Hacker News Reader

Comment by adamtulinius | Hacker News Reader

I'm stuck in a "please accept our gazillion cookies" loop. After managing preferences (which is implemented illegally, as I understand, since opt-out should be as easy as opt-in) and saving, I just get shown the same page again.

Too bad, sounded like a fun article.

View on HN

As an extra insult, the page shown then has the preferences (which you have to get to through several smokescreens, where only one path is correct) reverted back to the original "enabled". Like showing you a contract with fine print, then after you carefully read and crossed out stuff in the fine print, they tear it down and pull out another copy of the original one. Their communication thus being: "fuck your choice, we think exactly nothing of it, are we clear enough?"

I really hope some group of lawyers will start smashing the corporations with GDPR lawsuits with no remorse. I intensely hope there's money to be made out of this.

I'm currently making a list of bad implementations of GDPR, as far as I've observed I'd say that roughly 80% (low estimate) of cookie management systems are dark patterns, and that most of them are downright illegal.

Maybe I should write an article on that, it's a perfect case study.

A lot sites moved on to merge their privacy policies with their cookie policies, and they disallow access if you don't accept all of their tracking methods. How do you judge those examples? I'm not referring to those hiding the options to opt-out deep within their policies, sometimes even with text links, but those with absolute consent, i.e., either accept or move on.

My wording was indeed inappropriate (I'm not a native speaker), "dark patterns" are subjective but I'd say:

  - the less privacy-friendly option is a big shiny button, while privacy controls are behind a small greyed link
  - hiding the privacy options behind many interactions, basically making it as frustrating as possible to find the opt-out, I always find that amusing to read "We value your privacy" while I spend so much time looking for actual control over my privacy
  - all of the "partners" checked by default (non GDPR compliant), with no easy way to deselect all ("select all" is, however, usually an option)
  - bait and switch: when you go to partners' settings, checking the checkbox is actually requesting to opt-out, but to know that you need to read a long, grey paragraph with a small font size at the very end of the list
  - punishing the user by making it unnecessarily slow to opt-out, most of them are legitimate from my finding, but I've noticed a few fake loadings (zero requests in the network tab), it may simply be due to poor engineering though (Hanlon's razor)
  - redirecting the user from the original content after he opted-out, also feels like an intended punishment to me (but same as before: can be explained by poor engineering)

The list is non-exhaustive, but I wish I had better writing abilities to share my observations in a Medium article or something like that.

(Meta: please don’t use code formatting for lists; just use a paragraph for each list item, that way it’s readable. You can even use U+2022 BULLET • as the marker instead of - if the fancy takes you!)

Thanks a lot, I was wondering how to format it!

I think the most egregious one I've seen was "To opt-out of tracking cookies, click here to learn how to turn off cookies in your browser".

I absolutely hate how tumblr implemented their cookie policy. Doesn't GDPR forces vendors to have an easy opt-out from all button ?

In any case, i took the trouble from opt-ing out and archiving the page : https://archive.is/2hADS

No, GDPR forces vendors to have opt-out by default, with whatever opt-in they please. I stopped visiting tumblr because of that.

I wonder if it would be possible to create a uBlock Origin like thing that automatically opt you out of everything on a website instead of having to go three menus down just do click them.

Just install Cookie AutoDelete (or equivalent extension) in your browser. You'll be able to click 'Accept' in cookie notices with abandon safe in the knowledge that it doesn't matter what the site says or does, you're in control.

(Also disable 3rd party cookies in your browser settings while you're at it)

Sites have to work without.

Non-compliance issues aside, here's why I'm not convinced that blindly agreeing is a good policy:

Imagine that, by clicking "I accept", I agree to get my browser's fingerprint stored in their servers to identify me. For the sake of GDPR compliance, I can go back to their site at any time, revoke this consent, and they would actually forget me (crazy, I know).

The problem is: since I have already agreed to the tracking, I won't see the "Accept" button anymore. Sure, I can go there and revoke my consent, but why would I? I don't even remember going there the first time.

Agreeing to something I don't _really_ agree to is a bad idea overall. A better alternative, I think, is to start accessing cached versions of websites.

Also, accepting to tracking is accepting to tracking.

Cookies are but one method of tracking, so even if cookies are deleted the site may still successfully and thus lawfully track you through other means.

Yes, awful experience but the article is indeed great fun and very well done

Reply on news.ycombinator.com