4 ms·

The proliferation of irritating cookie consent popups on the web is ENTIRELY the fault of the EU "Cookie Law" 2009/136/EC (amendment to 2002/58/EC) I repeat -

by cbeach 3y ago

The proliferation of irritating cookie consent popups on the web is ENTIRELY the fault of the EU "Cookie Law" 2009/136/EC (amendment to 2002/58/EC) I repeat - the cookie consent popups, and the resulting de-sensitisation of users to genuinely useful warning popups - that's ENTIRELY the fault of the technocratic leadership of the European Union. "Big corps" have to follow the rules or they will face hefty fines. --- Edit: the comments about the consent forms protecting against "spying" are disingenuous. Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent.

littlestymaar 3y ago
No. In fact it's not a “cookie warning pop-up”, it's a cookie consent pop-up. And there's an easy way to get rid of that pop-up for companies (big or small BTW): stop using cookies that require user consent: that is, stop harvesting people's data.
- iteria 3y ago
  You're missing the point. The law didn't take into consideration that people are awful and as a result not only didn't accomplish its aims of either reducing the amount of data collected or making users aware of data collection, it made the act of using the web worse. This is the problem with feel good laws like this. You always have to write laws assuming that those negatively effected will be bad actors that will try to subvert the law. That's just human nature. People want to keep doing what they're doing.
  - troupo 3y ago
    > The law didn't take into consideration that people are awful Okay. I always ask this: what's your solution to this?
  - ben_w 3y ago
    The huge fines suggest that they did take into account bad actors.
  - littlestymaar 3y ago
    > not only didn't accomplish its aims of either reducing the amount of data collected or making users aware of data collection, it made the act of using the web worse. It made the web worse because companies decided that making it worse was better than changing their business model. But it did reduce the amount of data collected. > You always have to write laws assuming that those negatively effected will be bad actors that will try to subvert the law. But they did. But EU was lobbied into being too business friendly, and relied on nudging them into better behavior instead of forcing them, and the businesses said “no way, we'd rather fuck up our website”. There's no way the European Commission could have convinced the member states to accept a law that would be too detrimental to business interest. When discussing a law, you must always take into account the political forces that drives it adoption process.
cromka 3y ago
This is an equivalent of your call being eavesdropped, EU forcing the operator to remind you every 60s that they are listening and you getting upset that the EU made calls so annoying.
- nicky0 3y ago
  But I'd rather they ban eavesdropping not make my call really annoying. Not a well thought through law and clearly needs an update to restore usability to the web Yet you are happy enough to stop at "the intention was good". I imagine you smiling happily every time you have to click "set cookie preferences ... reject all".. ahh good old EU looking out for me, how wonderful they made things.
  - troupo 3y ago
    > Not a well thought through law and clearly needs an update to restore usability to the web Show me where GDPR talks about browsers or cookie popups. > Yet you are happy enough to stop at "the intention was good". No, I'm not. I want the EU to slap the maximum possible fines on the biggest perpetrators, as defined by the law.
  - piva00 3y ago
    > I imagine you smiling happily every time you have to click "set cookie preferences ... reject all".. ahh good old EU looking out for me, how wonderful they made things. The cookie banners you are complaining about are illegal, read the EU law directive [1], it states pretty explicitly: > Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place. It's not the fault of the EU law if companies decide to act illegally. Blame the fucking companies, they are the ones making you miserable. [1] https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
gambiting 3y ago
Basically EU made sure you are aware that you are being spied upon, that your personal information is being harvested and sold for marketing........and you get angry at the EU?
fmobus 3y ago
What is your proposed policy alternative?
- cbeach 3y ago
  Users can disable cookies on their browser if they care about limiting tracking and website functionality. Or if you insist on regulations that burden every website operator, how about the user ticks a box in their browser once e.g. "I do not consent to cookies regulated by EU Cookie Law" and then that choice is sent in the header of every web request, and website operators are mandated to respect it (and NOT show a banner asking for consent every time the user visits!) What if the operators don't respect the header? Well, what if operators don't respect the user's responses to cookie consent popups? We're relying on operators doing the right thing in both cases, and the EU cannot guarantee either approach will work.
  - jdiez17 3y ago
    > Users can disable cookies on their browser if they care about limiting tracking and website functionality. You seem to be deliberately ignoring the fact that cookies are necessary for normal website functions like logging in to a user account. And also the fact that those types of cookies do NOT require a consent banner. > how about the user ticks a box in their browser once e.g. "I do not consent to cookies regulated by EU Cookie Law" and then that choice is sent in the header of every web request, and website operators are mandated to respect it (and NOT show a banner asking for consent every time the user visits!) I agree, that would be ideal. I hope it comes in the next version of the ePrivacy directive. > What if the operators don't respect the header? Well, what if operators don't respect the user's responses to cookie consent popups? That's what law enforcement is for. A common critique of new EU laws is that the enforcement is lax at the beginning. However, it ramps up over time and is a one-way ratchet. The EU is like a massive ship with huge inertia. Changing course takes a long time, but once it gets going, you better not be in the way. By the way, we saw this with those highly infuriating and illegal cookie banners that hide the option to deny cookies behind many clicks. The regulation clearly says it should be as easy to consent, as to not consent. And most cookie banners I see nowadays have an easy opt out button.
troupo 3y ago
Nope. (Also IANAL) - EU Cookie Law is "tell people you're using cookies". And with GDPR it became "if you use that data strictly for the operation of your website, you don't need anything at all" - GDPR is: if you want to collect more data, and track people, and sell/send people's data to third parties, you have to ask for their consent in a clear unambiguous manner, with opt-out being as easy as opt-in. The industry's response to that [1]? --- We value your privacy. 1498 partners We're building a profile on you GDPR made us do it Agree to all --- And the gullible devs gobbled that up and blame the law for their own industry's failing. [1] https://twitter.com/dmitriid/status/1733421877119324609 https://twitter.com/dmitriid/status/1733421877119324609
- cccbbbaaa 3y ago
  No, ePrivacy article 5(3) always had an exception for strictly necessary purposes, with clear guidance of what it means from DPAs and WP29 (now EDPB). I agree with the rest of your message though.
la_oveja 3y ago
> Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent. no, it does not
the8472 3y ago
IANAL but my understanding is that if a cookie is strictly necessary for functionality (such as a login token or storing the region the user explicitly selected) then no consent is needed. "improve performance and UX using simple analytics" I don't see how performance requires persistent analytics. This smells like a flimsy justification or perhaps "we always did it this way" rather than strict technical necessity. You can send events from a current session without keeping state in the client. And if one truly cared about performance, there's a lot of fat to trim from many commercial webpages that shouldn't require any analytics at all, try opening a profiler first and notice how much time is spent on loading all the analytics stuff.
- sokoloff 3y ago
  I think you might be reading improve performance to mean “page speed optimization” rather than “profit making optimization”.
- midjji 3y ago
  This is correct, its not needed for good performance, and most things websites require cookies for dont require the disclaimer, with two caveats. First its pretty clear from the law what requires it, but what if you are wrong, what if corp requires legal to sign off on the engineers statement that it is legal, its not like you gain much from not having the disclaimer, and second, most freemium analytics (e.g. googles) and all ad related services do require it.
  - lupusreal 3y ago
    > its not like you gain much from not having the disclaimer Then the "popups" (which aren't actually popups) aren't actually as onerous to users as the web developers on HN would have us believe. Seriously, I never hear common people complain about it, only people in the industry who have a commercial stake in tracking people without consent
zuppy 3y ago
> s ENTIRELY the fault of the EU "Cookie Law" i profoundly disagree. the cookie law+gdpr did not force the websites to show their obnoxious overlays, they do that in order to confuse a part of the users and make it hard do not opt in. they could have used a simpler way to show the information, or, you know... not sucking every information about you they can, which would have not created the need to show anything. edit: maybe it's not well known exception, but cookies that are mandatory for the functionality of the website (and are not used for tracking) do not have to pass through the opt in process. for example, the session cookie for the login functionality.
ben_w 3y ago
> I repeat - the cookie consent popups, and the resulting de-sensitisation of users to genuinely useful warning popups - that's ENTIRELY the fault of the technocratic leadership of the European Union. Repeat as much as you like, you're still wrong. Note that this website you're currently using doesn't have one. Neither does github. > Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent. That's the point. I've seen analytics data. Looks neat. Definitely doesn't need to be granular to the level of individual users. Also, given how badly I'm categorised by even the giants like FB, I simply don't believe this data is half as useful as it seems from the shiny graphs coming out of most analytics software.

by cbeach 3y ago

littlestymaar 3y ago

No. In fact it's not a “cookie warning pop-up”, it's a cookie consent pop-up. And there's an easy way to get rid of that pop-up for companies (big or small BTW): stop using cookies that require user consent: that is, stop harvesting people's data.

iteria 3y ago
You're missing the point. The law didn't take into consideration that people are awful and as a result not only didn't accomplish its aims of either reducing the amount of data collected or making users aware of data collection, it made the act of using the web worse. This is the problem with feel good laws like this. You always have to write laws assuming that those negatively effected will be bad actors that will try to subvert the law. That's just human nature. People want to keep doing what they're doing.
- troupo 3y ago
  > The law didn't take into consideration that people are awful Okay. I always ask this: what's your solution to this?
- ben_w 3y ago
  The huge fines suggest that they did take into account bad actors.
- littlestymaar 3y ago
  > not only didn't accomplish its aims of either reducing the amount of data collected or making users aware of data collection, it made the act of using the web worse. It made the web worse because companies decided that making it worse was better than changing their business model. But it did reduce the amount of data collected. > You always have to write laws assuming that those negatively effected will be bad actors that will try to subvert the law. But they did. But EU was lobbied into being too business friendly, and relied on nudging them into better behavior instead of forcing them, and the businesses said “no way, we'd rather fuck up our website”. There's no way the European Commission could have convinced the member states to accept a law that would be too detrimental to business interest. When discussing a law, you must always take into account the political forces that drives it adoption process.

cromka 3y ago

This is an equivalent of your call being eavesdropped, EU forcing the operator to remind you every 60s that they are listening and you getting upset that the EU made calls so annoying.

nicky0 3y ago
But I'd rather they ban eavesdropping not make my call really annoying. Not a well thought through law and clearly needs an update to restore usability to the web Yet you are happy enough to stop at "the intention was good". I imagine you smiling happily every time you have to click "set cookie preferences ... reject all".. ahh good old EU looking out for me, how wonderful they made things.
- troupo 3y ago
  > Not a well thought through law and clearly needs an update to restore usability to the web Show me where GDPR talks about browsers or cookie popups. > Yet you are happy enough to stop at "the intention was good". No, I'm not. I want the EU to slap the maximum possible fines on the biggest perpetrators, as defined by the law.
- piva00 3y ago
  > I imagine you smiling happily every time you have to click "set cookie preferences ... reject all".. ahh good old EU looking out for me, how wonderful they made things. The cookie banners you are complaining about are illegal, read the EU law directive [1], it states pretty explicitly: > Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place. It's not the fault of the EU law if companies decide to act illegally. Blame the fucking companies, they are the ones making you miserable. [1] https://gdpr.eu/cookies/ https://gdpr.eu/cookies/

gambiting 3y ago

Basically EU made sure you are aware that you are being spied upon, that your personal information is being harvested and sold for marketing........and you get angry at the EU?

fmobus 3y ago

What is your proposed policy alternative?

cbeach 3y ago
Users can disable cookies on their browser if they care about limiting tracking and website functionality. Or if you insist on regulations that burden every website operator, how about the user ticks a box in their browser once e.g. "I do not consent to cookies regulated by EU Cookie Law" and then that choice is sent in the header of every web request, and website operators are mandated to respect it (and NOT show a banner asking for consent every time the user visits!) What if the operators don't respect the header? Well, what if operators don't respect the user's responses to cookie consent popups? We're relying on operators doing the right thing in both cases, and the EU cannot guarantee either approach will work.
- jdiez17 3y ago
  > Users can disable cookies on their browser if they care about limiting tracking and website functionality. You seem to be deliberately ignoring the fact that cookies are necessary for normal website functions like logging in to a user account. And also the fact that those types of cookies do NOT require a consent banner. > how about the user ticks a box in their browser once e.g. "I do not consent to cookies regulated by EU Cookie Law" and then that choice is sent in the header of every web request, and website operators are mandated to respect it (and NOT show a banner asking for consent every time the user visits!) I agree, that would be ideal. I hope it comes in the next version of the ePrivacy directive. > What if the operators don't respect the header? Well, what if operators don't respect the user's responses to cookie consent popups? That's what law enforcement is for. A common critique of new EU laws is that the enforcement is lax at the beginning. However, it ramps up over time and is a one-way ratchet. The EU is like a massive ship with huge inertia. Changing course takes a long time, but once it gets going, you better not be in the way. By the way, we saw this with those highly infuriating and illegal cookie banners that hide the option to deny cookies behind many clicks. The regulation clearly says it should be as easy to consent, as to not consent. And most cookie banners I see nowadays have an easy opt out button.

troupo 3y ago

Nope. (Also IANAL) - EU Cookie Law is "tell people you're using cookies". And with GDPR it became "if you use that data strictly for the operation of your website, you don't need anything at all" - GDPR is: if you want to collect more data, and track people, and sell/send people's data to third parties, you have to ask for their consent in a clear unambiguous manner, with opt-out being as easy as opt-in. The industry's response to that [1]? --- We value your privacy. 1498 partners We're building a profile on you GDPR made us do it Agree to all --- And the gullible devs gobbled that up and blame the law for their own industry's failing. [1] https://twitter.com/dmitriid/status/1733421877119324609 https://twitter.com/dmitriid/status/1733421877119324609

cccbbbaaa 3y ago
No, ePrivacy article 5(3) always had an exception for strictly necessary purposes, with clear guidance of what it means from DPAs and WP29 (now EDPB). I agree with the rest of your message though.

la_oveja 3y ago

> Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent. no, it does not

the8472 3y ago

IANAL but my understanding is that if a cookie is strictly necessary for functionality (such as a login token or storing the region the user explicitly selected) then no consent is needed. "improve performance and UX using simple analytics" I don't see how performance requires persistent analytics. This smells like a flimsy justification or perhaps "we always did it this way" rather than strict technical necessity. You can send events from a current session without keeping state in the client. And if one truly cared about performance, there's a lot of fat to trim from many commercial webpages that shouldn't require any analytics at all, try opening a profiler first and notice how much time is spent on loading all the analytics stuff.

sokoloff 3y ago
I think you might be reading improve performance to mean “page speed optimization” rather than “profit making optimization”.
midjji 3y ago
This is correct, its not needed for good performance, and most things websites require cookies for dont require the disclaimer, with two caveats. First its pretty clear from the law what requires it, but what if you are wrong, what if corp requires legal to sign off on the engineers statement that it is legal, its not like you gain much from not having the disclaimer, and second, most freemium analytics (e.g. googles) and all ad related services do require it.
- lupusreal 3y ago
  > its not like you gain much from not having the disclaimer Then the "popups" (which aren't actually popups) aren't actually as onerous to users as the web developers on HN would have us believe. Seriously, I never hear common people complain about it, only people in the industry who have a commercial stake in tracking people without consent

zuppy 3y ago

> s ENTIRELY the fault of the EU "Cookie Law" i profoundly disagree. the cookie law+gdpr did not force the websites to show their obnoxious overlays, they do that in order to confuse a part of the users and make it hard do not opt in. they could have used a simpler way to show the information, or, you know... not sucking every information about you they can, which would have not created the need to show anything. edit: maybe it's not well known exception, but cookies that are mandatory for the functionality of the website (and are not used for tracking) do not have to pass through the opt in process. for example, the session cookie for the login functionality.

ben_w 3y ago

> I repeat - the cookie consent popups, and the resulting de-sensitisation of users to genuinely useful warning popups - that's ENTIRELY the fault of the technocratic leadership of the European Union. Repeat as much as you like, you're still wrong. Note that this website you're currently using doesn't have one. Neither does github. > Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent. That's the point. I've seen analytics data. Looks neat. Definitely doesn't need to be granular to the level of individual users. Also, given how badly I'm categorised by even the giants like FB, I simply don't believe this data is half as useful as it seems from the shiny graphs coming out of most analytics software.