12 ms·

The problem here is not the law, but malicious compliance by websites that don't want to give up tracking. "Spend Five Minutes in a Menu of Legalese" is not th

The problem here is not the law, but malicious compliance by websites that don't want to give up tracking. "Spend Five Minutes in a Menu of Legalese" is not the intended alternative to "Accept All". "Decline All" is! And this is starting to be enforced through the courts, so you're increasingly seeing the "Decline All" option right away. As it should be. https://www.techspot.com/news/108043-german-court-takes-stand-against-manipulative-cookie-banners.html https://www.techspot.com/news/108043-german-court-takes-stan... Of course, also respecting a Do-Not-Track header and avoiding the cookie banner entirely while not tracking the user, would be even better.

torginus 1y ago
I wonder why people don't build a collection of scripts into a browser plugin, like Adblock that auto rejects all tracking info to the greatest extent possible?
- bvvgpc 1y ago
  I would install that in a heartbeat!
  - jraph 1y ago
    Then enable the cookie banner lists in uBlock Origin. Do expect occasional breakages and remember to temporarily disable the blocking to get through.
- h4kor 1y ago
  These exist. There is "Consent-O-Matic" for example
  - Semaphor 1y ago
    Direct link, works on mobile as well: https://addons.mozilla.org/en-US/firefox/addon/consent-o-matic/ https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat... There’s probably also a version for the adtech browser somewhere.
  - retSava 1y ago
    Isn't that the inverse? Ie auto-accept just to get rid of the UI box? Edit: their FF-page says, Set your preferences once, and let the technology do the rest! This add-on is built and maintained by workers at Aarhus University in Denmark. We are privacy researchers that got tired of seeing how companies violate the EU's General Data Protection Regulation (GDPR). Because the organisations that enforce the GDPR do not have enough resources, we built this add-on to help them out. We looked at 680 pop-ups and combined their data processing purposes into 5 categories that you can toggle on or off. Sometimes our categories don't perfectly match those on the website, so then we will choose the more privacy preserving option.
    - tcfhgj 1y ago
      > Isn't that the inverse? Ie auto-accept just to get rid of the UI box? no, that's "I don't care about Cookies"
- lez 1y ago
  There IS an optional list for ublock origin that tries to get rid of cookie nonsense.
- inetknght 1y ago
  uMatrix for Firefox and friends. NoScript too. And AdGuard.
- layer8 1y ago
  Ghostery does exactly that.
aaronrobinson 1y ago
This. And the ones that mean you have to manually switch off multiple legitimate interest toggles mean I just press the back button.
- rkomorn 1y ago
  > I just press the back button I do this more and more, and I think it's the right and best thing to do.
- bmacho 1y ago
  +1 it's a win-win situation. The website announces upfront that they are malicious so I can just leave
- 1718627440 1y ago
  I do this as well, but in case I do want to read the site, I just delete the node from the DOM.
- mrguyorama 1y ago
  Since "legitimate interest" means you don't need consent, they do not let you toggle it off. If they are showing you a toggle and calling it for "legitimate interest", they are most likely lying. They love to put cookies under "performance and enhancements" as if that isn't bullshit as well. All legitimate interest cookies are in the greyed out toggle for "required cookies". By law, you can decline all and the site should still work fine, which again means they won't allow you to turn off actually needed cookies.
  - deleted 1y ago
    [deleted]
emacdona 1y ago
One thousand percent yes. And I'll repeat because people need to see it called out as often as possible: this is due to malicious compliance by websites. Period. I'm so cynical now that I can't read articles like this without my first reaction being to look at how it benefits companies that profit from ads. My two theories here? 1. An attempt to shift liability from companies having to comply with GDPR to browsers having to comply. 2. An attempt to consolidate all cookie consent into the three (?) browser engines we have... so efforts to thwart it can be focused on just those places.
crazygringo 1y ago
No, the problem is 100% the law, because it was written in a way that allows this type of malicious compliance. Laws need to be written well to achieve good outcomes. If the law allows for malicious compliance, it is a badly written law. The sites are just trying to maximize profit, as anyone could predict. So write better laws.
- itopaloglu83 1y ago
  Although I agree the law isn’t as good as it could be. It’s also impossible to create perfect law when websites are looking to avoid the spirit of the law to begin with. Otherwise how can we explain “please see our privacy policy and send us a sneaker email to opt out” kind of tracking options.
  - lesuorac 1y ago
    Yeah law is kinda like the rules in sports leagues. You have to keep updating it as the meta shits. It's impossible to write things correctly the first or final time and especially with the interpretation of words changing over time it doesn't matter if you could.
    - a4isms 1y ago
      Rules in sports are always being adjusted, and participants are always looking for (barely legal) ways to get around them. Example: In cycling, they banned narrow handlebars. There's an aero advantage, but it was seen as a safety problem. So cyclists canted their brake hoods way inside, rested their hands on the brake hoods, and got an aero advantage. And now there's a rule about brake hoods. Laws are meant only be living things that change as society changes, and also change to patch what we might call "exploits." You are perfectly correct: It's never one and done, it's an ongoing process.
    - jeroenhd 1y ago
      This is part of why a lot of EU directives are almost 50% "why this law is necessary and what we're trying to achieve", 30% "what needs to be implemented", and then 20% "who's going to look after all of this and how". That way, a misplaced comma or a wonky sentence doesn't allow for easy loopholes that need tighter laws to fix issues. Now law text will work forever, but this format makes for a very solid foundation.
itopaloglu83 1y ago
Tracking by default is not an acceptable solution, so I would say respecting the Do-Not-Track header must be mandatory and enforced by laws and percentage of global revenue fines.
- bradleyy 1y ago
  GPC (Global Privacy Control) is the header that's actually being enforced in (parts of) the US. DNT is considered deprecated by many, due to the nonconsensual way that Microsoft rolled it out.
  - Nextgrid 1y ago
    Why is Microsoft's implementation a problem? Having the setting default to a safe value is the rational choice. It's like saying having a secure OS/browser would deprive malware authors of revenue, and thus vulnerabilities should be preserved unless the user explicitly opts into patching them.
    - TheCoelacanth 1y ago
      Yeah, and according to most privacy laws, not tracking should be the default.
    - bradleyy 1y ago
      https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer... This combined with governments ignoring it, and actively enforcing GPC... it's questionable whether compliance is necessary (I still suggest treating it the same as a GPC signal). But future work and effort should be put towards the GPC signal.
  - velcrovan 1y ago
    For a new corporate website we just completed, we used GPC signals as the opt out mechanism. If your browser sends GPC, the site just opts you out of everything and loads zero tracking scripts. If it doesn't, you see a popup that explains how to turn it on if you want, or an "I understand" button. An approach like this seems ideal to me, the problem is that it's only natively supported in Firefox. Our instructions for Chrome and Edge are basically "install Privacy Badger." And Safari is the WORST, which as an Apple customer it pains me to say. Not only does the browser not support it, there are ZERO Safari browser extensions, NONE, on ANY platform (mac/iphone/ipad), that you can install that will send a simple GPC signal with the HTTP headers. There is a paid Safari extension on iOS called ChangeTheHeaders that you can configure to send a GPC signal, but come on, you can't ask normal people to buy an app and manually enter a specific HTTP header. (ChangeTheHeaders is made by Jeff Johnson, the same dev as StopTheMadness. I asked him whether he'd consider adding user-friendly GPC signals to that (or any other) plugin and he said it would just be "duplicating functionality" :-/ )
whywhywhywhy 1y ago
The problem is exactly the law then because it was written so incompetently that it left the loopholes to allow websites to try and trick accepting. Should have been written in the law that it’s a one toggle in browser settings. If government is going to impose on the internet the least they could do is be competent in what they impose. Not writing laws that waste lifetimes in collective hours a day as every person in Europe deals with multiple of these dialogs a day and thousands a year.
- dns_snek 1y ago
  > it left the loopholes to allow websites to try and trick accepting. It did not. These practices are illegal under the GDPR, the problem is a chronic lack of enforcement by most national enforcement agencies in all but the most severe cases. Some are just ineffective but others have gone completely rogue. Swedish Data Protection Authority (DPA) for example takes the position that commercial data brokers like Mrkoll are allowed to publish and sell people's personal information (including your current home address, hello stalkers!) [1] and that this is somehow protected under the pretense of "journalism" [2]. [1] https://mrkoll.se/resultat?n=Otto&c=&min=16&max=120&sex=a&c_stat=all&company= https://mrkoll.se/resultat?n=Otto&c=&min=16&max=120&sex=a&c_... [2] https://noyb.eu/en/swedish-data-brokers-claim-journalists-legal-protection-evade-eu-law https://noyb.eu/en/swedish-data-brokers-claim-journalists-le...
  - dns_snek 1y ago
    [2] Doesn't fully capture the negligence of the Swedish DPA ("IMY"), here's a better source: > IMY’s practice of simply “forwarding” complaints. > The IMY’s way of dealing with complaints since the Supreme Administrative Court ruling is to attach an “appeal form” to their (non-)decisions. But it still doesn’t investigate the complaints. Instead, the authority simply forwards the complaint to the entity that illegally processes personal data and then immediately closes the case. This also happened in the case preceding noyb’s current legal action against the IMY. After a data subject filed a complaint regarding a recorded phone call, the authority forwarded it to the respondent without investigating. [3] https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-properly-deal-complaints https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-pro...
bradleyy 1y ago
The Global Privacy Control (GPC) is the header that actually has enforcement behind it in the US, and there are already companies getting fined. California has partnered with several other states to broaden enforcement. Would love something better than GPC, but in the interim, the EU should start considering it as a proper signal of (lack of) consent, obviating the need for a banner altogether.
- Macha 1y ago
  Ah, I was wondering why I was seeing more dialogs default to opt out when I hadn’t heard of any notable EU slap downs when it started
sothatsit 1y ago
I would blame ad providers more than individual website owners. From my experience, ad providers have made it very difficult to serve their ads unless you use an ad-supported cookie consent manager. I tried to write my own simple cookie consent form and gave up after realising how obscenely complicated TCF is. And since most ad-compatible cookie consent banners are provided by the ad companies themselves, you kinda just get stuck with bad options. I even tried to pay for a commercial cookie consent manager but it wasn’t supported by my ad provider. If I had more time I probably could have figured it out. But unfortunately I’m just running a hobby project and do not have weeks to spend on this. The revenue from the ads is what pays for hosting. I imagine lots of websites are in a similar boat. I would love if there was a simpler option that could respect people’s privacy more, be less annoying, and that would still allow websites like mine to survive by running ads. Targeting browsers instead of websites could have been that option.
gabeyaw 1y ago
The irony being this site doesn't offer a decline all option.
- szszrk 1y ago
  My default firefox settings rejected content tracker and in the end no cookies were created at all, plus there was just one failed CDN request outside original domain. Not bad.
  - Nextgrid 1y ago
    Don't worry, you are still being tracked by IP + browser fingerprinting... and using a browser with a low single-digit marketshare stands out like a sore thumb. (which is also why framing GDPR discussions around cookies misses the point - the point is to determine the user's consent to being tracked regardless of technical ability, whether cookies, IP address, fingerprinting, or even some magic crystal ball)
    - GJim 1y ago
      > being tracked by IP + browser fingerprinting That is also illegal under the GDPR; you cannot track me without my explicit opt-in consent, whither by 'cookies' or other means. I continue to be astounded how little grasp some HN readers (a technical news site!) have of the GDPR.
      - Nextgrid 1y ago
        I am aware it is illegal, and yet just like for cookie-based tracking, everyone gets away with it.
UltraSane 1y ago
No. I absolutely do not want to be asked to accept cookies for every single website I visit.
- Spivak 1y ago
  This is the problem, the law clearly recognizes tracking as something people don't want. The fact that they let every website beg you to allow tracking instead of banning all but functional cookies is the problem. They capitulated to advertisers and this is the result. Nobody wants this crap.
  - Nextgrid 1y ago
    The regulation actually specifies what counts as informed consent. Annoying users into accepting tracking does not count. The problem is that there's a chronic lack of enforcement, so the winning strategy is to breach the regulation. Worst case scenario, you will merely be forced to clean house at some point (but can enjoy the rewards of tracking until then).
- GJim 1y ago
  Then don't visit scummy websites (advertisers take a bow) that track you and seek to invade your privacy.
  - UltraSane 1y ago
    It isn't just scummy websites that ask for cookies consent. It is half the web.
    - rkomorn 1y ago
      And half seems like a very conservative underestimate.
Aaargh20318 1y ago
> Of course, also respecting a Do-Not-Track header and avoiding the cookie banner entirely while not tracking the user, would be even better Best way to get rid of the cookie banner is to just forbid tracking completely. Given a free choice, how many people actually want to be tracked?
- tcfhgj 1y ago
  I allow tracking for a small selection of apps
- phendrenad2 1y ago
  > Given a free choice, how many people actually want to be tracked? Good question. But there isn't enough information to answer the question. Are these people properly informed about what "tracking" means, or do they think this means companies are passing around their full names and addresses on post-it notes?
jrm4 1y ago
The problem here is the problem everywhere; we still as a world have no remotely effective way to actually punish companies-as-bad-actors on the internet or in tech generally. None of any technical ANYTHING matters until we (meaning law and government) inflict truly meaningful consequences. Fines, breaking up companies, perhaps even jail time, etc.
- danaris 1y ago
  We have ways to do these things. We just refuse to use them, because our politicians either believe that companies should have more rights than we do, or are terrified that if they actually try to enforce the law on them they'll lose out on massive amounts of campaign contributions (whether direct or indirect).
- Barrin92 1y ago
  Yes. The problem isn't the letter of the law, it's that governing bodies like the EU need something like an enforcement czar who tells companies in no uncertain terms that if they're going to try to be clever they're going to get the ol' Jack Ma treatment. Stop letting the tail wag the dog. And before someone says that it will hamper innovation, I used to live in China and talk to investors often, they would always stress that for every guy with a billion who can't play by the rules there's a thousand guys with a million who have no problem taking the market share, that's hardly an issue
shagie 1y ago
> The problem here is not the law, but malicious compliance by websites that don't want to give up tracking. If that was the case, then why does the site from the EU first off track... and secondly why does it use a cookie banner rather than some other solution that would not be malicious compliance with the law? If there was a solution to having cookies and some other way of informing visitors of it, shouldn't that be demonstrated on the official EU government explaining GDPR? https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers... Can a company go wrong implementing the same approach as https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en uses? Why is that considered malicious compliance with the law?
- Kbelicius 1y ago
  > If that was the case, then why does the site from the EU first off track If you are asking why there isn't a "reject all" button on their webpage then the answer is simple. There is one. The "Accept only essential cookies". > and secondly why does it use a cookie banner rather than some other solution that would not be malicious compliance with the law? GDPR (general data protection regulation) is about general data protection, not about technology. It applies the same no matter if you are using cookies or something else. > Can a company go wrong implementing the same approach as https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en uses? Why is that considered malicious compliance with the law? The example you've given is an example of compliance since there is a button to reject all tracking cookies. Whenever you read the words malicious compliance within the context of this discussion you can just swap it with the word illegal which is the correct word for the behavior that is being bemoaned here.
  - shagie 1y ago
    I'm asking "if cookie consent banners are the less than idea solution, why isn't the official EU government site implementing it in a way that is ideal?" If a company is deciding how to comply with the GDPR on its website, can it go wrong with copying how that site does it? Alternatively, if it tries something that is new, do they risk getting sued by the EU for not following the GDPR? My claim that it isn't malicious compliance to use cookie consent banners, but rather the least risky approach since that is exactly how europa.eu complies with their own laws.
tjwebbnorfolk 1y ago
Important not to confuse the actual result vs. the hoped-for result. You HOPED that websites' top priority is to provide the best possible experience. The REALITY is that not getting sued is way more important than removing all possible user inconveniences.
deleted 1y ago
[deleted]
isodev 1y ago
> The problem here is not the law Of course. The law is clear, the intent is clear and the guidelines are clear. I think the biggest challenge (and the reason why it feels this is everywhere) is because of the handful of "big corporations" controlling the browsers. Neither Apple nor Google have any interest in making tracking opt-in or working to make this into a standard. In my view, the situation will be greatly improved with policy like the DMA being amplified even further to prevent cartel-like reactions from the FAANGs (whatever the acronym is today). We have a deep "culture difference" with the US, where everyone expects everything to be spelled out for them in the law so they can sue each other into oblivion, but the reality is this doesn't work. We need to reduce the influence of bigger players and install guardrails so it will never be possible again for a single company to have such dramatic influence over the world. Imagine how many of these consent prompts can be removed if it wasn't for the fact that even loading a Google Font exposes one to a few hundred "partners"?
- danaris 1y ago
  > Neither Apple nor Google have any interest in making tracking opt-in or working to make this into a standard. Apple has taken steps to make it harder to track, both in iOS apps and in the browser. It's Google whose revenue depends entirely on surveillance advertising. The problem is that the technical methods surveillance ad networks use within the browser to track us are features that are useful for many other things. Trying to redefine this as a technical problem, that can be solved purely by getting the browser makers to change how browsers work, rather than a sociopolitical problem, will fail. Sure, there are more things that Google—and probably Apple—could be doing to protect us, but they can't completely stop the tracking. The way to stop the tracking is to make laws banning targeted advertising.
  - isodev 1y ago
    > Apple has taken steps Apple engages in “privacy washing” - they take steps in the name of privacy when it disadvantages their competitors. At the same time, Apple has no problem collecting say Spotlight and Safari search terms … or “features” from Photos etc. I agree that ads as a monetisation channel were a mistake. But beyond that, privacy is a human right and should be applied without exception.
jacobtomlinson 1y ago
Ironic, I opened that article to be greeted with a cookie banner that didn't have a "Decline All" button.
monocularvision 1y ago
Everyone states this. At the same time, any official site I have ever visited for the EU government/regulators _has cookie banners_. Why would the EU malicious compliance itself?
adrr 1y ago
Or we could stop the charade of that cookie laws prevents tracking and get rid of all the stupid banners. All the beacons are firing in the back(server to server) now and all session data is passed on the inbound URL and stored. Browsers banning third party beacons, cookies laws, etc don't do anything. You can't even tell your being tracked.
- Scandiravian 1y ago
  GDPR is not about Cookies, it's about all tracking, including the examples you mention. As far as I understand the GDPR, the things you mention would also require the user to opt-in to be legal
dspillett 1y ago
> but malicious compliance by websites that don't want to give up tracking It isn't even compliance, they are just breaking the rules by as much as they think they can get away with and so far, for the most part, they are getting away with it.
duxup 1y ago
I feel like the law plays into that. That law has "discovered" that these rules for these sites suck because nobody wants to sit and decide what they want on a site by site basis and thus the "just get out of my face" kinda clicking and annoyance works. The idea that just visiting any given site I visit means I have to make some legal agreement makes no sense.
legitster 1y ago
Counterpoint - making every website you visit ask you about cookies still absolutely sucks. Even when they are fully in compliance it's a bad experience that makes using the internet worse. And it's all because the law was written by lawyers who care less about user experience or privacy than the companies that have to enforce it.
self_awareness 1y ago
"The problem is not the law but with the people who don't follow it." I mean... uh. If the world would only consist of people who want to cooperate and don't have malicious intentions, then WE WOULDN'T NEED THE LAW AT ALL. The law exists BECASUE OF the people who don't want to comply. So if the law doesn't control those people who don't want to comply, then the problem is with the law. Because if we're saying that the problem is with the people, then the discussion is pointless like a black hole.
JumpCrisscross 1y ago
> "Spend Five Minutes in a Menu of Legalese" is not the intended alternative to "Accept All". "Decline All" is! Do any browsers support running a minified LLM on device through an extension? Training an LLM to reject optional cookies (or better yet, fuck with the telemetry) would seem highly doable nowadays.
- begrid 1y ago
  You have Consent o matic firefox extension which works quite well, it works well on most websites
  - noisem4ker 1y ago
    uBlock Origin + Cookie Notice blocklists also work fine. I started to write this comment meaning to add that Firefox does it all by itself now, but I just read that such feature "is not currently available anymore". https://support.mozilla.org/en-US/kb/cookie-banner-reduction https://support.mozilla.org/en-US/kb/cookie-banner-reduction Does anyone know what happened after years of development, before I delve into their Bugzilla to find out?
    - Doohickey-d 1y ago
      Using uBlock to hide the cookie banners mostly works, but there are occasional websites where it's buggy: I have to disable uBlock, accept or reject cookies, then re-enable uBlock. So some websites actually require an accept/reject, and don't work if just visually hiding the banner, which is what this does.
calmoo 1y ago
It doesn't matter what the law is, it's setup to allow these malicious practices. It's bad legislation.
more_corn 1y ago
Are you kidding me?! The problem is absolutely the law. It specifically says websites have to. It could easily say “browsers have to” and 8 billion people would be spared the perpetual annoyance of cookie poop up warnings.
Aerroon 1y ago
But I don't want to deal with "Accept All" and "Decline All" either. First, I, the user, am requesting to open the website. It's not the website imposing on me. My browser, which supposedly is under my control, is what forwards all the data. Second, there is absolutely no way to know whether the website actually does what it says based on the cookie pop up. If it's a website based outside the EU then there's no way to enforce this cookie pop up. But if the browser handles this, then there is a way to enforce it. Of course, the downside there is that the website will then use other means to potentially collect the data, meaning that you still need the law to limit such data collection.

torginus 1y ago

I wonder why people don't build a collection of scripts into a browser plugin, like Adblock that auto rejects all tracking info to the greatest extent possible?

bvvgpc 1y ago
I would install that in a heartbeat!
- jraph 1y ago
  Then enable the cookie banner lists in uBlock Origin. Do expect occasional breakages and remember to temporarily disable the blocking to get through.
h4kor 1y ago
These exist. There is "Consent-O-Matic" for example
- Semaphor 1y ago
  Direct link, works on mobile as well: https://addons.mozilla.org/en-US/firefox/addon/consent-o-matic/ https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat... There’s probably also a version for the adtech browser somewhere.
- retSava 1y ago
  Isn't that the inverse? Ie auto-accept just to get rid of the UI box? Edit: their FF-page says, Set your preferences once, and let the technology do the rest! This add-on is built and maintained by workers at Aarhus University in Denmark. We are privacy researchers that got tired of seeing how companies violate the EU's General Data Protection Regulation (GDPR). Because the organisations that enforce the GDPR do not have enough resources, we built this add-on to help them out. We looked at 680 pop-ups and combined their data processing purposes into 5 categories that you can toggle on or off. Sometimes our categories don't perfectly match those on the website, so then we will choose the more privacy preserving option.
  - tcfhgj 1y ago
    > Isn't that the inverse? Ie auto-accept just to get rid of the UI box? no, that's "I don't care about Cookies"
lez 1y ago
There IS an optional list for ublock origin that tries to get rid of cookie nonsense.
inetknght 1y ago
uMatrix for Firefox and friends. NoScript too. And AdGuard.
layer8 1y ago
Ghostery does exactly that.

aaronrobinson 1y ago

This. And the ones that mean you have to manually switch off multiple legitimate interest toggles mean I just press the back button.

rkomorn 1y ago
> I just press the back button I do this more and more, and I think it's the right and best thing to do.
bmacho 1y ago
+1 it's a win-win situation. The website announces upfront that they are malicious so I can just leave
1718627440 1y ago
I do this as well, but in case I do want to read the site, I just delete the node from the DOM.
mrguyorama 1y ago
Since "legitimate interest" means you don't need consent, they do not let you toggle it off. If they are showing you a toggle and calling it for "legitimate interest", they are most likely lying. They love to put cookies under "performance and enhancements" as if that isn't bullshit as well. All legitimate interest cookies are in the greyed out toggle for "required cookies". By law, you can decline all and the site should still work fine, which again means they won't allow you to turn off actually needed cookies.
- deleted 1y ago
  [deleted]

emacdona 1y ago

One thousand percent yes. And I'll repeat because people need to see it called out as often as possible: this is due to malicious compliance by websites. Period. I'm so cynical now that I can't read articles like this without my first reaction being to look at how it benefits companies that profit from ads. My two theories here? 1. An attempt to shift liability from companies having to comply with GDPR to browsers having to comply. 2. An attempt to consolidate all cookie consent into the three (?) browser engines we have... so efforts to thwart it can be focused on just those places.

crazygringo 1y ago

No, the problem is 100% the law, because it was written in a way that allows this type of malicious compliance. Laws need to be written well to achieve good outcomes. If the law allows for malicious compliance, it is a badly written law. The sites are just trying to maximize profit, as anyone could predict. So write better laws.

itopaloglu83 1y ago
Although I agree the law isn’t as good as it could be. It’s also impossible to create perfect law when websites are looking to avoid the spirit of the law to begin with. Otherwise how can we explain “please see our privacy policy and send us a sneaker email to opt out” kind of tracking options.
- lesuorac 1y ago
  Yeah law is kinda like the rules in sports leagues. You have to keep updating it as the meta shits. It's impossible to write things correctly the first or final time and especially with the interpretation of words changing over time it doesn't matter if you could.
  - a4isms 1y ago
    Rules in sports are always being adjusted, and participants are always looking for (barely legal) ways to get around them. Example: In cycling, they banned narrow handlebars. There's an aero advantage, but it was seen as a safety problem. So cyclists canted their brake hoods way inside, rested their hands on the brake hoods, and got an aero advantage. And now there's a rule about brake hoods. Laws are meant only be living things that change as society changes, and also change to patch what we might call "exploits." You are perfectly correct: It's never one and done, it's an ongoing process.
  - jeroenhd 1y ago
    This is part of why a lot of EU directives are almost 50% "why this law is necessary and what we're trying to achieve", 30% "what needs to be implemented", and then 20% "who's going to look after all of this and how". That way, a misplaced comma or a wonky sentence doesn't allow for easy loopholes that need tighter laws to fix issues. Now law text will work forever, but this format makes for a very solid foundation.

itopaloglu83 1y ago

Tracking by default is not an acceptable solution, so I would say respecting the Do-Not-Track header must be mandatory and enforced by laws and percentage of global revenue fines.

bradleyy 1y ago
GPC (Global Privacy Control) is the header that's actually being enforced in (parts of) the US. DNT is considered deprecated by many, due to the nonconsensual way that Microsoft rolled it out.
- Nextgrid 1y ago
  Why is Microsoft's implementation a problem? Having the setting default to a safe value is the rational choice. It's like saying having a secure OS/browser would deprive malware authors of revenue, and thus vulnerabilities should be preserved unless the user explicitly opts into patching them.
  - TheCoelacanth 1y ago
    Yeah, and according to most privacy laws, not tracking should be the default.
  - bradleyy 1y ago
    https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer... This combined with governments ignoring it, and actively enforcing GPC... it's questionable whether compliance is necessary (I still suggest treating it the same as a GPC signal). But future work and effort should be put towards the GPC signal.
- velcrovan 1y ago
  For a new corporate website we just completed, we used GPC signals as the opt out mechanism. If your browser sends GPC, the site just opts you out of everything and loads zero tracking scripts. If it doesn't, you see a popup that explains how to turn it on if you want, or an "I understand" button. An approach like this seems ideal to me, the problem is that it's only natively supported in Firefox. Our instructions for Chrome and Edge are basically "install Privacy Badger." And Safari is the WORST, which as an Apple customer it pains me to say. Not only does the browser not support it, there are ZERO Safari browser extensions, NONE, on ANY platform (mac/iphone/ipad), that you can install that will send a simple GPC signal with the HTTP headers. There is a paid Safari extension on iOS called ChangeTheHeaders that you can configure to send a GPC signal, but come on, you can't ask normal people to buy an app and manually enter a specific HTTP header. (ChangeTheHeaders is made by Jeff Johnson, the same dev as StopTheMadness. I asked him whether he'd consider adding user-friendly GPC signals to that (or any other) plugin and he said it would just be "duplicating functionality" :-/ )

whywhywhywhy 1y ago

The problem is exactly the law then because it was written so incompetently that it left the loopholes to allow websites to try and trick accepting. Should have been written in the law that it’s a one toggle in browser settings. If government is going to impose on the internet the least they could do is be competent in what they impose. Not writing laws that waste lifetimes in collective hours a day as every person in Europe deals with multiple of these dialogs a day and thousands a year.

dns_snek 1y ago
> it left the loopholes to allow websites to try and trick accepting. It did not. These practices are illegal under the GDPR, the problem is a chronic lack of enforcement by most national enforcement agencies in all but the most severe cases. Some are just ineffective but others have gone completely rogue. Swedish Data Protection Authority (DPA) for example takes the position that commercial data brokers like Mrkoll are allowed to publish and sell people's personal information (including your current home address, hello stalkers!) [1] and that this is somehow protected under the pretense of "journalism" [2]. [1] https://mrkoll.se/resultat?n=Otto&c=&min=16&max=120&sex=a&c_stat=all&company= https://mrkoll.se/resultat?n=Otto&c=&min=16&max=120&sex=a&c_... [2] https://noyb.eu/en/swedish-data-brokers-claim-journalists-legal-protection-evade-eu-law https://noyb.eu/en/swedish-data-brokers-claim-journalists-le...
- dns_snek 1y ago
  [2] Doesn't fully capture the negligence of the Swedish DPA ("IMY"), here's a better source: > IMY’s practice of simply “forwarding” complaints. > The IMY’s way of dealing with complaints since the Supreme Administrative Court ruling is to attach an “appeal form” to their (non-)decisions. But it still doesn’t investigate the complaints. Instead, the authority simply forwards the complaint to the entity that illegally processes personal data and then immediately closes the case. This also happened in the case preceding noyb’s current legal action against the IMY. After a data subject filed a complaint regarding a recorded phone call, the authority forwarded it to the respondent without investigating. [3] https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-properly-deal-complaints https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-pro...

bradleyy 1y ago

The Global Privacy Control (GPC) is the header that actually has enforcement behind it in the US, and there are already companies getting fined. California has partnered with several other states to broaden enforcement. Would love something better than GPC, but in the interim, the EU should start considering it as a proper signal of (lack of) consent, obviating the need for a banner altogether.

Macha 1y ago
Ah, I was wondering why I was seeing more dialogs default to opt out when I hadn’t heard of any notable EU slap downs when it started

sothatsit 1y ago

I would blame ad providers more than individual website owners. From my experience, ad providers have made it very difficult to serve their ads unless you use an ad-supported cookie consent manager. I tried to write my own simple cookie consent form and gave up after realising how obscenely complicated TCF is. And since most ad-compatible cookie consent banners are provided by the ad companies themselves, you kinda just get stuck with bad options. I even tried to pay for a commercial cookie consent manager but it wasn’t supported by my ad provider. If I had more time I probably could have figured it out. But unfortunately I’m just running a hobby project and do not have weeks to spend on this. The revenue from the ads is what pays for hosting. I imagine lots of websites are in a similar boat. I would love if there was a simpler option that could respect people’s privacy more, be less annoying, and that would still allow websites like mine to survive by running ads. Targeting browsers instead of websites could have been that option.

gabeyaw 1y ago

The irony being this site doesn't offer a decline all option.

szszrk 1y ago
My default firefox settings rejected content tracker and in the end no cookies were created at all, plus there was just one failed CDN request outside original domain. Not bad.
- Nextgrid 1y ago
  Don't worry, you are still being tracked by IP + browser fingerprinting... and using a browser with a low single-digit marketshare stands out like a sore thumb. (which is also why framing GDPR discussions around cookies misses the point - the point is to determine the user's consent to being tracked regardless of technical ability, whether cookies, IP address, fingerprinting, or even some magic crystal ball)
  - GJim 1y ago
    > being tracked by IP + browser fingerprinting That is also illegal under the GDPR; you cannot track me without my explicit opt-in consent, whither by 'cookies' or other means. I continue to be astounded how little grasp some HN readers (a technical news site!) have of the GDPR.
    - Nextgrid 1y ago
      I am aware it is illegal, and yet just like for cookie-based tracking, everyone gets away with it.

UltraSane 1y ago

No. I absolutely do not want to be asked to accept cookies for every single website I visit.

Spivak 1y ago
This is the problem, the law clearly recognizes tracking as something people don't want. The fact that they let every website beg you to allow tracking instead of banning all but functional cookies is the problem. They capitulated to advertisers and this is the result. Nobody wants this crap.
- Nextgrid 1y ago
  The regulation actually specifies what counts as informed consent. Annoying users into accepting tracking does not count. The problem is that there's a chronic lack of enforcement, so the winning strategy is to breach the regulation. Worst case scenario, you will merely be forced to clean house at some point (but can enjoy the rewards of tracking until then).
GJim 1y ago
Then don't visit scummy websites (advertisers take a bow) that track you and seek to invade your privacy.
- UltraSane 1y ago
  It isn't just scummy websites that ask for cookies consent. It is half the web.
  - rkomorn 1y ago
    And half seems like a very conservative underestimate.

Aaargh20318 1y ago

> Of course, also respecting a Do-Not-Track header and avoiding the cookie banner entirely while not tracking the user, would be even better Best way to get rid of the cookie banner is to just forbid tracking completely. Given a free choice, how many people actually want to be tracked?

tcfhgj 1y ago
I allow tracking for a small selection of apps
phendrenad2 1y ago
> Given a free choice, how many people actually want to be tracked? Good question. But there isn't enough information to answer the question. Are these people properly informed about what "tracking" means, or do they think this means companies are passing around their full names and addresses on post-it notes?

jrm4 1y ago

The problem here is the problem everywhere; we still as a world have no remotely effective way to actually punish companies-as-bad-actors on the internet or in tech generally. None of any technical ANYTHING matters until we (meaning law and government) inflict truly meaningful consequences. Fines, breaking up companies, perhaps even jail time, etc.

danaris 1y ago
We have ways to do these things. We just refuse to use them, because our politicians either believe that companies should have more rights than we do, or are terrified that if they actually try to enforce the law on them they'll lose out on massive amounts of campaign contributions (whether direct or indirect).
Barrin92 1y ago
Yes. The problem isn't the letter of the law, it's that governing bodies like the EU need something like an enforcement czar who tells companies in no uncertain terms that if they're going to try to be clever they're going to get the ol' Jack Ma treatment. Stop letting the tail wag the dog. And before someone says that it will hamper innovation, I used to live in China and talk to investors often, they would always stress that for every guy with a billion who can't play by the rules there's a thousand guys with a million who have no problem taking the market share, that's hardly an issue

shagie 1y ago

> The problem here is not the law, but malicious compliance by websites that don't want to give up tracking. If that was the case, then why does the site from the EU first off track... and secondly why does it use a cookie banner rather than some other solution that would not be malicious compliance with the law? If there was a solution to having cookies and some other way of informing visitors of it, shouldn't that be demonstrated on the official EU government explaining GDPR? https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers... Can a company go wrong implementing the same approach as https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en uses? Why is that considered malicious compliance with the law?

Kbelicius 1y ago
> If that was the case, then why does the site from the EU first off track If you are asking why there isn't a "reject all" button on their webpage then the answer is simple. There is one. The "Accept only essential cookies". > and secondly why does it use a cookie banner rather than some other solution that would not be malicious compliance with the law? GDPR (general data protection regulation) is about general data protection, not about technology. It applies the same no matter if you are using cookies or something else. > Can a company go wrong implementing the same approach as https://european-union.europa.eu/index_en https://european-union.europa.eu/index_en uses? Why is that considered malicious compliance with the law? The example you've given is an example of compliance since there is a button to reject all tracking cookies. Whenever you read the words malicious compliance within the context of this discussion you can just swap it with the word illegal which is the correct word for the behavior that is being bemoaned here.
- shagie 1y ago
  I'm asking "if cookie consent banners are the less than idea solution, why isn't the official EU government site implementing it in a way that is ideal?" If a company is deciding how to comply with the GDPR on its website, can it go wrong with copying how that site does it? Alternatively, if it tries something that is new, do they risk getting sued by the EU for not following the GDPR? My claim that it isn't malicious compliance to use cookie consent banners, but rather the least risky approach since that is exactly how europa.eu complies with their own laws.

tjwebbnorfolk 1y ago

Important not to confuse the actual result vs. the hoped-for result. You HOPED that websites' top priority is to provide the best possible experience. The REALITY is that not getting sued is way more important than removing all possible user inconveniences.

deleted 1y ago

[deleted]

isodev 1y ago

> The problem here is not the law Of course. The law is clear, the intent is clear and the guidelines are clear. I think the biggest challenge (and the reason why it feels this is everywhere) is because of the handful of "big corporations" controlling the browsers. Neither Apple nor Google have any interest in making tracking opt-in or working to make this into a standard. In my view, the situation will be greatly improved with policy like the DMA being amplified even further to prevent cartel-like reactions from the FAANGs (whatever the acronym is today). We have a deep "culture difference" with the US, where everyone expects everything to be spelled out for them in the law so they can sue each other into oblivion, but the reality is this doesn't work. We need to reduce the influence of bigger players and install guardrails so it will never be possible again for a single company to have such dramatic influence over the world. Imagine how many of these consent prompts can be removed if it wasn't for the fact that even loading a Google Font exposes one to a few hundred "partners"?

danaris 1y ago
> Neither Apple nor Google have any interest in making tracking opt-in or working to make this into a standard. Apple has taken steps to make it harder to track, both in iOS apps and in the browser. It's Google whose revenue depends entirely on surveillance advertising. The problem is that the technical methods surveillance ad networks use within the browser to track us are features that are useful for many other things. Trying to redefine this as a technical problem, that can be solved purely by getting the browser makers to change how browsers work, rather than a sociopolitical problem, will fail. Sure, there are more things that Google—and probably Apple—could be doing to protect us, but they can't completely stop the tracking. The way to stop the tracking is to make laws banning targeted advertising.
- isodev 1y ago
  > Apple has taken steps Apple engages in “privacy washing” - they take steps in the name of privacy when it disadvantages their competitors. At the same time, Apple has no problem collecting say Spotlight and Safari search terms … or “features” from Photos etc. I agree that ads as a monetisation channel were a mistake. But beyond that, privacy is a human right and should be applied without exception.

jacobtomlinson 1y ago

Ironic, I opened that article to be greeted with a cookie banner that didn't have a "Decline All" button.

monocularvision 1y ago

Everyone states this. At the same time, any official site I have ever visited for the EU government/regulators _has cookie banners_. Why would the EU malicious compliance itself?

adrr 1y ago

Or we could stop the charade of that cookie laws prevents tracking and get rid of all the stupid banners. All the beacons are firing in the back(server to server) now and all session data is passed on the inbound URL and stored. Browsers banning third party beacons, cookies laws, etc don't do anything. You can't even tell your being tracked.

Scandiravian 1y ago
GDPR is not about Cookies, it's about all tracking, including the examples you mention. As far as I understand the GDPR, the things you mention would also require the user to opt-in to be legal

dspillett 1y ago

> but malicious compliance by websites that don't want to give up tracking It isn't even compliance, they are just breaking the rules by as much as they think they can get away with and so far, for the most part, they are getting away with it.

duxup 1y ago

I feel like the law plays into that. That law has "discovered" that these rules for these sites suck because nobody wants to sit and decide what they want on a site by site basis and thus the "just get out of my face" kinda clicking and annoyance works. The idea that just visiting any given site I visit means I have to make some legal agreement makes no sense.

legitster 1y ago

Counterpoint - making every website you visit ask you about cookies still absolutely sucks. Even when they are fully in compliance it's a bad experience that makes using the internet worse. And it's all because the law was written by lawyers who care less about user experience or privacy than the companies that have to enforce it.

self_awareness 1y ago

"The problem is not the law but with the people who don't follow it." I mean... uh. If the world would only consist of people who want to cooperate and don't have malicious intentions, then WE WOULDN'T NEED THE LAW AT ALL. The law exists BECASUE OF the people who don't want to comply. So if the law doesn't control those people who don't want to comply, then the problem is with the law. Because if we're saying that the problem is with the people, then the discussion is pointless like a black hole.

JumpCrisscross 1y ago

> "Spend Five Minutes in a Menu of Legalese" is not the intended alternative to "Accept All". "Decline All" is! Do any browsers support running a minified LLM on device through an extension? Training an LLM to reject optional cookies (or better yet, fuck with the telemetry) would seem highly doable nowadays.

begrid 1y ago
You have Consent o matic firefox extension which works quite well, it works well on most websites
- noisem4ker 1y ago
  uBlock Origin + Cookie Notice blocklists also work fine. I started to write this comment meaning to add that Firefox does it all by itself now, but I just read that such feature "is not currently available anymore". https://support.mozilla.org/en-US/kb/cookie-banner-reduction https://support.mozilla.org/en-US/kb/cookie-banner-reduction Does anyone know what happened after years of development, before I delve into their Bugzilla to find out?
  - Doohickey-d 1y ago
    Using uBlock to hide the cookie banners mostly works, but there are occasional websites where it's buggy: I have to disable uBlock, accept or reject cookies, then re-enable uBlock. So some websites actually require an accept/reject, and don't work if just visually hiding the banner, which is what this does.

calmoo 1y ago

It doesn't matter what the law is, it's setup to allow these malicious practices. It's bad legislation.

more_corn 1y ago

Are you kidding me?! The problem is absolutely the law. It specifically says websites have to. It could easily say “browsers have to” and 8 billion people would be spared the perpetual annoyance of cookie poop up warnings.

Aerroon 1y ago

But I don't want to deal with "Accept All" and "Decline All" either. First, I, the user, am requesting to open the website. It's not the website imposing on me. My browser, which supposedly is under my control, is what forwards all the data. Second, there is absolutely no way to know whether the website actually does what it says based on the cookie pop up. If it's a website based outside the EU then there's no way to enforce this cookie pop up. But if the browser handles this, then there is a way to enforce it. Of course, the downside there is that the website will then use other means to potentially collect the data, meaning that you still need the law to limit such data collection.