Cookie policy notifications have ruined user experience on the web

https://www.reddit.com/r/web_design/comments/93o0eg/cookie_policy_notifications_have_ruined_user/

by _davebennett • 8 years ago

85 84 8 years ago

reddit.com

SteveNuts• 8 years ago

Do these notifications actually help with GDPR compliance or are they just a CYA for the websites?

gruez3• 8 years ago

they were around before GDPR:

http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

Cthulhu_• 8 years ago

Definitely cover your ass, given how the fines are instant bankruptcy for a lot of companies.

I'm inclined to believe this + the cookie banners are also a lot of "well site X did it like that, we probably should do that as well" instead of reading and understanding the actual rules.

The easy way out would of course be to not violate the GDPR, but with 3rd party advertisers that's a bit painful.

I still don't know why big publishers don't just own the ads themselves, that is, have an ad department, have them approve ads and return statistics to the advertisers, have tracking all on the same domain, etc.

Rjevski• 8 years ago

GDPR compliance requires opt-out, so cookie notifications are useless as far as compliance now. If you don't/can't comply, then you might as well not mention cookies at all - in both cases you're in breach of GDPR but at least you won't be ruining your UX.

PeterisP4• 8 years ago

GDPR compliance can not be done by opt-out, if consent is required, it requires opt-in - recital 32 (https://gdpr-info.eu/recitals/no-32/) "Consent should be given by a clear affirmative act [...]", "Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

No matter what your notifications and T&C says, the default UX path where the user clicks "meh, whatever, go on" until the popup disappears won't give the site any legal consent to use data because informed, specific, freely given opt-in consent didn't happen.

xg153• 8 years ago

Given that (from my IANAL understanding) the GDPR requires opt-in and forbids "click I accept or leave our service" style forced opt-in, I'd say this is not even CYA - it's closer to magical cargo cult incantations.

etatoby• 8 years ago

the GDPR requires opt-in and forbids "click I accept or leave our service"

That's an asinine law if I ever saw one. Telling me how I should run my business? Really? From what vantage point, if I may ask?

If I had a company, I would ignore the whole thing and invite them to cross the pond and try their crap in my jurisdiction, under my laws. Or just block them altogether. If they want to go back to the middle ages, let them.

PeterisP4• 8 years ago

IMHO not really, GDPR isn't really about (and thus can't be satisfied by) notifications and click-OK-to-continue "consent".

For the common use cases of data by random websites, there really are two common scenarios GDPR-wise:

1) Whatever you're (not) doing with the user data falls under one of the multiple GDPR valid reasons for use that do not require user consent: in this case a clear and informative description in an easily accessible privacy policy is sufficient, and the notification/"agreement" isn't needed for GDPR compliance, the popup is useless.

2) Whatever you want to do with user data requires user consent, but you're not going to get GDPR-valid (informed, specific, freely given and opt-in) consent. There are specific sites that can get meaningful consent because users really want it (e.g. genealogy sites come to mind), but for the random "we want to track you for advertising purposes and share it with 200 third parties", it's not realistic. And the popups don't (can't) help you with that. A popup that allows you to opt out... well, if it's not opt-in, the consent isn't valid in the first place; if the user goes "meh, whatever", then that doesn't count as opt-in consent. If the user is required to "agree" to continue, then that doesn't count as freely given consent. If the user isn't clearly told everything before they intentionally opt-in to every single use case because they want you to do that particular thing, then that doesn't count as specific, informed consent. If you do implement all these things properly, then most users aren't going to opt-in in the "ad-tracking" scenario (which is the GDPR intended result), so companies don't want to implement it properly.

So the nasty popup doesn't really grant you consent anyway (the process is inevitably missing at least one of these key criteria for valid consent), so GDPR-wise it's useless anyway.

jasonkostempski4• 8 years ago

HA, this made it to the front page right as I was composing this Ask HN submission about picking a de facto standard element CSS class so that ad blockers could just start including a simple rule to get rid of them: https://news.ycombinator.com/item?id=17679932

NSAID• 8 years ago

It'd be even better if my user agent could simply indicate my acceptance (or lack thereof) for me

kylel• 8 years ago

This is what Do Not Track was supposed to be. Unfortunately it never got much momentum. Google, Facebook, Twitter, etc. ignore the DNT header.

y0ghur7_xxx• 8 years ago

There is an adblock filter list for cookie warnings: https://github.com/r4vi/block-the-eu-cookie-shit-list

jasonkostempski4• 8 years ago

I figured, but maintaining that is such a waste of human life and parsing the list is a waste of my CPU time. Since no one on either side of the fence wants the notices to exist, web developers could just use a de facto standard element class and ad blockers can add a simple rule.

rasz• 8 years ago

works for most:

    javascript:(function()%7Bvoid([].forEach.call(document.querySelectorAll('body *'),e=>/fixed|sticky/.test(getComputedStyle(e).position)&&e.parentNode.removeChild(e)))%3Bdocument.body.style.overflow%3D'auto'%3Bdocument.body.style.height%3D'auto'%7D)()

modzu• 8 years ago

then there's reddit and its giant full page ad for the app before finally redirecting me to the content once i find the tiny link to continue instead of opening the app store...

yes reddit and fb and gmail and the like are intentionally crippled when viewed on mobile. why? maybe because the data an app can suck up off your phone is much more valuable. no pesky same-origin policies!

i digress :(

imron• 8 years ago

Don't worry about trying to click the 'continue' link, just keep scrolling down and it disappears.

It's still annoying, but not as annoying as trying to click the tiny link.

Bartweiss5• 8 years ago

I noticed that reddit now has three separate "use our app" prompts, which don't seem to communicate so they can all appear on the same page. There's the loading-in system popup, the bottom-of-screen one, and the internal popup with a picture and two choices.

And then the bottom-bar one, instead of having two buttons, makes the entire field open the app store except for a tiny 'x' in the top right. Talk about unsubtle dark patterns.

mercer• 8 years ago

The reddit redesign feels a lot like the Digg changes before everyone moved away. I think reddit still has a lot more going for it, and being able to opt out solves the problem, but I'm still every so slightly worried.

Confiks• 8 years ago

I gave up on the redesign and am now using a browser extension[1][2] that always redirects to the old design.

[1] https://addons.mozilla.org/en-US/firefox/addon/old-reddit-re...

[2] https://chrome.google.com/webstore/detail/old-reddit-redirec...

cpeterso• 8 years ago

I've read lots of articles from companies like Pinterest and Flipkart about how lightweight PWAs increased user engagement by some huge amount, like 200%. So why are other companies like Reddit spoiling their mobile web experience by pushing their apps so hard?

anthony_franco• 8 years ago

Use this link on mobile. It’s way better: https://i.reddit.com/

zelon88• 8 years ago

Oh man! And you think anyone is bad when it comes to intrusive cookies just look at the crap Reddit keeps on you!

Shank3• 8 years ago

I'm a really big fan of geotargeting these notices only to the EU. If the EU wants cookie notices, give the EU cookie notices. Don't give anyone else cookie notices, because they're garish and few people reasonably care.

stingraycharles• 8 years ago

But what if your geotargeting doesn’t work as expected, and has a few false negatives? Will that hold up in court?

Shank3• 8 years ago

Policy is all about how it gets enforced and acted on. An imperfect cookie targeting scheme could probably fall down in court, but there isn't much caselaw about the cookie law right now. I can't recall any major cases where website operators were taken to court over it.

littlestymaar2• 8 years ago

You can't do geotargetting here, because to perform geotargetting you need the user consent to use his location (which is a personal data ;) ) if he is european.

Shank3• 8 years ago

Is IP geolocation included in that? I'm genuinely curious, actually. That's how most websites do content filtering (even BBC iPlayer uses server side geolocation to filter people out).

fasteddie• 8 years ago

This isn't true.

You can use cookies for necessary operations of the website, which this almost certainly is. Also, country level location data isn't PII, and also doing a geoip lookup that you don't store anywhere also isn't in violation.

Bizarro• 8 years ago

If you don't have operations in the EU then you don't have to worry about that nonsense to begin with.

dominotw2• 8 years ago

Is this different from GDPR in the sense that EU citizen can be accessing your website from other parts of the world?

pupppet2• 8 years ago

They’re terrible. Who are we kidding, no one has backed out of the website after seeing one of these notices.

craigsmansion• 8 years ago

Of course people have.

They don't state it clearly, but every cookie means: "By accepting this cookie you agree to be tracked on the Internet, and allow that data to be sold."

(or, "We don't really understand cookie-law, and we didn't actually need to put this up".)

Once you know that, it's easier to ask yourself: "Do I really need to read this? Also given that it's likely a sub-par publication, because tracking usually implies layouts and techniques optimised to keep you on the site and optimise data collection."

mrec• 8 years ago

I back out of them all time.

Particularly the egregious dark-pattern ones: "Click this giant green button to let us track you out the wazoo, or click this tiny misleadingly-named link to drag you through a six-hour hell of settings dialogs which will drop you out without actually changing anything the instant it thinks it can get away with it."

dominotw2• 8 years ago

do you know if an example website that does this.

pupppet2• 8 years ago

The vast majority of people are not backing out. They're instinctively clicking that button to get it out of the way, it's the new banner blindness.

gruez3• 8 years ago

We wouldn't be having this discussion if cookies were opt-in rather than opt-out. I don't sign into 90% of websites I visit, but why are all of them allowed to track me? If cookies were opt-in, then the legal issue of "consent" would be cleanly resolved, and the interface can be handled by the user agent rather than through obtrusive modals.

SyneRyder• 8 years ago

You can already do this. In Firefox:

* Go to your Cookies And Site Data preferences

* Select "Block Cookies And Site Data"

* Click on "Exceptions"

* Add the address of the website you opt-into

* Click "Allow For Session" or "Allow" as you choose.

sib• 8 years ago

You visited them and you didn't turn off your browser's cookie requests; therefore you decided to accept the files that the site offer to your browser.

ballenf• 8 years ago

You make a fair point -- it's popular to take the same tack with web servers and ad blocking (a server makes content publicly available -- users can decide which parts to view). Not a stretch to apply the same logic both ways -- just because a server offers a file to you, doesn't mean you are forced to store and give the file back on demand.

If this view were more widely adopted, it would maybe pressure browser vendors into being more transparent with users on cookie management and proactively ask them how they want to handle them.

krapp• 8 years ago

The problem is, the purpose of cookies isn't tracking, they're a hack to maintain state between requests for what's supposed to be a stateless protocol (and until HTML5 came along with session storage and local storage, they were the only way to do that in the browser.) So cookies are useful (and often used) for purposes besides tracking and advertising.

Having cookies be opt-in by default would just punish anyone using cookies for benign purposes.

Bartweiss5• 8 years ago

I'd be interested to know what percentage of sites would actually lose functionality.

At a crude estimate, >90% of the sites that show me cookie warnings do everything I actually want them to statelessly. And I have some backup for that, because when I block cookies by default very few sites actually seem to get worse.

Are there clever user-aiding tricks with cookies that I don't realize I'm losing? Or is the average site with cookies purely for tracking and advertising?

(This is all a separate question from "should cookies be blocked by default"; I know a few uses really do suffer badly.)

rkeene2• 8 years ago

Cookies were never the only way to do this. Before cookies became popular having the ability to create a session was still possible. The primary method of doing this was similar to cookies, have a sessionId parameter to your query. There were also passive ways of profiling a user's client to isolate it based on what it looked like (IP, User Agent, user agent Accept and Accept Charset, etc see [0]).

[0] http://www.rkeene.org/viewer/tmp/wwwftp_cgi.c.htm#line182

iKevinShah3• 8 years ago

As a workaround, we can disable them on the whole and enable on per site basis (the 10% of websites you sign into). Its a hassle but yeah ...

gruez3• 8 years ago

that's sort of what I do with cookie auto-delete, which keeps cookies until you close the tab. otherwise some sites dont play nice when you disable cookies entirely.

closeparen2• 8 years ago

Cookies rely on the cooperation of the user-agent. From the website's perspective, they are opt-in.

z_open• 8 years ago

Cookies are opt-in. Install umatrix and be done with it.

littlestymaar2• 8 years ago

How ironic, websites have been breaking user experience for years by embedding always more trackers that took forever to load.

If a publisher doesn't want to display a GDPR notification to its users there's a simple trick : just don't collect and monetize personal informations!

thrill• 8 years ago

Notifications should be for exceptions that require action.

cookiePuss• 8 years ago

Action, like "close your browser and clear your cookies, disable cookies, and then block further cookie dropping from that site as well"?

Exceptions like when you're being ratted out, to many other companies that perform surveillance on you, by a company you have no particular affection for?

iKevinShah3• 8 years ago

Even if we use cookies for basic sessions (absolutely no personal tracking, just session ID) - Isn't it mandatory to show "Cookie bar" on the said site?

pjc50• 8 years ago

No.

http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

(Perhaps surprisingly there is an exemption for "third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.")

Retric2• 8 years ago

Generally no. It's when cookies can identify an individual that it's considered personal data.

aaronarduino• 8 years ago

Here is an idea: instead of a cookie policy notification, have a setting in the browser with the user's cookie setting. That way a website can look at that setting and store cookies or not.

detaro• 8 years ago

You can already have your website check for the Do Not Track header, don't set non-essential cookies and don't show a notice when it's set. Basically no website does that.

andrethegiant• 8 years ago

What happens if you use cookies and don't show any banner?

Does this also apply to localStorage and other offline storage methods?

aarongray• 8 years ago

It would be cool if we could develop a protocol where users could flip a setting on their browser that tells every website they visit that the user has consciously, legally opted-in to all cookies. Heck, it would be cool to also have an option that says I accept all your Privacy Policies and Terms of Agreement, so don't show me any banners related to those either.

joobus• 8 years ago

a setting on their browser that tells every website they visit that the user has consciously, legally opted-in to all cookies

IMO, you do this when you open the browser. Why does every website need to explain how the internet works?

PeterisP4• 8 years ago

Many websites legally need opt-in permission to put (and use) a tracking cookie, so unless the user intentionally chooses to do opt in, they're not legally permitted to do so even if the internet technologies enable them to make it happen.

There are many things that are technically easily possible, but prohibited unless certain nontechnical conditions are met. Tracking cookies is one of them.

Opening a browser doesn't constitute freely opting in to your specific use of data; at most it constitutes not opting out, but that's not legally sufficient.

weinzierl2• 8 years ago

Are Cookie policy notifications a thing outside of the EU? I always assumed that websites geo target these notifications and life with the small risk of corner cases (like EU customer in the US). If anyone has experience, or numbers I’d find that highly interesting.

One datapoint from Germany: We were largely unaffected by cookie notifications before GDPR, because of a local law (TMG) that superseded the EU “cookie law”.

Since GDPR we are in the curious situation that every small and medium sized business plasters it’s website with extravagant opt-in notification pop-ups while the worst privacy offenders, like the nations largest newspapers, bombard you with all kinds of cookies with no notification at all.

Just one example I tried a few moments ago:

spiegel.de one of the most widely read German-language news sites set 54 cookies from lots of different domains plus local storage usage. No cookie notification whatsoever.

Another example: bundesregierung.de, the official government website, states in it’s privacy policy that they set a web analytics cookie (Matomo) but they don’t show a notification either.

JeanMarcS• 8 years ago

The « funniest » part is that Spiegel probably made several news article about GDPR. In France it’s the same.

Sad thing for them, they won’t be able to pretend they didn’t knew (which will be a good lesson taught)

weinzierl2• 8 years ago

Heise is even worse. They covered GDPR extensively, yet don't do any notifications on their own websites.

mobilehnuser• 8 years ago

Not just cookie policy notifs but all bottom or top aligned overlays present on page load... like the one on this reddit page begging me to install a mobile app so they can get my advertising id

jokoon• 8 years ago

I can't count how many times i right clicked to hide element thanks to u block origin

Bromskloss• 8 years ago

I wish we could converge on a way to tag such notifications, so that those who want to can filter them out.

Cookie policy notifications have ruined user experience on the web

Related Stories