5 ms·

> Why would EU governments use cookie banners They generally don't, because you don't need banners to store cookies that you need to store to have a working si

> Why would EU governments use cookie banners They generally don't, because you don't need banners to store cookies that you need to store to have a working site. In other words, if you see cookie banner, somebody is asking to store/track stuff about you that's not really needed. Cookie banners were invented by the market as a loophole to continue dark patterns and bad practices. EU is catching flak because its extremely hard to legislate against explicit bad actors abusing loopholes in new technology. But yeah, blame EU. And before you go all "but my analytics is needed to get 1% more conversion on my webshop": if you have to convince me to buy your product by making the BUY button 10% larger and pulsate rainbow colors because your A/B test told you so, I will happily include that in the category "dark patterns".

nonethewiser 11mo ago
In terms of whether or not the ubiquity of cookie banners is malicious compliance or if it was an inevitable consequence of GDPR, it doesnt matter if trackers are good or necessary. GDPR doesn't ban them. So having them and getting consent is just a normal consequence. We can say, "Wouldn't it have been nice if the bad UX of all these cookies organically led to the death of trackers," but it didn't. And now proponents of GDPR are blaming companies for following GDPR. This comes from confusing the actual law with a desired side effect that didn't materialize.
- troupo 11mo ago
  No, those companies do not follow GDPR. They are testing how far they can go without triggering mass complaints etc. See https://noyb.eu/en/where-did-all-reject-buttons-come https://noyb.eu/en/where-did-all-reject-buttons-come
- vouwfietsman 11mo ago
  > And now proponents of GDPR are blaming companies for following GDPR. Not really, proponents of GDPR are aware that GDPR explicitly blocking trackers would be extremely hard as there is a significant gray area where cookies can be useful but non-essential, so you'd have to define very specifically what constitutes a tracker or do a blanket ban and hurt legitimate use-cases. Both are bad. For some reason though people think that the body that institutes laws that try to make the world a better place, when loopholes are found and abused for profit, this is somehow the standard body making a mistake, rather than each individual profit-seeking loophole-abusing entity being the problematic and blame-worthy actor. I never understand why, I guess you work somewhere that makes money off of this.
Neikius 11mo ago
you CAN use analytics! Just need to use first party analytics... it is not so hard to set up, there are many opensource self-hosted options. I hate how everyone and their mother ships all my data to google and others just because they can.
- crazygringo 11mo ago
  Let's not deceive ourselves -- first-party analytics are much, much harder to set up, and a lot less people are trained on other analytics platforms. They're also inherently less trustworthy when it comes to valuations and due diligence, since you could falsify historical data yourself, which you can't do with Google.
- inkysigma 11mo ago
  Can you actually do meaningful analytics without the banner at all? You need to identify the endpoint to deduplicate web page interactions and this isn't covered under essential use afaik. I think this means you need consent though I don't know if this covered under GDPR or ePrivacy or one of the other myriad of regulations on this.
  - rusk 11mo ago
    > You need to identify the endpoint to deduplicate web page You can deduplicate but you cannot store or transmit this identity information. The derived stats are fine as long as it’s aggregated in such a way that preserves anonymity
    - LunaSea 11mo ago
      How would you deduplicate without a unique identifier or fingerprint of some sort (which would not preserve anonymity)?
      - mortarion 11mo ago
        No one needs to deduplicate over a longer period than a few minutes, or a single session. If you need that, then you're doing something shady. If a user visits your site, clicks a few things, leaves and comes back two hours later, you don't need know if it's the same person or not. The goal of analytics is to see how people in general use your website, not how an individual person use your website. So just take IP address, browser details, your domain name, and a random ID you stick in a 30 minute session cookie. Hash it together. Now you have token valid for 30 minutes you can use for deduplication but no way of tying it back to particular user (after 30 minutes). And yes, if the user changes browser preferences, then they will get a new hash, but who cares? Not rocket science.

nonethewiser 11mo ago

In terms of whether or not the ubiquity of cookie banners is malicious compliance or if it was an inevitable consequence of GDPR, it doesnt matter if trackers are good or necessary. GDPR doesn't ban them. So having them and getting consent is just a normal consequence. We can say, "Wouldn't it have been nice if the bad UX of all these cookies organically led to the death of trackers," but it didn't. And now proponents of GDPR are blaming companies for following GDPR. This comes from confusing the actual law with a desired side effect that didn't materialize.

troupo 11mo ago
No, those companies do not follow GDPR. They are testing how far they can go without triggering mass complaints etc. See https://noyb.eu/en/where-did-all-reject-buttons-come https://noyb.eu/en/where-did-all-reject-buttons-come
vouwfietsman 11mo ago
> And now proponents of GDPR are blaming companies for following GDPR. Not really, proponents of GDPR are aware that GDPR explicitly blocking trackers would be extremely hard as there is a significant gray area where cookies can be useful but non-essential, so you'd have to define very specifically what constitutes a tracker or do a blanket ban and hurt legitimate use-cases. Both are bad. For some reason though people think that the body that institutes laws that try to make the world a better place, when loopholes are found and abused for profit, this is somehow the standard body making a mistake, rather than each individual profit-seeking loophole-abusing entity being the problematic and blame-worthy actor. I never understand why, I guess you work somewhere that makes money off of this.

Neikius 11mo ago

you CAN use analytics! Just need to use first party analytics... it is not so hard to set up, there are many opensource self-hosted options. I hate how everyone and their mother ships all my data to google and others just because they can.

crazygringo 11mo ago
Let's not deceive ourselves -- first-party analytics are much, much harder to set up, and a lot less people are trained on other analytics platforms. They're also inherently less trustworthy when it comes to valuations and due diligence, since you could falsify historical data yourself, which you can't do with Google.
inkysigma 11mo ago
Can you actually do meaningful analytics without the banner at all? You need to identify the endpoint to deduplicate web page interactions and this isn't covered under essential use afaik. I think this means you need consent though I don't know if this covered under GDPR or ePrivacy or one of the other myriad of regulations on this.
- rusk 11mo ago
  > You need to identify the endpoint to deduplicate web page You can deduplicate but you cannot store or transmit this identity information. The derived stats are fine as long as it’s aggregated in such a way that preserves anonymity
  - LunaSea 11mo ago
    How would you deduplicate without a unique identifier or fingerprint of some sort (which would not preserve anonymity)?
    - mortarion 11mo ago
      No one needs to deduplicate over a longer period than a few minutes, or a single session. If you need that, then you're doing something shady. If a user visits your site, clicks a few things, leaves and comes back two hours later, you don't need know if it's the same person or not. The goal of analytics is to see how people in general use your website, not how an individual person use your website. So just take IP address, browser details, your domain name, and a random ID you stick in a 30 minute session cookie. Hash it together. Now you have token valid for 30 minutes you can use for deduplication but no way of tying it back to particular user (after 30 minutes). And yes, if the user changes browser preferences, then they will get a new hash, but who cares? Not rocket science.