Cookie Warning Shenanigans Have Got to Stop
troyhunt.com
troyhunt.com
Clicking 'no' should still allow people to view the website, but without placing any tracking cookies.
Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...
I think the real problem here is that the technical feature of cookies providing browser state is a poor proxy for what EU/DPA _really_ wants to regulate, which is privacy-related tracking.
There are tons of sites I've written which use cookies, but have no ads and perform no user-tracking whatsoever, not even Google Analytics. It is true that cookies are the _easiest_ (if not the only) way to do the other; but making "cookies" the thing that gets effectively "regulated"... I realize this isn't necessarily the intent of the regulations, but I'm suggesting it's part of what results in the situation troy mentions. There are very few sites that don't use cookies; there are or at least could be more sites that don't track you in a privacy-compromising way, to train the user that this is the same thing is just too much noise for the user to actually make any discernments.
"This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."
Of course, no website will ever tell you "Hey, we're using cookies to track you"; it's in most companies' (both legal consulting companies' and website owners') best interest to keep people ignorant. Consulting companies want website owners to be scared and buy legal consulting services, and website owners want people to think that the pop-ups are a result of stupid EU legislation and not because they are actually being tracked.
If I need to get explicit opt-in for "So, remembering your shopping cart when you come back requires cookies, that okay with you?" I'm not sure how much better that would be. It's still gonna be information overload "false positives".
But I think that is what the regulations actually intend. "We need cookies to give you: Shopping cart; search history; login to your account; whatever -- opt in or out to each one, you can still use the site just without those features if you go out."
A) That is actually fairly expensive to implement. B) I think it _still_ wouldn't accomplish the goals, it's still _way too much information_. Nobody cares whether or not you use cookies to implement a shopping cart. They care about things related to "tracking", especially aggregated tracking, and profiling. C) But you are exactly right that no company is ever going to tell you what you _really_ care about. Unless regulations make them maybe. These regulations were trying. Not there yet.
The biggest lie in most cookie warning popups is that you need to accept them for the site to function. It is often not true. Those are session cookies and you don't need to warn users about them, they're just allowed.
I didn't know this, and neither do any of the cookie warnings mention this. So like many people I thought the cookie law was the stupidest thing ever because like you say, you gotta have state. But the session cookies used to make a site hold state, those aren't considered tracking. When I learned about this little fact, it changed my opinion about the cookie law considerably.
As far as I understand it, the GDPR does everything and more than the cookie law was supposed to, so IMO it's about time we put that disaster behind us.
On the web, your approximate unique ID is your browser fingerprint. That can be used to join your activity to other activity. Your session cookie is your activity for your browsing session (or for users who never quit their browser, your entire computer uptime).
Think about it -- a cookie is information the web server gives to you; it's essentially a bookmark to your current position in the app. The server already knows where you were -- it saw you there!; it just doesn't know that you want to go back there on your next HTTP request.
Tracking data is data you give to the web server. Cookies are only one primitive to enable tracking. Cookies can be replicated by URL query parameters, subject to size constraints.
There’s only a handful that need them for logging in.
Most sites I visit I don’t want to interact with, I just want to read.
Silent cookies aren't completely banned by the GDPR/cookie laws, only cookies that aren't necessary to provide the service requested by the user. That's sort of vague, but I think mostly obvious what is intended there. It's pretty easy to operate within the spirit and letter of the law: Shopping baskets, load balancer cookies and login tokens are fine (provided you only use them for those purposes!), third party advertising tracking cookies are absolutely not (without consent). More info here: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
Lawyers have told me that you do not even need consent for Google Analytics, unless you enable the data collection for advertising features.
It appears to me that there's intentional bad faith misunderstanding from some, regarding both the cookie law and GDPR, in order to try and paint it as unworkable.
So, yeah, it's a mess. These "extra" warnings are contributing to user fatigue, I agree with troy hunt that users are just gonna ignore them all. I also understand why a small organization can say "Well, I don't really understand if we need it or not, the lowest risk thing to do is just to supply it." And there's no law _preventing_ you from supplying an unnecessary pointless cookie warning banner...
Very much this. None of the cookie warning dialogs (I've seen) mention this, and a lot of them use the dialog to complain about the law.
Something seems to have changed when GDPR came around though. The cookie warning dialogs before just had angry or condescending warnings with only a big "I accept" button, and otherwise too bad. But recently I've begun to see more and more warning dialogs that both have more honest wording about what they're about, as well as providing a "Decline" button.
IIRC there is something in the GDPR about explaining the privacy choices in clear language to the user, as well as having to provide an alternative if possible. If that's the case then it really does smell like intentional bad faith.
Although to be fair in addition to bad faith, I think it's also a lot of webdevelopers just not doing research what is exactly required and just parroting the scary story off each other.
But there's certainly a large part that just want to scare their users into accepting Google Analytics tracking. I'm curious about what those lawyers told you, though. Analytics data flowing through a third party widget that is doing the same on almost every site anywhere, sure feels like tracking to me. But maybe if you disable the data collection for advertising option, Google really won't cross-correlate that data for their own purposes. Even then, doesn't Analytics track the path users take on a single site too? For measuring "conversions" and such, as well as just detect whether people get "lost" on the site, or something.
Now certainly that's useful information, but it is tracking. Also you can get a lot of that information (and more) by just doing basic usability testing on real users. No tracking required and if you ask 10 people to try your site, you get 90% of the usability issues, with diminishing returns (based on some usability research I once read somewhere). But the information is much higher quality because you can ask them questions, ask them to perform tasks, actually look over their shoulder, etc. Tracking website users through analytics is just numbers and doesn't tell the whole story in very many cases, anyway.
Is there any legitimate and reasonably necessary purpose for third party cookies? And similarly is there any undesirably exploitative use of first party cookies? As I am not a web developer, these are not rhetorical questions.
"Legitimate reasons" is another. You can process personal data (use cookies) under that reason, and you don't need to ask for consent.
--- quote ---
Removed support for the expired Do Not Track standard to prevent potential use as a fingerprinting variable.
--- end quote ---
From the same website you link [1]: “Does anyone refuse tracking cookies? Then you still need to give this person access to your website or app, for example after payment.” (google translated)
[1]: https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne...
If a site makes its money from ads, on the other hand, the location of the visitors is irrelevant when it comes to taxation. The payments from the ad network will just be ordinary business income at the place the site is located.
I don't think the charge a fee model has a chance, except for a few large sites, until some sort of intermediate service is developed that isolates the sites from having to deal with taxes in a bazillion jurisdictions. Something like a Spotify for site access, where users can pay the service a subscription fee, and the service pays sites after taking care of the appropriate taxes on the user's subscription fees so that the sites don't have to deal with it.
Shopping baskets, load balancer cookies and login tokens are fine (provided you only use them for those purposes!).
Third party advertising tracking cookies are absolutely not (without consent).
Edit: guess somebody never integrated a payment provider :-)
It's hilarious how everyone has just forgotten that used to be a thing. The people on this website are literally the problem, you can't even conceive of a website that doesn't track every click you make across the whole internet, and you guys are the people building the new web.
Do you think TV adverts are placed randomly? They aren't. Different times of day have different value to different advertisers. TV ads are targeted based on detailed knowledge of audience demographics.
Do you think billboard ads are placed randomly? They aren't. Their placement is optimised based on the beliefs of the ad firms about who will drive past them or see them.
Do you think internet ads were placed randomly before AdSense? No, they were targeted by rough demographic guessed from the sites content just like TV and billboard ads were.
All that's changed on the internet is that targeted has got more precise and more sophisticated. But there's no bright line separating "generic" from "targeted" ads, like you imagine. And the better targeting is hardly an optional feature like the DPAs seem to imagine. It increases revenues which enables firms to provide new content and new features. Roll back the web to 1990s era ad techniques and now all the ads on generic sites like news or search with no clearly defined audience will be barrel-scraping "punch the monkey" animations, for those of us who remember that stuff.
Ads were always a thing, they're just going to be better targeted with more info.
There is no free lunch, so what this means is the 'no cookie' users may be exposed to more ads.
I understand the market dynamics are not working very well, but we have to remember that information provided is not free either.
What is not allowed is to withdraw services to those that want to exercise their right to privacy.
My stance is even more ridiculous: Deadbeats who can't afford hosting without begging, selling ads, or turning against their users, scale your site down to something that's cheap to host, or get the hell off the internet. Back to the amateur web of the 90s. It was fine.
Shouldn't people be able to choose what currency they want to pay for something in?
it's expensive and maybe non-viable for many websites. But it's not like all websites need to exist? There was a world wide web before cookies.
I like to think of that time as a great time too, but oh man so much we couldn't do.... I get what you're saying generally, but man I'd hate "before cookies" to be the standard.
We didn't have e-commerce before cookies.
The €0.00002 it took to serve that one page just because the user doesn't want to consent to cookie placement/tracking? Is it really that harmful?
NPR seems to do this just fine for GDPR reasons: Decline and Visit Plain Text Site
I mean, by your argument, all digital goods should be free, since it never costs much to transmit the bits.
I do love NPRs approach though.
So what can these - now shady - companies do? They probe the limits of the law, and try to keep their business model alive as long as they can. We need to wait and see. In my opinion, the most probable development is that European data protection agencies will start to hand out fines. Of course, the shady companies will fight them in court, and of course, they will lose. Then they will retreat a step, and try again with a little bit less intrusion into the user's privacy. Over time, courts will rule, and fines will increase, until the shady companies will give up in EU.
Then EU will essentially become free of tracking networks. It might take a few years, but I think the intermediate annoyance is worth it.
I don't disagree with you but I think it is more likely that these companies will just not let EU peoples use their sites at all.
One BIG fine (and you know they're salivating at the prospect of getting multi-billions out of Google and/or FB) and doing business in the EU becomes too much of a gamble for a company to justify the risks.
It might even encourage some more ethical alternatives, or some real attempts to solve micropayments.
As it looks to me, they are responding back by trying to push through articles 11 and 13 so that they can then all switch to paywalls. A paywall for a news company is practically useless as the internet currently stands as any major story 1 makes gets linked to and paraphrased by dozens of other news agencies within minutes. Why would users pay for a news website when they can get practically the same thing at a free one that did not work to come up with the story. And article 13 is to prevent 1 user who does pay for a website from copying the entire article and pasting it in a comment (I see that and archive/outline links all the time here and on reddit).
Don't like cookies? No one is forcing you to visit a particular website.
I also feel like tech companies could adopt an open standard for cookie acceptance preferencesin web browsers, but they're afraid to lest they be forced to deal with even more regulation later.
to decide whether to track your users? through third parties? for advertising purposes?
Why? Why do you get to decide and not the users? I'd rather you didn't!
It really honestly does surprise me the amount of crap Americans are willing to swallow when it comes to advertising methods, or even just profit in general. Your whole society is rife with abuse. There's robo-calling, giant billboards, attack ads, pharma ads, ads or contests that are literally scams, just a few from the top of my head. Probably more I don't know about (ads to target children? there is NO good way to argue that children "should" be targeted by ads).
It's a small miracle you managed to push a mandatory "unsubscribe" link underneath mass email lists. I suppose it's mandatory because given the attitude to this kind of abuse I doubt they would put them there voluntarily.
Also, you've seen what happened to the online ad industry without this kind of regulation. If you don't make rules they're going to push it as far as they can. It's gotten to the point where people recommend adblockers for security not getting rid of annoyance. Or for saving about 95% of your mobile data plan surfing sites. Did you ever notice the most profitable ads pay for the shittiest content? The system isn't even working.
However I think websites should be able to block access to anyone they want. It doesn't seem fair to force websites to serve an audience if they do not wish to.
I'll take freedom any day over someone telling me that they know better.
Obviously you cannot do whatever you want to a person who physically enters your business. This is a facile point. The same is true of websites: simply because a person navigates to your website, you do not automatically have the right to place tracking cookies into their browser.
For a privacy advocating party it would suit them to not log anything and be very clear about that.
Source: https://autoriteitpersoonsgegevens.nl/nl/over-deze-site/cook...
No! It doesn't. Viewing a website isn't anyone's god-given right. The tracking cookies are part of the business model. If you don't agree with how a business makes money, stop patronizing them.
If this is serious, look for companies to just block all traffic from The Netherlands. Why even bother dealing with the hassle.
Some business models are predatory societal negatives and should be done away with at a government level of respecting individual rights. Behind-the-scenes tracking and data brokering are in that class.
GDPR seems like it could evolve quite quickly, and sort of fork a bit here...
Also makes me wonder, do they have to have access to the whole site?
This feels like a war on cookies, and there are bad things done with cookies, but I'm not sure if they're fighting on the right front long term here.
If people simply just say yes all the time / don't know, not sure we're making progress.
Problem is will-full misinformation. It's a war on tracking cookies, not session cookies for login state, etc. But all the cookie warning dialogs make it sound like it's a war on all cookies no matter what, so "just accept because otherwise this site won't work, also <insert clueless condescending remark about the cookie law>" (really, the amount of sites that use this dialog as a misinformation soapbox to vent against not being able to track their users...).
It's mostly small and medium sized firms that show the cookie warning out of fear. That's completely the opposite of what I want as a consumer as well as a small-time webmaster.
EDIT: Just to be clear: spiegel.de never shows a cookie warning even if visit with a fresh browser. You can opt out by visiting their privacy page [1] (in English).
[1] http://m.spiegel.de/extra/what-we-do-with-your-data-a-121194...
The money and time could have been a lot better spent on international awareness campaigns arming consumers with more privacy knowledge instead of expecting website owners to shoulder the informational burden (because those orgs in aggregate have no core incentive to treat user's privacy as an inherent good).
The GDPR is unlikely to be overturned, and there are plenty in the EU who are eager to enforce it. Just because it's not being enforced right this second doesn't mean the law won't catch up to offenders.
Especially if Margrethe Vestager replaces Jean-Claude Juncker as president of the European Commission, you can expect a ton of action on this front.
My prediction is that these Cookie shenanigans will be ruled as illegal according to GDPR, and then they will disappear.
The results of the legislation -in regard to cookies- are inconsistent, annoying, unevenly enforced, create a moral hazard and two-tier system, and I presume have negative overall utility.
This is why I do not consider the law to have been written with good intentions. The intentions were claimed to be good, but I don't see the lawmakers having had put in the necessary effort to ensure privacy improvement. Nor admit there are shortcomings to the legislation that need either fixing, or perhaps scrapping the legislation. Did they really intent on exerting enough effort to write the legislation well? To shoulder blame if it does not work out? To take the responsibility? Or to shore it up as situation develops?
Right now I perceive the cookie warnings to be merely EU's advertising banners - "Heeey, this is EU taking care of you!" - plastered all around the web just like banner ads used to be plastered all over the web. Morally the same - pompous self promotion, except paid for with legal rubberstamp rather than money.
See Art. 7: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."
See Recital 32: "Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data ... This could include ticking a box when visiting an internet website ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent."
If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach).
Please feel free to downvote this if you don't like it, but I'm merely telling you what the law says. If you disagree factually, I'd appreciate a comment though.
Exactly this. Basically what the GDPR says is: if your business doesn't require the data, you cant use it without the user's consent. And data used for better advertising is NOT essential to e.g. a news site.
What's more, the regulation syas that you can NOT simply say "accept or leave" in that case. You then have to provide the service to the user without storing that non essential data. You can't provide a service, even for free, that you condition on storing data not essential for that service. There is no "if you don't like it, leave" clause.
Basically: spiegel.de has to be prepared to show their news to anyone, including those that do not wish to be tracked by their ads. Right now we are in a period of denial where site owners believe they can have these "By entering you agree to..." banners. Once the first large fines are handed out, It'll be fun to watch.
In that case, it's simply not consent, so instead of collecting void consent, which will get you into trouble, you should display a simple privacy notice that links to your privacy policy, where you explain your legitimate interests. That is what you have to do for first-party tracking, for session cookies than can be associated with a specific person, and even for log files that contain IP addresses.
If you offer a free digital newspaper, you may argue in court that your ad-funded offering could not exist without third-party advertising and analysis tools, and that your legitimate interest (secure funding via ads) aligns well with the interests of the data subject (read free news). National Data Protection Authorities have suggested that they consider valid consent necessary for third-party tracking, so it's a somewhat bold strategy, but in the end, the ECJ will have to decide.
Until the ePrivacy regulation arrives with some clarifications, we're effectively living in a limbo. Cases of blatant abuse aside, I doubt that we will see waves of draconian fines regarding third-party tracking until then.
Recommended reading: https://ico.org.uk/for-organisations/guide-to-data-protectio...
> 4 It shall be as easy to withdraw as to give consent.
If you prompt me to accept on every page then you must also prompt me to decline on every page, otherwise you fail this test. Hiding the option to withdraw consent in some random settings page is obviously not as easy as clicking yes when prompted.
Most sites have already created all their tracking cookies before the user even sees the opt-in form too, which isn't compliant with the GDPR or the old cookie law.
If a site doesn't wants to cover itself all the time with a popup regarding cookies, then they're not allowed to cover itself all the time for users who never consent to tracking.
You can use absolutely no external tracking and be GDPR-noncompliant. In fact, an Apache web server running the default test page is technically noncompliant. Everyone loves to jump to the tracking ads and data selling, since they are easy targets, but the scope of the law is much broader than that.
Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes?
These days I just block all third-party cookies, which solves most of the problem.
>"She goes apeshit whenever a pop-up window comes up. And one time, she paged me because she got a message about accepting cookies. She was all freaked out because now she thought she was being charged for actual cookies."
https://local.theonion.com/getting-mom-onto-internet-a-sisyp...
I don't get any popups or cookie notices on visiting HN or several other sites. It's not like it's a fundamental need to set hundreds of tracking cookies on a visitor's browser to show them a website.
> Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes?
Wait, what? There are such solutions. GDPR, and the "cookie law" before it, don't "require" any popups.
They allow cookies, 1x1 pixel images, browser fingerprinting, Flash supercookies, browser local storage, etc. without any need for stupid popups... as long as that's required to implement the site's functionality. Consent for these things is implied by the user's use of the functionality (e.g. game scoreboards, saving word processor documents, keeping track of a user's shopping cart, etc.).
What these laws do require is that handling such personal data without such implied consent, should require explicit consent. This acts as a disincentive for sites who want to continue spying on their visitors, by forcing the UX to be more annoying and dissuade visitors from staying.
> the only practical significant impact is that browsing the web has become more annoying.
Sounds like the dissuasion is working. Hopefully that is causing spyware sites to receive fewer visitors (and perhaps revenue), and potentially rethink their decisions.
Most people hate the UX change but don’t care about the privacy so probably a net loss for the EU.
https://cliqz.com/en/magazine/study-google-is-the-biggest-be...
It clearly isn't. Vast majority of people (me too) are trained to automatically accept whatever cookie BS the website asks for, just to get rid of the popup as quickly as possible and get to content. And no, these "spyware" sites such as reddit.com or bloomberg.com won't switch to non-tracking ads to get rid of the popup.
We have seen nothing of that, contrary, tech companies have improved our life's immensely, for free, and in my opinion, are the one of the biggest driving force towards improving the future. Data is not just being collected for advertisement, tracking, and evil purposes, but is a very important asset in the development of products.
Furthermore, historically it was governments, not companies, that were abusing private data for nefarious purposes. Yet there seems to be no effort to stop it happening from that direction? Well of course not, its way to useful, and you'd be a fool not to use it, but companies are 'bad' trying utilize it...
Have you been asleep for the past decade? Pervasive tracking and spying on consumers has been the topic of discussion even long before that.
EU countries have had data protection laws since late 90s, and the web companies have taken a collective dump on them. So now the EU has created a single law that is quite sensible (if not without flaws) which says: you can only collect the data you absolutely require to work. If you collect other data and especially if you send to third parties, you must ask the person using your site if that's ok.
Oh my, did web company do to deserve this? Oh, I don't know. Open TechCrunch and opt out of ~300 tracking, data collection and ad companies, and tell me what they have done.
i'm asking because my government knows everything about me: my private and public IPs, what sites I visit, my comments on those sites, how old I am, how often I go downtown etc etc etc
It should be straightforward to show quantifiable harm to people’s right to privacy. You could survey a large number of people to ask if they would be OK with having their online habits monitored in detail by unknown companies (whose websites they didn’t even visit) for the purpose of targeting ads to them at later dates. If close to 100% of respondents say this is an invasion of their privacy, then that’s what it is. You could also do some more technical research to work out how many times per week people’s privacy is invaded in this way. You’d probably arrive at a very big number, rising every year.
The rules are actually only concerned with tracking cookies. Session cookies and user preference cookies aren’t within its scope. They are still perfectly acceptable to use without explicit consent from the user.
The law talks about information that can be used to identify a person.
So a cookie such as "gdpr_response=ok" has ZERO effect on GDPR compliance.
I should mention that I essentially browse this way due to a few privacy add-ons I use and it is absolutely infuriating having to deal with these pop-ups even on sites that I've already visited.
I, for one, am happy that bullshit like “hey, we send your data to 244 trackers uncontrollably” has become visible and is being called out.
I mean, visible only in the EU.
Dark patterns and site-blocking are anti-GDPR, so I’m hoping for some heavy fine across the board. And, hopefully, if not the end then curtailing of the intrusive and tracking cookies, ads etc.
These laws force people who are attempting to take advantage of non-technical users to either stop it, or do so in an obvious way that lets even non-technical users see that /something/ is up.
It's good, I like it. It's driving social progress, as truth always does. I'll get downvoted for expressing that opinion here of course. Too many american software developers who want to inflict their freedom on others I guess.
Downvotes may begin now.
Of course, on HN I have to acknowledge that half of the users on this website get their paychecks from invading the privacy of the general public. If you fall into this category: what you're doing has always been wrong and now the law is catching up to that.
It's also quite ironic that the EU now cares about privacy considering that a decade ago they passed the Data Retention Directive. I guess privacy didn't matter then, huh?
This is a very astute observation, and is causing some angst among parts of the European population.
However, this seemingly conflicting behavior has a cultural rationale behind it.
In general, Europeans see government as trying to look out for their best interest, while they view corporate power with large skepticism. "Americans" hold the complete opposite view.
So when the governments in the EU tout sheepish clichés like "think about the children, catch terrorists, pedophiles" etc, by being able to retain data for those purposes, the public falls flat and lets Orwellian laws pass without much fuss. Because ... "the government is our ally, and we trust it, the claims, and that the data will be managed responsibly".
However, when corporations do the same, there's more fuss.
The one european people that is of sane mind here is those of germany, due to their history. Unfortunately germans are also deceived by their government through back-room deals on EU level, and with the national security excuse, when it can be kept out of the public eye; effect same as the other EU nations. The good thing however is that the german people are not as gullible as other parts of europe when it comes to surveilance and tracking, and they do tend to kick up a big fuss when this sh*t goes down. So they act as a sort of moral calibration for the other nations, such as mine.
Understanding this fundamentally different mindsets between US and European citizen will hopefully help explain quite a lot, for those who didn't already know this. This is why "american" views are insane to some europeans, and why EU is naive/retarded in the eyes of the US. (very generalized)
Most sites have a simple 'Reject All' which I definitely use all the time.
Oath and it's sites are the devil incarnate when it comes to implementation and they deserve to be slapped down.
Yes. I'm not even European, and I'm perfectly fine with this.
Ask me to track me. If I like you, your web site, or your content, then sure. I'll give you a little personal data.
just because we don’t currently have solutions doesn’t mean they aren’t out there. i guarantee my 5 second developer definitely not UX idea is the LEAST that a real UX professional will come up with, when pushed
*EDIT: and yes this kind of cookie is okay with GDPR because it’s not tracking a “data subject”... it’s maybe a broad timestamp (the day you first accessed the site), and a counter for the number of articles/site loads... you don’t have to ask for this permission, because you can’t track someone with it
This way, no information about the client is sent to the server at all.
>Ask me to track me. If I like you, your web site, or your content, then sure. I'll give you a little personal data.
This should be a setting you choose in your browser and the rest of us (> 99%) should be able to ignore.
We could even call it "DNT", for "Do Not Track".
But the little personal data you mention is not only given to them but to 224 different ad networks. Most of them make it impossible or difficult to opt out.
You are asking them for the website. They are asking for your data in return which your browser provides because that's how it is configured. Your browser could simply refuse at any point.
All those settings in browsers that let you control access to your camera, location, etc aren't part of legal compliance, they are just there because Google, Mozilla, sometimes Apple and Microsoft all agreed this is a good best behavior to avoid getting regulated on again.
If the EU started mandating an opt-in system for camera access you can bet most websites would start dumping pop up banners about it regardless of if all the browsers supported the regulation already just to avoid culpability.
"At a cookie wall, website visitors have no real or free choice. It is true that they can refuse tracking cookies, but that is not possible without adverse consequences. Because refusing tracking cookies means that they cannot access the website. That is why cookie walls are prohibited under the AVG."
I find this fascinating. Is there really not a free choice to simply leave the website? A paywall is surely legal. But it is illegal for me to "pay" using something other than money.
Am I allowed to offer users additional functionality in exchange for access to their data?
[0] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne...
The warnings accomplish nothing. It's just another nag screen. It was a bad idea when it was thought up and it still is today. It's an attempt to seal a wound (misuse of personal data) with a piece of string. It wasn't even a half decent band-aid.
http://www.privacy-regulation.eu/en/r43.htm
> Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
In other words, people aren't allowed to sell their data in exchange for services. I suppose the argument is that people are really bad at valuing their own data. They don't know how it can be combined with other datasets and how it might be resold and repackaged and never go away. There are other things people can't legally sell, such as organs, votes and sex, so it's not an entirely brand new idea.
Consumer protection laws regularly put limits on the freedom of contracts between companies and consumers. A rental car agency can’t give you a rebate for renting an unsafe car.
The fact that no money changes hands doesn’t change this. If you’re offering free taster portions of bread to passer-bys, you can not use lead as an ingredient. Neither being free, nor putting up a sign with the list of ingredients will change that.
GDPR is terribly vague and creates a barrier-to-entry. Draconian measures may hurt large companies, but they threaten smaller ones.
EU is saying they don't like Silicon Valley behemoths' power but they want valley-like companies in the EU (sometimes even calling for a 'European Google', as if you could just pass a rule to make that happen). And then they create laws that make it easy for the large players and harder for their competition.
Everyone here spent a great deal of money for some compliance boo-hoo. FAANG has your consent and upgrades their policy, done.
To me, this seems like ineffective and incompetent lawmaking, no matter if the intentions were sound.
If you had you would know that the regulation isn't there to nail companies from other regions. Anyone doing business with Europeans is subject to the same rules of the game, and that naturally also includes European businesses.
These cookie notices are also almost invariably violating the GDPR. There must be a clear choice, and if you choose not to be tracked, you must be able to still use the service unimpeded; then there must be a clear and understandable description to the intents of data collection; and lastly, the opt-out choice must be accessible equally simply as the opt-in choice (none of this "Accept" vs. "Manage options" bullshit.) For example, one of the very few larger pages where I've seen it done right is Wikia/Fandom.
> Am I allowed to offer users additional functionality in exchange for access to their data?
In a way, yes, but you're phrasing it in a roundabout way. You can ask for personal data to enable additional functionality that requires that data. For example, you're allowed to ask for location if you want to show them some offers nearby. They are allowed to refuse and in that case they cannot use the particular function that's tied to their realtime location. If they've given permission to use their data, you, however, are not allowed to use that location data for any other purpose other than what they explicitly agreed to and what's actually needed to provide the service. I.e. you can ask for the location to provide a location based service but you don't need their age and income data; also you cannot use their location for other purposes they aren't informed about. And you certainly aren't allowed to sell it to someone else without an express permission.
In short - you need a clear and explicit permission for specific purposes, and you cannot deny access to those parts of your service that don't require personal data.
So, what you're telling me is that GDPR actually limits my rights as a private citizens because that think I'm too stupid to make my own decisions? I guess I shouldn't be surprised.
Smaller sites don't have the resources to curate their own ads, that's why they use ad networks. If we are strict about this then this rule will eliminate small sites while tightening the grip of the big sites on the net, because they have the resources to adapt.
That's why you ask people. If enough people agree to paying for your content with their data, your site lives on.
If too many opt to not pay for your content with their data, your site dies unless it can find another way of making money, such as subscriptions.
Yes, it absolutely can mean that the giants will expand and lots of small sites that use ad networks will die.
It's just that there's too many people doing that for the overloaded DPAs to take care of them all.
Look, it's even a real thing: https://en.wikipedia.org/wiki/Alarm_fatigue
At least keep it in Europe, use the IP to geolocate, let the EU users deal it.
Some companies have outright banned EU traffic, sounds like only showing the banners for EU IPs seems ok.
So geolocation is not a satisfactory option.
In the vast majority of cases that's not how laws actually work from one nation to the next. That isn't how legal jurisdiction works. If it were, any nation could impose its laws on any other nation at any time.
> So geolocation is not a satisfactory option.
In fact it is. I can safely disregard the EU and nearly all of its laws including GDPR and privacy laws in the EU. I don't operate in the EU, either physically or in terms of hosting. They have no access to me, my finances, my business, and have zero jurisdiction over me as a US citizen. I'm bound by US law, not EU law.
I can do anything I want to with data from EU citizens that visit my US-based services, so long as I obey US laws. The exception to that is if I need to operate in the EU, then I should comply with EU law.
The EU also does not rule China (1.4 billion people, world's second largest economy), for a strong reference on how the EU's laws don't actually apply globally. While you're in China, as an EU citizen, you are not governed by EU law, you are governed by Chinese law. Give that a test run, you'll find out instantly how it works. If you visit sites located in China, they're going to obey Chinese law, not EU law. Millions of Chinese sites are not concerning themselves with GDPR compliance, because it does not apply to them at all.
There are Polish speakers that aren't Polish citizens. Translating to Polish doesn't prove an intent to sell to Poland any more than having a page in English implies trying to sell to England.
There is nothing in the law that says that translating into Polish or another language common in the EU results in GDPR being applied. The actual law says,
"This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
the monitoring of their behaviour as far as their behaviour takes place within the Union."
That's it. "Offering goods or services" can be interpreted in a variety of ways, but translating into a language doesn't mean anything. People speak German in communities all over the world. Even offering payment in Euros isn't necessarily targeting the EU. Plenty of EU expats have Euro accounts, particularly those based in Africa and Asia. So it's perfectly normal to have a German language site, selling products in Euros, targeting Germans in Shanghai and have that not be in GDPR scope. However, an English language site, selling in US dollars showing Berlin apartment listings targeting American expats in Germany -- that would be in GDPR Scope. The language and currency have nothing to do with it. It's the intended audience that matters and that can be often determined by the product/content being sold/delivered.
The point of my rant is that too many people are reducing GDPR into some ridiculously simplistic terms such as "can't use euros, can't use an EU language" or similar. However, the actual reality isn't so sophomoric.
GDPR actually applies to companies which are doing business in the EU and storing personal data of anybody who resides in the EU.
Completely false. Citizenship has nothing to do with GDPR. It's all about location.
An EU resident visiting the United States is not covered by GDPR while in the United States. An EU Citizen living in Los Angeles is not covered by GDPR. A Tunisian illegal immigrant in Berlin is covered by GDPR.
The 2012 draft of GDPR founded jurisdiction on the passive responsibility principle, which, while highly controversial, would, in fact have applied GDPR protections based on nationality of the person and not the location. However, that's not in the final version of the law. In Article 3, "resident" has been replaced with "data subjects who are in the Union."
"In the Union" means, inside the European Union. Which means the law's protections do not extend to those not inside the EU. The jurisdiction is unambiguous and crystal clear. Not a single word in Article 3 suggests that a Frenchman in Peru is covered by GDPR. Which means that your statement "wherever they happen to be at the moment" is false.
Here is the actual text of Article 3: https://gdpr-info.eu/art-3-gdpr/
It seems that there still exists an incredible amount of ignorance about GDPR. It feels like people are reading analysis from others who are reading analysis from others and very view have actually read the actual law themselves. Or worse, people are using their memory of years-ago discussions about provisions or language that isn't in the actual final regulation and contributing to this completely wrong narrative such as "The law doesn't just apply to pages being served to the EU, it applies to pages being served to EU citizens, wherever they happen to be at the moment." That's 100% false. It's the exact opposite of the truth.
The fact on territorial scope is that GDPR covers an identifiable natural person inside the EU. It doesn't care about nationalities. It only cares about location. Geolocation is absolutely a satisfactory option, because an EU resident, citizen or whatever sitting in a Starbucks in Seoul, is not covered by GDPR. No matter how badly people might wish that to be false, the words in the actual regulation say otherwise.
From [1]:
Recital 23 provides a further clarification for cases where it’s unclear if a firm offers goods and services to EU data subjects:
Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
French Guinea no longer exist (it is now the (non european) Republic of Guinea). Confused with French Guiana (where Kourou is located)?
> And the Dutch DPA’s guidance makes it clear internet visitors must be asked for permission in advance for any tracking software to be placed — such as third-party tracking cookies; tracking pixels; and browser fingerprinting tech — and that that permission must be freely obtained. Ergo, a free choice must be offered.
Neither cookies, nor tracking pixels, nor browser fingerprinting are software. Your web browser is software. The server side runs software. These are data.
It seems pedantic, but I think it shows that the lawmakers have an underlying misunderstanding of how tech (and the world) works.
To make an analogy, cookies and tracking pixels are akin to license plates. I think the authors of this law thought they were more like cellular GPS beacons.
It's one thing to say, "no installing a device which actively communicates home on your visitors". It's quite another to say, "No remembering your visitor's face unless they tell you it's ok."
> Neither cookies, nor tracking pixels, nor browser fingerprinting are software. Your web browser is software. The server side runs software. These are data.
> It seems pedantic, but I think it shows that the lawmakers have an underlying misunderstanding of how tech (and the world) works.
No, that's just TechCruch's summary. This is the Dutch DPA's actual guidance: https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...
It's in Dutch. I would not be surprised if "software" has a slightly different meaning or connotations than in English.
And even if it doesn't you don't need a precise command of technical jargon as a practitioner would use it to have a good understanding of an area. The meaning of TechCruch's translation was perfectly clear to me, and better than alternate formulations I can think of that avoid using "software" to refer to cookies. Maybe they should have just government-jargon and called them "tracking cybers."
The tracking that is akin "remembering a face" is user agent and ip address tracking.
In my mind, a store that uses facial recognition software to track my movement within the store and purchasing habbits is still incredibly creepy and highly invasive of my privacy.
If I don't want to be tracked, I can choose to shop at a different store. But I can't live in a system of underground tunnels.
In Germany, they actually demanded an "Internet eraser" (https://www.heise.de/newsticker/meldung/Digitaler-Radiergumm...) [so ridiculous I don't think anyone ever attempted to translate] so content, mostly images, would somehow 'automatically expire'. Never worked, images could be screenshotted, etc. etc. Said this was "highest standards made in Germany". Never made sense, never took off.
The US came up with Snapchat.
You'll see malicious or smart-aleck compliance with any rule that a group doesn't agree with or when they feel that it personally spites them.
The core issue is that the ~150 companies of the Oath network will effectively go out of business when they comply with GDPR. So now they try to play some games, until the fines handed out to them become too large to sustain in EU.
I had remembered that I had installed a "Random User-Agent" plugin in Chrome, with privacy concerns in mind. Sometimes it sends a user-agent that causes a site to send me a page that can't actually be rendered by my browser, so I have to turn it off on some sites.
But I was curious to see what amiunique.org would make of the various random user-agent strings that the plugin would send it.
Ironically, the plugin seems to break the amiunique.org site, I can only get a whitescreen or occasionally a spinner forever, unless I disable the "random user-agent" plugin.
Not sure what to make of that.
The fact that your site uses cookies is irrelevant, and there's no need to tell anyone. However! If your site stores personal information (directly or via a partner), you need to have a valid reason.
The definitions of "personal information" and "valid reason" are, fortunately, not exhaustively enumerated in the GDRP. I say fortunately, because if they were exhaustively enumerated, Facebook would find a loophole, and the whole law would be worthless.
One of the 'valid reasons' for storing personal information, is a clear, freely given, consent from the user. This is the one that all the tracking companies want to get, because they think it allows them to do shady things if they can trick the user into pressing 'OK'. But if the user was tricked or coerced, the consent was not really clear or freely given. Hence the sort of court rulings that the article mentions.
So, if you store a cookie for your domain saying 'tracking_consent=false', this is probably not personally identifiable, so you can just do it. No reason for any banner.
But if you track the 'browser fingerprint' that Troy Hunt is talking about, without consent, you are probably in violation of the GDPR. Even if it's not a cookie. And you had a cookie banner.
> The fact that your site uses cookies is irrelevant, and there's no need to tell anyone.
Let's not forget the infamous ePrivacy directive, e.g. Recital 66:
"Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. ... Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user."
Of course, the relationship between GDPR and the old ePrivacy directive is rather ambiguous.
On the same device, I consume news of the same sites from multiple sources or embeded browsers: Facebook, Google News, Chrome...
I don't want to go through the hassle of opting out of tracking from every partner of the very same site I visit. Now multiply the task by every site you visit and every device you use...
I now even suspect they intentionally remove the preference cookies so that you get tired of opting out
Thought experiment: What would these "fingerprints" look like if on given day everyone were to turn off JS and set their user agent string and other headers to the same values?
The author writes that if I visit amiunique.org I "will almost certainly be" informed that I am unique.
Well that is not what happened. According to their test, I am "almost" unique, but still not unique. What the page says is that we can almost certainly be tracked. Does not say whether this would still be worth it to an advertiser.
The question is not "whether we can be tracked". Of course we can. Most people using the computers on the internet, in the same way as people using telephones on a landline or cellular network, are not expecting to be "untraceable".
The question is how easy we are making it for anyone to conduct tracking -- not just those who are properly authorised to do so -- and for what purpose are they collecting this information.
I think the logic is "Yes, you're right, many regular people can't make freely informed consent for that sort of mass tracking... so the solution is to stop tracking people"
Incidentally, with all of the Organic / GMO-Free / et all certifiers out there, would a privacy badge be the way to go, or is that backwards thinking in the way of early internet site badges?
They couldn't possibly know what site A or B respectively does with a user's data. That differs from site to site.
It is therefore of course the obligation of each site that directly or indirectly works with user PII to explain to its users how that specific site is using the data.
The former does not require consent. The latter does.
For example, the CAN-SPAM act requires the words "SEXUALLY EXPLICIT" to accompany messages with sexual/adult content. A tracking cookie's name can simply have the word "tracking" in it, which would trigger a browser to throw up a consent pop-up. A long, useless message from the site about why the user should click it could be provided to the user in a number of ways. The law doesn't even have to specify that
ps. If I ever mention that the article had a ridiculous cookie warning system that I didnt bother getting through (eg. The techcrunch gif in the article), or that the site is just plain broken from EU, then I get downvoted to hell.
pps. If I really wanna read something, or need to for work or whatever then I use outline.com
I just use this Firefox add-on to hide most of the popups: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...
The true monster was the intrusive firewall/AV all along.
You don’t get served any tracking cookies until you agree.
This fulfills the explicit consent requirement of GDPR as well as the requirement for people to be able to use your site even if they don’t accept cookies.
We get much less analytics then we used to - many people just ignore the cookies bar, either knowingly or just because they don’t notice it. But it’s totally worth it.
I hope the EU starts fining non-compliant (i.e. 99% of) sites aggressively, specifically those that pretend to care about your privacy, but don’t really (“Agree” button only).
In my experience, the option is usually hidden (look for “options”). But a surprising number of sites do actually comply and make this not prohibitively obscure.
Meanwhile everyone else doesn't understand these pop ups, doesn't know anything more post GDPR, and they just roll through them and get tracked just the same.
In effect we have big annoying pop ups and little seems to have changed. If we care about the ideas behind GDPR, I think we have to recognize that it may be failing miserably in practice.
I don't buy it, and was the main point of this latest GDPR clarification [1]:
> "Cookie walls that demand a website visitor agrees to their internet browsing being tracked for ad-targeting as the “price” of entry to the site are not compliant..." [adding] "...There is no objection to software for the proper functioning of the website and the general analysis of the visit on that site... sharing of this information with 3rd parties is only allowed with permission."
Basically the mere presence of a cookie warning (regardless of the specifics) should not be signaling to the visitor "[agree] to enter" or "[agree] to enable features". They should be signaling "[agree] to us sharing some identity elements and browsing behavior with 3rd parties, mostly for ad targeting; or [decline] the aforementioned; either way, welcome to the site."
Once users realize they can still enter the site if they click deny, their (automatic) choice will better align with their actual preference.
[1] https://techcrunch.com/2019/03/08/cookie-walls-dont-comply-w...
It lead me to the idea that it might be interesting to build a bot that builds a “consent graph” which will tell you exactly how many (and perhaps draw connections visually) different companies you have to provide consent to from a given advertiser/company/website.
This is a pretty interesting argument against the clumsy rules of GDPR which exist, in my opinion, practically entirely outside reality.
Those annoying cookie banners aren't actually GDPR compliant. GDPR mandates that consent should be freely given and should be opt-in, so forcing you to consent in order to view the site is illegal, and so is pre-checking the tick boxes or making it hard to opt-out (like having to explicitly visit the privacy policy, or uncheck hundreds of tick boxes).
If GDPR was actually enforced, fines would start flying out, and website operators will quickly start complying and cookie banners will become much less intrusive or annoying.
That's the cheapest. It's not really that hard to understand. I'm not a lawyer, read it and had a GDPR consulting firm review the tweaks we made of our systems. They were happy with it.
But if you're working for a larger company, then consult with their legal department or have the company hire a GDPR consulting firm. They should be able to afford it without a problem, and will likely be happy to support such an action if the non-compliance risk is deemed large enough. A business decision, not a technical one.
> it essentially boils down to "take this cookie or no access for you"
This is something GDPR explicitly bans. "Consent" obtained this way is invalid; the site doesn't even have to bother asking at that point.
> To continue chucking up cookie warnings to everyone and somehow expecting them to make an informed decision about the risks they present? 99% of people are going to click through them anyway
No, sites don't have to chuck up cookie warnings. If the cookie warnings were actually compliant, i.e. didn't try to hide the "no" option behind several clicks, there would be very little incentive for the user to say yes, because "no" means the warning goes away just as well, plus the user doesn't get tracked.
Of course, the sites realize that, and are setting up non-compliant "consent" dialogs that try to trick or pressure the user into "consenting". The solution to that is to prosecute the ones that do that until they stop. (I bet many of the sites set and use tracking cookies even before you close the dialog.)
At that point, the sites can choose whether they want to annoy users or not, but since a large part of the users will click "no" at that point (since the sites can't really provide an incentive to click yes), they might as well stop using the trackers.
And sites using cookies for functionality the user actually wants don't have to ask for consent for those cookies. If the site asks, it's because it wants to track you, and you have no reason to agree.
Good thing that there are browsers extensions which take care about removing these "cookies" notification so I don't have to deal with it.
Regular users absolutely do not care about privacy,cookies GDPR etc. When events like "cambridge analytica" occur they will be enraged, maybe even some "thumbs down" and "angry face" emotes will appear under facebook news notification before scrolling further down! Probably for HN users it is hard to comprehend because you are looking at the world from inside of your knowledge bubble.
More knowledgeable users know that this is total farce and masquerade and don't care about cookie notifications too.
The obvious one to me is to just ban consent. Make anything you would need consent for outright illegal. No one in the right mind would be giving consent for tracking without compensation (which is what the GDPR asks for) anyways.
Maybe leave a small prohibitively expensive loophole for projects that do need to track things (e.g. scientific studies). For instance requiring approval by an ethics committee and a contract signed in person by hand by both parties after jointly reviewing every term.
The market was working fine.
GDPR puts the citizen/customer in power of their own data. They can ask for their data, they can ask for it to be deleted, they have (however shitty the UX) control over where it goes. They can contact large corporations and request these things and be heard out.
I don't know how to explain it any other way: These things are fucking important.
As for your organization's GDPR expert who doesn't know anything about anything, this sounds like a "your organization" problem. Replace GDPR with some other acronym such as HIPAA, PCI or even SEO or PHP, it's still your organization's fault for hiring someone who doesn't know their stuff. How is that GDPR's fault?
Edit: Yes, keep downvoting facts. GDPR isn't just cookie warnings, how is that controversial?
I believe that thought is treated as an axiom by some and an under-tested hypothesis by others.
It also doesn't matter if people aren't educated and don't care.... or simply don't care if they are educated.
It's not clear to me that any progress has been made by GDPR in those areas.
You can't say "I liked it better before GDPR because cookie warnings".
I think many people specially on HN understand the implications of using cookies and also understand the privacy concerns by 3rd parties taking their data. What I don't understand is why there are people who assume almost everyone has absolutely no idea or concern about any of these things and therefore advocate for pushing horrible and half-baked regulations like GDPR unto the dumb masses.
The idea that, because it's about you it's therefore yours, is wrong.
Almost no cookie warnings meet the law and many of the ones that do could use a different lawful basis and not show a dialog at all.
So what do you do if your website literally cannot function without cookies?
Maybe we could call it something like "DoNotTrack", to get the idea across.
DNT was mostly ignored, but if it had the weight of law behind it, it could still be great.
Some places still respect the header. Medium does - you'll get the warning for embedded content.
Advertisers couldn’t care less about privacy.
HN, can we get a political movement going to make the EU adopt this?
Would be much nicer if the - already existing! - do not track header was interpreted to mean "Allow-Cookies: HELL_NO_WHY_ARE_YOU_EVEN_ASKING_FUCK_OFF".
Thanks to GDPR, the provider does NOT have to ask for consent for necessary cookies - only for the tracking stuff to which you have no incentive to agree. Every time a page pops up one of those "we value your privacy" screens, they're lying in your face - if they did, they wouldn't have to ask.
A more wordy version of the sentiment would be something like, "We value your privacy. At about $1.83. Could we have it, please?"
When I implemented one of these it was because lawyers told my team to do it. We didn't want this, neither as developers nor as users of websites. Neither were our designers thrilled at the prospect of cluttering up our site with this dingus.
I get that this is just a general rant, and I agree that people just click through them and don't actually care. But it's important to keep in mind how this actually came about, and (as a somewhat separate point) that lots of things in our society operate this way. Which is not intended as a defense, but it's more common than just cookies.
Or do you read every terms of service document shoved in your face when you sign up for something?
I don't understand the downvotes though, are you disagreeing that certain countries do not have the manpower to enforce GDPR to the extent they could? Please.
It's just that basically the entire world is violating the law, and it'll take a while to get to everyone.
I like the "ideas" behind GDPR, it's just this isn't the way to do it and really accomplish anything that really helps an individual.
We can't authenticate you without cookies or some other form of identification, so that throws out any site with an account.
Even if I am not even remotely interested in tracking what pages you view on my website if I need to have you login and authenticate I need some form of cookie / session ID.
If you need to be anonymous use a browser like Firefox Focus or similar but understand that you won't be able to log in for longer than a single session, if at all.
Cancel GDPR and similar privacy laws before we outlaw the [useful] internet completely. These laws are a mess written by people who honestly are not remotely qualified to make these kinds of decisions.
I'm all for the option of privacy but it's your own responsibility -- stop using the internet leave all your electronics at home and go ride your horse into the wilderness and breathe some fresh air if you want privacy.