Please stop putting cookie pop-ups on your website (2022)

https://olivergrimsley.com/2022/03/04/please-stop-putting-cookie-pop-ups-on-your-website/

124 207 2 years ago

"Almost every major website you visit today pops up a banner to warn you that it uses “cookies.” This is not legally required in the U.S. or in most places, and where it is, the vast majority of sites do not comply with legal requirements."

Moldoteck2• 2 years ago

afaik gdpr is valid for eu citizens that are in other countries too, including us. US ofc wouldn't do a thing, but EU can act on your business in their land. That's why cookies are everywhere - websites can't know if you are eu citizen or not. Another problem is that - if you don't use cookies for ads/tracking, you don't need a banner but many websites are ignoring this Another problem - imo gdpr should have been adapted to enforce some http header with auto-response so that the banner wouldn't be needed

peter_d_sherman2• 2 years ago

"That's why cookies are everywhere - websites can't know if you are eu citizen or not."

An excellent point!

Websites can't know if someone is a citizen of country X, country Y, country Z, or even no country (indigenous people, sovereigns, legal constructs, AI's, international groups/associations, companies domiciled in space, other actors/legal constructs, present and future, etc., etc.)!

That is, they cannot know implicitly, without being explicitly given the appropriate information, if someone/something (non-human actors and/or legal reprentatives) accessing a website are citizens of a given country -- or not!

Now websites can do what many courts do, rightly or wrongly, and that is to presume an arbitrary citizenship/jurisdiction for a given website visitor (or visiting actor -- whatever is on the other side of that HTTP/S request)...

But will that be the correct presumption to make in all cases?

Probably not!

So perhaps the future needs a way for visitors to set in their browser (or by some other mechanism!) -- their citizenship and/or jurisdiction!

Of course, then we'd get into some weird scenarios like "what if website X in country Y decides to decline people who have set their browser to "I'm a citizen of country Z" -- sort of like the equivalent of a limiting country's physical immigration policy -- but for HTTP/S requests...

If the HTTP/S requests are not in the citizenship/jurisdiction of a whitelist specified by each website, then, "no HTTP/S response for you!" (Sort of like the HTTP/S version of Seinfeld's Soup Nazi -- "No soup for you -- come back in 1 year!" :-)).

Of course, the whole set of ideas I've outlined above, were they to come to fruition in the future -- sort of would violate the spirit of openness, trust, and good faith that was present in the early World Wide Web...

Remember that the early World Wide Web was built in such a way that all HTTP requests were answered with no need to provide a password or other credentials, no need to accept cookies (the early WWW / HTTP didn't have them!) and could be contrasted with FTP sites of the time which did require passwords (although many would be set to allow username "anonymous", password "anonymous" logins).

That is, the early WWW / HTTP -- was a passwordless, cookieless, loginless, "just give me the information", information-passing protocol, which in its earliest incarnations served academics (no one else had access to the Internet at that time!) who only wanted to share academic infomation (papers and the like!) with other academics, regardless of their country, jurisdiction, or their acceptance or rejection of any potentially access-limiting and resource denying cookie!

So, in conclusion, an excellent point!

mindwok• 2 years ago

Interesting article. This policy has felt like a complete failure, but I didn't know the depths of how badly it has failed.

I would really like to see these die. Regulators should just work with browser vendors to make an API that I can set at the browser level, and websites just read that to know my preferences and leave me alone.

sofixa3• 2 years ago

Your preferences should be on the website level though, not global. And you should be asked about it on first visiting the website.

Let me explain why with an example: say you're the type of people who doesn't care about "privacy" online ("I've got nothing to hide"), or you do; and you want to "support " certain ad-supported websites you're a fan of; but not that new clickbait toilet paper your aunt sends you.

I can't think of any way to have a good UX to opt in or out of "tracking" cookies which people would actually use (few will bother changing the defaults, and most mindlessly click ok).

awfulneutral• 2 years ago

Why not do like with popups, and show a little toast with "x tracking cookies were blocked, click to allow"? Cookies could have to register whether they are essential or not. It's really wild how much work must have been created by distributing this problem to every website on earth instead of doing it in the browser.

litenboll• 2 years ago

The important part here is that it's at the browser level, IMO. Then it's the user's choice to either reject/accept all by default or get prompted once per page. I'd guess that 99.9% want to set it globally and never think about it again.

wruza3• 2 years ago

Your preferences should be on the website level though, not global. And you should be asked about it on first visiting the website.

Preferences should be expressible in any form a user seems fitting their needs. If they want to block-all,enable-per-site or enable-all,block-per-site, or block-mask, or enable-mask, or top-down rule priority list — they should be able to. Designing preferences in any other way is a dark pattern not worth considering as a fully user-controlled mechanism.

I can't think of any way to have a good UX to opt in or out of "tracking" cookies which people would actually use

Virtually any UX is better than cookie popups as they are now, cause they get designed with interests of a site owner in mind. This alone makes it the worst possible UX on average.

wvenable2• 2 years ago

Why would anyone want to support an ad-supported website by allowing cross-domain tracking? I think that's a stretch.

gpvos• 2 years ago

The API exists already: the DNT (do not track) header.

troupo13• 2 years ago

And the industry is using it to fingerprint and track users.

andreapaiola• 2 years ago

So... Abolish all the EULAs?

scarlehoff• 2 years ago

Please stop - selling our data to advertisers.

o_m• 2 years ago

For that to work users have to spend money on their services. I hope that will happen in the future, but until then it is hard to compete with free services that has ads.

troupo13• 2 years ago

You don't need invasive and pervasive tracking to display ads. Google became an ad behemoth with contextual ads

kalaksi2• 2 years ago

They probably still track you even if you paid money, so that makes paying less enticing. And it's prudent to assume so unless they clearly state otherwise

dehrmann• 2 years ago

The larger lesson here is this is what happens when governments try to regulate things they don't understand. Cookie popups just add friction, and it's not clear consumers see any real privacy benefit. What's even worse is people seem to not care that the policy isn't working, but they aren't telling lawmakers to fix it.

sofixa3• 2 years ago

The lawmakers regulated that a website should warn you, and then upgraded to ask for your consent, before collecting and storing privately identifiable information about you.

The regulation doesn't mention cookie popups. The easiest way to comply is to not collect nor store any such information.

ipv6ipv44• 2 years ago

The regulation doesn't mention cookie popups. The easiest way to comply is to not collect nor store any such information.

Utopia is just around the corner as long as everyone does exactly as I say rather than being driven by self interest.

Earw0rm4• 2 years ago

How do you manage login sessions without?

If you're a site that has even basic analytics reporting requirements, how do you do any of that without?

"Don't do these things" is a decent option for sole traders, microbusiness and hobby website operators, but good luck selling that to anyone "in a suit" (more likely $500 jeans or chinos nowadays).

jiggawatts2• 2 years ago

Website admins chose the path of malicious compliance.

michaelteter2• 2 years ago

Not necessarily. Many are told by their bosses to either put minimal effort into becoming compliant, or worse, told to use a horrid cookie notice service that creates so much user frustration that some of us abandon the site rather than deal with it.

I think with few exceptions, most web admins just want to get the cookie notice sh*t out of the way and get on with work that matters.

michaelteter2• 2 years ago

I'm not sure why you're being downvoted. I believe the way you stated this is accurate.

The regulation and its outcome was clearly not understood or intended by those who mandated it. Absolutely everyone is suffering from this.

As for the "not care", I think the primary issue is that most people don't make much effort to understand the things they use. If they understood what was going on, they would be more upset and possibly make some effort to get things changed/reverted.

I would put a bit of blame on big corporations for not spending some of their lobbying money on fighting this requirement - not because they should get a free pass at misusing our info, but because they should be well equipped to know that the regulation will be addressed in a crappy way that costs them money and annoys users.

johnnyanmac2• 2 years ago

I think it's a bit weird (but the author did the same thing) that the blame is put on regulators here for not being precise enough with language, and not companies are are happily exploiting the loophole for as long as they can. And if it does get repealed: great! companies win, tracking is back.

There seems to be a nuance missing here in most of this discussion.

troupo13• 2 years ago

GDPR is general regulation that doesn't even talk about cookies or browsers.

The obnoxious cookie popups is the industry's malicious and calculated response.

troupo13• 2 years ago

GDPR is general regulation that doesn't even talk about cookies or browsers.

The obnoxious cookie popups is the industry's malicious and calculated response.

This is a good sibling comment about this: https://news.ycombinator.com/item?id=41576346

USiBqidmOOkAqRb2• 2 years ago

Could you perhaps muster up the courage to clearly substantiate what you're criticizing? These terms "government", "regulation", "lawmakers" come off as dogwhistles. It's not like evil Ursula von der Leyen walked up to the blue lectern and said websites now must present a dialog with one button before you can look at the content.

If you're talking about GDPR, then it regulates that businesses have to have reason to store and process PII. I don't see a reason to be unhappy about that.

dusted2• 2 years ago

The cookie policy is a stupid value-signalling stunt with only negative real-life effects. The correct way of handling the problem would have been through request headers and browser settings, or simply, use the existing option of either allowing or disallowing cookies, and put this option on a per-site basis and a bit more into the users face..

szszrk• 2 years ago

only negative real-life effects

Almost. It hardly worked as intended, but at least it increased awareness. The fact that some sites tried to comply and actually provided a full list of all sites that they sell your private data to is somewhat a win. It got to a lot of wider public that realized "they sell it to 97 companies?!".

I personally think local governments or EU wide institutions should have a registry of companies and their sites with ratings, so we could integrate that directly in our browsers, company registries, phone dialer apps. iFixIt style.

- Clarity of EULA: 1/10, impossible to understand without lawyer's interpretation.

- Length of EULA: 1/10, pops up every week with no diff or summary of changes

- Legality: 4/10, historical track record of rules that are not compliant with local laws of xxx

- History: 1/10, no way to track what were the previous versions of the document or when they changed

- ...

EDIT: to give some context and prove it's possible to provide metrics to legal documents, in Poland we have a formal "Registry of Forbidden Clauses" with references to lost court cases:

https://www.rejestr.uokik.gov.pl/

yobbo• 2 years ago

Besides cookies, there are tracking methods based on fingerprinting, IP and so on. None of them are permitted without explicit consent. This means that a site may not load resources from a third-party server without consent, since the request itself reveals enough information for fingerprinting and tracking.

Tracking is plainly not permitted without consent.

imiric• 2 years ago

Tracking is plainly not permitted without consent.

According to some poorly thought out law in certain territories, sure.

In practice, however, there is no technical mechanism by which users, or anyone else for that matter, can detect whether they're being tracked or consent to it. There are browser extensions conscious users can install to block certain browser features, but these are not infallible, and they're constantly playing a cat and mouse game with trackers.

The cookie policy only applies for cookies, not for general tracking. And even with it, companies loophole their way by claiming "legitimate interest". Many popular websites show cookie consent forms with upwards of a thousand of these companies, and deliberately use dark patterns to make it impossible to deny all of them. It's absolute insanity.

But in general, cookies are a red herring. They're used as sacrificial offering aimed at governments and the public to show that a company really cares about user privacy by not using them. When in reality they've been relying on far more sophisticated tracking methods for many years which are technically impossible for the public to even comprehend.

And let's not forget about the shady data broker market, where our data is perpetually transacted against our will or knowledge, let alone benefit.

We need far more technical experts in governments to pass strict regulation against this nonsense, in a way that it actually benefits the public. But I'm not holding my breath that this will ever happen, considering the corporatocracy we're living in.

wvenable2• 2 years ago

Request headers aren't going to do anything. Browser settings, maybe. If browsers were not owned by advertising companies, they'd just disallow this tracking and that would be the end of it.

dusted2• 2 years ago

This also solves nothing. It's up to the ethics of the company how they chose to group "none" "essential" and "all" and what kind of server-side tracking they do anyway.. It's no harder to do the wrong thing with the current system, but at least the headers would be invisible to the user.

Alternatively: Only allow the website to set cookies if it presents headers with the different options, in a standardized way so the user can chose to pre-set a preference and not be bothered with the cookie nag modal.

friendzis3• 2 years ago

GDPR compliance can be implement many ways, starting with not collecting data in the first place. Even if data is collected and sold it is still both possible and arguably even easier to implement GDPR compliance without cookie pop ups.

However, we have codecamp graduates gluing left-pad modules together until something works instead of engineers building websites and it shows.

cynicalsecurity3• 2 years ago

Neither "graduates" nor "engineers" are responsible for any website functionality. They simply do the work that the management requested them to do.

cynicalsecurity3• 2 years ago

The request headers are already there. It's the DoNotTrack header.

troupo13• 2 years ago

The Do Not Track header was immediately used by the industry to fingerprint and track users.

GDPR isn't about cookies, or browsers.

thn-gap2• 2 years ago

When I'm on my phone and a website shows the ads popup, I open it in Brave, which just blocks everything. That's the current implementation of "do not track" settings.

GJim9• 2 years ago

The cookie policy

No. It isn't a "cookie policy".

The GDPR states I must give a specific opt-in approval to provide my personal data and allow it to be passed on.

You can use as many cookies as you like, but if you want to track me personally (advertisers take a bow) then you need my specific consent to do so. And so you should.

I'm amazed I have to keep explaining this to American web designers who should know better. This has been law in the UK and EU for quite some time now and is a prerequisite to doing business here.

The GDPR is a bloody good law. It makes the gathering of unnecessary personal data a liability, as it should be. See here: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

Timshel• 2 years ago

? You now have a one click button to refuse most of tracking on compliant website and this include Google.

Fail to see how it’s value-signalling ...

cbanek• 2 years ago

Also, for those of us with vision issues (or just want to zoom in a lot on a webpage), these popups look horrible at 150%-200%, and often get misrendered in strange ways, sometimes hiding the button. Then if you actually try to reject it, if you can, the rejecting or customizing page is nearly always broken when zoomed in.

literalAardvark• 2 years ago

This doesn't read quite right to me. Maybe I missed something.

Under the GDPR sites are emphatically NOT allowed to deny service over rejecting cookies.

Iirc the only valid options are providing a paid alternative or blocking service to the entire class of GDPR covered citizens.

xaerise• 2 years ago

That is not really GDPR. That is the ePrivacy ( ie. The Cookie Law from 2009 ) directive that supplements but sometimes overrules GDPR.

https://gdpr.eu/cookies/ # Cookie compliance

wkat424212• 2 years ago

Even a paid alternative is very iffy. Some jurisdictions like Germany have allowed it after a court ruling but most have not. Meta is also getting flak from the EU for their "accept or pay" model.

TheRealPomax• 2 years ago

So, the problem with this is: the law. If you use session management: GOOD NEWS GDPR AND CPPA UNDER PENALTY OF THE COURTS DEMAND YOU INFORM USERS and if you know a better way than an intrusive "accept this before you can continue" by all means pipe up but the problem is overbearing laws, not "people following them". The law requires that you disallow access until people tell you their position on your handling of their personally identifiable information and welcome to modern web dev hell. If you don't like it, hell has done its job.

Both Europe and California consider IP addresses PII and this is the result.

nikanj2• 2 years ago

Session management does not require a cookie consent. Implementation-relevant technical cookies are exempt, it's the 337 different analytics services that sites use that require the cookie consent

troupo13• 2 years ago

1. you don't need consent for functionality strictly required for the functionality of your product. Such as session management

2. You are allowed to legitimately process PII for legitimate purposes related to your business: e.g. combating fraud

3. What you emphatically aren't allowed without consent: collect vast amounts of data, store it indefinitely, and sell it to 15 000 third party "partners"

Moldoteck2• 2 years ago

gdpr works a bit differently. You can use cookies for providing website operations, for it you don't even need a banner. You can't easily use cookies/trackers for ad purposes. You can still display ads but these shouldn't use cookies (this way again - no need for banner).

evdubs• 2 years ago

uBlock Origin has cookie notice filters. I don't think this is enabled by default; you can enable it in the Filter Lists section, along with "annoyances".

Moru• 2 years ago

And it works really well. Until it does not, and then you need to figure why the page isn't working for you but your neighbour has no problems. I still use it all the time though but there is some pages I won't bother with much. Probably better that way anyway :-)

wkat424212• 2 years ago

Yes I prefer using the special EU cookie wall plugin. I forget the name right now, sorry.

Ublock just blocks the popup which breaks some sites that don't work until you make a choice, which you can't because it's blocked. The other plugin answers it for you in the background with your chosen options.

planb• 2 years ago

Cookie banners are a great reason for expirations dates on new policies. If it works: Great, renew it! If it does not work, is not required anymore or was just plain stupid: Never talk about it again and it will run out. But who will actively admit that regulation failed and work to undo it?

cornedor2• 2 years ago

Cookie banners is not a policy, it is used to work around a policy, and often implemented incorrectly. GPDR says you need to be given a specific informed decision, but often cookie banners show a big green approve button, and a less positive deny button (if that is even the case). When the law is being enforced better (Which is slowly happening) those cookie banners should get 2 the same looking buttons, and that would result in more denies. Hopefully, companies would realize that they need to solve their marketing differently.

RamRodification• 2 years ago

More like big green approve button vs.

"Configure my preferences" -> Untick all the things -> Make sure you click the almost invisible Save button and not accidentally click the big green "Allow All" button.

Horrible. If we can force websites to do this, we should be able to force websites to read my request header NoDamnTrackingCookiesFfs

timeon3• 2 years ago

Most of laws, at leas where I live, are amended. 'Never talk about it again' seems bit naive to me. If good faith have not helped with trackers then ban them outright.

ipv6ipv44• 2 years ago

By far, my favorite feature in iOS 18 is Safari’s “hide distracting items” feature. It lets you permanently hide the cookie popups on a per site basis. And the annoying google sign in popups, and the annoying scroll down popups.

jimkleiber• 2 years ago

Whoa thanks for letting me know this exists

wruza3• 2 years ago

and the annoying scroll down popups

Wait, is it when you pull the page by moving your finger to the bottom of the screen and the “header” pops up?

ipv6ipv44• 2 years ago

Some sites ask you for an email, or login when you scroll down, and you have to hide it to keep reading. I think Medium pioneered this?

Lio• 2 years ago

You mean the vanity flap at the top?

No those are a different sign of design ineptitude.

They mean the popups that appear as you try to read what you followed the link for.

anonzzzies2• 2 years ago

If you do not collect my data outside for what is strictly needed, then all is good. Remove analytics, recaptcha, embedded youtube, google cdn and any other things you do not actually need to run your product. And collect only the info you need (and nope, you really do not need my address or phone number unless you ship physical goods, so why are you getting it?). You probably do not need my email address besides for spam (forgot password is not a thing; either use one of the oauth providers, or hash the email and let the user enter it; if it matches you can send the email).

Then you don't need cookie banners or gdpr consent popups. It is not that hard. But you want to screw your clients for profit, I know, in that case, you need them or get fined. Which you should be for misusing my information/behaviour and privacy. Nothing good did come of ad tracking, user fingerprinting and data selling, so I wish you many fines.

johnnyanmac2• 2 years ago

it is not legally required to provide the service if a user declines tracking cookies. The site can simply not provide functionality. So in many cases, its not really a choice – the choice is either not to use the site, or consent to tracking.

to be fair that is the choice. And ideally, the invisible hand would show that this is a horrible idea and cause a huge spike in traffic, but alas.

I think "stop putting popups cookies" on websites is an extreme stance, but I agree we could use fine tuning on the little things to help keep the spirit of the law. It should indeed be opt-in and not "ask for forgiveness". And it should adhere to current compliances.

randoomed• 2 years ago

Unfortunately that (quoted) line is incorrect see this page by the dutch privacy authority: https://www.autoriteitpersoonsgegevens.nl/en/themes/internet... It is based on this 2019 ruling also by this same authority (unfortunately only available in dutch) https://www.autoriteitpersoonsgegevens.nl/documenten/normuit...

While this ruling does not specifically only use the ePrivacy directive (it is instead based in GDPR), laws do not exist in a vacuum.

nikanj2• 2 years ago

Malicious compliance gets the website two benefits: 1) Annoying the customer enough with the popups might net a permission to track from an user who originally did not want the cookies 2) Making the cookie banners as frustrating as possible increases the political pressure against the EU, hopefully leading to them repelling the anti-tracking legislation

There's no upsides for a website from providing an easy "Never track me" button, or just not using analytics cookies - you don't have to put up cookie consent banners for technical cookies used to save e.g. light/dark mode preference

blkhawk2• 2 years ago

The issue is also that the cookie banner has become a meme for non technical "deciders". That means even sites that do not track you will have the banner.

shmeeed• 2 years ago

Do you have an example for such a site? Where does one even find a site without tracking nowadays?

How is such a banner even supposed to work when there is no choice for the user to make?

I mean, someone has to make that banner, so it's quite a way from the rash decision to its execution, where at any point (preferrably immediately) someone could and should step in and say "we are not required to do that and we should not spend any money on it". In my experience, non technical deciders are often sadly under-advised, sometimes because tech people who might know better fail to communicate even very simple facts like in these in an understandable way.

thinkingemote• 2 years ago

I've come across a few websites that have cookie controls that don't do what they say they do when I manually examined them. E.g. still using analytics

Are there any tools to check websites to see that they do what they say they will do? Or is it a manual thing?

dochne• 2 years ago

The Insites GDPR checker[1] does this.

[1] https://insites.com/free-website-gdpr-check/

binkethy• 2 years ago

Stop using Google Analytics and your need to place cookies and thus need for cookie popups vanishes.

Goatcounter or Plausible will do fine. Some decent frontend log parsing will also be a viable strategy.

Stop feeding Google your customers data for free.

cornedor2• 2 years ago

They mostly use it to monitor (and automate) how successful ads are. Plausible is not a drop-in replacement for such use cases.

friendzis3• 2 years ago

You have sales data for that.

fire_lake• 2 years ago

I love the “long press to preview” feature in mobile web browsers. But now all I get to preview is the cookie pop up! EU, pls fix.

natch• 2 years ago

Please stop using full justify text layout on your website.

rrr_oh_man2• 2 years ago

The future 2 years down is cookieless anyway.¹

I'm afraid that these banners, because these are called "cookie banners" and not "consent to us using your data and giving it freely to other companies banners", will just go away, people (& companies) will be happy, and the consumer stays a fool.

¹ https://en.wikipedia.org/wiki/Third-party_cookies

ben_w2• 2 years ago

The legal requirement behind them is about storing information about a person that isn't strictly necessary for functionality or law.

It remains even if "cookies" were replaced with "smart dust tracked into your house by cyber-ants".

rrr_oh_man2• 2 years ago

Yup, but it will be very hard to see/prove this from the outside.

Unlike cookies.

mrweasel3• 2 years ago

Maybe stop doing stupid shit that will legally require you to inform users that you're about to sell/share everything you know about them to 3rd parties?

I fail to understand companies that display page after page of cookies and tracking stuff for you to approve don't see the issue with their actions or the insanity of "allow us to share data with our 1500 partners". Does no one in these business look at this and go: "Hey, why do we need 50 different tracking tools" or "Why do we share customer data with over a thousand other businesses?".

When you actually read what these pop-ups says, then you understand why they are there, and why the problem with the laws isn't that it's annoying, but that it is not much more restrictive.

simonbarker874• 2 years ago

The vast majority of websites just want to know where their visitors are coming from and, if they are selling a product, some aggregate level of demographic knowledge to tailor their marketing efforts. They really don’t care about an individual or even small cohort and aren’t selling the data on.

Targeting advertising is sooo much more effective for small and medium sized businesses and actually makes many businesses viable in a way they weren’t in the past.

The ideal solution would be to find a way for businesses to get those insights in a way that preserves privacy at the individual level. Something like apples differential privacy system but web wide.

mrweasel3• 2 years ago

Targeting advertising is sooo much more effective for small and medium sized businesses

I'm starting to question that, but without any proof that just me rambling. Assuming that it works, I'd actually be fine with a site saying "Hey, just letting you know, we use Google Analytics to learn more about you, is that cool?".

The 1500 partners and 50+ trackers aren't numbers I'm making up, those are numbers I frequently see. Sure, you feel you need a tracker, I can easily enough say no to a single tracker. I can also understand a webshop needing to share information with their advertising partner, but not 1500 of them.

The law would never have amounted to anything if the reality was a limited scope of data sharing with a clear obvious purpose. It's the insane amount of tracking and data sharing that triggered all this.

fredski42• 2 years ago

The ideal solution would be to find a way for businesses to get those insights in a way that preserves privacy at the individual level.

Isn’t that what Mozilla and Meta are together experimenting with?

Earw0rm4• 2 years ago

Targeting, yes; retargeting, no.

So much user time is spent, for example, on a few big sites which have enough data within their own siloes (based on users' behaviour and topics of interest), they can target pretty well without relying on external data. The big video sites, social media, Amazon/eBay/etc.

And then there's a big layer of smaller sites who can inherently target because they're already specialist in nature.

The losers in this scenario aren't really the brands, they're big generic sites such as news media who don't have any way to acquire targeting information on their own.

matheusmoreira2• 2 years ago

It doesn't matter what they want. It doesn't matter why they want it. They are not entitled to this information. They should not be able to know anything at all about us without our explicit consent. We should not have to sacrifice our privacy and peace of mind so that businesses can succeed. If they can't succeed without surveilling us and selling us out, then let them go bankrupt.

compiler1410• 2 years ago

all this effort - easily defeated by adblock and antitracking tools xD

timeon3• 2 years ago

If they can't do business without selling users data, then they shouldn't be doing the business.

Earw0rm4• 2 years ago

Presumably the partners are brought in en masse via some third party brokerage/aggregator service.

It's not like a news site is selecting and managing 1500 different partners individually.

GJim9• 2 years ago

This is not an excuse!

I can only imagine the disbelief and laughter in court if a thief said "Your honour, it's not like I stole one car, I actually stole 1500 different ones"!

thn-gap2• 2 years ago

What I always find funny about this, is that the popup is presented with "We value your privacy", followed by "allow us to share data with >500 partners".

I wished that such statements had some value greater than nil.

ikari_pl• 2 years ago

but they DO put a measurable value on your privacy

latexr16• 2 years ago

When you actually read what these pop-ups says, then you understand why they are there, and why the problem with the laws isn't that it's annoying, but that it is not much more restrictive.

Worse, people (including on HN) actively blaming the EU for it. It’s like having a law mandating people are informed when there’s poison in their drink, then seeing people complain about the warning labels everywhere. The label isn’t the problem! As you said, if anything the issue is that the law isn’t aggressive enough.

ruthmarx21• 2 years ago

Worse, people (including on HN) actively blaming the EU for it.

The EU is exactly to blame for it.

The activity isn't illegal, and the EU didn't make it illegal.

What the *EU did* was make it so that companies engaging in that legal activity now had to disclose it in some way, and thee cookie popups are the best way to do that.

It's ridiculous to try and say the EU isn't to blame when they introduced and approved the legislation directly responsible for the popups.

joenot443• 2 years ago

Legislation by the EU is why the popups are there. It really is that simple.

unmole3• 2 years ago

It’s like having a law mandating people are informed when there’s poison in their drink

Why does the European Parliament[0] and virtually[1] every EU website[2] feel the need to poison drinks?

The label isn’t the problem!

The label is useless. See also, California's Prop 65: https://en.wikipedia.org/wiki/California_Proposition_65_list...

1: https://www.europarl.europa.eu/portal/en

2: https://european-union.europa.eu/

3: https://gdpr.eu/

ruthmarx21• 2 years ago

Maybe stop doing stupid shit that will legally require you to inform users that you're about to sell/share everything you know about them to 3rd parties?

Why? It's legal and extremely lucrative.

If it's really an issue, maybe the EU could actually limit these activities instead of just forcing sites to put a notification that they are attempting to engage in those activities?

GJim9• 2 years ago

I don’t know if you are trolling or so misinformed it is funny.

The UK and EU do limit those activities. They remain entirely legal providing you get explicit opt-in consent.

switch007• 2 years ago

Why would they stop?

Most users are now giving explicit consent to be tracked! What a dream! Before, they had to worry about legal grey areas!

Now the legislation says it's fine, as long as they click "OK". Which almost every user does because they are tired and annoyed by the pop ups.

Thank you legislators!

wkat424212• 2 years ago

Enact a law that requires a service to respect the do not track signal from a browser (currently entirely voluntary), and not store any tracking cookies, clear gifs or other trackers – and require that a site not “discriminate” against users who elect no tracking – basically – provide all functions to users whether they consent or do not consent.

This is indeed the obvious solution. I don't understand why the EU didn't mandate the do not track flag to be obeyed. I know some browsers already removed it but that was because nobody bothered to obey it. As soon as it can be mandated it will be useful and come back quickly.

Also, there was criticism from the advertising industry that the do not track was on by default but that's how tracking should work in the EU anyway: opt in.

By not doing this the EU keeps getting flak for the many cookie walls.

tgv2• 2 years ago

I don't understand why the EU didn't mandate the do not track flag to be obeyed.

1. Because the implementation is simply left open?

2. Because it's nearly impossible to verify?

bspinner• 2 years ago

How are cookie banners any better in regards to 2? Not sure what you mean by 1.

wkat424212• 2 years ago

The implementation in technical terms is left open yes, but they could have added a clause that settings like this (and not necessarily specifically this alone) must be respected if set. And in that case no other questions may be asked because the preference is already given. In that case the EU would have done themselves a huge favour because now they get blamed by everyone for the cookiewalls. Even though this was never the intention of the law.

What do you mean verify? If it's set then it's set. It gets automatically injected with every web request. It's not possible to make sure the user manually set the flag or if it was default, no. But in the EU the law says that tracking must be opt-in so this is perfectly good behaviour in line with the law.

redprince• 2 years ago

That there is no such mechanism can be explained pretty well with this extreme scenario:

- Browsers would come with the no tracking signal enabled by default (why wouldn't they?) so that tracking would become opt-in.

- Nobody chooses to be tracked.

- The whole industry built on tracking users collapses, namely advertisement

- Web sites who based their business model on advertisement go under

Because of this I bet that the industry is lobbying extremely hard for solutions that are maximally useless and inconvenient for the user. Unless the user "chooses" to be tracked of course.

In that vein, another proposal for stemming the flood of cookie consent banners comes from the German government and outlines a multi vendor strategy with very little technical guidance for centralized consent management systems:

https://www.heise.de/en/news/Consent-management-German-gover...

f1refly2• 2 years ago

- Browsers would come with the no tracking signal enabled by default (why wouldn't they?) so that tracking would become opt-in.
- Nobody chooses to be tracked.
- The whole industry built on tracking users collapses, namely advertisement
- Web sites who based their business model on advertisement go under

This seems like the perfect outcome to me, but I doubt we'll be this lucky

wkat424212• 2 years ago

Well yes but the websites will find suppliers of untracked (context sensitive e.g. car ads on a website about cars) ads, which will become more valuable since they no longer have to compete with tracked ads.

Companies like Google and Meta would lose their huge moat because they're the only ones with the kind of pervasive tracking network that make tracked ads viable. They no longer have a big advantage over smaller ad players. And them losing their huge market position isn't a bad thing IMO.

I don't think ads would disappear, they would just become untracked. Neither would websites. They will find a way.

troupo13• 2 years ago

I don't understand why the EU didn't mandate the do not track flag to be obeyed.

GDPR is a general regulation. It doesn't concern itself with browsers, or cookies. It's on industry to come up with a solution for specific technologies.

Oh, and for browsers they did. It's called the "Do Not Track" header, and the industry immediately sed it to fingerprint and track users.

By not doing this the EU keeps getting flak for the many cookie walls.

No. It's the industry winning the PR wall. The EU never mandated the cookie walls. It's the industry's calculated malicious compliance.

Well, in the end the industry might end up with EU strictly regulating every single technical aspect of this, but then the industry will cry about government overreach or something.

wkat424212• 2 years ago

Oh, and for browsers they did. It's called the "Do Not Track" header, and the industry immediately sed it to fingerprint and track users.

They do this anyway. They should have mandated this be honoured (or any other type of tech). If that were the case the browsers would have brought it back in short order.

The EU never mandated the cookie walls. It's the industry's calculated malicious compliance.

Exactly. And this is their fault for not regulating this properly.

tomw1808• 2 years ago

So, suppose I run websites. Actually I do and I have cookie banners on all of them - but only for users with EU IP Addresses.

Here's the twist: Good news is (for me), I can[1] track and do whatever I want with any other IP address. You visit my site? Well, thanks to nobody else I care about having GDPR-like regulations in place, I can make sure I'll not only track you down and display ads across all advertiser networks, feed them your visit in all imaginable and unimaginable ways, but I can do it in such a targeted way that it's borderline scary. I can literally use any information you gave me on my websites, like your name, your location, proximity to anything. And if I can't then the advertiser can. And in the case of that particular lawsuit mentioned in the article, collecting all user consents, their IP addresses, and basically which websites they visited, its like a gold mine for advertisiers. If it isn't one yet, it can be turned into one with the click of a button.

It's like that one case a few years back, where a health insurance company bought a bank and started closing bank accounts from people they knew were risk patients.

Simply connect the dots...

GDPRs promise was to make it harder to do so. It wasn't the plan to annoy the hell out of everyone with banners. The whole idea was to not allow tracking unless you opted in, because quite frankly, its scary.

And no, I'm not a fan of GDPR or overregulation. But in reality, there hasn't been any tech I've come across that really protects the non-technical internet users at large. There's uBlock and plugins, but not installed by default or built into standard mobile browsers. Apple might be close for regular consumers to stop the excessive tracking and companies like FB really hates them for it (for good reason, it costs them big $$). Google will never shoot their own foot by integrating non-tracking tech into any of their products.

So, no, my opinion is don't stop that darn annoying cookie pop-ups unless you also stop the tracking. If you stop the tracking, remove the cookie pop-up. As easy as that.

[1] I don't do it, but I could. I'm not a reckless psycho-marketer.

mediumsmart• 2 years ago

me and my 486 partners agree

pploug• 2 years ago

Hey, just some background from someone who took part in a couple of privacy compliance projects at large platforms in the past:

For companies doing this the right way, the banner was just the tip of the iceberg, loads of work went into ensuring compliance behind the scenes, so customer and employee data was not shared with 3rd parties unknowingly. In one case the list of 3rd parties went from +400 to about 70, this is in my opinion a win for privacy, the culture around sharing your data went from casual to cautious.

Secondly, the culture around trusting meta and google blindly with behaviour data changed drastically. Businesses became aware of how much valuable data they share with these platforms, which actually puts them at great risk, should you really give these platforms detailed data on what customers browse and buy on your site, so they can use the data to sell targeting for competitors, or direct users towards their own shopping platforms?

So, yes the law is not perfect, we all hate the banners, but at least what happened in those early implementation days when the banner became law, was a change in culture around how data was shared and a better understanding of the risk for the business of using 3rd parties.

nurettin• 2 years ago

The way to reduce cookie banners only depends on a small tweak by google. If you give people the choice between SEO and legibility, they will choose SEO.

kuba-orlik• 2 years ago

If a site does comply with the notice and consent requirements, it is not legally required to provide the service if a user declines tracking cookies.

That's simply not true. In order for consent to be valid under GDPR, the service should operate normally if you decline tracing cookies. Otherwise it's considered a "forced consent" and is not valid.

nuclearsugar• 2 years ago

I think its ironic for these pop-ups to frequently only offer "accept necessary" or "accept all"...

fmajid• 2 years ago

Global Privacy Control, basically a legally binding Do-Not-Track header, is already the law in California, I don’t understand why the EU is dragging its feet on making it mandatory to comply with.

Please stop putting cookie pop-ups on your website (2022)

Related Stories