're going to sell my data. My big question with those banners is: what the hell does "legitimate interest" mean? The toggle for normal cookies is generally off by default or easy to turn off, but then there's another tab, or other toggles, listed as "legitimate interest", and it lists all the same stuff I don't want: ad personalisation, tracking, etc. What's the difference? Why do they consider that legitimate interest?
  - mschuster91 3y ago
    That's a GDPR term. "Legitimate interest" should only be what is necessary to provide the service to the user (e.g. load balancer cookies, session cookies for logins). Everything else is abusing the term and should be reported to the responsible data protection authority.
    - p_l 3y ago
      And cookies that are necessary to perform service required by end user don't require consent.
  - piva00 3y ago
    There's a pretty comprehensive answer in the official EU's Commission Q&A section [1]. [1] https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_en https://commission.europa.eu/law/law-topic/data-protection/r...
  - dspillett 3y ago
    > My big question with those banners is: what the hell does "legitimate interest" mean? There is a definition in the regulation, which IIRC basically amounts to a rewording of "strictly necessary". This definition does not cover what companies use it to excuse. The way the phrase is actually used, for much wider tracking, what it has come to mean is "we see your preference not to be logged and stalked for the benefit of our business plan, but fuck you and your preference we want to do it anyway". This is why the legitimate interest check boxes are often hidden in nested concertinas or other UX nightmares, to make it extra difficult to opt out of what should be an opt in. Once a body has gone this far to try engineer an accidental opt-in they are _definitely_ not to be trusted IMO. Though it is likely too late if you really care: they may have already dropped their payload & sent at least some information back to base, and will "accidentally" not remove it later or find some other excuse as to why they shouldn't.
    - mcv 3y ago
jansan 3y ago
The popups make things even worse, because people automatically click on "Agree to all", which permits far more than would be permitted without a cookie banner.
- psychoslave 3y ago
  Do they? On my side, when Consent-O-Matic don’t deal with it all automatically, I look for the "deny all" button and just go elsewhere to find the information I need.
  - cbeach 3y ago
    I'd love to install Consent-O-Matic but when I try, my browser warns me that the extension can read and change all my data on all websites. So, the EU makes laws that supposedly protect my privacy, and in order to deal with the awful practical consequences of those laws, I'd need to give an unknown third party access to all my data on all my websites?
    - pipo234 3y ago
      I believe a German (?) court recently ruled that sending a do-not-track header in HTTP request is sufficient. So essentially, a website showing a cookie banner despite a visitor already expressing her/his preference using DNT, is a malfunctioning website. Now all we need is some carrots or sticks to nudge companies to fix their websites. Like fines or decreased search ranking.
  - jansan 3y ago
    Yes, they do. Maybe some nerds don't, but 90% of people do.
- piva00 3y ago
  That's because the implementation is illegal, it should show "Agree to all" and "Refuse all" in the same context, the implementations have decided, as a strategy, to bury the refusal which goes against even the text of the law which states it should be as easy to give as to remove consent.

That's not the fault of the GDPR. The point of the GDPR was to force companies to expose just how much they sell your data, and thus incentivize people to vote with their wallet and choose services that value protecting your data. Unfortunately, corporate greed was too high, and the result are cookie banners listing sometimes >1k third-party entities.

jstummbillig 3y ago
That is not unfortunate. That is bad design.
- ben_w 3y ago
  Deliberate bad design by the websites; I'm not sure how the law could be rewritten except to just say "you had your chance to do this right, now you're all just banned from collecting anything unless it's strictly necessary, just as if every user had said 'deny'."
  - piva00 3y ago
    The law is already explicit about requiring that acceptance and refusal should be equally easy to access, the vast majority of these banners are actually illegal.
    - ben_w 3y ago
      Also correct, but even with that modification to the popups, I think they may want to go further.
mcv 3y ago
Well, it is informative to see to just how many entities they're going to sell my data. My big question with those banners is: what the hell does "legitimate interest" mean? The toggle for normal cookies is generally off by default or easy to turn off, but then there's another tab, or other toggles, listed as "legitimate interest", and it lists all the same stuff I don't want: ad personalisation, tracking, etc. What's the difference? Why do they consider that legitimate interest?
- mschuster91 3y ago
  That's a GDPR term. "Legitimate interest" should only be what is necessary to provide the service to the user (e.g. load balancer cookies, session cookies for logins). Everything else is abusing the term and should be reported to the responsible data protection authority.
  - p_l 3y ago
    And cookies that are necessary to perform service required by end user don't require consent.
- piva00 3y ago
  There's a pretty comprehensive answer in the official EU's Commission Q&A section [1]. [1] https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_en https://commission.europa.eu/law/law-topic/data-protection/r...
- dspillett 3y ago
  > My big question with those banners is: what the hell does "legitimate interest" mean? There is a definition in the regulation, which IIRC basically amounts to a rewording of "strictly necessary". This definition does not cover what companies use it to excuse. The way the phrase is actually used, for much wider tracking, what it has come to mean is "we see your preference not to be logged and stalked for the benefit of our business plan, but fuck you and your preference we want to do it anyway". This is why the legitimate interest check boxes are often hidden in nested concertinas or other UX nightmares, to make it extra difficult to opt out of what should be an opt in. Once a body has gone this far to try engineer an accidental opt-in they are _definitely_ not to be trusted IMO. Though it is likely too late if you really care: they may have already dropped their payload & sent at least some information back to base, and will "accidentally" not remove it later or find some other excuse as to why they shouldn't.
  - mcv 3y ago

jansan 3y ago

The popups make things even worse, because people automatically click on "Agree to all", which permits far more than would be permitted without a cookie banner.

psychoslave 3y ago
Do they? On my side, when Consent-O-Matic don’t deal with it all automatically, I look for the "deny all" button and just go elsewhere to find the information I need.
- cbeach 3y ago
  I'd love to install Consent-O-Matic but when I try, my browser warns me that the extension can read and change all my data on all websites. So, the EU makes laws that supposedly protect my privacy, and in order to deal with the awful practical consequences of those laws, I'd need to give an unknown third party access to all my data on all my websites?
  - pipo234 3y ago
    I believe a German (?) court recently ruled that sending a do-not-track header in HTTP request is sufficient. So essentially, a website showing a cookie banner despite a visitor already expressing her/his preference using DNT, is a malfunctioning website. Now all we need is some carrots or sticks to nudge companies to fix their websites. Like fines or decreased search ranking.
- jansan 3y ago
  Yes, they do. Maybe some nerds don't, but 90% of people do.
piva00 3y ago
That's because the implementation is illegal, it should show "Agree to all" and "Refuse all" in the same context, the implementations have decided, as a strategy, to bury the refusal which goes against even the text of the law which states it should be as easy to give as to remove consent.