18 ms·

None of those popups are required by European lawmakers. Websites don’t need to ask for permission for the essential cookies like what’s necessary to log into a

None of those popups are required by European lawmakers. Websites don’t need to ask for permission for the essential cookies like what’s necessary to log into an online account or add items to a shopping cart - indeed, many compliant EU cookie popups have “only essential cookies” as the least permissive option. They only need to ask for permission if they want consent for the kind of invasive tracking that the GDPR and related regulations were intended to discourage anyway. And they aren’t required to use popups or banners to get any consent they might need. The popups, and especially the quite probably legally invalid common implementation where granting consent is made easier than refusing it, are a frequently bad-faith attempt by the industry to continue tracking-centric business as fully as possible contrary to the policy intention of the GDPR. They are not a requirement of the law.

f1shy 2y ago
Dont ask me why. But that idiotic pop ups come even in the internal portal in out company… is a disaster. Yes they are not required, but OBVIOUSLY are there to make us crazy and make us click whatever make them disappear faster. An nobody is doing NOTHING after years…
- diggan 2y ago
  > But that idiotic pop ups come even in the internal portal in out company Wow, talk about misunderstanding how that works. I hope it's not a company based within the EU because if they're so clueless about the regulations they have to follow, I'd be confident they're breaking a multitude of other laws (accidentally most likely).
  - f1shy 2y ago
    Yes. Is EU!!! And it drives me crazy. Totally internal page, only seen by employees. Beyond comprehension.
lolinder 2y ago
Legislators don't get to dodge the natural consequences of their legislation. This wasn't an unexpected side effect, it's the only possible outcome of the bill in the world as it actually exists. Laws should not be written for spherical humans, they should be written for the real-world humans who actively circumvent laws where they can get away with it. And when legislation makes the world worse for everyone because it encourages self-interested individuals and companies to act in a way that is annoying or harmful, legislators don't get to dodge responsibility by saying that it's their fault and they should have just done the right thing. We have laws precisely because people can't be counted on to do the right thing.
- natch 2y ago
  Agree, and on topic of Apple, this is also a perfect response to why many of Europe’s regulations against Apple are so bad. Not all of them; I don’t have an issue with requiring the use of one charging cable standard, but the privacy and user safety side effects of the legislated undermining of security cannot be ignored.
  - lolinder 2y ago
    Yes, agreed. Even the title of this piece shows the problem: if Apple isn't meeting the letter of the law, then fine, they need to be punished. But so much of the complaints against Apple are that they're not meeting the spirit of the law, which is a nonsense argument.
- jkaplowitz 2y ago
  I agree that the law could and should be improved. I feel that having the law is still better than not having it, because there is at least a way to know what awful tracking is occurring, a way to decline it, and a way to assert some rights to at least some partial degree of effectiveness. There is a basis from which to improve the law, instead of having to start from scratch.
- frail_figure 2y ago
  Don’t collect PII -> don’t show cookie banners. It really is that simple. You don’t need your visitor’s PII. You don’t deserve it “just because”. The visitor does deserve to choose if they want to consent to it.
natch 2y ago
If Europe is so brilliant at creating wonderful regulations they should make these popups illegal.
- icetank 2y ago
  They are. Pop-ups to allow consent are required to be small enough so usability of the site is not impaired as long as the user has not decided yet. Websites just gamble on the fact that any extra profits they make offset the cost of fines. Or that no entiry reports miss use in the first place.
  - jkaplowitz 2y ago
    > Pop-ups to allow consent are required to be small enough so usability of the site is not impaired as long as the user has not decided yet. I believe you, but can you share the cite for that? Other commenters have implied that it's not true, and I'd like to have the evidence available when I reply to them.
  - thayne 2y ago
    That's rather subjective though. I can argue that any popup impairs the useability of the site, a site owner can argue a popup thay takes up half the screen doesn't, because the site is still useable with it.
runako 2y ago
> many compliant EU cookie popups have “only essential cookies” as the least permissive option. It's still an issue that essentially all sites are required* to include a cookie banner of some kind. IIRC the EU law even claims jurisdiction over sites in other countries that only serve local audiences, on the notion that an EU national might visit the website. * "Required" here defined as "materially everyone, including the web developers at the EU, interprets the law this way."
- diggan 2y ago
  > It's still an issue that essentially all sites are required* to include a cookie banner of some kind. Essentially all sites that ship off PII to 3rd party websites or otherwise process PII need to include the cookie banner. They can also chose not to do those things, yet they do figure it's worth adding a cookie banner instead of changing that practice. So in reality, the websites have themselves to blame here.
  - lolinder 2y ago
    The websites, as you note, are not the ones who are hurting from the cookie banners, so they're not looking to cast blame anywhere. The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website while still not really having any control over how much tracking is done to them. This is an entirely predictable outcome of the bill as written by virtue of the fact that it did not require websites to respect settings configured at the browser or operating system level. This was a glaring weakness in the law that was pointed out repeatedly at the time.
    - diggan 2y ago
      > The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website How is more choice hurting users? I thought I'd read arguments against user choice on Facebook perhaps, but on Hacker News? Companies are now forced to give users a choice if they process/sell PII. Users can then chose to accept/reject this (if the company implementing the choice as the regulation tells them to), where both choices should be as easy as the other, and if they reject it, the company should follow what the user says. I agree with you though that it's a shame "Do-Not-Track" headers weren't built in into this, since it's already there but poorly supported. But that really should have been a given, as then companies wouldn't have any chance of turning it around. But I'm guessing they lobbied hard against that, and seemingly won.
ruthmarx 2y ago
> They only need to ask for permission if they want consent for the kind of invasive tracking that the GDPR and related regulations were intended to discourage anyway. This is exactly the problem, and exactly why the EU is to blame for those popups. Instead of outlawing a behavior they had a problem with, they are trying ti discourage it. The way they try to discourage it is why we have all these stupid popups.
- wizzwizz4 2y ago
  They did outlaw it. The GDPR's definition of "consent" makes these popups illegal.
  - ruthmarx 2y ago
    That's not true at all. Most cookie popups are compliant with GDPR - they're still annoying.
    - jkaplowitz 2y ago
      The vast majority that I see give you an easy button on the first screen to grant consent, but then hide the option to refuse consent on a second screen behind something like "manage preferences". That dark pattern is not compliant with GDPR.
      - ruthmarx 2y ago
        I would say the most I see have accept, reject and manage preferences as buttons, normally with manage preferences being a link rather than a button. The dark pattern you describe isn't on any big business websites for example. Out of curiosity, you mean against the spirit of the GDPR rather than the letter of it, right?
        wizzwizz4 2y ago
        The spirit, and the letter too. (It's quite a well-written law.) Article 7, "Conditions for consent": > 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

f1shy 2y ago

Dont ask me why. But that idiotic pop ups come even in the internal portal in out company… is a disaster. Yes they are not required, but OBVIOUSLY are there to make us crazy and make us click whatever make them disappear faster. An nobody is doing NOTHING after years…

diggan 2y ago
> But that idiotic pop ups come even in the internal portal in out company Wow, talk about misunderstanding how that works. I hope it's not a company based within the EU because if they're so clueless about the regulations they have to follow, I'd be confident they're breaking a multitude of other laws (accidentally most likely).
- f1shy 2y ago
  Yes. Is EU!!! And it drives me crazy. Totally internal page, only seen by employees. Beyond comprehension.

lolinder 2y ago

Legislators don't get to dodge the natural consequences of their legislation. This wasn't an unexpected side effect, it's the only possible outcome of the bill in the world as it actually exists. Laws should not be written for spherical humans, they should be written for the real-world humans who actively circumvent laws where they can get away with it. And when legislation makes the world worse for everyone because it encourages self-interested individuals and companies to act in a way that is annoying or harmful, legislators don't get to dodge responsibility by saying that it's their fault and they should have just done the right thing. We have laws precisely because people can't be counted on to do the right thing.

natch 2y ago
Agree, and on topic of Apple, this is also a perfect response to why many of Europe’s regulations against Apple are so bad. Not all of them; I don’t have an issue with requiring the use of one charging cable standard, but the privacy and user safety side effects of the legislated undermining of security cannot be ignored.
- lolinder 2y ago
  Yes, agreed. Even the title of this piece shows the problem: if Apple isn't meeting the letter of the law, then fine, they need to be punished. But so much of the complaints against Apple are that they're not meeting the spirit of the law, which is a nonsense argument.
jkaplowitz 2y ago
I agree that the law could and should be improved. I feel that having the law is still better than not having it, because there is at least a way to know what awful tracking is occurring, a way to decline it, and a way to assert some rights to at least some partial degree of effectiveness. There is a basis from which to improve the law, instead of having to start from scratch.
frail_figure 2y ago
Don’t collect PII -> don’t show cookie banners. It really is that simple. You don’t need your visitor’s PII. You don’t deserve it “just because”. The visitor does deserve to choose if they want to consent to it.

natch 2y ago

If Europe is so brilliant at creating wonderful regulations they should make these popups illegal.

icetank 2y ago
They are. Pop-ups to allow consent are required to be small enough so usability of the site is not impaired as long as the user has not decided yet. Websites just gamble on the fact that any extra profits they make offset the cost of fines. Or that no entiry reports miss use in the first place.
- jkaplowitz 2y ago
  > Pop-ups to allow consent are required to be small enough so usability of the site is not impaired as long as the user has not decided yet. I believe you, but can you share the cite for that? Other commenters have implied that it's not true, and I'd like to have the evidence available when I reply to them.
- thayne 2y ago
  That's rather subjective though. I can argue that any popup impairs the useability of the site, a site owner can argue a popup thay takes up half the screen doesn't, because the site is still useable with it.

runako 2y ago

> many compliant EU cookie popups have “only essential cookies” as the least permissive option. It's still an issue that essentially all sites are required* to include a cookie banner of some kind. IIRC the EU law even claims jurisdiction over sites in other countries that only serve local audiences, on the notion that an EU national might visit the website. * "Required" here defined as "materially everyone, including the web developers at the EU, interprets the law this way."

diggan 2y ago
> It's still an issue that essentially all sites are required* to include a cookie banner of some kind. Essentially all sites that ship off PII to 3rd party websites or otherwise process PII need to include the cookie banner. They can also chose not to do those things, yet they do figure it's worth adding a cookie banner instead of changing that practice. So in reality, the websites have themselves to blame here.
- lolinder 2y ago
  The websites, as you note, are not the ones who are hurting from the cookie banners, so they're not looking to cast blame anywhere. The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website while still not really having any control over how much tracking is done to them. This is an entirely predictable outcome of the bill as written by virtue of the fact that it did not require websites to respect settings configured at the browser or operating system level. This was a glaring weakness in the law that was pointed out repeatedly at the time.
  - diggan 2y ago
    > The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website How is more choice hurting users? I thought I'd read arguments against user choice on Facebook perhaps, but on Hacker News? Companies are now forced to give users a choice if they process/sell PII. Users can then chose to accept/reject this (if the company implementing the choice as the regulation tells them to), where both choices should be as easy as the other, and if they reject it, the company should follow what the user says. I agree with you though that it's a shame "Do-Not-Track" headers weren't built in into this, since it's already there but poorly supported. But that really should have been a given, as then companies wouldn't have any chance of turning it around. But I'm guessing they lobbied hard against that, and seemingly won.

ruthmarx 2y ago

> They only need to ask for permission if they want consent for the kind of invasive tracking that the GDPR and related regulations were intended to discourage anyway. This is exactly the problem, and exactly why the EU is to blame for those popups. Instead of outlawing a behavior they had a problem with, they are trying ti discourage it. The way they try to discourage it is why we have all these stupid popups.

wizzwizz4 2y ago
They did outlaw it. The GDPR's definition of "consent" makes these popups illegal.
- ruthmarx 2y ago
  That's not true at all. Most cookie popups are compliant with GDPR - they're still annoying.
  - jkaplowitz 2y ago
    The vast majority that I see give you an easy button on the first screen to grant consent, but then hide the option to refuse consent on a second screen behind something like "manage preferences". That dark pattern is not compliant with GDPR.
    - ruthmarx 2y ago
      I would say the most I see have accept, reject and manage preferences as buttons, normally with manage preferences being a link rather than a button. The dark pattern you describe isn't on any big business websites for example. Out of curiosity, you mean against the spirit of the GDPR rather than the letter of it, right?
      - wizzwizz4 2y ago
        The spirit, and the letter too. (It's quite a well-written law.) Article 7, "Conditions for consent": > 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.