4 ms·

> never seem to blame the web companies for doing the naughty things on their websites Part of the problem is that the law didn't seek to distinguish between t

> never seem to blame the web companies for doing the naughty things on their websites Part of the problem is that the law didn't seek to distinguish between tame first-party cookies and the really naughty third-party cookies so the burden is equal regardless of how malicious the service is. > For the company, it's a one time JIRA ticket for a junior software engineer to code up a banner. This is actually not true. There's a lot more that goes into a cookie banner than you might realize, and there's now an industry dominated by a small handful of players (Osano vs OneTrust)

Rygian 2y ago
The cookie banner has nothing to do with first -party vs third-party. The cookie banner is required depending on the purpose of the cookies, not the party setting them.
nicce 2y ago
> There's a lot more that goes into a cookie banner than you might realize, and there's now an industry dominated by a small handful of players (Osano vs OneTrust) Isn't this industry for those, who want to share their website data automatically with 100+ partners? For others, who don't really share that much data with others, less relevant.
- legitster 2y ago
  If you are just running a static websites, maybe. But if you are going to run a website with any services on it (video content, eCommerce, member management, etc) you are going to have partners. Establishing a browser session with every single one would be pretty onerous (and honestly much worse for privacy) so a first-party cookie is a pretty good compromise.
  - hnbad 2y ago
    > But if you are going to run a website with any services on it (video content, eCommerce, member management, etc) you are going to have partners. No? At least not in the scale that would require these consent services. Services like member management are literally required to operate the website so those can go into the privacy policy (as would e.g. hosting on AWS or using a CDN). The reason these consent services exist is that a lot of websites are just content mills that operate entire on behavioral advertising, whether it's the web version of a newspaper or just SEO blog spam. These often use hundreds of "partners" for analytics, ads, targeting, re-targeting, etc. And they desperately try to trick visitors into opting into those. For your run of the mill Wordpress website you can just get a plugin like https://devowl.io/wordpress-real-cookie-banner/ https://devowl.io/wordpress-real-cookie-banner/ - and in many cases the free version is good enough.
ffsm8 2y ago
It did though? You don't need a banner for actually legitimate use (session Cookie, settings, etc) The things they're calling legitimate use just isn't, which is why they need banners.
- diggan 2y ago
  I keep seeing this misinformation going around, and it has been going around since almost day 1 of when the directive became known. I'm not sure where it's coming from, or who initially thought it worked like that, but judging by the comments in this submission it seems like a ton of people are very misinformed about how these things actually work.
  - azinman2 2y ago
    So how to these things actually work?
    - 6510 2y ago
      Anything goes as long as it is useful for the user. Funny example: If they chose not to accept your spying cookies you get to set a cookie to store that choice.
      - dkarras 2y ago
        Someone might think: surely seeing ads targeted for them instead of random ads must be useful / beneficial for the user!
        hnbad 2y ago
        The first step is data minimization. The second step is informed and revokable consent. Everything else follows from there. Do targeted ads increase the amount of personal data that needs to be stored and processed and the number of entities that will access it? Yes they do. Are they required for the site to serve its stated purpose? No, unless the site is marketing itself as literally a curated stream of targeted ads. So they require informed and revokable consent (i.e. opt-in). Even if you think they're beneficial to the user. It's not about what's beneficial. It's about what's required. That's why most sites try to group services by categories like "functional", "analytics", etc. If you want to embed a Google Maps view to help people find your physical store, that's beneficial but still requires consent because it shares their data with a third party (i.e. Google) when the browser loads that map. Of course in this case you don't even need a banner, you could just have a placeholder (often called "content blocker") instead of the map with the option to consent to loading the map and storing that decision so the user doesn't have to see the placeholder again.
ryandrake 2y ago
> Part of the problem is that the law didn't seek to distinguish between tame first-party tokens and the really naughty third-party tokens Maybe I'm an outlier, but ideally I don't want them collecting any "tokens" without my consent. I don't care if they're first party or third party or birthday party. I should be able to browse web sites in peace without some company collecting anything. If the web site doesn't work exactly the way I'd expect because I did not provide that consent, then that's on me.
- self_awareness 2y ago
  Well that's a thought everyone can identify with, but objectively speaking, they're paying with their energy to build the website, and paying their money to host it. Yet you would want to browse it for no cost at all. How to resolve this?
  - hnbad 2y ago
    You're framing website use as transactional but for financial transactions we literally require informed consent. Also you seem to be operating under the assumption that your personal data is something that can be used as payment. The GDPR literally does not allow that just as human rights don't allow committing yourself to indentured servitude. You can't sign away your rights. If you share personal data you continue to have rights to that data and can revoke your consent. It doesn't stop being your data just because you handed it over, even if you did so willingly. If your business model can't work without exploiting your users' personal data, your business model no longer works and it's your job to find a new business model that does. There are plenty of business models that only worked when indentured servitude was legal (let's not have the debate about prison labor in the US) and I'm sure you would agree that it's fine for those business models to no longer work. It's part of the risk of doing business. Innovate. Disrupt. Or perish.
- smolder 2y ago
  There is basic non-identifying logging that is almost entirely necessary to operate a website. I assume you're okay with that much?
BiteCode_dev 2y ago
It totally does make the distinction. If you use cookies for auth, no need to disclail it. Better, you don't need a banner even of you do track users for anybody with DNT. So you can offer a seamless experience. They just don't care.
- legitster 2y ago
  > you don't need a banner even of you do track users for anybody with DNT This is not true. The specific text of the law requires that websites have to provide details about their cookies, and then document and store user preferences. If you just honored the DNT, you would still be out of compliance.
jorvi 2y ago
> and there's now an industry dominated by a small handful of players (Osano vs OneTrust) Because of that there are now neat categories of cookies / cookie purposes. Would be nice if we could select one time in our browser “necessary cookies only”, and that would be communicated to every website visited, without the need for a banner. But that’s user friendly and that’s anathema to the modern web :)
consteval 2y ago
> Part of the problem is that the law didn't seek to distinguish between tame first-party cookies and the really naughty third-party cookies so the burden is equal regardless of how malicious the service is. It does, or rather the law doesn't state cookies at all. It has nothing to do with cookies. All the law says is you require informed consent if you want to harvest personal data and use it for tracking. Cookies are a common way to do that. But cookies used for session and whatnot are exempt, because they're not used for tracking. The problem is companies are maliciously compliant.

Rygian 2y ago

The cookie banner has nothing to do with first -party vs third-party. The cookie banner is required depending on the purpose of the cookies, not the party setting them.

nicce 2y ago

> There's a lot more that goes into a cookie banner than you might realize, and there's now an industry dominated by a small handful of players (Osano vs OneTrust) Isn't this industry for those, who want to share their website data automatically with 100+ partners? For others, who don't really share that much data with others, less relevant.

legitster 2y ago
If you are just running a static websites, maybe. But if you are going to run a website with any services on it (video content, eCommerce, member management, etc) you are going to have partners. Establishing a browser session with every single one would be pretty onerous (and honestly much worse for privacy) so a first-party cookie is a pretty good compromise.
- hnbad 2y ago
  > But if you are going to run a website with any services on it (video content, eCommerce, member management, etc) you are going to have partners. No? At least not in the scale that would require these consent services. Services like member management are literally required to operate the website so those can go into the privacy policy (as would e.g. hosting on AWS or using a CDN). The reason these consent services exist is that a lot of websites are just content mills that operate entire on behavioral advertising, whether it's the web version of a newspaper or just SEO blog spam. These often use hundreds of "partners" for analytics, ads, targeting, re-targeting, etc. And they desperately try to trick visitors into opting into those. For your run of the mill Wordpress website you can just get a plugin like https://devowl.io/wordpress-real-cookie-banner/ https://devowl.io/wordpress-real-cookie-banner/ - and in many cases the free version is good enough.

ffsm8 2y ago

It did though? You don't need a banner for actually legitimate use (session Cookie, settings, etc) The things they're calling legitimate use just isn't, which is why they need banners.

diggan 2y ago
I keep seeing this misinformation going around, and it has been going around since almost day 1 of when the directive became known. I'm not sure where it's coming from, or who initially thought it worked like that, but judging by the comments in this submission it seems like a ton of people are very misinformed about how these things actually work.
- azinman2 2y ago
  So how to these things actually work?
  - 6510 2y ago
    Anything goes as long as it is useful for the user. Funny example: If they chose not to accept your spying cookies you get to set a cookie to store that choice.
    - dkarras 2y ago
      Someone might think: surely seeing ads targeted for them instead of random ads must be useful / beneficial for the user!
      - hnbad 2y ago
        The first step is data minimization. The second step is informed and revokable consent. Everything else follows from there. Do targeted ads increase the amount of personal data that needs to be stored and processed and the number of entities that will access it? Yes they do. Are they required for the site to serve its stated purpose? No, unless the site is marketing itself as literally a curated stream of targeted ads. So they require informed and revokable consent (i.e. opt-in). Even if you think they're beneficial to the user. It's not about what's beneficial. It's about what's required. That's why most sites try to group services by categories like "functional", "analytics", etc. If you want to embed a Google Maps view to help people find your physical store, that's beneficial but still requires consent because it shares their data with a third party (i.e. Google) when the browser loads that map. Of course in this case you don't even need a banner, you could just have a placeholder (often called "content blocker") instead of the map with the option to consent to loading the map and storing that decision so the user doesn't have to see the placeholder again.

ryandrake 2y ago

> Part of the problem is that the law didn't seek to distinguish between tame first-party tokens and the really naughty third-party tokens Maybe I'm an outlier, but ideally I don't want them collecting any "tokens" without my consent. I don't care if they're first party or third party or birthday party. I should be able to browse web sites in peace without some company collecting anything. If the web site doesn't work exactly the way I'd expect because I did not provide that consent, then that's on me.

self_awareness 2y ago
Well that's a thought everyone can identify with, but objectively speaking, they're paying with their energy to build the website, and paying their money to host it. Yet you would want to browse it for no cost at all. How to resolve this?
- hnbad 2y ago
  You're framing website use as transactional but for financial transactions we literally require informed consent. Also you seem to be operating under the assumption that your personal data is something that can be used as payment. The GDPR literally does not allow that just as human rights don't allow committing yourself to indentured servitude. You can't sign away your rights. If you share personal data you continue to have rights to that data and can revoke your consent. It doesn't stop being your data just because you handed it over, even if you did so willingly. If your business model can't work without exploiting your users' personal data, your business model no longer works and it's your job to find a new business model that does. There are plenty of business models that only worked when indentured servitude was legal (let's not have the debate about prison labor in the US) and I'm sure you would agree that it's fine for those business models to no longer work. It's part of the risk of doing business. Innovate. Disrupt. Or perish.
smolder 2y ago
There is basic non-identifying logging that is almost entirely necessary to operate a website. I assume you're okay with that much?

BiteCode_dev 2y ago

It totally does make the distinction. If you use cookies for auth, no need to disclail it. Better, you don't need a banner even of you do track users for anybody with DNT. So you can offer a seamless experience. They just don't care.

legitster 2y ago
> you don't need a banner even of you do track users for anybody with DNT This is not true. The specific text of the law requires that websites have to provide details about their cookies, and then document and store user preferences. If you just honored the DNT, you would still be out of compliance.

jorvi 2y ago

> and there's now an industry dominated by a small handful of players (Osano vs OneTrust) Because of that there are now neat categories of cookies / cookie purposes. Would be nice if we could select one time in our browser “necessary cookies only”, and that would be communicated to every website visited, without the need for a banner. But that’s user friendly and that’s anathema to the modern web :)

consteval 2y ago

> Part of the problem is that the law didn't seek to distinguish between tame first-party cookies and the really naughty third-party cookies so the burden is equal regardless of how malicious the service is. It does, or rather the law doesn't state cookies at all. It has nothing to do with cookies. All the law says is you require informed consent if you want to harvest personal data and use it for tracking. Cookies are a common way to do that. But cookies used for session and whatnot are exempt, because they're not used for tracking. The problem is companies are maliciously compliant.