6 ms·

> I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they s

> I have a rather draconian idea - websites and apps should be explicitly required to ask permission when they send your data somewhere to tell you where they send your data and who will get to see it, store it, and with what conditions. Oh good, another pop-up dialog no one will read that will be added to every site. Hopefully if something horrible like this is done, just shoving it in the privacy policy or terms of use will suffice, because no one will read it regardless. I have my own draconian idea: no more performative regulations which are so poorly designed that they are basically impossible to meaningfully enforce. This stuff just leads to a lot of wasteful, performative compliance without delivering any actual benefits.

dijksterhuis 2y ago
> Oh good, another pop-up dialog no one will read that will be added to every site. > no one i go through every cookie pop up and manually reject all permissions. especially objecting to legitimate interest. i actually enjoy it. i find it satisfying saying no to a massive list of companies. the number of people who read these things is definitely not 0. my question to you is, why does compliance with regulation make you so … irritated? you don’t think it serves a purpose. but it does. there’s an incongruity there.
- jampekka 2y ago
  At least my irritation comes from the increasing amount of "consents" and "agreements" that are obviously not designed to be read, let alone understood. Not only cookie nags, but things like EULAs and ToS and privacy policies. And they are often not even legally valid. It's all a performative sharade of "voluntary contracts", which are in practice just forced down people's throats due to power inbalances.
  - TeMPOraL 2y ago
    Yes, but how much can you blame this on regulation, where the regulatory intent is clear, and it's the industry that collectively chose to engage in malicious compliance?
    - jampekka 2y ago
      If the regulation has unworkable enforcement system, the regulation is to blame. E.g. that while around 2% want to be tracked while the majority is tracked is clearly a catastrophic failure in the design of the regulation. For the case of nags, something like a legally mandated respect of DNT would have solved the problem, at least on the UI level. Instead now it's a cat and mouse game with dark patterns obviously against the spirit of the law, where some Irish judge bends over backwards to find loopholes.
  - dijksterhuis 2y ago
    IANAL > EULAs and ToS often seems to be liability protection for the service provider for the service provider/company. “when we were made aware of these account we immediately removed them from the service for a breach of the ToS”. ring any bells from any news articles? basically, “please don’t take us to court and sue us for everything users might do with our software. thanks.” > privacy policies consumer protection. don’t sell my phone number to direct marketing companies without me explicitly saying you can do so, or without you explicitly saying you will do so. this is being enforced: * https://ico.org.uk/action-weve-taken/enforcement/quick-tax-claims-limited-en/ https://ico.org.uk/action-weve-taken/enforcement/quick-tax-c... * https://ico.org.uk/action-weve-taken/enforcement/bonne-terre-limited/ https://ico.org.uk/action-weve-taken/enforcement/bonne-terre... more complete list: https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/ — like, yeah, these are not perfect. and they are sometimes frustrating to deal with, for everyone on either side of the agreement. and figuring out someone has done something against one of these agreements is sometimes impossible. but it is better than having nothing. don’t let perfect be the enemy of good.
    - jampekka 2y ago
      There are also things like mandatory arbitration, bans of reverse engineering, handover of copyrights and personal information etc etc hidden in the ToSs and EULAs and privacy policies (or in byzantine nagboxes). Often not even legally enforceable, but how many want to go to court with some megacorporation with the risk of having to pay huge legal fees? The terms should be in law, not by whatever some lawyer army cooked up, whenever applicable and the enforcement should be done by public authorities. And proposing legally unenforceable clauses in ToS and EULAs should be criminalized. They are essentially fraud.
- amelius 2y ago
  I always have the feeling companies keep nagging me until I check the right boxes. Or that even if I explicitly say "no", then at some point they quietly change my settings to "yes" and I have no way of proving that wasn't what I said.
- jaredklewis 2y ago
  Why does it irritate me? Because I genuinely care about things like user privacy and I wish we had regulations which were actually well designed to achieve their goals. It seems to me that legislators think “what would I like to happen” and then stop there. They don’t seem to consider enforcement or other practical effects at all. I’m honestly baffled that anyone could think that the cookie popups are a success. Like if we are going to mandate that everyone implement some new scheme, can we at least make it a good one? The lowest possible bar might be something like a standardized setting in browsers. Something actually good for user privacy might mean imposing some cost on companies that want to sell user information, so there are actually incentive's for companies to respect user privacy. Maybe I am way off, but I think the group of people that "enjoy" going through cookie popups, like yourself, are a distinct minority. For most people, it's an annoyance.
aziaziazi 2y ago
> pop-up dialog no one will read The said popup isn’t to be read but visually inform the visitor they trespass in an advertisement intensive area. The wise one will go back to their steps and find another source of information.
Ragnarork 2y ago
> no more performative regulations which are so poorly designed that they are basically impossible to meaningfully enforce It's difficult not to imagine that as a jab towards GDPR which, despite far from perfect, is neither performative, nor impossible to enforce. That you're frustrated with that doesn't remove the need for it, doesn't mean other people think the same way, and doesn't warrant letting that area completely free to be rampaged on by ads companies directly or indirectly.
- jampekka 2y ago
  In practice the enforcement is not really working. Anecdotally I encounter illegal tracking nags every day. The compliance there is is often at most malicious in nature, and years and years of dragging feet to make a minor change that is then again deemed illegal after years and years. For a more systematic analysis of the enforcement problems, see e.g. NOYB. And it's kind of ridiculous that a donation based non-profit has to constantly "harrass" the authorities for them to even try to enforce the law. I've personally sent complaints to my DPA, and they don't even bother to answer. https://noyb.eu/en/5-years-gdpr-national-authorities-let-down-european-legislator https://noyb.eu/en/5-years-gdpr-national-authorities-let-dow... https://noyb.eu/en/project/national-administrative-procedure https://noyb.eu/en/project/national-administrative-procedure
  - diggan 2y ago
    > In practice the enforcement is not really working. Anecdotally I encounter illegal tracking nags every day. How many of those encounters have led you to reporting this to anyone? There been a bunch of enforcement cases, and even a whole website dedicated to tracking those; https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ I'm happy to see the country I live in frequently in that list (Spain) and just in 2025 there been at least 14 cases, pretty substantial for something that supposedly isn't enforced.
    - jampekka 2y ago
      I have sent complaints to my DPA. As I said, they don't even answer. Sure there are some enforced cases, but the vast vast majority gets either stuck in bureaucracy or are simply ignored. https://noyb.eu/en/5-years-gdpr-national-authorities-let-down-european-legislator https://noyb.eu/en/5-years-gdpr-national-authorities-let-dow...
TeMPOraL 2y ago
> I have my own draconian idea: no more performative regulations which are so poorly designed that they are basically impossible to meaningfully enforce. Oh but they are enforced, and they are effective. Ever since GDPR passed, the business both on-line and in meatspace cut out plenty of bullshit user-hostile things they were doing. The worst ideas now don't even get proposed, much less implemented. It's a nice, if gradual, shift of cultural defaults. Also, it's very nice to be able to tell some "growth hacker" to fsck off or else I'll CC the local DPA in the next reply, and have it actually work. Not to mention, the popups you're complaining about serve an important function. Because it's not necessary to have them when you're not doing anything abusive, the amount and hostility of the popups is a direct measure of how abusive your business is.
- shafyy 2y ago
  > Because it's not necessary to have them when you're not doing anything abusive, the amount and hostility of the popups is a direct measure of how abusive your business is. This is a very important point that most (even tech-savyy folks) don't get: If you don't track your users, you don't need to show a consent pop-up. You don't need a consent pop-up for cookies or session storage that is helping the functionality of the website (e.g. storing session information, storing items you have put into your cart, storing user settings). Hell, even if you track your users anonymously, you don't need their consent. This means: If they have a pop-up, they are tracking personally identifiable information. And they sure as hell don't NEED to do that.
jbaber 2y ago
Eh. It's really the implementation is garbage. I'd love every textbox that submits data to have a 6pt red-on-white caption that has only the words "Anything typed in this box is not private".
- shiomiru 2y ago
  The problem is that the very purpose of a textbox is to submit data. So you'll have to add the caption to every single textbox. (I've actually tried to do something similar in my browser, but it was an eyesore so I removed it.)
GTP 2y ago
I'm not a lawyer, but I think an argument can be made that services can (and maybe should?) use the "do not track" setting of browsers to infer the answer to cookie dialogs, thus eliminating the "problem".

dijksterhuis 2y ago

> Oh good, another pop-up dialog no one will read that will be added to every site. > no one i go through every cookie pop up and manually reject all permissions. especially objecting to legitimate interest. i actually enjoy it. i find it satisfying saying no to a massive list of companies. the number of people who read these things is definitely not 0. my question to you is, why does compliance with regulation make you so … irritated? you don’t think it serves a purpose. but it does. there’s an incongruity there.

jampekka 2y ago
At least my irritation comes from the increasing amount of "consents" and "agreements" that are obviously not designed to be read, let alone understood. Not only cookie nags, but things like EULAs and ToS and privacy policies. And they are often not even legally valid. It's all a performative sharade of "voluntary contracts", which are in practice just forced down people's throats due to power inbalances.
- TeMPOraL 2y ago
  Yes, but how much can you blame this on regulation, where the regulatory intent is clear, and it's the industry that collectively chose to engage in malicious compliance?
  - jampekka 2y ago
    If the regulation has unworkable enforcement system, the regulation is to blame. E.g. that while around 2% want to be tracked while the majority is tracked is clearly a catastrophic failure in the design of the regulation. For the case of nags, something like a legally mandated respect of DNT would have solved the problem, at least on the UI level. Instead now it's a cat and mouse game with dark patterns obviously against the spirit of the law, where some Irish judge bends over backwards to find loopholes.
- dijksterhuis 2y ago
  IANAL > EULAs and ToS often seems to be liability protection for the service provider for the service provider/company. “when we were made aware of these account we immediately removed them from the service for a breach of the ToS”. ring any bells from any news articles? basically, “please don’t take us to court and sue us for everything users might do with our software. thanks.” > privacy policies consumer protection. don’t sell my phone number to direct marketing companies without me explicitly saying you can do so, or without you explicitly saying you will do so. this is being enforced: * https://ico.org.uk/action-weve-taken/enforcement/quick-tax-claims-limited-en/ https://ico.org.uk/action-weve-taken/enforcement/quick-tax-c... * https://ico.org.uk/action-weve-taken/enforcement/bonne-terre-limited/ https://ico.org.uk/action-weve-taken/enforcement/bonne-terre... more complete list: https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/ — like, yeah, these are not perfect. and they are sometimes frustrating to deal with, for everyone on either side of the agreement. and figuring out someone has done something against one of these agreements is sometimes impossible. but it is better than having nothing. don’t let perfect be the enemy of good.
  - jampekka 2y ago
    There are also things like mandatory arbitration, bans of reverse engineering, handover of copyrights and personal information etc etc hidden in the ToSs and EULAs and privacy policies (or in byzantine nagboxes). Often not even legally enforceable, but how many want to go to court with some megacorporation with the risk of having to pay huge legal fees? The terms should be in law, not by whatever some lawyer army cooked up, whenever applicable and the enforcement should be done by public authorities. And proposing legally unenforceable clauses in ToS and EULAs should be criminalized. They are essentially fraud.
amelius 2y ago
I always have the feeling companies keep nagging me until I check the right boxes. Or that even if I explicitly say "no", then at some point they quietly change my settings to "yes" and I have no way of proving that wasn't what I said.
jaredklewis 2y ago
Why does it irritate me? Because I genuinely care about things like user privacy and I wish we had regulations which were actually well designed to achieve their goals. It seems to me that legislators think “what would I like to happen” and then stop there. They don’t seem to consider enforcement or other practical effects at all. I’m honestly baffled that anyone could think that the cookie popups are a success. Like if we are going to mandate that everyone implement some new scheme, can we at least make it a good one? The lowest possible bar might be something like a standardized setting in browsers. Something actually good for user privacy might mean imposing some cost on companies that want to sell user information, so there are actually incentive's for companies to respect user privacy. Maybe I am way off, but I think the group of people that "enjoy" going through cookie popups, like yourself, are a distinct minority. For most people, it's an annoyance.

aziaziazi 2y ago

> pop-up dialog no one will read The said popup isn’t to be read but visually inform the visitor they trespass in an advertisement intensive area. The wise one will go back to their steps and find another source of information.

Ragnarork 2y ago

> no more performative regulations which are so poorly designed that they are basically impossible to meaningfully enforce It's difficult not to imagine that as a jab towards GDPR which, despite far from perfect, is neither performative, nor impossible to enforce. That you're frustrated with that doesn't remove the need for it, doesn't mean other people think the same way, and doesn't warrant letting that area completely free to be rampaged on by ads companies directly or indirectly.

jampekka 2y ago
In practice the enforcement is not really working. Anecdotally I encounter illegal tracking nags every day. The compliance there is is often at most malicious in nature, and years and years of dragging feet to make a minor change that is then again deemed illegal after years and years. For a more systematic analysis of the enforcement problems, see e.g. NOYB. And it's kind of ridiculous that a donation based non-profit has to constantly "harrass" the authorities for them to even try to enforce the law. I've personally sent complaints to my DPA, and they don't even bother to answer. https://noyb.eu/en/5-years-gdpr-national-authorities-let-down-european-legislator https://noyb.eu/en/5-years-gdpr-national-authorities-let-dow... https://noyb.eu/en/project/national-administrative-procedure https://noyb.eu/en/project/national-administrative-procedure
- diggan 2y ago
  > In practice the enforcement is not really working. Anecdotally I encounter illegal tracking nags every day. How many of those encounters have led you to reporting this to anyone? There been a bunch of enforcement cases, and even a whole website dedicated to tracking those; https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ I'm happy to see the country I live in frequently in that list (Spain) and just in 2025 there been at least 14 cases, pretty substantial for something that supposedly isn't enforced.
  - jampekka 2y ago
    I have sent complaints to my DPA. As I said, they don't even answer. Sure there are some enforced cases, but the vast vast majority gets either stuck in bureaucracy or are simply ignored. https://noyb.eu/en/5-years-gdpr-national-authorities-let-down-european-legislator https://noyb.eu/en/5-years-gdpr-national-authorities-let-dow...

TeMPOraL 2y ago

> I have my own draconian idea: no more performative regulations which are so poorly designed that they are basically impossible to meaningfully enforce. Oh but they are enforced, and they are effective. Ever since GDPR passed, the business both on-line and in meatspace cut out plenty of bullshit user-hostile things they were doing. The worst ideas now don't even get proposed, much less implemented. It's a nice, if gradual, shift of cultural defaults. Also, it's very nice to be able to tell some "growth hacker" to fsck off or else I'll CC the local DPA in the next reply, and have it actually work. Not to mention, the popups you're complaining about serve an important function. Because it's not necessary to have them when you're not doing anything abusive, the amount and hostility of the popups is a direct measure of how abusive your business is.

shafyy 2y ago
> Because it's not necessary to have them when you're not doing anything abusive, the amount and hostility of the popups is a direct measure of how abusive your business is. This is a very important point that most (even tech-savyy folks) don't get: If you don't track your users, you don't need to show a consent pop-up. You don't need a consent pop-up for cookies or session storage that is helping the functionality of the website (e.g. storing session information, storing items you have put into your cart, storing user settings). Hell, even if you track your users anonymously, you don't need their consent. This means: If they have a pop-up, they are tracking personally identifiable information. And they sure as hell don't NEED to do that.

jbaber 2y ago

Eh. It's really the implementation is garbage. I'd love every textbox that submits data to have a 6pt red-on-white caption that has only the words "Anything typed in this box is not private".

shiomiru 2y ago
The problem is that the very purpose of a textbox is to submit data. So you'll have to add the caption to every single textbox. (I've actually tried to do something similar in my browser, but it was an eyesore so I removed it.)

GTP 2y ago

I'm not a lawyer, but I think an argument can be made that services can (and maybe should?) use the "do not track" setting of browsers to infer the answer to cookie dialogs, thus eliminating the "problem".