6 ms·

This site uses cookies to store the fact you clicked “Accept Cookies”

29 points by boznz 2y ago

boznz 2y ago
This short post came about because I got an email yesterday which managed to traverse my spam filters saying my web site does not adhere to the GDPR regulations and (of course) offering to help fix it. Yes I know I shouldn't have opened it. (Lesson learnt, Spam filter added!) Anyway apologies in advance for said budget-driven, non-gdpr-compliant, web-site, and probably falling over at the slightest sign of stress.
- rozab 2y ago
  But... your site doesn't use cookies and doesn't process personal data. Why do you think you're in breach of GDPR?
  - boznz 2y ago
    The post is supposed to be a bit tongue-in-cheek (and is tagged so), the fact being I am a New Zealand company who does have any known customers or affiliates in the EU but I also have no idea what WordPress or its plugins do in the background if you say enter your email for an RSS or comment feed. I think lots of non-EU and non-technical bloggers would likely see the email I had (which was just opportunistic marketing spam from a European company and not nefarious) and think they were in breach of something like you say they are probably not.
    - 1116574 2y ago
      >I think lots of non-EU and non-technical bloggers would likely see the email I had and think they were in breach of something like you say they are probably not. This is true for all laws, all scams, all ads.
- karpour 2y ago
  Just because your site uses cookies does not mean you need a consent banner to be GDPR compliant Unless you're tracking people or sharing visitor data with third party services, you're likely not doing anything that requires consent. See here: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
  - lmkg 2y ago
    That website is not authoritative and should not be given more credence than your median tech blog.
    - usr1106 2y ago
      And not more credence than TFA. GDPR has legally very little to do with cookie banners as other comments have already pointed out. I am pretty sure nobody has been ever improsened because of not asking consent for storing cookies. Even for hefty fines you first need a hefty turnover, so that site seems unaffected. And obviously a couple of 100 millions are not hefty for Meta, Google & Co. They make bigger profits by taking the risks of not being in compliance.
o11c 2y ago
Remember, according to the GDPR: * any strictly necessary cookies do not require consent * any preference/functionality cookies require consent, but the user has to go looking for them anyway Thus, preemptive cookie banners are only needed for the "this is an evil website" case.
- arresin 2y ago
  I believe you can still do telemetry even, it just has to be anonymised.
- Kerrick 2y ago
  Evil, really? Is a simple A/B test where you want to see whether using the phrase “sign up” or “register” on the landing page is more effective evil? Even if you have no desire to track individuals and you just want to know which phrase is more helpful in aggregate? Storing the data necessary to learn this requires consent, doesn’t it?
  - loloquwowndueo 2y ago
    Yes it’s evil.
  - deleted 2y ago
    [deleted]
  - selfhoster11 2y ago
    IMO, yes. You are storing data you don't need to store, and adding a (small) fingerprint to the user's persistent profile with your site - so don't store it. Losing the ability to run A/B tests is not a big deal.
  - marcosdumay 2y ago
    It requires consent if it's personal information. You can pretty much do an A/B framework that doesn't require consent. You will absolutely be prohibited from running any of the popular options we have today.
  - ghusto 2y ago
bradleyy 2y ago
As someone who has helped build one of those cookie banners, I will admit that using cookies to store the state of what you consented to is somewhat ironic, or at least meta. It's got some really interesting parts though: serving those banners, geolocated (show the right thing for the legal regime you're in) at actual "web scale lol". And while folks hate them, we respect the GPC signal, and then won't show you the banner, just opt you out of everything.
- bradleyy 2y ago
  It may not have been clear: I work for a SAAS company that sells a "cookie banner", or more properly, consent management; it's quite a bit more complex than just managing cookies. Actually, if you're managing cookies, you've already lost.
- lapcat 2y ago
  > using cookies to store the state of what you consented to is somewhat ironic, or at least meta. It's a nightmare for anyone who uses private windows.
  - bradleyy 2y ago
    The alternative would be something like "making you log in to save cookie preferences". There are legitimate reasons to do this, but most would oppose it. Would you provide some market feedback? Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? Note: this is actually a problem I'm thinking about, and really do want to find a workable solution.
    - lapcat 2y ago
      > Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? The fundamental problem is that 99% of sites with cookie banners don't need cookie banners, because they don't need cookies at all. They say (lie) that it's to "improve your experience", but it's really just for tracking purposes. If a site has a login, then of course they need some kind of storage, and they can present the cookie consent in the login form. Otherwise, though, it's an imposition with no benefit to the site visitor. When you say "we respect the GPC signal", do you mean the Sec-GPC header? That would be a bit of improvement if all sites had to respect the header, but at this point it's still experimental and not widely used or respected.
zelon88 2y ago
Cookies are entirely a design choice, and a lazy one at that. It is entirely possible to identify, authenticate, maintain session, and store data about a user on the server completely without cookies. * * https://github.com/zelon88/HRCloud3/blob/master/core.php#L544 https://github.com/zelon88/HRCloud3/blob/master/core.php#L54...
- milesrout 2y ago
  Session information is usually stored in a cookie. It is not better to use a session URI parameter.
  - zelon88 2y ago
    In the proof of concept I linked, a self expiring session token is given to the client. If it is returned before the expiry, a new token is generated and the process starts over. If it is not returned before its expiry the session is considered to have been closed.
    - deleted 2y ago
      [deleted]
    - SirensOfTitan 2y ago
      But how are you storing the session token in the browser?
      - zelon88 2y ago
        In a hidden DOM on the page. Updated asynchronously. There is Javascript running on the page that updates the DOM. So as long as the user is on the page, the "session" stays alive.
        milesrout 2y ago
        A session by definition extends beyond one page.
johnea 2y ago
I don't agree at all with the "wild west" and "buyer beware" stuff in the article. But I do completely agree that it's annoying, when I surf to a website with cookies disabled, and am forced to click "Yes I accept cookies", even though my browser isn't going to accept them. and that after I click OK, the site displays anyway. I did read an article that came through the HN feed about how many person/hours of productivity were lost each year to this process in general. It wasn't a small amount.
cosmotic 2y ago
One thing many dont understand about GDPR is that consent for cookies is only needed if its a nonessentual cookie, or in other words one used for ad tracking or analytics. Using a cookie to store user session for login is the use of an essential cookie and doesnt necessitate the popup on its own.
- JohnTHaller 2y ago
  Yeah, but that login cookie is tied to a session within our database. And since we can count those sessions and see when they were last accessed, now we have stats based on those sessions which are based on those cookies. And we can analyze those stats and glean some useful data - analyzed statistics, we'll call them analytics for short - so we have analytics based on the statistics from the sessions attached to the cookies. So, we better show a cookie banner just to be safe.
avemg 2y ago
I am going to use this opportunity to ask: Why is that stackoverflow sites absolutely, positively cannot seem to remember my cookie preferences and seemingly ask me every single time I find myself there?
- learningmore 2y ago
  Yes! I’ve even considered finding some extension to just accept every cookie option for every site, so just I’m not hammered with consent dialogs on StackOverflow. I use multiple browsers for testing, across multiple computers. Perhaps this fact, along with their consent expiration policy causes the consent dialogs to always show.
- deleted 2y ago
  [deleted]
- int_19h 2y ago
  It's because they are using a third-party (cookielaw.org) cookie to record the your choice. So if your browser is configured to not allow third-party cookies - e.g. Safari's "prevent third party tracking" and similar options in other browsers, or PiHole and AdGuard - this breaks them. And yes, it's a known issue going back several years. The official response is "it affects less than 1% of our users, so fuck you".
  - cedws 2y ago
    Must be positioning themselves for a Microsoft acquisition!
  - LegionMammal978 2y ago
    How would they even be able to fix it, short of redirecting all their domains to stackexchange.com subdomains (and causing a colossal branding mess and making everyone mad)? Almost by definition, anything that would allow them to know you've accepted cookies on a different domain would be a form of tracking that all the anti-tracking stuff would clamp down on.
    - 2y ago
ghusto 2y ago
Please put in the bare minimum effort to understand. If you had, you'd know that you either _do not need a cookie banner_, or that you do because your site is collecting identifiable information on persons using cookies. If you do not care about the latter, then please start caring.

29 points by boznz 2y ago

This short post came about because I got an email yesterday which managed to traverse my spam filters saying my web site does not adhere to the GDPR regulations and (of course) offering to help fix it. Yes I know I shouldn't have opened it. (Lesson learnt, Spam filter added!) Anyway apologies in advance for said budget-driven, non-gdpr-compliant, web-site, and probably falling over at the slightest sign of stress.

rozab 2y ago
But... your site doesn't use cookies and doesn't process personal data. Why do you think you're in breach of GDPR?
- boznz 2y ago
  The post is supposed to be a bit tongue-in-cheek (and is tagged so), the fact being I am a New Zealand company who does have any known customers or affiliates in the EU but I also have no idea what WordPress or its plugins do in the background if you say enter your email for an RSS or comment feed. I think lots of non-EU and non-technical bloggers would likely see the email I had (which was just opportunistic marketing spam from a European company and not nefarious) and think they were in breach of something like you say they are probably not.
  - 1116574 2y ago
    >I think lots of non-EU and non-technical bloggers would likely see the email I had and think they were in breach of something like you say they are probably not. This is true for all laws, all scams, all ads.
karpour 2y ago
Just because your site uses cookies does not mean you need a consent banner to be GDPR compliant Unless you're tracking people or sharing visitor data with third party services, you're likely not doing anything that requires consent. See here: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
- lmkg 2y ago
  That website is not authoritative and should not be given more credence than your median tech blog.
  - usr1106 2y ago
    And not more credence than TFA. GDPR has legally very little to do with cookie banners as other comments have already pointed out. I am pretty sure nobody has been ever improsened because of not asking consent for storing cookies. Even for hefty fines you first need a hefty turnover, so that site seems unaffected. And obviously a couple of 100 millions are not hefty for Meta, Google & Co. They make bigger profits by taking the risks of not being in compliance.

o11c 2y ago

Remember, according to the GDPR: * any strictly necessary cookies do not require consent * any preference/functionality cookies require consent, but the user has to go looking for them anyway Thus, preemptive cookie banners are only needed for the "this is an evil website" case.

arresin 2y ago
I believe you can still do telemetry even, it just has to be anonymised.
Kerrick 2y ago
Evil, really? Is a simple A/B test where you want to see whether using the phrase “sign up” or “register” on the landing page is more effective evil? Even if you have no desire to track individuals and you just want to know which phrase is more helpful in aggregate? Storing the data necessary to learn this requires consent, doesn’t it?
- loloquwowndueo 2y ago
  Yes it’s evil.
- deleted 2y ago
  [deleted]
- selfhoster11 2y ago
  IMO, yes. You are storing data you don't need to store, and adding a (small) fingerprint to the user's persistent profile with your site - so don't store it. Losing the ability to run A/B tests is not a big deal.
- marcosdumay 2y ago
  It requires consent if it's personal information. You can pretty much do an A/B framework that doesn't require consent. You will absolutely be prohibited from running any of the popular options we have today.
- ghusto 2y ago

bradleyy 2y ago

As someone who has helped build one of those cookie banners, I will admit that using cookies to store the state of what you consented to is somewhat ironic, or at least meta. It's got some really interesting parts though: serving those banners, geolocated (show the right thing for the legal regime you're in) at actual "web scale lol". And while folks hate them, we respect the GPC signal, and then won't show you the banner, just opt you out of everything.

bradleyy 2y ago
It may not have been clear: I work for a SAAS company that sells a "cookie banner", or more properly, consent management; it's quite a bit more complex than just managing cookies. Actually, if you're managing cookies, you've already lost.
lapcat 2y ago
> using cookies to store the state of what you consented to is somewhat ironic, or at least meta. It's a nightmare for anyone who uses private windows.
- bradleyy 2y ago
  The alternative would be something like "making you log in to save cookie preferences". There are legitimate reasons to do this, but most would oppose it. Would you provide some market feedback? Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? Note: this is actually a problem I'm thinking about, and really do want to find a workable solution.
  - lapcat 2y ago
    > Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? The fundamental problem is that 99% of sites with cookie banners don't need cookie banners, because they don't need cookies at all. They say (lie) that it's to "improve your experience", but it's really just for tracking purposes. If a site has a login, then of course they need some kind of storage, and they can present the cookie consent in the login form. Otherwise, though, it's an imposition with no benefit to the site visitor. When you say "we respect the GPC signal", do you mean the Sec-GPC header? That would be a bit of improvement if all sites had to respect the header, but at this point it's still experimental and not widely used or respected.

zelon88 2y ago

Cookies are entirely a design choice, and a lazy one at that. It is entirely possible to identify, authenticate, maintain session, and store data about a user on the server completely without cookies. * * https://github.com/zelon88/HRCloud3/blob/master/core.php#L544 https://github.com/zelon88/HRCloud3/blob/master/core.php#L54...

milesrout 2y ago
Session information is usually stored in a cookie. It is not better to use a session URI parameter.
- zelon88 2y ago
  In the proof of concept I linked, a self expiring session token is given to the client. If it is returned before the expiry, a new token is generated and the process starts over. If it is not returned before its expiry the session is considered to have been closed.
  - deleted 2y ago
    [deleted]
  - SirensOfTitan 2y ago
    But how are you storing the session token in the browser?
    - zelon88 2y ago
      In a hidden DOM on the page. Updated asynchronously. There is Javascript running on the page that updates the DOM. So as long as the user is on the page, the "session" stays alive.
      - milesrout 2y ago
        A session by definition extends beyond one page.

johnea 2y ago

I don't agree at all with the "wild west" and "buyer beware" stuff in the article. But I do completely agree that it's annoying, when I surf to a website with cookies disabled, and am forced to click "Yes I accept cookies", even though my browser isn't going to accept them. and that after I click OK, the site displays anyway. I did read an article that came through the HN feed about how many person/hours of productivity were lost each year to this process in general. It wasn't a small amount.

cosmotic 2y ago

One thing many dont understand about GDPR is that consent for cookies is only needed if its a nonessentual cookie, or in other words one used for ad tracking or analytics. Using a cookie to store user session for login is the use of an essential cookie and doesnt necessitate the popup on its own.

JohnTHaller 2y ago
Yeah, but that login cookie is tied to a session within our database. And since we can count those sessions and see when they were last accessed, now we have stats based on those sessions which are based on those cookies. And we can analyze those stats and glean some useful data - analyzed statistics, we'll call them analytics for short - so we have analytics based on the statistics from the sessions attached to the cookies. So, we better show a cookie banner just to be safe.

avemg 2y ago

I am going to use this opportunity to ask: Why is that stackoverflow sites absolutely, positively cannot seem to remember my cookie preferences and seemingly ask me every single time I find myself there?

learningmore 2y ago
Yes! I’ve even considered finding some extension to just accept every cookie option for every site, so just I’m not hammered with consent dialogs on StackOverflow. I use multiple browsers for testing, across multiple computers. Perhaps this fact, along with their consent expiration policy causes the consent dialogs to always show.
deleted 2y ago
[deleted]
int_19h 2y ago
It's because they are using a third-party (cookielaw.org) cookie to record the your choice. So if your browser is configured to not allow third-party cookies - e.g. Safari's "prevent third party tracking" and similar options in other browsers, or PiHole and AdGuard - this breaks them. And yes, it's a known issue going back several years. The official response is "it affects less than 1% of our users, so fuck you".
- cedws 2y ago
  Must be positioning themselves for a Microsoft acquisition!
- LegionMammal978 2y ago
  How would they even be able to fix it, short of redirecting all their domains to stackexchange.com subdomains (and causing a colossal branding mess and making everyone mad)? Almost by definition, anything that would allow them to know you've accepted cookies on a different domain would be a form of tracking that all the anti-tracking stuff would clamp down on.
  - 2y ago

ghusto 2y ago

Please put in the bare minimum effort to understand. If you had, you'd know that you either _do not need a cookie banner_, or that you do because your site is collecting identifiable information on persons using cookies. If you do not care about the latter, then please start caring.