Stop whining about “The EU Cookie Policy” and improve your ways

https://social.wildeboer.net/@jwildeboer/110195737889831520

by rapnie • 3 years ago

155 266 3 years ago

social.wildeboer.net

The vast majority of people DO NOT care about cookies nor do they care about trackers.

However, there is a very real productivity loss with all the cookie prompts - both trying to implement them, getting around them, and the billions of people who have to click on them every single day.

We've got to come up with a better solution.

rapnie2• 3 years ago

The author states this:

To make this very clear: user/visitor consent is only needed for data going to 3rd parties. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions. So your session tracking cookie on your site DOES NOT need a consent popup AT ALL.

Most consent dialogs can be avoided, were it not that the surveillance capitalist services need your data, and shove these dialogs full of deceptive design in your face. In hopes to have as many people as possible complain about the regulations, and use that pressure to lobby them away again.

4ad3• 3 years ago

My bank doesn't use 3rd party cookies, but they have a modal wall you have to click through anyway that explains that they DO NOT use cookies.

This is insanity. Their explanation is that users are so accustomed to these cookie walls that a site without one would feel suspicious and unsafe.

I very much blame the EU on this, because the EU policy has solved NOTHING, tracking still happens just as before, except now users just have to go through more friction. Of course I am also pissed at the websites and entities that sell my data, but that is irrelevant to my gripe with the EU.

Hermel• 3 years ago

So why do even the official website of the European commission and the European parliament have a cookie consent button? One would assume that they are not "capitalist services".

luckylion4• 3 years ago

Is he right though? I work with affiliate people a lot, and they hate cookie-consent popups. Even when you do all your analytics inhouse with self-hosted matomo, if you want to use a cookie, you need consent is what the lawyers say unanimously. And these aren't "we want you to ask for consent because we secretly want more privacy" lawyers, these are "I get paid to find a way for you to do your tracking in the easiest way possible and I don't care about privacy" lawyers.

Maybe they're all wrong, but I have doubts.

nicbou• 3 years ago

That's completely false though. Tracking your users without consent is still not allowed, even if you store the data on your own servers.

shmde2• 3 years ago

Also accepting them cookies is one single click but rejecting them feels like entering the dark realm with multiple options and not knowing where to click. I am software dev but still have to use just enough mental resources to reject all of the non essential ones. How the fuck is this legal.

germanier12• 3 years ago

It's not legal. It's just not rigorously enforced.

It was promised that things get better with the proposed ePrivacy regulation. Let's see.

Anduia• 3 years ago

It is not legal for webs to make rejecting cookies more complicated than accepting them.

In fact, the French data protection authority CNIL has issued orders to around sixty players that do not make refusing cookies as easily as accepting them. They have also fined companies such as Google and Facebook for making it harder to reject cookies than to accept them. The CNIL has ordered these companies to provide a means of refusing cookies as simple as the existing means of accepting them.

Also, under GDPR, it is not legal for websites to make rejecting cookies more complicated than accepting them. In May 2020, the EU updated its GDPR guidance to clarify that cookie walls do not offer users a genuine choice because if you reject cookies you’re blocked from accessing content. It confirms that cookie walls should not be used. Companies such as Google have introduced new options to reject tracking cookies in Europe after their existing dialog boxes were found to be in violation of EU data laws.

Now what I don't know is if users outside of EU get the evil-twin version of those popups when visiting websites. My experience browsing the www is just not as bad as many people describe because I usually get a "reject all" button or when "managing" the cookies, they are all disabled by default and I can simply save the options.

submeta• 3 years ago

vast majority of people DO NOT care about cookies nor do they care about trackers

I highly doubt that. Do give people simpler ways to opt-out of all tracking, and they‘d happily chose that. Currently we have two problems: 1) The consent button is one click for cookies, the other is several clicks away. 2) The layman does not now how to choose a setting to always opt-out of tracking.

dre_bot• 3 years ago

Most don't even know what the hell a cookie is or any of the shit in those prompts.

pelorat3• 3 years ago

I mean Gen-Z barely knows what an operating system is.

illiarian18• 3 years ago

The vast majority of people DO NOT care about cookies nor do they care about trackers.

When presented with "Ask app to not track" on iOS, 96% users clicked "do not track" https://arstechnica.com/gadgets/2021/05/96-of-us-users-opt-o...

boffinism2• 3 years ago

These two statements are not incompatible.

shmde2• 3 years ago

Having a clear cut "CALL TO ACTION" dialogue option which presents one positive ( don't track me ) and one negative ( track me ) option. People choose the positive one.

Cookies/tracking banners on website completely obfuscates the choice. Negative option ( track me ) is presented as the pearly gates to heaven and easy to click. Positive option ( don't track me ) is presented as these mathematical puzzle where you must know what to click or your dog gets executed.

So yeah people care about not being tracked when presented with clear instructions to which one is bad and which one is good.

ssss112• 3 years ago

That “most users don’t care” line is tossed around by people all over the place and you righty point out that it isn’t true.

If my job relied on people giving up their data privacy I would probably continue telling everyone that line as well.

no_time• 3 years ago

We've got to come up with a better solution.

I've got an easy one for you: stop embedding google analytics and others. You don't need a cookie banner when you only have operational ones or better yet, none at all.

oneeyedpigeon5• 3 years ago

Are you sure that out-of-the-box GA requires it? I thought the only info it recorded was anonymised.

clnq3• 3 years ago

You can have GDPR-compliant analytics, like what Fathom does.

I also built my own analytics solution that simply shows me my blog article reads per day, week, month, and year (that is all I care about). It's a simple bit of JS that sends a request to my endpoint when the user spends 30 seconds on a page with an article. I also do some light user agent filtering (no "curl" or "python" in the agent string, for example).

I might start logging the referrer in the future to see where my traffic is coming from. However, I am very far from needing cookies or a GDPR notice. I doubt there's a need for cookies at all for most analytics. Even if you wish to track user flow in your website, you can do it with IPs (or hashed IPs to not store the actual IPs) only. An IP is unlikely to change while a user is browsing the website.

It seems to my mind that we only see so many GDPR notices because many websites use dinosaur software like Google Analytics that hasn't been keeping up with the times.

mabedan• 3 years ago

You’re missing the point of the article. The banner is only needed if your business relies on handing over info about the user to 3rd party. And yes, it’s reasonable to make sure user knows about it. The fact that these pop ups are annoying is the fault of the creator, not the regulation.

Try accessing Apple.com or iCloud.com. No cookie pop up, yet one of the most successful businesses in history. You don’t have to be annoying

qtzfz3• 3 years ago

What info? My IP address and the pages I've visited inside their site? By visiting a site I know I'm giving that info to them, they can do whatever they want with it.

wongarsu• 3 years ago

At least part of the intent of the law was that websites would reduce the amount of tracking if they have to explicitly ask for consent. You can build your website with just functional cookies (session cookie, storing preferences like dark mode, etc) and cookie-less tracking, and go without any cookie popups.

Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the most in-your-face popup possible to cause users to reflexively hit consent instead.

Nextgrid11• 3 years ago

Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the most in-your-face popup possible to cause users to reflexively hit consent instead.

GDPR actually has provisions against this kind of malicious compliance - the problem is a chronic lack of enforcement, despite it being trivial to detect with a web crawler.

datkirby• 3 years ago

People are definitely aware of them. The trouble lies with how easy opting-out is. Many websites have included options to just opt for the "compulsory" option. The only concern now is how many of them would willingly provide that option.

ssss112• 3 years ago

Of course the simple solution that we all know is to not collect the damn data in the first place. But marketing boffins the world over will never willingly do this unless it’s enforced by law, so we’re left with the user’s taking on the burden of clicking deliberately confusing stuff and not knowing whether they’ve ended up consenting or not.

maeln• 3 years ago

Most people do not care because they don't really see/understand how it affect them. Just like most people probably don't care about HVAC regulation, welding regulation for system under pressure and other very technical field.

They will see the issue and care about it when something happen. We have a lot of regulation about welding under high pressure because we know from experience what happen when we have no rules (things go boom).

What happen when we have no regulation about tracker ? We get massive data leaks from poorly secured data hoarding company (hello Equifax). This is dangerous in many many ways: Identity theft, scam & spam, identifying people with certain political view, from a minority of some sort, etc... GDPR does not solve all this issue, some company can still hoard massive amount of data about you (it is always scary to ask for a data extraction from Meta, Twitter, ... and how you have a "profile") and have bad security, but it does limit in how many hand this data circulate and how easy it is to gain access to.

ge962• 3 years ago

Soon as I see the cookie prompt I either abandon the site or read past it. Maybe I write a thing that specifically removes it by an extension.

clnq3• 3 years ago

There are already lists for ad blockers that remove those cookie notices.

ge962• 3 years ago

I don't know how people can use the internet without an adblocker.

welder• 3 years ago

A related browser extension was posted here yesterday:

Consent-O-Matic: Automatic cookie management (au.dk)

https://news.ycombinator.com/item?id=35562230

olivierduval5• 3 years ago

Actually it's a bit more complex (but not much) than what is described: 1st party may need user consent when they will use personal datas for something that is not the intended service (legitimate use).

For example, for a shopping cart: cookies are necessary for the service, so no problem. For fraud detection : no problem because it's a legitimate use. But if you start tracking with a user cookie what pages your users are viewing (statistics collection), then... you need the user consent ! Because it's not necessary for the service... (even if it might be in your interest)

EDIT: if your statistics are not bound to personal informations (so you dont need statistics for INDIVIDUAL users but only the your users AS A WHOLE) then... no problem for RGPD and no need for consent. Actually, that's what a lot of RGPD-compatible statistics do (like Matomo and others...)

oneeyedpigeon5• 3 years ago

I think the vast majority of sites that use cookie popups DO need to do so because they use targeted advertising. It's only a tiny number that have been 'too aggressive', although I'm personally aware of such an example.

olivierduval5• 3 years ago

As a side note: cookie management is just A PART of RGPD, that is based on personal information. So RGPD implies to inform the user about the ways their information is used, how it can be accessed, modified, deleted and so...

Circuitstorm513• 3 years ago

It's GDPR as in General Data Protection Regulation.

oneeyedpigeon5• 3 years ago

if you start tracking with a user cookie what pages your users are viewing (statistics collection), then... you need the user consent

What about if you're Amazon and you want to show 'people who bought this also bought this' content? Then the tracking is necessary.

germanier12• 3 years ago

It's not enough that you "want to". You have to weigh your interest and that of the users against each other and would probably come to the conclusion that you can process that data for that purpose without consent if you aggregate it.

pelorat3• 3 years ago

Why? Just store lists of bought product ids in its own database, then compute some statistics on it. Zero customer or user involvement is needed in that process.

harha• 3 years ago

What if you could only buy bundles of goods which are dynamically generated (and look like a basket to the user) and the seller just shows frequently purchased bundles or combines subsets of these? Curious where to draw the line.

goodpoint6• 3 years ago

Not at all. You don't need cookies and consent for anonymized statistics.

thiht• 3 years ago

Then you ask for consent.

jwildeboer3• 3 years ago

Toot/thread author here. You are of course right. I couldn't pack all details in those toots. I had to break it down to the absolute basics that are often misunderstood: Not every cookie needs consent. The way this is presented nowadays in these popups is deliberately misleading and trying to move the blame to some anonymous political entity when in reality it simply isn't that way.

nonethewiser7• 3 years ago

Are mastadon posts really called toots or is this a joke?

Myrmornis3• 3 years ago

Aren't you failing to account for the following?

In theory, website owners could do as GitHub did and remove inessential cookies and get rid of annoying banners: https://github.blog/2020-12-17-no-cookie-for-you/ But in practice, website owners are worried about breaking laws and aren't experts and just follow what they see everyone else doing, and so put up banners. So in practice, the regulations are indeed the ultimate cause of annoying banners, even if in theory those are avoidable in some cases. The people who introduced the regulations were able to look at the ecosystem of website owners and predict that the consequences of the regulations would be the vandalism of the internet by banners that we've seen over the last few years.

janosdebugs• 3 years ago

This seems to conflict with the ePrivacy directive:

Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment.

krsdcbl• 3 years ago

I'd have one very important addition, as you tend to use the word yourself even if you basically term at pointing out this distinction:

The law itself does not even mention "cookies", afaik.

It aims at regulating ANY kind of detection or storage of PII, regardless of it's technical nature.

"Cookies" are preferred nomenclature partly because non technical users kinda understand what it means, but it's VERY MUCH also part of the very tactics you are writing about: because "do you accept cookies?" is a really really cute obfuscation of "do you consent to us taking your fingerprints and tracking everything you do online?".

That also goes for calling the GDPR the "EU cookie law".

The EU already had a "cookie law" long before GDPR that already mandated informing users about the site's usage of cookies, but it was widely ignored or even unknown to publishers outside of the eu since it: didn't regulate consent & storage, referred to cookies specifically and had thus become easy to kite with modern tracking techniques even if anybody gave a damn, and also didn't impose any kind of substantial sanctions when breached.

The GDPR aimed to fix that and therefore explicitly avoids specifying any technology it should be applied to. It's applicable to cookies, server side tracking, fotos of you or paper forms just the same.

friendzis6• 3 years ago

While legitimate interest is one of possible exemptions to GDPR blanket ban, legitimate interest justification must be accompanied by a rights and freedom test.

mschuetz• 3 years ago

The problem is that GDPR doesn't go far enough. It should completely prohibit third party tracking without the possibility to agree to it. Third party cookies/tracking simply should not exist.

goodluckchuck3• 3 years ago

The problem is they picked the wrong parties to be responsible. It’s not the websites that are doing the tracking. The websites are merely asking to save a cookie. It is the users’ own web browser that is storing the cookie and sending the cookie back to these websites. It’s the browsers that should be regulated if anybody but it’s a lot easier to regulate the little guy than to regulate Google and apple.

martin_a• 3 years ago

Who integrated the tracking scripts and tools that want to set a cookie?

The "little guy" or the browser?

Nextgrid11• 3 years ago

The GDPR goes far enough and even prohibits dark patterns and annoying the user into accepting. Making the "decline" option harder to find is not compliant for example.

The problem is a chronic lack of enforcement that allowed websites (and entire companies such as TrustArc/etc) to implement these malicious pseudo-compliant solutions and get away with it, at the expense of everyone's privacy and sanity.

ActorNightly15• 3 years ago

Id be willing to bet that there is a large overlap of people who dislike tech company layoffs and people who have this sentiment about 3d party tracking.

irusensei3• 3 years ago

I live in the EU but have a VPN setup for a non-EU country so that I see less cookie modals and overall have a better experience.

Lurkars• 3 years ago

Does that mean you autoaccept everything and automatically handing your data to 3rd parties?

irusensei3• 3 years ago

What data?

fsh• 3 years ago

GitHub got rid of their banners in 2020: https://github.blog/2020-12-17-no-cookie-for-you/

I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background.

Nextgrid11• 3 years ago

I believe there is also a lot of "cargo culting" where site admins copy what everyone else is doing without understanding the legal background.

And an entire industry with companies like TrustArc built on pitching and selling this crap even if not required and/or if their solution wouldn't achieve compliance anyway.

marssaxman• 3 years ago

This is very convenient, because I can add this one line to my ublock origin config and thereby eliminate many cookie banners:

###onetrust-consent-sdk

baby• 3 years ago

That’s what happens when you add regulations to an industry of small players who can’t afford to spend time or money in understanding these things

Nextgrid11• 3 years ago

The regulation is much easier to understand and comply with than many other laws you already need to comply with (taxation, etc) and nobody seems to complain about.

The problem isn't the complexity of the regulation, it's that entire businesses and careers have been built on the fact that spyware became decriminalized in the last decade and they are fighting back with misinformation to try and preserve this status-quo.

npteljes2• 3 years ago

I think it boils down to how service providers can manage the inconvenience. Since sites can pass the blame to the EU for the cookie things, and they can create a nice shiny button that makes the inconvenience go away in an instant, cookie modals are a good solution. They can perform that they are giving the users options for privacy, and also absolve themselves from the burden of the EU regulation, with one simple click on the Allow all button.

I also think that it users don't mind the inconvenience too much. Complain, yes, but they are not really choosing a website that doesn't have the popup, over a website that does have. And so, businesses have no real incentive to change their ways.

illiarian18• 3 years ago

The incessant "think of the small businesses" is becoming the new "think of the children".

It's easier for small businesses to comply with GDPR.

acatton• 3 years ago

small players who can’t afford to spend time or money in understanding these things

Most of them can afford it, since it's part of the cost of doing business. Most European businesses were already regulated by similar rules with the Loi informatique et libertés in France, and the Datenschutzgesetz in Germany. But since the maximum fines were smaller, everybody was breaking the law.

The main issue is not that they can't afford it, the issue is that they don't want to do it.

I've worked for 3 different small businesses which were happy to use free-of-charge AGPL libraries in their main SaaS product. And when I mentioned that we should remove AGPL libraries or release our entire codebase under AGPL, what I got was "we'll look into this later".

This is not "i can't afford it", this is "i'm too lazy/incompetent to make time for it"

thecopy• 3 years ago

Indeed. I have many times mentioned this with business/product owners in my organization - but it is a nasty mix of complicated laws and regulation, pressure from legal, and a mentality of risk-minimizing. I usually only mention it in passing because fighting the requirement (which often is not actually needed) would take all my time and several weeks/months. I dont really care in the end.

the_gipsy• 3 years ago

At GitHub, we want to protect developer privacy, and we find cookie banners quite irritating, so we decided to look for a solution. After a brief search, we found one: just don’t use any non-essential cookies. Pretty simple, really.

Your Product Owner / Team must push against the ever-growing demands of Marketing Team. If the Marketing Team dictates what features Product should build instead of selling your product, then you are doomed. Saying yes to having a cookie banner is sadly an easy bargain for Product Team.

veltas• 3 years ago

Tech bros love to whine about "The EU cookie policy" that simply doesn't exist the way they imagine it. All these popups are the most radical way to interpret the explicit consent demanded by regulations when sending data to a 3rd party. An ongoing provocation by the ad/tracker industry to blame their ruthless data hoarding on the EU.

The official EU website has one of these annoying pop-ups. Are they part of the provocation? https://european-union.europa.eu/index_en

gizmo• 3 years ago

If you click on the cookies explainer you'll see that they actually use a shitton of cookies:

https://european-union.europa.eu/cookies_en

Instead of that cookie banner they could just not have visitors connect to all those 3rd party services that use cookies to track users!

ginko• 3 years ago

That one's the pretty much the optimal implementation though.

* it's a small bar on the bottom

* the site works without clicking on the consent buttons

* it has clear "opt-in" or "opt-out" options

* no annoying "customize my permissions" sub-menu with tons of enabled switches and dark patterns

Machado1172• 3 years ago

* No loading screen when you don’t accept all cookies

dkersten• 3 years ago

It’s also fast. I clicked the don’t allow button and it responded instantaneously. Many cookie banners are (probably purposely, at least when should don’t allow) slow as hell.

nonethewiser7• 3 years ago

That one's the pretty much the optimal implementation though.

Takes up 40% of my screen on mobile

luckylion4• 3 years ago

That one's the pretty much the optimal implementation though.

It's strictly performative, they're setting session and tracking cookies without consent. Whatever you click on their "consent" (or if you click at all) is irrelevant and has no effect on the cookies being set. It's been that way for a long time and nobody cares (I've reported it before and never got a reply).

It's a classic "do as I say, not as I do". Rules are for us, not for them.

pelorat3• 3 years ago

If you click on "how we use cookies" you'll see the reason is 3rd party services outside of the control of the EU (like embedded YouTube) that they are using on some of their pages.

raverbashing3• 3 years ago

has one of these annoying pop-ups

You mean a footer. With a 'Only essential cookies' option.

A bit annoying, yes, and other commenters have mentioned the reason for it.

So nothing in your face like "We care about (selling) your privacy"

signatoremo2• 3 years ago

It is still in your face. It takes a large part of a mobile screen.

If they care enough about privacy they would only use “essential cookies” and get rid of the others.

goodpoint6• 3 years ago

Are they part of the provocation?

No, why are you assuming that?

febeling• 3 years ago

This should have been solved technically, not politically. Why not set cookie rules in the browser settings, and handle at http standard level?

jeltz4• 3 years ago

Because Google owns the largest browser. The problem could only be solved politically.

goodluckchuck3• 3 years ago

No, that proves the problem could not be solved politically, because regulators lacked the political power needed to regulate google

Nextgrid11• 3 years ago

GDPR and those data processing consent flows are about data collection and processing in general and not a specific technical means of doing so - it would also apply to IP addresses, browser fingerprinting, information manually entered (such as delivery address when placing an e-commerce order) or a hypothetical crystal ball that actually worked.

matsemann2• 3 years ago

How would the browser discern between legitimate 1st part cookies and illegal privacy violating ones? It's not a technical problem, it needs laws.

And for GDPR and other privacy rules, cookies aren't even a thing. The laws doesn't care about the medium you use. They apply beyond technicalities. For instance you could track IP addresses and a browser would have no way to stop you. GDPR makes it illegal without involving new crazy tech.

Guid_NewGuid• 3 years ago

No one likes these consent modals, not the EU, not the companies, not the end users.

But they're good.

They're making the negative externality visible. We had developed an ecosystem where as soon as you clicked on a webpage it would spaff your personal data to third party brokers and infest you with tracking across the entire internet. All driven by marketing and sales departments. All driven by a capitalist free market.

The regulations changed nothing other than to make people annoyed by this. Good. Take that anger and direct it against the god damn companies building this stuff, many of the employees of which are on this site. Stop whining about the EU, they're just holding up a mirror to the abject horror of tech.

flangola7• 3 years ago

Couldn't have said it better myself.

lofaszvanitt3• 3 years ago

No, they are not good in any way. Imagine you have to press buttons whenever you start your car and have to give promises you are not going to go above the speed limit...

It's just plain NONSENSE. This consent madness should be implemented in the browser. You set it once, and then you just forget about it. Poof, problem gone. If

Kalium• 3 years ago

I cannot imagine that the legal systems in question would consider setting a consent setting in your browser, once, to be explicit positive and informed opt-in.

berkes3• 3 years ago

It was in the browser (still is?) called DNT, and it didn't work because the industry ignored, circumvented and even actively opposed it. Your idea has been tried and was found to not work.

teekert2• 3 years ago

I use Matomo on Wordpress. Turned of cookie based tracking. It means sometimes a revisting visitor can not be discriminated from a new one. I don't care. But, now he is saying, I can enable the cookie if I want, without needing the consent banner?

And what about a privacy page? Indeed it does make whipping up a blog or so more complex. Although I usually use Hugo of WP, keep them vanilla: Now cookies required for just viewing content.

Some kind of tool would be handy.

Hamuko• 3 years ago

But, now he is saying, I can enable the cookie if I want, without needing the consent banner?

No? It's clearly not an essential cookie considering your site is currently working without it.

ActorNightly15• 3 years ago

So stop blaming "the EU" and ask yourself if this is the internet we want.

...Yes, thats exactly the internet "we" want. I don't get why it so hard to accept that people simply dgaf about privacy, and much prefer free products online paid for by ads. And there is nothing wrong with that, because for those that actually care about privacy, there are plenty of tools.

germanier12• 3 years ago

It's hard to accept because many, many people won't agree with you and do give a fuck.

ActorNightly15• 3 years ago

To anyone that doesn't agree with me, please show me your rooted android phone that has no popular apps installed that collect any data, and doesn't use a sim card.

Because if you say you give a fuck about privacy, and use a modern android phone with OEM rom or an iPhone, you either don't understand what privacy is and shouldn't be talking about it in the first place, or you are a hypocrite.

Myrmornis3• 3 years ago

When you say "many, many" I take that to mean "a substantial proportion" and I think you may be making the mistake of estimating your proportions from the population of people in tech forums, rather than from the global population of internet users.

nonethewiser7• 3 years ago

Yet here we are. People know what facebook is and still use it.

malermeister2• 3 years ago

It's not the internet I want. I don't want surveillance capitalism manipulating society so they buy more shit.

I'm part of the EU electorate. Are you?

ActorNightly15• 3 years ago

I don't want surveillance capitalism manipulating society so they buy more shit.

Neither do I, but prove to me that this actually happens. Namely the surveillance part with online trackers.

Varqu2• 3 years ago

I don't understand why it isn't solved in this way:

You get a banner on your first visit, with a list "here are all the cookies and ways how we use your data, if you are not fine with it, please leave this website"

This should be an option for small private websites (different rules for FB, Google and alike), because no one forces you to use a site, same as "my house, my rules"

mnw21cam2• 3 years ago

Because that is very explicitly illegal. Consent to harvest personal data that isn't necessary for pure access to the site must not be used as a condition of access.

jnsaff2• 3 years ago

This would be explicitly forbidden by GDPR. You either don’t serve EU customers or allow them to opt out/in. You can’t degrade or deny service based on consent.

ActorNightly15• 3 years ago

The issue is that there is too much money to be left on the table advertising wise, so instead you are going to see every way to get around anything GDPR that is going to progressively shit up the internet.

In the end, you can be tracked without cookies using fingerprinting, and AI will make this job easier and easier. So the banner is pretty much irrelevant technologically. You will also see companies that make popular browsers include features in the browsers for advertising purposes that will make cookies irrelevant - i.e you give consent otherwise the browser doesn't work at all or on websites with relevant content.

Best thing to do is really just to let it all go IMO. Its really not a big deal. Between things like VPN and all the privacy tweaking you can do in Firefox, if someone wants privacy they can have it.

goodpoint6• 3 years ago

"my house, my rules"

A website is in no way "your house".

raverbashing3• 3 years ago

Ah yes, the "internet we want", where Ad geniuses will spam you for the same thing you just bought off Amazon and mobile sites turning your phone into a hand warmer with all the ad crap they have to load and all the 3rd party cookies they add

ActorNightly15• 3 years ago

And yet, before GDPR, when all of this was happening, those sites still saw increase in visitors and still made money, because people learned to ignore the ads since the design of the core website was pretty good and ads were not obtrusive to user experience.

sacado2• 3 years ago

Some people dgaf. They are free to click on "I agree with everything."

Some people do gaf. They are free to click on "I don't agree with non-legitimate use of my data."

Those who don't want to submit to these simple rules are free to not do business with EU citizens at all.

Everybody's free. EU is the new land of Freedom it seems.

goodpoint6• 3 years ago

thats exactly the internet "we" want

This is not how civilized society works. Taken individually, people don't care about a million things, yet regulators have to take care of those things on behalf of everybody else.

Just because you don't understand the ramifications of something it does not mean nobody else understands it.

ActorNightly15• 3 years ago

Taking care of those things would involve an actual solution that works, which would require people understanding the technical aspects of the problem, which would require those type of people running for office and getting elected.

When that happens, then we can talk about responsible governance in this regard. GDPR was a direct response to Trump campaign shenanigans, as a tool for politicians to capitalize on appearing to be better than US. It had nothing to do with protecting people. If GDPR outlawed 3d party tracking outright, then you would have half an argument.

belorn• 3 years ago

As long it is an informed consent that people don't care about privacy.

Uninformed consent is the tricky part. Medicine has to constantly deal with that a lot of people that dgaf about what medicine or brand of medicine is given to treat a specific illness. They just want to get better. Is there something wrong with doctors that just don't inform or get consent? Patients that actually care about specific medicines can look it up.

iamnotsure2• 3 years ago

Cookies invade privacy, cookie prompts invade both privacy and attention.

hammyhavoc5• 3 years ago

Is the purpose of the prompt itself not to invade your attention to make a decision on whether you want them or not?

Likewise, how does the prompt invade your privacy if you don't act upon it?

iamnotsure2• 3 years ago

Before the prompts, situation was not good, but I could delete browser history and what not. After the prompts, I still need to delete browser history, but I can't delete memories of prompts from my mind. Every time I see a cookie prompt, I get traumatized. Prompt blockers do not work reliably. I don't want to read about cookies, GDPR, EU, whatever every time I see a random web page. I remember the old internet.

GranularRecipe2• 3 years ago

"To make this very clear: user/visitor consent is only needed for data going to 3rd parties."

I think this statement is categorically false. Art. 6 GDPR (https://gdpr-info.eu/art-6-gdpr/) lists exhausively the reasons for lawful processing of personal data which applies not only to cookies, but also IP addresses etc. The "cookie consent" addresses Art. 6 Point 1(a). Whether third-parties (data processors) are involved is irrelevant, e.g. if I need to transfer personal data to my accountant, it falls under b, c (or d).

mnw21cam2• 3 years ago

Agreed. It isn't the third party that is the issue - it is the separate purpose.

For example, if I access a web page, I'm giving my IP address to the server, so that it knows how to sent the data I just asked for back. That IP address is personal information, but it is necessary for the server to fulfil the purpose of the task I just asked for. That server also gives the IP address to a third party - the router in between it and me. That's also necessary, because otherwise the packets can't be routed, and it's fine legally.

However, if the company running the web page were to take that IP address and store it and use it for deep analytics, matching my request up to other requests from the same IP address, then the personal data has not been handed over to a third party, but it is being used for a purpose which requires consent, and would be illegal unless that consent had been obtained. That data use isn't necessary for the original purpose of the task I asked for, which is to serve me a web page - it is a separate purpose.

ThunderSizzle• 3 years ago

Wouldn't that depend on perspective? Wouldn't the router e.g. cloudflares purpose be to ensure fast delivery and that it's not an attack.

Both require capturing the ip address and analyzing behavior. A faster road where no one wants to go isn't a faster way, so the router needs to capture it so they know where to build their roads.

herbstein• 3 years ago

However, if the company running the web page were to take that IP address and store it and use it for deep analytics

Or, in fact, sending off to Google Fonts. As a German court case reveals, that is considered sending the IP to Google -- breaking GDPR since it is done without consent on first launch of the site.

jwildeboer3• 3 years ago

Toot author here. Yes, the complexities are tough to explain in a few toots. Bit as an abstraction it is valid IMHO. As per the GDPR and ePrivacy Directive, a website must ask its users’ consent to use cookies that are not necessary for accessing the website’s functionality. All third party cookies typically fall under this rule. 1st party cookies that do not collect PII (Personally Identifiable Information) like simple session cookies ar exempted from consent.

jillesvangurp• 3 years ago

This is correct. Bad UX with modal popups and very ambiguous/deliberately vague verbose language designed to make you click some ok button are a choice not a legal requirement. Being deliberately obnoxious is of course a weird choice if you are trying to actually get people to engage with your website.

The more obnoxious the UX, the less you should trust websites to do the right things when it comes to your privacy and rights. If someone puts a "reject all" button in the cookie thing, I click it on principle. Every time. I go out of my way to find it and click it. The harder websites try to hide that button, the harder I try to find it and click it. It's usually there.

But you have to wade through a lot of bullshit and deal with some offensively stupid UX to get to that button. I'm not going to mico-manage all the various ways you want to sell my data / abuse me. Does anyone actually do that? The engagement on UI like that must be absolutely terrible. What does that say about your brand if you are trying to be deliberately misleading, manipulative, and offensive like that? It's not a good look.

Advertising your web design incompetence and malice/corporate stupidity like that is a choice. A bad and odd choice. But it's a choice. The more visually offensive the cookie experience, the less likely I am to provide consent and the more annoyed I get. It's that simple. Maybe I'm weird. Or maybe lots of people are exactly like me and don't provide consent either. So why even bother with this level of abuse?

I also have an ad blocker (I don't even remember the web before ad blockers), I use firefox containers, and firefox cleans up cookies and blocks trackers really aggressively. So, not only is this stupid. It's also futile.

Nextgrid11• 3 years ago

Dark patterns aren't actually a valid approach of complying with the regulation - if you do that, you may as well just track and collect data without consent, because any consent obtained by misleading or annoying the user does not count as valid anyway.

Here's what the UK legislation has to say (which is still identical to the EU GDPR as far as I know, though subject to change post-Brexit): https://ico.org.uk/for-organisations/guide-to-data-protectio...

Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent.
Explicit consent requires a very clear and specific statement of consent.
Keep your consent requests separate from other terms and conditions.
Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough.
Be clear and concise.
Make it easy for people to withdraw consent and tell them how.
Avoid making consent to processing a precondition of a service.

pdpi2• 3 years ago

The harder websites try to hide that button, the harder I try to find it and click it. It's usually there.

These days, if I can't find it within a few seconds, I just bounce and find some other less obnoxious site to use instead.

nonethewiser7• 3 years ago

I don’t even get that far. I just close websites with cookie banners if I can help it.

openplatypus• 3 years ago

Cookie Banner is just a term for consent for data processing.

It is not exclusive to 3rd party cookie or tracker. If you have no legitimate interest in doing something with the data, you must ask the user first.

hammyhavoc5• 3 years ago

Both CloudFlare and Jetpack on WordPress insert a tracking cookie as a part of using their service, right? (I may be wrong, things may have changed)

For a lot of folks, that's what they have to use, otherwise delivering the page resource-wise isn't viable. Ergo, they need those banner popups to be in compliance, right?

remus• 3 years ago

It depends on what the cookies are being used for. If they're "essential for site functionality" (e.g. fraud prevention) then consent is not necessary.

hammyhavoc5• 3 years ago

Well, here's the thing though, it could be argued that they are essential for site functionality (if you conflate functionality with availability for example), however, you are revealing the IP of the user to those third-party services, which is no bueno.

Loading Google Fonts via Google's CDN is non-compliant, ergo why would Jetpack be any different? https://www.theregister.com/2022/01/31/website_fine_google_f...

However, CloudFlare is an odd one. They're also the reverse proxy and DNS for the site, ergo they can collect that IP if they intend to, which they apparently don't.

Where is the line drawn? If an asset loaded via a third-party CDN is "leaking the IP", surely CloudFlare also is? Surely any kind of DNS is?

I'm asking big questions, I know, but have always been curious, and have been waiting for a good opportunity to put them in front of others.

3dfan2• 3 years ago

The problem with the GDPR is that it is a monster of a legalese text:

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

Which nobody understands.

Which, depending on how you read it, might make participating on the internet practically impossible. An IP is considered personal data, so in theory you cannot use foreign infrastructure like a CDN.

Which certainly makes the internet as we know it impossoble. An internet where everybody builds tools on their site that everybody else can embed on their site. Because that would mean IPs flowing around between sites.

Which gives a huge disadvantage to Euroeans. Because Europreans have to show cookie banners and stuff to everybody around the world. While the rest of the world has to only show them to Europeans. Look at your favorite website through a proxy inside/outside the EU. It starts with an annoying popup only in the EU.

Which cements the stronghold of Google and Co, who 1) only have to bug their European users and 2) have the legal resources to cope with this insanity. Startups and indiemakers don't. So there will be even less of them in the EU. And the ones who exist will have to waste their time on this instead of building their products.

Tarq0n• 3 years ago

This is way off base. Using PI to fulfill a request someone has made of you is the happy path of GDPR, you just can't retain or reuse that information more than you have

1) a contract or

2) permission or

3) a lawful task

For.

Having other parties process PI for you is fine as long as it's done under an agreement that binds them to the same terms.

3dfan2• 3 years ago

First, no, you cannot reduce a thousands of words long legal document to a few words like you did and say "Easy, this is how it works". Those thousands of words are there for a reason.

Second, good luck, figuring out what you have "a contract, permission or a lawful task" for under the specific circumstances of your site.

Third, good luck, making and understanding an "agreement that binds them" with every provider of every piece of infrastrcuture you use. Good luck doing that for even a single piece of infrastructure.

hardware2win2• 3 years ago

An IP is considered personal data,

Is or can?

ivanhoe• 3 years ago

Ideally browsers would have an API to handle GDPR requests natively, the way they do for hardware access, and users would be able to set the default level of access, as well as lists of exceptions for some domains. Of course, Google will never provide such API in Chrome as it would be bad for their core business of spying on people in order to sell them more stuff.

CactusBlue• 3 years ago

It exists, and it's called the DNT header. It was deprecated because ironically, it was used for user fingerprinting.

soneil2• 3 years ago

It was also widely ignored.

Not much has changed since browsers had to remove the capability to create popup windows (and pop-unders, which only existed because users were getting too proficient at the game of whackamole). At every single step, the industry has shown it will only behave anywhere near reasonably when externally forced to do so.

DNT should have solved this problem, but the leopard couldn't change its spots, and used it to further its attacks on users instead.

And this is why we have over-reaching regulation. Not because we want it, but because we earned it.

Sephr• 3 years ago

DNT isn't deprecated in Firefox or Chrome.

hardware2win2• 3 years ago

Also many web masters dont realize that consent is not needed for technical cookies like auth.

jwildeboer3• 3 years ago

Toot/thread author here. I have added more clarifications and explanations, based on the feedback in the comments here. Thank you for that! It was an angry rant written down in a very short burst of productivity ;) I had to simplify a lot if things to get the main point across — that these pop-up banners are NOT what GDPR demands, that they deliberately are designed to exaggerate and intrude on users.

PaulKeeble• 3 years ago

Arguably most of these cookie popups are not compliant with GDPR law anyway as all cookie acceptance has to default to opt out, its only if the user wants to opt in that the data can be collected. Almost all of the popups default the wrong way and use dark patterns including making you wait minutes to avoid the popups.

This is all by design, they will happily show you that popup everytime you come to the site and you'll never see it again if you accept them. When you see such a pop up you know what sort of entity you are dealing with, one that is willing to fight with the EU and the law to get that data as well as enormously hurting its customers in preference.

exabrial• 3 years ago

The only scoring thing about the EUs cookie policy was fucking noticed on every site for functional cookies.

And let’s be real, the other cookie content popups are probably theater.

qikInNdOutReply• 3 years ago

It needs a API, to talk with a user preference tresor and auto-negotiate site access. If a agreement can not be reached, the site remains privacy paywalled, else its just there and the site owner has consent.

Havoc• 3 years ago

How much simple analytics are considered reasonable? Simple example counting users and say what country they’re from.

Technically not required to make the site work but might count as legitimate use?

SergeAx• 3 years ago

I want to stop whining about cookies popups. Any actionable items, besides browser extension to eliminate them for good?

zkid18• 3 years ago

A 1st party cookie for tracking a session that stays on the site doesn't need consent/popups. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions

I'd love to hear some legal or DPA opinion on this. From what I know, per the ePrivacy Directive in the version from 2009, any access or storage to information on the end user's device needs consent unless that access/storage is strictly necessary for a service explicitly requested by the user. This is known as the “cookie law”, but is not technology-specific and will also apply to equivalent client-side approaches such as LocalStorage, tracking IDs in URLs, or fingerprinting. The consent requirement is also independent of the question of whether the stored information qualifies as personal data.

The GDPR didn't change anything with these rules. It only changed the definition of consent, invalidating “implied consent” approaches like “by continuing to use this site, you consent to …”. Consent means opt-in. Consent must be easy to decline and withdraw, and users must understand what precisely they are consenting to. This has led to a decrease in the percentage of people who consent to the storage of analytics IDs.

So the question is whether we can be considered as a strictly necessary for a service

more_corn• 3 years ago

Except from the usability and privacy perspective the EU cookie rule is objectively bullshit. Don’t require notification for every fucking site I visit. Also there are no circumstances where “functional cookies are required”. Painting a webpage doesn’t require a cookie.

If you really cared about customer privacy you’d make a rule that allowed me to set my privacy setting in my browser and require the sites to respect it. And one of the options better be “none ever, just do what you can without it”

What moron thought the current rules were sane? What a useless waste of air to defend an obviously broken and constantly annoying and useless rule.

In conclusion a four year old could have come up with a better rule. So stop whining about people’s legitimate objections.

Stop whining about “The EU Cookie Policy” and improve your ways

Related Stories