5 ms·

The idea behind this proposal was a noble one: companies should ask permission before invading the privacy of consumers. Unfortunately, companies collectively

by jvdh 11y ago

The idea behind this proposal was a noble one: companies should ask permission before invading the privacy of consumers. Unfortunately, companies collectively decided that their businessmodel does not need changing at all, and simply implemented a "cookie wall" for all their consumers. This led to consumers, like you, to quickly get "cookie wall fatigue" and try to click 'OK' as soon as possible, without thinking at all. And all the while, we complain that privacy on the Internet is going to hell, and there is nothing we can do about it, because consumers don't care enough, or have given up...

Vespasian 11y ago
The sad thing is that this development was perfectly foreseeable.
blfr 11y ago
Pretty much every political failure can be described as a noble idea with a dumb outcome. And this one was obviously predictable.
- LoSboccacc 11y ago
  what bothers me is that most websites just show the warning but sends you the cookie anyway while they are mandated to wait till you agree to do that, and basically there is no enforcement so even if I were upset about a site tracking me without consent, I cannot report it and no penalty will actually ever happen to people in violation of this law. anyway, I think this is mostly a social and educational failure and shows how much more we need to do before we actually own our own hardware instead of relying on the god will of third parties, which never actually works. moreover this should have been fixed at browser level, and it already was. anyone caring for privacy already had configured the browser for this stuff; at most people just needed more awareness on what was already available in term of privacy controlling extensions instead we got retarded regulations which explicitly exclude session, authentication and social cookies so basically does nothing about the real issue - 'oh this is not google analytics, it's google plus tracking you - wink wink' - and data mining proceeds as usual.
  - matthewmacleod 11y ago
    if I were upset about a site tracking me without consent, I cannot report it and no penalty will actually ever happen to people Why can't you report it? In the UK, head to the IPO (https://ico.org.uk/concerns/ https://ico.org.uk/concerns/), for example. Other countries have similar bodies.
    - LoSboccacc 11y ago
      in italy they just saw it fit to put a 130 eur registration tax, but I haven't seen any official enforcement body being assigned
fla 11y ago
The idea was noble, but the law was poorly done. If you want to have a Remember me checkbox (=writing a cookie with a session id), you'll have to get the user autorization. It effectively protects from nothing, it justs makes more popups in everyones life (yay!). I think we are living in an era where there is a huge knowledge and perception gap with the people making the laws (At least in Europe). Hopefully this gap will narrow in the next 10-20 years, and things will be shapen more correctly in the future.
- jvdh 11y ago
  The Netherlands has seen some refinement of the cookie law, and there are some sites, for example http://www.ns.nl http://www.ns.nl where you now have a choice in what kind of cookies you want to allow. Again, companies are trying very hard to hide this choice, but a tiny result from the study is that you do get this choice.
  - fla 11y ago
    Even more popups, choices and waste of energy if you ask me :)
- mrsirduke 11y ago
  Nobel is not the exact word I'd use. It's been unenforceable from the get go. If anything, think, just for a second, how much this law has costed the EU, and how many hours has been wasted reading/participating in the law. Of course, it could be one way of stimulating the economy, but I'd like to think it wasn't.
- Symbiote 11y ago
  > If you want to have a Remember me checkbox (=writing a cookie with a session id), you'll have to get the user autorization. [X] Remember me (uses a cookie, see _terms_) That should do, so long as the box is unticked by default.
eueueu 11y ago
It's pretty easy for the very small minority of people who don't want cookies to disable them in their browser. Also it's pretty easy for any website that wants to track you, to track you using something other than cookies.
- avian 11y ago
  > It's pretty easy for the very small minority of people who don't want cookies to disable them in their browser. No it's not. At least for Firefox, the cookie preferences feature has been neglected for years. It's hidden beyond an increasing number of clicks and has long standing bugs (for instance, my whitelist of sites I allow cookies from is wiped each time Firefox upgrades) > Also it's pretty easy for any website that wants to track you, to track you using something other than cookies. The specific law (details are slightly different in each European country) I'm familiar with concerns storing and processing identifying information. For various reasons, everybody focused exclusively on HTTP cookies, but tracking using, say, ETAGs would fall under the same requirement of notifying the users as far as I know.
  - userbinator 11y ago
    At least for Firefox, the cookie preferences feature has been neglected for years. It's hidden beyond an increasing number of clicks and has long standing bugs (for instance, my whitelist of sites I allow cookies from is wiped each time Firefox upgrades) I think the fact that they're actually making it harder with each new UI revision - and trying to make it go away in some sense - is a sign that their interests are not aligned with those of their users' desire for privacy. It's not so surprising, really, as their revenue largely comes from an ad-supported search engine, and so they would not want to be defeating ad-networks' tracking by making cookie management/blocking easier...
    - Karunamon 11y ago
      That's not a really fair assumption - I recall the stated reason for this change (and the removal of another few checkboxes, like ones that disable javascript and images globally) is that idiot users would turn it off for some reason, and then complain that sites don't work right. As much as I hate the idea of protecting people from themselves, there's some merit to this.
laumars 11y ago
I don't even think this law makes any sense from a privacy standpoint since cookies hold very small amounts of data (thus are seldom used for much aside preferences and IDs). What's more, cookies are stored locally anyway. If there was a law passed that users had to agree to being tracked (be that via tracking cookies, or any other medium), or that users had to agree to having persistent sessions (eg entries on a session table), then that might have actually made some impact. Though I'm sure even then, there's easy workarounds (eg web server logs).
- mattmanser 11y ago
  It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! However they made the law too broad and had it cover on site cookies too, which get used for the typical session information that powers features that every consumer expects these days (recently viewed, shopping baskets, etc.). So the companies got caught in the general stupidity.
  - laumars 11y ago
    > It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! I agree, but cookies aren't the only method of being tracked. So we're back to my original point that legislating against cookies specifically isn't the right way to go about addressing privacy concerns. Hense why I said they should be targeting the tracking data that is stored remotely, as that will cover a multitude of sins.
  - fixermark 11y ago
    I never really understood why this was mandated as a server-side issue. Rather than mandate every server behave nicely (an enforceability nightmare), why not mandate every client protect users' privacy with deeper cookie control? Sort of like the one time preference request option when installing something from an app store: "This site tried to set a cookie to <adtracker.site-you-are-not-on.com>; do you accept (y/n)? (more info link) --> Cookies can be used to track you across websites; some people feel this is an invasion of their privacy." You could even mandate browsers allow for whitelisting and blacklisting. For the people who care, it'd break the back of the tracking industry within one generation of browser evolution.
antocv 11y ago
> "companies should ask permission before invading the privacy of consumers" Thats not even a noble goal to pursue. Companies should be fined for invading privacy/tracking habits. Simple.

by jvdh 11y ago

Vespasian 11y ago

The sad thing is that this development was perfectly foreseeable.

blfr 11y ago

Pretty much every political failure can be described as a noble idea with a dumb outcome. And this one was obviously predictable.

LoSboccacc 11y ago
what bothers me is that most websites just show the warning but sends you the cookie anyway while they are mandated to wait till you agree to do that, and basically there is no enforcement so even if I were upset about a site tracking me without consent, I cannot report it and no penalty will actually ever happen to people in violation of this law. anyway, I think this is mostly a social and educational failure and shows how much more we need to do before we actually own our own hardware instead of relying on the god will of third parties, which never actually works. moreover this should have been fixed at browser level, and it already was. anyone caring for privacy already had configured the browser for this stuff; at most people just needed more awareness on what was already available in term of privacy controlling extensions instead we got retarded regulations which explicitly exclude session, authentication and social cookies so basically does nothing about the real issue - 'oh this is not google analytics, it's google plus tracking you - wink wink' - and data mining proceeds as usual.
- matthewmacleod 11y ago
  if I were upset about a site tracking me without consent, I cannot report it and no penalty will actually ever happen to people Why can't you report it? In the UK, head to the IPO (https://ico.org.uk/concerns/ https://ico.org.uk/concerns/), for example. Other countries have similar bodies.
  - LoSboccacc 11y ago
    in italy they just saw it fit to put a 130 eur registration tax, but I haven't seen any official enforcement body being assigned

fla 11y ago

The idea was noble, but the law was poorly done. If you want to have a Remember me checkbox (=writing a cookie with a session id), you'll have to get the user autorization. It effectively protects from nothing, it justs makes more popups in everyones life (yay!). I think we are living in an era where there is a huge knowledge and perception gap with the people making the laws (At least in Europe). Hopefully this gap will narrow in the next 10-20 years, and things will be shapen more correctly in the future.

jvdh 11y ago
The Netherlands has seen some refinement of the cookie law, and there are some sites, for example http://www.ns.nl http://www.ns.nl where you now have a choice in what kind of cookies you want to allow. Again, companies are trying very hard to hide this choice, but a tiny result from the study is that you do get this choice.
- fla 11y ago
  Even more popups, choices and waste of energy if you ask me :)
mrsirduke 11y ago
Nobel is not the exact word I'd use. It's been unenforceable from the get go. If anything, think, just for a second, how much this law has costed the EU, and how many hours has been wasted reading/participating in the law. Of course, it could be one way of stimulating the economy, but I'd like to think it wasn't.
Symbiote 11y ago
> If you want to have a Remember me checkbox (=writing a cookie with a session id), you'll have to get the user autorization. [X] Remember me (uses a cookie, see _terms_) That should do, so long as the box is unticked by default.

eueueu 11y ago

It's pretty easy for the very small minority of people who don't want cookies to disable them in their browser. Also it's pretty easy for any website that wants to track you, to track you using something other than cookies.

avian 11y ago
> It's pretty easy for the very small minority of people who don't want cookies to disable them in their browser. No it's not. At least for Firefox, the cookie preferences feature has been neglected for years. It's hidden beyond an increasing number of clicks and has long standing bugs (for instance, my whitelist of sites I allow cookies from is wiped each time Firefox upgrades) > Also it's pretty easy for any website that wants to track you, to track you using something other than cookies. The specific law (details are slightly different in each European country) I'm familiar with concerns storing and processing identifying information. For various reasons, everybody focused exclusively on HTTP cookies, but tracking using, say, ETAGs would fall under the same requirement of notifying the users as far as I know.
- userbinator 11y ago
  At least for Firefox, the cookie preferences feature has been neglected for years. It's hidden beyond an increasing number of clicks and has long standing bugs (for instance, my whitelist of sites I allow cookies from is wiped each time Firefox upgrades) I think the fact that they're actually making it harder with each new UI revision - and trying to make it go away in some sense - is a sign that their interests are not aligned with those of their users' desire for privacy. It's not so surprising, really, as their revenue largely comes from an ad-supported search engine, and so they would not want to be defeating ad-networks' tracking by making cookie management/blocking easier...
  - Karunamon 11y ago
    That's not a really fair assumption - I recall the stated reason for this change (and the removal of another few checkboxes, like ones that disable javascript and images globally) is that idiot users would turn it off for some reason, and then complain that sites don't work right. As much as I hate the idea of protecting people from themselves, there's some merit to this.

laumars 11y ago

I don't even think this law makes any sense from a privacy standpoint since cookies hold very small amounts of data (thus are seldom used for much aside preferences and IDs). What's more, cookies are stored locally anyway. If there was a law passed that users had to agree to being tracked (be that via tracking cookies, or any other medium), or that users had to agree to having persistent sessions (eg entries on a session table), then that might have actually made some impact. Though I'm sure even then, there's easy workarounds (eg web server logs).

mattmanser 11y ago
It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! However they made the law too broad and had it cover on site cookies too, which get used for the typical session information that powers features that every consumer expects these days (recently viewed, shopping baskets, etc.). So the companies got caught in the general stupidity.
- laumars 11y ago
  > It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! I agree, but cookies aren't the only method of being tracked. So we're back to my original point that legislating against cookies specifically isn't the right way to go about addressing privacy concerns. Hense why I said they should be targeting the tracking data that is stored remotely, as that will cover a multitude of sins.
- fixermark 11y ago
  I never really understood why this was mandated as a server-side issue. Rather than mandate every server behave nicely (an enforceability nightmare), why not mandate every client protect users' privacy with deeper cookie control? Sort of like the one time preference request option when installing something from an app store: "This site tried to set a cookie to <adtracker.site-you-are-not-on.com>; do you accept (y/n)? (more info link) --> Cookies can be used to track you across websites; some people feel this is an invasion of their privacy." You could even mandate browsers allow for whitelisting and blacklisting. For the people who care, it'd break the back of the tracking industry within one generation of browser evolution.

antocv 11y ago

> "companies should ask permission before invading the privacy of consumers" Thats not even a noble goal to pursue. Companies should be fined for invading privacy/tracking habits. Simple.