11 ms·

Imagine a market in which companies charge a lot of hidden fees behind their customers' back, and users are not happy when they realize after the fact. The law

by nolok 3y ago

Imagine a market in which companies charge a lot of hidden fees behind their customers' back, and users are not happy when they realize after the fact. The law is updated to say you are not allowed to charge the user a fee unless you tell him in advance. Companies with tons of hidden fees decide to keep them but force you to read all the fees on every page of the menu before you can see the rest of the text, in the most annoying way possible, and promote the idea that the issue is not the extravagant fees, nor the fact that the companies hide them before and had to be forced by law to warn you about them, no the problem is a law that force them to tell you what you're getting into before it's too late ! That's, essentially, what's happening. And we have people complain that companies need to display their fees. On this issue in the group that complain about the cookie law there are some people who are very wrong on purpose because it's in their interest, and some people who are very wrong because they genuinely don't understand the position they're defending, complaining about being made aware of the fee, instead of the fees themselves or the fact that the companies hide them if not forced by law. To each their own belief about which category PG fits into.

aurareturn 3y ago
Using your analogy, I think what ends up happening is that even companies that don't collect hidden fees will put up a banner just in case. Not only that, I'm not an EU citizen and I'm not browsing websites based in EU but I'm still bombarded with cookie banners non-stop.
- piva00 3y ago
  > Not only that, I'm not an EU citizen and I'm not browsing websites based in EU but I'm still bombarded with cookie banners non-stop. Again, that's the fault of the companies putting those up, they could make it opt-in to collect your data, they could just put a small notice on the footer with 2 simples links "Accept all/Reject all". But they chose, they decided to pester you with those banners as annoyingly as possible to make you have exactly the reaction you're having.
  - aurareturn 3y ago
    The fact that companies are doing that says more about the bad law than the companies which is exactly Paul Graham's point.
    - bananapub 3y ago
      what a ridiculous point of view. do you think the same thing about laws against murder? about fraud?
      - card_zero 3y ago
        I've got to admit, I'm unclear what the equivalent of a cookie banner for murder would be. This criminal uses murder! If you continue to interact, you consent to being murdered. Murders you anyway
    - paulryanrogers 3y ago
      Or it says more about the manipulative intentions of the companies than anything about a good law.
    - piva00 3y ago
      What exactly is bad about the law that allows companies to do the annoying cookie banner?
    - kibwen 3y ago
      [flagged]
      - throw10920 3y ago
        > Please stop defending the behavior of shitty companies. At the very least, I hope you're getting paid for these comments. Please don't do this on HN.
    - layer8 3y ago
      The law is pretty crystal clear. In many cases the issue is that websites are outsourcing their tracking to ad companies, which in turn apply those banners indiscriminately because that's in their interest. That being said, all the dark-pattern banners actually break the law. The problem, if anything, is lack of enforcement of the law.
- nolok 3y ago
  For your first point I disagree, my companies don't track and we don't have banner cookies. On your second point, that is again a choice of said companies, not a problem with the law. The GDPR has proven very well that if they cared, they can segment who is affected or not, and not just big tech lots of random local news site and the likes are doing it just fine. So again, you're aiming at the wrong culprit.
- gizmo 3y ago
  Do you have /any/ examples of websites that don't have a bunch of 3rd party cookies that still have a cookie banner? Middle managers absolutely love anything with charts and graphs because it makes their decisions feel more scientific. That's why they want tracking software included on their websites. And if the law requires disclosure then a cookie popup is the solution.
  - PennRobotics 3y ago
    It only took two minutes to find at https://www.schwarzkuenstler.com/ https://www.schwarzkuenstler.com/ and I'm sure I can find a dozen more in half an hour. Germany is a bit litigious w.r.t. internet or privacy, so the combination---cookie consent---is a doozy. Nearly every German website that does anything will have a consent notification, and the slightest misstep (e.g. using Google Fonts without asking permission) can be punishable.
    - gizmo 3y ago
      Their privacy policy states they use Google reCAPTCHA, which requires disclosure.
      - PennRobotics 3y ago
        True, I hadn't noticed that at first glance, and I didn't see that as a third-party cookie in my site data. Nonetheless, I regularly see cookie warnings on sites with purely first-party cookies or even "just" session storage. (Mostly, I have been alert to this for the past year as I've started making non-personal web sites in Europe.)
  - maccard 3y ago
    My company recently announced a game, and we launched a website for the game. There's no ̶t̶h̶i̶r̶d̶ ̶p̶a̶r̶t̶y̶ e:tracking cookies (I didn't make the site, but I do run it). Our US based legal team told us we needed a cookie banner if we were going to have visitors in the EU. I pushed back, but I lost, and ultimately it's not my fight.
- pokot0 3y ago
  Just been in Europe last week (I live in US): you have no idea what a nightmare internet is in Europe. You are only seeing a side effect here.
  - denton-scratch 3y ago
    > what a nightmare internet is in Europe I live in Europe; I don't experience this "nightmare". Would you care to expand?
    - yau8edq12i 3y ago
      As someone who's lived in both the US and Europe during the past few years... GP is full of shit.
    - pokot0 3y ago
      Sure. The nightmare is that every single time you open the browser on a website you have to go through the data tracking preference for that website. It's a lot of work to avoid being tracked (companies are obviously using dark patterns there) and when you do it 20 times a day it gets frustrating quickly and collectively a big waste of human time. Now I am not saying the US doesn't have a problem. They just don't have GDPR and most website don't ask you for any permission to track you. So the experience is generally smoother (with the occasional tracking popup). Ideally there should be a way for me to broadcast my willingness to share my data and not allow dark patterns to try to change my opinion. But the GDPR does not cover that and allows websites to drive you crazy until you click "YES, Track me"
      - tremon 3y ago
        I think your problem is that you're accessing US websites from Europe, since those are what you know. European websites are a lot less annoying, they actually care about the customer base here.
      - denton-scratch 3y ago
        > every single time you open the browser on a website you have to go through the data tracking preference for that website This is not my experience. Perhaps the websites you favour are exceptionally abusive. > a way for me to broadcast my willingness to share my data That's the opposite of what most people want to broadcast. > But the GDPR does not cover that and allows websites to drive you crazy Apparently your view is that GDPR should not allow that, i.e. it isn't strict enough. I'm inclined to agree.
miracle2k 3y ago
> On this issue in the group that complain about the cookie law there are some people who are very wrong on purpose because it's in their interest, and some people who are very wrong because they genuinely don't understand the position they're defending, complaining about being made aware of the fee, instead of the fees themselves or the fact that the companies hide them if not forced by law. The reality is that I (and others who are complaining, as well as many who have resigned themselves to their fate) are happy to have a website "track me", certainly if the cost of non-tracking are having to click away an annoying popup, and think that people who compare a website wanting to know the number of their visitors to "hidden fees" are kind of being ridiculous.
- catapart 3y ago
  This is addressed in the article. They could track you, with your consent, in many different ways. The fact that they are choosing to force this cost upon you is what is ridiculous.
- nolok 3y ago
  > The reality is that I (and others who are complaining, as well as many who have resigned themselves to their fate) are happy to have a website "track me", certainly if the cost of non-tracking are having to click away an annoying popup The you should doubly blame the companies, because that's what do not track was for, they're the one who decided to make it not work that way and instead being ignored and not considered a valid option for the law. > think that people who compare a website wanting to know the number of their visitors to "hidden fees" are kind of being ridiculous. You don't need a cookie for that, and what GDPR has told us is that we're not talking of that but about dozens or hundreds on every major sites so trying to frame it that way is disingenuous.
- isodev 3y ago
  "Number of visitors" does not constitute tracking. The tracking in question here is to discover who you are specifically and the absurd amount of detail about your online activities collected and shared with data brokers for aggregation and resale. A few of these cookie prompts during the day and they'd be able to tell everything from where your kids go to school to the kind of prn you prefer to watch on weekdays and everything in between.
roenxi 3y ago
Hidden fees are bad because of the specific combination - the hiding, and the fees. Since tracking isn't hidden and isn't a fee, the analogy doesn't help to justify the EUs law. People should have a default expectation that if they give their personal data to companies then it will be recorded. And if they don't want cookies then they should disable cookies. The EU's regulation hasn't revealed anything that is useful to know about.
- paulryanrogers 3y ago
  Tracking is certainly hidden if you're not a programmer, and is certainly a fee if you value your time. Not all people live in low-trust societies or desire to.
- AlexandrB 3y ago
  People don't "give" their information to trackers, it's collected without their knowledge. I don't think most people expect the kind of things trackers collect is being collected.
AlchemistCamp 3y ago
The "fee" isn't the cookie. It's the obnoxious popup.
CipherThrowaway 3y ago
Agree. How much corporate propaganda are people consuming that legislators are seen as wholly responsible for the bad behavior and malicious compliance actions of corporations? What does it say about the relationship between businesses and consumers that the first response to this bad behavior is to shout "look what you made them do!" Seemingly it is everyone's fault except the bad actors themselves.
- ragnese 3y ago
  It's so depressing. Many of the people who are pointing the finger at the regulators for the annoying cookie banners don't actually see the web site/app *as* a bad actor. The fact that they had been tracking tons of extra data via cookies without their consent or knowledge was totally fine to them as long as it wasn't inconveniencing them in any way. The cookie banner is an inconvenience to their mindless consumption, so NOW it's a problem and they just don't care what the solution actually is as long as the thing goes away. I've seen this attitude from tech people, too, so it's not just a matter of tech ignorance or illiteracy.
  - kortilla 3y ago
    > The cookie banner is an inconvenience to their mindless consumption, It’s an inconvenience to people who care about privacy and use browser configurations that don’t store state between visits. So now in an attempt to protect regular users, the law ended up hurting users that already cared. Additionally, the shadiest and incompetent sites still just track people with no cookie banner. So the law doesn’t really provide protection against uncooperative parties, whereas privacy technology does.
    - ragnese 3y ago
      > It’s an inconvenience to people who care about privacy and use browser configurations that don’t store state between visits. > > So now in an attempt to protect regular users, the law ended up hurting users that already cared. Fair point about the banners mostly "hurting" users who care about privacy (but, really though- how much does it really "hurt" you? I'm "hurt" more by the fact that I have to fold laundry several days a week). But, I take major issue with you saying that the LAW ended up hurting users. Companies are under no legal obligation to make those banners as obnoxious as they are or with so many dark patterns (I sometimes don't know if I'm even enabling or disabling tracking with the way they word it). That's squarely on the web site owners pulling that nonsense. > Additionally, the shadiest and incompetent sites still just track people with no cookie banner. So the law doesn’t really provide protection against uncooperative parties, whereas privacy technology does. I agree that the only/best way to protect yourself is via technology and not by relying on people obeying the law. However, if this is also an argument against having the law, it's an incredibly weak one. You can apply that logic to argue that NO laws are effective. People still murder even though it's illegal- must be a bad law, no?
clktmr 3y ago
I don't want to be tracked either. But if companies can play the law this easily, I think it's a pretty bad law.
- ragnese 3y ago
  Are we all such spoiled brats that some cookie banners interrupting our web browsing is all it takes for us to give up and call the malicious companies the winners and the law(s) trying to protect our privacy "bad"? We're a pathetic lot.
Aeolun 3y ago
I don’t think this is strictly accurate. There’s nothing about cookies themselves that makes them a problem. It’s the way they are used. Needing to inform people you are using cookies for sessions is like needing to inform people you are using a fork to eat. The problem is that some people are using the fork to stab people, so now we require everyone to say how they’re going to use it in advance. Instead of just prohibiting stabbing people.
- bazoom42 3y ago
  You don’t need to inform people you are using cookies. It is not about cookies.
  - vaylian 3y ago
    As long as those cookies are only used for making the core functionality of the website work (i.e. login sessions, user preferences)
  - nickpp 3y ago
    > You don’t need to inform people you are using cookies. Are you a lawyer? Are you willing to assume the liability I may incur if I follow your advice?
    - pas 3y ago
      """ Cookies that do not require consent [...] or authentication cookies (when users authenticate themselves on your web site to log in in order to check online services such as their bank account). """ https://europa.eu/youreurope/business/dealing-with-customers/data-protection/online-privacy/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers...
      - nickpp 3y ago
        Again: are you a lawyer?! If not, in what quality are you advising businesses how to implement such a dangerous law? Have you seen the magnitude of the potential punishment? Will you cover my fines if you're wrong?
foobarian 3y ago
The fees example is maybe apples to oranges. The fees are a problem because they subvert the pricing information signals needed for the free market. The problem is not the fact that they are charged, the problem is that they are not included in an upfront price display. Were they included in the total upfront price and never specified the users should not care - it's not their business how a company spends their money. But I suppose that was just an example you picked to illustrate the industry's malicious compliance, and not the main point, in which case fair enough. :-)
- ImPostingOnHN 3y ago
  The use of secret tracking also subverts the pricing signals needed for the free market. Users aren't informed that the website is subsidized by the sale of the users' information, much less the details of the arrangements and monetary amounts. If the total price of the website without the secret costs of tracking were presented upfront, it would be less of an issue.
AbrahamParangi 3y ago
This is a bad example because the market usually fixes this problem. The reason why the market doesn’t fix the cookie banner problem and the reason why this is bad law is because users defacto do not care, it is merely annoying. There’s a law in California that says that businesses which have chemicals that might cause cancer on the premises need to let people know. That’s great but the levels they set turn out to be lower than what you can feasibly test for and as a result all properties pretty much just put up the signs that say “there might be chemicals here”. The warning is useless and annoying because of market forces which is another way of saying the law incentivized the behavior that occurred.
- pornel 3y ago
  The market is working perfectly here, if you remember that users are not the customers. Users are the product sold to adtech, data brokers, law enforcement, etc. For data-harvesting companies users are like livestock, and nobody cares about livestock's opinion. It only matters how much value can be extracted from users, even if it's annoying, misleading, and relies on dark patterns.
  - sanderjd 3y ago
    Yes, but that "livestock" can vote with their feet. If people cared about this, it would be a good opportunity for new entrants to take market share from incumbents by not using tracking cookies and thus not needing to have the cookie banners. But (to the parent comment's point) that isn't happening because this is not a compelling feature to offer, because people do not care about this, no matter how much we want them to. I used to think this was just an education issue, that people just didn't understand the implications of privacy concerns on the web. But I no longer think this is the case. I think people do mostly understand, and just do not consider this a priority.
whazor 3y ago
Airbnb used to hide their total price until EU started requiring them to do so in 2019, whereas USA only had this requirement from December 2022.
c22 3y ago
Except you could always just "turn off fees" in the browser, so the whole conflict seems kind of superfluous.
- account42 3y ago
  Except you can't because the in-browser fees are only one of many possible fees you could be charged.
haitchfive 3y ago
I agree with almost everything you said, except for one thing: I don't believe the euphemism "hidden fees" helps to clarify the fact that these people are taking money away from people without their knowledge or explicit consent. We have other more precise words to describe that action. I asked ChatGPT what those could be, here's its answer: Q: What are some english words meaning "taking money away from people without their knowledge or explicit consent"? ChatGPT: There are several words and phrases in English that convey the idea of taking money away from people without their knowledge or explicit consent: Embezzlement: This refers to the act of dishonestly withholding assets for the purpose of theft. It often involves someone in a position of trust, such as an employee, misappropriating funds entrusted to them. Misappropriation: Similar to embezzlement, misappropriation involves taking something (usually money) for one's own use without permission or legal right, often in a breach of trust. Theft: Theft is the generic term for taking someone else's property without permission, including money. Fraud: Fraud involves intentional deception for personal gain, which can include financial deception or stealing. Swindling: This term implies deceitful behavior to cheat or defraud someone, often involving trickery or manipulation. Skimming: Skimming refers to the illegal practice of taking cash "off the top" of the proceeds of a business or other source of income without recording it. Extortion: While not always directly related to taking money without explicit consent, extortion involves obtaining money, property, or services from an individual or entity through coercion or threat. Pilfering: Pilfering involves stealing small amounts or petty theft, often done stealthily or without detection. Conning: This refers to the act of deceiving or tricking someone, often for financial gain, through manipulation or persuasion. Clandestine withdrawals: This phrase specifically refers to taking money from someone's account without their knowledge or consent, typically in a secretive or unauthorized manner.
- ImPostingOnHN 3y ago
  We here are all interested in hearing your thoughts, so please filter raw chatbot output through them, rather than pasting the output verbatim, which isn't value-added, and can even be negative value, given chatbots' penchant for hallucinating information.
rglullis 3y ago
> The law is updated to say you are not allowed to charge the user a fee unless you tell him in advance. Why not a real regulation then to get rid of hidden fees and heavy fines/jail time for companies that are found to be doing it? PG's argument (I hope) is that there is no point in talking about "regulation" and "customer protection" if companies STILL get away with their ridiculous and hostile practices. There is no customer benefit in having user data collection and tracking. Companies do it only to exploit you. Even the usual BS excuses ("oh, we need user data to customize the experience") could be done completely in-device. I don't want regulatory bodies to just give more hoops for other companies to jump. They will jump it anyway, because it is profitable to do so. What I want is for regulatory bodies to effectively stop predatory practices.
- danaris 3y ago
  I mean, that would be great, but I suspect that even just here on HN you'd get a lot of people strongly disagreeing with you. Because that would infringe upon the companies' "freedom" to profit in whatever way they see fit—and the people's "freedom" to let their data be vacuumed up and sold for massive profits.
  - rglullis 3y ago
    Whether they agree or not is irrelevant. I think that PG's argument is that all the "regulation" and "strength of the EU" amounts to nothing. It's just people pretending to play power games, doing privacy theater and solving absolutely zero problems.
    - paulmd 3y ago
      have him register a new, anonymous HN account and go say that in one of our weekly "apple bad" threads
      - rglullis 3y ago
        Two wrongs don't make a right. Apple is bad and the EU bureaucracy is ineffective.
onel 3y ago
I think this is a good analogy and I agree that the intent of the law was not to force websites to have a cookie banner, it was just the side effect. What I think we are missing is a browser option/API that lets the user choose the acceptable tracking level. Similar to the do not track header but more fine grained. As we are missing that, extensions are doing a good job ATM https://chromewebstore.google.com/detail/consent-o-matic/mdjildafknihdffpkfmmpnpoiajfjnjd?pli=1 https://chromewebstore.google.com/detail/consent-o-matic/mdj... https://addons.mozilla.org/ro/firefox/addon/consent-o-matic/ https://addons.mozilla.org/ro/firefox/addon/consent-o-matic/ I found pretty late about Consent-o matic and it saved me a ton of time handling banners. It's exactly what we should have built-in the browser.
- bmicraft 3y ago
  We have that, it's called DNT. Unfortunately companies argue that: - it's not really a user choice when some browsers set it by default and therefore ignore it - it's set globally for a browser but a user might want to give away their privacy to my specific site ... and show the banner anyway
soerxpso 3y ago
The flaw in your analogy is that the modal consumer cares about hidden fees, wants to be made aware of them, and might even make a different decision with that knowledge. The modal consumer does not care about cookies. Imagine you walk into a restaurant and they hand you a paper that details full allergy information for all of the foods they serve, and then they wait for you to say, "I consent to these ingredients being in the food," before they can seat you. I think that's a closer analogy. We can all agree that the restaurant shouldn't hide that information from you, and that some minority of people might want the information, but do we really have to add this inconvenient step to the process for all people? The current real-world system, where allergy information is available upon request, was working fine. There are some things that everyone cares about and would be appalled by, that businesses should have to inform people about, and many things that a small minority of people care about. Why stop at cookies? Maybe we should mandate a popup if the website's server infrastructure was manufactured abroad, and another popup if the company that runs the website has higher than average carbon emissions, and another popup if the food in the food court that serves the headquarters of the company that runs the website is not kosher. The lobby of people who care about cookies is of similar size to the lobby of people who care deeply about binary size and about running JavaScript. Should there be mandatory popups to execute JavaScript? If the website is >10MB, should I have to consent on a lightweight page before downloading it? How do you determine which activities warrant a popup warning and which do not?
- mafuy 3y ago
  I am not allergic, then I do not need to know about it and I will suffer no damages from not caring. This is not the case for tracking. Tracking can hurt you.

by nolok 3y ago

aurareturn 3y ago

Using your analogy, I think what ends up happening is that even companies that don't collect hidden fees will put up a banner just in case. Not only that, I'm not an EU citizen and I'm not browsing websites based in EU but I'm still bombarded with cookie banners non-stop.

piva00 3y ago
> Not only that, I'm not an EU citizen and I'm not browsing websites based in EU but I'm still bombarded with cookie banners non-stop. Again, that's the fault of the companies putting those up, they could make it opt-in to collect your data, they could just put a small notice on the footer with 2 simples links "Accept all/Reject all". But they chose, they decided to pester you with those banners as annoyingly as possible to make you have exactly the reaction you're having.
- aurareturn 3y ago
  The fact that companies are doing that says more about the bad law than the companies which is exactly Paul Graham's point.
  - bananapub 3y ago
    what a ridiculous point of view. do you think the same thing about laws against murder? about fraud?
    - card_zero 3y ago
      I've got to admit, I'm unclear what the equivalent of a cookie banner for murder would be. This criminal uses murder! If you continue to interact, you consent to being murdered. Murders you anyway
  - paulryanrogers 3y ago
    Or it says more about the manipulative intentions of the companies than anything about a good law.
  - piva00 3y ago
    What exactly is bad about the law that allows companies to do the annoying cookie banner?
  - kibwen 3y ago
    [flagged]
    - throw10920 3y ago
      > Please stop defending the behavior of shitty companies. At the very least, I hope you're getting paid for these comments. Please don't do this on HN.
  - layer8 3y ago
    The law is pretty crystal clear. In many cases the issue is that websites are outsourcing their tracking to ad companies, which in turn apply those banners indiscriminately because that's in their interest. That being said, all the dark-pattern banners actually break the law. The problem, if anything, is lack of enforcement of the law.
nolok 3y ago
For your first point I disagree, my companies don't track and we don't have banner cookies. On your second point, that is again a choice of said companies, not a problem with the law. The GDPR has proven very well that if they cared, they can segment who is affected or not, and not just big tech lots of random local news site and the likes are doing it just fine. So again, you're aiming at the wrong culprit.
gizmo 3y ago
Do you have /any/ examples of websites that don't have a bunch of 3rd party cookies that still have a cookie banner? Middle managers absolutely love anything with charts and graphs because it makes their decisions feel more scientific. That's why they want tracking software included on their websites. And if the law requires disclosure then a cookie popup is the solution.
- PennRobotics 3y ago
  It only took two minutes to find at https://www.schwarzkuenstler.com/ https://www.schwarzkuenstler.com/ and I'm sure I can find a dozen more in half an hour. Germany is a bit litigious w.r.t. internet or privacy, so the combination---cookie consent---is a doozy. Nearly every German website that does anything will have a consent notification, and the slightest misstep (e.g. using Google Fonts without asking permission) can be punishable.
  - gizmo 3y ago
    Their privacy policy states they use Google reCAPTCHA, which requires disclosure.
    - PennRobotics 3y ago
      True, I hadn't noticed that at first glance, and I didn't see that as a third-party cookie in my site data. Nonetheless, I regularly see cookie warnings on sites with purely first-party cookies or even "just" session storage. (Mostly, I have been alert to this for the past year as I've started making non-personal web sites in Europe.)
- maccard 3y ago
  My company recently announced a game, and we launched a website for the game. There's no ̶t̶h̶i̶r̶d̶ ̶p̶a̶r̶t̶y̶ e:tracking cookies (I didn't make the site, but I do run it). Our US based legal team told us we needed a cookie banner if we were going to have visitors in the EU. I pushed back, but I lost, and ultimately it's not my fight.
pokot0 3y ago
Just been in Europe last week (I live in US): you have no idea what a nightmare internet is in Europe. You are only seeing a side effect here.
- denton-scratch 3y ago
  > what a nightmare internet is in Europe I live in Europe; I don't experience this "nightmare". Would you care to expand?
  - yau8edq12i 3y ago
    As someone who's lived in both the US and Europe during the past few years... GP is full of shit.
  - pokot0 3y ago
    Sure. The nightmare is that every single time you open the browser on a website you have to go through the data tracking preference for that website. It's a lot of work to avoid being tracked (companies are obviously using dark patterns there) and when you do it 20 times a day it gets frustrating quickly and collectively a big waste of human time. Now I am not saying the US doesn't have a problem. They just don't have GDPR and most website don't ask you for any permission to track you. So the experience is generally smoother (with the occasional tracking popup). Ideally there should be a way for me to broadcast my willingness to share my data and not allow dark patterns to try to change my opinion. But the GDPR does not cover that and allows websites to drive you crazy until you click "YES, Track me"
    - tremon 3y ago
      I think your problem is that you're accessing US websites from Europe, since those are what you know. European websites are a lot less annoying, they actually care about the customer base here.
    - denton-scratch 3y ago
      > every single time you open the browser on a website you have to go through the data tracking preference for that website This is not my experience. Perhaps the websites you favour are exceptionally abusive. > a way for me to broadcast my willingness to share my data That's the opposite of what most people want to broadcast. > But the GDPR does not cover that and allows websites to drive you crazy Apparently your view is that GDPR should not allow that, i.e. it isn't strict enough. I'm inclined to agree.

miracle2k 3y ago

> On this issue in the group that complain about the cookie law there are some people who are very wrong on purpose because it's in their interest, and some people who are very wrong because they genuinely don't understand the position they're defending, complaining about being made aware of the fee, instead of the fees themselves or the fact that the companies hide them if not forced by law. The reality is that I (and others who are complaining, as well as many who have resigned themselves to their fate) are happy to have a website "track me", certainly if the cost of non-tracking are having to click away an annoying popup, and think that people who compare a website wanting to know the number of their visitors to "hidden fees" are kind of being ridiculous.

catapart 3y ago
This is addressed in the article. They could track you, with your consent, in many different ways. The fact that they are choosing to force this cost upon you is what is ridiculous.
nolok 3y ago
> The reality is that I (and others who are complaining, as well as many who have resigned themselves to their fate) are happy to have a website "track me", certainly if the cost of non-tracking are having to click away an annoying popup The you should doubly blame the companies, because that's what do not track was for, they're the one who decided to make it not work that way and instead being ignored and not considered a valid option for the law. > think that people who compare a website wanting to know the number of their visitors to "hidden fees" are kind of being ridiculous. You don't need a cookie for that, and what GDPR has told us is that we're not talking of that but about dozens or hundreds on every major sites so trying to frame it that way is disingenuous.
isodev 3y ago
"Number of visitors" does not constitute tracking. The tracking in question here is to discover who you are specifically and the absurd amount of detail about your online activities collected and shared with data brokers for aggregation and resale. A few of these cookie prompts during the day and they'd be able to tell everything from where your kids go to school to the kind of prn you prefer to watch on weekdays and everything in between.

roenxi 3y ago

Hidden fees are bad because of the specific combination - the hiding, and the fees. Since tracking isn't hidden and isn't a fee, the analogy doesn't help to justify the EUs law. People should have a default expectation that if they give their personal data to companies then it will be recorded. And if they don't want cookies then they should disable cookies. The EU's regulation hasn't revealed anything that is useful to know about.

paulryanrogers 3y ago
Tracking is certainly hidden if you're not a programmer, and is certainly a fee if you value your time. Not all people live in low-trust societies or desire to.
AlexandrB 3y ago
People don't "give" their information to trackers, it's collected without their knowledge. I don't think most people expect the kind of things trackers collect is being collected.

AlchemistCamp 3y ago

The "fee" isn't the cookie. It's the obnoxious popup.

CipherThrowaway 3y ago

Agree. How much corporate propaganda are people consuming that legislators are seen as wholly responsible for the bad behavior and malicious compliance actions of corporations? What does it say about the relationship between businesses and consumers that the first response to this bad behavior is to shout "look what you made them do!" Seemingly it is everyone's fault except the bad actors themselves.

ragnese 3y ago
It's so depressing. Many of the people who are pointing the finger at the regulators for the annoying cookie banners don't actually see the web site/app *as* a bad actor. The fact that they had been tracking tons of extra data via cookies without their consent or knowledge was totally fine to them as long as it wasn't inconveniencing them in any way. The cookie banner is an inconvenience to their mindless consumption, so NOW it's a problem and they just don't care what the solution actually is as long as the thing goes away. I've seen this attitude from tech people, too, so it's not just a matter of tech ignorance or illiteracy.
- kortilla 3y ago
  > The cookie banner is an inconvenience to their mindless consumption, It’s an inconvenience to people who care about privacy and use browser configurations that don’t store state between visits. So now in an attempt to protect regular users, the law ended up hurting users that already cared. Additionally, the shadiest and incompetent sites still just track people with no cookie banner. So the law doesn’t really provide protection against uncooperative parties, whereas privacy technology does.
  - ragnese 3y ago
    > It’s an inconvenience to people who care about privacy and use browser configurations that don’t store state between visits. > > So now in an attempt to protect regular users, the law ended up hurting users that already cared. Fair point about the banners mostly "hurting" users who care about privacy (but, really though- how much does it really "hurt" you? I'm "hurt" more by the fact that I have to fold laundry several days a week). But, I take major issue with you saying that the LAW ended up hurting users. Companies are under no legal obligation to make those banners as obnoxious as they are or with so many dark patterns (I sometimes don't know if I'm even enabling or disabling tracking with the way they word it). That's squarely on the web site owners pulling that nonsense. > Additionally, the shadiest and incompetent sites still just track people with no cookie banner. So the law doesn’t really provide protection against uncooperative parties, whereas privacy technology does. I agree that the only/best way to protect yourself is via technology and not by relying on people obeying the law. However, if this is also an argument against having the law, it's an incredibly weak one. You can apply that logic to argue that NO laws are effective. People still murder even though it's illegal- must be a bad law, no?

clktmr 3y ago

I don't want to be tracked either. But if companies can play the law this easily, I think it's a pretty bad law.

ragnese 3y ago
Are we all such spoiled brats that some cookie banners interrupting our web browsing is all it takes for us to give up and call the malicious companies the winners and the law(s) trying to protect our privacy "bad"? We're a pathetic lot.

Aeolun 3y ago

I don’t think this is strictly accurate. There’s nothing about cookies themselves that makes them a problem. It’s the way they are used. Needing to inform people you are using cookies for sessions is like needing to inform people you are using a fork to eat. The problem is that some people are using the fork to stab people, so now we require everyone to say how they’re going to use it in advance. Instead of just prohibiting stabbing people.

bazoom42 3y ago
You don’t need to inform people you are using cookies. It is not about cookies.
- vaylian 3y ago
  As long as those cookies are only used for making the core functionality of the website work (i.e. login sessions, user preferences)
- nickpp 3y ago
  > You don’t need to inform people you are using cookies. Are you a lawyer? Are you willing to assume the liability I may incur if I follow your advice?
  - pas 3y ago
    """ Cookies that do not require consent [...] or authentication cookies (when users authenticate themselves on your web site to log in in order to check online services such as their bank account). """ https://europa.eu/youreurope/business/dealing-with-customers/data-protection/online-privacy/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers...
    - nickpp 3y ago
      Again: are you a lawyer?! If not, in what quality are you advising businesses how to implement such a dangerous law? Have you seen the magnitude of the potential punishment? Will you cover my fines if you're wrong?

foobarian 3y ago

The fees example is maybe apples to oranges. The fees are a problem because they subvert the pricing information signals needed for the free market. The problem is not the fact that they are charged, the problem is that they are not included in an upfront price display. Were they included in the total upfront price and never specified the users should not care - it's not their business how a company spends their money. But I suppose that was just an example you picked to illustrate the industry's malicious compliance, and not the main point, in which case fair enough. :-)

ImPostingOnHN 3y ago
The use of secret tracking also subverts the pricing signals needed for the free market. Users aren't informed that the website is subsidized by the sale of the users' information, much less the details of the arrangements and monetary amounts. If the total price of the website without the secret costs of tracking were presented upfront, it would be less of an issue.

AbrahamParangi 3y ago

This is a bad example because the market usually fixes this problem. The reason why the market doesn’t fix the cookie banner problem and the reason why this is bad law is because users defacto do not care, it is merely annoying. There’s a law in California that says that businesses which have chemicals that might cause cancer on the premises need to let people know. That’s great but the levels they set turn out to be lower than what you can feasibly test for and as a result all properties pretty much just put up the signs that say “there might be chemicals here”. The warning is useless and annoying because of market forces which is another way of saying the law incentivized the behavior that occurred.

pornel 3y ago
The market is working perfectly here, if you remember that users are not the customers. Users are the product sold to adtech, data brokers, law enforcement, etc. For data-harvesting companies users are like livestock, and nobody cares about livestock's opinion. It only matters how much value can be extracted from users, even if it's annoying, misleading, and relies on dark patterns.
- sanderjd 3y ago
  Yes, but that "livestock" can vote with their feet. If people cared about this, it would be a good opportunity for new entrants to take market share from incumbents by not using tracking cookies and thus not needing to have the cookie banners. But (to the parent comment's point) that isn't happening because this is not a compelling feature to offer, because people do not care about this, no matter how much we want them to. I used to think this was just an education issue, that people just didn't understand the implications of privacy concerns on the web. But I no longer think this is the case. I think people do mostly understand, and just do not consider this a priority.

whazor 3y ago

Airbnb used to hide their total price until EU started requiring them to do so in 2019, whereas USA only had this requirement from December 2022.

c22 3y ago

Except you could always just "turn off fees" in the browser, so the whole conflict seems kind of superfluous.

account42 3y ago
Except you can't because the in-browser fees are only one of many possible fees you could be charged.

haitchfive 3y ago

I agree with almost everything you said, except for one thing: I don't believe the euphemism "hidden fees" helps to clarify the fact that these people are taking money away from people without their knowledge or explicit consent. We have other more precise words to describe that action. I asked ChatGPT what those could be, here's its answer: Q: What are some english words meaning "taking money away from people without their knowledge or explicit consent"? ChatGPT: There are several words and phrases in English that convey the idea of taking money away from people without their knowledge or explicit consent: Embezzlement: This refers to the act of dishonestly withholding assets for the purpose of theft. It often involves someone in a position of trust, such as an employee, misappropriating funds entrusted to them. Misappropriation: Similar to embezzlement, misappropriation involves taking something (usually money) for one's own use without permission or legal right, often in a breach of trust. Theft: Theft is the generic term for taking someone else's property without permission, including money. Fraud: Fraud involves intentional deception for personal gain, which can include financial deception or stealing. Swindling: This term implies deceitful behavior to cheat or defraud someone, often involving trickery or manipulation. Skimming: Skimming refers to the illegal practice of taking cash "off the top" of the proceeds of a business or other source of income without recording it. Extortion: While not always directly related to taking money without explicit consent, extortion involves obtaining money, property, or services from an individual or entity through coercion or threat. Pilfering: Pilfering involves stealing small amounts or petty theft, often done stealthily or without detection. Conning: This refers to the act of deceiving or tricking someone, often for financial gain, through manipulation or persuasion. Clandestine withdrawals: This phrase specifically refers to taking money from someone's account without their knowledge or consent, typically in a secretive or unauthorized manner.

ImPostingOnHN 3y ago
We here are all interested in hearing your thoughts, so please filter raw chatbot output through them, rather than pasting the output verbatim, which isn't value-added, and can even be negative value, given chatbots' penchant for hallucinating information.

rglullis 3y ago

> The law is updated to say you are not allowed to charge the user a fee unless you tell him in advance. Why not a real regulation then to get rid of hidden fees and heavy fines/jail time for companies that are found to be doing it? PG's argument (I hope) is that there is no point in talking about "regulation" and "customer protection" if companies STILL get away with their ridiculous and hostile practices. There is no customer benefit in having user data collection and tracking. Companies do it only to exploit you. Even the usual BS excuses ("oh, we need user data to customize the experience") could be done completely in-device. I don't want regulatory bodies to just give more hoops for other companies to jump. They will jump it anyway, because it is profitable to do so. What I want is for regulatory bodies to effectively stop predatory practices.

danaris 3y ago
I mean, that would be great, but I suspect that even just here on HN you'd get a lot of people strongly disagreeing with you. Because that would infringe upon the companies' "freedom" to profit in whatever way they see fit—and the people's "freedom" to let their data be vacuumed up and sold for massive profits.
- rglullis 3y ago
  Whether they agree or not is irrelevant. I think that PG's argument is that all the "regulation" and "strength of the EU" amounts to nothing. It's just people pretending to play power games, doing privacy theater and solving absolutely zero problems.
  - paulmd 3y ago
    have him register a new, anonymous HN account and go say that in one of our weekly "apple bad" threads
    - rglullis 3y ago
      Two wrongs don't make a right. Apple is bad and the EU bureaucracy is ineffective.

onel 3y ago

I think this is a good analogy and I agree that the intent of the law was not to force websites to have a cookie banner, it was just the side effect. What I think we are missing is a browser option/API that lets the user choose the acceptable tracking level. Similar to the do not track header but more fine grained. As we are missing that, extensions are doing a good job ATM https://chromewebstore.google.com/detail/consent-o-matic/mdjildafknihdffpkfmmpnpoiajfjnjd?pli=1 https://chromewebstore.google.com/detail/consent-o-matic/mdj... https://addons.mozilla.org/ro/firefox/addon/consent-o-matic/ https://addons.mozilla.org/ro/firefox/addon/consent-o-matic/ I found pretty late about Consent-o matic and it saved me a ton of time handling banners. It's exactly what we should have built-in the browser.

bmicraft 3y ago
We have that, it's called DNT. Unfortunately companies argue that: - it's not really a user choice when some browsers set it by default and therefore ignore it - it's set globally for a browser but a user might want to give away their privacy to my specific site ... and show the banner anyway

soerxpso 3y ago

The flaw in your analogy is that the modal consumer cares about hidden fees, wants to be made aware of them, and might even make a different decision with that knowledge. The modal consumer does not care about cookies. Imagine you walk into a restaurant and they hand you a paper that details full allergy information for all of the foods they serve, and then they wait for you to say, "I consent to these ingredients being in the food," before they can seat you. I think that's a closer analogy. We can all agree that the restaurant shouldn't hide that information from you, and that some minority of people might want the information, but do we really have to add this inconvenient step to the process for all people? The current real-world system, where allergy information is available upon request, was working fine. There are some things that everyone cares about and would be appalled by, that businesses should have to inform people about, and many things that a small minority of people care about. Why stop at cookies? Maybe we should mandate a popup if the website's server infrastructure was manufactured abroad, and another popup if the company that runs the website has higher than average carbon emissions, and another popup if the food in the food court that serves the headquarters of the company that runs the website is not kosher. The lobby of people who care about cookies is of similar size to the lobby of people who care deeply about binary size and about running JavaScript. Should there be mandatory popups to execute JavaScript? If the website is >10MB, should I have to consent on a lightweight page before downloading it? How do you determine which activities warrant a popup warning and which do not?

mafuy 3y ago
I am not allergic, then I do not need to know about it and I will suffer no damages from not caring. This is not the case for tracking. Tracking can hurt you.