3 ms·

Those “cookie banners” are nonsense aimed at getting this outcome. This is a loss for European citizens and small businesses and a win for the trillion dollar

Those “cookie banners” are nonsense aimed at getting this outcome. This is a loss for European citizens and small businesses and a win for the trillion dollar ecosystem of data abuse.

immibis 1y ago
There's the confusion about whether ePD (which is all cookies even functional ones) was superseded by GDPR or whether it wasn't and both rules apply. Personally I think common sense is that GDPR replaced ePD or at least its cookie banner rule, but I'm also not a company with billions of euros to sue.
nonethewiser 1y ago
How can you comply with the current requirements without cookie banners? Why would EU governments use cookie banners if they are just nonsense meant to degrade approval of GDPR?
- BadBadJellyBean 1y ago
  By not putting a billion trackers on your site and also by not using dark patterns. The idea was a simple yes or no. It became: "yes or click through these 1000 trackers" or "yes or pay". The problem is that it became normal to just collect and hoard data about everyone.
  - tantalor 1y ago
    > billion trackers ... dark patterns Straw man argument. The rule equally applies to sites with just one tracker and no dark patterns.
  - nonethewiser 1y ago
    Again, then why does the EU do this? Clearly its not simply about erroding confidence in GDPR if the EU is literally doing it themselves. Besides, you seem to be confusing something. GDPR requires explicit explanation of each cookie, including these 1000s of trackers. It in no way bans these. This is just GDPR working as intended - some people want to have 1000s of trackers and GDPR makes them explain each one with a permission. Maybe it would be nice to not have so many trackers. Maybe the EU should ban trackers. Maybe consumers should care about granular cookie permissions and stop using websites that have 1000s of them because its annoying as fuck. But some companies do prefer to have these trackers and it is required by GDPR to confront the user with the details and a control.
    - pseudalopex 1y ago
      > Besides, you seem to be confusing something. No. You asked How can you comply with the current requirements without cookie banners? Not How can you have trackers and comply with the current requirements without cookie banners? And don't use dark patterns would have answered this question as well.
      - nonethewiser 1y ago
        >No. You asked How can you comply with the current requirements without cookie banners? Within the context of the discussion of if its malicious compliance or a natural consequence of the law. Obviously you could have a website with 0 cookies but thats not the world we live in. Maybe you were hoping GDPR would have the side effect of people using less cookies? It in no way requires that though. I mean just think of it this way. Company A uses Scary Dark Pattern. EU makes regulation requiring information and consent from user for companies that use Scary Dark Pattern. Company A adds information and consent about Scary Dark Pattern. Where is the malicious compliance? The EU never made tracker cookies or cookies over some amount illegal.
        pseudalopex 1y ago
        > Within the context of the discussion of if its malicious compliance or a natural consequence of the law. You ignored I said don't use dark patterns answered the question you meant to ask. > Obviously you could have a website with 0 cookies but thats not the world we live in. Maybe you were hoping GDPR would have the side effect of people using less cookies? We were discussing trackers. Not cookies. > I mean just think of it this way. Company A uses Scary Dark Pattern. EU makes regulation requiring information and consent from user for companies that use Scary Dark Pattern. Company A adds information and consent about Scary Dark Pattern. I will not think of it using an unnecessary and incorrect analogy. And writing things like Scary Dark Pattern is childish and shows bad faith. > Where is the malicious compliance? The EU never made tracker cookies or cookies over some amount illegal. The malicious compliance is the dark patterns you ignored. Rejecting cookies was much more complicated than accepting them. Users were pressured to consent by constantly repeating banners. The “optimal user experience” and “accept and close” labels were misleading. These were ruled not compliance in fact.[1] But the companies knew it was malicious and thought it was compliance. Ignoring Do Not Track or Global Privacy Control and presenting a cookie banner is a dark pattern as well. [1] https://techgdpr.com/blog/data-protection-digest-3062025-the-reject-all-button-is-a-must-legitimate-interest-as-the-data-controllers-initiative/ https://techgdpr.com/blog/data-protection-digest-3062025-the...
- croes 1y ago
  Don’t track your site visitors. No tracking, no banner. Or respect the now deprecated DNT flag, no banner necessary. Now we get DNT 2.0 and the website owner will once again maliciously comply.
  - nonethewiser 1y ago
    OK sounds great. But some companies prefer to have trackers. They are required by GDPR to explain each cookie and offer a control for permissions. They probably had trackers before GDPR too. So how is that malicious compliance? They are just operating how they did before except now they are observing GDPR. It sounds like maybe you just want them to ban trackers. Or for people to care more about trackers and stop using websites with trackers (thereby driving down trackers) Great. Those are all great. But none of them happened and none of that is dictated by GDPR.
    - Neikius 1y ago
      You can have first party trackers. That is not so hard. Every site onto itself is a first party tracker, but if your developers can't do it there are opensource solutions available to host.
      - nonethewiser 1y ago
        Again, great. Didn't happen and isn't required by GDPR though.
      - inkysigma 1y ago
        1p solutions still require consent since the analytics banners are also there to enable processing of personal information in the first place (on the most primitive level IP address)
        Neikius 11mo ago
        Oh? But the site is processing IP address when the web server logs your visit. Maybe I missed a part of GDPR somewhere, guess I gotta re-read it.
- hdgvhicv 1y ago
  By not setting a cookie until the user does something active when I then tell them (say on “log in” or “add to basket”.
  - nonethewiser 1y ago
    I dont think you actually need a cookie for that, technically. But I take your point. What about trackers which they want to set immediately on page load? Just separate prompts for each seems worse than 1 condensed view. You might say "but trackers suck - I don't care about supporting a good UX for them" and it would be hard to disagree. But I'm making the point that its not malicious compliance. It would be great if people didn't use trackers but that is the status quo and GDPR didn't make theme illegal. Simply operating as normal plus new GDPR compliance clearly isnt malicious. The reality is cookie banners everywhere was an inevitable consequence of GDPR.
    - mr_toad 1y ago
      > But I'm making the point that its not malicious compliance. It’s totally technically feasible to have a non-blocking opt-in box. But sites effectively make a legally mandated opt-in dialog into an opt-out dialog by making it block the site. Blocking the page loading until the banner is dismissed is definitely malicious, and arguably not compliant at all. And lets not get started on all the sites where the banner is just non-functional smoke screen.
  - watermelon0 1y ago
    You don't need a cookie banner for authentication/shopping basket cookies, since these are essential. However, you are still required to provide a list of essential cookies and their usage somewhere on the website.
    - phendrenad2 1y ago
      This. I don't know why there's a heavy overlap between the "GDPR didn't go far enough" people and not actually reading the GRPR. I'd think they would overlap a lot with people who actually read it.
- vouwfietsman 1y ago
  > Why would EU governments use cookie banners They generally don't, because you don't need banners to store cookies that you need to store to have a working site. In other words, if you see cookie banner, somebody is asking to store/track stuff about you that's not really needed. Cookie banners were invented by the market as a loophole to continue dark patterns and bad practices. EU is catching flak because its extremely hard to legislate against explicit bad actors abusing loopholes in new technology. But yeah, blame EU. And before you go all "but my analytics is needed to get 1% more conversion on my webshop": if you have to convince me to buy your product by making the BUY button 10% larger and pulsate rainbow colors because your A/B test told you so, I will happily include that in the category "dark patterns".
  - nonethewiser 1y ago
    In terms of whether or not the ubiquity of cookie banners is malicious compliance or if it was an inevitable consequence of GDPR, it doesnt matter if trackers are good or necessary. GDPR doesn't ban them. So having them and getting consent is just a normal consequence. We can say, "Wouldn't it have been nice if the bad UX of all these cookies organically led to the death of trackers," but it didn't. And now proponents of GDPR are blaming companies for following GDPR. This comes from confusing the actual law with a desired side effect that didn't materialize.
    - troupo 1y ago
      No, those companies do not follow GDPR. They are testing how far they can go without triggering mass complaints etc. See https://noyb.eu/en/where-did-all-reject-buttons-come https://noyb.eu/en/where-did-all-reject-buttons-come
    - vouwfietsman 1y ago
      > And now proponents of GDPR are blaming companies for following GDPR. Not really, proponents of GDPR are aware that GDPR explicitly blocking trackers would be extremely hard as there is a significant gray area where cookies can be useful but non-essential, so you'd have to define very specifically what constitutes a tracker or do a blanket ban and hurt legitimate use-cases. Both are bad. For some reason though people think that the body that institutes laws that try to make the world a better place, when loopholes are found and abused for profit, this is somehow the standard body making a mistake, rather than each individual profit-seeking loophole-abusing entity being the problematic and blame-worthy actor. I never understand why, I guess you work somewhere that makes money off of this.
- Neikius 1y ago
  By not tracking and setting any third party cookies. Just using strictly functional cookies is fine, just put a disclaimer somewhere in the footer and explain as those are already allowed and cannot be disabled anyway.
  - petcat 1y ago
    The EU's own government websites are polluted with cookie banners. They couldn't even figure out how to comply with their own laws except to just spam the user with cookie consent forms.
    - consp 1y ago
      The eu's maybe but for my government i have no banners.
- a2128 1y ago
  See this article by GitHub about how they removed cookie banners: https://github.blog/news-insights/company-news/no-cookie-for-you/ https://github.blog/news-insights/company-news/no-cookie-for... EU law requires you to use cookie banners if your website contains cookies that are not required for it to work. Common examples of such cookies are those used by third-party analytics, tracking, and advertising services. [...] we find cookie banners quite irritating, so we decided to look for a solution. After a brief search, we found one: just don’t use any non-essential cookies. Pretty simple, really.
  - missingdays 1y ago
    When I open this link I'm greeted with the cookies banner "We use optional cookies to improve your experience on our websites and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services listed above will be used. You may change your selection on which cookies to accept by clicking "Manage Cookies" at the bottom of the page to change your selection. This selection is maintained for 180 days. Please review your selections regularly. "

Those “cookie banners” are nonsense aimed at getting this outcome. This is a loss for European citizens and small businesses and a win for the trillion dollar ecosystem of data abuse.

immibis 1y ago

There's the confusion about whether ePD (which is all cookies even functional ones) was superseded by GDPR or whether it wasn't and both rules apply. Personally I think common sense is that GDPR replaced ePD or at least its cookie banner rule, but I'm also not a company with billions of euros to sue.

nonethewiser 1y ago

How can you comply with the current requirements without cookie banners? Why would EU governments use cookie banners if they are just nonsense meant to degrade approval of GDPR?

BadBadJellyBean 1y ago
By not putting a billion trackers on your site and also by not using dark patterns. The idea was a simple yes or no. It became: "yes or click through these 1000 trackers" or "yes or pay". The problem is that it became normal to just collect and hoard data about everyone.
- tantalor 1y ago
  > billion trackers ... dark patterns Straw man argument. The rule equally applies to sites with just one tracker and no dark patterns.
- nonethewiser 1y ago
  Again, then why does the EU do this? Clearly its not simply about erroding confidence in GDPR if the EU is literally doing it themselves. Besides, you seem to be confusing something. GDPR requires explicit explanation of each cookie, including these 1000s of trackers. It in no way bans these. This is just GDPR working as intended - some people want to have 1000s of trackers and GDPR makes them explain each one with a permission. Maybe it would be nice to not have so many trackers. Maybe the EU should ban trackers. Maybe consumers should care about granular cookie permissions and stop using websites that have 1000s of them because its annoying as fuck. But some companies do prefer to have these trackers and it is required by GDPR to confront the user with the details and a control.
  - pseudalopex 1y ago
    > Besides, you seem to be confusing something. No. You asked How can you comply with the current requirements without cookie banners? Not How can you have trackers and comply with the current requirements without cookie banners? And don't use dark patterns would have answered this question as well.
    - nonethewiser 1y ago
      >No. You asked How can you comply with the current requirements without cookie banners? Within the context of the discussion of if its malicious compliance or a natural consequence of the law. Obviously you could have a website with 0 cookies but thats not the world we live in. Maybe you were hoping GDPR would have the side effect of people using less cookies? It in no way requires that though. I mean just think of it this way. Company A uses Scary Dark Pattern. EU makes regulation requiring information and consent from user for companies that use Scary Dark Pattern. Company A adds information and consent about Scary Dark Pattern. Where is the malicious compliance? The EU never made tracker cookies or cookies over some amount illegal.
      - pseudalopex 1y ago
        > Within the context of the discussion of if its malicious compliance or a natural consequence of the law. You ignored I said don't use dark patterns answered the question you meant to ask. > Obviously you could have a website with 0 cookies but thats not the world we live in. Maybe you were hoping GDPR would have the side effect of people using less cookies? We were discussing trackers. Not cookies. > I mean just think of it this way. Company A uses Scary Dark Pattern. EU makes regulation requiring information and consent from user for companies that use Scary Dark Pattern. Company A adds information and consent about Scary Dark Pattern. I will not think of it using an unnecessary and incorrect analogy. And writing things like Scary Dark Pattern is childish and shows bad faith. > Where is the malicious compliance? The EU never made tracker cookies or cookies over some amount illegal. The malicious compliance is the dark patterns you ignored. Rejecting cookies was much more complicated than accepting them. Users were pressured to consent by constantly repeating banners. The “optimal user experience” and “accept and close” labels were misleading. These were ruled not compliance in fact.[1] But the companies knew it was malicious and thought it was compliance. Ignoring Do Not Track or Global Privacy Control and presenting a cookie banner is a dark pattern as well. [1] https://techgdpr.com/blog/data-protection-digest-3062025-the-reject-all-button-is-a-must-legitimate-interest-as-the-data-controllers-initiative/ https://techgdpr.com/blog/data-protection-digest-3062025-the...
croes 1y ago
Don’t track your site visitors. No tracking, no banner. Or respect the now deprecated DNT flag, no banner necessary. Now we get DNT 2.0 and the website owner will once again maliciously comply.
- nonethewiser 1y ago
  OK sounds great. But some companies prefer to have trackers. They are required by GDPR to explain each cookie and offer a control for permissions. They probably had trackers before GDPR too. So how is that malicious compliance? They are just operating how they did before except now they are observing GDPR. It sounds like maybe you just want them to ban trackers. Or for people to care more about trackers and stop using websites with trackers (thereby driving down trackers) Great. Those are all great. But none of them happened and none of that is dictated by GDPR.
  - Neikius 1y ago
    You can have first party trackers. That is not so hard. Every site onto itself is a first party tracker, but if your developers can't do it there are opensource solutions available to host.
    - nonethewiser 1y ago
      Again, great. Didn't happen and isn't required by GDPR though.
    - inkysigma 1y ago
      1p solutions still require consent since the analytics banners are also there to enable processing of personal information in the first place (on the most primitive level IP address)
      - Neikius 11mo ago
        Oh? But the site is processing IP address when the web server logs your visit. Maybe I missed a part of GDPR somewhere, guess I gotta re-read it.
hdgvhicv 1y ago
By not setting a cookie until the user does something active when I then tell them (say on “log in” or “add to basket”.
- nonethewiser 1y ago
  I dont think you actually need a cookie for that, technically. But I take your point. What about trackers which they want to set immediately on page load? Just separate prompts for each seems worse than 1 condensed view. You might say "but trackers suck - I don't care about supporting a good UX for them" and it would be hard to disagree. But I'm making the point that its not malicious compliance. It would be great if people didn't use trackers but that is the status quo and GDPR didn't make theme illegal. Simply operating as normal plus new GDPR compliance clearly isnt malicious. The reality is cookie banners everywhere was an inevitable consequence of GDPR.
  - mr_toad 1y ago
    > But I'm making the point that its not malicious compliance. It’s totally technically feasible to have a non-blocking opt-in box. But sites effectively make a legally mandated opt-in dialog into an opt-out dialog by making it block the site. Blocking the page loading until the banner is dismissed is definitely malicious, and arguably not compliant at all. And lets not get started on all the sites where the banner is just non-functional smoke screen.
- watermelon0 1y ago
  You don't need a cookie banner for authentication/shopping basket cookies, since these are essential. However, you are still required to provide a list of essential cookies and their usage somewhere on the website.
  - phendrenad2 1y ago
    This. I don't know why there's a heavy overlap between the "GDPR didn't go far enough" people and not actually reading the GRPR. I'd think they would overlap a lot with people who actually read it.
vouwfietsman 1y ago
> Why would EU governments use cookie banners They generally don't, because you don't need banners to store cookies that you need to store to have a working site. In other words, if you see cookie banner, somebody is asking to store/track stuff about you that's not really needed. Cookie banners were invented by the market as a loophole to continue dark patterns and bad practices. EU is catching flak because its extremely hard to legislate against explicit bad actors abusing loopholes in new technology. But yeah, blame EU. And before you go all "but my analytics is needed to get 1% more conversion on my webshop": if you have to convince me to buy your product by making the BUY button 10% larger and pulsate rainbow colors because your A/B test told you so, I will happily include that in the category "dark patterns".
- nonethewiser 1y ago
  In terms of whether or not the ubiquity of cookie banners is malicious compliance or if it was an inevitable consequence of GDPR, it doesnt matter if trackers are good or necessary. GDPR doesn't ban them. So having them and getting consent is just a normal consequence. We can say, "Wouldn't it have been nice if the bad UX of all these cookies organically led to the death of trackers," but it didn't. And now proponents of GDPR are blaming companies for following GDPR. This comes from confusing the actual law with a desired side effect that didn't materialize.
  - troupo 1y ago
    No, those companies do not follow GDPR. They are testing how far they can go without triggering mass complaints etc. See https://noyb.eu/en/where-did-all-reject-buttons-come https://noyb.eu/en/where-did-all-reject-buttons-come
  - vouwfietsman 1y ago
    > And now proponents of GDPR are blaming companies for following GDPR. Not really, proponents of GDPR are aware that GDPR explicitly blocking trackers would be extremely hard as there is a significant gray area where cookies can be useful but non-essential, so you'd have to define very specifically what constitutes a tracker or do a blanket ban and hurt legitimate use-cases. Both are bad. For some reason though people think that the body that institutes laws that try to make the world a better place, when loopholes are found and abused for profit, this is somehow the standard body making a mistake, rather than each individual profit-seeking loophole-abusing entity being the problematic and blame-worthy actor. I never understand why, I guess you work somewhere that makes money off of this.
Neikius 1y ago
By not tracking and setting any third party cookies. Just using strictly functional cookies is fine, just put a disclaimer somewhere in the footer and explain as those are already allowed and cannot be disabled anyway.
- petcat 1y ago
  The EU's own government websites are polluted with cookie banners. They couldn't even figure out how to comply with their own laws except to just spam the user with cookie consent forms.
  - consp 1y ago
    The eu's maybe but for my government i have no banners.
a2128 1y ago
See this article by GitHub about how they removed cookie banners: https://github.blog/news-insights/company-news/no-cookie-for-you/ https://github.blog/news-insights/company-news/no-cookie-for... EU law requires you to use cookie banners if your website contains cookies that are not required for it to work. Common examples of such cookies are those used by third-party analytics, tracking, and advertising services. [...] we find cookie banners quite irritating, so we decided to look for a solution. After a brief search, we found one: just don’t use any non-essential cookies. Pretty simple, really.
- missingdays 1y ago
  When I open this link I'm greeted with the cookies banner "We use optional cookies to improve your experience on our websites and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services listed above will be used. You may change your selection on which cookies to accept by clicking "Manage Cookies" at the bottom of the page to change your selection. This selection is maintained for 180 days. Please review your selections regularly. "