4 ms·

> many compliant EU cookie popups have “only essential cookies” as the least permissive option. It's still an issue that essentially all sites are required* to

by runako 2y ago

> many compliant EU cookie popups have “only essential cookies” as the least permissive option. It's still an issue that essentially all sites are required* to include a cookie banner of some kind. IIRC the EU law even claims jurisdiction over sites in other countries that only serve local audiences, on the notion that an EU national might visit the website. * "Required" here defined as "materially everyone, including the web developers at the EU, interprets the law this way."

diggan 2y ago
> It's still an issue that essentially all sites are required* to include a cookie banner of some kind. Essentially all sites that ship off PII to 3rd party websites or otherwise process PII need to include the cookie banner. They can also chose not to do those things, yet they do figure it's worth adding a cookie banner instead of changing that practice. So in reality, the websites have themselves to blame here.
- lolinder 2y ago
  The websites, as you note, are not the ones who are hurting from the cookie banners, so they're not looking to cast blame anywhere. The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website while still not really having any control over how much tracking is done to them. This is an entirely predictable outcome of the bill as written by virtue of the fact that it did not require websites to respect settings configured at the browser or operating system level. This was a glaring weakness in the law that was pointed out repeatedly at the time.
  - diggan 2y ago
    > The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website How is more choice hurting users? I thought I'd read arguments against user choice on Facebook perhaps, but on Hacker News? Companies are now forced to give users a choice if they process/sell PII. Users can then chose to accept/reject this (if the company implementing the choice as the regulation tells them to), where both choices should be as easy as the other, and if they reject it, the company should follow what the user says. I agree with you though that it's a shame "Do-Not-Track" headers weren't built in into this, since it's already there but poorly supported. But that really should have been a given, as then companies wouldn't have any chance of turning it around. But I'm guessing they lobbied hard against that, and seemingly won.
    - lolinder 2y ago
      It absolutely is hurtful to users to have to make a choice dozens of times every day. We were in a better position before, when users could choose to have their browsers just block cookies if they cared. Now I have my browser block cookies and I still have to respond to a cookie banner on every single website.
      - yjftsjthsd-h 2y ago
        > users could choose to have their browsers just block cookies if they cared 1. That would also block functional cookies. 2. That requires users to know that it's a thing they should care about. It's not cool to spy on people just because they haven't realized what you're doing and taken countermeasures.
        lolinder 2y ago
        Agreed. But I don't think this situation is better—users now know about it but are exhausted by it. Having educated them doesn't help if you've also pounded them into submission.
        jkaplowitz 2y ago
        > Having educated them doesn't help if you've also pounded them into submission. Pounding them into submission also makes their consent legally invalid in many cases, at least by the standard which the GDPR requires. Example GDPR complaint about this problem: https://noyb.eu/en/bereal-app-wont-take-no-answer https://noyb.eu/en/bereal-app-wont-take-no-answer This aspect of the law is more an enforcement issue (including national Data Protection Authorities which have effectively been captured by the companies they are supposed to regulate) than a legislation issue. I'm glad that noyb recently got approved to file something broadly similar to what in the US would be called a class action lawsuit, so that they can do some of the enforcement that the governments won't. Consider donating to them if you want to see proper compliance. They're doing most of the useful enforcement these days. I have no affiliation myself besides also considering making my own donation.
jkaplowitz 2y ago
> It's still an issue that essentially all sites are required* to include a cookie banner of some kind. IIRC the EU law even claims jurisdiction over sites in other countries that only serve local audiences, on the notion that an EU national might visit the website. > > * "Required" here defined as "materially everyone, including the web developers at the EU, interprets the law this way." This is all commonly believed but isn't accurate. The only reason the web developers at the EU (correctly) feel like they need to ask for some kind of consent is because they want to use that consent to process visitors personal data beyond the scope of the essential cookies which I was describing. For cookies within only the essential scope, they wouldn't need consent or a banner at all, unless some law other than the GDPR requires proactive in-your-face disclosure of the fact that cookies are being set at all. The relevant consent doesn't have to be gained through a banner, but at least the EU websites' implementation doesn't involve dark patterns of making it easier to grant consent than refuse it. As for claiming jurisdiction over sites in other countries, a slightly simplified version of the rule in GDPR Article 3 is that they claim jurisdiction over such sites when they are targeting people in the EU, or when they are processing the data in the EU, or when they are an EU company processing the data outside of the EU. They do not claim jurisdiction over foreign sites that only serve foreign audiences, and they even give examples like that in their official guidance. To give one clear example right here: The GDPR does not generally apply to the case where someone in the EU visits a US-based website of a ski resort in the US, not even if they purchase a ticket via the website from the EU. By contrast, if the ski resort sets up a .eu website, translates their site into major EU languages that aren't very common in the US, allows purchasing in euros and via EU-centric payment methods like SEPA bank transfer and other methods specific to various EU countries, and so on, they're clearly targeting people in the EU so then the GDPR would apply. And so much unofficial guidance has inaccurately stated that nationality or citizenship is what determines GDPR rights. The most official sources, and the better unofficial sources, are clear that the location of the data subject matters but not their nationality or citizenship. An EU citizen doesn't get any more GDPR rights while in the US than someone who isn't an EU citizen.
- runako 2y ago
  Edit: making clearer, including text from the law. You inadvertently highlight one of the main issues with the GDPR: unclear guidance. From the "Does the GDPR apply to companies outside of the EU?" page at gdpr.eu: "If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data." Even their explanation is not clear. Notably, it's different from your understanding of whether it would apply. Which: I don't blame you, the law is not explained well anywhere I have seen. And their conclusion of "Not likely. But technically..." is not sufficient as official guidance. What if we go to the law itself? " 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. " Section b doesn't have the carveouts you asserted. Is that exemption in one of the other 98 articles, or an amendment, or elsewhere? Or does it not formally exist? If the hypothetical US ski resort uses e.g. Stripe that allows people to pay in whatever payment mechanisms are common in their countries, does that alone mean I am "targeting" EU residents? What if my billing page allows a customer to select Belgium in the billing address? What if I don't block shipping addresses in the EU? The intent here is not to litigate this to death, but rather to point out that the reason so much of the understanding of the law is contradictory is that the thing itself is complex. People don't want to get sanctioned, and putting cookie banners on sites is a way to prevent sanctions.

by runako 2y ago

diggan 2y ago

> It's still an issue that essentially all sites are required* to include a cookie banner of some kind. Essentially all sites that ship off PII to 3rd party websites or otherwise process PII need to include the cookie banner. They can also chose not to do those things, yet they do figure it's worth adding a cookie banner instead of changing that practice. So in reality, the websites have themselves to blame here.

lolinder 2y ago
The websites, as you note, are not the ones who are hurting from the cookie banners, so they're not looking to cast blame anywhere. The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website while still not really having any control over how much tracking is done to them. This is an entirely predictable outcome of the bill as written by virtue of the fact that it did not require websites to respect settings configured at the browser or operating system level. This was a glaring weakness in the law that was pointed out repeatedly at the time.
- diggan 2y ago
  > The people who are hurting are the users of the internet who suddenly find themselves having to consent to cookies on every single website How is more choice hurting users? I thought I'd read arguments against user choice on Facebook perhaps, but on Hacker News? Companies are now forced to give users a choice if they process/sell PII. Users can then chose to accept/reject this (if the company implementing the choice as the regulation tells them to), where both choices should be as easy as the other, and if they reject it, the company should follow what the user says. I agree with you though that it's a shame "Do-Not-Track" headers weren't built in into this, since it's already there but poorly supported. But that really should have been a given, as then companies wouldn't have any chance of turning it around. But I'm guessing they lobbied hard against that, and seemingly won.
  - lolinder 2y ago
    It absolutely is hurtful to users to have to make a choice dozens of times every day. We were in a better position before, when users could choose to have their browsers just block cookies if they cared. Now I have my browser block cookies and I still have to respond to a cookie banner on every single website.
    - yjftsjthsd-h 2y ago
      > users could choose to have their browsers just block cookies if they cared 1. That would also block functional cookies. 2. That requires users to know that it's a thing they should care about. It's not cool to spy on people just because they haven't realized what you're doing and taken countermeasures.
      - lolinder 2y ago
        Agreed. But I don't think this situation is better—users now know about it but are exhausted by it. Having educated them doesn't help if you've also pounded them into submission.
        jkaplowitz 2y ago
        > Having educated them doesn't help if you've also pounded them into submission. Pounding them into submission also makes their consent legally invalid in many cases, at least by the standard which the GDPR requires. Example GDPR complaint about this problem: https://noyb.eu/en/bereal-app-wont-take-no-answer https://noyb.eu/en/bereal-app-wont-take-no-answer This aspect of the law is more an enforcement issue (including national Data Protection Authorities which have effectively been captured by the companies they are supposed to regulate) than a legislation issue. I'm glad that noyb recently got approved to file something broadly similar to what in the US would be called a class action lawsuit, so that they can do some of the enforcement that the governments won't. Consider donating to them if you want to see proper compliance. They're doing most of the useful enforcement these days. I have no affiliation myself besides also considering making my own donation.

jkaplowitz 2y ago

> It's still an issue that essentially all sites are required* to include a cookie banner of some kind. IIRC the EU law even claims jurisdiction over sites in other countries that only serve local audiences, on the notion that an EU national might visit the website. > > * "Required" here defined as "materially everyone, including the web developers at the EU, interprets the law this way." This is all commonly believed but isn't accurate. The only reason the web developers at the EU (correctly) feel like they need to ask for some kind of consent is because they want to use that consent to process visitors personal data beyond the scope of the essential cookies which I was describing. For cookies within only the essential scope, they wouldn't need consent or a banner at all, unless some law other than the GDPR requires proactive in-your-face disclosure of the fact that cookies are being set at all. The relevant consent doesn't have to be gained through a banner, but at least the EU websites' implementation doesn't involve dark patterns of making it easier to grant consent than refuse it. As for claiming jurisdiction over sites in other countries, a slightly simplified version of the rule in GDPR Article 3 is that they claim jurisdiction over such sites when they are targeting people in the EU, or when they are processing the data in the EU, or when they are an EU company processing the data outside of the EU. They do not claim jurisdiction over foreign sites that only serve foreign audiences, and they even give examples like that in their official guidance. To give one clear example right here: The GDPR does not generally apply to the case where someone in the EU visits a US-based website of a ski resort in the US, not even if they purchase a ticket via the website from the EU. By contrast, if the ski resort sets up a .eu website, translates their site into major EU languages that aren't very common in the US, allows purchasing in euros and via EU-centric payment methods like SEPA bank transfer and other methods specific to various EU countries, and so on, they're clearly targeting people in the EU so then the GDPR would apply. And so much unofficial guidance has inaccurately stated that nationality or citizenship is what determines GDPR rights. The most official sources, and the better unofficial sources, are clear that the location of the data subject matters but not their nationality or citizenship. An EU citizen doesn't get any more GDPR rights while in the US than someone who isn't an EU citizen.

runako 2y ago
Edit: making clearer, including text from the law. You inadvertently highlight one of the main issues with the GDPR: unclear guidance. From the "Does the GDPR apply to companies outside of the EU?" page at gdpr.eu: "If your organization uses web tools that allow you to track cookies or the IP addresses of people who visit your website from EU countries, then you fall under the scope of the GDPR. Practically speaking, it’s unclear how strictly this provision will be interpreted or how brazenly it will be enforced. Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely. But technically you could be held accountable for tracking these data." Even their explanation is not clear. Notably, it's different from your understanding of whether it would apply. Which: I don't blame you, the law is not explained well anywhere I have seen. And their conclusion of "Not likely. But technically..." is not sufficient as official guidance. What if we go to the law itself? " 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. " Section b doesn't have the carveouts you asserted. Is that exemption in one of the other 98 articles, or an amendment, or elsewhere? Or does it not formally exist? If the hypothetical US ski resort uses e.g. Stripe that allows people to pay in whatever payment mechanisms are common in their countries, does that alone mean I am "targeting" EU residents? What if my billing page allows a customer to select Belgium in the billing address? What if I don't block shipping addresses in the EU? The intent here is not to litigate this to death, but rather to point out that the reason so much of the understanding of the law is contradictory is that the thing itself is complex. People don't want to get sanctioned, and putting cookie banners on sites is a way to prevent sanctions.