7 ms·

This mindset is how we got those awful cookie banners. Even more dialogs that most users will blindly tap "Allow" to will not fix the problem. Society has col

by mvkel 2y ago

This mindset is how we got those awful cookie banners. Even more dialogs that most users will blindly tap "Allow" to will not fix the problem. Society has collectively decided (spiritually) that it is ok signing over data access rights to third parties. Adding friction to this punishes 98% of people in service of the 2% who aren't going to use these services anyway. Sure, a more educated populous might tip the scales. But it's not reality, and the best UX reflects reality.

timeon 2y ago
Better to have cookie banners than made-up 'collective decision'.
RedComet 2y ago
The cookie banners are an example of malicious compliance.
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
myspy 2y ago
I always click disallow. And if you design software that uses tracking and what not. Go fuck yourself.
PittleyDunkin 2y ago
[flagged]
diggan 2y ago
> This mindset is how we got those awful cookie banners. The only thing I've found awful is the mindset of the people implementing the banners. That you feel frustration over that every company has a cookie banner, is exactly the goal. The companies could decide that it isn't worth frustrating the user over something trivial like website analytics, as they could get that without having to show a cookie banner at all. But no, they want all the data, even though they most likely don't use all of it, and therefore are forced to show the cookie banner. Then you as a user see that banner, and instead of thinking "What a shitty company that don't even do the minimal work to not having to show me the cookie banner", you end up thinking "What a bad law forcing the company to inform me about what they do with my data". Sounds so backwards, but you're not the first with this sentiment, so the PR departments of the companies seems like they've succeed in re-pointing the blame...
- necovek 2y ago
  Seconded: and we need to have worthy competitors spring up without those bad practices and lousy cookie banners, and people to flock to them. Once that happens, the "originals" will feel the pressure.
  - bevan 2y ago
    Not using those “bad practices” of third party analytics can be an existential threat to small businesses, unfortunately.
    - diggan 2y ago
      Not really. You can still get metrics and analytics, you just don't include PII in it. There are tons of privacy-respecting platforms/services (both self-hosted and not) you can use, instead of just slapping Google Analytics on the website and having to show the banner. But even so, I'd argue that since it's a small business, you'd do much better with qualitative data rather than quantitative, since it's a small business it's hard to make choices based on small amount of data. Instead, conduct user experience studies with real people, and you'll get a ton of valuable data. All without cookie banners :)
  - sweeter 2y ago
    one must ask themselves, "why?", this never happens lol.
- zo1 2y ago
  In my experience, most people that have semi or full decision-making control over this kind of thing have absolutely no idea if they even need cookie consent banners. They just fall for the marketing speak of every single SAAS product that sells cookie-consent/GDPR stuff and err on the side of caution. No one wants to be the guy that says: "hey, we're only logging X, Y and not Z. And GDPR says we need consent only if we log Z, so therefore we don't need cookie consent." For starters, they need a lawyer to tell them it's "A OK" to do it this way, and secondly it's plain old cheaper and a lot less political capital to just go with the herd on this. The cost of the banner is off-loaded outside of the company and, for the time being, the users don't seem to mind or care. This is why half the web has cookie-consent banners. No amount of developers who know the details screaming up the ladder will fix this. The emergent behavior put in place by the legal profession and corporate politics favors the SAAS companies that sell GDPR cookie banner products and libraries. Even if they're in the right, there is a greater-than-zero percent chance that if they do the wrong thing they'll go to court or be forced to defend themselves. And even then if it's successful, the lawyers still need to be paid, and the company will look at "that fucking moron Joe from the website department" which caused all their hassles and countless hours of productivity as a result of being a "smart ass".
necovek 2y ago
Nope, collective indifference to subpar user experiences has gotten us those lousy cookie banners. Web sites could legally use cookies for non-tracking purposes without cookie banners but considering people have not stopped visiting sites despite the fugly click-through cookie banners makes them a failure. All it takes is for 50% of the internet users to stop visiting web sites with them, and web site authors will stop tracking users with external cookies.
- chickenfeed 2y ago
  I read an article that said something along the lines of people aren't prepared to pay for apps, so instead we get app store silo advert supported crap-ware. And if it's not the apps its click bait making fractional gains by being supported by ad networks. That some of, but not all of us recoil from.
- GlacierFox 2y ago
  "All it takes is for 50% of the internet users to stop visiting web sites with them..." You've written that like it's a plausible and likely scenario.
  - xp84 2y ago
    Yeah, this is an insane proposal. I know GP may be imagining a smart populace walking away from Big Evil Facebook and X with heads held high, but the other 99% of sites are also doing the same cookie banner stupidity because it is roughly mandatory due to useless EU law (unless you’re not engaging at all in advertising even as an advertiser). So, no more accessing your bank, power utility, doctor, college, etc. That’ll show those pesky cookie banner people! “The Internet” to someone boycotting cookie banners would basically just be a few self-hosted blogs.
    - necovek 2y ago
      I am happy to learn what I may have been imagining: thanks for that! The law has turned out to be useless, agreed — or at least, it has driven hard-to-navigate UX that we live through today. The intent could have taken us in a different direction with some care (i.e. mandating a clear, no-dark-pattern opt-out/opt-in ahead-of-time option a la DoNotTrack header that similarly failed): if web clients (browsers) were required to pass visitor's preferences and if the list of shared-with was mandated to be machine readable with an exact format (so browsers would create nice UIs), maybe we'd get somewhere.
2Gkashmiri 2y ago
I use Firefox focus on android and Firefox with ubo and others.. On desktop and Firefox app, I only browse through private browsing so cookies are mostly irrelevant as session ends as soon as all windows close.
- kQq9oHeAz6wLLS 2y ago
  But you're an edge case, and an extreme one at that.
csomar 2y ago
No. A significant number of people care about Privacy which is why 1. Apply was targeting them with Ads and 2. AdBlock did hurt Google's business. Also care is different from go to war (as in install Linux and manually setup a privacy shield + Tor + only transact in Monero). Some people do that out of principal. Many people want the Privacy features but with the ease of use.
- mvkel 2y ago
  Define "significant," and do you have a source? I'd bet if you ask people "do you care about privacy?" Close to 100% would say yes. If you ask "you have to give up privacy to be able to log in to your email automatically. Are you ok with that?" Close to 100% would say yes. If you ask "we will give you this email service for free but in exchange we get to squeeze every ounce of juice that we can out of it to persuade you to buy things you don't need. Are you ok with that?" Close to 100% would say yes. It doesn't matter what people say they care about. Their actions say otherwise, if the privacy-friendly option is in any way less convenient.
  - robertlagrant 2y ago
    Sometimes I think the real power of Gmail is the Log In With Google button.
nfriedly 2y ago
u-Block Origin's annoyances filters take care of the cookie banners, giving the best of both worlds: no banners and a minimal amount of tracking. (The "I don't care about cookies" extension is similarly effective, but since I'm already running u-block origin, it makes more sense to me to enable it's filter.)
- diggan 2y ago
  > u-Block Origin's annoyances filters take care of the cookie banners, giving the best of both worlds: no banners and a minimal amount of tracking. Word of caution though, that might silently break some websites. I've lost count of the times some HTTP request silently failed because you weren't meant to be able to get some part of the website, without first rejecting/accepting the 3rd party cookies. Usually, disabling uBlock, rejecting/accepting the cookies and then enabling it again solves the problem. But the first time it happened, it kind of caught me by surprise, because why in holy hell would you validate those somehow?!
  - nicbou 2y ago
    This happens to me albeit pretty rarely. This tells me that the website doesn’t respect or understand GDPR.
andrepd 2y ago
Not really. A mandatory opt-in option at the browser level would be the correct way to do it, but legislation forced instead those cookie banners onto the webpage.
- elondaits 2y ago
  No, legislation (the GDPR) doesn’t say anything about cookie pop ups. It says that private data (or any kind) can only be used with opt in consent, given freely, with no strings attached, with the ability to be withdrawn, that it will be kept secure, deleted when not needed for the original purpose, etc. All very reasonable stuff. Tracking cookies are affected, but the legislation covers all private data (IP, email address, your location, etc) … And if Browsers agreed on a standard to get and withdraw opt-in consent, it would be compatible with what the legislation requires.
jchw 2y ago
Actually, if my mindset were leading, we wouldn't have cookie consent banners because we would've just banned non-essential tracking altogether.
- hn3er1q 2y ago
  Now we just have to define what’s “essential” and how to identify it, across states, countries and jurisdictions. Should be easy. ;)
  - pbhjpbhj 2y ago
    How about this: 'Nothing is essential until you prove it is' - apply to the cookie ombudsman for €1k to make your case for allowance. You complete a detailed form including giving your company registration and the reason for use of each cookie. You list each company with access. You pay into escrow €10 per user per company (eg 10 users, sending data to 1200 companies; 120000€) you wish to gather/keep data on, providing that users details and an annual fee. Any non trivial infringement and you get DNS blocklisted, the escrow money is paid out, CEO of the registered company is fined one years income (max of last 4 years) and legal proceedings are started against the company and its executives. On application to the cookie ombudsman I can see all companies who legally have access to my data (and via which gateway company), I can withdraw access, they can withdraw service.
  - jchw 2y ago
    We already did this for cookie consent so apparently it's possible.
no_wizard 2y ago
I’m spitballing here but wouldn’t another way to handle it would be to return dummy / null responses by redirecting telemetry calls to something that will do so? This would have the added benefit of being configurable and work on a bunch of apps instead of just one at a time too
gameman144 2y ago
With cookie banners, legislation said that every website needed to ask for consent -- a thousand sites, a thousand banners. Operating system level controls, though, provide a single control plane. One can very easily imagine OS-level toggles per application of: [No Internet, No Internet outside your own app-sandbox, Ask me every time, Everything is allowed]. No opt in from apps required -- they might break if the network is disabled, but the user is still in control of their data.
khana 2y ago
[dead]
nazcan 2y ago
I think it's clear that users should be able to have their own agents that make these decisions. If you want an agent that always defers to you and asks about Internet access, great. If you want one that accepts it all great. If you want one that uses some fancy logic, great.
AgentOrange1234 2y ago
Why does it have to be more friction? Users had a global way to signal “do not track me” in their browser. I don’t know why regulators didn’t mandate respecting that instead of cookie consent popups. Apple IDs could easily have global settings about what you are comfortable with, and then have their apps respect them.
antoniojtorres 2y ago
This string of unprovable assumptions is not how you do things.
consteval 2y ago
I think society has collectively "decided" in the same way they "decided" smoking in a restaurant is great. There's little to no conscious choice in this. But there is a lot of money in this. Like... a LOT of money. If I were to try to influence society to be okay with it, it would be a no brainer. So, to me, it's obvious that society has been brainwashed and propagandized to accept it. But doing so generates hundreds of billions if not trillions of dollars. How, exactly, such manipulation is done is unknown to me. Probably meticulously, over the course of decades if not centuries. I know that the concept of privacy during the writing of the constitution was much, much more stringent than it was in the 70s, which is much more stringent than it is today. But, I am very confident it is happening.
- fsflover 2y ago
  The connection with smoking is real here indeed: https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/09.24.20%20CPC%20Witness%20Testimony_Kendall.pdf https://energycommerce.house.gov/sites/democrats.energycomme...

by mvkel 2y ago

timeon 2y ago

Better to have cookie banners than made-up 'collective decision'.

RedComet 2y ago

The cookie banners are an example of malicious compliance.

deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

myspy 2y ago

I always click disallow. And if you design software that uses tracking and what not. Go fuck yourself.

PittleyDunkin 2y ago

[flagged]

diggan 2y ago

> This mindset is how we got those awful cookie banners. The only thing I've found awful is the mindset of the people implementing the banners. That you feel frustration over that every company has a cookie banner, is exactly the goal. The companies could decide that it isn't worth frustrating the user over something trivial like website analytics, as they could get that without having to show a cookie banner at all. But no, they want all the data, even though they most likely don't use all of it, and therefore are forced to show the cookie banner. Then you as a user see that banner, and instead of thinking "What a shitty company that don't even do the minimal work to not having to show me the cookie banner", you end up thinking "What a bad law forcing the company to inform me about what they do with my data". Sounds so backwards, but you're not the first with this sentiment, so the PR departments of the companies seems like they've succeed in re-pointing the blame...

necovek 2y ago
Seconded: and we need to have worthy competitors spring up without those bad practices and lousy cookie banners, and people to flock to them. Once that happens, the "originals" will feel the pressure.
- bevan 2y ago
  Not using those “bad practices” of third party analytics can be an existential threat to small businesses, unfortunately.
  - diggan 2y ago
    Not really. You can still get metrics and analytics, you just don't include PII in it. There are tons of privacy-respecting platforms/services (both self-hosted and not) you can use, instead of just slapping Google Analytics on the website and having to show the banner. But even so, I'd argue that since it's a small business, you'd do much better with qualitative data rather than quantitative, since it's a small business it's hard to make choices based on small amount of data. Instead, conduct user experience studies with real people, and you'll get a ton of valuable data. All without cookie banners :)
- sweeter 2y ago
  one must ask themselves, "why?", this never happens lol.
zo1 2y ago
In my experience, most people that have semi or full decision-making control over this kind of thing have absolutely no idea if they even need cookie consent banners. They just fall for the marketing speak of every single SAAS product that sells cookie-consent/GDPR stuff and err on the side of caution. No one wants to be the guy that says: "hey, we're only logging X, Y and not Z. And GDPR says we need consent only if we log Z, so therefore we don't need cookie consent." For starters, they need a lawyer to tell them it's "A OK" to do it this way, and secondly it's plain old cheaper and a lot less political capital to just go with the herd on this. The cost of the banner is off-loaded outside of the company and, for the time being, the users don't seem to mind or care. This is why half the web has cookie-consent banners. No amount of developers who know the details screaming up the ladder will fix this. The emergent behavior put in place by the legal profession and corporate politics favors the SAAS companies that sell GDPR cookie banner products and libraries. Even if they're in the right, there is a greater-than-zero percent chance that if they do the wrong thing they'll go to court or be forced to defend themselves. And even then if it's successful, the lawyers still need to be paid, and the company will look at "that fucking moron Joe from the website department" which caused all their hassles and countless hours of productivity as a result of being a "smart ass".

necovek 2y ago

Nope, collective indifference to subpar user experiences has gotten us those lousy cookie banners. Web sites could legally use cookies for non-tracking purposes without cookie banners but considering people have not stopped visiting sites despite the fugly click-through cookie banners makes them a failure. All it takes is for 50% of the internet users to stop visiting web sites with them, and web site authors will stop tracking users with external cookies.

chickenfeed 2y ago
I read an article that said something along the lines of people aren't prepared to pay for apps, so instead we get app store silo advert supported crap-ware. And if it's not the apps its click bait making fractional gains by being supported by ad networks. That some of, but not all of us recoil from.
GlacierFox 2y ago
"All it takes is for 50% of the internet users to stop visiting web sites with them..." You've written that like it's a plausible and likely scenario.
- xp84 2y ago
  Yeah, this is an insane proposal. I know GP may be imagining a smart populace walking away from Big Evil Facebook and X with heads held high, but the other 99% of sites are also doing the same cookie banner stupidity because it is roughly mandatory due to useless EU law (unless you’re not engaging at all in advertising even as an advertiser). So, no more accessing your bank, power utility, doctor, college, etc. That’ll show those pesky cookie banner people! “The Internet” to someone boycotting cookie banners would basically just be a few self-hosted blogs.
  - necovek 2y ago
    I am happy to learn what I may have been imagining: thanks for that! The law has turned out to be useless, agreed — or at least, it has driven hard-to-navigate UX that we live through today. The intent could have taken us in a different direction with some care (i.e. mandating a clear, no-dark-pattern opt-out/opt-in ahead-of-time option a la DoNotTrack header that similarly failed): if web clients (browsers) were required to pass visitor's preferences and if the list of shared-with was mandated to be machine readable with an exact format (so browsers would create nice UIs), maybe we'd get somewhere.

2Gkashmiri 2y ago

I use Firefox focus on android and Firefox with ubo and others.. On desktop and Firefox app, I only browse through private browsing so cookies are mostly irrelevant as session ends as soon as all windows close.

kQq9oHeAz6wLLS 2y ago
But you're an edge case, and an extreme one at that.

csomar 2y ago

No. A significant number of people care about Privacy which is why 1. Apply was targeting them with Ads and 2. AdBlock did hurt Google's business. Also care is different from go to war (as in install Linux and manually setup a privacy shield + Tor + only transact in Monero). Some people do that out of principal. Many people want the Privacy features but with the ease of use.

mvkel 2y ago
Define "significant," and do you have a source? I'd bet if you ask people "do you care about privacy?" Close to 100% would say yes. If you ask "you have to give up privacy to be able to log in to your email automatically. Are you ok with that?" Close to 100% would say yes. If you ask "we will give you this email service for free but in exchange we get to squeeze every ounce of juice that we can out of it to persuade you to buy things you don't need. Are you ok with that?" Close to 100% would say yes. It doesn't matter what people say they care about. Their actions say otherwise, if the privacy-friendly option is in any way less convenient.
- robertlagrant 2y ago
  Sometimes I think the real power of Gmail is the Log In With Google button.

nfriedly 2y ago

u-Block Origin's annoyances filters take care of the cookie banners, giving the best of both worlds: no banners and a minimal amount of tracking. (The "I don't care about cookies" extension is similarly effective, but since I'm already running u-block origin, it makes more sense to me to enable it's filter.)

diggan 2y ago
> u-Block Origin's annoyances filters take care of the cookie banners, giving the best of both worlds: no banners and a minimal amount of tracking. Word of caution though, that might silently break some websites. I've lost count of the times some HTTP request silently failed because you weren't meant to be able to get some part of the website, without first rejecting/accepting the 3rd party cookies. Usually, disabling uBlock, rejecting/accepting the cookies and then enabling it again solves the problem. But the first time it happened, it kind of caught me by surprise, because why in holy hell would you validate those somehow?!
- nicbou 2y ago
  This happens to me albeit pretty rarely. This tells me that the website doesn’t respect or understand GDPR.

andrepd 2y ago

Not really. A mandatory opt-in option at the browser level would be the correct way to do it, but legislation forced instead those cookie banners onto the webpage.

elondaits 2y ago
No, legislation (the GDPR) doesn’t say anything about cookie pop ups. It says that private data (or any kind) can only be used with opt in consent, given freely, with no strings attached, with the ability to be withdrawn, that it will be kept secure, deleted when not needed for the original purpose, etc. All very reasonable stuff. Tracking cookies are affected, but the legislation covers all private data (IP, email address, your location, etc) … And if Browsers agreed on a standard to get and withdraw opt-in consent, it would be compatible with what the legislation requires.

jchw 2y ago

Actually, if my mindset were leading, we wouldn't have cookie consent banners because we would've just banned non-essential tracking altogether.

hn3er1q 2y ago
Now we just have to define what’s “essential” and how to identify it, across states, countries and jurisdictions. Should be easy. ;)
- pbhjpbhj 2y ago
  How about this: 'Nothing is essential until you prove it is' - apply to the cookie ombudsman for €1k to make your case for allowance. You complete a detailed form including giving your company registration and the reason for use of each cookie. You list each company with access. You pay into escrow €10 per user per company (eg 10 users, sending data to 1200 companies; 120000€) you wish to gather/keep data on, providing that users details and an annual fee. Any non trivial infringement and you get DNS blocklisted, the escrow money is paid out, CEO of the registered company is fined one years income (max of last 4 years) and legal proceedings are started against the company and its executives. On application to the cookie ombudsman I can see all companies who legally have access to my data (and via which gateway company), I can withdraw access, they can withdraw service.
- jchw 2y ago
  We already did this for cookie consent so apparently it's possible.

no_wizard 2y ago

I’m spitballing here but wouldn’t another way to handle it would be to return dummy / null responses by redirecting telemetry calls to something that will do so? This would have the added benefit of being configurable and work on a bunch of apps instead of just one at a time too

gameman144 2y ago

With cookie banners, legislation said that every website needed to ask for consent -- a thousand sites, a thousand banners. Operating system level controls, though, provide a single control plane. One can very easily imagine OS-level toggles per application of: [No Internet, No Internet outside your own app-sandbox, Ask me every time, Everything is allowed]. No opt in from apps required -- they might break if the network is disabled, but the user is still in control of their data.

khana 2y ago

[dead]

nazcan 2y ago

I think it's clear that users should be able to have their own agents that make these decisions. If you want an agent that always defers to you and asks about Internet access, great. If you want one that accepts it all great. If you want one that uses some fancy logic, great.

AgentOrange1234 2y ago

Why does it have to be more friction? Users had a global way to signal “do not track me” in their browser. I don’t know why regulators didn’t mandate respecting that instead of cookie consent popups. Apple IDs could easily have global settings about what you are comfortable with, and then have their apps respect them.

antoniojtorres 2y ago

This string of unprovable assumptions is not how you do things.

consteval 2y ago

I think society has collectively "decided" in the same way they "decided" smoking in a restaurant is great. There's little to no conscious choice in this. But there is a lot of money in this. Like... a LOT of money. If I were to try to influence society to be okay with it, it would be a no brainer. So, to me, it's obvious that society has been brainwashed and propagandized to accept it. But doing so generates hundreds of billions if not trillions of dollars. How, exactly, such manipulation is done is unknown to me. Probably meticulously, over the course of decades if not centuries. I know that the concept of privacy during the writing of the constitution was much, much more stringent than it was in the 70s, which is much more stringent than it is today. But, I am very confident it is happening.

fsflover 2y ago
The connection with smoking is real here indeed: https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/09.24.20%20CPC%20Witness%20Testimony_Kendall.pdf https://energycommerce.house.gov/sites/democrats.energycomme...