9 ms·

> often it violates the gdpr If this is true, why hasn't there been a huge fine against Google for it? At this point, the net of GDPR is so wide as to be usel

by throwaway2037 2y ago

> often it violates the gdpr If this is true, why hasn't there been a huge fine against Google for it? At this point, the net of GDPR is so wide as to be useless to me. If I see one more fucking cookie disclaimer, I will snap. Is this really making us "safer" or "more secure/private"? I doubt it, but lots of small software consultancies in the EU made a bundle charging everyone to upgrade their websites to make them GDPR-compliant!

colimbarna 2y ago
Cookie disclaimers are not GDPR. They're also completely optional; you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Businesses make choices not to do that and we've become stuck at a local suboptimum.
- anonzzzies 2y ago
  It depends what you store and what you use it for if it touches the gdpr. You can run entire SaaS products profitably (as we do) without gdpr violations while having no cookie or consent banners. Just don't track users or store information you do not strictly need for your saas. Sure there are many more considerations, but this is a basic consideration.
- wizzwizz4 2y ago
  > you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Strictly-speaking, notification before cookies are set is required by the 2002 ePrivacy directive (article 5(3)), which includes cookies (and related technologies) under the banner of the 1995 Data Privacy Directive (later superseded by the GDPR). The intent of the ePrivacy law is clearly not "have a banner that yells about cookies". The intent is that you only set cookies when someone, say, clicks on the Dark Mode toggle, or does something else that sets a cookie, and that when they do that, they know the data privacy implications. Traditional uses of cookies aren't affected: "Add to basket? (this uses cookies: learn more)" isn't that onerous, nor annoying. It's a pain for our dark mode toggle, but the law was written back in the day, when the expectation was that we could actually customise our user agents.
anonzzzies 2y ago
As many have said here, this should be arranged at the browser level. But personally, I hate the disclaimer and having to wade through the options (although the reject all becomes more common, at least on serious sites), but I do like that now I see who is tracking and not allow it while still seeing a functioning site. And although I am from the EU, my company is not, but I still have to comply with EU rules. Our product has no cookie or consent banners as I choose to make sure we comply and not have tracking products (or collect anything not needed for the functioning of the site) at all on our sites; this is sometimes a little bit more work but I believe the world is better for it. You don't need to track your users and you definitely don't need to pass that valuable data to Google (or CLOUD act; the US gov etc etc) for free so they can make money with your clients.
- Nextgrid 2y ago
  Pushing for things to be handled at the browser level is a fundamental misunderstanding of the GDPR. Browser-based identifiers such as cookies are only a very small part of it. Furthermore, tracking goes way beyond just cookies, and is done with things like IP address/user-agent tracking and browser fingerprinting - neither requires the cooperation of your browser, it can't do anything about it. If you're talking about codifying the various data processing categories and let the browser communicate that via a header, it's already been tried with Do-Not-Track and was either 1) ignored, or 2) used as one extra part of the browser fingerprint. The root cause is that there's an entire industry of parasites that make their money on breaching the GDPR and have no incentive to implement it. GDPR enforcement itself being lax means that they can get away with such non-compliant implementations. If the GDPR is ever enforced properly, the problem would quickly resolve. The consent flows would first become compliant, and a few months later would be removed entirely along with all the tracking because the opt-in rates are so low that it's pointless to have it. But this would also spell doom for a huge industry of scum, so expect hard pushback at every step.
  - anonzzzies 2y ago
    The browser would work if enforced. So not very different from not enforcing gdpr in it's current form. And I am not only talking about cookies; I am talking about that the browser should convey what I want instead of me clicking on buttons every site I get to. But yes, if not enforced, the scum will win anyway.

colimbarna 2y ago

Cookie disclaimers are not GDPR. They're also completely optional; you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Businesses make choices not to do that and we've become stuck at a local suboptimum.

anonzzzies 2y ago
It depends what you store and what you use it for if it touches the gdpr. You can run entire SaaS products profitably (as we do) without gdpr violations while having no cookie or consent banners. Just don't track users or store information you do not strictly need for your saas. Sure there are many more considerations, but this is a basic consideration.
wizzwizz4 2y ago
> you can have a fully functional modern website that stores state in cookies and not put in a cookie banner. Strictly-speaking, notification before cookies are set is required by the 2002 ePrivacy directive (article 5(3)), which includes cookies (and related technologies) under the banner of the 1995 Data Privacy Directive (later superseded by the GDPR). The intent of the ePrivacy law is clearly not "have a banner that yells about cookies". The intent is that you only set cookies when someone, say, clicks on the Dark Mode toggle, or does something else that sets a cookie, and that when they do that, they know the data privacy implications. Traditional uses of cookies aren't affected: "Add to basket? (this uses cookies: learn more)" isn't that onerous, nor annoying. It's a pain for our dark mode toggle, but the law was written back in the day, when the expectation was that we could actually customise our user agents.

anonzzzies 2y ago

As many have said here, this should be arranged at the browser level. But personally, I hate the disclaimer and having to wade through the options (although the reject all becomes more common, at least on serious sites), but I do like that now I see who is tracking and not allow it while still seeing a functioning site. And although I am from the EU, my company is not, but I still have to comply with EU rules. Our product has no cookie or consent banners as I choose to make sure we comply and not have tracking products (or collect anything not needed for the functioning of the site) at all on our sites; this is sometimes a little bit more work but I believe the world is better for it. You don't need to track your users and you definitely don't need to pass that valuable data to Google (or CLOUD act; the US gov etc etc) for free so they can make money with your clients.

Nextgrid 2y ago
Pushing for things to be handled at the browser level is a fundamental misunderstanding of the GDPR. Browser-based identifiers such as cookies are only a very small part of it. Furthermore, tracking goes way beyond just cookies, and is done with things like IP address/user-agent tracking and browser fingerprinting - neither requires the cooperation of your browser, it can't do anything about it. If you're talking about codifying the various data processing categories and let the browser communicate that via a header, it's already been tried with Do-Not-Track and was either 1) ignored, or 2) used as one extra part of the browser fingerprint. The root cause is that there's an entire industry of parasites that make their money on breaching the GDPR and have no incentive to implement it. GDPR enforcement itself being lax means that they can get away with such non-compliant implementations. If the GDPR is ever enforced properly, the problem would quickly resolve. The consent flows would first become compliant, and a few months later would be removed entirely along with all the tracking because the opt-in rates are so low that it's pointless to have it. But this would also spell doom for a huge industry of scum, so expect hard pushback at every step.
- anonzzzies 2y ago
  The browser would work if enforced. So not very different from not enforcing gdpr in it's current form. And I am not only talking about cookies; I am talking about that the browser should convey what I want instead of me clicking on buttons every site I get to. But yes, if not enforced, the scum will win anyway.