4 ms·

> Shame companies cannot live without tracking cookies Most cookies are entirely benign. Many cookies (or something like a cookie) are required for a website t

by Alupis 2y ago

> Shame companies cannot live without tracking cookies Most cookies are entirely benign. Many cookies (or something like a cookie) are required for a website to operate normally. The EU law, while good intentioned, was/is too broad and failed to understand the realities of operating websites. This regulation has caused the entire world to be annoyed with useless cookie banners that 99% of people just reflexively click through - just like all of California's Prop65 warnings are ignored today. > Don't store PII. These hard-line statements defy reality. Many websites have legitimate need to store PII. > You know the best way of not having to care about GDPR? Don't be in the EU? Just ignore it. There are no consequences. If you don't have physical presence within the EU - there's little-to-zero the EU can do about it. The EU can think it's laws apply to the world all it wants - but the world disagrees.

whstl 2y ago
> Many cookies (or something like a cookie) are required for a website to operate normally "Essential Cookies" do not need a consent banner. Case in point: Hacker News is 100% compliant AFAIK and has no banner. > Many websites have legitimate need to store PII. If there is actual legitimate interest or legal requirements, such as collecting an address for delivering a package or performing fraud-prevention, there is also no need for cookie banners.
- Alupis 2y ago
  And if that data is "transferred" to a 3rd party for that analysis (aka. a REST call into their API) then you are back to requiring these annoying banners. Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers. Oh the horror!
  - whstl 2y ago
    What does "for that analysis" refers to? Fraud prevention? If so, it is legitimate interest to do fraud prevention, so there's no need for a consent banner, first or third-party. Naturally you can't go and use this data for a purpose that has no basis under legitimate interest. Another example: Cloudflare is running DDoS prevention under our noses here at HN, for example, but there's no need to ask for consent, even though Cloudflare is a third-party. Why? Because this is considered legitimate interest. > Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers For this you do need consent, if you transfer PII. If you don't want a banner you can replace it with a simple checkbox during the checkout process. Not only less hostile, but also more transparent than a banner.
    - Alupis 2y ago
      > What does "for that analysis" To understand how customer's shop on my website. Heatmaps, view port, device type, screen resolution, frequency of browsing, where their mouse hovers the most, page dwell time, etc. These are impossible tasks for most website operators to do themselves. > For this you do need consent, if you transfer PII. If you don't want a banner you can replace it with a simple checkbox during the checkout process. Not only less hostile, but also more transparent than a banner. Or... you can just ignore the EU because the EU doesn't matter. You know, like I originally asserted? > If you don't want a banner you can replace it with a simple checkbox during the checkout process This is the sort of mindset that crafted this poorly designed regulation in the first place. Most website operators are not going to willingly add a barrier at the final step of a conversion. If you are going to use my property and resources - it's my rules or don't come. Pretty simple...
      - deleted 2y ago
        [deleted]
      - whstl 2y ago
        You don't need banners just because something is third-party. If there is no PII and/or legitimate consent, you don't need a banner. There are GDPR compliant analytics platforms, fraud prevention, third-party payment gateways, for example. They don't need banners. As for the rest, it's quite inflammatory and I don't know how it relates to my comment, so I'll refrain from answering.
        what 2y ago
        You don’t need banners period. The EU doesn’t get to tell people how to operate their web properties. If EU citizens don’t like it, they can stop visiting those properties. Even simpler.
        tbrownaw 2y ago
        > The EU doesn’t get to tell people how to operate their web properties. Well, except for all the people in the eu. I'm pretty sure the eu does get to tell those people to do or not do things, online or not.
diggan 2y ago
> Most cookies are entirely benign. Many cookies (or something like a cookie) are required for a website to operate normally. The EU law was/is too broad - and has caused the entire world to be annoyed with useless cookie banners. Give reading the actual implementations a try. You'll quickly notice they actually thought of this. I wouldn't say it's "expertly crafted" by any means, but the banner is for a specific "class" of cookies, not just "abc=123" as you seem to think.
- Alupis 2y ago
  You might try to argue many types of cookies are non-essential - but that would be because you lack experience in this domain. Website operators have a right to study how people use their website just the same as a brick-and-mortar operator has the right to study how customers navigate their store isles. The EU law compels a popup for these types of services/scripts and 99% of people just click through them because they are noise. Lastly - the EU and it's laws don't matter. What are they going to do about non-compliant foreign websites? Nothing.
  - diggan 2y ago
    > You might try to argue many types of cookies are non-essential - but that would be because you lack experience in this domain. I'm not arguing anything, read the directives and implementations yourself, then get back to me. While some might lack experience, others seem to lack reading comprehension. That's fine, we can always learn :) > Website operators have a right to study how people use their website In the EU, that depends. As a website operator at a certain scale, you cannot do whatever you want with personal data. > Lastly - the EU and it's laws don't matter. What are they going to do about non-compliant foreign websites? Nothing. Yeah, I mean that's cool and all, but maybe you're spending time discussing in the wrong HN submission then? I don't go around in submissions about "Golang is bad" commentating how you wouldn't have those issues if you didn't use Golang in the first place. Not my idea of curious conversation at all. Obviously EU directives and laws apply in EU
    - Alupis 2y ago

by Alupis 2y ago

whstl 2y ago

> Many cookies (or something like a cookie) are required for a website to operate normally "Essential Cookies" do not need a consent banner. Case in point: Hacker News is 100% compliant AFAIK and has no banner. > Many websites have legitimate need to store PII. If there is actual legitimate interest or legal requirements, such as collecting an address for delivering a package or performing fraud-prevention, there is also no need for cookie banners.

Alupis 2y ago
And if that data is "transferred" to a 3rd party for that analysis (aka. a REST call into their API) then you are back to requiring these annoying banners. Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers. Oh the horror!
- whstl 2y ago
  What does "for that analysis" refers to? Fraud prevention? If so, it is legitimate interest to do fraud prevention, so there's no need for a consent banner, first or third-party. Naturally you can't go and use this data for a purpose that has no basis under legitimate interest. Another example: Cloudflare is running DDoS prevention under our noses here at HN, for example, but there's no need to ask for consent, even though Cloudflare is a third-party. Why? Because this is considered legitimate interest. > Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers For this you do need consent, if you transfer PII. If you don't want a banner you can replace it with a simple checkbox during the checkout process. Not only less hostile, but also more transparent than a banner.
  - Alupis 2y ago
    > What does "for that analysis" To understand how customer's shop on my website. Heatmaps, view port, device type, screen resolution, frequency of browsing, where their mouse hovers the most, page dwell time, etc. These are impossible tasks for most website operators to do themselves. > For this you do need consent, if you transfer PII. If you don't want a banner you can replace it with a simple checkbox during the checkout process. Not only less hostile, but also more transparent than a banner. Or... you can just ignore the EU because the EU doesn't matter. You know, like I originally asserted? > If you don't want a banner you can replace it with a simple checkbox during the checkout process This is the sort of mindset that crafted this poorly designed regulation in the first place. Most website operators are not going to willingly add a barrier at the final step of a conversion. If you are going to use my property and resources - it's my rules or don't come. Pretty simple...
    - deleted 2y ago
      [deleted]
    - whstl 2y ago
      You don't need banners just because something is third-party. If there is no PII and/or legitimate consent, you don't need a banner. There are GDPR compliant analytics platforms, fraud prevention, third-party payment gateways, for example. They don't need banners. As for the rest, it's quite inflammatory and I don't know how it relates to my comment, so I'll refrain from answering.
      - what 2y ago
        You don’t need banners period. The EU doesn’t get to tell people how to operate their web properties. If EU citizens don’t like it, they can stop visiting those properties. Even simpler.
        tbrownaw 2y ago
        > The EU doesn’t get to tell people how to operate their web properties. Well, except for all the people in the eu. I'm pretty sure the eu does get to tell those people to do or not do things, online or not.

diggan 2y ago

> Most cookies are entirely benign. Many cookies (or something like a cookie) are required for a website to operate normally. The EU law was/is too broad - and has caused the entire world to be annoyed with useless cookie banners. Give reading the actual implementations a try. You'll quickly notice they actually thought of this. I wouldn't say it's "expertly crafted" by any means, but the banner is for a specific "class" of cookies, not just "abc=123" as you seem to think.

Alupis 2y ago
You might try to argue many types of cookies are non-essential - but that would be because you lack experience in this domain. Website operators have a right to study how people use their website just the same as a brick-and-mortar operator has the right to study how customers navigate their store isles. The EU law compels a popup for these types of services/scripts and 99% of people just click through them because they are noise. Lastly - the EU and it's laws don't matter. What are they going to do about non-compliant foreign websites? Nothing.
- diggan 2y ago
  > You might try to argue many types of cookies are non-essential - but that would be because you lack experience in this domain. I'm not arguing anything, read the directives and implementations yourself, then get back to me. While some might lack experience, others seem to lack reading comprehension. That's fine, we can always learn :) > Website operators have a right to study how people use their website In the EU, that depends. As a website operator at a certain scale, you cannot do whatever you want with personal data. > Lastly - the EU and it's laws don't matter. What are they going to do about non-compliant foreign websites? Nothing. Yeah, I mean that's cool and all, but maybe you're spending time discussing in the wrong HN submission then? I don't go around in submissions about "Golang is bad" commentating how you wouldn't have those issues if you didn't use Golang in the first place. Not my idea of curious conversation at all. Obviously EU directives and laws apply in EU
  - Alupis 2y ago