25 ms·

Dear Paul Graham, there is no cookie banner law

• ianlevesque 3y ago
  The funny thing about legislation is that you're responsible for the unintended consequences of your laws too.
  • Avamander 3y ago
    It's impossible to foresee everything, including the amount of malicious compliance. In the end we are better off with this legislation and its future iterations and additions than we are without it. The extent to which people's data is misused is simply ridiculous.
    • mgoetzke 3y ago
      Though this was 100% predictable
    • piker 3y ago
      So perhaps that suggests caution be taken in meddling…
      • paulryanrogers 3y ago
        Meddling in what way? 'Meddling' causing citizens to lose visibility and corporations to gain more power over data?
  • gostsamo 3y ago
    No, people cannot escape responsibility by saying "the law made me be belligerent toward my users". It is intentional choice to use cookies and to make it unpleasant for people.
    • paulryanrogers 3y ago
      And use of cookies themswlves don't demand these banners, nor that they be so obstructive. Just don't collect unnecessary cookies or PII, or put in a prominent banner that doesn't overlap the site purpose.
    • Diggsey 3y ago
      > No, people cannot escape responsibility by saying "the law made me be belligerent toward my users". Correction: people should not be able to escape responsibility by saying this. The problem is that right now people do escape responsibility for saying this because the EU is not properly enforcing these new laws. Introducing a law and then not enforcing it has consequences, and those consequences should have been foreseen. Either the law is unenforceable due to practical constraints, in which case it's a bad law, or the EU is failing to enforce it due to inability. Hopefully the EU starts putting more focus on enforcing its existing laws rather than creating new ones.
  • isodev 3y ago
    You mean the EU should have foreseen that people in tech have no conscience and sensitivity for right or wrong?
    • SuperNinKenDo 3y ago
      To be fair, completely foreseeable.
      • moomin 3y ago
        Yeah, I’m not sure legislators should be on the hook for malicious compliance, though.
        • SuperNinKenDo 3y ago
          Of course not, I was just having a laff at tech's expense.
      • isodev 3y ago
        As a reminder, it's the same people in tech we're trusting to build things like chat bots, "AI", cars that try to drive themselves and rockets that try to land themselves... etc. You have to admit that if these same people can't be trusted to follow a simple "do not track" directive, humanity is in big trouble.
        • SuperNinKenDo 3y ago
          Sadly, we are. I didn't ever think of myself as an optimist until I realised just how pessimistic it is possible to become, as I've learned in the last 5 or so years. Now I realise I was quite an optimistic person, at least by comparison with my present self.
        • crabmusket 3y ago
          I mean, humanity is and always has been in big trouble. That's why history is full of disasters, mass death etc. But I don't think it's that developers "can't" follow a DNT cookie. It's that they won't because it doesn't benefit their employer's financial interests. Making a rocket that lands, on the other hand, does directly correspond to SpaceX's financial interests.
  • nicce 3y ago
    In this case, it is just showing that most companies are collecting more data than they need. You don’t need a banner for the data that is necessary for the service to work at minimum level. There is no role for the consent since the site won’t work otherwise.
    • poszlem 3y ago
      It also shows that most people don't care and just want to get on with their day. We know that companies are collecting more data. Now what?
      • leononame 3y ago
        How does it show that? Most people I know are annoyed by this and click on "reject" (if they can find it), but for a lot of non-technical people these banners are just a given because they don't even understand the problem. Doesn't mean they don't care
        • oneeyedpigeon 3y ago
          > if they can find it If it even exists!
        • poszlem 3y ago
          How many "normies" do you know that stopped visiting websites that track them? I don't know anybody who isn't in my tech bubble who cares, and very few normies who would rather pay money than to give access to their data.
          • leononame 3y ago
            None. That doesn't mean they don't care. As I said, most people I know are annoyed by this but take these banners and tracking as a given because they don't understand enough about technology and see them everywhere. And let's be honest here, if you were to stop visiting sites that track you, you could just stop using more or less the whole internet. It's not about stopping to use these sites, it's about stopping those sites from tracking you, which almost everyone I talk to is ok with. The only people I see that defend the amount of tracking happening on the web are commenters online (here, on reddit, etc.). That leads me to believe it's mostly corporate accounts. To the point: Not using a site is not the point of it. Insert "yet you participate in society" meme
  • bryanrasmussen 3y ago
    On the one hand when murders go up because you make using a gun in a crime an automatic 5 year prison term you should have foreseen that possible situation, on the other hand the real bad guy is the one shooting the witnesses.
  • leononame 3y ago
    Yes and no? To some extent, sure. As an example: But if companies or people went out of their way to comply with a law that is clearly not complying with the spirit of the law, just the letter of it, are you really responsible for that? Or are they because they're doing everything to not comply? Let's say you make a law to reduce working hours from 40 to 37 hours except in "emergency situations". Now a company will force employees to sign off on "emergency situations" every week or they'll be fired. They're clearly not complying to the spirit of the law? Is it really your fault when you make a law like that? I'd say only to some degree, the people trying to abuse every loop hole are much more responsible in this case. Companies using dark patterns, hiding the "reject all" option behind an additional click (which even is illegal) and even trying to collect all data possible are much more responsible than the EU's law. Oftentimes they are collecting data just because, not even thinking about it, because they'll add GA to their WordPress site without even looking at it or whatever. That cookie banners have become the standard around the web is sad because it just shows how much everyone is trying to track you.
    • paulryanrogers 3y ago
      Bonus points if you can convince folks to call it the annoying Sign Off law.
  • casperb 3y ago
    I would expect that most companies would be ashamed to publicly state that they sell your data to hundreds(!) of data providers and they would fix this before they had to disclose it. But nope, apparently the money is too good. And blaming the government is more convenient.
  • crabmusket 3y ago
    I guess PG's original tweet assumes that cookie banners are a) bad, b) the fault of the EU, and C) unanticipated and unintended by the EU, thereby demonstrating their incompetence. I can't really comment on what the lawmakers foresaw or intended, but I'd argue that cookie banners are actually a) good, and b) the fault of companies who can't imagine a better way to treat their users. The reason I think they're good is that they cause a psychological nuisance to users of software which doesn't go out of their way to do them well or avoid their necessity. Over time I hope this will tend to cause an association in users minds that sites with cookie banners are somehow seedy or unscrupulous, like pop-up ads.
  • pron 3y ago
    I would put it another way. Any legislation against doing something is almost always motivated by someone's desire to do that very thing. Legislation is usually a battle of interests where the legislator, ideally, wants to protect the overall interests of the public when they conflict with narrower private interests. When the narrower interests belong to powerful groups, you often expect to see some struggle, and if the private interests have a way of making the regulation seem more intrusive and annoying than the harm it's intended to cause, they would take advantage of that to sway the public in their favour. So legislators do expect such a struggle, and the shape it takes may be partly their fault, but it's clearly not all their fault. The more power the private interests have, the more likely they are to find some way to fight the regulation. They will certainly do everything they can to convince the public that the legislators are bad at regulation. In this particular case, however, websites showing banners are also harming themselves as their competitors now have an interest in not showing banners and offering a better experience -- i.e. the regulation makes it worthwhile not to display banners in competitive situations. So we'll see how this all turns out.
  • sham1 3y ago
    The thing is, the consequences seem to be very much intended. The consequences of forcing companies to be transparent about tracking, and hopefully letting the users start voting with their wallets as they get annoyed by the omnipresent "We Value Your Privacy"-popups (which is very ironic considering all the dark patterns et al that are used to have users get tracked). If nothing else, at least now people know just how much they've been tracked. One can only hope that this increased consciousness would help people to choose services that don't track people. For example Hacker News doesn't need tracking cookies nor a cookie popup, and it seems to be doing just fine, even in terms of the law ;)
• piker 3y ago
  Dumb take. “Just run your business with 10% of the revenue? What’s the problem?” Edit: to those downvoting, yea, it’s agreed that tracking is bad but the tone of the article completely ignores that a lot of the web’s content depends on this model so if it “just didn’t track” a large swath would no longer exist.
  • FranzFerdiNaN 3y ago
    If your business cant survive without selling visitors data to Facebook it shouldnt exist.
  • dTal 3y ago
    If your business is "doing sketchy shit with people's data", and the regulatory hammer just came down on you... well, yeah.
    • zpeti 3y ago
      Come on, this is such a ridiculous take. Adding google adsense to a website needs a cookie bar. That’t not "doing sketchy shit with people's data" I can’t believe how many people have bought into this EU regulation hook line and sinker. It’s ridiculous, imagine the man hours that have been wasted in the last 7 years just clicking cookie bars. And as OP says, it’s completely unrealistic to not have them.
      • chgs 3y ago
        Google Adsense is doing sketchy shit with peoples data.
        • dTal 3y ago
          Indeed. Just because it is widespread doesn't make it okay. We should not allow greedy companies to set the Overton Window of acceptability.
        • PaulHoule 3y ago
          Advertising is “ground zero” for the cookie explosion because nobody trusts anybody in the advertising biz. For instance the website selling ads has every reason to inflate view and click count numbers, the ad buyer has reasons to diminish those numbers. In fact if you measure an honest pipeline it is going to look that way because some people drop out at each stage. One reason you have 87 trackers on a typical web site is that many sites and advertisers figure if they have a large number of trackers they can’t all be wrong. Site X could show ads to users just fine without third-party cookies but then advertisers would not be so sure about the stats.
• throwaway67743 3y ago
  One of the most egregious abusers of this recently got told off for it, I want to say it's IAB, but they're all as bad. Trust arc or whatever they're called deliberately made it as annoying and deceptive as possible. You can't blame the EU at all for a deliberate misinterpretation of the law.
  • raverbashing 3y ago
    Yeah, IIRC I think noyb was looking into "Trust arc"
• nolok 3y ago
  Imagine a market in which companies charge a lot of hidden fees behind their customers' back, and users are not happy when they realize after the fact. The law is updated to say you are not allowed to charge the user a fee unless you tell him in advance. Companies with tons of hidden fees decide to keep them but force you to read all the fees on every page of the menu before you can see the rest of the text, in the most annoying way possible, and promote the idea that the issue is not the extravagant fees, nor the fact that the companies hide them before and had to be forced by law to warn you about them, no the problem is a law that force them to tell you what you're getting into before it's too late ! That's, essentially, what's happening. And we have people complain that companies need to display their fees. On this issue in the group that complain about the cookie law there are some people who are very wrong on purpose because it's in their interest, and some people who are very wrong because they genuinely don't understand the position they're defending, complaining about being made aware of the fee, instead of the fees themselves or the fact that the companies hide them if not forced by law. To each their own belief about which category PG fits into.
  • aurareturn 3y ago
    Using your analogy, I think what ends up happening is that even companies that don't collect hidden fees will put up a banner just in case. Not only that, I'm not an EU citizen and I'm not browsing websites based in EU but I'm still bombarded with cookie banners non-stop.
    • piva00 3y ago
      > Not only that, I'm not an EU citizen and I'm not browsing websites based in EU but I'm still bombarded with cookie banners non-stop. Again, that's the fault of the companies putting those up, they could make it opt-in to collect your data, they could just put a small notice on the footer with 2 simples links "Accept all/Reject all". But they chose, they decided to pester you with those banners as annoyingly as possible to make you have exactly the reaction you're having.
      • aurareturn 3y ago
• flipbrad 3y ago
  Note that this isn't a cookie law, it's also the EU's main anti-malware law. The principle is that no piece of third-party controlled software should write information to your computer/phone, or read info from it, over the Internet, without your prior informed consent (with narrow exceptions for storage/reads that are needed to provide a service you've asked for, or equally narrow functions like load balancing). This isn't just about browser cookies, but also your webcam, your mic, and the contents of your Documents folder. The principle seems sound, but the EU is deadlocked over reforms to create some extra exemptions, e.g. for security scans/mandatory updates, or privacy-respecting audience metrics. EU regulators are already sort of turning a blind eye to those, so it's fair to say the EU isn't great at regulating - it's not fixing what society mostly seems to see as bugs/overreach in the original (now decades-old) law.
  • is_true 3y ago
    did they try to make it a standard for browser? I tried searching but I couldn't find anything
    • tpm 3y ago
      The standard for browser was called Do Not Track [0], but of course adtech killed it, there is another one now, but unless this is mandated by law or courts it won't go anywhere. Note there seems to be a court decision upholding DNT as rejection of consent [1], but this would have to be much more powerful and broadly adopted to work. [0] https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track [1] https://dig.watch/updates/german-court-affirms-legal-significance-of-do-not-track-signals-in-linkedin-case https://dig.watch/updates/german-court-affirms-legal-signifi...
  • toyg 3y ago
    What do you mean by "the original (now decades-old) law" ? The GDPR is 8 years old.
    • PinguTS 3y ago
      The ePrivacy directive, mostly referred to as "Cookie law" is from 2002. https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002L0058 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A...
• tlb 3y ago
  Part of what it means to be "good at regulation" is to anticipate the likely consequences of regulations. So a regulation that says that "businesses must now give away their products for free, unless they honk each customer's nose" will result in a lot of sore noses. Which is basically the case here. Almost all websites make money through ads, or at least keep logs of user activity to help them optimize their website, and that's not going to change, so the EU's boneheaded regulations make the customers suffer a little extra.
  • xxs 3y ago
    I guess the confusion is about advertising and tracking - the banners are about tracking not advertising.
    • paulgb 3y ago
      Advertising can be more targeted (and thus higher paying) when paired with tracking.
      • itishappy 3y ago
        So can car insurance, but I'd rather my agent not install a GPS without my knowledge or consent on my vehicle.
        • tekknik 3y ago
          not the same, you’re paying for car insurance and they offer you a discount if you allow tracking. most sites using tracking are providing you something for no monetary cost to you, instead by showing you targeted ads
          • itishappy 3y ago
            It's not that different, let's make it the same. Welcome to my new insurance company! Thanks for requesting a quote (it's free! the quote, not the insurance), my agent will swing by to install a GPS chip while you sleep. We're not doing anything malicious with it, we just give you call whenever you're within 5 miles of one of our locations. We'll put it in the bin the vehicle manufacturer conveniently installed for us to hold all the trackers grocery stores and shopping malls use to offer free parking, which you can of course empty out at any time (it's clearly labeled once you remove the oil pan). What's this, a shopping center now asks before installing a GPS chip on my car (but still somehow offers free parking if I decline)? How inconvenient!
• bjornsing 3y ago
  This is written from the standpoint that you want to deny consent. But I just want to give consent and get on with my day. I see it as sort of paying for the content. Honestly I think most people see it this way, even if it’s an unpopular stance in some tech circles.
  • c-flow 3y ago
    I find it annoying but I do the opposite. Don't give my consent for all the optionals and prefer not to get tracked. I don't believe all of that tracking is warranted in a significant number of cases. Websites appear to be still fully functional without all of those extras, too, meaning the website providers are also ok with foregoing it.
• poszlem 3y ago
  Putting up a wall in the middle of a busy street and then getting upset when people find ways around it doesn't make sense. The solution is either to remove the wall or ensure it cannot be bypassed. Right now, it's just irritating for the average person and slightly inconveniencing those who actually break the rules. This is the same situation with the cookie banner regulations. If the goal is to eliminate tracking, then making tracking illegal is the straightforward path (or make "do not track" actually mean something legally). Otherwise, ignoring it might be better. Implementing a policy that only frustrates the general public without effectively addressing the problem is not the right approach. This is what the OP cannot understand. EDIT: To the downvoters - I don't think you understand what the purpose of the downvote is on this site.
  • squigz 3y ago
    Since this is around the 5th time this sentiment has been expressed in this thread, I have to ask... are cookie banners really so frustrating? Oh no, gotta click one, maybe 2, more buttons...
    • poszlem 3y ago
      2 more buttons x the number of websites you visit a day x the number of time the website forgets your choice? Yes, they are quite annoying.
      • squigz 3y ago
        My bar for annoyance must just be very high.
    • oneeyedpigeon 3y ago
      > are cookie banners really so frustrating They would be a LOT less frustrating if: a) they were standardized — they currently add a hefty cognitive load while parsing them, deciding which action to take, etc. b) they worked properly — I would say, more often than not, they 'forget' the previous setting. I should never see a cookie popup on the same site twice unless I clear my browser settings.
• bheadmaster 3y ago
  I think this is one of the rare cases where the now-popular-and-often-misused word "gaslighting" fits perfectly: the companies are punishing users because of a law that protects them from data exploitation, then blame the law for protecting them. It's beyond evil. On the other hand, nobody is entitled to free content on the internet. Hopefully people will become annoyed enough that they will stop visiting the sites of data exploitation companies altogether.
• ptero 3y ago
  As a person who is generally suspicious of regulation on the grounds that it is an always growing beast (rules do not get revisited enough and rejected when they become an unneeded complexity), this viewpoint is spot on for me. And while the main visible results today are bad (cookie banners of various levels of annoyance) it is bad mostly due to existing dark patterns and encourages changes in the right direction. Will those chances come and, if so, when, is to be seen. My 2c.
• JimDabell 3y ago
  Yes there is. More specifically, it’s the Privacy and Electronic Communications Directive 2002/58/EC, which each member state adjusts their own laws to follow. It’s published here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02002L0058-20091219 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A... The relevant part: > Article 5 > Confidentiality of the communications > 3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. If you want to argue that companies have a legal alternative to showing you cookie banners, then by all means do so. But don’t say there’s no law because there clearly is. This is a misleading and inflammatory headline. Edit: Yes, I read the article. To draw a distinction between “must obtain consent” and “must show UI that obtains consent” is of no value unless you want to write an article with a shocking headline.
  • ascar 3y ago
    The article makes that point. There is no law to put a giant banner that disturbs UX in your users face. Companies choose to do so. There only is a law that prevents companies from tracking you without consent.
  • shdon 3y ago
    But that is what the title states and is explained in the article. There is no law that forces a cookie banner. There is a law that requires consent before tracking, but that is not necessarily about showing a banner - that is just one of the possible ways of complying with the law. There is an electronic privacy law, and it is quite comprehensive. There is no "cookie banner law".
  • iainmerrick 3y ago
    There’s a law, but it’s not a “cookie banner law”. The section you quoted says nothing about banners. The banners are a design decision by the operators.
• pearjuice 3y ago
  To me, this seems like engagement clickbait targeting PG to promote an infotainment product (CTO coaching/course): >there is no cookie banner law There definitely is. The article explicitly states this: >you need my consent when you want to track me "tracking" here means storing data: >store information in a visitor's browser is only allowed if the user is provided with "clear and comprehensive information", in accordance with the Data Protection Directive, about the purposes of the storage of, or access to, that information; and has given their consent (wikipedia) The actual directive also explicitly states this >consent may be given by any appropriate method enabling a freely given specific and informed indication of the user's wishes, including by ticking a box when visiting an Internet website (32002L0058.17)
  • xxs 3y ago
    >"tracking" here means storing data: Yes, without any consent. For instance logging in a site, doesn't require the warning.
• whywhywhywhy 3y ago
  Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have just been a browser setting that had to be respected and this whole thing would have been completely transparent to the end user and they would have benefitted by default. Instead through incompetent government employees we now have cookie banners for the rest of eternity on almost every site and they're not even standardized so worst sites like where journalists publish can have more and more obtuse ones.
  • poszlem 3y ago
    This is 100% what PG means IMO and the most sane take on this. Either write the law correctly so it's not easily bypassed or just don't touch anything because you will only make it worse.
    • piva00 3y ago
      The law is not bypassed, the annoying banners with no simple option to reject are illegal. The issue is that enforcement is slow, not that the law is badly written. GDPR's Article 7 [0] is very clear: > 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. [emphasis mine] [0] https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
      • throw10920 3y ago
        > The issue is that enforcement is slow, not that the law is badly written. The enforcement/implementation of a law is so deeply entwined with the text that it's deceptive to separate them. If a law is written in a way so as to make enforcement hard, or if the government doesn't have the resources to quickly and consistently apply it, then it's a bad law because it enables weaponized targeted/selective enforcement of a new law that wasn't present before.
• fullspectrumdev 3y ago
  The deliberate, bad faith misunderstandings of the tracking consent and GDPR stuff on here reminds me every time exactly how many people are apparently content to work for and shill for adtech. Working for Lockheed Martin or RTX is a more moral choice than working in adtech IMO.
• adulion 3y ago
  can you build a website nowadays with analytics without using cookies? or violating GDPR?
  • IanCal 3y ago
    Of course you can. What is it you want to do that you think you can't do?
  • cornedor 3y ago
    Yes you can. See for example https://plausible.io/ https://plausible.io/, which does analytics without using cookies, and without collecting any personal data.
  • alex_suzuki 3y ago
    You can use something like Plausible Analytics which does not use cookies.
  • deleted 3y ago
    [deleted]
  • cbeach 3y ago
    You can track the number of visits without using cookies, but its practically impossible to track the number of unique visitors without using cookies. The number of unique visitors is a very useful metric (both in itself, and combined with the number of visits). The EU has made it impossible to track this simple and harmless metric without inconveniencing all users with awful UX. Under the GDPR / ePrivacy Directive, ANY user-based unique identifer used for advertising, analytics and tracking will trigger the need for consent. --- General Data Protection Regulation (GDPR) Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person." Article 6(1) outlines the lawfulness of processing and states that processing is only lawful if and to the extent that at least one of the following applies: "the data subject has given consent to the processing of his or her personal data for one or more specific purposes." --- ePrivacy Directive (Directive 2002/58/EC) Article 5(3) requires prior informed consent for the storage of or access to information stored on a user's device: "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."
• kennethwolters 3y ago
  The entity that has legislative power takes responsibility for unintended consequences of its legislation. At least this is how Anglo/Common Wealth cultures think about it. You can see that Germans think about this differently.
• VoodooJuJu 3y ago
  I wonder - why didn't the the EU put the burden on user agents a.k.a. web browsers to handle the cookie notices? When I visit a site, before saving any cookies, have my user agent ask me if I want to allow cookies for that site. Could have a default "no cookies" option with a whitelist, or default "yes" with a blacklist. It would have been so much easier, with a far more consistent UX, wouldn't it have? Now we have to put up with 1,000 different flavors of invasive banners, popups, "necessary cookies", etc.
  • IanCal 3y ago
    Because it's not about cookies. It's a much broader statement than that about how the company is allowed to handle your data.
  • elygre 3y ago
    The EU in this scenario believes in the open market: let the web browsers and web sites find a technical solution.
  • pgeorgi 3y ago
    The EU doesn't tend to require specific implementations - the banners aren't a required implementation, either. It's just what the advertisers thought works best to get their desired outcome. There was the DNT header. Few sites acknowledge it (and thanks to those who do!), and when Microsoft went against spec by setting it default-on in their browser, advertisers whined that they can't see informed consent anymore and just shut down the whole initiative. Note: Microsoft is also in the advertising business, so if you're into that, that might be another angle for your favorite conspiracy theories. Finally, there's consent-o-matic, available as browser extension for various browsers, and it lets you state your preferences. https://consentomatic.au.dk/ https://consentomatic.au.dk/ Would it have been better to integrate that into browsers properly? Sure. But the social and economical dynamics being what they are, this is probably the best we can get.
  • _v7gu 3y ago
    DNT existed, but websites decided they could freely ignore that. Hence the regulation
• jasode 3y ago
  >, Paul Graham came up with the thought, that the EU forces companies to have cookie banners. There is no law for cookie banners. [...] Companies could easily avoid any cookie banner. Just don’t track. KingOfCoders/amazingcto, of course you are technically correct but Paul Graham wasn't talking about the letter of the law. Instead, you have to interpret his complaint with the lens of game theory. I.e. The Law of Unintended Consequences that takes into account what companies actually do in response to laws instead of what we hope they will do. Your blog post focused on good intentions of the law. PG's tweet focused on actual outcome.
  • n4r9 3y ago
    Doesn't that argument work both ways? If you interpret the EU's regulation with the "lens of game theory", it is an unintended consequence of aggressive corporate data collection. Not sure why it makes sense to complain about the EU and not the companies.
    • polygamous_bat 3y ago
      > Not sure why it makes sense to complain about the EU and not the companies. Unfortunately a non-negligible number of people in tech also have libertarian leanings, with a default “gubmint bad!” position, which makes them easy prey for adtech propaganda.
      • gred 3y ago
        > Unfortunately a non-negligible number of people in tech also have libertarian leanings Why is this unfortunate? Because you don't agree with us? The "they would agree with me if they were smarter" trope is tired and gets us nowhere.
        • Kbelicius 3y ago
          > Why is this unfortunate? GP answered your question, for some reason you decided to cut the quote right before the answer. Here is the part that is missing from your quote which answers your question: '[...]with a default “gubmint bad!” position'
• andrewstuart 3y ago
  Why is this guy pontificating in this topic if he is not a lawyer?
• eterevsky 3y ago
  There is a law, that does not mandate cookie banners, but that still causes them by creating incentives to show the banner. That's the point of criticism.
  • pif 3y ago
    You are implying that strict anti-emission laws caused uncontrolled emissions by Volkswagen vehicles. But Volkswagen was very discreet about it, and when uncovered everybody was against them. Website are being obnoxious, instead, and people accuse the law. Go figure!
    • eterevsky 3y ago
      I don't see the relation to the story about VW and emissions. VW broke the law, while the websites are following it.
      • paulryanrogers 3y ago
        Arguably by your logic the emissions laws incentivize cheating, much as folks see the GDPR incentivizing annoying users -- to nag regulators to change the rules back in the company's favor. It's a stretch though. I prefer more obvious analogies.
• happosai 3y ago
  Great example: Neither hacker news, nor that linked article needed a cookie banner.
  • xxs 3y ago
    The article even has a book ad on the side
• deleted 3y ago
  [deleted]
  • deleted 3y ago
    [deleted]
• deleted 3y ago
  [deleted]
• arbuge 3y ago
  "Companies could easily avoid any cookie banner. Just don’t track." It seems like a point dear to the author's heart, given the way he highlights this and puts it in bold at the top of the article. But while it sounds good on the surface, it doesn't take much digging to show it's silly. If you store any kind of data about a visitor to make their life more convenient, is that tracking? Shopping carts? Notification preferences? etc. It's actually a bit ironic to ask visitors if it's ok to track them. If they say no, you have to track them to at least remember that choice.
  • crabmusket 3y ago
    Shopping carts and notification preferences don't require a consent banner.
    • iEchoic 3y ago
      Our lawyers told us otherwise. Regardless of the answer here, the fact that there's still a debate about what basic functionality requires a cookie banner is really a testament to how bad this legislation is. How long has this been around, 20 years? And there's still widespread debate and lack of understanding as to what specific functionality requires a cookie banner?
      • smallerfish 3y ago
        > How long has this been around, 20 years? No. It took effect in 2018.
        • cccbbbaaa 3y ago
          Cookies banner are a response to the ePrivacy directive from 2002.
          • smallerfish 3y ago
            They weren't widely implemented until post GDPR, and in fact post https://curia.europa.eu/juris/document/document.jsf;jsessionid=D5DC4CA415C605B28E70747FD3C5158C?%20text=&docid=218462&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=1458627 https://curia.europa.eu/juris/document/document.jsf;jsession...
• dangus 3y ago
  Just in case this helps someone: you can just block cookie banners because before you click “accept” the default is no tracking. There are extensions like “I don’t care about cookies” for this but also uBlock Origin has a list checkbox for it.
  • andrewaylett 3y ago
    The default should be no tracking.
    • deleted 3y ago
      [deleted]
• aurareturn 3y ago
  Agreed with Paul Graham here: https://news.ycombinator.com/item?id=39627573 https://news.ycombinator.com/item?id=39627573 HN loves EU regulations though. HN also loves Paul Graham. I got my popcorn ready to read what people will write.
• ZiiS 3y ago
  Whilst, I am very opposed to tracking; especially covert. I do believe the cookie law is bad. Fundamentally, websites can not store content on your computer without your consent. Your "User Agent" is what stores cookies; it is usually a piece of open source software fully in your control capable of only storing them based on any policy you like, including asking you for each site. Whilst it would be nice for all sites to set an "Evil Bit" telling you which cookies are functional and which are for Adversing tracking, this is un-policable.
  • niklasrde 3y ago
    That's not true. "strictly necessary cookies" are allowed without consent (but information on their use must be available). Examples for what that means given by the EU itself [1] include "cookies that allow web shops to hold your items in your cart while you are shopping". And on the policing - there are a lot of laws that cannot be "policed". It requires trust, goodwill, collaboration and savy users to report violations to the webmaster or relevant ICO. [1]: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
    • ZiiS 3y ago
      How do you know if a site has used a cookie they said was functional to track you?
      • LunaSea 3y ago
        It doesn't matter because that's the law and if you don't follow it you risk a fine. How do you know if your neighbour is not producing meth in his basement?
  • mpeg 3y ago
    What you're suggesting is basically the same thing as what the law is achieving. Yes, users could block all cookies but this will break functionality on a lot of sites, so it's not reasonable. And yes, sites could communicate which are functionality cookies and which are tracking cookies, but as you say it's hard to police this, so pushing the issues to the user's software won't work. What the law does is fixes all this by requiring sites to obtain consent in certain scenarios; but if your site only sets cookies required for the site to function (shopping cart, login cookies), or if it tracks users for the purpose of security (eg a bank that detects when you log in from a new device / location) you DO NOT need to obtain consent, no banner required.
• randallsquared 3y ago
  Having read comments here first, I was surprised when I visited the article and found that while the thrust of the article was that pg was incorrect about the existence of a law about "cookie banners", the tweet referenced in the post -- and screenshot, even -- does not even imply that pg thinks that there is a law specifically mandating cookie banners.
• oytis 3y ago
  He's not saying there is though? The "cookie law" is 14 years old now, and it looks like the proverbial Brussels effect failed to change how the whole industry operates, except we now have cookie banners.
  • paulryanrogers 3y ago
    Customers are more informed. Savvy companies now only do essential tracking, so don't have to bother users. Or at least more will as enforcement catches on.
• stephc_int13 3y ago
  This article just reminded me that I should always choose NO when asked. And that probably can be automated...
  • frizlab 3y ago
    There are extensions to hide the cookie banners and while you have not clicked yes you have effectively said no.
  • shade 3y ago
    I've been running Consent-o-matic [1] in both Chrome and Firefox for quite a while now, which automates a lot of them. You can set your preferences for what categories of cookies you want to allow. [1] https://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic
• pcl 3y ago
  > “I’m not a lawyer and this is not legal advice. Ask your data protection specialist.” Ironically, the author felt compelled to announce that he’s not providing legal advice. There is also no need for him to make that disclaimer. But hey, why take the risk?
• vbo 3y ago
  With or without EU regulations, client software could decide to discard all cookies once the user has "left" the site. Or it could block cross domain cookies of its own volition. Yes, it doesn't fix the fundamental issue, but it does address it for those that want to fix it against the tide. Yes, it comes with drawbacks, but it is what it is so long as we don't collectively move towards paying for content, ideally in micro form. I sometimes come across articles in local publications that ask me to subscribe - dude, seriously? Do you expect me to subscribe to an Alaskan publication when I live half the world away and could not care less of what happens there, but just want to read this one article that seems interesting? So instead we have ad funded websites that have to do what they have to do in order to make some money and keep publishing whatever it is they publish. Hence tracking cookies. Everyone's needs would be better served if we could pay for content the same way we did back in the day of printed newspapers. You buy today's edition and you get today's edition and no one except the newsagent is tracking you (if you happen to regularly buy the newspaper from her, she'll remember you, and she may even suggest additional newspapers to buy but it's implied, right? we dislike machine tracking, not humans remembering our buying habits). Alas, we don't have that. We have intrusive tracking and subscriptions, even though technically it's something we could build in weeks (lest the payment companies didn't make it unfeasible, for their own benefit). And people do sometimes try to figure it out. Bundles come to mind. Everything -- except micro transactions allowing you to purchase just. this. article. And while micro transactions don't exclude tracking, companies are more likely (is this wishful thinking?) to be careful with a paying customer's experience than with freeloaders, which is what we insist of being, while putting up demands as to what publishers can do with our data.
  • pif 3y ago
    > Everyone's needs would be better served if we could pay for content the same way we did back in the day of printed newspapers. This is one option. Another is that advertisement goes back to those days: you associate advertisement to a content and to a rough geographical location, and that's it. No personalised ads is still possible.
• skrebbel 3y ago
  I agree with this. We recently removed all tracking (eg google analytics) from our homepage because we didn't want to have a cookie banner. The result: everything is going fine. Turns out we didn't need the tracking at all. Should've done it way sooner. I hope the EU sticks to their guns. A few years ago, there was a flood of HN posts about optimizing initial page loads etc, because research showed that even a few hundred milliseconds slower load times measurably affected how often people clicked on buttons named "buy" and "sign up" and the likes. Then GDPR happened, and this somehow became a non-topic and instead we get 3-screen tall "TrustArc" modals that take half a second responding to a click? This makes no sense at all! I hope, and believe, that it's just a matter of time before people re-discover that yes, actually, if you make a page fast and nice and friendly, you get more clicks/signups/purchases/$kpi, and that cookie banners hurt business. If this is true, then what we're seeing now is just the initial path of least resistance: do what we did before, plus do what the lawyers tell us to. As the key GDPR rules have gradually become "common knowledge", we ought to be seeing gradually more sites switch their approach and focus on fast UX again, ie, no cookie banners and thus no tracking. Sure, it's work, and I bet the math doesn't always work out against tracking, but I bet often enough it does.
  • cseleborg 3y ago
    > I agree with this. We recently removed all tracking (eg google analytics) from our homepage because we didn't want to have a cookie banner. The result: everything is going fine. Turns out we didn't need the tracking at all. Should've done it way sooner. Thank you. The industry needs more such testimonies showing that letting go of tracking is okay and won't sink the ship.
    • deleted 3y ago
      [deleted]
• dangoodmanUT 3y ago
  There's a simple way to not have your rockets explode when trying to go to mars, just don't build rockets
• deleted 3y ago
  [deleted]
• bananapub 3y ago
  it is pure HN that there's so many people commenting who 1) didn't bother to read the article 2) didn't bother to read any previous articles and so have continually spread nonsense about what the regulations actually required 3) defending all the companies that decided to be fuckwits with barrages of notices to users instead of actually sincerely trying to reduce their creepy nonsense and then - if anything was left that required disclosure - explained it honestly
  • _v7gu 3y ago
    I believe quite a lot of them have their paychecks depending on invasive user tracking, so no surprise.
    • bananapub 3y ago
      everyone's at best a temporarily embarrassed surveillance capitalist
• cafed00d 3y ago
  > Companies could easily avoid any cookie banner. Just don’t track. Well, then, the EU should've just made _this_ the law. And we'd have called it the "Just don't track" law. Rant & Details: > There is no law for cookie banners. > What the EU is saying, you need my consent when you want to track me, profile me and sell my behavior off to ad companies. > or “Look, Why take a chance?” (Remo Gaggi), This kinda proves PG's point. Rant: I find it incredible that folks defend the EU by saying things like "There is no law for cookie banners". No, there is a law. The law is reason people think "Look, Why take a chance?" and build crap like cookie banners in. The law is not a bunch of words on paper. It's the institution that incentivizes or punishes people for their actions; thereby influencing people's behavior.
  • paulryanrogers 3y ago
    The law punishes companies, not private citizens. If lawyers are overreacting or companies cannot discern between essential tracking and non-essential then perhaps they are the incompetent ones.
    • aleph_minus_one 3y ago
      > If lawyers are overreacting or companies cannot discern between essential tracking and non-essential then perhaps they are the incompetent ones. If the EU is incapable of creating a law where it is unclear even to quite some lawyers where the boundary between allowed and forbidden is, the EU politicians are the incompetent ones.
      • cseleborg 3y ago
        There are a bazillion unclear laws all over the world. It's common practice, really, to formulate things a little bit generally, and let practitioners (lawyers and courts) figure out the details. In this case, the unclear point is around the notion of "legitimate interest". I guess something like fraud prevention can be thought of legitimate interest. But ad companies just said, "well, we make money out of tracking the hell out of users, so it's in our legitimate interest to keep doing it, and never mind that the whole point of the law was explicitly to rein in our industry's nasty behaviour." So now law practitioners how to hash out amongst themselves what "legitimate interest" actually means in 2024, and this of course can change in 2034, so you write the law to not have to be updated every time the tech industry invents new ways of being naughty.
• MobileVet 3y ago
  > Or you are worn down and no longer care after twenty banners and say yes This is probably the worst omission from the EU law, no limit to the number of times you can be asked. I told you my answer last time I visited… but you didn’t like it so you ask again, and again, and again. Every time I visit you ask me. <rage quit>
• YetAnotherNick 3y ago
  Europe's parliament's site has cookie banner[1]. People saying you don't need cookie banner either haven't worked in companies or are purely driven by ideology. [1]: https://www.europarl.europa.eu/portal/en https://www.europarl.europa.eu/portal/en
  • braymundo 3y ago
    And it's a super sane implementation. A simple yes or no.
  • dahauns 3y ago
    The site also shows how simple it could be, though - it respects the DNT flag: no cookie banner, no tracking in this case.
    • YetAnotherNick 3y ago
      It's a case of moving goalposts. The thing claimed is that sites don't need cookie banner and a simple parliament site needs it.
• prima-facie 3y ago
  Just read an article about this a couple of days ago which went into more detail: https://www.bitecode.dev/p/there-is-no-eu-cookie-banner-law https://www.bitecode.dev/p/there-is-no-eu-cookie-banner-law
• rsp1984 3y ago
  > Just don’t track. You're making it sound like it was a switch that I could simply turn on/off as a web dev. The reality is that most sites are a complete clusterf*k of 3rd party components, dependencies, backend services etc. Doing an audit of which of these components are compliant with tracking / cookie laws is just not a realistic ask. Hence why devs decide to just tack on a cookie banner and call it a day.
  • paulryanrogers 3y ago
    These do not sound like competent companies, if they cannot even classify the tracking that they initiate as essential or non-essential
• jesprenj 3y ago
  Slovenia does have a cookie law, explicitly stating that setting cookies in browsers is not allowed unless permission is granted beforehand. But it's up to interpretarion whether enabling cookies in the browser counts as permission. http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO8611 http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO8611 -- 225. člen (piškotki)
• 627467 3y ago
  > Companies could easily avoid any cookie banner. Just don’t track. Companies can easily not deal with EU shenanigans. Just leave the EU. actually: many do.
• nojvek 3y ago
  US does a really shitty job at regulating tech companies - esp privacy and abuse of data. Perhaps because the big tech has captured the regulators with a lobby revolving door. Look at how big a tantrum Apple is throwing regarding 3rd party app stores. I’m glad EU is doing what it’s doing. And the various data locality laws. Data is precious. I wish US would impose stronger fines when data is misused or hacked into due to negligence.
  • mlrtime 3y ago
    And yet there isn't a lot of actual difference between Americans and EU citizens. Sure lots of EU laws, practically speaking no difference at all.
• skerit 3y ago
  > What the EU is saying, you need my consent when you want to track me, profile me and sell my behavior off to ad companies. Huh. I always thought that as soon as you use a long-term cookie that could technically be used for tracking, you have to get permission. Which also means you have to get permission when someone logs in to your website. Though I guess the act of logging in could be seen as giving permission. Anyway: I don't add cookie banners on my websites, and I don't use any tracking.
• frizlab 3y ago
  > just listen to “Do Not Track” headers (it’s deprecated because companies did hate this) It was my understanding that it is deprecated because it was completely disregarded and thus gave a false sense of safety from tracking and it was used by tracking company to do additional tracking.
• 627467 3y ago
  hey: I want to be tracked and I'm extremely annoyed that the law forces me to consent on every f- site I go to. Seems fairly clear that I consent when my browser makes a request to someone elses server and I have js enabled. If you don't want to be tracked: disable js, disable cookies, don't go to website you know will track you. As a user: the way you can check whether you have a tracker is as trivial as interacting with a cookie banner. Plus the cookie banners are all different but the UI to check cookies on your browser is standard and the same. if the EU wants to do something: force browser vendors to educate users on how to use their software
• seanhunter 3y ago
  At one company where I worked the head of legal and the compliance officer scheduled a meeting with me[1] without any notice. I showed up and it turns out they wanted to know why we didn't have a cookie banner. I explained we didn't have any cookies. They insisted we implement a cookie banner which would set a cookie to say whether or not you had accepted cookies. This was the only cookie. [1] Never a good sign when legal and compliance just book a meeting with you like that and you don't know any normal context.
• adamlett 3y ago
  A personal anecdote: I was charged with adding a cookie banner to my company’s website after having successfully resisted having one for many years. The reason given to me by the new owners of the business being that the marketing department wanted to try some new stuff, and the lawyers told them that it required consent on the part of our users. I was also told that I shouldn’t spend a lot of time on this, and to therefore use an off-the-shelf product (OneTrust), and to not customize it any way. When I remarked that the default texts for the banner sounded very scary and implied that we did a lot of things that we weren’t actually doing, I was told to leave them unchanged, because we had to assume that they had been vetted by (OneTrust’s) lawyers, and that it would be too legally risky to change them. My argument that OneTrust’s offering was a one size fits all that had to be compliant with the sleaziest, most ad-tech compromised media sites out there, but that we were not that, failed to make an impression. A couple of observations: 1. Players like OneTrust and the consultants who specialize in this, are highly incentivized to play up the risks of not being compliant. My layman’s estimation of the legal risks is that the risk for good faith actors is actually pretty low. If the authorities find that you are not in compliance, you will most likely get a chance to rectify this, and possibly a slap on the wrist. Those scary fines measured in percent of global revenue, is not going to be what you face for an honest mistake. 2. Those businesses that rely on invasive tracking, and therefore really must use these banners, benefit from everyone else mistakingly believing that they too must compromise their UX with these banners. It makes what they do seem normal and acceptable.
• reactordev 3y ago
  I'm glad someone said this on a broader scale than I could reach. This is exactly why we have cookie consent pop-ups. Implemented by Admiral Tech or whatever. It's disgusting and is hostile to the open web. Even disagreeing now forces you into another full-page pop-up where you have to itemize your disagreement before clicking on Reject All.
• seydor 3y ago
  I think pg is talking about the advertising banners, and yes, congratulations EU you have ruined our web experience to the benefit of even-worse-tracking that mobile applications do. I think the bigger issue here is that this law did not fix anything, destroyed what little EU online advertising business existed, and focused on the wrong thing. For starters, the european people did not ask for this law, they have bigger problems, it was campaigned by specific german interest groups for which most EU citizens are indiffernt. Ad tracking is/was not a concern for the vast majority of EU citizens (who , again were never asked about this law) . Internet and social media addiction, however, IS an issue that most citizens have, and the EU has spent so much energy and capital on this pointless cookie banners issue, that it doesnt have more to spend on solving the addiction issue. Premature legislation always does that, and the worst is, there will never be accountability for such wrong decisions. The people who inspired the legislation are not up in some kind of election, and the upcoming MEP elections have nothing to do with EU politics and everything to do with domestic politics (Show me a country where MEP election results are not considered a proxy for national elections). But it doesnt matter how many times someone points the political misaligments , there is no mechanism to change that until something really grave happens, when it will be too late.
• zalyalov 3y ago
  I see a lot of comments about how it is some sort of an unforeseen second-order consequence. But it isn't. If you want to have no tracking, you write a law that nans tracking. If you write a law about mandatory notifications, bombardment of notifications is the most direct consequence one can imagine.
• jstummbillig 3y ago
  Both ideas are simplistic nonsense. It's how we wish people worked, but it's not how people work. The area of people that actively care about being tracked is not equal to the area of people, that would say yes if you point blank ask them "do you want to be tracked?" (with all the fears that this question triggers), and it's not equal to the area of people who would actually be happy to give up the affordances that tracking allows for in their every day life, even if they really do not like to say "yes" when asked to be tracked. All of this is compatible because, hi, this is us. We close our eyes, and pretend they are open. We love to not consider consequences, while thinking of ourselves as considerate. Well, not always. We do make "a few mistakes" every now and then, of course. This makes the whole thing believable, to ourselves and each other. I understand that it makes for good internet banter to ignore all that but what else it is good for, I do not know.
• RudyStone 3y ago
  A-fucking men.
• tristor 3y ago
  I have what I think is a somewhat clear perspective on the issue of tracking cookies, because I have been on both sides of this issue “in the trenches.” My observation has been that companies really cannot choose to not track as a larger entity, because systemically they do not trust their own employees to make good decisions. What I mean by this is that tracking in web properties is a joint decision (in most tech companies anyway) between Marketing, Legal, and Product as functions and executive leadership overall. This is actually a “big” decision, because it’s a binary decision that guides future trajectory. Companies can choose to: A. Make decisions about where to expend resources on ads, product feature development, localization, accessibility, et al on web properties based entirely on the “gut check” of their employees in each function and trust the outcomes. B. Carefully measure and track everything so that decisions are supported by data and results are tracked, simplifying decision making and reducing the potential bias of employees and eliminating the need to trust employees to make good decisions and being able to validate outcomes. If your product /is/ a web-app, the impact becomes even more pronounced. At the end of the day, the only way to get an organization to give up tracking is to directly force the issue in the law or solve the underlying issues that create a trust gap and competency gap within large organizations. I think the latter is likely impossible to solve, so the former is the only option. In line with the banality of evil, companies are not maliciously deciding to track you, if there is any malice here its towards their own employees down the line, who aren’t or can’t be trusted to do their jobs without tracking. Because Option B is the only likely option here, the net effect of the law as it stands today is to have a cookie banner everywhere. There’s literally a SaaS called Cookie Law that helps companies comply with these rules.
• antomeie 3y ago
  I don't know exactly what Paul was referring to when he wrote his tweet, but my own interpretation of the problem is that the EU has basically transferred the responsibility entirely over to the end user, which is a responsibility that we know people are not capable of handling. Sure, you can say that websites have the option of "Just don't track", but realistically we know that that will never happen. Particularly since a lot of websites are actually tracking the user for the purpose of making the experience better (such as remembering settings, recent search terms, etc...), rather than tracking for the purpose of selling data to advertisers. But, from the user's point of view, they won't know what they have agreed to anyways. So essentially we get to a scenario where 99% of the websites have annoying cookie banners, when we already know that 99% of users won't read the terms anyways... If the EU was good at regulating things, they would come up with a solution which puts the responsibility primarily on the website. One example of this could be if EU defines like ~5 different "data ratings", with pre-defined conditions of what sort of data was allowed to be tracked for each rating. Then the websites are responsible for choosing the rating that corresponds to their level of data gathering, and if they report it incorrectly, the EU could fine them. The result of this is that when a user visits a website, you can quickly see a "badge" in the browser which lets you know what sort of tracking this page has (thus the user learn what each rating means, and get a better understanding of what they agree to). This is very similar to what Apple already does in the App Store in the "Data Linked To You" section for each app.
• openplatypus 3y ago
  Tired of cookie banners? Just use Consent Free analytics like Wide Angle Analytics.
• deleted 3y ago
  [deleted]
• amadeuspagel 3y ago
  There is a law that lead to almost every website, including every official EU website, to have a cookie banner. If you refer to the "cookie banner law" everyone will know that you mean that law.
• ChrisArchitect 3y ago
  Related: There is no EU cookie banner law https://news.ycombinator.com/item?id=39706375 https://news.ycombinator.com/item?id=39706375
• luke-stanley 3y ago
  @KingOfCoders / amazingcto you wrote `Indeed, as an American, there is no need to force them onto you.` - I feel like that suggests some assumptions about PG here that might not be quite correct. Since PG's often in the UK, his place of birth and where he has a residence, he's sometimes in a place that has GDPR obligations, he'll likely be exposed to the full GDPR vs analytics annoyances that IP addresses, email addresses, trackers, and the data protection make likely. I've no idea what internet use would be like in the US though (I haven't surfed via the US for ages though so don't know what the geo-targetted and account targetted consent differences are). PG likely both benefits and suffers from being in multiple jurisdictions. As for his personal identity, with terms like American and British, he might identify with both, but he did write "Keep Your Identity Small" so he might even prefer neither label, I don't know. Regardless, yes there could be better ways at a protocol level, maybe the EU should have foresaw that rather that the noise which we have now. Guess we'll have ML agents to handle it for us soon.
• philip-b 3y ago
  If only my browser showed, for each link that leads to a website with an annoying cookie banner, a small icon indicating that that's the kind of website the link leaves to. Can someone make a browser extension like that?
• burneraccount12 3y ago
  [dead]
• mediumsmart 3y ago
  Thats right, however, there is a consent needed for cookies that are not necessary. If you don't have the cookie banner asking for consent to track you with the unnecessary tracking cookies you can get a letter from the abmahnanwalt which means that in germany there is a defacto cookie banner law (next to the self censorhip brain bucket) just to be on the safe side.
• tmaly 3y ago
  I don’t put these cookie banners on my sites. They are just annoying. Most decent browsers block google analytics these days. The facebook pixel was retired as far as I can recall. At this point I just have a local analytics setup just to let me know how many visits a particular page got.
• schnuri 3y ago
  Is it just me or does someone else finds it curious that a post with 414 points in 2 hours and many comments is on page 2? There are posts with less points, and less comments in more time that are on the first page. Is the HN ranking algorithm public?
  • hazbo 3y ago
    It's now magically made it to page 6, seems a bit odd
  • ambichook 3y ago
    flame war detector will downgrade posts like this if i understand HN correctly :)
• aristofun 3y ago
  Paul Graham is right still. Eu bureaucrats could have expected that many companies _need_ tracking to survive. While most people do not actually care about tracking. Not to mention that behind most companies are the people who earn their living. By honest work (advertising is not guns smuggling you know). So eventually those stupid bureaucrats didn’t really solve anything, but made life slightly worse for everyone. Which proves original Paul’s point.
  • gitaarik 3y ago
    Or you could look at it like this: Big websites are tracking people, unknowingly to them, giving them lots of power, because information is power these days. And the sites that treat their customers fairly and honestly, ie they just want to offer you their product/service and are not interested in making a profit from your information, are not highlighted for their good intentions. This law makes the difference clear to users. Maybe most users don't care, like most users don't care about open source, or fair trade products. But I'm personally happy that the EU cares, because I care. And I understand that most people don't care because they are ignorant about the issues and consequences. But I do find it a bit funny that a lot of people on HN don't seem to care. And I think the cookie banners are a good way to start to make people aware of these issues. It won't solve it in one go of course, but at least it starts to make people think about it in some way. And maybe there are better ways, but you gotta start somewhere.
    • gitaarik 3y ago
      Maybe the next step would be that websites should adhere to the "Do not track" browser option, and not show the popup when people have that option on. I think that would make a lot of people very happy. The businesses that thrive on data collection not of course, but who cares about them really? People might say they pay our salaries, but if they don't thrive, other businesses will thrive, and they will pay our salaries. I rather have businesses thrive in a ethical way and have them pay our salaries. So I can only see good coming out from this.
      • aristofun 3y ago
• deleted 3y ago
  [deleted]
• d--b 3y ago
  Well pg is right in that the EU should have forbidden tracking users completely. But I'm pretty sure that close to 100% of pg's YC startups do track their users. So here's pg's shitting all over the regulators who made him a flower by still allowing his businesses to track people by tricking them into accepting cookies. Ugh
• nedt 3y ago
  Just imagine someone in the supermarket following you all the time, writing down all of your actions. That's pretty creepy and that's why you have to give consent first. I have no idea why anyone thought it's normal when done online. Or to extend it to the offline world just because it's technical easy. That's all the cookie banner is doing - showing how creepy many companies are and how much they don't care about you personally.
  • skoocda 3y ago
    If someone was running a supermarket and you came in day after day and never paid for anything, they'd get suspicious and probably follow you around all the time, too. You don't pay for (almost) anything on the internet. Nobody does, because the requisite infrastructure doesn't even exist to allow you to pay for a page at a time. Until that changes, the creepy companies will keep finding ways to follow you around- both to earn money from advertising, and to ensure you're not abusing their systems.
• siva7 3y ago
  > The only thing that matters is that if an entity wants to track people, they have to let them know in a way that is clear and request their approval. The law may be a one-liner that just wants to protect the users privacy. But this vagueness makes this law so extremely bad. Companys don't know anymore what's allowed and what not, so in order not to risk getting sued by some greedy shenanigans they just put up some cookie consent wall up. Can i use tools like Microsoft Clarity or Google Pages without getting sued by not having some cookie banner? Who knows anymore without getting an expensive lawyer and then i have to deal with the expensive technical changes required to implement these regulation wich especially hurts small or one-person software shops while big co doesn't care anyway.
• bartimus 3y ago
  If you don't want websites to store (1st, 2nd or 3rd party) cookies then such behavior could/should simply be controlled within the browser. Just turn off cookies (although the browser cookie control options could be improved). If I'm allowing my browser to set cookies, I don't need an EU law forcing websites to ask me everytime if I'm ok with a cookie being set.
• 1vuio0pswjnm7 3y ago
  "Companies could easily avoid any cookie banner. Just don't track."
• soerxpso 3y ago
  This seems like a very "um, akshuallyyy" response. There IS a cookie banner law. If the law says, "You must do X before doing Y," and you know that everyone is still going to do Y, you've effectively mandated X. The argument that simply not doing Y (which everyone does, and which you need to do to avoid being at a competitive disadvantage in the market) would avoid the mandate to do X is a pointless technicality. Regardless of whether cookie banners could technically be avoided, Graham's point stands that this regulation has served no purpose other than to annoy consumers.
• diego_sandoval 3y ago
  The whole premise of the law is wrong at a fundamental level. For cookies to function, browser (acting on behalf of the user) and website have to cooperate. First, the website sends a snippet of data to the browser, the browser then stores that data, and sends it back to the server on subsequent requests. If the user doesn't want the cookies to function, all he has to do is tell his browser to stop sending the cookies back. The website has no way to forcefully store the cookies on the users computer and then snatch them back from their hard drive. The browser, and ultimately, the user, is the one that decides to store and send the cookies back. But legally, website owners are held accountable for the inability of users to stop themselves from sending the cookies back. It doesn't make sense. If the rest of the Internet worked this way, you would need to call Google on the phone and tell them that you consent to them sending you HTML before being able to load google.com on your browser.
• Ajnasz 3y ago
  The only cookie I would accept that I don't accept any other cookies.
• throwaway220033 3y ago
  Without even reading the whole article, I can tell the author is German. Create dumb and pointless rules and enforce them with highest passion. Believe that you're the smartest person who only understands these rules. Serve nothing but the soul sucker bureaucracy. Many people are leaving Germany pretty much because of this. Startup founders often do pointless work just to not get in prison. The author of course has zero experience building anything. He is the amazing CTO. He'll teach you how to do. Because he's superior than rest of the world. The society here has tendency to descend into madness with a strange group behaviour. History. Rhymes.
• sk10y 3y ago
  The cookie banners are the way they are because they comply with the law, so you can not say "you follow the law in a wrong way", except for these banners which do not allow to reject cookies as easy as to accept them, the banners comply with the law so you can not blame site owners. Instead, the law and requirements should be adjusted to make the horror of cookie banners stop. I never could understand who thought asking website owners to get your consent is a good idea. Think of when you are installing an app on your phone, is it the app asks permission to use your location or your OS? Access to cookie storage is the same, a browser should allow or not allow webpage to store something on your device. Same as most of the browsers do for notifications btw. Fixing ~200 browsers is much easier than fixing millions of the websites, you can also setup default preference, you can also have a clear, unbiased UI.