5 ms·

I don't even think this law makes any sense from a privacy standpoint since cookies hold very small amounts of data (thus are seldom used for much aside prefere

by laumars 11y ago

I don't even think this law makes any sense from a privacy standpoint since cookies hold very small amounts of data (thus are seldom used for much aside preferences and IDs). What's more, cookies are stored locally anyway. If there was a law passed that users had to agree to being tracked (be that via tracking cookies, or any other medium), or that users had to agree to having persistent sessions (eg entries on a session table), then that might have actually made some impact. Though I'm sure even then, there's easy workarounds (eg web server logs).

mattmanser 11y ago
It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! However they made the law too broad and had it cover on site cookies too, which get used for the typical session information that powers features that every consumer expects these days (recently viewed, shopping baskets, etc.). So the companies got caught in the general stupidity.
- laumars 11y ago
  > It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! I agree, but cookies aren't the only method of being tracked. So we're back to my original point that legislating against cookies specifically isn't the right way to go about addressing privacy concerns. Hense why I said they should be targeting the tracking data that is stored remotely, as that will cover a multitude of sins.
- fixermark 11y ago
  I never really understood why this was mandated as a server-side issue. Rather than mandate every server behave nicely (an enforceability nightmare), why not mandate every client protect users' privacy with deeper cookie control? Sort of like the one time preference request option when installing something from an app store: "This site tried to set a cookie to <adtracker.site-you-are-not-on.com>; do you accept (y/n)? (more info link) --> Cookies can be used to track you across websites; some people feel this is an invasion of their privacy." You could even mandate browsers allow for whitelisting and blacklisting. For the people who care, it'd break the back of the tracking industry within one generation of browser evolution.
  - laumars 11y ago
    Browsers already can whitelist and blacklist IPs (though you'd possibly want a extension / addon to help manage that for you). The problem is that: 1) every site writes cookies and some cookies are needed for sites to behave properly (eg it would be impossible to use online shopping without cookies). So the amount of "do you accept" messages you'd see would be insane. It would get to the point that users would just give up and accept everything (pretty much like we do now, in fact). As a fun experiment, lynx (the terminal based web browser) asks you to accept cookies by default. So try browsing around the web with that. You'd see how very quickly it becomes the most annoying thing ever! 2) what happens when your tracking cookie comes from the same domain as site which you might want cookies stored from? You either have to accept being tracked or break that site. 3) lastly, there are methods of being tracked without the use of cookies. Cookies are by far the easiest and thus most common. But it's possible to work around disabled cookies.
bwy 11y ago
You might be surprised how much data cookies can hold. Google Ads cookies (anything with __ga, etc.) are in almost every site do indeed appear to hold some tracking data. But I agree with you that this is some misguided legislation for many reasons.
- laumars 11y ago
  I know full well what data is stored in cookies, and you're still only describing IDs. The actual tracking data would be stored remotely, with the cookie used just as a "car licence plate" of sorts. On it's only it's a harmless unique identifier but the privacy issues arise when persistent data is held against that identifier. So my point was, the actual privacy issues isn't the data stored in the cookie itself, it's the data on the remote servers - and thus that's what needs to be legislated against if the EU want to address privacy issues. I do agree that ideally we don't want these cookies either, but those cookies would be useless without any data against anyway.

by laumars 11y ago

mattmanser 11y ago

It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! However they made the law too broad and had it cover on site cookies too, which get used for the typical session information that powers features that every consumer expects these days (recently viewed, shopping baskets, etc.). So the companies got caught in the general stupidity.

laumars 11y ago
> It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked! I agree, but cookies aren't the only method of being tracked. So we're back to my original point that legislating against cookies specifically isn't the right way to go about addressing privacy concerns. Hense why I said they should be targeting the tracking data that is stored remotely, as that will cover a multitude of sins.
fixermark 11y ago
I never really understood why this was mandated as a server-side issue. Rather than mandate every server behave nicely (an enforceability nightmare), why not mandate every client protect users' privacy with deeper cookie control? Sort of like the one time preference request option when installing something from an app store: "This site tried to set a cookie to <adtracker.site-you-are-not-on.com>; do you accept (y/n)? (more info link) --> Cookies can be used to track you across websites; some people feel this is an invasion of their privacy." You could even mandate browsers allow for whitelisting and blacklisting. For the people who care, it'd break the back of the tracking industry within one generation of browser evolution.
- laumars 11y ago
  Browsers already can whitelist and blacklist IPs (though you'd possibly want a extension / addon to help manage that for you). The problem is that: 1) every site writes cookies and some cookies are needed for sites to behave properly (eg it would be impossible to use online shopping without cookies). So the amount of "do you accept" messages you'd see would be insane. It would get to the point that users would just give up and accept everything (pretty much like we do now, in fact). As a fun experiment, lynx (the terminal based web browser) asks you to accept cookies by default. So try browsing around the web with that. You'd see how very quickly it becomes the most annoying thing ever! 2) what happens when your tracking cookie comes from the same domain as site which you might want cookies stored from? You either have to accept being tracked or break that site. 3) lastly, there are methods of being tracked without the use of cookies. Cookies are by far the easiest and thus most common. But it's possible to work around disabled cookies.

bwy 11y ago

You might be surprised how much data cookies can hold. Google Ads cookies (anything with __ga, etc.) are in almost every site do indeed appear to hold some tracking data. But I agree with you that this is some misguided legislation for many reasons.

laumars 11y ago
I know full well what data is stored in cookies, and you're still only describing IDs. The actual tracking data would be stored remotely, with the cookie used just as a "car licence plate" of sorts. On it's only it's a harmless unique identifier but the privacy issues arise when persistent data is held against that identifier. So my point was, the actual privacy issues isn't the data stored in the cookie itself, it's the data on the remote servers - and thus that's what needs to be legislated against if the EU want to address privacy issues. I do agree that ideally we don't want these cookies either, but those cookies would be useless without any data against anyway.