5 ms·

So they finally admit that it was a mistake. Even EU government websites had annoying giant cookie banners. Yet, some how the vast majority of HN comments def

So they finally admit that it was a mistake. Even EU government websites had annoying giant cookie banners. Yet, some how the vast majority of HN comments defend the cookie banners saying if you don't do anything "bad" then you don't need the banners.

m00dy 1y ago
worst implementation ever. I bet it is the reason that most people are now taking anti depressants.
basisword 1y ago
It worked to highlight the insane amount of tracking every fucking website does. Unfortunately it didn’t stop it. A browser setting letting me reject everything by default will be a better implementation. But this implementation only failed because almost every website owner wants to track your every move and share those moves with about 50 different other trackers and doesn’t want to be better.
- GardenLetter27 1y ago
  You can just set your browser not to send whichever cookies you don't want to. Cookies are a client-side technology. Why does the government need to be involved?
  - webstrand 1y ago
    Not all cookies are bad for the user, for instance the one that keeps you logged in or stores the session id. Those kind were never banned in the first place. Blocking cookies locally doesn't allow you to easily discriminate between tracking and functional cookies. And even if the browser had a UI for accepting or rejecting each cookie, they're not named such that a normal user could figure out which are important for not breaking the website, and which are just for tracking purposes. By passing a law that says "website providers must disambiguate" this situation can be improved.
    - youngtaff 1y ago
      Cookies that keep you logged in or maintain a session don’t need consent
      - webstrand 1y ago
        Blocking cookies client side will block all cookies regardless of value. Hence the usefullness of law to disambiguate.
  - layer8 1y ago
    The website wouldn’t inform you about which cookies are doing what. You wouldn’t have a basis to decide on which cookies you want because they are useful versus which you don’t because they track you. You also wouldn’t be informed when functional cookies suddenly turn into tracking cookies a week later. The whole point of the consent popups is to inform the user about what is going on. Without legislation, you wouldn’t get that information.
  - stavros 1y ago
    Because it's not like the browser has two thousand cookies per website, it only has one and then they share your data with the two thousand partners server-side. The government absolutely needs to be involved.
    - immibis 1y ago
      Actually it often is a separate cookie per tracker because that's convenient for the trackers. But the only reason they don't put in the effort to do it the way you said is that browsers don't have the feature to block individual cookies. If they did, they would.
      - 1718627440 1y ago
        Some browsers like Midori do the sensible thing and ask you for every cookie, whether you actually want to have it. Cookie dialogs are then entirely redundant. You can click accept all in the website, and reject all in the browser.
        immibis 1y ago
        Which is presumably the reason nobody uses Midori
        1718627440 1y ago
        I liked it. The reason I don't use it is because it doesn't support modern JS heavy websites.
    - AnthonyMouse 1y ago
      To begin with that isn't true, because the worst offenders are third party cookies, since they can track the user between websites, but then you can block them independently of the first party cookies. Then you have the problem that if they are using a single cookie, you now can't block it because you need it to be set so it stops showing you the damn cookie banner every time, but meanwhile there is no good way for the user or the government to be able to tell what they're doing with the data on the back end anyway. So now you have to let them set the cookie and hope they're not breaking a law where it's hard to detect violations, instead of blocking the cookie on every site where it has no apparent utility to you. But the real question is, why does this have anything to do with cookies to begin with? If you want to ban data sharing or whatever then who cares whether it involves cookies or not? If they set a cookie and sell your data that's bad but if they're fingerprinting your browser and do it then it's all good? Sometimes laws are dumb simply because the people drafting them were bad at it.
  - rebolek 1y ago
    Of course, let ME decide if I want to keep fdfhfiudva=dsaafndsafndsoai and remove cindijcasndiuv=fwíáqfewjfoi. I know best what those cookies do!
  - eitau_1 1y ago
    If there's no regulation, nothing stops a website from telling hundreds of third-party entities about your visit. No amount of fiddling with browser settings and extensions will prevent a keen website operator from contributing to tracking you (at least on ip/household level) by colluding with data brokers via the back-end.
  - troupo 1y ago
    Because it's not about cookies. Ad trackers shouldn't store my precise geolocation for 12 years for example: https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541
- fmbb 1y ago
  50 is not even close. Those banners often list up to 3000 ”partners”.
- graemep 1y ago
  The cookie law made this worse. I used to use an extension that let me whitelist which sites could set cookies (which was pretty much those I wanted to login to). I had to stop using it because I had to allow the cookie preference cookies on too many sites.
  - immibis 1y ago
    There could be an extension to block the banners, too. I think uBO has a feature to block certain CSS classes?
    - graemep 1y ago
      The only thing that works well for me is using an extension that automatically gives permissions and another that auto deletes cookies when i close the tab. The problem with Ublock etc. is that just blocking breaks quite a lot of sites.
  - whstl 1y ago
    uBlock blocks most of those for me lately.
  - pessimizer 1y ago
    You can fix that. I use an extension called "I don't care about cookies" that clicks "yes" to all cookies on all websites, and I use another extension* that doesn't allow any cookies to be set unless I whitelist the site, and I can do this finely even e.g. to the point where I accept a cookie from one page to get to the next page, then drop it, and drop the entire site from even that whitelist when I leave the page, setting this all with a couple of clicks. * Sadly the second is unmaintained, and lets localStorage stuff through. There are other extensions that have to be called in (I still need to hide referers and other things anyway.) https://addons.mozilla.org/en-US/firefox/addon/forget_me_not/ https://addons.mozilla.org/en-US/firefox/addon/forget_me_not.... I have the simultaneous desire to take the extension over or fork it, and the desire not to get more involved with the sinking ship which is Firefox. Especially with the way they treat extension developers. https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... does a similar thing.
youngtaff 1y ago
Cookie banners are made obtrusive by the people running CMPs as they want to make it as hard as possible to stop collecting the data
- Mountain_Skies 1y ago
  Funny thing is that I often will go out of my way to find the least permissive settings if the banner is obnoxious or has a dark pattern.
LogicFailsMe 1y ago
every accusation is a confession you see...
legitster 1y ago
> Yet, some how the vast majority of HN comments defend the cookie banners saying if you don't do anything "bad" then you don't need the banners. There are a LOT of shades of gray when it comes to website tracking and HN commenters refuse to deal with nuance. Imagine running a store, and then I ask you how many customers you had yesterday and what they are looking at. "I don't watch the visitors - it's unnecessary and invasive". When in fact, having a general idea what your customers are looking for or doing in your store is pretty essential for running your business. Obviously, this is different than taking the customer's picture and trading it with the store across the street. When it comes to websites and cookie use, the GDPR treated both behaviors identically.
- pseudalopex 1y ago
  > Imagine running a store, and then I ask you how many customers you had yesterday and what they are looking at. Server logs can provide this information.
  - legitster 1y ago
    Not for the amount of stuff on the web now that is client-side rendered.
    - pseudalopex 1y ago
      Client side rendering means in practice clicking a product retrieves JSON and images instead of HTML and images. This can be logged.
  - crazygringo 1y ago
    Only in very simple ways. Realistically, you want to know things like, how many users who looked at something made a purchase in the next 3 days? Is that going up or down after a recent change we made? Many necessary business analytics require tracking and aggregating the behavior of individual users. You can't do that with server logs.
    - 1y ago
croes 1y ago
> if you don't do anything "bad" then you don't need the banners. Because that’s how it is. For instance why does a site need to share my data with over 1000 "partners“? And the EU uses the same tracking and website frameworks as others so they got banners automatically. It wasn’t a mistake but website providers maliciously complied with the banners to shift the blame. Seems you fell for it.

m00dy 1y ago

worst implementation ever. I bet it is the reason that most people are now taking anti depressants.

basisword 1y ago

It worked to highlight the insane amount of tracking every fucking website does. Unfortunately it didn’t stop it. A browser setting letting me reject everything by default will be a better implementation. But this implementation only failed because almost every website owner wants to track your every move and share those moves with about 50 different other trackers and doesn’t want to be better.

GardenLetter27 1y ago
You can just set your browser not to send whichever cookies you don't want to. Cookies are a client-side technology. Why does the government need to be involved?
- webstrand 1y ago
  Not all cookies are bad for the user, for instance the one that keeps you logged in or stores the session id. Those kind were never banned in the first place. Blocking cookies locally doesn't allow you to easily discriminate between tracking and functional cookies. And even if the browser had a UI for accepting or rejecting each cookie, they're not named such that a normal user could figure out which are important for not breaking the website, and which are just for tracking purposes. By passing a law that says "website providers must disambiguate" this situation can be improved.
  - youngtaff 1y ago
    Cookies that keep you logged in or maintain a session don’t need consent
    - webstrand 1y ago
      Blocking cookies client side will block all cookies regardless of value. Hence the usefullness of law to disambiguate.
- layer8 1y ago
  The website wouldn’t inform you about which cookies are doing what. You wouldn’t have a basis to decide on which cookies you want because they are useful versus which you don’t because they track you. You also wouldn’t be informed when functional cookies suddenly turn into tracking cookies a week later. The whole point of the consent popups is to inform the user about what is going on. Without legislation, you wouldn’t get that information.
- stavros 1y ago
  Because it's not like the browser has two thousand cookies per website, it only has one and then they share your data with the two thousand partners server-side. The government absolutely needs to be involved.
  - immibis 1y ago
    Actually it often is a separate cookie per tracker because that's convenient for the trackers. But the only reason they don't put in the effort to do it the way you said is that browsers don't have the feature to block individual cookies. If they did, they would.
    - 1718627440 1y ago
      Some browsers like Midori do the sensible thing and ask you for every cookie, whether you actually want to have it. Cookie dialogs are then entirely redundant. You can click accept all in the website, and reject all in the browser.
      - immibis 1y ago
        Which is presumably the reason nobody uses Midori
        1718627440 1y ago
        I liked it. The reason I don't use it is because it doesn't support modern JS heavy websites.
  - AnthonyMouse 1y ago
    To begin with that isn't true, because the worst offenders are third party cookies, since they can track the user between websites, but then you can block them independently of the first party cookies. Then you have the problem that if they are using a single cookie, you now can't block it because you need it to be set so it stops showing you the damn cookie banner every time, but meanwhile there is no good way for the user or the government to be able to tell what they're doing with the data on the back end anyway. So now you have to let them set the cookie and hope they're not breaking a law where it's hard to detect violations, instead of blocking the cookie on every site where it has no apparent utility to you. But the real question is, why does this have anything to do with cookies to begin with? If you want to ban data sharing or whatever then who cares whether it involves cookies or not? If they set a cookie and sell your data that's bad but if they're fingerprinting your browser and do it then it's all good? Sometimes laws are dumb simply because the people drafting them were bad at it.
- rebolek 1y ago
  Of course, let ME decide if I want to keep fdfhfiudva=dsaafndsafndsoai and remove cindijcasndiuv=fwíáqfewjfoi. I know best what those cookies do!
- eitau_1 1y ago
  If there's no regulation, nothing stops a website from telling hundreds of third-party entities about your visit. No amount of fiddling with browser settings and extensions will prevent a keen website operator from contributing to tracking you (at least on ip/household level) by colluding with data brokers via the back-end.
- troupo 1y ago
  Because it's not about cookies. Ad trackers shouldn't store my precise geolocation for 12 years for example: https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541
fmbb 1y ago
50 is not even close. Those banners often list up to 3000 ”partners”.
graemep 1y ago
The cookie law made this worse. I used to use an extension that let me whitelist which sites could set cookies (which was pretty much those I wanted to login to). I had to stop using it because I had to allow the cookie preference cookies on too many sites.
- immibis 1y ago
  There could be an extension to block the banners, too. I think uBO has a feature to block certain CSS classes?
  - graemep 1y ago
    The only thing that works well for me is using an extension that automatically gives permissions and another that auto deletes cookies when i close the tab. The problem with Ublock etc. is that just blocking breaks quite a lot of sites.
- whstl 1y ago
  uBlock blocks most of those for me lately.
- pessimizer 1y ago
  You can fix that. I use an extension called "I don't care about cookies" that clicks "yes" to all cookies on all websites, and I use another extension* that doesn't allow any cookies to be set unless I whitelist the site, and I can do this finely even e.g. to the point where I accept a cookie from one page to get to the next page, then drop it, and drop the entire site from even that whitelist when I leave the page, setting this all with a couple of clicks. * Sadly the second is unmaintained, and lets localStorage stuff through. There are other extensions that have to be called in (I still need to hide referers and other things anyway.) https://addons.mozilla.org/en-US/firefox/addon/forget_me_not/ https://addons.mozilla.org/en-US/firefox/addon/forget_me_not.... I have the simultaneous desire to take the extension over or fork it, and the desire not to get more involved with the sinking ship which is Firefox. Especially with the way they treat extension developers. https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... does a similar thing.

youngtaff 1y ago

Cookie banners are made obtrusive by the people running CMPs as they want to make it as hard as possible to stop collecting the data

Mountain_Skies 1y ago
Funny thing is that I often will go out of my way to find the least permissive settings if the banner is obnoxious or has a dark pattern.

LogicFailsMe 1y ago

every accusation is a confession you see...

legitster 1y ago

> Yet, some how the vast majority of HN comments defend the cookie banners saying if you don't do anything "bad" then you don't need the banners. There are a LOT of shades of gray when it comes to website tracking and HN commenters refuse to deal with nuance. Imagine running a store, and then I ask you how many customers you had yesterday and what they are looking at. "I don't watch the visitors - it's unnecessary and invasive". When in fact, having a general idea what your customers are looking for or doing in your store is pretty essential for running your business. Obviously, this is different than taking the customer's picture and trading it with the store across the street. When it comes to websites and cookie use, the GDPR treated both behaviors identically.

pseudalopex 1y ago
> Imagine running a store, and then I ask you how many customers you had yesterday and what they are looking at. Server logs can provide this information.
- legitster 1y ago
  Not for the amount of stuff on the web now that is client-side rendered.
  - pseudalopex 1y ago
    Client side rendering means in practice clicking a product retrieves JSON and images instead of HTML and images. This can be logged.
- crazygringo 1y ago
  Only in very simple ways. Realistically, you want to know things like, how many users who looked at something made a purchase in the next 3 days? Is that going up or down after a recent change we made? Many necessary business analytics require tracking and aggregating the behavior of individual users. You can't do that with server logs.
  - 1y ago

croes 1y ago

> if you don't do anything "bad" then you don't need the banners. Because that’s how it is. For instance why does a site need to share my data with over 1000 "partners“? And the EU uses the same tracking and website frameworks as others so they got banners automatically. It wasn’t a mistake but website providers maliciously complied with the banners to shift the blame. Seems you fell for it.