19 ms·

I get that too many regulations is a bad thing. But when we talk privacy and personal data there should be no gray zone. It has to be black and white. When I se

by rckt 11mo ago

I get that too many regulations is a bad thing. But when we talk privacy and personal data there should be no gray zone. It has to be black and white. When I see a stupid cookie banner I search for "Reject all". There's no some data that companies can collect and process without my consent, they just shouldn't be able to collect anything without me actively opting in. Business never respects anything, but profits. Seeing news about relaxing these laws with the "AI" going after this leaves a bitter taste. And with them also trying to push the Chat Control thing, it gets even worse.

betaby 11mo ago
That cookie thing should a browser's default.
- Fargren 11mo ago
  That would be fine, if there was a law that forced every browser to have this setting and every company to respect the setting.
  - bryanrasmussen 11mo ago
    arguably if there was a browser setting for this the current GDPR would require you to respect that setting. But that's arguably, it would still need to adjudicated.
    - 1718627440 11mo ago
      The browser setting already exists (DNT), so I don't know what you want to conlude.
      - bryanrasmussen 11mo ago
        My conclusion would be that under the current GDPR that if someone had the browser setting on, if a company did not respect that setting and kept private data, that they could be reported for GDPR violations and then the issue could be adjudicated, i.e that the courts would then decide if in fact GDPR violations occur by not following that browser setting. Secondary conclusion - it might be more beneficial if one just contacted the EDPB and said since this browser setting exists and nobody is using it please issue a ruling if the browser setting must be followed, set it to go into effect by this date giving people time to implement it, and if they agreed the browser setting would be adequate to represent your GDPR wishes they might also conclude that it would be an onerous process to make you go through a GDPR acceptance if it were turned on, howe ver as this article is saying that they are "scaling back" the GDPR that would seem to be dead in the water, which is why I said under "the current GDPR".
        1718627440 11mo ago
        In the absence of any explicit consent, no-consent is always assumed by the GDPR. The absence of a DNT header definitely doesn't count as consent, so that header is kind of useless, since the GDPR basically requires every request to be handled as if it has a DNT header. A pre-existing statement of non-consent doesn't stop anyone from asking whether the user might want to consent now. So it is not legally required to not show a cookie dialog when the DNT header is set, which would be the only real purpose of the DNT header, but legislating such a thing, would be incompatible with the other laws. It would basically forbid anyone from asking for any consent, that's kind of stupid. The GDPR requires the consent to be given fully informed and without any repercussions on non-consent. So you can't restrict any functionality when non-consenting users, and you can also not say "consent or pay a fee". Also non-consenting must be as easy as consenting and must be revocable at every time. So a lot of "cookie-dialogs" are simply non-compliant with the GDPR. What would be useful is a "Track me" header, but the consent must be given with an understanding to the exact details of what data is stored, so this header would need to tell what exactly it consents to. But no one would turn it on, so why would anyone waste the effort to implement such a thing in the browser and web applications? > GDPR that would seem to be dead in the water I agree, and I don't like that.
        bryanrasmussen 11mo ago
        If there were any companies that provided value for tracking people would turn on a track me header, but there are none. so I agree.
        1718627440 11mo ago
        I mean I run Debian, and voluntarily enabled popularity-contest, so is not like these examples don't exist.
- Someone 11mo ago
  FTA: “Under the new proposal, some “non-risk” cookies won’t trigger pop-ups at all, and users would be able to control others from central browser controls that apply to websites broadly.”
  - dijit 11mo ago
    GDPR allows for essential cookies with no popup. Implied consent is valid for most functionality, just not selling peoples tracking data or giving it to a third party who could. Its entirely possible to have no pop-up. Someone once told me they wanted one anyway because it made the site seem more legitimate than if I removed it (the only thing I would have needed to change was the embedded video from youtube and I could have dropped the popup. Oh well).
    - dgroshev 11mo ago
      No pop-ups on apple.com!
    - NooneAtAll3 11mo ago
      embedding youtube is enough to be non-cookiebanner-compliant??
      - Spunkie 11mo ago
        We went the route inspired by gamingonlinux.com So anywhere there is a YouTube embed we instead display a static thumbnail with 2 inline buttons underneath. 1 button to accept cookies and then load the embed and 1 button to view the video directly on YouTube in a new tab. It works nicely and also pushed us to switch most of our videos to being first party hosted instead of YouTube.
      - sdoering 11mo ago
        Look at what YT loads in terms of tracking, when opening a page with an embedded YT video - even if you do not play that. Or install something like pi-hole and watch how many analytics calls to Adobe Analytics the Adible app is sending out. Even if just idle in the background. Given the fact that you pay Adobe by the server call, Audible clearly must earn a shitload of money, if they can burn tracking calls like this. If you are on a Mac, try Little Snitch and see where your data is going while surfing the net. No wonder in the US there are companies, that can sell you a clear image of all relevant data on nearly any person to enable algorithmic wage discrimination [1]. I know, that industry is trying to push EU further and further towards less consumer protections. But we have a great example of what that means for workers, consumers and all of us in the US. [1]: https://pluralistic.net/2025/11/10/zero-sum-zero-hours/ https://pluralistic.net/2025/11/10/zero-sum-zero-hours/
- mmooss 11mo ago
  Like Do Not Track?
tsoukase 11mo ago
Using an Ad blocker I feel regret for stealing the site's revenue. So I allow them to collect my personal data. Anyways, I think most of them will not respect my rejection.
- zelphirkalt 11mo ago
  A site that cannot exist without collecting not needed personal data and without selling out its visitors, has no justification of continuing to exist. Don't let them guilt-trip you.
  - tonyhart7 11mo ago
    that just shallow and one sided argument that never respect another side of coin
    - array_key_first 11mo ago
      It's also true. Not every business model is viable, and that's life. I can't run a hitman business. Because that's illegal. Oh well, too bad, so sad. This is what makes the world a somewhat decent place. If we make things that suck ass illegal and then, as a byproduct, a bunch of businesses can no longer make money - then good. That's the correct outcome. This is how a free market works. You want to win customers? Make a good product, have a good model, don't cheat by lying to customers, or doing shit without their consent. We don't want scams, scams are bad. If those go away that's a net benefit for humanity.
      - tonyhart7 11mo ago
        what do you mean illegal??? tell that to Ads advertising business that bringing billions every year, and its legal btw
        array_key_first 11mo ago
        Right, and that sucks major fucking ass. It's bad and literally nobody likes it. If it went away overnight, I would not lose sleep. I don't think I'm alone in that. If you want to run a business that relies on gathering obscene amounts of data on people and then using it in aggregate to commit crimes against humanity, then fine. But at least make them consent to you fucking them up the ass. I don't think that's too much to ask for.
zelphirkalt 11mo ago
Yep, it is exactly what the EU shouldn't do. This will actually further disadvantage EU companies, when US companies are left to run rampant. It also will take away any "made in EU" advantage that EU-local companies had over US competition. GDPR was exactly the right step. In fact it was not enforced strictly enough and should have been enforced much stricter, punishing all the shady businesses which employed dark pattern to extract personal data from citizen.
impulser_ 11mo ago
Yeah, but a lot of the rules around privacy and personal data make it hard to accept business from Europeans. If you are a small business or startup you might not even accept business from Europeans because navigating these rules are almost impossible.
- Etheryte 11mo ago
  I'm not sure how this makes sense. Functionally the rules are the same across the entire bloc and it's pretty straightforward: unless you have a legitimate reason to store the data, you need to ask for consent and the consent must be free. I want to make more money is not a legitimate reason. I have a legal requirement to fight financial fraud is a legitimate reason. Obviously the reality is more nuanced, but understanding this basic idea gets you there 95% of the way.
- OkayPhysicist 11mo ago
  Just don't track users. Don't store any information you don't need, don't try to spy on them beyond what information they choose to share with you freely, and the GDPR has zero issues with you.
energy123 11mo ago
I've stopped thinking of regulations as a single dial, where more regulations is bad or less regulations is bad. It entirely depends on what is being regulated and how. Some areas need more regulations, some areas need less. Some areas need altered regulation. Some areas have just the right regulations. Most regulations can be improved, some more than others.
- l5870uoo9y 11mo ago
  I disagree with this otherwise seemingly reasonable position. Draghi's latest report pointed out that overregulation is a major problem in the EU and costs EU companies the equivalent of a 50% tariff (if I remember correctly). Of course, Draghi's report has led to nothing more than a few headlines.
  - wizzwizz4 11mo ago
    That 50% figure seems extremely dubious. I'd expect either methodological failures, or a definition of "costs" that I disagree with (e.g. fair-competition regulations preventing price-hikes, "costing" EU companies the profit they could obtain from a cartel). However, skimming the report (https://commission.europa.eu/topics/competitiveness/draghi-report_en https://commission.europa.eu/topics/competitiveness/draghi-r...), I can't find the 50% figure.
    - l5870uoo9y 11mo ago
      > Mario Draghi has argued that the EU's internal barriers, which are equivalent to a high tariff rate, cost more than external tariffs. He has cited IMF estimates that show these internal barriers are equivalent to a $45\%$ tariff on manufactured goods and a $110\%$ tariff on services. These internal market restrictions, which include regulatory hurdles and bureaucracy, hinder cross-border competition and have a significant negative impact on the EU's economy. Source: https://iep.unibocconi.eu/europes-internal-tariffs-why-imfs-44-estimate-doesnt-hold https://iep.unibocconi.eu/europes-internal-tariffs-why-imfs-...
      - 11mo ago
kronicum2025 11mo ago
> But when we talk privacy and personal data there should be no gray zone. It has to be black and white. you are wrong. If one followed your ways, we would never do a lot of things. There are things called regulatory sandboxes for a reason. But those don't really work in fields where the "scale of the data" is the core reason of why things work. Chat control is stupid.
shoddydoordesk 11mo ago
Who is the audience your comment is trying to reach? Who are these mysterious "companies"? It's important to realize companies are made of people. Someone had to explicitly code the dark pattern in the GDPR cookie dialog. Ever notice the button for "Accept All" is big and shiny, while refusing all is more often than not a cumbersome, multi-click process? That's not an accident. That was coded by people. People around us, people who post here. I'm sure "made GDPR dialog deceptively confusing" went on someone's accomplishment report that they then used to justify a raise or promotion.
- palata 11mo ago
  My theory is that companies are not the sum of their employees. Employees are generally good; toxic humans are a small minority (unfortunately they tend to be over-represented at the head of companies). But put employees together into a profit-maximisation machine, and the machine will try to maximise profit, with dark patterns and downright evil things. Similar with our species as a whole: nobody is actively working to break the climate so much that their kids will die long before they reach the age of retirement. But that's what we as a species are doing together, somehow. Individually, we don't want that, but that's not enough.
  - OkayPhysicist 11mo ago
    That explains passively malignant processes, like not radically overhauling your business to address climate change. It doesn't explain actively malevolent things like "let's bury the "Decline Cookies" dialog under 3 layers of clicks. That's a proactive choice, that some software developer chose to implement.
    - palata 11mo ago
      I'm guessing that in many cases, it's not one software developer who decides. Most people are told what to do, and for many websites I'm guessing that it's just some kind of Wordpress add-on. Someone realised that they sold more add-ons if they implement those dark patterns, so they did it ("it's not me, I offer a good one but they buy the evil one"). In my experience in startups, the website was managed by marketing people who honestly had no clue: they seemed to genuinely believe that they needed those cookies ("I am in marketing, I need the data") and they did not understand the consequences. "I just install this Google thing, and then Google gives me nice data for free". Why do people build weapons? That's a lot worse than a cookie popup, but I'm sure every single person in that industry will tell you that they "save lives".
eitau_1 11mo ago
Most baffling thing is that sometimes you can't opt-out from "always active" stuff that still involve hundreds of "partners"; see: https://news.ycombinator.com/item?id=45844691 https://news.ycombinator.com/item?id=45844691
- user34283 11mo ago
  Users can opt-out by not using the service or buying an ad-free version if available. One would think that developers should not be forced to offer for free a version monetized with 60% less effective ads. And I understand currently this is indeed not the case for small developers, they can offer paid ad-free or free but with personalized ads. Large platforms apparently cannot.
  - deleted 11mo ago
    [deleted]
  - moi2388 11mo ago
    That’s not how the GDPR and cookie laws work at all
    - hk__2 11mo ago
      That’s how most news websites work in Europe: accept the cookies, or pay.
      - moi2388 11mo ago
        Yes, but opt-out tracking data which is not necessary for the operation of the primary use case of the app is not allowed. It must be opt-in, truly a free choice, and informed consent, and declining must be as easy as accepting.
        user34283 11mo ago
        My search told me that unless you are a gatekeeper, offering a reasonably priced ad-free tier allows to make the ad-monetized version personalized only. I think it makes sense. Either pay, or consent to effective ads. There's no free lunch
imiric 11mo ago
Do you really think that clicking on any button on cookie consent popups actually does anything? It's just an illusion of choice. The reality is that these sites will still track you, whether that's via cookies or, more commonly today, fingerprinting. When they list thousands of "partners" with "legitimate interest", it's a hint that there's a multi-billion-dollar industry of companies operating behind the scenes that will do whatever it takes to profile and track you, regardless of what you click on a silly form. Regulations like the GDPR don't come close to curtailing this insanity.
- zelphirkalt 11mo ago
  I very much doubt, that the practice of putting hundreds or thousands of partners into the legitimate interest category is legal. I wish this was more challenged and brought in front of the courts. And not just wristslaps dished out. Such practices need to have business threatening punishments attached to them.
- vanviegen 11mo ago
  I'm sure that happens in some cases. But the EU is building a reputation for handling out fines that actually hurt, and I'm sure that actively lying to consumers about this would warrant a big one, if ever discovered. And in any case, tracking will be a lot less robust without those 388 cookies.
golol 11mo ago
I think I should be able to collect whatever publicly available data I can find.
- rckt 11mo ago
  But we are not dealing here with the public data. Stalking people, recording their every step and action so then you can sell their behavioural habits is not collecting public data, it’s stalking and invading people's private life.
yapyap 11mo ago
> I get that too many regulations is a bad thing Well yeah, cause your sentence relies on itself. _Too many_ regulations is a bad thing. But to have a lot of regulations, especially in fields where there is not much to be gained but oh so much being lost in the interest of capital gains like in generative AI, is a blessing rathr than a curse.
renegade-otter 11mo ago
Europe has much more fatal startup-killing regulation problems than cookies, however. Who cares about cookies? I am on your site, you are going to plant/collect cookies. These goddamned banners are a solution in search of a problem, and it's yet another hurdle a company of, say, 3 has to go through, for very little reason.
- thfuran 11mo ago
  The banner isn't required. They could just not do the things the banner would ask consent for.
  - Myrmornis 11mo ago
    People don't know whether they are or are not doing things that require consent under the law. That's because, if you haven't noticed, the people concerned are computer programmers, UI designers, and PMs. Notably missing from that list is "lawyers who can be bothered to research the question". People put the banners up because they see other people doing it and it seems safest. That all of this would be so should have been perfectly obviously to whoever contemplated bringing the regulation into existence. Therefore they are either imperceptive or malign.
    - thfuran 11mo ago
      Any company that can hire teams of software developers can afford to hire a lawyer to tell them whether they need to irritate all their customers. And frankly, they'd be dumb not to hire a lawyer if they think they need some legal cover to determine whether that cover is sufficient.
      - Myrmornis 11mo ago
        Good god. I certainly wasn't suggesting this situation would be improved by software teams hiring lawyers to advise on their software! You appear to have completely lost perspective.
nine_k 11mo ago
More regulation, or stronger regulation, as in less wiggle room for businesses, may be a good thing. Case in point: a regulation requiring to disclose the ingredients of food. Too many regulations is almost always a bad thing: numerous pieces of regulation rarely fit together seamlessly. It becomes easier to miss some obscure piece, or to encounter a contradiction, or to find a loophole. The cost of compliance also grows, and that disproportionately favors big established players.
- samdoesnothing 11mo ago
  I think this is an excellent point. More is almost always worse, but if there is a genuine need for regulation it should be absolute.
- fwip 11mo ago
  In fact, "too many" is the exact point at which it becomes excessive. :P
- hekkle 11mo ago
  > The cost of compliance also grows, and that disproportionately favors big established players. Not true at all. Most of the harsher regulations only come into effect when the company hits a specific size. Examples from Australia (my country): - Online shops that operate overseas, and import to Australia have to collect sales tax... but only if they make more than $75,000 from Australia per annum. - Social media has to ban Australians under 16... but only if they make more than a billion per annum.
  - billy99k 11mo ago
    75,000 is very small for a business.
  - senordevnyc 11mo ago
    Actually, online shops that mail stuff to Australian customers who request them to do so don't have to collect or pay any sales tax. The Australian government might stomp their feet and declare otherwise, but they have no legal or jurisdictional authority to do so, nor any real means for enforcement. This trend of countries declaring that everyone on the planet is under their jurisdiction if they mail something there (or respond to a network request) is bananas.
lo_zamoyski 11mo ago
The trouble is that everyone else is pursuing tech unhindered by such regulations at breakneck speed, and Europeans realize that Europe - once the center of science and technology - is increasingly sliding into a backwater in this space and an open air museum. Now, some will agree with you and say that privacy should never be violated, but nonetheless accept a certain measure of tolerance toward that kind of violation, because they see rigid intolerance as causing more harm than the violation of privacy itself is causing [0]. This harm is chiefly the economic harm caused by the burden of regulation and the roadblocks it introduces. Perhaps this isn't true, but if it is, then moral offense is likely to have little effect. A more effective means might be the make following regulations cheaper. Of course, as we know, when you make something cheaper, you increase demand. This means that EU institutions would likely see this as an opportunity to increase regulation, nullifying the gains of introducing less costly ways to adhere to regulation. [0] This reminds me of Aquinas's view of prostitution. Naturally, Aquinas saw prostitution as a grave, intrinsic evil. No one is ever justified in soliciting the services of a prostitute, much less of being a prostitute. That's the moral stance; it concerns our personal moral obligations. However, from the position of the state and how the state should police such activity through law, Aquinas saw the criminalization of prostitution, however good in principle it might be, as a policy that would be practically worse - even disastrously so - than law and policy that is permissive toward prostitution. Whether you agree or disagree with him, the principle holds, namely, that the state not only does not need to police every bit of immorality, but by doing so, may actually contribute to the destabilization of society and to an even worse condition than the one it is saddled with.
- rapnie 11mo ago
  > sliding into a backwater in this space and an open air museum Or a place that follows a different approach than "break it to make it" mad dash, that fosters a different - perhaps richer - culture with tech more aligned to people's needs, and overall healthier to live in. If there is a good set of regulations in place. And that is where EU is not consistent, and this backtracking not helpful.
  - lo_zamoyski 11mo ago
wat10000 11mo ago
They should have gone farther. Don't require the user's permission for non-essential tracking cookies. Just ban them outright. No opt in, no opt out, it's just straight-up illegal to track people unless they're actively using a signed in account.
mvdtnz 11mo ago
There are lots of uses for cookies that have absolutely nothing to do with collecting data about you.
- rckt 11mo ago
  That's true. But it's just a small part of overall tracking. And nobody would care if the cookies were used only for auth or purely functional reasons.
- OkayPhysicist 11mo ago
  And you don't need user consent for most of those cookies.
insurancesucks 11mo ago
Laws should punish wrongdoing. Regulations that seek to stop all wrongdoing place burdens on law abiding citizens and businesses that were never going to harm anyone. We can't stop all wrong upfront, and the costs of attempting to do so are substantial.
ekjhgkejhgk 11mo ago
Reminder that cookie banners are not a regulation problem, they're a privacy problem. If you don't spy on your users you don't have to have cookie banners.
- jebronie 11mo ago
  no. even including a font from a different host is not allowed under the gdpr because you are leaking the users IP to that host. you are poorly informed on this topic.
  - ekjhgkejhgk 11mo ago
    But the different host IS tracking because that's how they make money from serving "free" fonts. So if what you're saying is true, that's exactly how it should be. When I go to a website I don't want others involved.
  - mrguyorama 11mo ago
    We used to use Subway's proprietary font. We never needed to call a server for that. Maybe don't build stuff in such a dumb and lazy way?
glitchc 11mo ago
Realistically speaking, how much are people willing to pay for email, communications, cloud backups, social media? This is the hard question.
- necovek 11mo ago
  They already do as part of their internet subscription at home and data plans on mobile. ISPs used to provide email addresses for people, and it was part of the cost.
ndesaulniers 11mo ago
I wish we standardized on Do Not Track headers. Cookie banners are a plague. Thanks Europe.
- dgroshev 11mo ago
  There is nothing stopping the industry from standardising on an alternative form of expressing consent, for example on browser installation. GDPR is agnostic to the form the consent takes, as long as it's informed and freely given. However, by far the biggest browser is funded by a corporation that wants tracking data across the web. I'm not very surprised that the corporation haven't made it easy to refuse just once. Thanks Google.
nomel 11mo ago
You can do this trivially in modern browsers: private browsing. I have one "normal" browser window for "persistent cookie" use (like gmail, youtube, etc) and another "private" window for everything else. Cookies are lost anytime a tab closes.
- deleted 11mo ago
  [deleted]
  - deleted 11mo ago
    [deleted]
  - deleted 11mo ago
    [deleted]
- deleted 11mo ago
  [deleted]
- morshu9001 11mo ago
  Yeah idk why there's a law trying to poorly enforce this instead
  - troupo 11mo ago
    Because the law isn't about cookies, but about tracking? You know, the kind that doesn't stop even if you open the "ignorant mode" in your browser: https://www.tomsguide.com/news/going-incognito-in-chrome-doesnt-mean-youre-not-being-tracked-now-confirmed-by-google https://www.tomsguide.com/news/going-incognito-in-chrome-doe...
- necovek 11mo ago
  Are you sure cookies get scrapped after you close a tab? Does opening a single session-based web site in multiple tabs work (eg. logged into Amazon in a private browser)? What browser are you using?
  - morshu9001 11mo ago
nmz 11mo ago
Why not accept and let cookie autodelete delete it after closing the site? Expecting any industry to follow the law is foolish, if it gets big enough, they will wear down and overturn any annoyance against it, malicious compliance is the only way. https://adnauseam.io/ https://adnauseam.io/
- fsflover 11mo ago
  It's not just about cookies but any kind of tracking, including fingerprinting.
- rckt 11mo ago
  I think we better remove the problem itself that come up with more and more ways to mitigate it.
everdev 11mo ago
And when they use our data to profit, we don't get a royalty cut.
lenkite 11mo ago
That cookie banner needs to be standardized and offered by the browser. It should be like a certificate popup. Why is every website forced into doing a shoddy job ?
- what 11mo ago
  How would that even work? The browser has no way to know what a cookie is for.
  - vilhelm_s 11mo ago
    They are regulating websites anyway, surely they can just invent some standard format to say what function each cookie has. How about requiring that the name of every cookie has to start with one of "Strictly Necessary", "Functional", "Performance", and "Targeting/Advertising"?
  - will4274 11mo ago
    It's not the tech that's hard. https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep/0205.html https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep...
- DavideNL 11mo ago
  Aren’t tracking cookies mostly irrelevant nowadays, because every browser can be uniquely fingerprinted anyway?
  - sdoering 11mo ago
    Fingerprinting is actually covered by the regulations and needs to be "consented" to. There are different regulations, but basically they are technology agnostic (a good thing). If you as a compnay want to use data that could theoretically be used as an identifyer for me, you need my consent. For any type of use. Except if it is absolutely necessary to provide the basic service. Or if we have a contractual relationship, but there are also protective rules in place to protect the customer. Different regulations handle storing data (like cookies, but also local/session storage and similar things on the devices of your users. But those are separate from GDPR. GDPR is - as said - only concerned with data that could be theoretically linked to me as an individual. Regardless what this data is. Could be an id in a cookie, could be a fingerprint, could be smoke signals. It could even be the combination of different data points, that taken together allow for an identification. Theoretical example: Imagine I live in a village with 500 people. The company tracks the location and that I am male (so roughtly 50% of the population), that I am between 45 - 50 (say about 10% of the population), have multiple cats (say maybe only three people now in that village, use a Linux based machine - bingo: You found me. And now you have a set of data that falls under the GDPR. Welcome in having to ensure you only use this data in a way that I gave consent to. See: The law doesn't even just look at marketing or tracking data. Or what happens in an app or a browser. It covers all data that is either pointing ti me as an "ID" - like a cookie ID, or at personal identifiable data - like bei combination in my example.
adrr 11mo ago
Are cookies really tracking you? 3rd party cookies don’t work in any browser. Ads are passing session data on the URLs instead. You can alow easily change some settings to stop persistent cookies. You can install privacy extensions like ghostery to block beacons. You can use features like ICloud private relay to prevent IP tracking. Solutions are all there and they aren’t because of any law.
- 0xedd 11mo ago
  [dead]
- 63stack 11mo ago
  There are a bunch of sites that stop working if you tweak privacy related settings. Twitter straight up tells you that if you experience problems, you should disable Firefox's tracking protection.
  - sdoering 11mo ago
    And by that they are actually in violation of GDPR. But hey - since when was Musk interested in following regulations. And since when has a governmental or supra-governmental entity been able to curb that tendency of the super rich and biggest cooperations. Like with meta: They know they mke 7 billion annualy from serving 15 billion scam ads daily. They calculated that they will have at most have to pay about a billion in governmental fines all over the world, if they should one day be regulated for that. So it is a clear business decision to go on shoing 15 billion+ scam ads per day to their "users". Were some interesting journalistic pieces on that a few days ago. And exactly those companies are the reason we need stronger protection. And these protections more heavily enforced.
- sdoering 11mo ago
  Don't mix PII data and cookies (or any other similar tech). There are different regulations in place here. If you want to use ddata that can identify me (even in theory), you need to ask me, if I am fine with that. If you want to store data on my computer, you also need to ask me, if I am fine with that. Because, if I request a download, I expect to download the file. If I request a website, I expect the website content. I do not expect data that you or others can use to see how often I visited your site. Like meta-shit, or google-crap, or linkedin-slop... If you want to do that, just ask m. And explain in clearly understandable words, what you do and why. That is just human decency. Yes, I can (and strongly do) protect myself against this (and I am working in that business, I know the tricks and tools and stuff). But my late mom can't. Or her 80+ year old neighbor. Or SO#s my 19 year old niece that only uses a tablet and a crapload of apps that target her and spew a shitload of targeted ads for wheightloss onto her since she was an early teen... So no -> Those companies need to be highly regulated. To me, those companes need to rott in hell, but that is my take. I want people to be protected. From business, from government. Thst is the basis of European privacy law - protecting the small person from the big entities. And rightly so. We have our history from which those protections originated.
erikerikson 11mo ago
> Business never respects anything, but profits That is taken as a law of the universe by some but B-Corps, Social Purpose Corps, FairShares Commons... There are exceptions and some are working to do better. That statement has mostly become an excuse.
lynx97 11mo ago
Everything that happens under Ursula Von der Leyen leaves a bitter taste.
po1nt 11mo ago
Every regulation has some unforeseen consequences. Most of the time it's impacts are worse than the effect we wanted to regulate from the start. Us humans discard the effects we can't predict as benign even over smaller inconveniences we can see.
- vanderZwan 11mo ago
  > Every regulation has some unforeseen consequences. This argument would feel a lot less insincere if the people who always trot it out also used it every time something gets deregulated. > Most of the time it's impacts are worse than the effect we wanted to regulate from the start. Are they though? Or do you only hear a disproportionate amount of complaints because of manufactured consent? Because I sure as hell don't trust the talking heads on TV backed by billionaires who don't like to see people push back at their greed and lust for power.
WA 11mo ago
I'm 100% on the same page as you. I just wanna point out that apparently, the enforcement of said regulation just failed. There are way too many businesses that don't give you a single "reject all" button and get away with their dark patterns. A regulation that can't be enforced consistently is not desirable and failed to some degree.
- sdoering 11mo ago
  I recently registered a complaint with my local data protection authority. This then got routed to their colleagues in North Rhine-Westphalia that are responsible, as the company in question had their business location there. What the company did? They showed a consent banner - but already sent my data to all manner of analytics and marketing companies. Before I even denied consent. They also did not mention all of those trackers/companies/cookies in their consent solution nor on their privacy page. The result from the authorities was a clear: Go f*k yourself e-mail to me (I had screenshots attached in my complaint). Basically stating: We do not see any way you are personally affected and we also have too much to do, so we won't go after a company, just because they tracked you and sent your data to a bunch of marketing companies and tracking firms, even as you denied consent. And we also don't care, that they actually did not mention quite a bunch of those receivers of my data in their data privacy page. So yeah - when governments actually have no interest in enforcing the rules in place to protect citizens, I am lost for words. Might have been, because the company in question being in violation of the law here was a former state-owned business, that while privatised is still run by politicians (like currently by the Chairman of the FDP Federal Committee for Justice, Home Affairs, Integration, and Consumer Protection to be precise). What pisses me off about this the most, though is, that companies that actually follow the regulations, treat customers well and respect their data privacy concerns, they are at a disadvantage. It is not that our government and those EU conservative ars**es are for a free market. They want a market in which their buddies and the ones providing the juicy jobs after governmental terms come to an end, to win. As always, conservatives follow Wilhoit's Law.
baxtr 11mo ago
The problems are in the details: why are news organizations exempt from this rule in Europe? You can’t read news websites unless you accept all cookies or pay to read. Who decides these things? How is such a rule in favor of privacy? Why is my site where I regularly post news not eligible? Who decides which sites are eligible? It’s these kind of moral double standards and cognitive dissonances that people have to endure. I wish it was black and white. But reality simply isn’t.
- Cthulhu_ 11mo ago
  It seems there were lawsuits but "pay to reject" is apparently legal as long as the pay is reasonable. I despise it personally.
  - jamiecurle 11mo ago
    If you're under UK law the ICO guidance on "pay to reject" can be found here: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-tracking/consent-or-pay/about-this-guidance/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
- qwertox 11mo ago
  > You can’t read news websites unless you accept all cookies or pay to read. You can't even read news websites when you accept all the cookies, and then, oh surprise, you'd have to pay. But they installed the cookies nonetheless, those scammers.
- Bewelge 11mo ago
  Are you sure they are exempt? I was always under the impression that their practice is pretty obviously illegal. I just did a quick google search and didn't find anything about exemption. So they are as exempt from the GDPR as much as Al Capone was exempt from taxes ;) What they seem to be exempt from is getting consent if they require the data for journalistic purposes. IANAL, but I think they are simply not following the law and waiting for a definitive decision by a court. ed: So I kept reading and from my understanding it's TBD whether the practice is lawful. The European Data Protection Board has issued an opinion against it a year ago.
PeterStuer 11mo ago
Once they lobbied in "legitimate interest" as the exception to the opt-in requirement, the whole regulation de facto became a farce for the end user.
miki123211 11mo ago
Nothing is ever black and white. You could prevent all car accidents by banning motor vehicles. You could prevent all side-effect related deaths by banning all the drugs. You could stop all phone scams by banning telephones. Obviously, that's excessive overregulation. Just as obviously, letting people get away with car accidents, phone scams and drugs that kill more people than they cure is not what we should be doing either. It's the job of the lawmakers to find the tradeoffs that work best for society. The moment you say "it's black and white, the other side has 0 good arguments", you lose the discussion in my view. If you don't understand what we're even trying to trade off here, we can't have a productive discussion about what the right tradeoff is.
- krainboltgreene 11mo ago
  What a funny comment. “You see, you just don’t understand trade-offs, here let me explain to you…”
- rckt 11mo ago
  What kind of a discussion can there be? It's very simple. I don't want any business or individual or whatever to collect any of my personal data if I don't agree to it. Right now companies do everything they can to do the opposite. And there's nothing here that can prove them right.
concinds 11mo ago
There is an infinitely more effective and trustworthy solution: an adblocker that blocks trackers. You don't have to spend minutes daily on dark-pattern banners. You don't risk the broken implementations that still track you no matter what you click, that regulators can't oversee on billions of websites. They should just keep the thing that lets you request full deletion of your account and data, the rest is total security theater. The EU's top #1, #2, #3, #4, and #5 priority right now should be achieving digital sovereignty and getting a strong homegrown tech industry (ban American social media and force local alternatives?) so the US can't coerce it. That'll require some additional, different regulations, and that's the kind they should focus all efforts on for the foreseeable future. They put the cart before the horse. Look at the sanctioned ICC judges (EU-based). Can't use any credit/debit cards (all American). Can't do any online e-commerce (there's a US entity somewhere in the flow). No Google/Apple accounts (how useful is your iPhone without the App Store?). "Regulate" foreign companies all you want, ultimately you still have no power over them. Cart before the horse.
- IanCal 11mo ago
  It's not more effective and trustworthy, particularly as you can do both. The laws also cover dramatically more than tracking scripts and cookies. > They should just keep the thing that lets you request full deletion of your account and data, the rest is total security theater. Then large law abiding sites can still do enormous amounts of tracking, and can do lots with my data that they currently are not doing.
- tcfhgj 11mo ago
  > There is an infinitely more effective and trustworthy solution: an adblocker that blocks trackers. You don't have to spend minutes daily on dark-pattern banners. You don't risk the broken implementations that still track you no matter what you click, that regulators can't oversee on billions of websites. try untangling the tracking code from the rest of the javascript code which is required for the sites to work - simply unrealistic.
- LtWorf 11mo ago
  > ultimately you still have no power over them You have the immense power of denying them access to your money, which turns out is a very compelling argument :)
blueblisters 11mo ago
The problem is paternalism and assuming the user is too dumb to take control their privacy preferences. The compliance of the cookie banner regulation has measurable negative externalities - one estimate suggests a EUR 14B/year productivity hit in the EU Most modern browsers allow you to disable all cookies if you like. You can always use incognito mode if you want to be selective about it. In an ideal world, the EU could have simply educated their constituents about privacy controls available in their browser.
- dgb23 11mo ago
  GDPR is not a cookie regulation it is a tracking regulation.
  - IanCal 11mo ago
    It's broader, it's about users data. For example, you can store my address so you can send the item I ordered to me. You can't, without permission, use that to send me marketing stuff.
alexnewman 11mo ago
Perhaps if you had some engineers write the laws they’d work better
deleted 11mo ago
[deleted]
Noaidi 11mo ago
This is why I just bought a Pixel and put GrapheneOS on it. And one with a SIM card that I can take out whenever I want. No AI, limited tracking, and no big tech. This is my personal boycott.
ernst_klim 11mo ago
> But when we talk privacy and personal data there should be no gray zone. It took me to move to Germany to figure that privacy is a spectrum, and I, despite being a crazy on privacy and security, actually don't want that much. I've been to a German factory where robots could not distinct between humans and objects bc Datenschutz. My colleagues had 3 bikes stolen in a week bc we have no CCTV cameras. Privacy definitely has costs, and not only for business, but for regular people in daily life. It should, as anything, be balanced against costs of doing business, people security concerns. Same goes for security: few private cctvs are ok, massive coordinated surveillance and chat control not ok. Everything is on spectrum and is a trade off.
- pebble 11mo ago
  I'm curious how the CCTV would have prevented the bike theft?
  - JimmyBiscuit 11mo ago
    Yeah, I can tell you that the only thing CCTV does is making the thief wear hoodies. And you get some clips of them carrying expensive bikes around the corner out of CCTV range to their parked transporter.
    - LtWorf 11mo ago
      Even without hoodie… who was it? Some dude.
  - m000 11mo ago
    True. I don't know from where people get the idea that the police would bother with an investigation for your (personally important) case if you had full-on surveilance. You may have your laptop snatched, go to the police station and show them the exact location of the thieves using e.g. find my Mac. The will do nothing, even if it's in the building across the street. Now, showing them some blurry (at best) faces in CCTV footage and ask them to investigate? Good luck.
- afandian 11mo ago
kvgr 11mo ago
We had our underground parking and storage units broken into in apartment building. And we couldn't see the CCTV camera, to be on a lookout for the thief and call cops. Only cops could see it. Thieves have higher protection than your property.
paulddraper 11mo ago
> they just shouldn't be able to collect anything without me actively opting in That's exactly why things are the way they are.

by rckt 11mo ago

betaby 11mo ago

That cookie thing should a browser's default.

Fargren 11mo ago
That would be fine, if there was a law that forced every browser to have this setting and every company to respect the setting.
- bryanrasmussen 11mo ago
  arguably if there was a browser setting for this the current GDPR would require you to respect that setting. But that's arguably, it would still need to adjudicated.
  - 1718627440 11mo ago
    The browser setting already exists (DNT), so I don't know what you want to conlude.
    - bryanrasmussen 11mo ago
      My conclusion would be that under the current GDPR that if someone had the browser setting on, if a company did not respect that setting and kept private data, that they could be reported for GDPR violations and then the issue could be adjudicated, i.e that the courts would then decide if in fact GDPR violations occur by not following that browser setting. Secondary conclusion - it might be more beneficial if one just contacted the EDPB and said since this browser setting exists and nobody is using it please issue a ruling if the browser setting must be followed, set it to go into effect by this date giving people time to implement it, and if they agreed the browser setting would be adequate to represent your GDPR wishes they might also conclude that it would be an onerous process to make you go through a GDPR acceptance if it were turned on, howe ver as this article is saying that they are "scaling back" the GDPR that would seem to be dead in the water, which is why I said under "the current GDPR".
      - 1718627440 11mo ago
        In the absence of any explicit consent, no-consent is always assumed by the GDPR. The absence of a DNT header definitely doesn't count as consent, so that header is kind of useless, since the GDPR basically requires every request to be handled as if it has a DNT header. A pre-existing statement of non-consent doesn't stop anyone from asking whether the user might want to consent now. So it is not legally required to not show a cookie dialog when the DNT header is set, which would be the only real purpose of the DNT header, but legislating such a thing, would be incompatible with the other laws. It would basically forbid anyone from asking for any consent, that's kind of stupid. The GDPR requires the consent to be given fully informed and without any repercussions on non-consent. So you can't restrict any functionality when non-consenting users, and you can also not say "consent or pay a fee". Also non-consenting must be as easy as consenting and must be revocable at every time. So a lot of "cookie-dialogs" are simply non-compliant with the GDPR. What would be useful is a "Track me" header, but the consent must be given with an understanding to the exact details of what data is stored, so this header would need to tell what exactly it consents to. But no one would turn it on, so why would anyone waste the effort to implement such a thing in the browser and web applications? > GDPR that would seem to be dead in the water I agree, and I don't like that.
        bryanrasmussen 11mo ago
        If there were any companies that provided value for tracking people would turn on a track me header, but there are none. so I agree.
        1718627440 11mo ago
        I mean I run Debian, and voluntarily enabled popularity-contest, so is not like these examples don't exist.
Someone 11mo ago
FTA: “Under the new proposal, some “non-risk” cookies won’t trigger pop-ups at all, and users would be able to control others from central browser controls that apply to websites broadly.”
- dijit 11mo ago
  GDPR allows for essential cookies with no popup. Implied consent is valid for most functionality, just not selling peoples tracking data or giving it to a third party who could. Its entirely possible to have no pop-up. Someone once told me they wanted one anyway because it made the site seem more legitimate than if I removed it (the only thing I would have needed to change was the embedded video from youtube and I could have dropped the popup. Oh well).
  - dgroshev 11mo ago
    No pop-ups on apple.com!
  - NooneAtAll3 11mo ago
    embedding youtube is enough to be non-cookiebanner-compliant??
    - Spunkie 11mo ago
      We went the route inspired by gamingonlinux.com So anywhere there is a YouTube embed we instead display a static thumbnail with 2 inline buttons underneath. 1 button to accept cookies and then load the embed and 1 button to view the video directly on YouTube in a new tab. It works nicely and also pushed us to switch most of our videos to being first party hosted instead of YouTube.
    - sdoering 11mo ago
      Look at what YT loads in terms of tracking, when opening a page with an embedded YT video - even if you do not play that. Or install something like pi-hole and watch how many analytics calls to Adobe Analytics the Adible app is sending out. Even if just idle in the background. Given the fact that you pay Adobe by the server call, Audible clearly must earn a shitload of money, if they can burn tracking calls like this. If you are on a Mac, try Little Snitch and see where your data is going while surfing the net. No wonder in the US there are companies, that can sell you a clear image of all relevant data on nearly any person to enable algorithmic wage discrimination [1]. I know, that industry is trying to push EU further and further towards less consumer protections. But we have a great example of what that means for workers, consumers and all of us in the US. [1]: https://pluralistic.net/2025/11/10/zero-sum-zero-hours/ https://pluralistic.net/2025/11/10/zero-sum-zero-hours/
mmooss 11mo ago
Like Do Not Track?

tsoukase 11mo ago

Using an Ad blocker I feel regret for stealing the site's revenue. So I allow them to collect my personal data. Anyways, I think most of them will not respect my rejection.

zelphirkalt 11mo ago
A site that cannot exist without collecting not needed personal data and without selling out its visitors, has no justification of continuing to exist. Don't let them guilt-trip you.
- tonyhart7 11mo ago
  that just shallow and one sided argument that never respect another side of coin
  - array_key_first 11mo ago
    It's also true. Not every business model is viable, and that's life. I can't run a hitman business. Because that's illegal. Oh well, too bad, so sad. This is what makes the world a somewhat decent place. If we make things that suck ass illegal and then, as a byproduct, a bunch of businesses can no longer make money - then good. That's the correct outcome. This is how a free market works. You want to win customers? Make a good product, have a good model, don't cheat by lying to customers, or doing shit without their consent. We don't want scams, scams are bad. If those go away that's a net benefit for humanity.
    - tonyhart7 11mo ago
      what do you mean illegal??? tell that to Ads advertising business that bringing billions every year, and its legal btw
      - array_key_first 11mo ago
        Right, and that sucks major fucking ass. It's bad and literally nobody likes it. If it went away overnight, I would not lose sleep. I don't think I'm alone in that. If you want to run a business that relies on gathering obscene amounts of data on people and then using it in aggregate to commit crimes against humanity, then fine. But at least make them consent to you fucking them up the ass. I don't think that's too much to ask for.

zelphirkalt 11mo ago

Yep, it is exactly what the EU shouldn't do. This will actually further disadvantage EU companies, when US companies are left to run rampant. It also will take away any "made in EU" advantage that EU-local companies had over US competition. GDPR was exactly the right step. In fact it was not enforced strictly enough and should have been enforced much stricter, punishing all the shady businesses which employed dark pattern to extract personal data from citizen.

impulser_ 11mo ago

Yeah, but a lot of the rules around privacy and personal data make it hard to accept business from Europeans. If you are a small business or startup you might not even accept business from Europeans because navigating these rules are almost impossible.

Etheryte 11mo ago
I'm not sure how this makes sense. Functionally the rules are the same across the entire bloc and it's pretty straightforward: unless you have a legitimate reason to store the data, you need to ask for consent and the consent must be free. I want to make more money is not a legitimate reason. I have a legal requirement to fight financial fraud is a legitimate reason. Obviously the reality is more nuanced, but understanding this basic idea gets you there 95% of the way.
OkayPhysicist 11mo ago
Just don't track users. Don't store any information you don't need, don't try to spy on them beyond what information they choose to share with you freely, and the GDPR has zero issues with you.

energy123 11mo ago

I've stopped thinking of regulations as a single dial, where more regulations is bad or less regulations is bad. It entirely depends on what is being regulated and how. Some areas need more regulations, some areas need less. Some areas need altered regulation. Some areas have just the right regulations. Most regulations can be improved, some more than others.

l5870uoo9y 11mo ago
I disagree with this otherwise seemingly reasonable position. Draghi's latest report pointed out that overregulation is a major problem in the EU and costs EU companies the equivalent of a 50% tariff (if I remember correctly). Of course, Draghi's report has led to nothing more than a few headlines.
- wizzwizz4 11mo ago
  That 50% figure seems extremely dubious. I'd expect either methodological failures, or a definition of "costs" that I disagree with (e.g. fair-competition regulations preventing price-hikes, "costing" EU companies the profit they could obtain from a cartel). However, skimming the report (https://commission.europa.eu/topics/competitiveness/draghi-report_en https://commission.europa.eu/topics/competitiveness/draghi-r...), I can't find the 50% figure.
  - l5870uoo9y 11mo ago
    > Mario Draghi has argued that the EU's internal barriers, which are equivalent to a high tariff rate, cost more than external tariffs. He has cited IMF estimates that show these internal barriers are equivalent to a $45\%$ tariff on manufactured goods and a $110\%$ tariff on services. These internal market restrictions, which include regulatory hurdles and bureaucracy, hinder cross-border competition and have a significant negative impact on the EU's economy. Source: https://iep.unibocconi.eu/europes-internal-tariffs-why-imfs-44-estimate-doesnt-hold https://iep.unibocconi.eu/europes-internal-tariffs-why-imfs-...
    - 11mo ago

kronicum2025 11mo ago

> But when we talk privacy and personal data there should be no gray zone. It has to be black and white. you are wrong. If one followed your ways, we would never do a lot of things. There are things called regulatory sandboxes for a reason. But those don't really work in fields where the "scale of the data" is the core reason of why things work. Chat control is stupid.

shoddydoordesk 11mo ago

Who is the audience your comment is trying to reach? Who are these mysterious "companies"? It's important to realize companies are made of people. Someone had to explicitly code the dark pattern in the GDPR cookie dialog. Ever notice the button for "Accept All" is big and shiny, while refusing all is more often than not a cumbersome, multi-click process? That's not an accident. That was coded by people. People around us, people who post here. I'm sure "made GDPR dialog deceptively confusing" went on someone's accomplishment report that they then used to justify a raise or promotion.

palata 11mo ago
My theory is that companies are not the sum of their employees. Employees are generally good; toxic humans are a small minority (unfortunately they tend to be over-represented at the head of companies). But put employees together into a profit-maximisation machine, and the machine will try to maximise profit, with dark patterns and downright evil things. Similar with our species as a whole: nobody is actively working to break the climate so much that their kids will die long before they reach the age of retirement. But that's what we as a species are doing together, somehow. Individually, we don't want that, but that's not enough.
- OkayPhysicist 11mo ago
  That explains passively malignant processes, like not radically overhauling your business to address climate change. It doesn't explain actively malevolent things like "let's bury the "Decline Cookies" dialog under 3 layers of clicks. That's a proactive choice, that some software developer chose to implement.
  - palata 11mo ago
    I'm guessing that in many cases, it's not one software developer who decides. Most people are told what to do, and for many websites I'm guessing that it's just some kind of Wordpress add-on. Someone realised that they sold more add-ons if they implement those dark patterns, so they did it ("it's not me, I offer a good one but they buy the evil one"). In my experience in startups, the website was managed by marketing people who honestly had no clue: they seemed to genuinely believe that they needed those cookies ("I am in marketing, I need the data") and they did not understand the consequences. "I just install this Google thing, and then Google gives me nice data for free". Why do people build weapons? That's a lot worse than a cookie popup, but I'm sure every single person in that industry will tell you that they "save lives".

eitau_1 11mo ago

Most baffling thing is that sometimes you can't opt-out from "always active" stuff that still involve hundreds of "partners"; see: https://news.ycombinator.com/item?id=45844691 https://news.ycombinator.com/item?id=45844691

user34283 11mo ago
Users can opt-out by not using the service or buying an ad-free version if available. One would think that developers should not be forced to offer for free a version monetized with 60% less effective ads. And I understand currently this is indeed not the case for small developers, they can offer paid ad-free or free but with personalized ads. Large platforms apparently cannot.
- deleted 11mo ago
  [deleted]
- moi2388 11mo ago
  That’s not how the GDPR and cookie laws work at all
  - hk__2 11mo ago
    That’s how most news websites work in Europe: accept the cookies, or pay.
    - moi2388 11mo ago
      Yes, but opt-out tracking data which is not necessary for the operation of the primary use case of the app is not allowed. It must be opt-in, truly a free choice, and informed consent, and declining must be as easy as accepting.
      - user34283 11mo ago
        My search told me that unless you are a gatekeeper, offering a reasonably priced ad-free tier allows to make the ad-monetized version personalized only. I think it makes sense. Either pay, or consent to effective ads. There's no free lunch

imiric 11mo ago

Do you really think that clicking on any button on cookie consent popups actually does anything? It's just an illusion of choice. The reality is that these sites will still track you, whether that's via cookies or, more commonly today, fingerprinting. When they list thousands of "partners" with "legitimate interest", it's a hint that there's a multi-billion-dollar industry of companies operating behind the scenes that will do whatever it takes to profile and track you, regardless of what you click on a silly form. Regulations like the GDPR don't come close to curtailing this insanity.

zelphirkalt 11mo ago
I very much doubt, that the practice of putting hundreds or thousands of partners into the legitimate interest category is legal. I wish this was more challenged and brought in front of the courts. And not just wristslaps dished out. Such practices need to have business threatening punishments attached to them.
vanviegen 11mo ago
I'm sure that happens in some cases. But the EU is building a reputation for handling out fines that actually hurt, and I'm sure that actively lying to consumers about this would warrant a big one, if ever discovered. And in any case, tracking will be a lot less robust without those 388 cookies.

golol 11mo ago

I think I should be able to collect whatever publicly available data I can find.

rckt 11mo ago
But we are not dealing here with the public data. Stalking people, recording their every step and action so then you can sell their behavioural habits is not collecting public data, it’s stalking and invading people's private life.

yapyap 11mo ago

> I get that too many regulations is a bad thing Well yeah, cause your sentence relies on itself. _Too many_ regulations is a bad thing. But to have a lot of regulations, especially in fields where there is not much to be gained but oh so much being lost in the interest of capital gains like in generative AI, is a blessing rathr than a curse.

renegade-otter 11mo ago

Europe has much more fatal startup-killing regulation problems than cookies, however. Who cares about cookies? I am on your site, you are going to plant/collect cookies. These goddamned banners are a solution in search of a problem, and it's yet another hurdle a company of, say, 3 has to go through, for very little reason.

thfuran 11mo ago
The banner isn't required. They could just not do the things the banner would ask consent for.
- Myrmornis 11mo ago
  People don't know whether they are or are not doing things that require consent under the law. That's because, if you haven't noticed, the people concerned are computer programmers, UI designers, and PMs. Notably missing from that list is "lawyers who can be bothered to research the question". People put the banners up because they see other people doing it and it seems safest. That all of this would be so should have been perfectly obviously to whoever contemplated bringing the regulation into existence. Therefore they are either imperceptive or malign.
  - thfuran 11mo ago
    Any company that can hire teams of software developers can afford to hire a lawyer to tell them whether they need to irritate all their customers. And frankly, they'd be dumb not to hire a lawyer if they think they need some legal cover to determine whether that cover is sufficient.
    - Myrmornis 11mo ago
      Good god. I certainly wasn't suggesting this situation would be improved by software teams hiring lawyers to advise on their software! You appear to have completely lost perspective.

nine_k 11mo ago

More regulation, or stronger regulation, as in less wiggle room for businesses, may be a good thing. Case in point: a regulation requiring to disclose the ingredients of food. Too many regulations is almost always a bad thing: numerous pieces of regulation rarely fit together seamlessly. It becomes easier to miss some obscure piece, or to encounter a contradiction, or to find a loophole. The cost of compliance also grows, and that disproportionately favors big established players.

samdoesnothing 11mo ago
I think this is an excellent point. More is almost always worse, but if there is a genuine need for regulation it should be absolute.
fwip 11mo ago
In fact, "too many" is the exact point at which it becomes excessive. :P
hekkle 11mo ago
> The cost of compliance also grows, and that disproportionately favors big established players. Not true at all. Most of the harsher regulations only come into effect when the company hits a specific size. Examples from Australia (my country): - Online shops that operate overseas, and import to Australia have to collect sales tax... but only if they make more than $75,000 from Australia per annum. - Social media has to ban Australians under 16... but only if they make more than a billion per annum.
- billy99k 11mo ago
  75,000 is very small for a business.
- senordevnyc 11mo ago
  Actually, online shops that mail stuff to Australian customers who request them to do so don't have to collect or pay any sales tax. The Australian government might stomp their feet and declare otherwise, but they have no legal or jurisdictional authority to do so, nor any real means for enforcement. This trend of countries declaring that everyone on the planet is under their jurisdiction if they mail something there (or respond to a network request) is bananas.

lo_zamoyski 11mo ago

The trouble is that everyone else is pursuing tech unhindered by such regulations at breakneck speed, and Europeans realize that Europe - once the center of science and technology - is increasingly sliding into a backwater in this space and an open air museum. Now, some will agree with you and say that privacy should never be violated, but nonetheless accept a certain measure of tolerance toward that kind of violation, because they see rigid intolerance as causing more harm than the violation of privacy itself is causing [0]. This harm is chiefly the economic harm caused by the burden of regulation and the roadblocks it introduces. Perhaps this isn't true, but if it is, then moral offense is likely to have little effect. A more effective means might be the make following regulations cheaper. Of course, as we know, when you make something cheaper, you increase demand. This means that EU institutions would likely see this as an opportunity to increase regulation, nullifying the gains of introducing less costly ways to adhere to regulation. [0] This reminds me of Aquinas's view of prostitution. Naturally, Aquinas saw prostitution as a grave, intrinsic evil. No one is ever justified in soliciting the services of a prostitute, much less of being a prostitute. That's the moral stance; it concerns our personal moral obligations. However, from the position of the state and how the state should police such activity through law, Aquinas saw the criminalization of prostitution, however good in principle it might be, as a policy that would be practically worse - even disastrously so - than law and policy that is permissive toward prostitution. Whether you agree or disagree with him, the principle holds, namely, that the state not only does not need to police every bit of immorality, but by doing so, may actually contribute to the destabilization of society and to an even worse condition than the one it is saddled with.

rapnie 11mo ago
> sliding into a backwater in this space and an open air museum Or a place that follows a different approach than "break it to make it" mad dash, that fosters a different - perhaps richer - culture with tech more aligned to people's needs, and overall healthier to live in. If there is a good set of regulations in place. And that is where EU is not consistent, and this backtracking not helpful.
- lo_zamoyski 11mo ago

wat10000 11mo ago

They should have gone farther. Don't require the user's permission for non-essential tracking cookies. Just ban them outright. No opt in, no opt out, it's just straight-up illegal to track people unless they're actively using a signed in account.

mvdtnz 11mo ago

There are lots of uses for cookies that have absolutely nothing to do with collecting data about you.

rckt 11mo ago
That's true. But it's just a small part of overall tracking. And nobody would care if the cookies were used only for auth or purely functional reasons.
OkayPhysicist 11mo ago
And you don't need user consent for most of those cookies.

insurancesucks 11mo ago

Laws should punish wrongdoing. Regulations that seek to stop all wrongdoing place burdens on law abiding citizens and businesses that were never going to harm anyone. We can't stop all wrong upfront, and the costs of attempting to do so are substantial.

ekjhgkejhgk 11mo ago

Reminder that cookie banners are not a regulation problem, they're a privacy problem. If you don't spy on your users you don't have to have cookie banners.

jebronie 11mo ago
no. even including a font from a different host is not allowed under the gdpr because you are leaking the users IP to that host. you are poorly informed on this topic.
- ekjhgkejhgk 11mo ago
  But the different host IS tracking because that's how they make money from serving "free" fonts. So if what you're saying is true, that's exactly how it should be. When I go to a website I don't want others involved.
- mrguyorama 11mo ago
  We used to use Subway's proprietary font. We never needed to call a server for that. Maybe don't build stuff in such a dumb and lazy way?

glitchc 11mo ago

Realistically speaking, how much are people willing to pay for email, communications, cloud backups, social media? This is the hard question.

necovek 11mo ago
They already do as part of their internet subscription at home and data plans on mobile. ISPs used to provide email addresses for people, and it was part of the cost.

ndesaulniers 11mo ago

I wish we standardized on Do Not Track headers. Cookie banners are a plague. Thanks Europe.

dgroshev 11mo ago
There is nothing stopping the industry from standardising on an alternative form of expressing consent, for example on browser installation. GDPR is agnostic to the form the consent takes, as long as it's informed and freely given. However, by far the biggest browser is funded by a corporation that wants tracking data across the web. I'm not very surprised that the corporation haven't made it easy to refuse just once. Thanks Google.

nomel 11mo ago

You can do this trivially in modern browsers: private browsing. I have one "normal" browser window for "persistent cookie" use (like gmail, youtube, etc) and another "private" window for everything else. Cookies are lost anytime a tab closes.

deleted 11mo ago
[deleted]
- deleted 11mo ago
  [deleted]
- deleted 11mo ago
  [deleted]
deleted 11mo ago
[deleted]
morshu9001 11mo ago
Yeah idk why there's a law trying to poorly enforce this instead
- troupo 11mo ago
  Because the law isn't about cookies, but about tracking? You know, the kind that doesn't stop even if you open the "ignorant mode" in your browser: https://www.tomsguide.com/news/going-incognito-in-chrome-doesnt-mean-youre-not-being-tracked-now-confirmed-by-google https://www.tomsguide.com/news/going-incognito-in-chrome-doe...
necovek 11mo ago
Are you sure cookies get scrapped after you close a tab? Does opening a single session-based web site in multiple tabs work (eg. logged into Amazon in a private browser)? What browser are you using?
- morshu9001 11mo ago

nmz 11mo ago

Why not accept and let cookie autodelete delete it after closing the site? Expecting any industry to follow the law is foolish, if it gets big enough, they will wear down and overturn any annoyance against it, malicious compliance is the only way. https://adnauseam.io/ https://adnauseam.io/

fsflover 11mo ago
It's not just about cookies but any kind of tracking, including fingerprinting.
rckt 11mo ago
I think we better remove the problem itself that come up with more and more ways to mitigate it.

everdev 11mo ago

And when they use our data to profit, we don't get a royalty cut.

lenkite 11mo ago

That cookie banner needs to be standardized and offered by the browser. It should be like a certificate popup. Why is every website forced into doing a shoddy job ?

what 11mo ago
How would that even work? The browser has no way to know what a cookie is for.
- vilhelm_s 11mo ago
  They are regulating websites anyway, surely they can just invent some standard format to say what function each cookie has. How about requiring that the name of every cookie has to start with one of "Strictly Necessary", "Functional", "Performance", and "Targeting/Advertising"?
- will4274 11mo ago
  It's not the tech that's hard. https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep/0205.html https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep...
DavideNL 11mo ago
Aren’t tracking cookies mostly irrelevant nowadays, because every browser can be uniquely fingerprinted anyway?
- sdoering 11mo ago
  Fingerprinting is actually covered by the regulations and needs to be "consented" to. There are different regulations, but basically they are technology agnostic (a good thing). If you as a compnay want to use data that could theoretically be used as an identifyer for me, you need my consent. For any type of use. Except if it is absolutely necessary to provide the basic service. Or if we have a contractual relationship, but there are also protective rules in place to protect the customer. Different regulations handle storing data (like cookies, but also local/session storage and similar things on the devices of your users. But those are separate from GDPR. GDPR is - as said - only concerned with data that could be theoretically linked to me as an individual. Regardless what this data is. Could be an id in a cookie, could be a fingerprint, could be smoke signals. It could even be the combination of different data points, that taken together allow for an identification. Theoretical example: Imagine I live in a village with 500 people. The company tracks the location and that I am male (so roughtly 50% of the population), that I am between 45 - 50 (say about 10% of the population), have multiple cats (say maybe only three people now in that village, use a Linux based machine - bingo: You found me. And now you have a set of data that falls under the GDPR. Welcome in having to ensure you only use this data in a way that I gave consent to. See: The law doesn't even just look at marketing or tracking data. Or what happens in an app or a browser. It covers all data that is either pointing ti me as an "ID" - like a cookie ID, or at personal identifiable data - like bei combination in my example.

adrr 11mo ago

Are cookies really tracking you? 3rd party cookies don’t work in any browser. Ads are passing session data on the URLs instead. You can alow easily change some settings to stop persistent cookies. You can install privacy extensions like ghostery to block beacons. You can use features like ICloud private relay to prevent IP tracking. Solutions are all there and they aren’t because of any law.

0xedd 11mo ago
[dead]
63stack 11mo ago
There are a bunch of sites that stop working if you tweak privacy related settings. Twitter straight up tells you that if you experience problems, you should disable Firefox's tracking protection.
- sdoering 11mo ago
  And by that they are actually in violation of GDPR. But hey - since when was Musk interested in following regulations. And since when has a governmental or supra-governmental entity been able to curb that tendency of the super rich and biggest cooperations. Like with meta: They know they mke 7 billion annualy from serving 15 billion scam ads daily. They calculated that they will have at most have to pay about a billion in governmental fines all over the world, if they should one day be regulated for that. So it is a clear business decision to go on shoing 15 billion+ scam ads per day to their "users". Were some interesting journalistic pieces on that a few days ago. And exactly those companies are the reason we need stronger protection. And these protections more heavily enforced.
sdoering 11mo ago
Don't mix PII data and cookies (or any other similar tech). There are different regulations in place here. If you want to use ddata that can identify me (even in theory), you need to ask me, if I am fine with that. If you want to store data on my computer, you also need to ask me, if I am fine with that. Because, if I request a download, I expect to download the file. If I request a website, I expect the website content. I do not expect data that you or others can use to see how often I visited your site. Like meta-shit, or google-crap, or linkedin-slop... If you want to do that, just ask m. And explain in clearly understandable words, what you do and why. That is just human decency. Yes, I can (and strongly do) protect myself against this (and I am working in that business, I know the tricks and tools and stuff). But my late mom can't. Or her 80+ year old neighbor. Or SO#s my 19 year old niece that only uses a tablet and a crapload of apps that target her and spew a shitload of targeted ads for wheightloss onto her since she was an early teen... So no -> Those companies need to be highly regulated. To me, those companes need to rott in hell, but that is my take. I want people to be protected. From business, from government. Thst is the basis of European privacy law - protecting the small person from the big entities. And rightly so. We have our history from which those protections originated.

erikerikson 11mo ago

> Business never respects anything, but profits That is taken as a law of the universe by some but B-Corps, Social Purpose Corps, FairShares Commons... There are exceptions and some are working to do better. That statement has mostly become an excuse.

lynx97 11mo ago

Everything that happens under Ursula Von der Leyen leaves a bitter taste.

po1nt 11mo ago

Every regulation has some unforeseen consequences. Most of the time it's impacts are worse than the effect we wanted to regulate from the start. Us humans discard the effects we can't predict as benign even over smaller inconveniences we can see.

vanderZwan 11mo ago
> Every regulation has some unforeseen consequences. This argument would feel a lot less insincere if the people who always trot it out also used it every time something gets deregulated. > Most of the time it's impacts are worse than the effect we wanted to regulate from the start. Are they though? Or do you only hear a disproportionate amount of complaints because of manufactured consent? Because I sure as hell don't trust the talking heads on TV backed by billionaires who don't like to see people push back at their greed and lust for power.

WA 11mo ago

I'm 100% on the same page as you. I just wanna point out that apparently, the enforcement of said regulation just failed. There are way too many businesses that don't give you a single "reject all" button and get away with their dark patterns. A regulation that can't be enforced consistently is not desirable and failed to some degree.

sdoering 11mo ago
I recently registered a complaint with my local data protection authority. This then got routed to their colleagues in North Rhine-Westphalia that are responsible, as the company in question had their business location there. What the company did? They showed a consent banner - but already sent my data to all manner of analytics and marketing companies. Before I even denied consent. They also did not mention all of those trackers/companies/cookies in their consent solution nor on their privacy page. The result from the authorities was a clear: Go f*k yourself e-mail to me (I had screenshots attached in my complaint). Basically stating: We do not see any way you are personally affected and we also have too much to do, so we won't go after a company, just because they tracked you and sent your data to a bunch of marketing companies and tracking firms, even as you denied consent. And we also don't care, that they actually did not mention quite a bunch of those receivers of my data in their data privacy page. So yeah - when governments actually have no interest in enforcing the rules in place to protect citizens, I am lost for words. Might have been, because the company in question being in violation of the law here was a former state-owned business, that while privatised is still run by politicians (like currently by the Chairman of the FDP Federal Committee for Justice, Home Affairs, Integration, and Consumer Protection to be precise). What pisses me off about this the most, though is, that companies that actually follow the regulations, treat customers well and respect their data privacy concerns, they are at a disadvantage. It is not that our government and those EU conservative ars**es are for a free market. They want a market in which their buddies and the ones providing the juicy jobs after governmental terms come to an end, to win. As always, conservatives follow Wilhoit's Law.

baxtr 11mo ago

The problems are in the details: why are news organizations exempt from this rule in Europe? You can’t read news websites unless you accept all cookies or pay to read. Who decides these things? How is such a rule in favor of privacy? Why is my site where I regularly post news not eligible? Who decides which sites are eligible? It’s these kind of moral double standards and cognitive dissonances that people have to endure. I wish it was black and white. But reality simply isn’t.

Cthulhu_ 11mo ago
It seems there were lawsuits but "pay to reject" is apparently legal as long as the pay is reasonable. I despise it personally.
- jamiecurle 11mo ago
  If you're under UK law the ICO guidance on "pay to reject" can be found here: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-tracking/consent-or-pay/about-this-guidance/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
qwertox 11mo ago
> You can’t read news websites unless you accept all cookies or pay to read. You can't even read news websites when you accept all the cookies, and then, oh surprise, you'd have to pay. But they installed the cookies nonetheless, those scammers.
Bewelge 11mo ago
Are you sure they are exempt? I was always under the impression that their practice is pretty obviously illegal. I just did a quick google search and didn't find anything about exemption. So they are as exempt from the GDPR as much as Al Capone was exempt from taxes ;) What they seem to be exempt from is getting consent if they require the data for journalistic purposes. IANAL, but I think they are simply not following the law and waiting for a definitive decision by a court. ed: So I kept reading and from my understanding it's TBD whether the practice is lawful. The European Data Protection Board has issued an opinion against it a year ago.

PeterStuer 11mo ago

Once they lobbied in "legitimate interest" as the exception to the opt-in requirement, the whole regulation de facto became a farce for the end user.

miki123211 11mo ago

Nothing is ever black and white. You could prevent all car accidents by banning motor vehicles. You could prevent all side-effect related deaths by banning all the drugs. You could stop all phone scams by banning telephones. Obviously, that's excessive overregulation. Just as obviously, letting people get away with car accidents, phone scams and drugs that kill more people than they cure is not what we should be doing either. It's the job of the lawmakers to find the tradeoffs that work best for society. The moment you say "it's black and white, the other side has 0 good arguments", you lose the discussion in my view. If you don't understand what we're even trying to trade off here, we can't have a productive discussion about what the right tradeoff is.

krainboltgreene 11mo ago
What a funny comment. “You see, you just don’t understand trade-offs, here let me explain to you…”
rckt 11mo ago
What kind of a discussion can there be? It's very simple. I don't want any business or individual or whatever to collect any of my personal data if I don't agree to it. Right now companies do everything they can to do the opposite. And there's nothing here that can prove them right.

concinds 11mo ago

There is an infinitely more effective and trustworthy solution: an adblocker that blocks trackers. You don't have to spend minutes daily on dark-pattern banners. You don't risk the broken implementations that still track you no matter what you click, that regulators can't oversee on billions of websites. They should just keep the thing that lets you request full deletion of your account and data, the rest is total security theater. The EU's top #1, #2, #3, #4, and #5 priority right now should be achieving digital sovereignty and getting a strong homegrown tech industry (ban American social media and force local alternatives?) so the US can't coerce it. That'll require some additional, different regulations, and that's the kind they should focus all efforts on for the foreseeable future. They put the cart before the horse. Look at the sanctioned ICC judges (EU-based). Can't use any credit/debit cards (all American). Can't do any online e-commerce (there's a US entity somewhere in the flow). No Google/Apple accounts (how useful is your iPhone without the App Store?). "Regulate" foreign companies all you want, ultimately you still have no power over them. Cart before the horse.

IanCal 11mo ago
It's not more effective and trustworthy, particularly as you can do both. The laws also cover dramatically more than tracking scripts and cookies. > They should just keep the thing that lets you request full deletion of your account and data, the rest is total security theater. Then large law abiding sites can still do enormous amounts of tracking, and can do lots with my data that they currently are not doing.
tcfhgj 11mo ago
> There is an infinitely more effective and trustworthy solution: an adblocker that blocks trackers. You don't have to spend minutes daily on dark-pattern banners. You don't risk the broken implementations that still track you no matter what you click, that regulators can't oversee on billions of websites. try untangling the tracking code from the rest of the javascript code which is required for the sites to work - simply unrealistic.
LtWorf 11mo ago
> ultimately you still have no power over them You have the immense power of denying them access to your money, which turns out is a very compelling argument :)

blueblisters 11mo ago

The problem is paternalism and assuming the user is too dumb to take control their privacy preferences. The compliance of the cookie banner regulation has measurable negative externalities - one estimate suggests a EUR 14B/year productivity hit in the EU Most modern browsers allow you to disable all cookies if you like. You can always use incognito mode if you want to be selective about it. In an ideal world, the EU could have simply educated their constituents about privacy controls available in their browser.

dgb23 11mo ago
GDPR is not a cookie regulation it is a tracking regulation.
- IanCal 11mo ago
  It's broader, it's about users data. For example, you can store my address so you can send the item I ordered to me. You can't, without permission, use that to send me marketing stuff.

alexnewman 11mo ago

Perhaps if you had some engineers write the laws they’d work better

deleted 11mo ago

[deleted]

Noaidi 11mo ago

This is why I just bought a Pixel and put GrapheneOS on it. And one with a SIM card that I can take out whenever I want. No AI, limited tracking, and no big tech. This is my personal boycott.

ernst_klim 11mo ago

> But when we talk privacy and personal data there should be no gray zone. It took me to move to Germany to figure that privacy is a spectrum, and I, despite being a crazy on privacy and security, actually don't want that much. I've been to a German factory where robots could not distinct between humans and objects bc Datenschutz. My colleagues had 3 bikes stolen in a week bc we have no CCTV cameras. Privacy definitely has costs, and not only for business, but for regular people in daily life. It should, as anything, be balanced against costs of doing business, people security concerns. Same goes for security: few private cctvs are ok, massive coordinated surveillance and chat control not ok. Everything is on spectrum and is a trade off.

pebble 11mo ago
I'm curious how the CCTV would have prevented the bike theft?
- JimmyBiscuit 11mo ago
  Yeah, I can tell you that the only thing CCTV does is making the thief wear hoodies. And you get some clips of them carrying expensive bikes around the corner out of CCTV range to their parked transporter.
  - LtWorf 11mo ago
    Even without hoodie… who was it? Some dude.
- m000 11mo ago
  True. I don't know from where people get the idea that the police would bother with an investigation for your (personally important) case if you had full-on surveilance. You may have your laptop snatched, go to the police station and show them the exact location of the thieves using e.g. find my Mac. The will do nothing, even if it's in the building across the street. Now, showing them some blurry (at best) faces in CCTV footage and ask them to investigate? Good luck.
afandian 11mo ago

kvgr 11mo ago

We had our underground parking and storage units broken into in apartment building. And we couldn't see the CCTV camera, to be on a lookout for the thief and call cops. Only cops could see it. Thieves have higher protection than your property.

paulddraper 11mo ago

> they just shouldn't be able to collect anything without me actively opting in That's exactly why things are the way they are.