4 ms·

Setting a language preference cookie is not tracking and I will die on that hill. The law requires consent before using a cookie to store even a mundane option

by dcow 1y ago

Setting a language preference cookie is not tracking and I will die on that hill. The law requires consent before using a cookie to store even a mundane option that was just directly modified by a user. Collecting a crash report is not tracking a user. Even first party product analytics is not tracking a user. Tracking a user across domains using a 3rd party aggregator to serve add and do attribution is the evil. And the EPD far overshoots the mark of specifically addressing that evil.

Latty 1y ago
A language preference cookie is not tracking under the GDPR and doesn't need to be promoted for. Of course, if you take that language preference and feed it into your advertising to identify and target people, then it becomes tracking.
- nightpool 1y ago
  You're correct under the GDPR but incorrect under the older ePrivacy Directive. EU sites need to be compliant with both, and so the cookie banners persist.
  - jraph 1y ago
    Are you sure? That's new to me. https://en.m.wikipedia.org/wiki/EPrivacy_Directive https://en.m.wikipedia.org/wiki/EPrivacy_Directive says > The Directive provision applicable to cookies is Article 5(3). Recital 25 of the Preamble recognises the importance and usefulness of cookies for the functioning of modern Internet and directly relates Article 5(3) to them but Recital 24 also warns of the danger that such instruments may present to privacy. The change in the law does not affect all types of cookies; those that are deemed to be "strictly necessary for the delivery of a service requested by the user", such as for example, cookies that track the contents of a user's shopping cart on an online shopping service, are exempted.
    - dcow 1y ago
      Read: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ …after you dismiss the cookie banner, of course. I add this not only as a quip but to highlight that even a gdpr explainer website which you’d expect isn’t doing the evil thing of tracking users, has interpreted the relevant laws such that it finds it necessary to promt the user in order to simply explain the gdpr and epd/epr…
      - Latty 1y ago
        > This is not an official EU Commission or Government resource. [...] Nothing found in this portal constitutes legal advice. It's easier and safer to just claim that you must prompt for everything, and it serves the goal of obfuscating bad behaviour. Cookies that are functionally necessary to do what the user is there for, not to track them, are OK, that's the spirit and intent of the law. Even if you think the wording means that, realistically, the EU isn't coming after anyone for a legitimate good-faith use of language cookies without a banner, and they'd clarify if that was how they intended to enforce it.
      - jraph 1y ago
        The way I read this proves you wrong: > Cookie compliance [heading] > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: > Receive users’ consent before you use any cookies except strictly necessary cookies. (emphasis not mine, but would have added it)
        dcow 1y ago
        A language preference cookie is colloquially considered a preferences cookie, which is included in the except strictly necessary cookies.
        jraph 1y ago
        I'm not sure what you mean but our ancestor comment describes this clearly. A language preference cookie is not tracking. https://news.ycombinator.com/item?id=44426726#44431268 https://news.ycombinator.com/item?id=44426726#44431268
jraph 1y ago
> The law requires consent before using a cookie to store even a mundane option that was just directly modified by a user Nope. That's exactly why the evil cookie modals are not on the GDPR but only on the sites that want to track you and now need to ask you for your consent before doing so. That's usually exactly where good faith GDPR detractors are wrong, and that's what needs to be repeated again and again in those discussions.
- nightpool 1y ago
  You're correct that the GDPR specifically doesn't require this, but you're incorrect that "the law" doesn't—the 2004 EU ePrivacy Directive requires affirmative consent for all cookies, and it's being enforced much more strictly now in a post-GDPR world
  - jraph 1y ago
    I answered that at https://news.ycombinator.com/item?id=44426726#44434685 https://news.ycombinator.com/item?id=44426726#44434685
    - dcow 1y ago
      No you didn’t. You’re misunderstanding the classification of strictly necessary vs functional vs marketing/tracking cookies. Go talk to a lawyer. I’m sure they will clear things up for you.
_Algernon_ 1y ago
>The law requires consent before using a cookie to store even a mundane option that was just directly modified by a user. If your are referring to GDPR this is wrong. GDPR does not require consent for strictly necessary cookies. >Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Though language preference does not seem like something that requires a cookie. Just respect the Accept-Language header. There is no need to reinvent the wheel here.
- dcow 1y ago
  No I am referring to the EPD as I state in my comment, an acronym you should know since it’s defined in the explainer you link. As someone who has experience in this area, it’s not as simple as “just use the Accept-Language header it will be fine”. In any event, that’s besides then point. There are non-tracking cookies that get swept up in the EPD’s consent requirements. This causes way more popups than needed to address the real problem of users being tracked and profiled across domains. The result is users being inundated with consent banners on freaking homepages. If you changed the requirements to “consent is required for marketing cookies” then I’d wager it would vastly reduce the need for these banners. You could show the banner interstitially as soon as a customer entered your funnel and wanted to try to perform spooky attribution. In my experience the banners are useless because they don’t actually tell me whether the site is tracking me or not (the behavior I presumably want to prevent). They just tell me whether the site uses cookies, which I’m okay with 99% of the time, so I just click yes.
  - jraph 1y ago
    > There are non-tracking cookies that get swept up in the EPD’s consent requirements Still not sure where you and nightpool got this. https://news.ycombinator.com/item?id=44426726#44434685 https://news.ycombinator.com/item?id=44426726#44434685
meindnoch 1y ago
Accept-Language.

by dcow 1y ago

Latty 1y ago

A language preference cookie is not tracking under the GDPR and doesn't need to be promoted for. Of course, if you take that language preference and feed it into your advertising to identify and target people, then it becomes tracking.

nightpool 1y ago
You're correct under the GDPR but incorrect under the older ePrivacy Directive. EU sites need to be compliant with both, and so the cookie banners persist.
- jraph 1y ago
  Are you sure? That's new to me. https://en.m.wikipedia.org/wiki/EPrivacy_Directive https://en.m.wikipedia.org/wiki/EPrivacy_Directive says > The Directive provision applicable to cookies is Article 5(3). Recital 25 of the Preamble recognises the importance and usefulness of cookies for the functioning of modern Internet and directly relates Article 5(3) to them but Recital 24 also warns of the danger that such instruments may present to privacy. The change in the law does not affect all types of cookies; those that are deemed to be "strictly necessary for the delivery of a service requested by the user", such as for example, cookies that track the contents of a user's shopping cart on an online shopping service, are exempted.
  - dcow 1y ago
    Read: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ …after you dismiss the cookie banner, of course. I add this not only as a quip but to highlight that even a gdpr explainer website which you’d expect isn’t doing the evil thing of tracking users, has interpreted the relevant laws such that it finds it necessary to promt the user in order to simply explain the gdpr and epd/epr…
    - Latty 1y ago
      > This is not an official EU Commission or Government resource. [...] Nothing found in this portal constitutes legal advice. It's easier and safer to just claim that you must prompt for everything, and it serves the goal of obfuscating bad behaviour. Cookies that are functionally necessary to do what the user is there for, not to track them, are OK, that's the spirit and intent of the law. Even if you think the wording means that, realistically, the EU isn't coming after anyone for a legitimate good-faith use of language cookies without a banner, and they'd clarify if that was how they intended to enforce it.
    - jraph 1y ago
      The way I read this proves you wrong: > Cookie compliance [heading] > To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: > Receive users’ consent before you use any cookies except strictly necessary cookies. (emphasis not mine, but would have added it)
      - dcow 1y ago
        A language preference cookie is colloquially considered a preferences cookie, which is included in the except strictly necessary cookies.
        jraph 1y ago
        I'm not sure what you mean but our ancestor comment describes this clearly. A language preference cookie is not tracking. https://news.ycombinator.com/item?id=44426726#44431268 https://news.ycombinator.com/item?id=44426726#44431268

jraph 1y ago

> The law requires consent before using a cookie to store even a mundane option that was just directly modified by a user Nope. That's exactly why the evil cookie modals are not on the GDPR but only on the sites that want to track you and now need to ask you for your consent before doing so. That's usually exactly where good faith GDPR detractors are wrong, and that's what needs to be repeated again and again in those discussions.

nightpool 1y ago
You're correct that the GDPR specifically doesn't require this, but you're incorrect that "the law" doesn't—the 2004 EU ePrivacy Directive requires affirmative consent for all cookies, and it's being enforced much more strictly now in a post-GDPR world
- jraph 1y ago
  I answered that at https://news.ycombinator.com/item?id=44426726#44434685 https://news.ycombinator.com/item?id=44426726#44434685
  - dcow 1y ago
    No you didn’t. You’re misunderstanding the classification of strictly necessary vs functional vs marketing/tracking cookies. Go talk to a lawyer. I’m sure they will clear things up for you.

_Algernon_ 1y ago

>The law requires consent before using a cookie to store even a mundane option that was just directly modified by a user. If your are referring to GDPR this is wrong. GDPR does not require consent for strictly necessary cookies. >Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. https://gdpr.eu/cookies/ https://gdpr.eu/cookies/ Though language preference does not seem like something that requires a cookie. Just respect the Accept-Language header. There is no need to reinvent the wheel here.

dcow 1y ago
No I am referring to the EPD as I state in my comment, an acronym you should know since it’s defined in the explainer you link. As someone who has experience in this area, it’s not as simple as “just use the Accept-Language header it will be fine”. In any event, that’s besides then point. There are non-tracking cookies that get swept up in the EPD’s consent requirements. This causes way more popups than needed to address the real problem of users being tracked and profiled across domains. The result is users being inundated with consent banners on freaking homepages. If you changed the requirements to “consent is required for marketing cookies” then I’d wager it would vastly reduce the need for these banners. You could show the banner interstitially as soon as a customer entered your funnel and wanted to try to perform spooky attribution. In my experience the banners are useless because they don’t actually tell me whether the site is tracking me or not (the behavior I presumably want to prevent). They just tell me whether the site uses cookies, which I’m okay with 99% of the time, so I just click yes.
- jraph 1y ago
  > There are non-tracking cookies that get swept up in the EPD’s consent requirements Still not sure where you and nightpool got this. https://news.ycombinator.com/item?id=44426726#44434685 https://news.ycombinator.com/item?id=44426726#44434685

meindnoch 1y ago

Accept-Language.