4 ms·

So you like the law, but don't like how it didn't actually solve the problem it was trying to solve? I assume you're pretty well read up on matters of privacy,

So you like the law, but don't like how it didn't actually solve the problem it was trying to solve? I assume you're pretty well read up on matters of privacy, right? So you have a better awareness and understanding. But do you believe the average person does? Or would you assume that the average person has either been trained to ignore the banner, automatically consent to more invasive tracking, or is generally more confused about why the banner exists, or what it does? The cookie consent law is the dumbest application of an attempt to improve privacy. It's made the internet worse, and is being used to train people into consenting to giving away their privacy without thinking... because: "clicking accept is what you have to do to use the page" -- every normal person casually browsing any site. No implementation for cookie based consent can be done correctly. Personally, I'd love to see a law that makes any/all dark patterns a crime, and empowers state prosecutors via grand jury to bring charges for them against both the company, and individual authors of the specific commits as jointly responsible. I don't want statutory laws, I want a trial jury to look at it, and decide if any technological measure, pattern, tactic, procedure, design, or measurement was used to encourage one decision over the other instead of a fair choice. I don't want a set of rules that given enough funding any company is able to win as a negative sum game. I want a jury, not a trailing clause, to decide if the company is clearly acting in good faith or worthy of apocalyptic fines.

vouwfietsman 3mo ago
> So you like the law, but don't like how it didn't actually solve the problem it was trying to solve? (Not the person you replied to) I'm not sure where all of this is coming from, the law is actually extremely obvious and useful: you want to track people, they have to be informed, and have to consent. The law says nothing about how, and the way it was implemented was entirely up to the corporations discretion, which of course opted for the most malicious terrible way to do it, but they did it. The purpose of the law was that people should be informed about cookies being installed and consent to that happening. Do you feel like people are now aware that cookies are being installed, more so than before the banner? Do people understand that they are consenting to this? That is the law at work. Everything above and beyond that is nice to have, and I'm sure the world would be better for it, but without the EU, people probably wouldn't even know what cookies were, let alone understand (or have control over) how they are being tracked. If that's not a net positive in a world where net-negatives happen every week, I don't know.
- AnthonyMouse 3mo ago
  > Do you feel like people are now aware that cookies are being installed, more so than before the banner? Do people understand that they are consenting to this? > That is the law at work. The problem is that's not what anybody, including the users, want. Nobody cares that browsers have cookies as an implementation detail. It's a ridiculous thing to use as the basis of a privacy rule. Does the user care that the site uses cookies to implement a shopping cart feature? Does the user not care that the site is tracking them without cookies using device fingerprinting? Cookies were never the problem. On top of that, they were the thing the users already had control over. Browsers allow you to delete or reject cookies, provide private browsing modes that don't submit them, etc. Meanwhile the things that would actually be useful, like prohibiting services from requiring the user to provide a phone number (a de facto cross-service cross-device tracking ID) in order use the service, or requiring device attestation (which uniquely identifies the device), are left unaddressed.
  - vouwfietsman 3mo ago
    I am eagerly awaiting your grassroots campaign to define legislation that would tackle such uses, and also eagerly awaiting it backfiring because of malicious compliance.
    - AnthonyMouse 3mo ago
      Malicious compliance is a result of incompetent drafting. It's common because incompetent drafting is common, case in point GDPR. It's definitely possible to screw it up less than that -- there are many laws that nobody complains about. You pass a law prohibiting any entity from conditioning the use of their service on the user providing them with a phone number. Even services that actually use SMS or voice calls are required to provide an alternative like email or the web with no reduction in functionality and for no additional cost. You pass a law stating that any device which is sold or leased to anyone who takes physical possession of it cannot contain a private key the customer is unable to both read and extricate at no cost. What does malicious compliance look like there? Anyone can give them an email instead of a phone number and if that doesn't work they're in violation. Remote attestation is the only reason for devices to come from the factory containing an inaccessible private key, which is thereby prohibited and unable to be used as a tracking ID.
AnthonyMouse 3mo ago
> I don't want a set of rules that given enough funding any company is able to win as a negative sum game. I want a jury, not a trailing clause, to decide if the company is clearly acting in good faith or worthy of apocalyptic fines. You want the winner to be the side with more expensive lawyers who use psychological manipulation techniques against a jury? In general juries are the finders of fact. They decide what happened, e.g. who is lying. Judges decide the law, i.e. whether the thing the jury says they did is a violation of the law. What you're asking for is to have the jury decide what the law is. There are a lot of problems with that, but one of the big ones is that jury determinations don't have to follow precedent and, unless you want judges ultimately deciding it anyway, can't really be appealed. Which would result in zillions of spurious lawsuits against innocent people because a small percentage of them would win big at random.

vouwfietsman 3mo ago

> So you like the law, but don't like how it didn't actually solve the problem it was trying to solve? (Not the person you replied to) I'm not sure where all of this is coming from, the law is actually extremely obvious and useful: you want to track people, they have to be informed, and have to consent. The law says nothing about how, and the way it was implemented was entirely up to the corporations discretion, which of course opted for the most malicious terrible way to do it, but they did it. The purpose of the law was that people should be informed about cookies being installed and consent to that happening. Do you feel like people are now aware that cookies are being installed, more so than before the banner? Do people understand that they are consenting to this? That is the law at work. Everything above and beyond that is nice to have, and I'm sure the world would be better for it, but without the EU, people probably wouldn't even know what cookies were, let alone understand (or have control over) how they are being tracked. If that's not a net positive in a world where net-negatives happen every week, I don't know.

AnthonyMouse 3mo ago
> Do you feel like people are now aware that cookies are being installed, more so than before the banner? Do people understand that they are consenting to this? > That is the law at work. The problem is that's not what anybody, including the users, want. Nobody cares that browsers have cookies as an implementation detail. It's a ridiculous thing to use as the basis of a privacy rule. Does the user care that the site uses cookies to implement a shopping cart feature? Does the user not care that the site is tracking them without cookies using device fingerprinting? Cookies were never the problem. On top of that, they were the thing the users already had control over. Browsers allow you to delete or reject cookies, provide private browsing modes that don't submit them, etc. Meanwhile the things that would actually be useful, like prohibiting services from requiring the user to provide a phone number (a de facto cross-service cross-device tracking ID) in order use the service, or requiring device attestation (which uniquely identifies the device), are left unaddressed.
- vouwfietsman 3mo ago
  I am eagerly awaiting your grassroots campaign to define legislation that would tackle such uses, and also eagerly awaiting it backfiring because of malicious compliance.
  - AnthonyMouse 3mo ago
    Malicious compliance is a result of incompetent drafting. It's common because incompetent drafting is common, case in point GDPR. It's definitely possible to screw it up less than that -- there are many laws that nobody complains about. You pass a law prohibiting any entity from conditioning the use of their service on the user providing them with a phone number. Even services that actually use SMS or voice calls are required to provide an alternative like email or the web with no reduction in functionality and for no additional cost. You pass a law stating that any device which is sold or leased to anyone who takes physical possession of it cannot contain a private key the customer is unable to both read and extricate at no cost. What does malicious compliance look like there? Anyone can give them an email instead of a phone number and if that doesn't work they're in violation. Remote attestation is the only reason for devices to come from the factory containing an inaccessible private key, which is thereby prohibited and unable to be used as a tracking ID.

AnthonyMouse 3mo ago

> I don't want a set of rules that given enough funding any company is able to win as a negative sum game. I want a jury, not a trailing clause, to decide if the company is clearly acting in good faith or worthy of apocalyptic fines. You want the winner to be the side with more expensive lawyers who use psychological manipulation techniques against a jury? In general juries are the finders of fact. They decide what happened, e.g. who is lying. Judges decide the law, i.e. whether the thing the jury says they did is a violation of the law. What you're asking for is to have the jury decide what the law is. There are a lot of problems with that, but one of the big ones is that jury determinations don't have to follow precedent and, unless you want judges ultimately deciding it anyway, can't really be appealed. Which would result in zillions of spurious lawsuits against innocent people because a small percentage of them would win big at random.