4 ms·

Having worked at multiple companies and talked to multiple legal teams about this, they tend to be very conservative. So the guidance I've gotten is that if we

Having worked at multiple companies and talked to multiple legal teams about this, they tend to be very conservative. So the guidance I've gotten is that if we store any information at all on the person's computer, even to know whether they've visited the site before, we still need a cookie banner. Basically, the law created enough fear among the lawyers that software developers are being advised to include the cookie banner in cases where it isn't strictly needed.

norman784 8mo ago
But it should not be obnoxious, look at steam how is a small banner with two simple actions, vs all other cookie banners.
- rpdillon 8mo ago
  Agreed! Many sites don't actually comply with the GDPR because they don't provide simple tools to control the cookies and instead force you through a flow. Part of my gripe with the law is the way those violations are not being systematically cited.
- buzzerbetrayed 8mo ago
  You literally just described something obnoxious
rendx 8mo ago
So? You're not arguing that we should get rid of 'reasonable' laws out of misinterpretations of them, are you?
- rpdillon 8mo ago
  Laws should be evaluated on the effect they actually have on society, rather than the effect that we wish they had on society. I am very critical of laws that fail this test, and I think they should be updated to improve their performance. We want the right outcome, not the right rules.
- bigstrat2003 8mo ago
  I'm willing to argue that, sure (though it's purely a hypothetical point as I'm not a citizen of the EU and thus I don't and shouldn't have a voice in the laws there). I don't judge a law by a deontological measure of worth, but rather by whether it seems to be making things better or worse. The GDPR has overwhelmingly made my experience browsing the web worse, not better. Whether it should have resulted in that is beside the point: it has resulted in that, so that is what I judge it by. Therefore, I think it makes sense to get rid of the law as it seems that it is making things worse for people, not better.
  - rendx 8mo ago
    > The GDPR has overwhelmingly made my experience browsing the web worse, not better. From where I sit that's hard to evaluate since you cannot actually see most data abuses and privacy concerns, and you also don't know how it would have been without it. You also see the effects of various laws and regulations in combination, so the ones related to GDPR are not easy to be singled out. Are you thinking only of the cookie banners? Maybe sites would be plastered with even worse bullshit. Did you consider that GDPR also resulted in privacy policies that (if actually somewhat legal) are fairly easy to read and not just copy pasta but specific to the service(s), have proper contact information, you get some transparency about which data partners the sites work with, sites need to have full data export, right to be forgotten (removal of your data/contributions), and so on. I am certain you benefit from it often, potentially without realizing, and you wouldn't know what the world would be like without them today so it's not so straightforward to reason about.
- r33b33 8mo ago
  If the law is stupid, don't follow it. Simply as
stephenr 8mo ago
> even to know whether they've visited the site before So uh, don't do that. You don't need to notify if you use cookies for required functionality like login sessions or remembering a functional setting. If you're tracking whether they're returning or not your activity is exactly the kind of behaviour the rule is covering because, in legal terms, it's skeezy as fuck.
- rpdillon 8mo ago
  It's a site where they log in and we store a cookie.
  - rendx 8mo ago
    "Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user." https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
    - rpdillon 8mo ago
      Right, and then the legal teams tell me they don't care, and we should put up the cookie banner anyway. I feel like you didn't read my original comment.
      - sensanaty 8mo ago
        That just means your legal team is lazy or incompetent. I work for a massive company that handles extremely sensitive PII and we don't have a cookie banner, because we don't need to have a cookie banner. GitHub doesn't have one, Gitlab doesn't have one.
      - kuschku 8mo ago
        I've built software used by EU governments, and we don't use a cookie banner for our login cookies either. If your legal team genuinely suggests that, it's likely your company uses the login cookies for some additional purposes.
dheera 8mo ago
If I see a cookie banner I often bounce. You'd have much better retention rates if you don't cover up the content the viewer is trying to view. How would you like it if I shoved a banner in your face the moment you walked into a store and forced you to punch a hole in it in order to view items on the shelves?
- Izkata 8mo ago
  There is a push for something like that: https://www.adweek.com/commerce/cooler-screens-rolls-out-to-convenience-stores-and-supermarkets-nationwide/ https://www.adweek.com/commerce/cooler-screens-rolls-out-to-...

norman784 8mo ago

But it should not be obnoxious, look at steam how is a small banner with two simple actions, vs all other cookie banners.

rpdillon 8mo ago
Agreed! Many sites don't actually comply with the GDPR because they don't provide simple tools to control the cookies and instead force you through a flow. Part of my gripe with the law is the way those violations are not being systematically cited.
buzzerbetrayed 8mo ago
You literally just described something obnoxious

rendx 8mo ago

So? You're not arguing that we should get rid of 'reasonable' laws out of misinterpretations of them, are you?

rpdillon 8mo ago
Laws should be evaluated on the effect they actually have on society, rather than the effect that we wish they had on society. I am very critical of laws that fail this test, and I think they should be updated to improve their performance. We want the right outcome, not the right rules.
bigstrat2003 8mo ago
I'm willing to argue that, sure (though it's purely a hypothetical point as I'm not a citizen of the EU and thus I don't and shouldn't have a voice in the laws there). I don't judge a law by a deontological measure of worth, but rather by whether it seems to be making things better or worse. The GDPR has overwhelmingly made my experience browsing the web worse, not better. Whether it should have resulted in that is beside the point: it has resulted in that, so that is what I judge it by. Therefore, I think it makes sense to get rid of the law as it seems that it is making things worse for people, not better.
- rendx 8mo ago
  > The GDPR has overwhelmingly made my experience browsing the web worse, not better. From where I sit that's hard to evaluate since you cannot actually see most data abuses and privacy concerns, and you also don't know how it would have been without it. You also see the effects of various laws and regulations in combination, so the ones related to GDPR are not easy to be singled out. Are you thinking only of the cookie banners? Maybe sites would be plastered with even worse bullshit. Did you consider that GDPR also resulted in privacy policies that (if actually somewhat legal) are fairly easy to read and not just copy pasta but specific to the service(s), have proper contact information, you get some transparency about which data partners the sites work with, sites need to have full data export, right to be forgotten (removal of your data/contributions), and so on. I am certain you benefit from it often, potentially without realizing, and you wouldn't know what the world would be like without them today so it's not so straightforward to reason about.
r33b33 8mo ago
If the law is stupid, don't follow it. Simply as

stephenr 8mo ago

> even to know whether they've visited the site before So uh, don't do that. You don't need to notify if you use cookies for required functionality like login sessions or remembering a functional setting. If you're tracking whether they're returning or not your activity is exactly the kind of behaviour the rule is covering because, in legal terms, it's skeezy as fuck.

rpdillon 8mo ago
It's a site where they log in and we store a cookie.
- rendx 8mo ago
  "Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user." https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
  - rpdillon 8mo ago
    Right, and then the legal teams tell me they don't care, and we should put up the cookie banner anyway. I feel like you didn't read my original comment.
    - sensanaty 8mo ago
      That just means your legal team is lazy or incompetent. I work for a massive company that handles extremely sensitive PII and we don't have a cookie banner, because we don't need to have a cookie banner. GitHub doesn't have one, Gitlab doesn't have one.
    - kuschku 8mo ago
      I've built software used by EU governments, and we don't use a cookie banner for our login cookies either. If your legal team genuinely suggests that, it's likely your company uses the login cookies for some additional purposes.

dheera 8mo ago

If I see a cookie banner I often bounce. You'd have much better retention rates if you don't cover up the content the viewer is trying to view. How would you like it if I shoved a banner in your face the moment you walked into a store and forced you to punch a hole in it in order to view items on the shelves?

Izkata 8mo ago
There is a push for something like that: https://www.adweek.com/commerce/cooler-screens-rolls-out-to-convenience-stores-and-supermarkets-nationwide/ https://www.adweek.com/commerce/cooler-screens-rolls-out-to-...