4 ms·

Correct URL: https://legiscope.com/blog/hidden-productivity-drain-cookie-banners.html https://legiscope.com/blog/hidden-productivity-drain-cookie-... > This si

by diggan 2y ago

Correct URL: https://legiscope.com/blog/hidden-productivity-drain-cookie-banners.html https://legiscope.com/blog/hidden-productivity-drain-cookie-... > This situation calls for an urgent revision of the ePrivacy Directive Shame companies cannot live without tracking cookies, and shame that the blame somehow end up on the regulation, rather than the companies who are the ones who introduce this cookie banner and "massive productivity loss". You know the best way of not having to put up cookie banners on your website? Don't store PII in cookies. You know the best way of not having to care about GDPR? Don't store PII.

dmafreezone 2y ago
You know the best way to protect your PII from websites? Don’t use the internet.
JumpCrisscross 2y ago
> shame that the blame somehow end up on the regulation, rather than the companies who are the ones who introduce this cookie banner and "massive productivity loss" You can wish upon a star that humans weren’t the way we are. In the real world, this was a predictable response to a stupid rule. (And in some cases a necessary one. For example, for websites requiring a login or reliant on ads.) > know the best way of not having to care about GDPR? Don't store PII This is a nothing to hide argument [1]. Proving compliance with GDPR is tedious and expensive even if you’re fully compliant. (Proving no jurisdiction is easier.) [1] https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument
- diggan 2y ago
  > this was a predictable response to a stupid rule It was predictable that ultimately people would blame the regulation instead of the companies? Not sure I understand what you mean, and even if you meant what I think you meant, not sure what the point is? People blame all sorts of things all the time... Edit since you've added more to your comment > Proving compliance with GDPR is tedious That's my point. No need to prove compliance if GDPR doesn't apply.
  - gjsman-1000 2y ago
    [flagged]
    - diggan 2y ago
      Except it's not that black and white. If you follow the regulation too loosely, you get warnings. If you then ignore the problem, you'd get bigger problems. But no one is gonna put a "10% of global turnover" as a fine immediately.
      - gjsman-1000 2y ago
        > But no one is gonna put a "10% of global turnover" as a fine immediately. You're dealing with the EU. Stupidly high fines happen weekly.
        diggan 2y ago
        > You're dealing with the EU. Stupidly high fines happen weekly. Thank you for making it clear you wasn't taking the conversation seriously, I almost thought someone could hold opinions like that in real life, but I'm happy it wasn't so.
        gjsman-1000 2y ago
        Tell that to Emanuel Macron, who has openly said that the EU might literally die functionally, if not politically, in just 2-3 years due to sheer economic lack of competitiveness. "Our former model is over. We are overregulating and underinvesting. In the two to three years to come, if we follow our classical agenda, we will be out of the market." "If we want clearly to be more competitive and have our place in this multipolar order; first, we need a simplification shock." "The EU could die, we are on a verge of a very important moment." https://www.politico.eu/article/emmanuel-macron-france-europe-competition-united-states-china-climate-change-defense-security/ https://www.politico.eu/article/emmanuel-macron-france-europ...
- ben_w 2y ago
  > for websites requiring a login They don't need consent for that. > reliant on ads Yes. For me, this has been eye-opening about how many different ad agencies there are snooping on my browsing history. It was bad enough when it was just the (UK) government passing a law to do that, now I've got websites with more "trusted partners" monitoring my every move than my high school had students. > This is a nothing to hide argument "Don't store PII" does not seem to be that, to me? If anything, the opposite party gets that criticism, given that the default is allowing private agencies to spy on everyone?
  - JumpCrisscross 2y ago
    Saying you don’t need to worry about GDPR if you don’t keep PII is the “nothing to hide” argument. There is still a cost to demonstrating compliance that goes beyond complying.
    - diggan 2y ago
      Maybe an analogy will make it click: If you have marijuana on you in a country where marijuana is illegal, then finding marijuana on you is illegal. If you don't have marijuana on you, you're not doing anything illegal. Replace marijuana with "personal data" and imagine it is about websites with visitors within EU. If they're not storing, processing and/or transmitting personal data, there is no compliance requirements (from GDPR at least).
      - JumpCrisscross 2y ago
        > If you have marijuana on you in a country where marijuana is illegal, then finding marijuana on you is illegal. If you don't have marijuana on you, you're not doing anything illegal This is a good analogy. By making the marijuana illegal, you also implicitly widen search powers. You can’t arrest someone you think smells like weed if weed is legal. (Or answer a neighbor’s complaint that they suspect they’re growing weed.) Same idea. If you say you aren’t storing personal data and I say you are, someone’s got the authority to check. Those checks and confirmations cost time and money. With a complain-investigate set-up like GDPR (and American securities law), the burden is on the respondent.
vegasbrianc 2y ago
Thanks, somehow the URL was truncated :(
Alupis 2y ago
> Shame companies cannot live without tracking cookies Most cookies are entirely benign. Many cookies (or something like a cookie) are required for a website to operate normally. The EU law, while good intentioned, was/is too broad and failed to understand the realities of operating websites. This regulation has caused the entire world to be annoyed with useless cookie banners that 99% of people just reflexively click through - just like all of California's Prop65 warnings are ignored today. > Don't store PII. These hard-line statements defy reality. Many websites have legitimate need to store PII. > You know the best way of not having to care about GDPR? Don't be in the EU? Just ignore it. There are no consequences. If you don't have physical presence within the EU - there's little-to-zero the EU can do about it. The EU can think it's laws apply to the world all it wants - but the world disagrees.
- whstl 2y ago
  > Many cookies (or something like a cookie) are required for a website to operate normally "Essential Cookies" do not need a consent banner. Case in point: Hacker News is 100% compliant AFAIK and has no banner. > Many websites have legitimate need to store PII. If there is actual legitimate interest or legal requirements, such as collecting an address for delivering a package or performing fraud-prevention, there is also no need for cookie banners.
  - Alupis 2y ago
    And if that data is "transferred" to a 3rd party for that analysis (aka. a REST call into their API) then you are back to requiring these annoying banners. Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers. Oh the horror!
    - whstl 2y ago
      What does "for that analysis" refers to? Fraud prevention? If so, it is legitimate interest to do fraud prevention, so there's no need for a consent banner, first or third-party. Naturally you can't go and use this data for a purpose that has no basis under legitimate interest. Another example: Cloudflare is running DDoS prevention under our noses here at HN, for example, but there's no need to ask for consent, even though Cloudflare is a third-party. Why? Because this is considered legitimate interest. > Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers For this you do need consent, if you transfer PII. If you don't want a banner you can replace it with a simple checkbox during the checkout process. Not only less hostile, but also more transparent than a banner.
r3trohack3r 2y ago
> You know the best way of not having to care about GDPR? Don't store PII. I hear this a lot. As an American that hosts casual personal websites, I can't help but worry that I'm in violation of the GDPR. For example, my router logs connections for debugging. And my NGinx server maintains server logs for debugging. These contain IP addresses. I'm pretty sure those are considered PII under GDPR. And there are a lot of things I think that follow from that, things I haven't bothered to look into or implement. Like whatever policies, disclaimers, notifications, request handling processes, etc. that need to be in place to gather those logs. Whether or not I need a registered agent in the EU to host my website seems to be rather fuzzy too. It seems to come down to how "sensitive" the data I store in my logs are? Its also not clear to me whether my home router is subject to GDPR if it receives and logs a packet that was sent to it by an EU citizen, regardless of whether there was a public internet service hosted on that router or not. I mostly choose to not think about these things - but that nagging concern that my entire self-hosted digital presence violates European law does linger.
- dijit 2y ago
  I get it, but you’re not in violation if you never pass those logs to anyone. GDPR is intentionally obfuscated and made scary by people who have an interest in others thinking the regulation is onerous and silly (so that it is eventually changed/removed). The regulation is not very hard to read, I would recommend you do it if you haven’t and boils down to: “don’t pass on (process) information without informed consent, if someone requests that you remove their account you should do so- and also don’t keep records around, and do your best not to let anyone access personal information”, the last one is technically unenforceable, but exists to prevent people leaving open access to data processors and bypassing consent more than anything else. A secondary benefit is that people take access controls a little more seriously by forcing breach disclosures. Even the cookie banners are not needed unless you’re setting cookies for data collection, especially for third-parties! There is a distinct irony in that all the online simplifications (“gdpr for dummies”, “the 7 things to comply with for gdpr”) are misleading and harder to read than the actual text of the regulation. EDIT; I was foolish to post this during the peak time for US people. It feels like the Americans want the GDPR to be perceived as a pain.

by diggan 2y ago

dmafreezone 2y ago

You know the best way to protect your PII from websites? Don’t use the internet.

JumpCrisscross 2y ago

> shame that the blame somehow end up on the regulation, rather than the companies who are the ones who introduce this cookie banner and "massive productivity loss" You can wish upon a star that humans weren’t the way we are. In the real world, this was a predictable response to a stupid rule. (And in some cases a necessary one. For example, for websites requiring a login or reliant on ads.) > know the best way of not having to care about GDPR? Don't store PII This is a nothing to hide argument [1]. Proving compliance with GDPR is tedious and expensive even if you’re fully compliant. (Proving no jurisdiction is easier.) [1] https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument

diggan 2y ago
> this was a predictable response to a stupid rule It was predictable that ultimately people would blame the regulation instead of the companies? Not sure I understand what you mean, and even if you meant what I think you meant, not sure what the point is? People blame all sorts of things all the time... Edit since you've added more to your comment > Proving compliance with GDPR is tedious That's my point. No need to prove compliance if GDPR doesn't apply.
- gjsman-1000 2y ago
  [flagged]
  - diggan 2y ago
    Except it's not that black and white. If you follow the regulation too loosely, you get warnings. If you then ignore the problem, you'd get bigger problems. But no one is gonna put a "10% of global turnover" as a fine immediately.
    - gjsman-1000 2y ago
      > But no one is gonna put a "10% of global turnover" as a fine immediately. You're dealing with the EU. Stupidly high fines happen weekly.
      - diggan 2y ago
        > You're dealing with the EU. Stupidly high fines happen weekly. Thank you for making it clear you wasn't taking the conversation seriously, I almost thought someone could hold opinions like that in real life, but I'm happy it wasn't so.
        gjsman-1000 2y ago
        Tell that to Emanuel Macron, who has openly said that the EU might literally die functionally, if not politically, in just 2-3 years due to sheer economic lack of competitiveness. "Our former model is over. We are overregulating and underinvesting. In the two to three years to come, if we follow our classical agenda, we will be out of the market." "If we want clearly to be more competitive and have our place in this multipolar order; first, we need a simplification shock." "The EU could die, we are on a verge of a very important moment." https://www.politico.eu/article/emmanuel-macron-france-europe-competition-united-states-china-climate-change-defense-security/ https://www.politico.eu/article/emmanuel-macron-france-europ...
ben_w 2y ago
> for websites requiring a login They don't need consent for that. > reliant on ads Yes. For me, this has been eye-opening about how many different ad agencies there are snooping on my browsing history. It was bad enough when it was just the (UK) government passing a law to do that, now I've got websites with more "trusted partners" monitoring my every move than my high school had students. > This is a nothing to hide argument "Don't store PII" does not seem to be that, to me? If anything, the opposite party gets that criticism, given that the default is allowing private agencies to spy on everyone?
- JumpCrisscross 2y ago
  Saying you don’t need to worry about GDPR if you don’t keep PII is the “nothing to hide” argument. There is still a cost to demonstrating compliance that goes beyond complying.
  - diggan 2y ago
    Maybe an analogy will make it click: If you have marijuana on you in a country where marijuana is illegal, then finding marijuana on you is illegal. If you don't have marijuana on you, you're not doing anything illegal. Replace marijuana with "personal data" and imagine it is about websites with visitors within EU. If they're not storing, processing and/or transmitting personal data, there is no compliance requirements (from GDPR at least).
    - JumpCrisscross 2y ago
      > If you have marijuana on you in a country where marijuana is illegal, then finding marijuana on you is illegal. If you don't have marijuana on you, you're not doing anything illegal This is a good analogy. By making the marijuana illegal, you also implicitly widen search powers. You can’t arrest someone you think smells like weed if weed is legal. (Or answer a neighbor’s complaint that they suspect they’re growing weed.) Same idea. If you say you aren’t storing personal data and I say you are, someone’s got the authority to check. Those checks and confirmations cost time and money. With a complain-investigate set-up like GDPR (and American securities law), the burden is on the respondent.

vegasbrianc 2y ago

Thanks, somehow the URL was truncated :(

Alupis 2y ago

> Shame companies cannot live without tracking cookies Most cookies are entirely benign. Many cookies (or something like a cookie) are required for a website to operate normally. The EU law, while good intentioned, was/is too broad and failed to understand the realities of operating websites. This regulation has caused the entire world to be annoyed with useless cookie banners that 99% of people just reflexively click through - just like all of California's Prop65 warnings are ignored today. > Don't store PII. These hard-line statements defy reality. Many websites have legitimate need to store PII. > You know the best way of not having to care about GDPR? Don't be in the EU? Just ignore it. There are no consequences. If you don't have physical presence within the EU - there's little-to-zero the EU can do about it. The EU can think it's laws apply to the world all it wants - but the world disagrees.

whstl 2y ago
> Many cookies (or something like a cookie) are required for a website to operate normally "Essential Cookies" do not need a consent banner. Case in point: Hacker News is 100% compliant AFAIK and has no banner. > Many websites have legitimate need to store PII. If there is actual legitimate interest or legal requirements, such as collecting an address for delivering a package or performing fraud-prevention, there is also no need for cookie banners.
- Alupis 2y ago
  And if that data is "transferred" to a 3rd party for that analysis (aka. a REST call into their API) then you are back to requiring these annoying banners. Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers. Oh the horror!
  - whstl 2y ago
    What does "for that analysis" refers to? Fraud prevention? If so, it is legitimate interest to do fraud prevention, so there's no need for a consent banner, first or third-party. Naturally you can't go and use this data for a purpose that has no basis under legitimate interest. Another example: Cloudflare is running DDoS prevention under our noses here at HN, for example, but there's no need to ask for consent, even though Cloudflare is a third-party. Why? Because this is considered legitimate interest. > Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers For this you do need consent, if you transfer PII. If you don't want a banner you can replace it with a simple checkbox during the checkout process. Not only less hostile, but also more transparent than a banner.

r3trohack3r 2y ago

> You know the best way of not having to care about GDPR? Don't store PII. I hear this a lot. As an American that hosts casual personal websites, I can't help but worry that I'm in violation of the GDPR. For example, my router logs connections for debugging. And my NGinx server maintains server logs for debugging. These contain IP addresses. I'm pretty sure those are considered PII under GDPR. And there are a lot of things I think that follow from that, things I haven't bothered to look into or implement. Like whatever policies, disclaimers, notifications, request handling processes, etc. that need to be in place to gather those logs. Whether or not I need a registered agent in the EU to host my website seems to be rather fuzzy too. It seems to come down to how "sensitive" the data I store in my logs are? Its also not clear to me whether my home router is subject to GDPR if it receives and logs a packet that was sent to it by an EU citizen, regardless of whether there was a public internet service hosted on that router or not. I mostly choose to not think about these things - but that nagging concern that my entire self-hosted digital presence violates European law does linger.

dijit 2y ago
I get it, but you’re not in violation if you never pass those logs to anyone. GDPR is intentionally obfuscated and made scary by people who have an interest in others thinking the regulation is onerous and silly (so that it is eventually changed/removed). The regulation is not very hard to read, I would recommend you do it if you haven’t and boils down to: “don’t pass on (process) information without informed consent, if someone requests that you remove their account you should do so- and also don’t keep records around, and do your best not to let anyone access personal information”, the last one is technically unenforceable, but exists to prevent people leaving open access to data processors and bypassing consent more than anything else. A secondary benefit is that people take access controls a little more seriously by forcing breach disclosures. Even the cookie banners are not needed unless you’re setting cookies for data collection, especially for third-parties! There is a distinct irony in that all the online simplifications (“gdpr for dummies”, “the 7 things to comply with for gdpr”) are misleading and harder to read than the actual text of the regulation. EDIT; I was foolish to post this during the peak time for US people. It feels like the Americans want the GDPR to be perceived as a pain.