Ask HN: GDPR pop-ups are getting so annying, what should we do about it?

https://news.ycombinator.com/item?id=30438663

by smoqadam • 4 years ago

17 49 4 years ago

news.ycombinator.com

Lately, I close every website that shows me a big, junky, stupid GPDR cookie consent (e.g. https://www.runnersworld.com/), but honestly I don't find many websites that has a reasonably small and well-designed cookie consent (e.g. https://www.rei.com/).

It seems that these pop-ups are designed to annoy users to force them to click on the Accept button right away, and most of them hide the rejection button somewhere, or make it difficult to find.

The reader mode on the browser works well sometimes, but it's not a permanent way to get rid of those pop-ups.

These pop-ups are making it hard to enjoy the Internet, what do you suggest to do to get rid of these pop-ups?

Thank you.

mytailorisrich3• 4 years ago

The GDPR mandate explicit consent and websites really want your consent because they rely on those cookies. So we end up with those dark patterns pop-ups because of the usual law of incentives and self-interest.

As a consequence, IMHO the only way to get rid of those pop-ups is to change the GDPR to mandate a simpler format. But that's not straightforward when there are potentially cookies for different functions and each requires specific consent... We're touching a fundamental issue with wanting to regulate the way the GDPR do...

baash054• 4 years ago

A few weeks back someone lost a case in Germany because they used google fonts, and forgot to tell people. After that, I say, why take the risk? I have more important things to think about.

systemvoltage4• 4 years ago

Is this an indictment and is it fair to say GDPR is a poorly implemented regulation? I am a pro-privacy advocate but like those cancer warning labels in California, I always accept cookies and move on. Billions of people spend a few seconds everyday clicking on these cookie banners. What would be the economic damage vs. privacy benefits? I appreciate what companies like Apple does with regards to privacy because it actually makes my life easier, not more difficult.

Another problem is the imprecise language of GDPR. "It's mostly not enforced for small businesses" doesn't cut it when it comes to adherence to law. Businesses need assurance, not ambiguity.

himinlomax• 4 years ago

GDPR does not mandate those pop-ups, most of them are not compliant and only exist as a way to try pretend to comply with the law.

d132• 4 years ago

It’s only required if you’re doing non-anonymized tracking, which websites don’t have to do at all and is completely unethical.

baash054• 4 years ago

I just put an ip-address to country list in my middleware and block all the GDPR countries. Now I have no issue with popups or cookies.

Honestly, I'd like to see more people follow that. I got the idea from others and it seems like a perfect solution.

People who can't/don't want cookies cannot really use any site I've ever worked on. It makes no sense building things for people who won't ever be customers.

moribunda• 4 years ago

You can use cookies with GDPR. Are you aware of split into 4 cookie categories? Is it surprising that people want some privacy and you can actually disagree to tracking?

Of course, people should be able to disable tracking more like: i don't want to be tracked by alphabet and Facebook, rather than turning it off for every website separately.

krageon• 4 years ago

It must be really odious for you to respect the people that use your website. Thank you for removing yourself.

baash054• 4 years ago

Here's the thing. The GDPR isn't really that great a set of rules. It's too vague, and really hard to manage.

I do however treasure privacy rights. That's why I don't use cloud flare. It blocks TOR, and many VPN's.

I've almost built my site to favour those methods of privacy, and I highly recommend them to people

I have paid the price of being on TOR often enough. Heaps of sights are beyond my reach.

People have the right to avoid cookies, but those rights come at a cost.

Oddly most of my users are from the EU, they just use VPN's

detaro4• 4 years ago

You do understand that the requirement isn't "site needs to work without any cookies"?

onion2k2• 4 years ago

These pop-ups are making it hard to enjoy the Internet, what do you suggest to do to get rid of these pop-ups?

Embrace them. Learn to love them. They're a good feature. Making websites explicitly require permission to do (subjectively) negative things like tracking users is a massively positive step in the right direction towards us all having ownership and agency over of our lives as we spend time online. Sure, it means we have to do a little work to say yes or no when a site wants to do something, but that's the cost of privacy. It's not very high.

There could be technical solutions (eg browsers could sent a header to automatically consent with the initial request) or you could use a plugin (eg consent-o-matic), but really, this stuff is important enough that "Eurgh! I had to click a button again! I'd sacrifice my privacy not to have to do that any more!" is a really bad take in my opinion.

cinntaile2• 4 years ago

"Eurgh! I had to click a button again! I'd sacrifice my privacy not to have to do that any more!" is a really bad take in my opinion.

I assume you don't surf in incognito mode. The collective amount of hours wasted clicking those popups must be enormous.

onion2k2• 4 years ago

The collective amount of hours wasted clicking those popups must be enormous.

You can't add them up and use that time though. That time is always going to be fragmented in to unusable bits. Millions of people wasting 2s each is not equivalent to thousands of hours of lost productivity. Likewise, one person wasting 2s many of times a year can't be replaced with a useful hour.

The 'lost time' argument doesn't make sense.

Aerroon3• 4 years ago

Making websites explicitly require permission to do (subjectively)

But that's already happening. Your browser just sends the data automatically. Putting this burden on the website just means that an actual nefarious actor will track you anyway. After all, how are you going to check that they actually don't save all that data your browser vomits at them?

If you want privacy then you have to make sure your browser doesn't send out that information in the first place. Once you've done that then GDPR is useful for plugging the holes for the non-bad actors.

drakonka• 4 years ago

I think what we can do about it is exactly what you've been doing: close the sites that purposefully make them obnoxious. The GDPR does not require these consent prompts to be this horrible. Websites make them that way to annoy users into getting mad at the privacy legislation _and_ also just click "Allow" by default to get to the content. Any website that uses such tactics is not a website I'm interested in using.

ssss113• 4 years ago

Bingo. Well said

bwb• 4 years ago

I use a chrome extension to auto accept everything. They are incredibly annoying. I wish i could do that on my phone.

I do not know any non techy who gives them more than 1 second of thought. They annoy everyone without doing anything good. My hope is the EU passes real privacy regulation at the company level. This cookie popup accomplishes nothing beyond annoying everyone.

d132• 4 years ago

They’re not necessary unless you’re doing non-annoymised tracking, like, for example, using the Devil’s Spawn that is Facebook Pixel. If websites are doing this, and asking you to consent they need to be punished - hit the back button and boycott them forever. It’s completely unnecessary - the web would be a so much better place is we all did this.

systemvoltage4• 4 years ago

How are you going to boycott the entire internet? Most websites I visit show this pop up and it’s more convenient to just click ok than to move to 5 different screens and waste another 30 seconds. This is what happens when you don’t address every aspect of side effects when making the law.

People get accustomed to it just like those California cancer warning labels that are basically useless and nothing but a waste.

detaro4• 4 years ago

Most websites I visit show this pop up and it’s more convenient to just click ok than to move to 5 different screens and waste another 30 seconds

So they don't comply with the law. People working for these sites choose to make this difficult and harder than its supposed to be.

kappuchino• 4 years ago

In an - at least in theory - open system some if not all players over time will maximise their gain from it. So advertisers wants your data, because the more they have, the more they can earn from specialised trageting. (This is why I believe Facebook is an advertising platform, not a social network, but I digress). So at some point you can only access information when logged in and (lets say for the sake of making a point) give your name, dob and much more. (Sounds familiar, like a paywall?). The GDPR makes it inconvenient to have and track all that data if not outright illegal for some cases. And asking for confirmation to use cookies to track a user is the neccessary evil to highlight that you are tracked. I understand the annoyance it creates for you and other users. Its still necessary.

And, if I may add that, its some kind of a new understanding I got for other systems as well. Releated example: There will - over time - no better google "competitor". Know why? Because if there is, at some point, then SEO will optimize the f** out of that competitor, too and make it maximally worse for everyone. Just like the optimization in the example above with the data. Except that the GDPR is a law for EU Citicens while google/the competitor only has to make it tolarable for them and their ad renvenue.

I find that perspective incredibly frustrating: Systems will get worse to a point of equilibrium, but its not the kind of "nice to work with" you and I have in mind. (Edit: Spelling)

OhNoNotAgain_99• 4 years ago

advertisement as webcontent is the modern spam. I wouldn't be surpriced if this is now the majority of all internet traffic. It used to be that spam was email related and the major internet traffic.

mgbmtl• 4 years ago

I use the uBlock Origin filters for "annoyances" on Firefox, both desktop and mobile, and I don't ever see them. The filter is not enabled by default.

jbjbjbjb• 4 years ago

Why haven’t they been implemented as a browser feature? And how comes the larger websites don’t seem to need the banners?

Xelbair2• 4 years ago

Comply with the law, don't gather unnecessary PII and poof - no need for popups.

ssss113• 4 years ago

But but but …every company needs all possible data about you because of “legitimate business interests”!

ID14523192• 4 years ago

My understanding is that you must tell people if you set cookies for any purpose, regardless of whether they are collecting personal data. Therefore, pretty much any content management solution, Wordpress site etc. will need to display a cookie consent banner.

Reubensson• 4 years ago

I think you need cookie banner only if you use non-essential cookies. For example if you use cookies only for user auth, you don't need to display any notification about that.

Aerroon3• 4 years ago

It's so 'simple' to do that even the EU's own website has the pop up:

https://www.europa.eu

Xelbair2• 4 years ago

Yes, because they do use cookies in a way that requires them to inform you about it. It's clean, readable, and devoid of dark patterns that are so prevalent.

Third-party cookies
Some of our pages display content hosted by contracted services on domains external to europa.eu, for example our contractor who helps operating the Europe Direct Contact Centre. The external hosting may need cookies in order to function.
Name of the cookie: PHPSESSIONID
Service: Europe Direct contact form
Purpose: Session info (random number), used for dealing with multi-language forms. No additional information stored
Cookie type and duration: Third-party session cookie, set by our contractor. Deleted after you quit your browser
Some of our pages display content from external providers, e.g. YouTube, Facebook and Twitter.
To view this third-party content, you first have to accept their specific terms and conditions. This includes their cookie policies, which we have no control over.
But if you do not view this content, no third-party cookies are installed on your device.

ianpurton• 4 years ago

We need Google to stop showing sites like these in their results.

The user experience is shit so don't send them any traffic.

ssss113• 4 years ago

I think they are ugly, clumsy and annoying because the companies that are forced to show them resent that and want it to fail. It feels like they’re saying to me “Look at this horrible thing I’m forced to present to you, I’m not letting you read what you’re here for until you go through the most annoying way of responding”

It should be a browser feature but chrome has dominant market share and why would they do anything in the interests of their users’ data security (which of course jeopardises their adtech empire).

We need a better browser…. Don’t say Firefox. Brave could be it I suppose.

ale42• 4 years ago

We need a better browser…. Don’t say Firefox. Brave could be it I suppose.

Brave is just based on Chromium... it might have lots of different features, but still Chromium it is under the hood.

CodeGlitch• 4 years ago

That's just for rendering though isn't it? Brave are free (and do) add any features they like on top of that.

captainbland• 4 years ago

To me it seems like they're usually similar enough and have broadly similar controls that it should be something that users should be able to configure from their browsers on a blanket basis, which should be provided in some standard HTTP headers/accessible through JS.

M2Ys4U• 4 years ago

Cookie banners have nothing to do with the GDPR.

They are a requirement of the ePrivacy Directive from 2002.

trixie_• 4 years ago

GDPR is a preview into what a more regulated web would look like and it’s awful. What should we do? Fight it. Demonstrate the pointlessness of the regulation now that everyone has a taste of it. Complacency will lead to more regulation. Leading to regulators able to shut down your site for not following arcane rule 345 subsection A. You think it’s a joke, but this is how it starts.

BugWatch• 4 years ago

We all know of SponsorBlock and its user-submitted segments for the YouTube videos, right?

Well, can't we build the similar addon and the crowd-sourced database, but one that would submit specific rule (page elements, and click order) to block everything - incl. "legitimate interest" bullshitery- except the barest of essential cookies?

Ask HN: GDPR pop-ups are getting so annying, what should we do about it?

Related Stories