4 ms·

Do you have /any/ examples of websites that don't have a bunch of 3rd party cookies that still have a cookie banner? Middle managers absolutely love anything w

by gizmo 3y ago

Do you have /any/ examples of websites that don't have a bunch of 3rd party cookies that still have a cookie banner? Middle managers absolutely love anything with charts and graphs because it makes their decisions feel more scientific. That's why they want tracking software included on their websites. And if the law requires disclosure then a cookie popup is the solution.

PennRobotics 3y ago
It only took two minutes to find at https://www.schwarzkuenstler.com/ https://www.schwarzkuenstler.com/ and I'm sure I can find a dozen more in half an hour. Germany is a bit litigious w.r.t. internet or privacy, so the combination---cookie consent---is a doozy. Nearly every German website that does anything will have a consent notification, and the slightest misstep (e.g. using Google Fonts without asking permission) can be punishable.
- gizmo 3y ago
  Their privacy policy states they use Google reCAPTCHA, which requires disclosure.
  - PennRobotics 3y ago
    True, I hadn't noticed that at first glance, and I didn't see that as a third-party cookie in my site data. Nonetheless, I regularly see cookie warnings on sites with purely first-party cookies or even "just" session storage. (Mostly, I have been alert to this for the past year as I've started making non-personal web sites in Europe.)
maccard 3y ago
My company recently announced a game, and we launched a website for the game. There's no ̶t̶h̶i̶r̶d̶ ̶p̶a̶r̶t̶y̶ e:tracking cookies (I didn't make the site, but I do run it). Our US based legal team told us we needed a cookie banner if we were going to have visitors in the EU. I pushed back, but I lost, and ultimately it's not my fight.
- almostnormal 3y ago
  It is not about third party or not, but what it is used for. Consent may be required even if there are no cookies at all.
  - maccard 3y ago
    > It is not about third party or not you're right, I said third party, but I actually meant tracking. I actually went and checked, and our only cookie is the cookie for if you've seen the cookie banner or not... > Consent may be required even if there are no cookies at all. For what?
    - akvadrako 3y ago
      It's not about cookies. Tracking without cookies also requires consent.
      - maccard 3y ago
        See my original post. Our US legal team said that we need the banner if we have visitors from the EU, not if we're tracking them.
        astura 3y ago
        >Our US legal team said that we need the banner if we have visitors from the EU, not if we're tracking them. This actually makes sense - because if you didn't have the cookie banner then some fucking weirdo would come to Hacker News and make a self righteous post about how you're "tracking residents of the EU without their consent and abusing them" (even though you're not). Instant karma. Next thing you know these weirdos and their mob are reporting you to their government and you're dealing with government inquiries and more legal expenses trying to prove your cookie-less web 1.0 site doesn't "abuse people." The banner placates them.
        bmicraft 3y ago
rcxdude 3y ago
I think a heck of a lot of smaller sites just cargo-cult the pop-up. Either because they misunderstand the law or because of overly cautious lawyers.
- account42 3y ago
  Or because of FUD from people interested in undermining privacy protections.
jlokier 3y ago
Aggregate data is not considered personal data by the GDPR. Managers and everyone else can have charts and graphs without retaining personal data. The processing of personal data prior to anonymisation to turn it into aggregate data, that part needs protection. But you can do it in a variety of ways that don't require personally invasive tracking.

by gizmo 3y ago

PennRobotics 3y ago

It only took two minutes to find at https://www.schwarzkuenstler.com/ https://www.schwarzkuenstler.com/ and I'm sure I can find a dozen more in half an hour. Germany is a bit litigious w.r.t. internet or privacy, so the combination---cookie consent---is a doozy. Nearly every German website that does anything will have a consent notification, and the slightest misstep (e.g. using Google Fonts without asking permission) can be punishable.

gizmo 3y ago
Their privacy policy states they use Google reCAPTCHA, which requires disclosure.
- PennRobotics 3y ago
  True, I hadn't noticed that at first glance, and I didn't see that as a third-party cookie in my site data. Nonetheless, I regularly see cookie warnings on sites with purely first-party cookies or even "just" session storage. (Mostly, I have been alert to this for the past year as I've started making non-personal web sites in Europe.)

maccard 3y ago

My company recently announced a game, and we launched a website for the game. There's no ̶t̶h̶i̶r̶d̶ ̶p̶a̶r̶t̶y̶ e:tracking cookies (I didn't make the site, but I do run it). Our US based legal team told us we needed a cookie banner if we were going to have visitors in the EU. I pushed back, but I lost, and ultimately it's not my fight.

almostnormal 3y ago
It is not about third party or not, but what it is used for. Consent may be required even if there are no cookies at all.
- maccard 3y ago
  > It is not about third party or not you're right, I said third party, but I actually meant tracking. I actually went and checked, and our only cookie is the cookie for if you've seen the cookie banner or not... > Consent may be required even if there are no cookies at all. For what?
  - akvadrako 3y ago
    It's not about cookies. Tracking without cookies also requires consent.
    - maccard 3y ago
      See my original post. Our US legal team said that we need the banner if we have visitors from the EU, not if we're tracking them.
      - astura 3y ago
        >Our US legal team said that we need the banner if we have visitors from the EU, not if we're tracking them. This actually makes sense - because if you didn't have the cookie banner then some fucking weirdo would come to Hacker News and make a self righteous post about how you're "tracking residents of the EU without their consent and abusing them" (even though you're not). Instant karma. Next thing you know these weirdos and their mob are reporting you to their government and you're dealing with government inquiries and more legal expenses trying to prove your cookie-less web 1.0 site doesn't "abuse people." The banner placates them.
        bmicraft 3y ago

rcxdude 3y ago

I think a heck of a lot of smaller sites just cargo-cult the pop-up. Either because they misunderstand the law or because of overly cautious lawyers.

account42 3y ago
Or because of FUD from people interested in undermining privacy protections.

jlokier 3y ago

Aggregate data is not considered personal data by the GDPR. Managers and everyone else can have charts and graphs without retaining personal data. The processing of personal data prior to anonymisation to turn it into aggregate data, that part needs protection. But you can do it in a variety of ways that don't require personally invasive tracking.