11 ms·

The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/o

The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/or clicking a button cannot constitute informed consent”; and see what they try next.) From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them out of the way. Just as shrink-wrap licenses and even simple contracts have at times in some jurisdictions essentially been neutered, so that only terms that a reasonable person would expect to be there are enforceable, at which point it becomes obvious that the whole thing needs tearing down in favour of standard licenses/contracts. In the Australian state Victoria, for example, there are standard rent and property sale contracts; for renting you must use that contract <https://www.consumer.vic.gov.au/housing/renting/starting-and-changing-rental-agreements/different-rental-agreements/residential-rental-agreements#:~:text=You%20must%20use%20the%20%E2%80%98prescribed%20form%E2%80%99%20when%20entering%20into%20a%20written%20rental%20agreement%2E https://www.consumer.vic.gov.au/housing/renting/starting-and...>, and I got the impression that residential sales practically always use the standard contract. But of course it’s impossible to convince someone of something when their livelihood depends on their not understanding it.

deleted 3mo ago
[deleted]
otterley 3mo ago
> From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them out of the way There’s no way this would fly. “I didn’t read it” can’t possibly be an excuse to avoid being bound by an agreement. Every party to an agreement that flaunted its terms, even though they took advantage of the benefits granted by it, would invoke it as a defense, and it’s irrefutable. The system would completely fall apart if this happened. There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing.
- deaton 3mo ago
  But "its specifically engineered to ensure that nobody reads it" is a real argument
  - otterley 3mo ago
    Where has this ever been adjudicated?
- bluGill 3mo ago
  Of you need a nonstandard contract then you need to provide proof that it was understood. These are not provided in a context where I would expect anyone reading it to have a lawyer to advise so they obviously don't understand it
  - otterley 3mo ago
    By that same logic, do you believe ignorance of the law is a valid defense to a criminal charge? Laws are also written by lawyers.
    - bluGill 3mo ago
      No, but I do believe that if the jury doesn't find it was obviously a crime without any being told the law then it wasn't a crime. That is the text of the law isn't important until guilty is decided. (So the jury can decide degree if that is a question for the jury, otherwise the judge needs to know for sentencing but the jury doesn't care)
- Avicebron 3mo ago
  > There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing. The value is derived from the people consuming the product. Placing the "incentive to produce value" above the people who presumably are the source of this value seems...misaligned.
ymolodtsov 3mo ago
Websites need cookies. I don't get why I have to suffer through this for a few puritans who literally lose nothing in the process of this transaction but act as if Stasi is watching them.
- estebarb 3mo ago
  Session cookies do not require a banner.
  - tempestn 3mo ago
    Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.
    - tappio 3mo ago
      There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.
      - tempestn 3mo ago
        My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.
        jason_oster 3mo ago
        It depends on what is to be analyzed. How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
        3mo ago
basch 3mo ago
Cookie control always should have been a browser control. The legal route always should have been to force it to be built into browsers that provide sane defaults, and make it illegal to circumvent what the browser declares as far as fingerprinting etc. any sort of elevation prompt, IF I allow them to be popups or an icon in a toolbar, should always be in the same place and not cover the page.
- MassiveQuasar 3mo ago
  Just enforce the GPC header... https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-GPC https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
  - quantumwannabe 3mo ago
    Or the "Do Not Track" header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
- nickff 3mo ago
  If people really cared, they’d choose browsers that have better control, but that’s obviously not a priority for them. Why do you think this sort of thing should be regulated to suit your preferences when most people don’t seem to agree with you?
  - ablob 3mo ago
    I think that's a stretch. People can care, but be unwilling to spend the time researching it or accept the trade offs that come with small browsers (which are often unsupported for applications you might want to use). There are many things someone might care about and at some point you have to prioritize. This topic in particular is practically a cold war where you always have to catch up on how things are, lest you loose it all. The required effort is disproportionate to the result. P.S.: No true Scotsman spotted
  - ClumsyPilot 3mo ago
kleiba2 3mo ago
> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data mining, profiling, and other privacy-related aspects. But in many cases, you could just click "reject" and the banner would also disappear... To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.
- readread 3mo ago
  "Accept all" always makes it go away immediately. Some variant on "reject" takes more effort like 70% of the time. Which is on purpose, of course. The ones that aren't maliciously-complying have a "necessary only" button that insta-closes it, but tons pretend that you might want to allow some spying but not all of it and make you go through another screen if you don't just "accept all". > To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning. Then it'd be possible to default it to "nope" (Firefox, and perhaps Safari, might do this) or to allow a "never, anywhere" setting the first time the question is asked, and malware and spyware vendors know that'd mean a much larger proportion of denials.
  - jackson1442 3mo ago
    "necessary only" also tends to have a malicious compliance aspect where they don't store a cookie recording your preference and show the banner on every single page until you click accept.
    - remus 3mo ago
      Perhaps I am overly optimistic in thinking this is just incompetence.
      - 3mo ago
ethin 3mo ago
IMO any contract, waver, etc., shouldn't be legally enforceable unless the signatory has actually read it. It's always seemed to me to be one hell of a pathway of abuse (in a way) to just be able to bind someone to be legally required to do anything you want, for example, by just relying on them not reading the thing they signed.
- dotancohen 3mo ago
  How to know if they actually read it? The signature implies that the contract has been read, understood, and accepted. I see no need for any alternative mechanism.
  - inigyou 3mo ago
    Well for instance if the other party is pressuring you to sign it then it can't be assumed that you had adequate time to read it and understand it
    - dotancohen 3mo ago
      Contract law of every civilised land already has a process for considering and accounting for duress.
      - inigyou 3mo ago
        It only accounts for "sign this or I'll kill you" not for "you have ten seconds to make a decision or the dream vacation goes to the next person"
        crote 3mo ago
        Some countries already have provisions for this. For example, in The Netherlands there is a legally mandated three-day period after signing the contract for purchasing a home during which the buyer can still call off the deal. The reasoning for this is that it is a seller's market, with demand far outnumbering supply. In practice it is very common these days to end up in a bidding war, and even forego any kind of "sale is void if home inspection turns up issues" clause. Want to think about it for a day or two before signing the biggest contract of your life? Too bad, another buyer is willing to sign today. With the mandatory three-day waiting period you avoid buyers being locked into a contract they basically immediately regret. It gives them some time to do due diligence, reducing the risk of buying a complete lemon. The seller can ask for a similar clause to be inserted, but it is less common. After all, the only risk to the seller is getting slightly less money for it, and that's already mostly dealt with during the bidding process.
goodrubyist 3mo ago
[flagged]
- TheScaryOne 3mo ago
  >If someone does not read a contract or a legal agreement, before accepting or signing, it's on them When was the last time you read an entire EULA before installing software? I'm going to guess the time frame is somewhere around "never." These are nuisance contracts designed to jade people with legalese while stealing their rights to things like class action and enforcing binding arbitration. Standard contracts sounds like the way to go.
  - goodrubyist 3mo ago
    I skim or read all the time, and so should people -- but ultimately they're adults and if they want to agree to them without reading, it's their choice (they shouldn't expect to later say they didn't read - this doesn't work, and that's how the current American legal cases were decided as well, thankfully, see e.g. regarding arbitration). Btw, regarding class action and arbitration, many of us already know that these are present in bold in the terms of many services we use or are going to use without even actually reading them.
arjie 3mo ago
Good grief no. Using websites in the UK and the EU is an exercise in pain. Every single one of them has the doorway effect where you follow a link to them and you’re faced with some Subway sandwich grade range of choices to be made and you’ve forgotten why you were there in the first place. As it stands I just hit Accept on literally everything and that’s fine for me.
- j1elo 3mo ago
  You could use Consent-O-Matic https://addons.mozilla.org/en-US/firefox/addon/consent-o-matic/ https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat... It already pushes the correct "Reject" button for you on a lot of sites (not all; it works based on rule lists)
  - arjie 3mo ago
    I used this for a bit and then some sites would just not work. I get it. It’s a hard thing to do and I admire it but getting blank result is far more frustrating than clicking accept each time.
- bbg2401 3mo ago
  How cookie consent has been deployed by the data sponges is my go-to demonstration of malicious compliance.
deleted 3mo ago
[deleted]
Ferret7446 3mo ago
The solution for the problem caused by regulation is more regulation. Sure, we didn't anticipate the negative consequences the first dozen times, but this time there will absolutely not be any unanticipated consequences.
- LadyCailin 3mo ago
  So, what, have no regulations whatsoever then? What an absurd suggestion. It’s a cat and mouse game, sure, but that’s like saying “there was a security hole in the software, might as well give up on trying to secure it.”

deleted 3mo ago

[deleted]

otterley 3mo ago

> From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them out of the way There’s no way this would fly. “I didn’t read it” can’t possibly be an excuse to avoid being bound by an agreement. Every party to an agreement that flaunted its terms, even though they took advantage of the benefits granted by it, would invoke it as a defense, and it’s irrefutable. The system would completely fall apart if this happened. There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing.

deaton 3mo ago
But "its specifically engineered to ensure that nobody reads it" is a real argument
- otterley 3mo ago
  Where has this ever been adjudicated?
bluGill 3mo ago
Of you need a nonstandard contract then you need to provide proof that it was understood. These are not provided in a context where I would expect anyone reading it to have a lawyer to advise so they obviously don't understand it
- otterley 3mo ago
  By that same logic, do you believe ignorance of the law is a valid defense to a criminal charge? Laws are also written by lawyers.
  - bluGill 3mo ago
    No, but I do believe that if the jury doesn't find it was obviously a crime without any being told the law then it wasn't a crime. That is the text of the law isn't important until guilty is decided. (So the jury can decide degree if that is a question for the jury, otherwise the judge needs to know for sentencing but the jury doesn't care)
Avicebron 3mo ago
> There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing. The value is derived from the people consuming the product. Placing the "incentive to produce value" above the people who presumably are the source of this value seems...misaligned.

ymolodtsov 3mo ago

Websites need cookies. I don't get why I have to suffer through this for a few puritans who literally lose nothing in the process of this transaction but act as if Stasi is watching them.

estebarb 3mo ago
Session cookies do not require a banner.
- tempestn 3mo ago
  Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.
  - tappio 3mo ago
    There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.
    - tempestn 3mo ago
      My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.
      - jason_oster 3mo ago
        It depends on what is to be analyzed. How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
        3mo ago

basch 3mo ago

Cookie control always should have been a browser control. The legal route always should have been to force it to be built into browsers that provide sane defaults, and make it illegal to circumvent what the browser declares as far as fingerprinting etc. any sort of elevation prompt, IF I allow them to be popups or an icon in a toolbar, should always be in the same place and not cover the page.

MassiveQuasar 3mo ago
Just enforce the GPC header... https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-GPC https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
- quantumwannabe 3mo ago
  Or the "Do Not Track" header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
nickff 3mo ago
If people really cared, they’d choose browsers that have better control, but that’s obviously not a priority for them. Why do you think this sort of thing should be regulated to suit your preferences when most people don’t seem to agree with you?
- ablob 3mo ago
  I think that's a stretch. People can care, but be unwilling to spend the time researching it or accept the trade offs that come with small browsers (which are often unsupported for applications you might want to use). There are many things someone might care about and at some point you have to prioritize. This topic in particular is practically a cold war where you always have to catch up on how things are, lest you loose it all. The required effort is disproportionate to the result. P.S.: No true Scotsman spotted
- ClumsyPilot 3mo ago

kleiba2 3mo ago

> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data mining, profiling, and other privacy-related aspects. But in many cases, you could just click "reject" and the banner would also disappear... To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.

readread 3mo ago
"Accept all" always makes it go away immediately. Some variant on "reject" takes more effort like 70% of the time. Which is on purpose, of course. The ones that aren't maliciously-complying have a "necessary only" button that insta-closes it, but tons pretend that you might want to allow some spying but not all of it and make you go through another screen if you don't just "accept all". > To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning. Then it'd be possible to default it to "nope" (Firefox, and perhaps Safari, might do this) or to allow a "never, anywhere" setting the first time the question is asked, and malware and spyware vendors know that'd mean a much larger proportion of denials.
- jackson1442 3mo ago
  "necessary only" also tends to have a malicious compliance aspect where they don't store a cookie recording your preference and show the banner on every single page until you click accept.
  - remus 3mo ago
    Perhaps I am overly optimistic in thinking this is just incompetence.
    - 3mo ago

ethin 3mo ago

IMO any contract, waver, etc., shouldn't be legally enforceable unless the signatory has actually read it. It's always seemed to me to be one hell of a pathway of abuse (in a way) to just be able to bind someone to be legally required to do anything you want, for example, by just relying on them not reading the thing they signed.

dotancohen 3mo ago
How to know if they actually read it? The signature implies that the contract has been read, understood, and accepted. I see no need for any alternative mechanism.
- inigyou 3mo ago
  Well for instance if the other party is pressuring you to sign it then it can't be assumed that you had adequate time to read it and understand it
  - dotancohen 3mo ago
    Contract law of every civilised land already has a process for considering and accounting for duress.
    - inigyou 3mo ago
      It only accounts for "sign this or I'll kill you" not for "you have ten seconds to make a decision or the dream vacation goes to the next person"
      - crote 3mo ago
        Some countries already have provisions for this. For example, in The Netherlands there is a legally mandated three-day period after signing the contract for purchasing a home during which the buyer can still call off the deal. The reasoning for this is that it is a seller's market, with demand far outnumbering supply. In practice it is very common these days to end up in a bidding war, and even forego any kind of "sale is void if home inspection turns up issues" clause. Want to think about it for a day or two before signing the biggest contract of your life? Too bad, another buyer is willing to sign today. With the mandatory three-day waiting period you avoid buyers being locked into a contract they basically immediately regret. It gives them some time to do due diligence, reducing the risk of buying a complete lemon. The seller can ask for a similar clause to be inserted, but it is less common. After all, the only risk to the seller is getting slightly less money for it, and that's already mostly dealt with during the bidding process.

goodrubyist 3mo ago

[flagged]

TheScaryOne 3mo ago
>If someone does not read a contract or a legal agreement, before accepting or signing, it's on them When was the last time you read an entire EULA before installing software? I'm going to guess the time frame is somewhere around "never." These are nuisance contracts designed to jade people with legalese while stealing their rights to things like class action and enforcing binding arbitration. Standard contracts sounds like the way to go.
- goodrubyist 3mo ago
  I skim or read all the time, and so should people -- but ultimately they're adults and if they want to agree to them without reading, it's their choice (they shouldn't expect to later say they didn't read - this doesn't work, and that's how the current American legal cases were decided as well, thankfully, see e.g. regarding arbitration). Btw, regarding class action and arbitration, many of us already know that these are present in bold in the terms of many services we use or are going to use without even actually reading them.

arjie 3mo ago

Good grief no. Using websites in the UK and the EU is an exercise in pain. Every single one of them has the doorway effect where you follow a link to them and you’re faced with some Subway sandwich grade range of choices to be made and you’ve forgotten why you were there in the first place. As it stands I just hit Accept on literally everything and that’s fine for me.

j1elo 3mo ago
You could use Consent-O-Matic https://addons.mozilla.org/en-US/firefox/addon/consent-o-matic/ https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat... It already pushes the correct "Reject" button for you on a lot of sites (not all; it works based on rule lists)
- arjie 3mo ago
  I used this for a bit and then some sites would just not work. I get it. It’s a hard thing to do and I admire it but getting blank result is far more frustrating than clicking accept each time.
bbg2401 3mo ago
How cookie consent has been deployed by the data sponges is my go-to demonstration of malicious compliance.

deleted 3mo ago

[deleted]

Ferret7446 3mo ago

The solution for the problem caused by regulation is more regulation. Sure, we didn't anticipate the negative consequences the first dozen times, but this time there will absolutely not be any unanticipated consequences.

LadyCailin 3mo ago
So, what, have no regulations whatsoever then? What an absurd suggestion. It’s a cat and mouse game, sure, but that’s like saying “there was a security hole in the software, might as well give up on trying to secure it.”