11 ms·

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have just been a browser setting that had to be respected and this whole thing would have been completely transparent to the end user and they would have benefitted by default. Instead through incompetent government employees we now have cookie banners for the rest of eternity on almost every site and they're not even standardized so worst sites like where journalists publish can have more and more obtuse ones.

poszlem 3y ago
This is 100% what PG means IMO and the most sane take on this. Either write the law correctly so it's not easily bypassed or just don't touch anything because you will only make it worse.
- piva00 3y ago
  The law is not bypassed, the annoying banners with no simple option to reject are illegal. The issue is that enforcement is slow, not that the law is badly written. GDPR's Article 7 [0] is very clear: > 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. [emphasis mine] [0] https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
  - throw10920 3y ago
    > The issue is that enforcement is slow, not that the law is badly written. The enforcement/implementation of a law is so deeply entwined with the text that it's deceptive to separate them. If a law is written in a way so as to make enforcement hard, or if the government doesn't have the resources to quickly and consistently apply it, then it's a bad law because it enables weaponized targeted/selective enforcement of a new law that wasn't present before.
    - foldr 3y ago
      Essentially all laws are difficult to enforce. If someone really won't follow the law, then it takes a lot of time and money to prosecute them. Society relies on most people voluntarily following most laws most of the time.
    - popcorncowboy 3y ago
      [flagged]
      - throw10920 3y ago
        I'm very clearly not conflating the legislature and judiciary, as evidenced by the fact that I differentiated between them in my comment. > a lack of resourcing to quickly enforce laws makes those laws bad Is true, and you haven't refuted it, only used the emotionally manipulative phrase "bad faith argument".
        popcorncowboy 3y ago
        Your entire argument is conflation. You literally say it's "deceptive to separate them". The whole POINT of modern governance is to separate them. Saying legislature is writing "bad laws" because the judiciary may or may not have the resources to enforce is to necessarily subjugate the legislature to the judiciary which violates the principles of separation in the first place. There are countless examples of legislation that does not get litigated due to political or other pressures on the judiciary. Your argument would require that the legislature lie down in those cases. Perhaps that is your preferred order of the world. But in a modern, principled government, the entire principle is their separation and independence. Suggesting otherwise is to lean into autocracy, whatever your motives.
        throw10920 3y ago
        > The whole POINT of modern governance is to separate them This is wildly incorrect. The point is not separation - that is obviously stupid and pointless. The point is maintaining checks and balances on the power of the government, and one of the (many) mechanisms is through separation. > Saying legislature is writing "bad laws" because the judiciary may or may not have the resources to enforce is to necessarily subjugate the legislature to the judiciary which violates the principles of separation in the first place. Again, incorrect, because the principle is limiting power, not separation of powers test for its own sake. Not passing laws that can't be correctly enforced is not a violation of that goal or the strategy of separation of powers. > There are countless examples of legislation that does not get litigated due to political or other pressures on the judiciary. Your argument would require that the legislature lie down in those cases. Nowhere did I say that or does my argument imply or necessitate that. Being unable to enforce a law due to lack of resources is categorically different than political pressure. You're intentionally misinterpreting my words > But in a modern, principled government, the entire principle is their separation and independence. This is your own projection of what a "modern", "principled" government should look like - which, as stated before, is obviously stupid and pointless. Separation is not a virtue - it's a means to an end. You may want to consider reading the US Constitution to see this in action.
  - demurgos 3y ago
    Thank you for mentioning point 7.3 this as it's a very important, but gets often ignored. I hope that it gets strictly enforced. _It shall be as easy to withdraw as to give consent._ Regarding the link you posted, they have a banner at the bottom saying: > We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it. [Ok] [No] [Privacy Policy] My understanding was that such an implicit consent ("we will assume that you are happy with it") is not legal so I find it a bit surprising to see it used on a website dedicated to the GDPR.
  - zalyalov 3y ago
    Yes, that very much is an example of the law being badly written. "Prior to giving consent, the data subject shall be informed thereof." Means there must be some sort of a cookie notification (which could of course take a small space of the screen, but still). The existence of this notification makes it easier to initially give consent. If withdrawing later is to be as easy, the notification must never disappear.
    - thomastjeffery 3y ago
      So you want users to be tracked without consent? I don't.
boxed 3y ago
The law isn't that bad actually, just that the courts have been very slow. The dark UI patterns are actually illegal and have been judged so in court now. This realization just has to trickle down to the companies writing these cookie banners.
- 63stack 3y ago
  * There was an option of making this non-intrusive, by requiring it to be a browser setting, they chose not to * The law went into effect ~6 years ago * Companies still break the law by employing dark patterns My take is that it makes both the law, and the courts bad.
  - toyg 3y ago
    Neither the law or the court can start any enforcement proceeding. Clearly, national prosecution authorities can't be arsed and we don't have enough citizen-activists filing strong lawsuits.
- ankit219 3y ago
  My take is that law tries to dictate UX more than just set groundrules which good laws do. They pre-emptively set the law such that it prevents any use when the focus is on misuse. The law is about 1st party and 3rd party cookies, not just 3rd party. In an ideal case, if it was just a law, a simpler wording could be "you are allowed to collect anonymized data, but not monetize/share it without permission from users. We may ask you to furnish proof that you havent been doing that at times, failing which you would face massive fines (as %age of revenue whatever)." Problem is collecting basic anonymized usage data[1] is needed by companies to improve the product, provide a better experience, detect misuse. They bundled those use cases with everything else meaning the law was too broad and we got cookie banners given every site needs basic analytics. On flipside, worst is that most websites use Google Analytics, so they might have had to display the banners anyway. [1] Moreover, it's vaguely worded so we companies do not know if they have committed a GDPR offence. By general understanding IP addresses are under GDPR. You can get that via request headers. So, to be on the safe side, even anonymized analytics tracking is considered under GDPR
cbeach 3y ago
Exactly this. The law could have been written in such a way that we could use a browser setting and avoid incessent popups which irritate users and desensitise them to genuinely useful warnings. Whatever the good intentions of EU lawmakers, they seem inept at technical legislation because they ALLOW companies to continue doing shady things, and rather than tackle it, the legislators create a law that merely annoys users.
- madsbuch 3y ago
  it would be horrible regulation if you tell how to comply instead of telling what to comply with. as written elsewhere (since you obviously didn't read anything) your proposed solution would be just fine. But people opted out of impmenting it that way since it would yield less profit.
  - cbeach 3y ago
    Show me the section of the ePrivacy Directive (Directive 2002/58/EC) or GDPR that implies the "Do Not Track" browser setting can override the need for consent banners / popups.
    - layer8 3y ago
      DNT wouldn't work, but a hypothetical "yes, please feel free to track me" setting would, if standardized by browser vendors and implemented appropriately (i.e. ensuring user consent).
    - madsbuch 3y ago
      well, if you respect the do not track setting and therefore DO NOT TRACK, then just remove the banner. You have not obligation to tell people that you do not track because you do not track.
      - SpicyLemonZest 3y ago
        Are you 100% confident that you don’t do anything which could be construed as tracking by a hostile regulator? Even the official EU sites that host the relevant regulations have cookie banners, explaining (https://eur-lex.europa.eu/content/legal-notice/legal-notice.html?locale=en#5.%20Cookies%20notice https://eur-lex.europa.eu/content/legal-notice/legal-notice....) that they can’t otherwise do basic analytics or interface persistence.
exitb 3y ago
It would be 100% ok for it to be a browser setting. It isn't though, because that would make too many people opt out. That's what the article is about.
- foldr 3y ago
  I don't think a browser setting would make any difference. The setting would have to be either "I don't want to be tracked by anyone ever" or "I'm ok with being tracked by everyone all the time". Everyone would just choose the first setting. But just because someone has that setting doesn't mean you can't ask them specifically if they're ok with being tracked on your specific website for some specific purpose. So then you're back at the cookie banners. (Also, if a lot of people did choose the 'everyone all the time' setting, that would arguably be a poor outcome, because it's unlikely that this is really what people want.)
  - thomastjeffery 3y ago
    > The setting would have to be either "I don't want to be tracked by anyone ever" or "I'm ok with being tracked by everyone all the time". The only alternative to that binary logic is cookie banners. So to be clear, you are advocating for cookie banners. The reality is that the overwhelming majority of people do legitimately want option 1, which makes cookie banners redundant. The only reason that cookie banners exist is as a high pressure sales tactic to sell users into option 3.
    - foldr 3y ago
      The point is that you'd still get cookie banners even with option 1, because a site can always ask you if you're willing to override your default preference.
      - exitb 3y ago
        It could work like popup permissions - unobtrusive notification you ignore unless you're specifically looking for it.
littlestymaar 3y ago
That's what you get when you try to protect consumer but “don't want to harm business” who are hurting consumers. Sometimes life really is is fact a zero sum game and you need to punish the offenders in order to protect the victims.
thinkingtoilet 3y ago
There is no loophole here. If you want to track someone, you need their consent. How are cookie banners a "loophole"? >Instead through incompetent government employees Or greedy companies, one of the two...
threemux 3y ago
As far as I can tell, politicians don't spend much if any time thinking about second and third order consequences. GDPR is but one example, but instances of this abound. The default should be to mistrust new laws. Reagan takes lots of flak on the internet, but he was right on the scariest phrase being "I'm from the government, and I'm here to help". Even worse, this thread is full of armchair lawyers that will confidently tell you there's no need for cookie banners in particular cases. Nevermind that there's hardly any case law about this and each country seems to interpret it differently. Any actual lawyer would tell you to slap it on there to stay protected.
- K0nserv 3y ago
  > Even worse, this thread is full of armchair lawyers that will confidently tell you there's no need for cookie banners in particular cases. Nevermind that there's hardly any case law about this and each country seems to interpret it differently. Any actual lawyer would tell you to slap it on there to stay protected. I bet the number of cases of illegal implementations due to insufficient consent are vastly smaller than the blatantly illegal consent implementations(i.e. those that make it harder to reject consent than accept it). Companies clearly don't care about following the law anyway.
  - oneeyedpigeon 3y ago
    > Any actual lawyer would tell you to slap it on there to stay protected. Presumably, lawyers err on the side of caution? That doesn't mean they're right.
    - K0nserv 3y ago
      I'd think so too, but the number of implementations that use dark patterns that make it more difficult to reject consent than accept it seems to indicate they aren't erring on the side of caution. I'm not talking just de-emphasising the reject option here, but cases where there is no reject option or it's buried beneath 2-3 more clicks.
- _v7gu 3y ago
K0nserv 3y ago
I wrote something elsewhere in the thread about this[0]. I don't think laws mandating specifics of implementations at the level of browser settings is a good idea. To your point about government employees not being competent I don't trust them to get that right. Companies could work with browser makers to fix this but, as the OP points out, they don't want to. In my opinion the EU's big failure with GDPR has been slow and ineffective enforcement against blatantly illegal implementations. 0: https://news.ycombinator.com/item?id=39742989 https://news.ycombinator.com/item?id=39742989
PinguTS 3y ago
The law does not require a specific implementation. Law is never written to require a specific implementation and should not be written in this way. Instead law is written in a technology neutral way. It is so neutral that it isn't even called "cookie law". It is called ePrivacy directive. It has only 5 times the mention of "cookie" as an example. Reference: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002L0058 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A...
shafyy 3y ago
> If the cookie law was written properly then it would have just been a browser setting that had to be respected and this whole thing would have been completely transparent to the end user and they would have benefitted by default. The law does not mandate websites to display a cookie banner. There are already "Do not track" settings in browsers. A website could choose to honor that setting and don't track you without ever showing you a cookie banner. But most don't.
- raydev 3y ago
  But the websites are still putting up banners in my way, and they never remember what I consent to anyway, they just ask every time. They didn't do this before the regulation. It doesn't much matter whether a website could do better, they simply aren't going to do better unless forced to. > A website could choose to honor that setting and don't track you without ever showing you a cookie banner. But most don't. Exactly! Either fix the regulation to say they can't make UX worse or throw it away.
  - shafyy 3y ago
    > They didn't do this before the regulation Yes, because they just tracked you and you didn't have a choice and didn't even know that they were tracking you probably. You don't seem to understand what GDPR does. Very simply, it says: "Hey, if you run a website and want to store cookies in your visitors browsers that helps you track them, you need to ask them first if that's ok". There are multiple paths websites could take: 1) Don't set tracking cookies -> No need to ask the visitor for consent 2) Honor "do not track" headers sent by browsers -> Only need to ask visitor for consent if the browser didn't set "do not track" header 3) Ask the visitors, but do it in a nice way that doesn't disrupt the whole browsing experience -> some examples are given in the blog post There are a lot of browser extension that hide or click reject cookies for you, so you don't need to see 99% of all cookie banners. Have you tried using some of them?
viraptor 3y ago
> but leaves a loophole There's no loophole. There's just limited enforcement. Most of the banners you see every day do not match the requirements at all.
xjay 3y ago
The problem is that we as a society constantly have to deal with adult children, so don't expect reason. Do expect elaborate rationalizations intended to waste the energy of an indecisive parent, who is basically getting bullied by a kid throwing a tantrum. This kind of behavior reminds me of the book: "Language vs. Reality: Why Language Is Good for Lawyers and Bad for Scientists" - Nick Enfield, Linguistic Anthropologist [1] [1] https://mitpress.mit.edu/9780262548465/language-vs-reality/ https://mitpress.mit.edu/9780262548465/language-vs-reality/
stetrain 3y ago
> Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. We deal with similar issues developing and releasing software. Instead of not ever releasing software, or only writing perfect software that never has issues, we have a couple of options. 1) In critical life or death situations, spend a ton of time modeling all states of the system and program in a way that very strictly controls for these states, with a lot of testing. See NASA/JPL coding standards for critical systems. 2) For less critical situations, or those were modeling all states of the system are impractical, we release, observe, and iterate. Yes there will be edge cases, bugs, and loopholes. But we can observe them, iterate, and release updates. I think case 1) is impractical for changes to large legal and economic frameworks in the real world given how many variables are at play. If we could model the entire economy and see how it would react to a given change, the world would be a very different place in lots of ways already. A lot of politics seems to work against 2) and that hurts our ability to improve things. "I will pass a law that does X" and "I will repeal the law Y that is not working, see look at these loopholes!" are good political campaign statements. "I will gather and analyze data on the operation of the current system and support an iterative change that intends to improve things, implement that change, and then observe the results to determine if future changes are needed" is hard to rally around either in campaigning or when actually doing the work of getting political support to pass law. I think decent example of this in government, although far from perfect, is the feedback loop of the NTSB and FAA. The NTSB's job is to observe and report on failures of air safety, and the FAA's job is to apply those lessons to future air regulation. Of course there are many examples of this not working perfectly, but it's a more concrete feedback loop than most governmental action has. More observation of the analysis of the impact of laws after they are passed, and follow-up iterations where we compare the expected and actual results and make updates, would probably result in a lot less gnashing of teeth over "bad government regulation" but I'm not sure how we get there politically.
pornel 3y ago
There has been a browser setting for tracking cookies since 2002! https://www.w3.org/P3P/ https://www.w3.org/P3P/ It has even been implemented in Internet Explorer when it had 90%+ market share. And then Google intentionally sent malformed P3P header to bypass user preferences in IE. When Safari added a heuristic rejecting Google's 3rd party cookies, Google has found a technical workaround to bypass it (and has been fined for doing this). When IE and P3P were totally dead, browsers have tried to give adtech the simplest to implement bare minimum setting - the DNT header. The adtech has completely ignored it. There are trillion-dollar businesses relying on tracking, and they will do whatever they can to undermine any technology and lobby against any law that would harm their business.

poszlem 3y ago

This is 100% what PG means IMO and the most sane take on this. Either write the law correctly so it's not easily bypassed or just don't touch anything because you will only make it worse.

piva00 3y ago
The law is not bypassed, the annoying banners with no simple option to reject are illegal. The issue is that enforcement is slow, not that the law is badly written. GDPR's Article 7 [0] is very clear: > 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. [emphasis mine] [0] https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
- throw10920 3y ago
  > The issue is that enforcement is slow, not that the law is badly written. The enforcement/implementation of a law is so deeply entwined with the text that it's deceptive to separate them. If a law is written in a way so as to make enforcement hard, or if the government doesn't have the resources to quickly and consistently apply it, then it's a bad law because it enables weaponized targeted/selective enforcement of a new law that wasn't present before.
  - foldr 3y ago
    Essentially all laws are difficult to enforce. If someone really won't follow the law, then it takes a lot of time and money to prosecute them. Society relies on most people voluntarily following most laws most of the time.
  - popcorncowboy 3y ago
    [flagged]
    - throw10920 3y ago
      I'm very clearly not conflating the legislature and judiciary, as evidenced by the fact that I differentiated between them in my comment. > a lack of resourcing to quickly enforce laws makes those laws bad Is true, and you haven't refuted it, only used the emotionally manipulative phrase "bad faith argument".
      - popcorncowboy 3y ago
        Your entire argument is conflation. You literally say it's "deceptive to separate them". The whole POINT of modern governance is to separate them. Saying legislature is writing "bad laws" because the judiciary may or may not have the resources to enforce is to necessarily subjugate the legislature to the judiciary which violates the principles of separation in the first place. There are countless examples of legislation that does not get litigated due to political or other pressures on the judiciary. Your argument would require that the legislature lie down in those cases. Perhaps that is your preferred order of the world. But in a modern, principled government, the entire principle is their separation and independence. Suggesting otherwise is to lean into autocracy, whatever your motives.
        throw10920 3y ago
        > The whole POINT of modern governance is to separate them This is wildly incorrect. The point is not separation - that is obviously stupid and pointless. The point is maintaining checks and balances on the power of the government, and one of the (many) mechanisms is through separation. > Saying legislature is writing "bad laws" because the judiciary may or may not have the resources to enforce is to necessarily subjugate the legislature to the judiciary which violates the principles of separation in the first place. Again, incorrect, because the principle is limiting power, not separation of powers test for its own sake. Not passing laws that can't be correctly enforced is not a violation of that goal or the strategy of separation of powers. > There are countless examples of legislation that does not get litigated due to political or other pressures on the judiciary. Your argument would require that the legislature lie down in those cases. Nowhere did I say that or does my argument imply or necessitate that. Being unable to enforce a law due to lack of resources is categorically different than political pressure. You're intentionally misinterpreting my words > But in a modern, principled government, the entire principle is their separation and independence. This is your own projection of what a "modern", "principled" government should look like - which, as stated before, is obviously stupid and pointless. Separation is not a virtue - it's a means to an end. You may want to consider reading the US Constitution to see this in action.
- demurgos 3y ago
  Thank you for mentioning point 7.3 this as it's a very important, but gets often ignored. I hope that it gets strictly enforced. _It shall be as easy to withdraw as to give consent._ Regarding the link you posted, they have a banner at the bottom saying: > We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it. [Ok] [No] [Privacy Policy] My understanding was that such an implicit consent ("we will assume that you are happy with it") is not legal so I find it a bit surprising to see it used on a website dedicated to the GDPR.
- zalyalov 3y ago
  Yes, that very much is an example of the law being badly written. "Prior to giving consent, the data subject shall be informed thereof." Means there must be some sort of a cookie notification (which could of course take a small space of the screen, but still). The existence of this notification makes it easier to initially give consent. If withdrawing later is to be as easy, the notification must never disappear.
  - thomastjeffery 3y ago
    So you want users to be tracked without consent? I don't.

boxed 3y ago

The law isn't that bad actually, just that the courts have been very slow. The dark UI patterns are actually illegal and have been judged so in court now. This realization just has to trickle down to the companies writing these cookie banners.

63stack 3y ago
* There was an option of making this non-intrusive, by requiring it to be a browser setting, they chose not to * The law went into effect ~6 years ago * Companies still break the law by employing dark patterns My take is that it makes both the law, and the courts bad.
- toyg 3y ago
  Neither the law or the court can start any enforcement proceeding. Clearly, national prosecution authorities can't be arsed and we don't have enough citizen-activists filing strong lawsuits.
ankit219 3y ago
My take is that law tries to dictate UX more than just set groundrules which good laws do. They pre-emptively set the law such that it prevents any use when the focus is on misuse. The law is about 1st party and 3rd party cookies, not just 3rd party. In an ideal case, if it was just a law, a simpler wording could be "you are allowed to collect anonymized data, but not monetize/share it without permission from users. We may ask you to furnish proof that you havent been doing that at times, failing which you would face massive fines (as %age of revenue whatever)." Problem is collecting basic anonymized usage data[1] is needed by companies to improve the product, provide a better experience, detect misuse. They bundled those use cases with everything else meaning the law was too broad and we got cookie banners given every site needs basic analytics. On flipside, worst is that most websites use Google Analytics, so they might have had to display the banners anyway. [1] Moreover, it's vaguely worded so we companies do not know if they have committed a GDPR offence. By general understanding IP addresses are under GDPR. You can get that via request headers. So, to be on the safe side, even anonymized analytics tracking is considered under GDPR

cbeach 3y ago

Exactly this. The law could have been written in such a way that we could use a browser setting and avoid incessent popups which irritate users and desensitise them to genuinely useful warnings. Whatever the good intentions of EU lawmakers, they seem inept at technical legislation because they ALLOW companies to continue doing shady things, and rather than tackle it, the legislators create a law that merely annoys users.

madsbuch 3y ago
it would be horrible regulation if you tell how to comply instead of telling what to comply with. as written elsewhere (since you obviously didn't read anything) your proposed solution would be just fine. But people opted out of impmenting it that way since it would yield less profit.
- cbeach 3y ago
  Show me the section of the ePrivacy Directive (Directive 2002/58/EC) or GDPR that implies the "Do Not Track" browser setting can override the need for consent banners / popups.
  - layer8 3y ago
    DNT wouldn't work, but a hypothetical "yes, please feel free to track me" setting would, if standardized by browser vendors and implemented appropriately (i.e. ensuring user consent).
  - madsbuch 3y ago
    well, if you respect the do not track setting and therefore DO NOT TRACK, then just remove the banner. You have not obligation to tell people that you do not track because you do not track.
    - SpicyLemonZest 3y ago
      Are you 100% confident that you don’t do anything which could be construed as tracking by a hostile regulator? Even the official EU sites that host the relevant regulations have cookie banners, explaining (https://eur-lex.europa.eu/content/legal-notice/legal-notice.html?locale=en#5.%20Cookies%20notice https://eur-lex.europa.eu/content/legal-notice/legal-notice....) that they can’t otherwise do basic analytics or interface persistence.

exitb 3y ago

It would be 100% ok for it to be a browser setting. It isn't though, because that would make too many people opt out. That's what the article is about.

foldr 3y ago
I don't think a browser setting would make any difference. The setting would have to be either "I don't want to be tracked by anyone ever" or "I'm ok with being tracked by everyone all the time". Everyone would just choose the first setting. But just because someone has that setting doesn't mean you can't ask them specifically if they're ok with being tracked on your specific website for some specific purpose. So then you're back at the cookie banners. (Also, if a lot of people did choose the 'everyone all the time' setting, that would arguably be a poor outcome, because it's unlikely that this is really what people want.)
- thomastjeffery 3y ago
  > The setting would have to be either "I don't want to be tracked by anyone ever" or "I'm ok with being tracked by everyone all the time". The only alternative to that binary logic is cookie banners. So to be clear, you are advocating for cookie banners. The reality is that the overwhelming majority of people do legitimately want option 1, which makes cookie banners redundant. The only reason that cookie banners exist is as a high pressure sales tactic to sell users into option 3.
  - foldr 3y ago
    The point is that you'd still get cookie banners even with option 1, because a site can always ask you if you're willing to override your default preference.
    - exitb 3y ago
      It could work like popup permissions - unobtrusive notification you ignore unless you're specifically looking for it.

littlestymaar 3y ago

That's what you get when you try to protect consumer but “don't want to harm business” who are hurting consumers. Sometimes life really is is fact a zero sum game and you need to punish the offenders in order to protect the victims.

thinkingtoilet 3y ago

There is no loophole here. If you want to track someone, you need their consent. How are cookie banners a "loophole"? >Instead through incompetent government employees Or greedy companies, one of the two...

threemux 3y ago

As far as I can tell, politicians don't spend much if any time thinking about second and third order consequences. GDPR is but one example, but instances of this abound. The default should be to mistrust new laws. Reagan takes lots of flak on the internet, but he was right on the scariest phrase being "I'm from the government, and I'm here to help". Even worse, this thread is full of armchair lawyers that will confidently tell you there's no need for cookie banners in particular cases. Nevermind that there's hardly any case law about this and each country seems to interpret it differently. Any actual lawyer would tell you to slap it on there to stay protected.

K0nserv 3y ago
> Even worse, this thread is full of armchair lawyers that will confidently tell you there's no need for cookie banners in particular cases. Nevermind that there's hardly any case law about this and each country seems to interpret it differently. Any actual lawyer would tell you to slap it on there to stay protected. I bet the number of cases of illegal implementations due to insufficient consent are vastly smaller than the blatantly illegal consent implementations(i.e. those that make it harder to reject consent than accept it). Companies clearly don't care about following the law anyway.
- oneeyedpigeon 3y ago
  > Any actual lawyer would tell you to slap it on there to stay protected. Presumably, lawyers err on the side of caution? That doesn't mean they're right.
  - K0nserv 3y ago
    I'd think so too, but the number of implementations that use dark patterns that make it more difficult to reject consent than accept it seems to indicate they aren't erring on the side of caution. I'm not talking just de-emphasising the reject option here, but cases where there is no reject option or it's buried beneath 2-3 more clicks.
_v7gu 3y ago

K0nserv 3y ago

I wrote something elsewhere in the thread about this[0]. I don't think laws mandating specifics of implementations at the level of browser settings is a good idea. To your point about government employees not being competent I don't trust them to get that right. Companies could work with browser makers to fix this but, as the OP points out, they don't want to. In my opinion the EU's big failure with GDPR has been slow and ineffective enforcement against blatantly illegal implementations. 0: https://news.ycombinator.com/item?id=39742989 https://news.ycombinator.com/item?id=39742989

PinguTS 3y ago

The law does not require a specific implementation. Law is never written to require a specific implementation and should not be written in this way. Instead law is written in a technology neutral way. It is so neutral that it isn't even called "cookie law". It is called ePrivacy directive. It has only 5 times the mention of "cookie" as an example. Reference: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002L0058 https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A...

shafyy 3y ago

> If the cookie law was written properly then it would have just been a browser setting that had to be respected and this whole thing would have been completely transparent to the end user and they would have benefitted by default. The law does not mandate websites to display a cookie banner. There are already "Do not track" settings in browsers. A website could choose to honor that setting and don't track you without ever showing you a cookie banner. But most don't.

raydev 3y ago
But the websites are still putting up banners in my way, and they never remember what I consent to anyway, they just ask every time. They didn't do this before the regulation. It doesn't much matter whether a website could do better, they simply aren't going to do better unless forced to. > A website could choose to honor that setting and don't track you without ever showing you a cookie banner. But most don't. Exactly! Either fix the regulation to say they can't make UX worse or throw it away.
- shafyy 3y ago
  > They didn't do this before the regulation Yes, because they just tracked you and you didn't have a choice and didn't even know that they were tracking you probably. You don't seem to understand what GDPR does. Very simply, it says: "Hey, if you run a website and want to store cookies in your visitors browsers that helps you track them, you need to ask them first if that's ok". There are multiple paths websites could take: 1) Don't set tracking cookies -> No need to ask the visitor for consent 2) Honor "do not track" headers sent by browsers -> Only need to ask visitor for consent if the browser didn't set "do not track" header 3) Ask the visitors, but do it in a nice way that doesn't disrupt the whole browsing experience -> some examples are given in the blog post There are a lot of browser extension that hide or click reject cookies for you, so you don't need to see 99% of all cookie banners. Have you tried using some of them?

viraptor 3y ago

> but leaves a loophole There's no loophole. There's just limited enforcement. Most of the banners you see every day do not match the requirements at all.

xjay 3y ago

The problem is that we as a society constantly have to deal with adult children, so don't expect reason. Do expect elaborate rationalizations intended to waste the energy of an indecisive parent, who is basically getting bullied by a kid throwing a tantrum. This kind of behavior reminds me of the book: "Language vs. Reality: Why Language Is Good for Lawyers and Bad for Scientists" - Nick Enfield, Linguistic Anthropologist [1] [1] https://mitpress.mit.edu/9780262548465/language-vs-reality/ https://mitpress.mit.edu/9780262548465/language-vs-reality/

stetrain 3y ago

> Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. We deal with similar issues developing and releasing software. Instead of not ever releasing software, or only writing perfect software that never has issues, we have a couple of options. 1) In critical life or death situations, spend a ton of time modeling all states of the system and program in a way that very strictly controls for these states, with a lot of testing. See NASA/JPL coding standards for critical systems. 2) For less critical situations, or those were modeling all states of the system are impractical, we release, observe, and iterate. Yes there will be edge cases, bugs, and loopholes. But we can observe them, iterate, and release updates. I think case 1) is impractical for changes to large legal and economic frameworks in the real world given how many variables are at play. If we could model the entire economy and see how it would react to a given change, the world would be a very different place in lots of ways already. A lot of politics seems to work against 2) and that hurts our ability to improve things. "I will pass a law that does X" and "I will repeal the law Y that is not working, see look at these loopholes!" are good political campaign statements. "I will gather and analyze data on the operation of the current system and support an iterative change that intends to improve things, implement that change, and then observe the results to determine if future changes are needed" is hard to rally around either in campaigning or when actually doing the work of getting political support to pass law. I think decent example of this in government, although far from perfect, is the feedback loop of the NTSB and FAA. The NTSB's job is to observe and report on failures of air safety, and the FAA's job is to apply those lessons to future air regulation. Of course there are many examples of this not working perfectly, but it's a more concrete feedback loop than most governmental action has. More observation of the analysis of the impact of laws after they are passed, and follow-up iterations where we compare the expected and actual results and make updates, would probably result in a lot less gnashing of teeth over "bad government regulation" but I'm not sure how we get there politically.

pornel 3y ago

There has been a browser setting for tracking cookies since 2002! https://www.w3.org/P3P/ https://www.w3.org/P3P/ It has even been implemented in Internet Explorer when it had 90%+ market share. And then Google intentionally sent malformed P3P header to bypass user preferences in IE. When Safari added a heuristic rejecting Google's 3rd party cookies, Google has found a technical workaround to bypass it (and has been fined for doing this). When IE and P3P were totally dead, browsers have tried to give adtech the simplest to implement bare minimum setting - the DNT header. The adtech has completely ignored it. There are trillion-dollar businesses relying on tracking, and they will do whatever they can to undermine any technology and lobby against any law that would harm their business.