11 ms·

Please stop putting cookie pop-ups on your website (2022)

peter_d_sherman 2y ago
>"Almost every major website you visit today pops up a banner to warn you that it uses “cookies.” This is not legally required in the U.S. or in most places, and where it is, the vast majority of sites do not comply with legal requirements."
- Moldoteck 2y ago
  afaik gdpr is valid for eu citizens that are in other countries too, including us. US ofc wouldn't do a thing, but EU can act on your business in their land. That's why cookies are everywhere - websites can't know if you are eu citizen or not. Another problem is that - if you don't use cookies for ads/tracking, you don't need a banner but many websites are ignoring this Another problem - imo gdpr should have been adapted to enforce some http header with auto-response so that the banner wouldn't be needed
  - peter_d_sherman 2y ago
    >"That's why cookies are everywhere - websites can't know if you are eu citizen or not." An excellent point! Websites can't know if someone is a citizen of country X, country Y, country Z, or even no country (indigenous people, sovereigns, legal constructs, AI's, international groups/associations, companies domiciled in space, other actors/legal constructs, present and future, etc., etc.)! That is, they cannot know implicitly, without being explicitly given the appropriate information, if someone/something (non-human actors and/or legal reprentatives) accessing a website are citizens of a given country -- or not! Now websites can do what many courts do, rightly or wrongly, and that is to presume an arbitrary citizenship/jurisdiction for a given website visitor (or visiting actor -- whatever is on the other side of that HTTP/S request)... But will that be the correct presumption to make in all cases? Probably not! So perhaps the future needs a way for visitors to set in their browser (or by some other mechanism!) -- their citizenship and/or jurisdiction! Of course, then we'd get into some weird scenarios like "what if website X in country Y decides to decline people who have set their browser to "I'm a citizen of country Z" -- sort of like the equivalent of a limiting country's physical immigration policy -- but for HTTP/S requests... If the HTTP/S requests are not in the citizenship/jurisdiction of a whitelist specified by each website, then, "no HTTP/S response for you!" (Sort of like the HTTP/S version of Seinfeld's Soup Nazi -- "No soup for you -- come back in 1 year!" :-)). Of course, the whole set of ideas I've outlined above, were they to come to fruition in the future -- sort of would violate the spirit of openness, trust, and good faith that was present in the early World Wide Web... Remember that the early World Wide Web was built in such a way that all HTTP requests were answered with no need to provide a password or other credentials, no need to accept cookies (the early WWW / HTTP didn't have them!) and could be contrasted with FTP sites of the time which did require passwords (although many would be set to allow username "anonymous", password "anonymous" logins). That is, the early WWW / HTTP -- was a passwordless, cookieless, loginless, "just give me the information", information-passing protocol, which in its earliest incarnations served academics (no one else had access to the Internet at that time!) who only wanted to share academic infomation (papers and the like!) with other academics, regardless of their country, jurisdiction, or their acceptance or rejection of any potentially access-limiting and resource denying cookie! So, in conclusion, an excellent point!
mindwok 2y ago
Interesting article. This policy has felt like a complete failure, but I didn't know the depths of how badly it has failed. I would really like to see these die. Regulators should just work with browser vendors to make an API that I can set at the browser level, and websites just read that to know my preferences and leave me alone.
- sofixa 2y ago
  Your preferences should be on the website level though, not global. And you should be asked about it on first visiting the website. Let me explain why with an example: say you're the type of people who doesn't care about "privacy" online ("I've got nothing to hide"), or you do; and you want to "support " certain ad-supported websites you're a fan of; but not that new clickbait toilet paper your aunt sends you. I can't think of any way to have a good UX to opt in or out of "tracking" cookies which people would actually use (few will bother changing the defaults, and most mindlessly click ok).
  - awfulneutral 2y ago
    Why not do like with popups, and show a little toast with "x tracking cookies were blocked, click to allow"? Cookies could have to register whether they are essential or not. It's really wild how much work must have been created by distributing this problem to every website on earth instead of doing it in the browser.
    - Earw0rm 2y ago
      Because Chrome (Google) and a large chunk of the web media publishing ecosystem are hooked on this crap. It's a hundred billion dollar business. And yes, it's mostly selling garbage, but that's hardly unique in 21st century capitalism.
    - greyface- 2y ago
      Lynx, back in the day, forced you to explicitly accept/reject each cookie offered by the server while loading the page. Modern browsers silently accept them all by default. Browsers have regressed.
andreapaiola 2y ago
So... Abolish all the EULAs?
scarlehoff 2y ago
Please stop - selling our data to advertisers.
- o_m 2y ago
  For that to work users have to spend money on their services. I hope that will happen in the future, but until then it is hard to compete with free services that has ads.
  - troupo 2y ago
    You don't need invasive and pervasive tracking to display ads. Google became an ad behemoth with contextual ads
  - kalaksi 2y ago
    They probably still track you even if you paid money, so that makes paying less enticing. And it's prudent to assume so unless they clearly state otherwise
    - Ferret7446 2y ago
      That's because you're not paying enough. If you pay enough, you absolutely can get non-tracking products. Of course, people either aren't willing or can't. Them's the breaks.
      - latexr 2y ago
        The overwhelming majority of ad-supported services do not offer ad-free and surveillance-free alternatives. Heck, even plans literally named “no ads” can still show you ads. https://help.hulu.com/article/hulu-ads-no-commercials https://help.hulu.com/article/hulu-ads-no-commercials
      - kalaksi 2y ago
        You don't know what I'd pay. So can you name any popular services that offer that option? To add, there are estimations about how much ad money average user generates and it's very much affordable
dehrmann 2y ago
The larger lesson here is this is what happens when governments try to regulate things they don't understand. Cookie popups just add friction, and it's not clear consumers see any real privacy benefit. What's even worse is people seem to not care that the policy isn't working, but they aren't telling lawmakers to fix it.
- sofixa 2y ago
  The lawmakers regulated that a website should warn you, and then upgraded to ask for your consent, before collecting and storing privately identifiable information about you. The regulation doesn't mention cookie popups. The easiest way to comply is to not collect nor store any such information.
  - ipv6ipv4 2y ago
    > The regulation doesn't mention cookie popups. The easiest way to comply is to not collect nor store any such information. Utopia is just around the corner as long as everyone does exactly as I say rather than being driven by self interest.
    - ben_w 2y ago
      Governments don't think in terms of utopia, but the rest is literally what a government is: here are the rules, you will follow them or get punished. Relying on self-interest is Laissez-faire, that had the result of (1) the invention of communism and (2) basically ended even in the US with the Great Depression. Communism kinda had the same problem, as it made false assumptions about human nature and self-interest.
  - Earw0rm 2y ago
    How do you manage login sessions without? If you're a site that has even basic analytics reporting requirements, how do you do any of that without? "Don't do these things" is a decent option for sole traders, microbusiness and hobby website operators, but good luck selling that to anyone "in a suit" (more likely $500 jeans or chinos nowadays).
dusted 2y ago
The cookie policy is a stupid value-signalling stunt with only negative real-life effects. The correct way of handling the problem would have been through request headers and browser settings, or simply, use the existing option of either allowing or disallowing cookies, and put this option on a per-site basis and a bit more into the users face..
- szszrk 2y ago
  > only negative real-life effects Almost. It hardly worked as intended, but at least it increased awareness. The fact that some sites tried to comply and actually provided a full list of all sites that they sell your private data to is somewhat a win. It got to a lot of wider public that realized "they sell it to 97 companies?!". I personally think local governments or EU wide institutions should have a registry of companies and their sites with ratings, so we could integrate that directly in our browsers, company registries, phone dialer apps. iFixIt style. - Clarity of EULA: 1/10, impossible to understand without lawyer's interpretation. - Length of EULA: 1/10, pops up every week with no diff or summary of changes - Legality: 4/10, historical track record of rules that are not compliant with local laws of xxx - History: 1/10, no way to track what were the previous versions of the document or when they changed - ... EDIT: to give some context and prove it's possible to provide metrics to legal documents, in Poland we have a formal "Registry of Forbidden Clauses" with references to lost court cases: https://www.rejestr.uokik.gov.pl/ https://www.rejestr.uokik.gov.pl/
- yobbo 2y ago
  Besides cookies, there are tracking methods based on fingerprinting, IP and so on. None of them are permitted without explicit consent. This means that a site may not load resources from a third-party server without consent, since the request itself reveals enough information for fingerprinting and tracking. Tracking is plainly not permitted without consent.
  - imiric 2y ago
    > Tracking is plainly not permitted without consent. According to some poorly thought out law in certain territories, sure. In practice, however, there is no technical mechanism by which users, or anyone else for that matter, can detect whether they're being tracked or consent to it. There are browser extensions conscious users can install to block certain browser features, but these are not infallible, and they're constantly playing a cat and mouse game with trackers. The cookie policy only applies for cookies, not for general tracking. And even with it, companies loophole their way by claiming "legitimate interest". Many popular websites show cookie consent forms with upwards of a thousand of these companies, and deliberately use dark patterns to make it impossible to deny all of them. It's absolute insanity. But in general, cookies are a red herring. They're used as sacrificial offering aimed at governments and the public to show that a company really cares about user privacy by not using them. When in reality they've been relying on far more sophisticated tracking methods for many years which are technically impossible for the public to even comprehend. And let's not forget about the shady data broker market, where our data is perpetually transacted against our will or knowledge, let alone benefit. We need far more technical experts in governments to pass strict regulation against this nonsense, in a way that it actually benefits the public. But I'm not holding my breath that this will ever happen, considering the corporatocracy we're living in.
cbanek 2y ago
Also, for those of us with vision issues (or just want to zoom in a lot on a webpage), these popups look horrible at 150%-200%, and often get misrendered in strange ways, sometimes hiding the button. Then if you actually try to reject it, if you can, the rejecting or customizing page is nearly always broken when zoomed in.
literalAardvark 2y ago
This doesn't read quite right to me. Maybe I missed something. Under the GDPR sites are emphatically NOT allowed to deny service over rejecting cookies. Iirc the only valid options are providing a paid alternative or blocking service to the entire class of GDPR covered citizens.
- xaerise 2y ago
  That is not really GDPR. That is the ePrivacy ( ie. The Cookie Law from 2009 ) directive that supplements but sometimes overrules GDPR. https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ # Cookie compliance
- wkat4242 2y ago
  Even a paid alternative is very iffy. Some jurisdictions like Germany have allowed it after a court ruling but most have not. Meta is also getting flak from the EU for their "accept or pay" model.
TheRealPomax 2y ago
So, the problem with this is: the law. If you use session management: GOOD NEWS GDPR AND CPPA UNDER PENALTY OF THE COURTS DEMAND YOU INFORM USERS and if you know a better way than an intrusive "accept this before you can continue" by all means pipe up but the problem is overbearing laws, not "people following them". The law requires that you disallow access until people tell you their position on your handling of their personally identifiable information and welcome to modern web dev hell. If you don't like it, hell has done its job. Both Europe and California consider IP addresses PII and this is the result.
- nikanj 2y ago
  Session management does not require a cookie consent. Implementation-relevant technical cookies are exempt, it's the 337 different analytics services that sites use that require the cookie consent
- troupo 2y ago
  1. you don't need consent for functionality strictly required for the functionality of your product. Such as session management 2. You are allowed to legitimately process PII for legitimate purposes related to your business: e.g. combating fraud 3. What you emphatically aren't allowed without consent: collect vast amounts of data, store it indefinitely, and sell it to 15 000 third party "partners"
- Moldoteck 2y ago
  gdpr works a bit differently. You can use cookies for providing website operations, for it you don't even need a banner. You can't easily use cookies/trackers for ad purposes. You can still display ads but these shouldn't use cookies (this way again - no need for banner).
evdubs 2y ago
uBlock Origin has cookie notice filters. I don't think this is enabled by default; you can enable it in the Filter Lists section, along with "annoyances".
- Moru 2y ago
  And it works really well. Until it does not, and then you need to figure why the page isn't working for you but your neighbour has no problems. I still use it all the time though but there is some pages I won't bother with much. Probably better that way anyway :-)
  - wkat4242 2y ago
    Yes I prefer using the special EU cookie wall plugin. I forget the name right now, sorry. Ublock just blocks the popup which breaks some sites that don't work until you make a choice, which you can't because it's blocked. The other plugin answers it for you in the background with your chosen options.
fire_lake 2y ago
I love the “long press to preview” feature in mobile web browsers. But now all I get to preview is the cookie pop up! EU, pls fix.
planb 2y ago
Cookie banners are a great reason for expirations dates on new policies. If it works: Great, renew it! If it does not work, is not required anymore or was just plain stupid: Never talk about it again and it will run out. But who will actively admit that regulation failed and work to undo it?
- cornedor 2y ago
  Cookie banners is not a policy, it is used to work around a policy, and often implemented incorrectly. GPDR says you need to be given a specific informed decision, but often cookie banners show a big green approve button, and a less positive deny button (if that is even the case). When the law is being enforced better (Which is slowly happening) those cookie banners should get 2 the same looking buttons, and that would result in more denies. Hopefully, companies would realize that they need to solve their marketing differently.
  - RamRodification 2y ago
    More like big green approve button vs. "Configure my preferences" -> Untick all the things -> Make sure you click the almost invisible Save button and not accidentally click the big green "Allow All" button. Horrible. If we can force websites to do this, we should be able to force websites to read my request header NoDamnTrackingCookiesFfs
    - wkat4242 2y ago
      Probably worth noting that this practice is illegal in the EU. Saying no should be just as easy as saying yes. However they are very bad at enforcing it, sadly.
      - Thiez 2y ago
        And 150 of the 400 "partners" will also have a pre-ticked "legitimate interest" checkbox that you have to untick separately. To me that's an automatic maximum penalty fine, but sadly there is no enforcement.
ipv6ipv4 2y ago
By far, my favorite feature in iOS 18 is Safari’s “hide distracting items” feature. It lets you permanently hide the cookie popups on a per site basis. And the annoying google sign in popups, and the annoying scroll down popups.
- jimkleiber 2y ago
  Whoa thanks for letting me know this exists
- wruza 2y ago
  and the annoying scroll down popups Wait, is it when you pull the page by moving your finger to the bottom of the screen and the “header” pops up?
  - ipv6ipv4 2y ago
    Some sites ask you for an email, or login when you scroll down, and you have to hide it to keep reading. I think Medium pioneered this?
    - wruza 2y ago
      Oh, sad. I hate these idiotic header backscroll popups so hard, hoped it can disable that too.
      - ipv6ipv4 2y ago
        Maybe it can. I don’t know.
  - Lio 2y ago
    You mean the vanity flap at the top? No those are a different sign of design ineptitude. They mean the popups that appear as you try to read what you followed the link for.
anonzzzies 2y ago
If you do not collect my data outside for what is strictly needed, then all is good. Remove analytics, recaptcha, embedded youtube, google cdn and any other things you do not actually need to run your product. And collect only the info you need (and nope, you really do not need my address or phone number unless you ship physical goods, so why are you getting it?). You probably do not need my email address besides for spam (forgot password is not a thing; either use one of the oauth providers, or hash the email and let the user enter it; if it matches you can send the email). Then you don't need cookie banners or gdpr consent popups. It is not that hard. But you want to screw your clients for profit, I know, in that case, you need them or get fined. Which you should be for misusing my information/behaviour and privacy. Nothing good did come of ad tracking, user fingerprinting and data selling, so I wish you many fines.
johnnyanmac 2y ago
> it is not legally required to provide the service if a user declines tracking cookies. The site can simply not provide functionality. So in many cases, its not really a choice – the choice is either not to use the site, or consent to tracking. to be fair that is the choice. And ideally, the invisible hand would show that this is a horrible idea and cause a huge spike in traffic, but alas. I think "stop putting popups cookies" on websites is an extreme stance, but I agree we could use fine tuning on the little things to help keep the spirit of the law. It should indeed be opt-in and not "ask for forgiveness". And it should adhere to current compliances.
- randoomed 2y ago
  Unfortunately that (quoted) line is incorrect see this page by the dutch privacy authority: https://www.autoriteitpersoonsgegevens.nl/en/themes/internet-and-smart-devices/cookies/cookiewall https://www.autoriteitpersoonsgegevens.nl/en/themes/internet... It is based on this 2019 ruling also by this same authority (unfortunately only available in dutch) https://www.autoriteitpersoonsgegevens.nl/documenten/normuitleg-ap-over-cookiewalls https://www.autoriteitpersoonsgegevens.nl/documenten/normuit... While this ruling does not specifically only use the ePrivacy directive (it is instead based in GDPR), laws do not exist in a vacuum.
nikanj 2y ago
Malicious compliance gets the website two benefits: 1) Annoying the customer enough with the popups might net a permission to track from an user who originally did not want the cookies 2) Making the cookie banners as frustrating as possible increases the political pressure against the EU, hopefully leading to them repelling the anti-tracking legislation There's no upsides for a website from providing an easy "Never track me" button, or just not using analytics cookies - you don't have to put up cookie consent banners for technical cookies used to save e.g. light/dark mode preference
- blkhawk 2y ago
  The issue is also that the cookie banner has become a meme for non technical "deciders". That means even sites that do not track you will have the banner.
  - shmeeed 2y ago
    Do you have an example for such a site? Where does one even find a site without tracking nowadays? How is such a banner even supposed to work when there is no choice for the user to make? I mean, someone has to make that banner, so it's quite a way from the rash decision to its execution, where at any point (preferrably immediately) someone could and should step in and say "we are not required to do that and we should not spend any money on it". In my experience, non technical deciders are often sadly under-advised, sometimes because tech people who might know better fail to communicate even very simple facts like in these in an understandable way.
    - blkhawk 2y ago
      It costs time of people who don't weant to spend the time to decide if a cookie banner is needed. its the default. it COSTS money to decide not to have it.
thinkingemote 2y ago
I've come across a few websites that have cookie controls that don't do what they say they do when I manually examined them. E.g. still using analytics Are there any tools to check websites to see that they do what they say they will do? Or is it a manual thing?
- dochne 2y ago
  The Insites GDPR checker[1] does this. [1] https://insites.com/free-website-gdpr-check/ https://insites.com/free-website-gdpr-check/
binkethy 2y ago
Stop using Google Analytics and your need to place cookies and thus need for cookie popups vanishes. Goatcounter or Plausible will do fine. Some decent frontend log parsing will also be a viable strategy. Stop feeding Google your customers data for free.
- cornedor 2y ago
  They mostly use it to monitor (and automate) how successful ads are. Plausible is not a drop-in replacement for such use cases.
  - friendzis 2y ago
    You have sales data for that.
    - wkat4242 2y ago
      Have you ever seen a marketeer say no to more data?
      - anonzzzies 2y ago
        Because it is there: don't make them choose; we have x and nothing more so you cannot have more.
        wkat4242 2y ago
        Yeah but there's the rub. Asking Google to take analytics away just isn't going to happen. It makes them billions. And marketeers want this data because sales data only tells them where they succeeded. Not where they failed to sell, which is more interesting to them because that's where the growth is found. It'll be really hard to wean them off this.
        bortsampson 2y ago
        The EU can simply tell them they can no longer operate Analytics. Too bad if it's hard on Google. They are a preditory company that violates privacy rights. There is clearly competition in the markets they serve. Any threat of complete exit is empty. Those competitors are more than willing to gain any market they exit. These companies need to be put in check by the government or a regulatory body. Marketing and Advertising are toxic to the internet.
natch 2y ago
Please stop using full justify text layout on your website.
rrr_oh_man 2y ago
The future 2 years down is cookieless anyway.¹ I'm afraid that these banners, because these are called "cookie banners" and not "consent to us using your data and giving it freely to other companies banners", will just go away, people (& companies) will be happy, and the consumer stays a fool. ¹ https://en.wikipedia.org/wiki/Third-party_cookies https://en.wikipedia.org/wiki/Third-party_cookies
- ben_w 2y ago
  The legal requirement behind them is about storing information about a person that isn't strictly necessary for functionality or law. It remains even if "cookies" were replaced with "smart dust tracked into your house by cyber-ants".
  - rrr_oh_man 2y ago
    Yup, but it will be very hard to see/prove this from the outside. Unlike cookies.
mrweasel 2y ago
Maybe stop doing stupid shit that will legally require you to inform users that you're about to sell/share everything you know about them to 3rd parties? I fail to understand companies that display page after page of cookies and tracking stuff for you to approve don't see the issue with their actions or the insanity of "allow us to share data with our 1500 partners". Does no one in these business look at this and go: "Hey, why do we need 50 different tracking tools" or "Why do we share customer data with over a thousand other businesses?". When you actually read what these pop-ups says, then you understand why they are there, and why the problem with the laws isn't that it's annoying, but that it is not much more restrictive.
- simonbarker87 2y ago
  The vast majority of websites just want to know where their visitors are coming from and, if they are selling a product, some aggregate level of demographic knowledge to tailor their marketing efforts. They really don’t care about an individual or even small cohort and aren’t selling the data on. Targeting advertising is sooo much more effective for small and medium sized businesses and actually makes many businesses viable in a way they weren’t in the past. The ideal solution would be to find a way for businesses to get those insights in a way that preserves privacy at the individual level. Something like apples differential privacy system but web wide.
  - mrweasel 2y ago
    > Targeting advertising is sooo much more effective for small and medium sized businesses I'm starting to question that, but without any proof that just me rambling. Assuming that it works, I'd actually be fine with a site saying "Hey, just letting you know, we use Google Analytics to learn more about you, is that cool?". The 1500 partners and 50+ trackers aren't numbers I'm making up, those are numbers I frequently see. Sure, you feel you need a tracker, I can easily enough say no to a single tracker. I can also understand a webshop needing to share information with their advertising partner, but not 1500 of them. The law would never have amounted to anything if the reality was a limited scope of data sharing with a clear obvious purpose. It's the insane amount of tracking and data sharing that triggered all this.
switch007 2y ago
Why would they stop? Most users are now giving explicit consent to be tracked! What a dream! Before, they had to worry about legal grey areas! Now the legislation says it's fine, as long as they click "OK". Which almost every user does because they are tired and annoyed by the pop ups. Thank you legislators!
wkat4242 2y ago
> Enact a law that requires a service to respect the do not track signal from a browser (currently entirely voluntary), and not store any tracking cookies, clear gifs or other trackers – and require that a site not “discriminate” against users who elect no tracking – basically – provide all functions to users whether they consent or do not consent. This is indeed the obvious solution. I don't understand why the EU didn't mandate the do not track flag to be obeyed. I know some browsers already removed it but that was because nobody bothered to obey it. As soon as it can be mandated it will be useful and come back quickly. Also, there was criticism from the advertising industry that the do not track was on by default but that's how tracking should work in the EU anyway: opt in. By not doing this the EU keeps getting flak for the many cookie walls.
- tgv 2y ago
  > I don't understand why the EU didn't mandate the do not track flag to be obeyed. 1. Because the implementation is simply left open? 2. Because it's nearly impossible to verify?
  - bspinner 2y ago
    How are cookie banners any better in regards to 2? Not sure what you mean by 1.
    - tgv 2y ago
      Point 1 means that e.g. the GDPR doesn't mandate a specific implementation. It describes the outcome, which is quite reasonable. Point 2: you can't check/verify if parties, especially those outside the jurisdiction of the EU, really honor things like the 'don't track' flag. It's unfortunate that so many companies decide to implement the requirements in the laziest and sleaziest possible ways.
  - wkat4242 2y ago
    The implementation in technical terms is left open yes, but they could have added a clause that settings like this (and not necessarily specifically this alone) must be respected if set. And in that case no other questions may be asked because the preference is already given. In that case the EU would have done themselves a huge favour because now they get blamed by everyone for the cookiewalls. Even though this was never the intention of the law. What do you mean verify? If it's set then it's set. It gets automatically injected with every web request. It's not possible to make sure the user manually set the flag or if it was default, no. But in the EU the law says that tracking must be opt-in so this is perfectly good behaviour in line with the law.
tomw1808 2y ago
So, suppose I run websites. Actually I do and I have cookie banners on all of them - but only for users with EU IP Addresses. Here's the twist: Good news is (for me), I can[1] track and do whatever I want with any other IP address. You visit my site? Well, thanks to nobody else I care about having GDPR-like regulations in place, I can make sure I'll not only track you down and display ads across all advertiser networks, feed them your visit in all imaginable and unimaginable ways, but I can do it in such a targeted way that it's borderline scary. I can literally use any information you gave me on my websites, like your name, your location, proximity to anything. And if I can't then the advertiser can. And in the case of that particular lawsuit mentioned in the article, collecting all user consents, their IP addresses, and basically which websites they visited, its like a gold mine for advertisiers. If it isn't one yet, it can be turned into one with the click of a button. It's like that one case a few years back, where a health insurance company bought a bank and started closing bank accounts from people they knew were risk patients. Simply connect the dots... GDPRs promise was to make it harder to do so. It wasn't the plan to annoy the hell out of everyone with banners. The whole idea was to not allow tracking unless you opted in, because quite frankly, its scary. And no, I'm not a fan of GDPR or overregulation. But in reality, there hasn't been any tech I've come across that really protects the non-technical internet users at large. There's uBlock and plugins, but not installed by default or built into standard mobile browsers. Apple might be close for regular consumers to stop the excessive tracking and companies like FB really hates them for it (for good reason, it costs them big $$). Google will never shoot their own foot by integrating non-tracking tech into any of their products. So, no, my opinion is don't stop that darn annoying cookie pop-ups unless you also stop the tracking. If you stop the tracking, remove the cookie pop-up. As easy as that. [1] I don't do it, but I could. I'm not a reckless psycho-marketer.
mediumsmart 2y ago
me and my 486 partners agree
pploug 2y ago
Hey, just some background from someone who took part in a couple of privacy compliance projects at large platforms in the past: For companies doing this the right way, the banner was just the tip of the iceberg, loads of work went into ensuring compliance behind the scenes, so customer and employee data was not shared with 3rd parties unknowingly. In one case the list of 3rd parties went from +400 to about 70, this is in my opinion a win for privacy, the culture around sharing your data went from casual to cautious. Secondly, the culture around trusting meta and google blindly with behaviour data changed drastically. Businesses became aware of how much valuable data they share with these platforms, which actually puts them at great risk, should you really give these platforms detailed data on what customers browse and buy on your site, so they can use the data to sell targeting for competitors, or direct users towards their own shopping platforms? So, yes the law is not perfect, we all hate the banners, but at least what happened in those early implementation days when the banner became law, was a change in culture around how data was shared and a better understanding of the risk for the business of using 3rd parties.
em1sar 2y ago
[dead]
kuba-orlik 2y ago
> If a site does comply with the notice and consent requirements, it is not legally required to provide the service if a user declines tracking cookies. That's simply not true. In order for consent to be valid under GDPR, the service should operate normally if you decline tracing cookies. Otherwise it's considered a "forced consent" and is not valid.
nurettin 2y ago
The way to reduce cookie banners only depends on a small tweak by google. If you give people the choice between SEO and legibility, they will choose SEO.
nuclearsugar 2y ago
I think its ironic for these pop-ups to frequently only offer "accept necessary" or "accept all"...
fmajid 2y ago
Global Privacy Control, basically a legally binding Do-Not-Track header, is already the law in California, I don’t understand why the EU is dragging its feet on making it mandatory to comply with.

>"Almost every major website you visit today pops up a banner to warn you that it uses “cookies.” This is not legally required in the U.S. or in most places, and where it is, the vast majority of sites do not comply with legal requirements."

Moldoteck 2y ago
afaik gdpr is valid for eu citizens that are in other countries too, including us. US ofc wouldn't do a thing, but EU can act on your business in their land. That's why cookies are everywhere - websites can't know if you are eu citizen or not. Another problem is that - if you don't use cookies for ads/tracking, you don't need a banner but many websites are ignoring this Another problem - imo gdpr should have been adapted to enforce some http header with auto-response so that the banner wouldn't be needed
- peter_d_sherman 2y ago
  >"That's why cookies are everywhere - websites can't know if you are eu citizen or not." An excellent point! Websites can't know if someone is a citizen of country X, country Y, country Z, or even no country (indigenous people, sovereigns, legal constructs, AI's, international groups/associations, companies domiciled in space, other actors/legal constructs, present and future, etc., etc.)! That is, they cannot know implicitly, without being explicitly given the appropriate information, if someone/something (non-human actors and/or legal reprentatives) accessing a website are citizens of a given country -- or not! Now websites can do what many courts do, rightly or wrongly, and that is to presume an arbitrary citizenship/jurisdiction for a given website visitor (or visiting actor -- whatever is on the other side of that HTTP/S request)... But will that be the correct presumption to make in all cases? Probably not! So perhaps the future needs a way for visitors to set in their browser (or by some other mechanism!) -- their citizenship and/or jurisdiction! Of course, then we'd get into some weird scenarios like "what if website X in country Y decides to decline people who have set their browser to "I'm a citizen of country Z" -- sort of like the equivalent of a limiting country's physical immigration policy -- but for HTTP/S requests... If the HTTP/S requests are not in the citizenship/jurisdiction of a whitelist specified by each website, then, "no HTTP/S response for you!" (Sort of like the HTTP/S version of Seinfeld's Soup Nazi -- "No soup for you -- come back in 1 year!" :-)). Of course, the whole set of ideas I've outlined above, were they to come to fruition in the future -- sort of would violate the spirit of openness, trust, and good faith that was present in the early World Wide Web... Remember that the early World Wide Web was built in such a way that all HTTP requests were answered with no need to provide a password or other credentials, no need to accept cookies (the early WWW / HTTP didn't have them!) and could be contrasted with FTP sites of the time which did require passwords (although many would be set to allow username "anonymous", password "anonymous" logins). That is, the early WWW / HTTP -- was a passwordless, cookieless, loginless, "just give me the information", information-passing protocol, which in its earliest incarnations served academics (no one else had access to the Internet at that time!) who only wanted to share academic infomation (papers and the like!) with other academics, regardless of their country, jurisdiction, or their acceptance or rejection of any potentially access-limiting and resource denying cookie! So, in conclusion, an excellent point!

mindwok 2y ago

Interesting article. This policy has felt like a complete failure, but I didn't know the depths of how badly it has failed. I would really like to see these die. Regulators should just work with browser vendors to make an API that I can set at the browser level, and websites just read that to know my preferences and leave me alone.

sofixa 2y ago
Your preferences should be on the website level though, not global. And you should be asked about it on first visiting the website. Let me explain why with an example: say you're the type of people who doesn't care about "privacy" online ("I've got nothing to hide"), or you do; and you want to "support " certain ad-supported websites you're a fan of; but not that new clickbait toilet paper your aunt sends you. I can't think of any way to have a good UX to opt in or out of "tracking" cookies which people would actually use (few will bother changing the defaults, and most mindlessly click ok).
- awfulneutral 2y ago
  Why not do like with popups, and show a little toast with "x tracking cookies were blocked, click to allow"? Cookies could have to register whether they are essential or not. It's really wild how much work must have been created by distributing this problem to every website on earth instead of doing it in the browser.
  - Earw0rm 2y ago
    Because Chrome (Google) and a large chunk of the web media publishing ecosystem are hooked on this crap. It's a hundred billion dollar business. And yes, it's mostly selling garbage, but that's hardly unique in 21st century capitalism.
  - greyface- 2y ago
    Lynx, back in the day, forced you to explicitly accept/reject each cookie offered by the server while loading the page. Modern browsers silently accept them all by default. Browsers have regressed.

andreapaiola 2y ago

So... Abolish all the EULAs?

scarlehoff 2y ago

Please stop - selling our data to advertisers.

o_m 2y ago
For that to work users have to spend money on their services. I hope that will happen in the future, but until then it is hard to compete with free services that has ads.
- troupo 2y ago
  You don't need invasive and pervasive tracking to display ads. Google became an ad behemoth with contextual ads
- kalaksi 2y ago
  They probably still track you even if you paid money, so that makes paying less enticing. And it's prudent to assume so unless they clearly state otherwise
  - Ferret7446 2y ago
    That's because you're not paying enough. If you pay enough, you absolutely can get non-tracking products. Of course, people either aren't willing or can't. Them's the breaks.
    - latexr 2y ago
      The overwhelming majority of ad-supported services do not offer ad-free and surveillance-free alternatives. Heck, even plans literally named “no ads” can still show you ads. https://help.hulu.com/article/hulu-ads-no-commercials https://help.hulu.com/article/hulu-ads-no-commercials
    - kalaksi 2y ago
      You don't know what I'd pay. So can you name any popular services that offer that option? To add, there are estimations about how much ad money average user generates and it's very much affordable

dehrmann 2y ago

The larger lesson here is this is what happens when governments try to regulate things they don't understand. Cookie popups just add friction, and it's not clear consumers see any real privacy benefit. What's even worse is people seem to not care that the policy isn't working, but they aren't telling lawmakers to fix it.

sofixa 2y ago
The lawmakers regulated that a website should warn you, and then upgraded to ask for your consent, before collecting and storing privately identifiable information about you. The regulation doesn't mention cookie popups. The easiest way to comply is to not collect nor store any such information.
- ipv6ipv4 2y ago
  > The regulation doesn't mention cookie popups. The easiest way to comply is to not collect nor store any such information. Utopia is just around the corner as long as everyone does exactly as I say rather than being driven by self interest.
  - ben_w 2y ago
    Governments don't think in terms of utopia, but the rest is literally what a government is: here are the rules, you will follow them or get punished. Relying on self-interest is Laissez-faire, that had the result of (1) the invention of communism and (2) basically ended even in the US with the Great Depression. Communism kinda had the same problem, as it made false assumptions about human nature and self-interest.
- Earw0rm 2y ago
  How do you manage login sessions without? If you're a site that has even basic analytics reporting requirements, how do you do any of that without? "Don't do these things" is a decent option for sole traders, microbusiness and hobby website operators, but good luck selling that to anyone "in a suit" (more likely $500 jeans or chinos nowadays).

dusted 2y ago

The cookie policy is a stupid value-signalling stunt with only negative real-life effects. The correct way of handling the problem would have been through request headers and browser settings, or simply, use the existing option of either allowing or disallowing cookies, and put this option on a per-site basis and a bit more into the users face..

szszrk 2y ago
> only negative real-life effects Almost. It hardly worked as intended, but at least it increased awareness. The fact that some sites tried to comply and actually provided a full list of all sites that they sell your private data to is somewhat a win. It got to a lot of wider public that realized "they sell it to 97 companies?!". I personally think local governments or EU wide institutions should have a registry of companies and their sites with ratings, so we could integrate that directly in our browsers, company registries, phone dialer apps. iFixIt style. - Clarity of EULA: 1/10, impossible to understand without lawyer's interpretation. - Length of EULA: 1/10, pops up every week with no diff or summary of changes - Legality: 4/10, historical track record of rules that are not compliant with local laws of xxx - History: 1/10, no way to track what were the previous versions of the document or when they changed - ... EDIT: to give some context and prove it's possible to provide metrics to legal documents, in Poland we have a formal "Registry of Forbidden Clauses" with references to lost court cases: https://www.rejestr.uokik.gov.pl/ https://www.rejestr.uokik.gov.pl/
yobbo 2y ago
Besides cookies, there are tracking methods based on fingerprinting, IP and so on. None of them are permitted without explicit consent. This means that a site may not load resources from a third-party server without consent, since the request itself reveals enough information for fingerprinting and tracking. Tracking is plainly not permitted without consent.
- imiric 2y ago
  > Tracking is plainly not permitted without consent. According to some poorly thought out law in certain territories, sure. In practice, however, there is no technical mechanism by which users, or anyone else for that matter, can detect whether they're being tracked or consent to it. There are browser extensions conscious users can install to block certain browser features, but these are not infallible, and they're constantly playing a cat and mouse game with trackers. The cookie policy only applies for cookies, not for general tracking. And even with it, companies loophole their way by claiming "legitimate interest". Many popular websites show cookie consent forms with upwards of a thousand of these companies, and deliberately use dark patterns to make it impossible to deny all of them. It's absolute insanity. But in general, cookies are a red herring. They're used as sacrificial offering aimed at governments and the public to show that a company really cares about user privacy by not using them. When in reality they've been relying on far more sophisticated tracking methods for many years which are technically impossible for the public to even comprehend. And let's not forget about the shady data broker market, where our data is perpetually transacted against our will or knowledge, let alone benefit. We need far more technical experts in governments to pass strict regulation against this nonsense, in a way that it actually benefits the public. But I'm not holding my breath that this will ever happen, considering the corporatocracy we're living in.

cbanek 2y ago

Also, for those of us with vision issues (or just want to zoom in a lot on a webpage), these popups look horrible at 150%-200%, and often get misrendered in strange ways, sometimes hiding the button. Then if you actually try to reject it, if you can, the rejecting or customizing page is nearly always broken when zoomed in.

literalAardvark 2y ago

This doesn't read quite right to me. Maybe I missed something. Under the GDPR sites are emphatically NOT allowed to deny service over rejecting cookies. Iirc the only valid options are providing a paid alternative or blocking service to the entire class of GDPR covered citizens.

xaerise 2y ago
That is not really GDPR. That is the ePrivacy ( ie. The Cookie Law from 2009 ) directive that supplements but sometimes overrules GDPR. https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ # Cookie compliance
wkat4242 2y ago
Even a paid alternative is very iffy. Some jurisdictions like Germany have allowed it after a court ruling but most have not. Meta is also getting flak from the EU for their "accept or pay" model.

TheRealPomax 2y ago

So, the problem with this is: the law. If you use session management: GOOD NEWS GDPR AND CPPA UNDER PENALTY OF THE COURTS DEMAND YOU INFORM USERS and if you know a better way than an intrusive "accept this before you can continue" by all means pipe up but the problem is overbearing laws, not "people following them". The law requires that you disallow access until people tell you their position on your handling of their personally identifiable information and welcome to modern web dev hell. If you don't like it, hell has done its job. Both Europe and California consider IP addresses PII and this is the result.

nikanj 2y ago
Session management does not require a cookie consent. Implementation-relevant technical cookies are exempt, it's the 337 different analytics services that sites use that require the cookie consent
troupo 2y ago
1. you don't need consent for functionality strictly required for the functionality of your product. Such as session management 2. You are allowed to legitimately process PII for legitimate purposes related to your business: e.g. combating fraud 3. What you emphatically aren't allowed without consent: collect vast amounts of data, store it indefinitely, and sell it to 15 000 third party "partners"
Moldoteck 2y ago
gdpr works a bit differently. You can use cookies for providing website operations, for it you don't even need a banner. You can't easily use cookies/trackers for ad purposes. You can still display ads but these shouldn't use cookies (this way again - no need for banner).

evdubs 2y ago

uBlock Origin has cookie notice filters. I don't think this is enabled by default; you can enable it in the Filter Lists section, along with "annoyances".

Moru 2y ago
And it works really well. Until it does not, and then you need to figure why the page isn't working for you but your neighbour has no problems. I still use it all the time though but there is some pages I won't bother with much. Probably better that way anyway :-)
- wkat4242 2y ago
  Yes I prefer using the special EU cookie wall plugin. I forget the name right now, sorry. Ublock just blocks the popup which breaks some sites that don't work until you make a choice, which you can't because it's blocked. The other plugin answers it for you in the background with your chosen options.

fire_lake 2y ago

I love the “long press to preview” feature in mobile web browsers. But now all I get to preview is the cookie pop up! EU, pls fix.

planb 2y ago

Cookie banners are a great reason for expirations dates on new policies. If it works: Great, renew it! If it does not work, is not required anymore or was just plain stupid: Never talk about it again and it will run out. But who will actively admit that regulation failed and work to undo it?

cornedor 2y ago
Cookie banners is not a policy, it is used to work around a policy, and often implemented incorrectly. GPDR says you need to be given a specific informed decision, but often cookie banners show a big green approve button, and a less positive deny button (if that is even the case). When the law is being enforced better (Which is slowly happening) those cookie banners should get 2 the same looking buttons, and that would result in more denies. Hopefully, companies would realize that they need to solve their marketing differently.
- RamRodification 2y ago
  More like big green approve button vs. "Configure my preferences" -> Untick all the things -> Make sure you click the almost invisible Save button and not accidentally click the big green "Allow All" button. Horrible. If we can force websites to do this, we should be able to force websites to read my request header NoDamnTrackingCookiesFfs
  - wkat4242 2y ago
    Probably worth noting that this practice is illegal in the EU. Saying no should be just as easy as saying yes. However they are very bad at enforcing it, sadly.
    - Thiez 2y ago
      And 150 of the 400 "partners" will also have a pre-ticked "legitimate interest" checkbox that you have to untick separately. To me that's an automatic maximum penalty fine, but sadly there is no enforcement.

ipv6ipv4 2y ago

By far, my favorite feature in iOS 18 is Safari’s “hide distracting items” feature. It lets you permanently hide the cookie popups on a per site basis. And the annoying google sign in popups, and the annoying scroll down popups.

jimkleiber 2y ago
Whoa thanks for letting me know this exists
wruza 2y ago
and the annoying scroll down popups Wait, is it when you pull the page by moving your finger to the bottom of the screen and the “header” pops up?
- ipv6ipv4 2y ago
  Some sites ask you for an email, or login when you scroll down, and you have to hide it to keep reading. I think Medium pioneered this?
  - wruza 2y ago
    Oh, sad. I hate these idiotic header backscroll popups so hard, hoped it can disable that too.
    - ipv6ipv4 2y ago
      Maybe it can. I don’t know.
- Lio 2y ago
  You mean the vanity flap at the top? No those are a different sign of design ineptitude. They mean the popups that appear as you try to read what you followed the link for.

anonzzzies 2y ago

If you do not collect my data outside for what is strictly needed, then all is good. Remove analytics, recaptcha, embedded youtube, google cdn and any other things you do not actually need to run your product. And collect only the info you need (and nope, you really do not need my address or phone number unless you ship physical goods, so why are you getting it?). You probably do not need my email address besides for spam (forgot password is not a thing; either use one of the oauth providers, or hash the email and let the user enter it; if it matches you can send the email). Then you don't need cookie banners or gdpr consent popups. It is not that hard. But you want to screw your clients for profit, I know, in that case, you need them or get fined. Which you should be for misusing my information/behaviour and privacy. Nothing good did come of ad tracking, user fingerprinting and data selling, so I wish you many fines.

johnnyanmac 2y ago

> it is not legally required to provide the service if a user declines tracking cookies. The site can simply not provide functionality. So in many cases, its not really a choice – the choice is either not to use the site, or consent to tracking. to be fair that is the choice. And ideally, the invisible hand would show that this is a horrible idea and cause a huge spike in traffic, but alas. I think "stop putting popups cookies" on websites is an extreme stance, but I agree we could use fine tuning on the little things to help keep the spirit of the law. It should indeed be opt-in and not "ask for forgiveness". And it should adhere to current compliances.

randoomed 2y ago
Unfortunately that (quoted) line is incorrect see this page by the dutch privacy authority: https://www.autoriteitpersoonsgegevens.nl/en/themes/internet-and-smart-devices/cookies/cookiewall https://www.autoriteitpersoonsgegevens.nl/en/themes/internet... It is based on this 2019 ruling also by this same authority (unfortunately only available in dutch) https://www.autoriteitpersoonsgegevens.nl/documenten/normuitleg-ap-over-cookiewalls https://www.autoriteitpersoonsgegevens.nl/documenten/normuit... While this ruling does not specifically only use the ePrivacy directive (it is instead based in GDPR), laws do not exist in a vacuum.

nikanj 2y ago

Malicious compliance gets the website two benefits: 1) Annoying the customer enough with the popups might net a permission to track from an user who originally did not want the cookies 2) Making the cookie banners as frustrating as possible increases the political pressure against the EU, hopefully leading to them repelling the anti-tracking legislation There's no upsides for a website from providing an easy "Never track me" button, or just not using analytics cookies - you don't have to put up cookie consent banners for technical cookies used to save e.g. light/dark mode preference

blkhawk 2y ago
The issue is also that the cookie banner has become a meme for non technical "deciders". That means even sites that do not track you will have the banner.
- shmeeed 2y ago
  Do you have an example for such a site? Where does one even find a site without tracking nowadays? How is such a banner even supposed to work when there is no choice for the user to make? I mean, someone has to make that banner, so it's quite a way from the rash decision to its execution, where at any point (preferrably immediately) someone could and should step in and say "we are not required to do that and we should not spend any money on it". In my experience, non technical deciders are often sadly under-advised, sometimes because tech people who might know better fail to communicate even very simple facts like in these in an understandable way.
  - blkhawk 2y ago
    It costs time of people who don't weant to spend the time to decide if a cookie banner is needed. its the default. it COSTS money to decide not to have it.

thinkingemote 2y ago

I've come across a few websites that have cookie controls that don't do what they say they do when I manually examined them. E.g. still using analytics Are there any tools to check websites to see that they do what they say they will do? Or is it a manual thing?

dochne 2y ago
The Insites GDPR checker[1] does this. [1] https://insites.com/free-website-gdpr-check/ https://insites.com/free-website-gdpr-check/

binkethy 2y ago

Stop using Google Analytics and your need to place cookies and thus need for cookie popups vanishes. Goatcounter or Plausible will do fine. Some decent frontend log parsing will also be a viable strategy. Stop feeding Google your customers data for free.

cornedor 2y ago
They mostly use it to monitor (and automate) how successful ads are. Plausible is not a drop-in replacement for such use cases.
- friendzis 2y ago
  You have sales data for that.
  - wkat4242 2y ago
    Have you ever seen a marketeer say no to more data?
    - anonzzzies 2y ago
      Because it is there: don't make them choose; we have x and nothing more so you cannot have more.
      - wkat4242 2y ago
        Yeah but there's the rub. Asking Google to take analytics away just isn't going to happen. It makes them billions. And marketeers want this data because sales data only tells them where they succeeded. Not where they failed to sell, which is more interesting to them because that's where the growth is found. It'll be really hard to wean them off this.
        bortsampson 2y ago
        The EU can simply tell them they can no longer operate Analytics. Too bad if it's hard on Google. They are a preditory company that violates privacy rights. There is clearly competition in the markets they serve. Any threat of complete exit is empty. Those competitors are more than willing to gain any market they exit. These companies need to be put in check by the government or a regulatory body. Marketing and Advertising are toxic to the internet.

natch 2y ago

Please stop using full justify text layout on your website.

rrr_oh_man 2y ago

The future 2 years down is cookieless anyway.¹ I'm afraid that these banners, because these are called "cookie banners" and not "consent to us using your data and giving it freely to other companies banners", will just go away, people (& companies) will be happy, and the consumer stays a fool. ¹ https://en.wikipedia.org/wiki/Third-party_cookies https://en.wikipedia.org/wiki/Third-party_cookies

ben_w 2y ago
The legal requirement behind them is about storing information about a person that isn't strictly necessary for functionality or law. It remains even if "cookies" were replaced with "smart dust tracked into your house by cyber-ants".
- rrr_oh_man 2y ago
  Yup, but it will be very hard to see/prove this from the outside. Unlike cookies.

mrweasel 2y ago

Maybe stop doing stupid shit that will legally require you to inform users that you're about to sell/share everything you know about them to 3rd parties? I fail to understand companies that display page after page of cookies and tracking stuff for you to approve don't see the issue with their actions or the insanity of "allow us to share data with our 1500 partners". Does no one in these business look at this and go: "Hey, why do we need 50 different tracking tools" or "Why do we share customer data with over a thousand other businesses?". When you actually read what these pop-ups says, then you understand why they are there, and why the problem with the laws isn't that it's annoying, but that it is not much more restrictive.

simonbarker87 2y ago
The vast majority of websites just want to know where their visitors are coming from and, if they are selling a product, some aggregate level of demographic knowledge to tailor their marketing efforts. They really don’t care about an individual or even small cohort and aren’t selling the data on. Targeting advertising is sooo much more effective for small and medium sized businesses and actually makes many businesses viable in a way they weren’t in the past. The ideal solution would be to find a way for businesses to get those insights in a way that preserves privacy at the individual level. Something like apples differential privacy system but web wide.
- mrweasel 2y ago
  > Targeting advertising is sooo much more effective for small and medium sized businesses I'm starting to question that, but without any proof that just me rambling. Assuming that it works, I'd actually be fine with a site saying "Hey, just letting you know, we use Google Analytics to learn more about you, is that cool?". The 1500 partners and 50+ trackers aren't numbers I'm making up, those are numbers I frequently see. Sure, you feel you need a tracker, I can easily enough say no to a single tracker. I can also understand a webshop needing to share information with their advertising partner, but not 1500 of them. The law would never have amounted to anything if the reality was a limited scope of data sharing with a clear obvious purpose. It's the insane amount of tracking and data sharing that triggered all this.

switch007 2y ago

Why would they stop? Most users are now giving explicit consent to be tracked! What a dream! Before, they had to worry about legal grey areas! Now the legislation says it's fine, as long as they click "OK". Which almost every user does because they are tired and annoyed by the pop ups. Thank you legislators!

wkat4242 2y ago

> Enact a law that requires a service to respect the do not track signal from a browser (currently entirely voluntary), and not store any tracking cookies, clear gifs or other trackers – and require that a site not “discriminate” against users who elect no tracking – basically – provide all functions to users whether they consent or do not consent. This is indeed the obvious solution. I don't understand why the EU didn't mandate the do not track flag to be obeyed. I know some browsers already removed it but that was because nobody bothered to obey it. As soon as it can be mandated it will be useful and come back quickly. Also, there was criticism from the advertising industry that the do not track was on by default but that's how tracking should work in the EU anyway: opt in. By not doing this the EU keeps getting flak for the many cookie walls.

tgv 2y ago
> I don't understand why the EU didn't mandate the do not track flag to be obeyed. 1. Because the implementation is simply left open? 2. Because it's nearly impossible to verify?
- bspinner 2y ago
  How are cookie banners any better in regards to 2? Not sure what you mean by 1.
  - tgv 2y ago
    Point 1 means that e.g. the GDPR doesn't mandate a specific implementation. It describes the outcome, which is quite reasonable. Point 2: you can't check/verify if parties, especially those outside the jurisdiction of the EU, really honor things like the 'don't track' flag. It's unfortunate that so many companies decide to implement the requirements in the laziest and sleaziest possible ways.
- wkat4242 2y ago
  The implementation in technical terms is left open yes, but they could have added a clause that settings like this (and not necessarily specifically this alone) must be respected if set. And in that case no other questions may be asked because the preference is already given. In that case the EU would have done themselves a huge favour because now they get blamed by everyone for the cookiewalls. Even though this was never the intention of the law. What do you mean verify? If it's set then it's set. It gets automatically injected with every web request. It's not possible to make sure the user manually set the flag or if it was default, no. But in the EU the law says that tracking must be opt-in so this is perfectly good behaviour in line with the law.

tomw1808 2y ago

So, suppose I run websites. Actually I do and I have cookie banners on all of them - but only for users with EU IP Addresses. Here's the twist: Good news is (for me), I can[1] track and do whatever I want with any other IP address. You visit my site? Well, thanks to nobody else I care about having GDPR-like regulations in place, I can make sure I'll not only track you down and display ads across all advertiser networks, feed them your visit in all imaginable and unimaginable ways, but I can do it in such a targeted way that it's borderline scary. I can literally use any information you gave me on my websites, like your name, your location, proximity to anything. And if I can't then the advertiser can. And in the case of that particular lawsuit mentioned in the article, collecting all user consents, their IP addresses, and basically which websites they visited, its like a gold mine for advertisiers. If it isn't one yet, it can be turned into one with the click of a button. It's like that one case a few years back, where a health insurance company bought a bank and started closing bank accounts from people they knew were risk patients. Simply connect the dots... GDPRs promise was to make it harder to do so. It wasn't the plan to annoy the hell out of everyone with banners. The whole idea was to not allow tracking unless you opted in, because quite frankly, its scary. And no, I'm not a fan of GDPR or overregulation. But in reality, there hasn't been any tech I've come across that really protects the non-technical internet users at large. There's uBlock and plugins, but not installed by default or built into standard mobile browsers. Apple might be close for regular consumers to stop the excessive tracking and companies like FB really hates them for it (for good reason, it costs them big $$). Google will never shoot their own foot by integrating non-tracking tech into any of their products. So, no, my opinion is don't stop that darn annoying cookie pop-ups unless you also stop the tracking. If you stop the tracking, remove the cookie pop-up. As easy as that. [1] I don't do it, but I could. I'm not a reckless psycho-marketer.

mediumsmart 2y ago

me and my 486 partners agree

pploug 2y ago

Hey, just some background from someone who took part in a couple of privacy compliance projects at large platforms in the past: For companies doing this the right way, the banner was just the tip of the iceberg, loads of work went into ensuring compliance behind the scenes, so customer and employee data was not shared with 3rd parties unknowingly. In one case the list of 3rd parties went from +400 to about 70, this is in my opinion a win for privacy, the culture around sharing your data went from casual to cautious. Secondly, the culture around trusting meta and google blindly with behaviour data changed drastically. Businesses became aware of how much valuable data they share with these platforms, which actually puts them at great risk, should you really give these platforms detailed data on what customers browse and buy on your site, so they can use the data to sell targeting for competitors, or direct users towards their own shopping platforms? So, yes the law is not perfect, we all hate the banners, but at least what happened in those early implementation days when the banner became law, was a change in culture around how data was shared and a better understanding of the risk for the business of using 3rd parties.

em1sar 2y ago

[dead]

kuba-orlik 2y ago

> If a site does comply with the notice and consent requirements, it is not legally required to provide the service if a user declines tracking cookies. That's simply not true. In order for consent to be valid under GDPR, the service should operate normally if you decline tracing cookies. Otherwise it's considered a "forced consent" and is not valid.

nurettin 2y ago

The way to reduce cookie banners only depends on a small tweak by google. If you give people the choice between SEO and legibility, they will choose SEO.

nuclearsugar 2y ago

I think its ironic for these pop-ups to frequently only offer "accept necessary" or "accept all"...

fmajid 2y ago

Global Privacy Control, basically a legally binding Do-Not-Track header, is already the law in California, I don’t understand why the EU is dragging its feet on making it mandatory to comply with.