No cookie consent walls, scrolling isn’t consent, says EU data protection body
techcrunch.com
techcrunch.com
If more browsers were still User Agents in the literal sense, maybe we wouldn't have needed this legislation. Browsers could have informed people about what cookies were, and could have presented the user with the option to never accept tracking cookies from Big Advertising. Every browser has the option to reject third party cookies or to clear all cookies at the end of the browser session.
This mischaracterization of cookies has, ironically, made life a lot less pleasant for people who don't accept cookies. The "opt-out" is just another cookie. There's nothing special about them either, they can be used to track return visitors just as well as any other cookie. I'm sure they're not, because that would be against the spirit of the law ...
Not tracking people without consent is definitely a Good Thing, but it shouldn't require everyone and their grandmother to put annoying cookie banners on every website under the sun. And I think it wouldn't have, had people been better informed.
IANAL, mind you - but that's how we implemented it - you're opting-in to the ads that target you and analytics which track you, or you get the non-tracking/non-targeting ads and analytics.
For pubads, look into "setCookieOptions(1)" and "setRequestNonPersonalizedAds(1)" for a good start on the matter.
It _can_ be done.
For my website [1], I have build close relationships with local experts. They provide services my readers need, and I know they can be trusted. I get a commission from resulting sales. I like that model because advertisers have zero access to or control over the readers' data. Unfortunately, it's simply not applicable to all websites.
(adsbygoogle=window.adsbygoogle || []).requestNonPersonalizedAds = true;
You also have pretty tight control over the categories of ad that Adsense can display, and you can even go as far as to review individual adverts. I've booted a couple of ads that I found to be unethical/distasteful from my site using the review feature in Adsense.
The only issue with Adsense is that there are a gazillion ads it might show on your site, so I'd recommend filtering out any categories you don't much like first, and then reviewing ads sorted by popularity/impressions in descending order, otherwise you'll quickly go mad.
[1] Obviously not an option if you absolutely don't want to do business with Google.
Google seems to disagree [1]: Non-personalized ads are targeted using contextual information rather than the past behavior of a user. Although these ads don’t use cookies for ads personalization, they do use cookies to allow for frequency capping, aggregated ad reporting, and to combat fraud and abuse. Consent is therefore required to use cookies for those purposes from users in countries to which the EU ePrivacy Directive’s cookie provisions apply.
What's not clear from Google's documentation, but what I assume, is that they also do not use the info about the context & visitor to serve them personalized ads on other websites.
Example: you're seeing an article about devops and you get an ad about AWS instead of an ad that has followed you around from another website you visited previously.
The cookie used for frequency capping is considered to be a "technical cookie" and has no bearing on privacy, best I can tell.
The other types of cookies can be pretty much disabled at the point of calling the google tag, or enabled (along with more tracking/targeting ads) if the user consented to that.
But the comment you're responding to says it right there: Even google is telling you it requires consent. It's a cookie, so it requires consent, period. Don't fool yourself.
Could google serve ads without cookies, and do fraud detection by other means? Yes, perhaps lowering payout due to increased risk. But it much better to pretend that a cookie-banner is needed, so that you might as well enable ad-tracking cookies.
Granted, from measurements on my own site that's only 1 - 1.5% of people, but Google's ad revenue for 2019 was $134.81 billion, meaning that they'd potentially be leaving $1.3 - $2 billion on the table by not serving ads to these people. Maybe it would be half that or less because the ads aren't personalised, so they're a bit more hit and miss and therefore probably wouldn't attract the same level of bids from advertisers.
But still, they'd be leaving a lot more money on the table than it would cost to fix the problem (an order of magnitude? two orders of magnitude?). Whilst they might choose to leave it due to opportunity cost, it doesn't seem that likely to me. Here's an example: I once worked at a company whose revenue sat in the £250-300 million range, and they absolutely considered it worth supporting 1% of their userbase for the extra £2 - 3 million it brought in (this is back in the day when IE7 and 8 were still a thing), because it probably only cost them high 5 to low-ish 6 figures per year in PITA workarounds to do that[1].
So, as I say, it seems odd to me that Google don't have a solution for serving cookie-free ads that require no consent.
Going back to skrtskrt's original question, "What are some good non-tracking & non-intrusive ad providers?"
[1] Obviously all us devs hated this, but it was tough to argue against from a rational standpoint.
I use adblock by default, so I have no ad-profile at Adsense that they'd use to show me "relevant ads". When I occasionally have to debug some issue with ads somewhere, I'm essentially getting the context-sensitive, not-personalized ads, and they're terrible. At least to me they look as if they were using very simple keyword-matches with little regard to context and primary language. It may be that they don't care to invest more, but it may also be that they don't have enough ad buyers that care for unpersonalized ads so they simply don't have a large pool they can choose from.
I'm also not sure that "cookie-free" would be enough, really. If you're loading ads directly from Google, the user makes the request and can therefore be tracked by Google. Even with Google Analytics and anonymizeIp, at least in the medical sector in Germany, GA is considered opt-in only. In that sense, I'm not sure a central service that delivers ads for you can work without requiring consent.
What very much should work would be a server-side system that's sale/lead-based, where the service would crawl your site, manage your affiliate programs and create ads for you that you'd then insert into your site. That way, no third party learns anything about the individual user and you don't require consent.
> You don't need to look far. You can simply tell Adsense[1] to serve up non-personalised ads
This discussion describes exactly the problem. How long has this tracking consent law been there now??
And it's just an option in Adsense?!!!
So whenever I see a cookie banner, you can assume they are simply too greedy to flip the switch.
Clearly the adtech and adtech-supporting industry hasn't even slightly bothered to look for alternatives, instead opting to annoy the public with banners. It's pure propaganda in the hope that the annoyance will turn into defeat, and somehow they manage to turn people's disgust towards the EU law instead of them, simply continuing to do their useless crap business and pretending the EU got their hands tied ... when there's a literal boolean switch to tell their shit to behave.
That part is not necessary. They are mandatory if you collect any form of personal data without legitimate interest.
Shopping carts, subscription services etc. will still work, you don't need to consent to that, as long as you're not tracking people or handling their data unecessarily.
When you see one of those cookie popups it is a sign that the website is trying to get more information out of you than they need.
Or the owner of the website has failed to understand the nature of the law. Given the amount of confusion in this comment section this also seems likely.
The ones which deliberately make the flow for closing the popup and accessing the site without 'consenting' are the ones I think are actually acting malicously.
Oh, sure, but if they don't understand it then they probably shouldn't be gathering people's data either.
GDPR is pretty complex, but website operators have proved for years and years that they can't be trusted to do the right thing themselves, so here we are.
Bear in mind:
- Extra data collection or processing must be opt in.
- Not opting in must be as easy as opting in.
- The content must be available if the user chooses not to opt in.
Then:
For instance, you go to a site, tumblr.com for example. Why is not important. You get a consent popup. Opting in to extra data collection is easy but you don't want to. Navigating this consent popup is almost impossible. within a few clicks you are lost, you find a list of several hundred "partners" tumblr wants to share your data with. All are checked and need to be individually unchecked. You still can't work out how to opt out.
To me it's like someone's trying to scam you out of your data. They are so desperate to get your information that they are jumping through all sorts of hoops to try to trick you into giving it.
Do I really want to give my data so an entity that is acting so creepily? Nope. I close the window.
That time "wasted" now, is time spent to fix their mistake.
The mistake of thinking they could collect data on me and sell it to third parties in perpetuity.
It being inconvenient to you to treat people's data and privacy with respect seems like something it's hard to feel sorry for.
Of course information should be protected, but there are all sorts of compliance procedures and processes that significantly increase complexity and cost.
And no, not asking for consent and collecting data without supervision is not an option, neither legally nor ethically.
GDPR compliance is usually expensive because people ignore Art. 5.1.(c):
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)
If you choose to collect personal data, you're responsible for handling it with due care. If you don't want that responsibility, don't collect the data. If your business model is predicated on doing shady things with personal data, find a different business model.
But I'm eagerly awaiting your measurements ...
Truly. Even if it shows the really big numbers you seem to imply. Because that shows something about their choice. How much trouble they're willing to go through to track you regardless.
It may not be terribly difficult to understand, but it is indeed very complex to enact at scale, especially with large systems that were designed under different constraints.
> Looking around for loopholes to do analytics that aren't actually what the user came to the site for is fundamentally the thing that the legislation is targeting...
Totally agree, and this shouldn't be done.
> ...this handwringing about cookie popups and consent and anonymized data is "complicated" simply because it is not in the nature of the law. You do that, you need permission, period, and you need to be OK with people saying "no, I'd really rather you not do that".
This is where we disagree a little. Calling it handwringing is hand-wavey and dismissive -- this stuff isn't easy to get right, and it's arguably a large cost for the wrong solution. Cookies come in HTTP response headers. Don't want the cookie to do anything? Don't read it! Tell your browser to ignore it. Don't like the JS that's being run? Disable JS.
Waging a war against cookies is just a cop-out for fighting the actual problem. What's next? Opt-in banners for JS in webpages? For using HTTP? TCP?
As a developer, I agree. As an end user, I am OK with this.
If organisations have to think hard about what data they collect, because it means they have to think hard about how to safely store and destroy it, then that's a good thing.
It has been easy to collect, store and disseminate user data without thought for a long time, and website operators have proved they can't (in general) act responsibly.
> This is where we disagree a little. Calling it handwringing is hand-wavey and dismissive
My honest opinion about most of the consent popups I see is that they are at best trying to weasel out of having to comply with the regulations, or at worst applying dark patterns to trick the user into "consenting".
I am sure there are some honest people with consent popups out there, but I'm not generally generous enough to attribute anything other than malice or incompetence.
> this stuff isn't easy to get right, and it's arguably a large cost for the wrong solution.
For sure, but it works both ways. There is a (potential) financial penalty for not taking care of user data, but at the same time, there's a pretty large cost to a user if their data is spaffed all over databases on the Internet when they didn't want that.
Also, I'm pretty sure if you are actually trying to be GDPR compliant then your first interaction with the information commissioners office will be them trying to help you comply, and you do always have the option of just deleting the data if you can't treat it safely.
> Cookies come in HTTP response headers. Don't want the cookie to do anything? Don't read it! Tell your browser to ignore it. Don't like the JS that's being run? Disable JS.
I feel like I read somewhere that telling the user to adjust their cookie settings in the browser was speficically discussed, and not allowed, but I could be wrong.
> Waging a war against cookies is just a cop-out for fighting the actual problem. What's next? Opt-in banners for JS in webpages? For using HTTP? TCP?
It would be a mistake to think that Cookies are the focus of the GDPR. See https://gdpr.eu/cookies/:
"However, throughout its’ 88 pages, it only mentions cookies directly once, in Recital 30."
The GDPR is about user privacy, cookies are one of the primary tools for violating it, and the most prominent artefact seen on the web, so it's the focus of a lot of discussion, but the main thrust of the regulations aren't around cookies themselves.
It is significantly unlikely that there will be opt in banners for JS, HTTP, TCP, phone calls, cameras at the beach, or just looking at people with your eyes any time soon.
I'm not against GDPR, and I'm glad these issues are getting attention. I just want to make sure we recognize there is a lot of nuance here, and there are real costs and second- and third-order consequences to consider.
Consent must be informed and specific, so simply asking users to set their browser to accept or reject all cookies (regardless of purpose) is not compliant.
On the other hand, if browsers get their act together and standardize a consent API with the necessary features, then browser-based consent management would surely be compliant. GDPR and ePrivacy don't address this explicitly, though GDPR Recital 32 considers consent by “choosing technical settings for information society services”.
Centralising consent in browsers is a key consideration in the proposal for an updated ePrivacy Regulation, but the EU is not going to mandate specific technologies. Everyone is well aware of the mess that is the Do-Not-Track header.
The only different "constraints" relevant here would be "we get to play fast and loose with the data we collect or allow to be collected about users, without repercussions".
If that wasn't the "constraints" they were operating under, they have no problem now either.
> Calling it handwringing is hand-wavey and dismissive -- this stuff isn't easy to get right, and it's arguably a large cost for the wrong solution. Cookies come in HTTP response headers. Don't want the cookie to do anything? Don't read it! Tell your browser to ignore it. Don't like the JS that's being run? Disable JS.
> Waging a war against cookies is just a cop-out for fighting the actual problem. What's next? Opt-in banners for JS in webpages? For using HTTP? TCP?
This is indeed where we disagree, except the law also disagrees with you:
It's. Not. About. Cookies.
It's simply about collecting and storing more data on your users than you strictly need to run your business.
There's really nothing technological about it, if you did it with pen and paper, you'd be subject to the same GDPR. Talking about HTTP response headers or "waging a war against cookies" is just misleading.
If the admin of a site thinks they need a cookie banner when they don't, it's really because they haven't really bothered to give much thought to reducing the amount of data collection they do on their users.
But I bet it's not really that common, website admins who think they need a cookie banner when they really do not. What is WAY more common: the website admins that do need a cookie banner, but ONLY because they use Google Analytics, and don't realise this is a choice they get to make.
Or people (right here in this thread) saying "I can't make a useful website otherwise" -- it's not that the law is hard to understand, it's not. It's that they refuse to give the problem any thought. The ones "failing to understand the nature of the law", actually just don't give a crap. It's like a butcher complaining "Why do I have to label my meat with 'made from tortured animals', I have to kill them right? I can't possibly produce any meat without using this rusty spoon that I've used for decades".
> The ones which deliberately make the flow for closing the popup and accessing the site without 'consenting' are the ones I think are actually acting malicously.
You can easily not act maliciously, and still be a crucial part of the problem. That's also what laws are for, even if you cross them non-maliciously, you get punished. That's because people "not understanding the nature of the law", when it directly applies to their business, is undesirable, and really a responsibility they should carry.
You forgot one more... you're a citizen of an EU member state. I live in a sovereign nation and EU law doesn't apply to me.
It's been quite funny seeing Americans fall over themselves to comply with GDPR requirements. It won't be funny when they also fall in line behind Chinese law.
That's a ridiculous over-generalization. My bank's website doesn't have ads on it; is that not useful? Wikipedia doesn't either, can you earnestly say you've never found wikipedia useful?
There is much more to the web than shitty ad-riddled websites.
Also it's kind of sad if you believe you can't make a useful website without having to hand over private user tracking data to Google. In fact you are using a website just like that, right now.
Most sites choose do popup instead because (they think) it is more effective. So be it, but don't say it's "mandatory" or that "they are forced to".
A/B testing is allowed and doesn't need opt-in if the A-or-B preference is only recorded in aggregate form and not tied to the user.
Same for the purchasing scenario. In this case, you would be explicitly collecting personal data to fulfill the order.
It's almost as if they just want to collect all the data on all the users forever without any oversight, by continuously rehashing bad and misunderstood versions of the GDPR and pretending it's hard and complex and vague.
I use and appreciate this one: https://www.i-dont-care-about-cookies.eu/
It reminds me a bit of legislation in other areas that aims to make something so inconvenient people give up on it, like the death by a thousand cuts to American gun owners with state laws making magazine limits smaller and smaller over time, banning this and that cosmetic feature that has no bearing on anyone's safety, etc. What is Europe's vested interest in doing this to the internet though, information control (regulate a few conglomerates instead of having to deal with a bunch of little sites, by stamping out the little sites) and spite towards America's much more prosperous tech sector?
This could actually be a good thing. These days advertisers act as censors: all it takes is a bunch of complaints and a website's revenue stream gets pulled. The webmasters react by deleting the controversial content and avoiding the subject in the future. If this is what a profitable internet looks like it should probably die.
> Nobody has ever been hurt by a tracking cookie in the history of the internet.
How do you know?
> stamping out the little sites
Social media is responsible for this. Few people buy domains these days, it's much easier to register a name on some existing site. Most traffic originates from social media these days.
This is how newspapers have operated for nearly a century, and how television operated for over 60 years.
What do you expect will replace it? A reversion to the patronage system? I don't think Bloomberg or Murdoch paying for content to be made in the way they want it is going to be an improvement.
Yes. They depend on advertising revenue and are worse off for it.
Journalists have a duty to report facts accurately but they must also keep the advertisers happy. Due to this conflict of interest, newspapers lose trust and are perceived as having little integrity. Gotta wonder if the article is presenting a truth or some version of it that happens to be aligned with the interests of the people with the money.
TV shows are sanitized for maximum advertiser appeal. Even when they push boundaries, it's carefully controlled by the networks. There are numerous and well-documented cases where they actively influenced the creative process. Gotta wonder what shows would be like if creators had true free expression.
> What do you expect will replace it?
I don't know. Hopefully something better.
> A reversion to the patronage system?
Perhaps. Would be great if we had some kind of crowdfunding or patronage system that lets people directly fund the creators they like. Art should work like an investment: large numbers of people invest in the studios they like and the work starts once enough capital has been raised. Since the money is guaranteed, creators get more freedom to do what they want. Since they'd be compensated before the work starts, copyright becomes irrelevant.
> How do you know?
Same way I know that that defining the ASCII code for T as 084 has never hurt anyone. It's an interpretation of information, independent of the human condition. Change my mind.
I would have accepted a case wherein a user in the arctic, with limited bandwidth, was hurt due to the cookie data interfering with the communication. Hand waving about a series of human failings being connected to a technology is not compelling.
I guess it's the same argument as the "gun" isn't responsible for gun violence, excepting cookies aren't even designed to reveal information. Guns are definitely designed (in part) be used against people.
It's not just any cookie though. You specifically mentioned tracking cookies.
> Nobody has ever been hurt by a tracking cookie in the history of the internet.
These cookies exist for no purpose other than information collection. They aren't even required for the website to function.
This isn't negligence, it's imprudence: being reckless with people's personal information, amassing large amounts of it in the name of profit without stopping to think about the consequences.
This isn't unique to cookies either. It applies to every browser fingerprinting method.
You make good points and I am not arguing with you, but I found theses two books really convinced me that some balance is required, and worthwhile.
Ideally, big companies would be subject to the law just the same. However, small companies can get a head start by just not doing what they know they are not supposed to.
> Nobody has ever been hurt by a tracking cookie in the history of the internet.
It doesn't have to hurt me. I just don't like it and I don't want it, and that is a good enough reason for me to not give up my privacy.
> some feel-good legislation that accomplishes nothing
It hasn’t been all 100% positive, and doesn’t apply to everyone, but GDPR has definitely had an overall positive impact on digital privacy practices globally. I say this as founder of a for-profit US web company affected by the legislation.
> Nobody has ever been hurt by a tracking cookie in the history of the internet.
This is really demonstrably false. Tracking cookies, tracking pixels, and other tracking technologies, have been and are still being used to de-anonymize people and cross-correlate browsing behavior of people visiting sites other than the one they’re on. The concern is over privacy, and tracking cookies are a real threat to privacy, hence the legislation.
That people absolutely ruin the user experience of their site deliberately is an active decision they make themselves.
Make an effort not to visit those sites. You will be surprised to know that people that make such bad decisions for their site seldom have any valuable content anyway.
I agree. The EU cookie laws were well-meaning, but have had the unintended consequence of making the web more annoying, more difficult to use, and more fragmented.
The solution? Cookie consent should be a built-in feature of browsers and http, not something that is reimplemented in a slightly different way by every single website.
Your browser should pop up a standardised cookie consent request when you browse a new site, and enforce your selection as part of its security policy. If you choose to block all cookies (ie: private browsing mode) then the cookie consent request wouldn’t need to appear at all.
Cookie control/policy in browsers needs to become more sophisticated than what we have today.
Many games wouldn't work well in a VM, of course, there's no getting around that.
Unfortunately these days the browser would be better referred to as the advertiser's agent," or perhaps just Google's agent.* Owing to Google's control over both web standards and the advertising market, cookie management features have received little attention.
Google's monopoly power has prevented a competitive market of privacy-focused, user-first browsers from flourishing.
It's also probably unlawful, the irony is that not too many years ago we punished Microsoft for unlawfully leveraging its monopoly to control the browser, and when we stopped them we paved the way for Google to do the same thing!
Well, from a antitrust perspective, having TWO giants in the space is better than having only ONE giant.
Ideally we'd now apply to Google the same pressure and further split the field. Alas, politics are complicated.
Only if you ignore the giant market of adtech tracking bullshit that that has been ruining the web since about 2000.
Every website that shows you a "cookie" banner (aka we-track-the-fuck-out-of-you banner), is part of this problem. The law is just bringing it to light. Don't be annoyed by the law, be annoyed by the websites, they are choosing to be annoying.
Look at those websites, they are the problem, not the law telling them they can't do it secretly behind your back any more.
The biggest problem was that this law didn't tell them to be fucking honest in the banners. "This website needs cookies to function" (when it's only about their mishandling of data to 3rd parties) is a straight up lie by omission. If they had to honestly tell in the banners what they were up to "we track your every breath on this site and then sell it to third parties, who sell it to other parties, and god knows what", people would be looking at these sites differently.
"We're forced by law to inform you that we crap on your privacy and are actively ruining the web by delivering the fundamental data that runs the adtech industry"
And obviously Chrome would never do this kind of thing, since it hurts Google.
TBH, I wouldn't blame GDPR for this. Here's a good analogy of what's tracking companies are doing:
- Companies dump used batteries into the sea.
- Dumping batteries into the sea is banned.
- Companies start dumping batteries into lakes.
I beg to differ. I use AdBlockPlus (ABP) and I can block 99% of these banners, and proceed immediately to the website. One can also use NoScript to block some websites that are full of crap/trackers (like techcrunch).
I would heavily recommend to switch to uBlock Origin (and maybe uMatrix) instead.
Disclosure: worked for eyeo in the past, and quit.
I propose a better alternative: just stop doing things requiring consent (which are, by definition, unnecessary, and almost always support an unethical business model), and then you won't have to annoy users with consent popups anymore.
Stop spreading this disinformation. It's just the filthy websites that track your every move on the site and then give it to third parties.
Would you rather they do that by default, extracting your data before you even notice, without even being able to distinguish the bad actor from the good actor?
The problem is that people think it's the cookie banner that's annoying, when it's in fact the very website that has been secretly abusing your privacy, except now they tell you.
The people think that agreeing to the tracking banner is a fair transaction because the adtech banner is being disingenuous. It's as if the entrance to a museum requires you to dump one empty battery in the ocean. It's a bit of a hassle but it doesn't cost you anything, and you get to see the museum which is what you want.
Except in 90% of the cases the museum is clickbait trash.
I mean I agree. No website should use cookie banners. None of them. Increasing fines all around for those adtech fuckheads.
(I do entirely agree with you, the default internet is pretty much like you said, sadly)
That combined with Firefox Containers would make for a very powerful combination since you could have different containers that would be your logged-in interface to a specific site, without then having to allow other sites be able to set cookies.
> Delete cookies and site data when Firefox is closed
setting checked in preferences. There is a Manage Permissions button next to it that allows some more per-website control.
Websites can place however many cookies they want. It won't help them track me past a day.
Setting up Safari this way and using FireFox only with containers for each major web platform works really well for me and I have been able to talk non tech friends into trying it.
Whitelist a site and set default behavior to block will still allow that whitelisted site... I think so at least, maybe you need wildcards or something...
That is - if you're building a website and using the bare minimum cookies you need to make the website function, you don't need a cookie popup. The default here is that you don't need a cookie popup, and when you start tracking users and/or selling their data, you need to comply with ePrivacy and the GDPR.
[0] https://varnish-cache.org/docs/trunk/phk/http20.html#beating...
Switching to server side storage would've been a too costly architectural change. What if the server side was stateless before?
And even if, web applications would still have needed to support the old model for interop reasons. It's not feasible for everyone to maintain code for both approaches when they are so different.
It'd also break many use cases, such as using a (signed) cookie as cache for some really frequently used data. Or more importantly authentication, where an auth service returns a token (in some cases a token that can be checked by a different service without contacting the auth service again).
So yeah, that was a non starter.
Then that's a pretty bad design choice to begin with? If some state is required for operation, but the website keeps it only on client? Not least of all reasons, for security?
As a concrete example for a common use case, websites show your user or first name in the top right corner. It's common to put this in a cookie set on login/logout. This avoids querying the user directory service (from the frontend or a different backend service) on every pageload. Security wise it doesn't matter if the user tampers with it, it's a display only thing. (More often than not it's signed anyway, and the cookie contains other things as well.)
Cookies meant to be presented back to a server can be signed and (optionally) encrypted. This is also a very widely used pattern ("cookie secret" is a good search term for concrete implementations in frameworks).
I was talking about statelessness on the server side. If you remove cookies from HTTP, you now need a database on the server side.
You also get extra communication (between the client/DB, or the web service/DB), whereas previously the data would've already been available in both (the client has the jar, and the web service gets it in each the request). Turning a local memory read into a network request can be a difficult architectural change.
Also, DynamoDB reads are priced per unit ;-)
How is a opt out cookie the same as tracking cookie?
Isn't there a clear difference for a cookie:
is_opt_out: true
tracking_id: 374739585483292
It's the same problem with pages where most users are logged in: the few who aren't are suddenly such a small group that they become identifiable through other means.
I = -log2(p)
https://news.ycombinator.com/item?id=22245101
https://source.chromium.org/chromium/chromium/src/+/master:c...
1. Do a study and check how many people want to be tracked. Don't trust the data from websites because everyone is currently being tricked into accepting. Go out on the street, talk to someone for 5 minutes about how tracking works, how it can lead to more relevant advertising and a potential increase in revenues for the service they're using, but in return their browsing history, purchases, and communication will be tracked and associated with them. How many want to be tracked?
2. If 80%+ of people do not want to be tracked, then just create a law saying it's not allowed. That's it, we're done.
3. If less than 80% of people don't want to be tracked, then force browsers to prompt users on install to ask if they want to accept tracking. Websites, analytics, advertisers, etc, then need to respect that setting or risk being fined. No need for every website in the world to invent their own cookie/tracking pop-up system, and no need for people to adjust their settings on a per-site basis.
Given how many people think the EU did a bad job defining cookies, tracking, tracking methods and etc, it would be fun to see what they would think about he definition of a "browser" as something that can be forced to implement a certain feature.
Ask the same people if they wanted websites to stay free.
I bet 80%+ would want to eat a cookie, a have it too. (No anti-pun intended!)
(Side note: the proposition of banning things if 80% don't want to use them is dangerous. No wanting something personally is not the same as banning it for everyone.)
A fair comparison would be a law saying people need to opt-in for paying for a cookie. You can't charge the customer or hide the information, they need to agree to pay for the cookies, and they need an equally clear option to not pay for them.
However, stores bend the rules. They have someone stand at the entrance saying, "Thanks for coming to our store, we have cookies for sale at $0.99. Would you like to come in?" If you say yes, then you're charged for cookies you buy. To get the cookies for free, you need to realize you can say "No" to entering the store, and then through a complex 5 minutes conversation, you can get the person to let you into the store for the free cookies every person is allowed to have according to the law.
Most people don't know about the free cookies. Others can't figure out the correct questions to ask to get permission to enter the store for the free cookies. Some people want the free cookies but they don't have 5 minutes to waste talking to the person, so they just decide to pay.
At the end of the day though, of course everyone wants the free cookies. I want them. You want them. The law says the store is required to give free cookies. Why introduce all the complex interactions and rules that businesses will not follow, and customers will find annoying? Just give everyone the cookies and be done with it.
If you don't want a blanket statement allowing free cookies everywhere, what's the ideal process? 97% of people want free cookies all the time. 2% of people want free cookies "sometimes". 1% of people never want free cookies. Asking people at each store for their preference (similar to a website cookies pop-up) is only beneficial to the 2% "sometimes" crowd. For the other 98%, they're just being annoyed and repetitively giving the same answer to every store. Require the banks to allow a setting on credit cards to toggle free cookies on or off, and have stores respect that setting without needing to ask.
Disclosure: I'm a Googler. Not sure how that affects my fatalism here.
Also, why do we assume that the choice is between the status quo and the total collapse of the internet ecosystem? That there's no way for digital advertising to generate a profit without gobbling up ever greater amounts of our personal data?
Logging out of youtube feels like falling kneedeep into the gutter. What I personally want is more and smarter tracking, not less.
When I'm at random site I rather see ads for electronics kits I considered purchasing recently, not liposuction or some other gross random things I would never want or need or even like to be aware of.
This seems like it's a silly nitpicking point, but in this context that's the whole point of the discussion: whether your users understand and consent to paying that cost.
If you were able to say "tracking or subscribe" it would made much more sense.
Example: my personal website costs me about $35/mo to run. If I put ads on it, Google would tell me I made about $5/mo, and then take that $5 for themselves because they have decided they don't need to pay out small amounts. So I basically get to pay to host ads for Google.
Counterpoint: Wikipedia.
There's a very popular (it's a bit weird that number of reviews is so drastically different between Chrome and Firefox) extension called Honey. Apparently bunch of people install it because it provides free coupons. I don't believe people that use it know that ultimately they are the product.
Too many people were using this as a way to get a blanket acceptance of cookies, which not only included specific state to make the web site work, but other tracking cookies. What I see when I read this ruling is that you can't bundle the two. You have to allow the user to say "No, I don't consent to any cookies that provide PII." and then stop using them.
You don't need cookies for that. But, if you insist that you do, that can easily be a session cookie, not a stored cookie. And there's no need to obtain consent for a cookie like this, if it's not used to identify or track a (EU) person.
and to this day, cookies in firefox are managed in a hidden box with a giant list of all the sites you've ever accepted. they don't want you to manage these permissions.
but for permissions they intent for you to manage, you click the security icon and you can revoke what you don't want. if the only permission you granted is the right to store cookies, it says you haven't granted any permissions, although this is a lie.
I used it for a week or two, maybe. I stopped because it made the web unbrowseable. If you think one banner per site is bad, imagine at least 5 consecutive popups to start, plus the possibility of more when you took any persistent action our the site loaded a new 3rd party resource. And if you don't choose the whitelist/blacklist option right away, it's the same thing the next time you visit.
I stuck with it until it became clear that I was not going to run out of domains to whitelist -- ie, this was a never-ending workload -- and switched to accepting only first-party cookies. I don't think there was an option to decline 3rd party and ask for 1st party; I probably would have used it.
No tracking-by-default, no need for a banner.
Of course it's not visitors who want persistent shopping baskets. It's sellers. And I don't really care about what they want. On ~100% of the websites I visit, I'm the visitor, not the seller. And given that webshops were a thing before persistent shopping baskets were a thing, I'll wager they can do without.
That’s not so simple. Persistent shopping baskets create problems for sellers e.g. stock changes; price changes; products may become obsolete. Some of them let the cart expire at some point, even down to a couple hours for some (ASOS). As a visitor I do want a persistent cart accross sessions because I may need some time to make (nor not) my purchase. And no, I won’t give you my email just for that.
So if that UI will be deployed, may be those popups won't make sense anymore.
You're probably right that it won't be happening now..the cat's out of the bag.
Unfortunately, cookies are not conveniently labeled as "advertising" or "federated login".
That said, yes, it'd be nice if the legislation in question had mandated proper labeling of cookies, and then let the user's browser handle rejecting them.
Ultimately though by default I use extension to destroy cookies as soon as I leave the page, I can place an exclusion for sites that I frequent but when I do that I just allow all cookies. My reasoning is that if I have credentials they can track me using these anyway.
Anyway the whole thing is moot though, since advertisers are beyond cookies and use many other ways to track users. Now seems what their primary goal is, is to be able to tie multiple devices of the same user together.
Now that the auth headers are known about, they can be treated as such and expired based on user preferences, but by default after 24h. There can be an alert "google.com has logged you in and now knows who you are until you log out".
Auth headers are then only sent for a single origin, so no scripts to track you around the web anyway.
The cookie workaround for those that need to genuinely use them are 1. session feature mentioned above - tie to that on the server side and 2. stick something in the URL and then keep tracking that via links, like most SPAs do anyway.
Want to do analytics? Anonymous-ish pixel or server logs.
Local storage is another issue, that should be permission based. (+ any other dodgy web apis).
Someone might say, what about a site you don't log into but needs to remember your prefence? A. Easy local storage, and it will ask for permissions AWS style e.g. "enter the name of the site to agree ____"
Maybe get rid of UA string?
s/browsers/popular &/
There are browsers and other clients that are still User-Agents in the literal sense but they are not the popular ones.
The popular browsers measure their success by market share, not qualitative measures.
That is why Firefox tries to stay more or less in lock step with the leading browser on features.
This is not done out of fear of being inferior by some qualitative measure but out of fear of losing market share.
There are plenty of ways to collect data about people without using cookies to do it, so GDPR would still be needed no matter what measures browsers took to block tracking cookies.
It discards most of these popups. Coupled with unlock origin and decentraleyes, I think you’re pretty well covered against tracking without too much hassle.
Of course temporary containers is the cherry on top (although amazon seems to have a way to recognize you anyway because it almost always only asks me for my email before logging me in)
When a website sends cookies, prompt the user "this website wants to track you, allow it? y/n".
The same way microphone/camera access it prompted. So it should be fine to reject this for news sites, a random museum, etc, but okay to accept for, eg: webmail, sites where you log in, etc.
We've simplified browsers UI so much, a SINGLE toggle button for this would be lovely!
Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn't they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they've approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting).
[1] https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
> PECR are the Privacy and Electronic Communications Regulations. Their full title is The Privacy and Electronic Communications (EC Directive) Regulations 2003.
> They are derived from European law. They implement European Directive 2002/58/EC, also known as ‘the e-privacy Directive’.
> PECR cover several areas:
> The use of cookies or similar technologies that track information about people accessing a website or other electronic service.
See "How does this fit with the GDPR?" for how the two relate, tl;dr:
> The GDPR does not replace PECR, although it changes the underlying definition of consent. Existing PECR rules continue to apply, but using the new GDPR standard of consent.
[1] https://ico.org.uk/for-organisations/guide-to-pecr/what-are-...
I don't understand this at all, and I always feel so nervous using my card at US retailers for this reason (these days I try to stick to PayPal where possible). Where I'm from, _all_ one-off online card transactions are 2FA'd between you and your bank; it was strange to say the least the first time I paid for something on Amazon and the transaction just...went through.
Meanwhile it causes the payment processors to not want to do business with merchants who get a large number of chargebacks, even if the problem isn't with the merchants but with their customers. In other words, it discriminates against merchants who do business with disadvantaged clientele who are more likely to have payment issues.
I mean it's an interesting enough heuristic, but can you provide an example of a processor that would refuse to business with someone because they had excessive chargeback, but also had the information in place to prove the purchases in question?
I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in.
I don't have much firsthand experience in it though, so I'd be thrilled if you could share some insight on it.
The problem in many cases is the difficulty in proving the purchases. For something like digital content, the only proof you'd really have is some server logs showing that it was transferred, which are naturally trivial to fabricate because they're entirely under the control of the seller, and so the payment processor may not give them much weight.
> I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in.
But then you run headlong into the efficient market hypothesis, because when everybody else is avoiding that customer base for those reasons there is less competition and thereby greater opportunity.
Also, from the perspective of the customer, just because 30% of similar customers are dirtbags doesn't mean you are or that you don't want to be able to buy your stuff.
a) the consumer catches it in time
b) the consumer has the time to deal with the bank (try calling Wells Fargo in the midst of COVID)
c) it doesn’t cause the consumer’s rent check to bounce
The US payment card system is not a good solution for the non-cash payments problem.
Actually fixing the problem - 2FA etc. - would probably be more consumer friendly in the long run.
Not saying that's the case for everyone, but you can't define "customer friendly" in a narrow way that conforms to your personal desires and assume that's that.
Also consider that if banks did have strong authentication around every purchase, there would be less of an incentive for banks or merchants to agree to roll over and eat the cost when there is fraud (and more ammunition for them against laws that require them to). No security/anti-fraud system is perfect, and something will always slip through; I wouldn't want to be a card holder stuck with a big bill because someone managed to clone/swap my SIM (for example) and make transactions using my card if I had no protection from that.
Other countries had chip cards and contactless payments in widespread use a decade or more before the US even got support for them.
Hoping someone from the industry can comment, but I was under the impression that US issuers were eventually forced into EMV, after dragging their heels, because the US became a prime market for cashing out mag stripe data from non-US issuers.
(Then again, I guess a chip reader doesn't stop people from putting in a skimmer that just reads the card number as usual through the magstripe.)
The pump also had a pad for contactless payments, but I couldn't get it to work with either my phone or the NFC chip on my credit card. Maybe it only works with Shell's own card? Wasn't clear.
(And at the complete other end of the spectrum, I then went to top up my tire pressure, only to find that the air pump wanted quarters, and only quarters. Fortunately the attendant turned it on for me for free. I usually don't carry much cash around with me, and even more rarely have coins.)
I'd imagine it would do though, as many chip readers only need you to insert your card far enough to read the chip, which isn't far enough to read the entire magnetic track and thus skim the track (am layman though)
And it's pretty rare. I've had only once actual instance of electric fraud, and one stolen card in 20 years. That's 20 years of never having to remember or type in a PIN.
So it's about who's responsible. Without 3DS or PIN a merchant is responsible. With 3DS or PIN a client is responsible.
"Passed in the 2002 and amended in 2009, the ePrivacy Directive (EPD) has become known as the “cookie law” since its most notable effect was the proliferation of cookie consent pop-ups after it was passed."
It is not the cookie that requires pop-ups. It's despicable behavior that does.
Well no, what you really want is browsers that do the right thing to begin with and e.g. block third party cookies by default. Then you don't need "cookie legislation" at all.
But if they're going to require something then it should at least be clear what the requirement is. If multiple large corporations who can obviously afford competent attorneys are doing something ridiculous, that's pretty good evidence that your legislation is drafted stupid.
Also GDPR is addressing much more than tracking consent.
Sure it can. Functional cookies come from the domain the user actually visited, advertising cookies come from other domains. That's not always true, but it's true often enough that those should be the defaults.
Firefox even does one better. It has a feature you can enable called "first party isolation" that allows third party cookies, but keeps a different set of them for each domain the user actually visits, so if the user visits a different site none of the third party cookies from the first site are there and they can't be used for tracking between sites.
> Also GDPR is addressing much more than tracking consent.
Next week we'll probably discuss some different part of it that would have been more effective if done some other way.
Meanwhile the actual problem with (third party) cookies is that they're used to correlate users across multiple sites for tracking purposes, which goes away when browsers stop accepting third party cookies by default.
> But consider if you buy some books or sex toys or whatever from an online store. Do you want the store to sell information about your purchases to third parties?
This is really a different problem, because how are you supposed to know if they're doing this anyway? How is the government? Once they have your information there is no real way to tell what they're doing with it if they're willing to lie to you.
So the answer is to make it so they never actually have your personal information. But for this we need some kind of anonymous digital payment system for small transactions, so that the vendor doesn't have to know who you are. If all they have is a transaction ID from a bank that lets them get paid and a virtual one-time-use PO box number you had the item shipped to which forwards to your real address for a week and then is deleted forever, they can do whatever they want with that information and you don't have to worry about it.
Right now the web is broken anyway - some pay (in data and ads), some are free-riders. And everyone is pested by cookie popups. This "no tracking unless required for functionality" would make it nice to change a model for actually paying for use. (It promotes quality content, less distractions, less clickbaits; and thinking twice if you want to spend more time on yet another meme aggregator.)
Let's imagine a world where a government force car builder to add speed limiter to cars. The car builders all decides to just cut the engine if you go over the limit. Will you say the law is bad or that car makers are trolling everybody ?
It's the same for this law. But curiously everybody is prompt to say that the law is bad. The reality is that a majority of internet actors are bad and are just trolling us.
Every time you see one of those cookie popups it is a sign, right there front and centre, that the website you are trying to use is trying to play fast and loose with your data.
Complaining about these notices would be like complaining that restaurants are forced to put up a sign on their front door "Kitchen employees don't wash their hands" when they get caught not doing so.
Brilliant. I might copy and reuse that.
You can still display advertising, that also doesn't need consent.
You just can't collect and process people's data that isn't required for providing the service. If a site displays that notice, it's because they're attempting to do more with your data, or collect extra data, than is strictly needed for the service.
Thus, these cookie disclaimers are like Proposition 65 warnings in California. They're everywhere so people ignore them.
Many people click "add to cart" without logging in because that is the service they want. Nobody voluntarily clicks "track and analyze my activities on this site", because that is not a service people want.
You realize that in order to implement "add to cart" you have to track their activity on the site? That's what the cookie is for. To track customers and persist their cart. If you can't track customers then you can't associate them with their cart.
As far as analyzing activities, what is any isn't allowed is murky. Is it okay to do A/B testing and see their impact on sales? This requires tracking and analyzing user activity, but isn't necessary to provide the service. But it is necessary to actually determine whether changes to the service are positive or negative. So do you throw away A/B testing, do A/B testing and risk fines, or throw up a cookie disclaimer?
> If you can't work out what data is and isn't required for the functioning of your site then perhaps you shouldn't be running one.
I'm more than confident in developers' abilities to know what is and requires. I'm dubious of government bureaucrats' abilities of doing so.
First, you can't avoid solving the murky analysis. You must be able to specify in clear language what personal data you're using for what purpose and which specific paragraph of the GDPR gives you the legal basis to do so.
Are you using that data for A/B testing because it's a legitimate need where you don't need consent or because the user consents to it? Well, you have to decide before implementing that disclaimer, because the disclaimer should clearly state that answer!
Furthermore, if you decide that some use case does not fit the legitimate need criteria and you need consent, then a "cookie disclaimer" does not reduce the risk of fines - because a disclaimer does not collect opt-in consent, it can (at best) record acknowledgement, so if you need consent but only have a disclaimer, then that still risks fines.
On the other hand, if you trust your developers to know what is required and what's not, and you have documented it properly (because it's not just a good idea, it's mandatory), then you should be able to run that documentation through your local data protection authority to validate any doubts, that's part of their job, and wherever I have seen them work it's something they eagerly do.
I run websites, and I don't feel in any way worried about it personally.
Are you familiar with Proposition 65 in California? Any product of business location that has any detectible amount of carcinogens needs to disclaim that it potentially contains carcinogens. Among other things, gas stoves and roasted coffee both contain trace amounts of carcinogens. So most restaurants and coffee shops display Proposition 65 warnings. Said warnings have become so ubiquitous that nobody cares about them. The same scenario is playing out with cookie disclaimers.
> Except there's no such thing as a cookie disclaimer as I said in another comment. Extra tracking/data processing has to be opt in, and you have to provide the service to the user even if they don't opt in, so you can't just throw up a notice that says you might not be compliant because you still need to be compliant.
Yeah, they do exist. And you can find them on plenty of sites that block content unless the disclaimer is accepted. You may be of the mind that this is not complaint with the legislation, but reality demonstrates otherwise.
> Prop 65 is different. The cookie law is like saying "if you sprinkle extra carcinogens in your product then you need to disclose it".
This is making the same error as the washing hands analogy. This ignores the fact that cookies are necessary to power user-facing features.
Except there's no such thing as a cookie disclaimer as I said in another comment. Extra tracking/data processing has to be opt in, and you have to provide the service to the user even if they don't opt in, so you can't just throw up a notice that says you might not be compliant because you still need to be compliant.
> Are you familiar with Proposition 65 in California?
Yep, it's irellevant.
I don't know if you're doing this deliberately or not at this point because I've said it so many times.
You. Are. Allowed. To. Use. Cookies. Under. GDPR.
There are times you need to ask for consent, but for login cookies, shopping carts etc. that follow some relatively simple guidelines, you don't need to ask for permission.
Do you really find that so hard to understand?
Until a government bureaucrat decides that your usage is not necessary and they threaten you with a fine.
You are not the one enforcing these laws. What you think is a reasonable interpretation of these "relatively simple guidelines" is no guarantee that a government commission is going to reach the same conclusion. Do you really find that so hard to understand?
Sure, the cart is perhaps a trivial case. But persistent tracking is also used to prevent abusive behavior, and other things that aren't strictly necessary. The risk that someone might try to claim that these are unnecessary far outweighs the cost of throwing up a cookie disclaimer. Thus, cookie disclaimers become pointless through their ubiquity.
Reply to your comment, since HN is rate limiting my work VPN:
> That's not it works. Someone complains to the Information Comissioners Office (ICO). ICO determine if the complaint is valid and will get in touch with the site owner to help them come into compliance.
And then they get sued if they don't come into compliance. This is just elaborating extra steps.
> There is no such thing.
> You have to make unecessary data collection and tracking opt in. You can't have a notice that says "we might do x unecessary data collection and/or tracking" and make the user click it or go away. You need to be compliant, or you need to not serve the European market.
Right, and websites don't display content unless this supposedly unnecessary data collection is opted into. Because nobody wants to risk being on the wrong side of ambiguous restrictions on necessary and unnecessary tracking. You insist that websites have to display content regardless. Reality demonstrates otherwise - this is a practice sites do all the time.
Again, cart's aren't actually necessary. They make it easier for users to buy multiple items, but you can make cart-less checkouts by having customers select all items on a single page. Thus, by adding cookies to implement a cart without consent you have violated user privacy for reasons unnecessary to provide your service.
That's not it works. Someone complains to the Information Comissioners Office (ICO). ICO determine if the complaint is valid and will get in touch with the site owner to help them come into compliance.
> Or you can just throw up a cookie disclaimer to cover your ass.
There is no such thing.
You have to make unecessary data collection and tracking opt in. You can't have a notice that says "we might do x unecessary data collection and/or tracking" and make the user click it or go away. You need to be compliant, or you need to not serve the European market.
In some countries your competitors or some other third parties can just directly send you a cease-and-desist letter if they believe you're violating some law.
Even if that letter turns out to be unfounded because it turns out that implementing a shopping cart using cookies without an explicit consent is a legitimate use case, they're quite a bit more of a hassle to handle than your supposed friendly ICO just "get[ting] in touch with the site owner to help them come into compliance".
So one more reason to err on the side of over-caution and just put up a popup for any kind of cookie...
If you don't come into compliance with data privacy laws after being helped to do so by the ICO, they yes, you deserve to end up in court.
> Right, and websites don't display content unless this supposedly unnecessary data collection is opted into.
That's literally not allowed under GDPR. You can't avoid the GDPR by doing soemthing that is in violation of the GDPR. It's like trying to avoid getting a speeding ticket by going faster.
> You insist that websites have to display content regardless. Reality demonstrates otherwise - this is a practice sites do all the time.
Yes, and they're not compliant with the GDPR. Not all sites will get the tap of the ICOs hammer though. Some are going to be too hard to enforce (non-EU only entities for instance) and some just won't get complaints.
> Again, cart's aren't actually necessary.
Nope, they are very much allowed.
> Thus, by adding cookies to implement a cart without consent you have violated user privacy for reasons unnecessary to provide your service.
Nope, totally incorrect.
Well, it worked for the Dukes of Hazzard, and it seems to be working well for Facebook et al so far...
The thing is, wait staff need to use pens/keyboards to do their job. It's part of what it is to be a waiter or waitress.
GDPR doesn't make website owners ask people if they can use cookies, you can use cookies just fine without asking people. You have to ask people when you want to collect or process more data than is required to provide the service.
The point of the analogy was to make a comparison between being clean with data and being clean with food.
I don't have any first-hand knowledge here, but my guess would be that the corporate lawyer's recommendation is always going to be "just get consent for every cookie". The alternative is to risk lengthy litigation over whether specific cookies required the consent. If they ask every time, they can avoid that nightmare.
Because of this, the notice doesn't really serve any purpose of a signal of sysop goodwill. Virtually every business large enough to have lawyers will add it where there's the possibility it'd be required, regardless of the cookie's intention.
Well-intended law that causes many negative side effects is still bad law, just as well-intended software may very well still be bad software.
Some lawyers make restaurants get waivers from customers before they order steak that's not fully cooked. It doesn't mean it's necessary (and I would definitely not eat at one).
> If your answer is "the entire world is stupid," then I'd argue you don't understand how the field of design is supposed to work.
And I think it really sums the argument up. Good design and engineering is about building something that performs its function efficiently, reliably, and unobtrusively. If something is widely misunderstood or misused, it's a design flaw.
"Blame the [law-abiding] citizens" is just as much of a cop-out as "blame the user".
In this case, however, it's not a case of general misinterpretation or misunderstanding. It's a case of the law creating very strong -- like significant-millions-of-dollars-on-the-line strong -- incentives for every significantly-sized company to harass every visitor. That's a pretty huge flaw.
It sounds like your response is basically "well if they aren't doing anything wrong, they have nothing to fear! just go to the tribunal and prove that every cookie is innocent." And in that case, please refer back to pembrook's quote above.
[0]: https://www.cookielaw.org/wp-content/uploads/2019/12/icc_uk_...
[1]: https://www.engadget.com/2020-01-13-websites-not-following-e...
However, that law does state that you don't need to get permission if the cookie is:
"Strictly necessary to provide a service explicitly requested by the user"
A cookie that remembers your shopping cart if you leave the site and return to it later. A cookie that remembers any preference you register if you leave a site and return to it later. A login cookie that persists after you leave the site doesn't explicitly require consent, but if you don't get it, then you are technically deviating from the guidelines that "[strictly necessary cookies] will generally be first-party session cookies" and that session cookies are "temporary and expire once you close your browser (or once your session ends)". If you had a persistent auth cookie, it would be reasonable to lean towards consent based on the published guidance.
> Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in.
> To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:
> Receive users’ consent before you use any cookies except strictly necessary cookies.
Your stated understanding of when consent is and is not required is simply incorrect.
Yup.
> login cookies
Put an unchecked "Remember me" checkbox on your login page and link to your cookie/privacy policy. This is a good idea anyway as the user might be on a shared computer.
> Preferences cookies
Allowed to be persistent as long as they don't contain user identifiable information.
> A cookie that remembers your shopping cart if you leave the site and return to it later.
I couldn't find any specific guidance on this, so it seems reasonable to use a cookie that might last a few hours or so, then have a talk to your local Information Commissioners Office if someone complains.
OK, I am willing to be educated, point me at the place in the regulations this is discussed.
> Not only is your interpretation of the regulations very highly opinionated, but it’s just outright wrong on some points.
s/opinion/interpretation/
> The guidelines also state that even for Strictly Necessary cookies, the site must explain why they are necessary, something your canonical example of a good site fails to do.
You don't need to do this in a cookie popup consent dialog. You are welcome to carry on thinking this if you want to though obviously.
> OK, I am willing to be educated, point me at the place in the regulations this is discussed.
It is not discussed, it is stated very explicitly:
>(66) Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.
https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:...
If you want to persist any preference information, you must get explicit consent. Whether you use that information for tracking or not, or whether it is combined with PII or not, has absolutely no bearing on your obligation. The act of persisting that information in the users browser requires consent. As this is a directive, it will be implemented independently by every member state, so if you want specific guidance for a specific state, you'll have to look it up. I linked the UKs guidance on this to you above, which you ignored. The facts are:
> If you want to persist any preference information, you must gain explicit consent
> The existence of cookie consent dialog is not a sign of malfeasance
> Lack of a cookie consent dialog is not a sign of lack of malfeasance
> Your stated interpretation of the regulations is very highly opinionated, and not supported by any jurisprudence
> Some of your stated interpretations are just demonstrably wrong
> The actual regulation is almost never followed
Based on those facts I would argue that the regulation has provided no benefit to the public at all, and has simple created a global nuisance that we all have to put up with now.
Emphasis mine:
However, such devices, for instance so-called ‘cookies’, can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose.
Where are you getting that some cookies don't require consent?
> Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.
See the "Cookies and the GDPR" section for discussion.
> Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in.
and further down the page a little bit:
> Receive users’ consent before you use any cookies except strictly necessary cookies.
I sincerely hope that nobody reading this thread follows any of your terribly incorrect advice.
You mean putting trust that a website behaves by implementing its own popup system versus enforcing it on the browser side with a single implementation? Doesn't sound sane to me.
Why don't we implement a law where visitors cannot enter your house when you are not at home, unless you consent. That way we can get rid of locks.
Very sane.
If you hire Harry Potters friend to create a totally magic way to track users and collect data from them GDPR still covers it.
We already have P3P to allow websites to declare how they want to use your information. European legislation should have focused on leveraging these existing tools and protocols to give control to the user, instead of annoying them with endless pop-ups.
1. https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
Also it seems either I or someone else misread the context. I'm in the broader GDPR context while someone else seems to be in the older cookie law context.
Using fingerprinting for tracking is not GDPR compliant.
Very sane.
Unless of course you block me from your browser, then I can't do anything.
Trying to say that the law is bad because it doesn’t conform to some idealised version of it you had in your head doesn’t mean the law is bad.
This is not only sane, it is very obviously the only way it could be done. Remember, the law isn't about cookies or headers or anything specific: it is a law about user tracking. You're delivering JS that paints a font in a hidden area of the screen? It's then measuring the results and reporting data back to you to track this particular user? Then you need to ask for consent. The browser can't possibly know the intent of the code it is running, so the browser can't be made responsible for protecting user privacy.
We don't need to imagine a world like that, because it has nothing to do with what we are talking about.
Let's stick to the real world. The EU implemented a law. Everybody is scared of the power of the government, so they implemented what they thought was the intention of the law, to avoid prosecution. The mom-and-pop flower shop down the street could care less about making troll political statements about technical internet topics.
Turns out, the law had stupid unintended consequences. Was the person who designed it stupid? Or is the entire world stupid?
If your answer is "the entire world is stupid," then I'd argue you don't understand how the field of design is supposed to work.
The same companies have their customers convinced that they need data collection to turn a profit.
As a result we see all kinds of stupid attempt to circumvent the law because an entire industry of shady data collectors and brokers have convinced businesses that the only way of making money online is by tracking people.
The basis of your argument is: All data collection is bad.
Therefore, in your model of the world, an evil conspiracy of bad actors are looking to strategically undermine the law with various dastardly convoluted schemes. I understand why you're arguing that, given the premise you're starting with.
However, the majority of business on the internet are not doing evil things with your data. They simply want to better target their offerings to their customers, allow for you to keep items in a shopping cart, etc. If they are providing better services to their customers, they make more money and the customers are happier. It's a win win for everybody involved.
Could it simply be that, most businesses put cookie popups on their sites because they don't want to get fined? Not because they are embroiled in an elaborate scheme to undermine the law?
Could it be that the EU should have created a smarter law that would actually help people be more aware of data tracking? Instead of stupid popups?
I wouldn't be so sure. There aren't that many advertising and analytics companies, but they make products that are widely used (and clearly misused) everywhere. The websites using such tools were never told that they could avoid having the banner if they just didn't have tracking cookies.
Using user’s data within the confines of a web app is usually OK so we can put just small much smaller guardrails up to keep companies respecting the public good.
I generally just don’t like my data shared with third parties. A single web site can literally pass your data on to hundreds of companies (as discussed in the book on Surveillance Capitalism).
As a user I don't want anyone to "better target me" - no single exception. Gosh I miss the time where we just burned the McDonald's...
There's no need to straw man secret cabals of conspirators, when it's just business. (Or if you want to get political, capitalism). When big tobacco companies pour money into lobbyists, fund skewed studies, and buy ads to flout anti-smoking legislation, no one calls it conspiracy. Businesses are incentivized to respond in certain ways.
They can do it without the cookie notice. For example, Amazon can track what I'm looking at on their site and what I'm buying and store it to their database. They can use this information to offer me what they think I'll like. Also, another user-friendly approach would be for a site to ask me to select categories/topics that I like. Whatever it is, GDPR gives me a right to export the data, review it, and ask for it to be deleted if I don't want the site to have it anymore. No need for cookies in this scenario. What they need cookies for is when one site wants to track what I do on other sites.
> allow for you to keep items in a shopping cart
This is a functional cookie and there's no need to ask for consent to store a shopping cart. This is just a perfidious argument that data tracking companies use to ridicule the law.
> Could it simply be that, most businesses put cookie popups on their sites because they don't want to get fined? Not because they are embroiled in an elaborate scheme to undermine the law? Not because they are embroiled in an elaborate scheme to undermine the law?
The law is very clear about when you need to ask for consent and when you don't need to ask for consent. Most sites implement it in a wrong way, many of them use deliberate dark patterns, for example, when you deny cookies you get a loading spinner that spins for a couple of minutes. These are all attempts to condition the user into avoiding pressing the "slow" button.
I don't think that's stupid, nor unintended.
Only by using a very loose definition of "implemented" sans common implementation measures like clarification and enforcement.
> implementation measures like clarification
No directive needs clarification to be implemented as law. That's the most absurd thing I've heard all year.
> If your answer is "the entire world is stupid,"That's not what actually happened. Companies got scared that the law would impact their business model, for which the law was directly design to impact, and asked lawyers to find the minimum change which could be argued as being in compliance.
When you ask lawyers to find a solution to a problem you do not get the intention of the law. If you ask a lawyer to find a solution to tax law you don't get the intention of the tax law, you get tax avoidance, the direct opposite. And if you ask a lawyer about consent, as I have done during conferences, you get straight answers like "People can consent to a 20 page EULA they have not read or have the legal education to translate".
It not that the word is stupid or that the person who designed the law is stupid. It just happens that if you pay a lot of people who have studied and spent a large part of their life to find clever interpretations of words what you get is a clever interpretation that may or may not be what a judge will see.
To make a quick parallel, a bunch of lawyers for companies are arguing that while the company is having millions in profits and giving out a lot of dividends to shareholder, the company is at the same time in "economical crisis" and thus deserve government grant money in order to handle corona. The department in charge of giving out the money asked its lawyers and they agreed, but the politicians are now a bit upset since they disagree. And so now everyone is arguing/blaming each other and discussing if they should change the law to specify what an economic crisis is and isn't and if the change to the law should be retroactive or not.
It sounds like you're saying the lawyers are smart, but the government is still stupid.
Why didn't the government have any lawyers involved in writing the law?
Isn't that pretty...stupid?
No, they didn't. They implemented something that they thought allows them to continue with the practices that the law was specifically designed to combat.
The user has very little motivation to accept tracking. The web site has a lot of motivation to track the user (because personalized ads = more money).
Thus, web sites make saying no as difficult as possible, while making saying yes as easy as possible.
A 100% compliant, user-friendly implementation would be showing non-personalized ads, then occasionally replacing one of those ads with a banner "want to receive ads that are actually relevant? click here to enable personalized ads" (which would lead to an informed consent dialog and set a cookie that would then apply to all web sites that use that ad provider).
But pop-ups coercing the user to consent are more profitable.
This could be fixed by enforcing the actual law (punishing the companies that tried to weasel out of it and processed data without valid consent) so that trying to weasel out of it is no longer a valid strategy.
A law that doesn't take into account how people react to is not "perfectly sane". This was the obvious outcome before it passed.
Law is a back-and-forth process; you can’t just create a perfect law on day one then stop evolving.
FTFY
Cookies are also just a method. GDPR is not specific about it.
Like with DNT? Nobody cares about that. Defaults matter too and DNT is default off. So it probably adds more entropy if you enable it.
Besides that: Technical cookies (or any other storage in your browser) that are required for your site to work do not require consent. Tracking from ads are obviously not included in that definition.
For purly functional cookies like they are used for CSRF prevention or login cookies do not require any user notifications as far as I know.
(Be aware that this is only true for login cookies which are just used to handle a active login, which means they must set the right flags to not be send to a different domain, etc.)
Sites were supposed to stop using a shotgun method of grabbing all data they can, sharing it with everyone that will take it, and hoping something will stick. They were supposed to take responsibility for data they collect and share.
But instead of changing anything, sites went for the laziest workaround (which apparently isn't even legal), so that they could ignore the legislation and keep business as usual.
It's obviously against the spirit of the law to have 200 different boxes that must be individually unticked, or the sort of nonsense that Oracle were pulling a while back (maybe still do) with the intentional delay spinner if you don't 'opt-in'.
If you can't run a website without literally violating the users basic human rights, then just don't.
Certainly the bar owner cannot distribute the videos without explicit consent. And yes, that can be problematic in many cases (for examples, capturing faces of people in a concert).
If a shopping center would want to distribute surveillance camera data to 'trusted partners' for marketing research without informed consent of the customers, that would definitely be a GDPR violation, and there would not be a "if you don't like it then don't go to that supermarket" situation but "if your supermarket can't survive without that income, then tough luck".
Correct, and thankfully website operators don't get the choice to violate users privacy without consent.
When you give up a small piece of seemingly insignificant data about yourself a million times per year, the aggregate is wildly more significant than the sum of those pieces. When you and everyone you know give up the aggregate of each persons aggregate information, again, its value is compounded. Finally, since no one has any insight into nor control over where their data ends up or how it's used down the road, the danger of sharing is even less evident.
Good can and does come from transparency, but this is one-way transparency. It's top-down and is begging for abuse. If we had a truly voter-representative government, it would have already created laws to mitigate the easy-to-anticipate problems that arise from massive accumulations of personal information, and we would no doubt have a better, if less profitable, WWW as a result.
Start from the top of the list every month, and slap any continued violator with 10x the previous fine. Go as far as time allows within the month.
I bet by the start of month 3, 90% of the sites would be compliant instead of 99% of them blatantly violating the rules.
> It shall be as easy to withdraw as to give consent.
Is consent given by agreeing to a huge banner that pops up anew every time you load the page?
Fine, you can do that, but then you have to pop up a huge "withdraw consent" banner every time a user that gave consent visits your site. Which you probably don't want, so you can't do the obnoxious opt-in banner either.
In practice, that would make any obnoxious way to ask for consent untenable, because you couldn't use it to annoy users into consenting (and staying in consenting state).
(I'm wondering if they're teaching me to hit the de-emphasised button by default.)
To quote:
"Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors."
Source: https://ec.europa.eu/digital-single-market/en/proposal-epriv...
So... maybe you should go back in time and tell the EU back at the turn of the millennium that...
People say that DNT failed because it was selected by default - but no, it failed because compliance was voluntary. The EU principles require explicit opt-in confirmation, so a browser setting that's set to "not track" by default is a reasonable way to do it, it only needs enforcement to ensure that websites (in EU jurisdiction) treat the DNT header as binding instruction to not track that user.
One of them would be to make browsers responsible for providing sensible defaults. And while the public perception might think the webpages are at fault it was the browsers that were responsible for storing and broadcasting private data. Arguably without clear and informed consent.
Of course there are problems with requiring software to have sensible default settings, but I reckon most problems with any legislation are due to the fact that none of them address the fact that cookies are a perfectly private system (with the user in full control of their own data) provided browsers don't send this data with every request without permission.
There was definitely a prior movement to push these cookie consent settings down to the browser (where I think they have the most chance of being respectful of the user and their consent choices) - but the situation changed later during subsequent ePrivacy regulation drafts.
Please voice your concerns with your MEP if you can - displays of support can and will change policy directions.
This would also open the door to extensions that just default consent to 'no'. This can't be the default though, to avoid another failure like Do Not Track.
2. Because website builders need to write custom things for consent
Otoh, we already have cookie-consent in browsers. Just don't accept cookies if you don't consent!
P3P could be a hint for the the user-agent, but the user-agent would have to tell the server what level of tracking etc is acceptable to the user.
The solution is just proper enforcement and education. Opt-out by law must be the default while opt-in requires extra actions. Just teach people to always click No and eventually the dialogues will go away.
https://ec.europa.eu/digital-single-market/en/proposal-epriv...
What you want is the ePrivacy Directive which "introduced" the cookie banners many years ago and its updated version which is (still) not ready.
Since the browser itself stores the cookies, it has the absolute authority to stop them.
https://en.wikipedia.org/wiki/GDPR_fines_and_notices
Google, $50M; Marriott International, £99M; British Airways, £183M; 1&1 €9.5M; etc.
I contacted my MEP at the time about this, and please do the same if you can voice your support for simpler, genuinely user-friendly and consent-respecting settings.
That could lead us back to the current situation where consent dialogs are designed by advertising networks, and result in user consent fatigue.
Blocking cookies should be done by users via software.
This is only going to make the barrier to entry higher and more expensive.
I have no idea what many small non tech businesses would do? Pay a few thousand every year when standards change?
That's the point. We want the barrier to entry in widespread tracking to be high.
For what it's worth, you don't need cookie consent warnings if you use them only for functionality integral to the product you offer your user. For example, if you need to use a cookie to facilitate a logged-in user session, you don't need to warn them.
The only ones paying the high price is the people who use it to collect user information not essential to the service they provide to the user, for god knows what.
That’s what is done.
The government doesn’t block cookies for you, they set the rules with user data, and the actors (service providers and users) act accordingly.
That’s how things should be.
I don’t want the governments to build or design software, I want them to set the rules and let browser developers and other actors react accordingly. If the reaction isn’t judged well intended or good enough, they are sanctioned accordingly.
Encoding the usage of a particular (probably otherwise short-lived) technology in law is generally a pretty bad idea. Sure, have the EU write laws about cookies - the two outcomes are A) this becomes useless when people switch to a different tech stack that doesn’t use cookies B) we’re stuck using 30-year-old technology to try to get things done, at least for regulated industries like banking or government services. Like the IE regulatory situation in Korea but worse.
Quoting recital 30 of gdpr
"NATURAL PERSONS MAY BE ASSOCIATED WITH ONLINE IDENTIFIERS…SUCH AS INTERNET PROTOCOL ADDRESSES, COOKIE IDENTIFIERS OR OTHER IDENTIFIERS…. THIS MAY LEAVE TRACES WHICH, IN PARTICULAR WHEN COMBINED WITH UNIQUE IDENTIFIERS AND OTHER INFORMATION RECEIVED BY THE SERVERS, MAY BE USED TO CREATE PROFILES OF THE NATURAL PERSONS AND IDENTIFY THEM."
I found this from 2013:
https://www.zdnet.com/article/south-koreans-use-internet-exp...
Anyone have an update to that story? I know in Korea they use a ton of apps to order things all the time now. Maybe this law was phased out, or just didn't apply to phones?
Not to take away from your broader point. Laws are just such a terrible development model. Everything's tested live and you can't easily revert anything.
> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
From: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL....
I'm an old dude, so I never understood why you would require websites to ask for cookie consent, when you can handle that more safely in your web browser.
That's like putting a sticker on your car saying "Don't come into my car" instead of just locking it. Why do you need regulation when you can just let technology solve it? No idea.
So NO! NO fucking cookie consent API! Just let the browser ask you when a cookie needs to get set... DAMNIT!
In my day, website used to be websites where you could read stuff. Anyone who wasn't able to predict these annoying popups after HTML5 and GDPR, is seriously blind.
(Sorry for the rant ;))
I'm stuck in Europe. I was fine without the GDPR. Now, I waste my time clicking "accept" because I don't have time to deal with this crap. Meanwhile, my university has hired what my stepfather would have called a "tweety little person" to police GDPR regulations. God knows what she does (she doesn't). God knows in what single way she has improved a single person's life. But she has a job now, and by God, she'll fight for it.
I care about privacy, but there were options to manage this already - like browser extensions. You could download them if you cared, and if you didn't want to, you didn't have to. Government regulation, demanded by zealots, has added one hundred tiny frustrations per day to millions of ordinary people, caused an expensive pain to thousands of small websites, and created a new, wholly useless compliance industry.
And is Facebook tracking me any less? Ha ha ha. Facebook can afford lawyers.
The argument I always hear is "Ordinary people don't know about cookies so it's the websites responsibility". As if ordinary people now understand cookies.
It's all a big fiasco, supported by people who think theory works in practice.
Have you read the GDPR, though? Because in no way does it require "cookie consent", incidentally, neither did the previous "cookie law". The consent forms I've seen so far are all willfull misinterpretation, dark patterns, or both.
95% (if not more) of non-shady uses of cookies do not require consent, and thus don't need a consent popup. If you do implement one on your website it means one of several things:
1) You did not actually read or understand when/why you need consent
2) You did read it/don't understand, but are unable to figure out where all the stuff on your site is actually coming from and are thus unsure about the implications
3) You actually need consent (in case you are hosed anyway, you can't predicate usage on consent, so there's 0 motivation for users to ever consent)
4) Your purposely trying to annoy EU residents in hopes they will lobby against GDPR back in the EU
5) You're blindly copying what other people are doing, because thinking is hard.
1. Is there risk?
2. Does adding a consent screen reduce or remove risk?
3. Is the risk reduction from 2 less than the cost?
Congrats, now every website in the world gets a cookie consent screen even if not technically required.
Not "subtly getting a minor detail wrong", but "doing something that is explicitly mentioned as not allowed" levels of wrong.
But 99% of businesses owners went to full panic mode and went straight to your point 5. "Our website needs such a popup".
Do you think the general public now understand cookies? Of course they don't.
Seemed all pretty obvious to me.
You can disable all cookies altogether in at least Firefox and Chrome. You can make them only last for the current session.
Power users, upon request, should be presented with and asked to accept/reject/blacklist/whitelist cookies.
Interestingly the only browser I know of that does this is Lynx, which is text-only and does not support Javascript.
What is your workflow when visiting a new site and figuring out what cookies to allow?
With browsers you can of course default to blacklisting all cookies and add exceptions as you go. I did this privately in Firefox until I was sent to work from home during the pandemic, after which figuring out what cookies I needed to enable to get Teams to work proved too much of a hassle.
The political is in trying to limit the options to either party like the Computer Fraud Abuse Act charging someone for entering in every possible phone number into a phone directory. The extreme unlimited (il)logical extreme is "If the user is capable of exploiting several 0 day escalation of priveledge attacks to download all of the credit card information and then delete the website that is on the designers for making a shoddy website" being legal. That would be a pure "no politics" UX system with many obvious and inobvious side effects.
javascript:(function(){(function () {var i, elements = document.querySelectorAll('body *');for (i = 0; i < elements.length; i++) {if (getComputedStyle(elements[i]).position === 'fixed') {elements[i].parentNode.removeChild(elements[i]);}}})();document.querySelector('body').style.setProperty('overflow','auto','important'); document.querySelector('html').style.setProperty('overflow','auto','important');})()It might be that I'm dumb and can't figure out how to add a ublock/umatrix rule to block it, but I'd love a single purpose addon that just deletes "overflow:hidden" in all cases.
https://chrome.google.com/webstore/detail/behindtheoverlay/l...
https://addons.mozilla.org/en-US/firefox/addon/behind_the_ov...
And while it's rarer than those, I've definitely also seen page components which show a preview of the content until you click on them, then expand to show everything else. Those would break as well.
So while you'd certainly block modal popups that prevent scrolling, you'd also break a bunch of things on other sites that use the overflow property for more legitimate reasons.
The slide out menus would be a shame, but I'd give that up to prevent it's rampant abuse everywhere else.
It's likely that simply setting a particular cookie with a dummy value would bypass this.
Just use NPR and donate the amount you'd willingly pay for the paper to your local station.
The server doesn't serve you the content until you accept... so it does matter what the server does.
I don't know which this is (or where the line is), but here's my latest project at my day job, where we used `position: sticky` for a sort of control bar, that I think worked out fairly well. (There are still some UI issues, but I think fewer than most of our peers trying to implement similar functionality).
https://digital.sciencehistory.org/works/4j03d097t
Switch to "transcript" tag, scroll around, click on timecodes to listen to that part of recording, etc.
(But can someone give me the personal satisfaction of agreeing the project I just finished made a legit and cool use of position sticky, haha).
It's also possible that the creator of the site did some weird stuff and the entire body has fixed positioning for some weird reason. You can't predict how people will use innocuous CSS rules, and randomly deleting elements just because they have a certain style is easy but wildly imprecise. Seems better to just set everything with position: fixed to be position: static and unset any overflow rules.
Alternatively, you can put user options there too, like a sort of floating toolbar. Sites like Medium do this in their WYSIWYG editor, and some of my own sites do this to display such options to logged in users.
Oh, and media players you might want to keep open as you scroll down the page/through the site. YouTube has a miniplayer option for just this, and a site with a music jukebox might want to use the same thing there too.
And yes, those mini carts you see on ecommerce websites when you add a product to your basket.
> webmail client
> WYSIWYG editor
> media players
So did GP edit their comment, or did you ignore half of it?
Also, your accusation isn't warranted. Just because someone doesn't know your arbitrary distinction between web app vs web site doesn't mean they ignored the person above them.
I don't think most people would consider HN suddenly a web app if it upgraded its <textarea> into a wysiwyg markdown box.
It's subjective. Your assertion that it's arbitrary is unfounded; you're clearly not even trying to imagine what a reasonable definition of that distinction might be.
> I don't think most people would consider HN suddenly a web app if it upgraded its <textarea> into a wysiwyg markdown box.
I'm pretty sure HN wouldn't need to abuse position:fixed to implement a WYSIWYG comment editor.
https://ec.europa.eu/digital-single-market/en/proposal-epriv...
Then the browser can display this however it is needed and let the user decide which to accept. Plugins could also automate this for the most popular websites so that only the necessary ones are used.
I just block all non-first party cookies with uMatrix. It's not perfect though and sometimes others have to be enabled, especially Google otherwise you'll spend your life completing Captchas.
DNT exists but either is not respected or as I've read around, being used to sieve out and track those who do not wish to be tracked.
In a perfect world where everyone is playing fair, site owners would be able to convince users that tracking is beneficial for them and such benefits for users would exist and would convince users to whitelist sites. But sadly, our reality is different and we're facing the aggressive modals - "give us consent or else you won't see the content".
I do understand that there's a need of earning money but this shouldn't be done by deceptive tactics of dark patterns and empty "we care for your privacy" slogans. But then I also don't believe that we'll face another "revision" of how tracking choices are handled done by regulators - not with Google around who's implanting this idea that Google Chrome is the Internet and we don't need address bar.
I just loaded up the home page of The New York Times (a random example), and it had placed 23 cookies on my laptop before the "Your tracker settings" window finished loading. Now I still haven't clicked "ACCEPT", and we're up to 43.
my understanding is no consent = no tracking cookies. session cookies are okay.
IANAL, though, so I could be incorrect.
To be fair, though, that's pretty clearly a bug; at a minimum, any site that's just serving content should be fine with no cookies. Of course, any site that's just content should also be at least 95% functional with no JS and barely any CSS, and we all know how that worked out...
No doubt. I was just making a statement about the current state of the web. Not applauding it in the least. :)
For exemple, as I said in another post, is explicitely allowed:
* Cookies for login/session
* Cookies for shopping carts
* Cookies for interface personnalisation (language, etc.)
* Cookies for load balancing
* Cookies to retain user choice regarding cookies
And quite a few other. So really you can run your website without consent notice if you care enough. One grey area is analytics, it varies amongst european DPAs. That I know of:
* In France it is allowed if you respect a few rules (no cross-processing, no localisation, etc..)
* In the UK, it is not per say allowed, but the ICO said they would not prosecute on those grounds.
The prompts were turning me crazy especially since I use a few privacy extensions that made it impossible for the websites to remember my settings. It meant even browsing the same website lead to one consent form per page I clicked...
EasyList Cookie: https://easylist-downloads.adblockplus.org/easylist-cookie.t...
AdGuard Annoyances filter: http://adguard.com/filters.html#annoyances
(There is also "Fanboy’s Annoyance", but it blocks more than just cookie notifications. For example, it blocks social media share buttons which I use a lot. So I don't use it.)
See here, under "Cookie Compliance": https://gdpr.eu/cookies/
This addon [1] will let you do just that. You can configure it to tell all sites to slurp as much of your data as they want, if that's what you prefer.
> How are we making anything better with all these cookie consent pop ups?
"We" are giving people back control over what happens with information about them. This is widely considered a good idea, though perhaps not near you ;) The pop-up part can be automated by software if you prefer a one-size-fits-all configuration, as described above.
[1] https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat...
With auto updates, you can't even verify that it isn't doing anything unwanted just once.
It could easily make sense to the developer to one day sell to someone who wants to do bad things which is commonly what happens with these.
I wish this wasn't true because add-ons like these are powerful and required for the modern web.
I think that they should scare you because they're, not surreptitiously but by design, consenting to innumerable requests to share your data without your interaction; but I guess to each their own scariness.
No. We are training people to click on every button and consent to anything that they are presented.
And the regulation isn't for tech-savvy power users, it's for the general population. And they do click every consent banner.
Even the most tech-savvy HNer was clicking through those without any thought and soon turned auto-consent on (aka disabled UAC).
A cookie policy with lots of legal jargon that's 5 pages long and impossible to understand is probably hiding the fact that the visitors are the only product of that platform.
On the other hand, if the cookie policy is straightforward, honest, and transparent I will be more likely to engage with that platform, even if I am the product. Less information will never make you safer or more well equipped. Especially in cyber space.
Think of it like getting a contractor for your house. Do you want the guy from Craigslist who only takes cash or do you want the licensed journeyman with insurance who invested in making sure he is well equipped and minimally liable?
Provider that gives me 1-5 check marks to make once (and where the default settings are "off"?) - trustworthy. Anything like Verizon properties which gives an intentionally bad UX with thousands of clicks, information overload, dark patterns where 'accept' = 'accept all' even when you unchecked some boxes.. all this tells me I don't want to support this site.
And gdpr does much more, I don't think Google and Facebook exports used to really be possible so easily.
I see it as MY data and YOUR data is pretty worthless. Aggregate data has value, but then that doesn't contain much insight about any individual at all.
Isn't it true that the more people's data you have, the less it says about any individual?
I don't see why it would. Unless legally compelled not to, why wouldn't you save both PII and aggregate?
Is TechCrunch some kind of bot aggregated site? Or is the irony just lost on them?
Most people I've talked to who are not strictly technical are blown away by the realization that facebook for instance knows any site you've visited so long as it has a "like" button on it. "But wait how is this so?" is what I often get. To which I take a deep breath and say "You know what... It's magic".
Truthfully people concerned about privacy either know what they are doing or use vpn's, tor and so on. The whole "consent" thing has simply turned into another annoying popup at this point.
But isn't that exactly an argument for why it is useful? If a site puts this big banner in your way, and you have to get rid of it to navigate, and if it seems consequence-free, then you'll do it. This is just saying that there has to be a way past the cookie-consent wall, so that the decision is no longer between "agree to this apparently without consequences" or "no content", but among "agree to this apparently without consequences" or "decline". Maybe lots of people will still choose the former, but at least you get a meaningful alternative, and that'll reduce the people allowing cookies (and, more importantly, give an option to those who do know about what they're agreeing to).
That's exactly the reason the law exists! And that's why it has to say that the clueless option ("just clicking") should be the one preserving your privacy.
It's why the law goes through such lengths to make the dumb thing the right thing: Because it's supposed to protect the privacy of people without those people even having to know what happens.
Even coloring the consent button green and the reject red is clearly against the spirit of the law, if not the letter.
I’m all for having a law that’s so strict that or requires a more complex action to consent (e.g if reject-but-continue is a click then consenting has to be a checkbox first etc).
Mindless clicking is what should be handled. If users have to search/read/think the law is not going to help - but it should be there to help those who won’t/can’t.
Edit: also, another observation from the field: Often the users aren't as clueless as certain lazy admins claim. And I am a sysadmin :-)
User agent: <0.01% Content language: <0.01%
On the subject of content language alone I'm willing to believe I'm more likely to be <0.00000001%. So combine all those together, and I'm pretty sure you can narrow down my identity to a single digit number of possible individuals, if not pin-point me exactly, without bothering with cookies at all. Which makes the whole privacy argument pretty stupid to begin with. Take someone like google and how many people use google analytics. Forget the cookies, forget everything: "oh I know this guy"! Same story with facebook like buttons and whatnot(if I hadn't blocked all traffic from facebook that is).
Here's some examples: - http://www.lingscars.com/images/pdf/icoletter.pdf - https://nocookielaw.com/
You just need to stop tracking people.
If you don't engage in tracking - congrats, you get to have a website without this shit.
Stop complaining that the GDPE has broken the web and start realising that every site with a dialogue up os sharing your every move with anyone that will pay.
I sure as hell don't, my mom and aunts don't, they have a harder time using the web because of this.
It makes everyone a privacy nut job, when most of us don't care.
An other person I know had issues of identify thefts and are now quite concerned about their data being thrown around. Once a person has gotten burned they tend to become a bit more concerned about the potential issues of private data just floating around everywhere.
But neither person care about cookies. They don't work with computers or care about web technology. The cookie existence or non-existence is completely irrelevant.
Most come from places where you give them your info, like phone number and address.
If you are going to do such a broad requirement, I'd like to see info on this, how many scams are run on cookies? Is the price of adding these cookie walls worth it?
To me this seems to be run on top of privacy nut jobs who don't get the real privacy threats we are facing.
I am much more concerned on broad usage of facial recognition than I am of cookies of recipes my mom reads online.
Now you can't exchange a service for data anymore, this is outlawed now, I don't know if thats good.
If data a company collects about a person end up being used by scummy call centers or data identity theft, then any victim should have the right to compensation equal to 10x of any monetary losses, and for every 100 victims the legal person responsible at the company that authorized the data collection should get 1 year in prison. No consent needed, no exceptions allowed. Just simple damages and jail time.
Sadly laws are not written like that and companies would not want to exist with such sword hanging above them, so we end up with laws like gdpr that tries to have enough threats to push companies in the right direction, with mixed results.
But the irony is what makes me angry, the government will create such nice laws to protect us from the tyranny of corporations, when governments are collecting all types of data, specially facial recognition, which IMO are way worse than cookies.
Google inserts many of those banners due to google analytics or ads being used. Their main intention is to gather more user data and make users provide data. This is NOT a 1:1 match with what site owners will want - which is to have users and some basic analytics.
The cookie banners are hostile and intrusive because they are designed to be so. The hope is that users are trained to click 'yes' to get rid of the annoyance.
The GDPR explicitly states that technical cookies are fine, so most sites wouldn't need any banner except for using google analytics & ads. So use a different analytics and you don't need a banner.
It's not the law, it's the implementation and the oligopoly of and companies pushing this implementation.
And then on your actual device at home, you only ever look at the screenshots.
That way, it becomes technically impossible for these websites to collect data on you, no matter how much fake consent they acquire.
So long as any company thinks "I'll just use this dark pattern until we get complaints, everyone else is doing that and I don't want to lose ad income for no reason" the law is broken. The example has to be so clear that it is percieved as better to have the company die from lack of ad-revenue, than to put up a cookie wall.
Companies should think "Ok we'll just have a discrete and compliant opt-in and hope that people will actually use it, and if this kills our business that's still better than the horror story that happened to FooCorp when they tried to pull that cookie wall stunt."
No industry has a right to exist.
very well put
I know this especially well because I automatically clear all browsing data each time I close my browser, and techcrunch.com is one of the domains I avoid on HN because of the more annoying "welcome" on any page. (edit: +n)
I wonder where things are heading.
If there is such a company I'm completely ok with them not being viable anymore.
i don't know where all the misinformation comes from, but companies don't need to provide their services for free. they can still show ads - just untargeted ones. or is ads = tracking nowadays?
This is what Google's advertising product started out as, basically automated magazine advertising at scale; it turned into this perverse tracking system once everyone was hooked onto free web content and nobody could get away from it.
Or you can just leave the website. It's not like you lose anything by not going to techcrunch, let alone lose your job or anything serious.
Targeted ads make the website a lot more money.
Your original statement made it sound as if you were saying all regulation is justified. Thanks for the primer on free-market/regulatory trade-offs though I never realized there was room for nuance.
The idea of GDPR generally is to prevent some undesirable behaviour (i.e. indiscriminately vacuuming up all the personal data you can and being careless with it), in part by establishing a regulation that says "you need to have good reasons if you want to process personal data". This means we have to define, among other things, what "good reasons" are.
In GDPR terms this would be the "lawful basis" for processing data. There are a bunch of these, including "you gave explicit consent", "it is a legal requirement", and "we have a legitimate interest in doing so".
The thing is, if "consent" is the basis on which you are processing data, then you cannot reasonably refuse service to someone who witholds consent – because that action would itself demonstrate that consent is not the lawful basis you are using. It's not a ban on discrimination, but the fact that your argument for why you need to process personal data would no longer be valid.
This seems backward to me - by allowing access to users who don't consent, you are implying that consent to track is not at all necessary to your functioning, and thus doing the tracking at all is now for invalid reasons... yea?
Think of it like this - if you want to process some personal data, regulations now oblige you to have a justification for doing so. That’s what GDPR calls a “lawful basis”, and there are six of them that can be used:
- Contract – "processing your data is required to offer or fulfil a contract with you"
- Consent – "we asked to process your data and you explicitly said it was okay"
- Legal obligation – "we need to process your data to comply with the law"
- Vital interest – "you were likely to die unless we processed this data"
- Public task – "we need to process your data to perform some kind of officially sanctioned public service"
- Legitimate interest – "we need to process this data for some other legitimate reason and promise that we won't do anything unexpected or unreasonable with it"
So, if you're running a website and you want to collect visitor data, you now need to justify why you are doing so, using one of these reasons. Each of these reasons outlines when they can be used, and what conditions apply to their use as a justification.
If you were running e.g. an insurance comparison site, you'd use the "contract" basis – processing a subject's data is necessary to fulfil some kind of service. A separate "consent" is not required. If you wanted to log requests to your site so you can detect intrusion attempts, you have a "legitimate interest" basis and again "consent" is not required – instead, you need to ensure you have evaluated the data you collect and demonstrated why it is required to fulfil that function.
To the specific point you raised – if your website legitimately needs to process data for reasons that are "necessary to your functioning", then you do not need consent to do so. You do need to document why this is the case, communicate it to users, provide adequate safeguards etc. but don't need to obtain an explicit consent. If you aren't able to use this approach, you still need a justification for your processing; if you want to use "explicit consent" as your reason, then that comes with the requirement that the consent is freely-given, explicitly opt-in, and is not a precondition for accessing the service.
If you decided to make "consent" a requirement to access a service, you would inherently be demonstrating that you did not meet the requirements for making that your "lawful basis" for processing.
Sorry that came out quite long, but I think it's important that anybody working with personal data understands these ideas!
Thanks!
Even sexual orientation isn't really protected in that way FWIW, which is why a lot of anti-discrimination rulings surrounding LGBT rights can often feel a bit convoluted.
Edit: I'm surprised that elondaits's explanation isn't at the top of my thread. It makes clear that "exchanging your data as payment for 'free' services" is the target of GDPR and seems to me that's the only sensible explanation. Is someone willing to refute their explanation?
In this case, however, I was using it as an example of setting a price you don't expect to be paid... you want everyone to pay with their data, but you are required by law to offer an alternative payment form... so you set the price for the alternative to so high no one pays it.
It probably wouldn't surprise you that it is unlawful to require visitors to sacrifice a kitten to access a site, would it?
I understand that the GDPR makes it illegal to make it necessary to consent to give up your data before gaining entry. I was just questioning that portion of the law. It would be a pointless conversation to question points of a law and have someone respond back "but that is the law".
Actually, in some countries, outside narrow restricted cases like support groups, yes; criminal record is a protected class in some cases.
However, being an ex-con isn't illegal. Having a club where you required members to consent to a crime being committed against them, which is more analogous here, wouldn't be legal.
But this thing where big sites say "data or else" isn't a proper negotiation. It's a contract of adhesion, and those get regulated for good reason.
If things get moved behind expensive paywalls, that's a shame. But if there is more truely free access, or content behind paywalls that charge as much as an ad is worth, that can be a net benefit.
That's only true under ideological assumptions that are far from universal. I think most people would be OK with society putting reasonably-justified restrictions on the kinds of rules the club can set.
The point of the law is quite clear: allowing people to use the web without having anyone force them into giving away personal information.
Sure, some companies won't be able to be creepy to users, but that was an acceptable tradeoff to the law.
I just don't see people really caring about their privacy. When given the choice between convenience and privacy people generally choose convenience. As someone who doesn't have a dog in this fight, I just end up annoyed.
And just because people don't care doesn't mean a company is automatically allowed to track people.
If the law were followed by the letter and companies weren't using dark patterns or ambiguous marketing-speak to convince people to allow cookies, only people with pro-tracking stances would allow it.
I assume it would be legal to charge money for reading the content... could they require that you create an account?
It does seem to lead to some strange loopholes though, like requiring an account for access.
That's false.
Requiring an account or even payment for access does not replace or imply consent of any kind, and all rules still apply even if the user is still logged in or paying.
In fact, it's probably more complicated for logged-in users since you have to comply to requirements of data-scrubbing, removing/anonymising logins/emails/passwords from your database upon request, etc.
Meaning: more code that you have to write and time you have to spend.
I've found that sites are slowly changing over to this method but it will probably take a big court case for the likes of TechCrunch to change.
Edit: Never mind, I guess that would violate Article 7's "It shall be as easy to withdraw as to give consent."
Wait--that exists? Then Oath _definitely_ is violating GDPR. Continuing without consent is basically impossible on their websites!
Companies like Verizon can get away with this abuse because we're all too lazy to report them in an instant.
Verizon has offices in the United Kingdom, Ireland, Belgium and the Czech Republic, but you can also use the online form of your country to report them in the EU.
File a complaint against Verizon and TechCrunch here:
UK: https://ico.org.uk/make-a-complaint/your-personal-informatio...
Ireland: https://www.dataprotection.ie/en/individuals/raising-concern...
However, EU GDPR legislation permits the EU to do whatever it can go after noncompliant sites in any jurisdiction. The legislation also requires all new trade agreements between the EU and other countries to be GDPR-compliant. The legislation permits them to go after "noncompliant" sites for 4% of worldwide revenue. So it's quite brutally extraterritorial by design.
The interpretation of the regulation does not require large fines for small infractions by non-EU-focused sites, and indeed the regulators presently work to be eminently reasonable about such things, but the lines are fuzzy and the interpretation could change without further legislation — and even if you could defend yourself against such a case, it may be ruinous anyway.
But if the company has no offices, bank accounts or other business presence in the EU, there is no practical way to enforce it.
So, if sites can't provide users with anything in return for consenting, doesn't that make consenting not a valid contract? Or does the EU not require a contract to have an exchange of value?
So can they do previews only without running afoul of the law and they specifying cookies for full access?
Consent that's not freely given is not valid legal basis for processing personal data according to GDPR. If users clicked "I agree" under these circumstances, then that "agreement" click is worthless, it does not grant any extra permission that the website owner did not already have.
In essence, GDPR makes that consent to processing private data is not for sale, it's not something you can legally trade away in a contract for some money or benefit.
It's valid to have informative click-through walls - to gather assertions that the user has been informed that you're going to do stuff with their data because you have a legal basis to do it even if they don't opt-in; but a click-through wall fundamentally can not be a mechanism of obtaining valid consent to some processing where consent is needed. GDPR consent must be opt-in, fully informed, and freely given - something that some of your users intentionally choose because they want to. If you expect all users to "consent" to some processing then that's impossible - you would rather have to argue that the "legitimate need" or some other part of GDPR allows you to process that data without consent. You can have all users acknowledge something, but you can't have all users consent to something, that's not how opt-in consent works.
Several Austrian and German Newspapers present me with a clear popup choice "Accept Tracking" or "Pay Money"
The Washington post does the same.
Websites are not required to give you their content for free.
But websites are not allowed to track people who don't really want to be tracked. If the choice was "accept tracking or go away" then clicking "accept tracking" does not give them a legally valid consent to track me. There's nothing illegal about that popup as such, it's the tracking without consent that would be a violation.
Can you give me a link to some of these Austrian and German newspapers so that I can try out their approval pipeline? If that's really the case (all kinds of minor nuances may change the situation) then my intent is to click "accept", followed by a GDPR request of how they're using my data, and if their response indicates "consent" as the basis for processing something, then I'll submit a complaint to my local DPA (which may get resolved by the end of year..)
My point is that some EU companies still doing X is not a sign that X is permitted - often all it means that GDPR is not enforced for them yet. I see a lot of local practices that are still happening despite our local DPA clearly stating that this is not 'kosher' - it takes a lot of time to make all industries comply, there have been a lot of changes (mostly for the mass market companies handling offline customers, everything from hospitals to the rental markets to supermarket loyalty cards) but there's a lot of noncompliance out there. Every now and then another subindustry gets investigated (probably prioritized by the number of complaints) and after some action gets taken, all the other local companies in that industry tidy up somewhat.
I'we only seen "Accept ads" or "Pay Money", which makes it bit different.
There are also non-tracking ads, and you can consent to be tracked even if you pay money.
Which is absurd. Did I not "freely give" $20 when I bought a pizza because if I had been able to get the pizza without paying I would have?
GDPR consent must be opt-in, fully informed, and freely given - something that some of your users intentionally choose because they want to.
And there's no reason for customers to opt-in when you're not allowed to offer anything in exchange. I would respect the GDPR a lot more if it directly banned "unnecessary" data collection, rather than going through these silly rituals of companies using dark patterns to try to claim that users agreed.
The valid reasons for customers to opt-in are in scenarios where they desire the result to be customised according to that private data - where the customer wants you to use that data because that actual use benefits them. E.g. a dating site user might want you to use all kinds of private data for the purposes of finding better date matches. And the same user might not want you to use that same data for any other purposes or share it with third parties. And the intended result of GDPR (as the enforcement slowly changes the common practices) is a world where these user's privacy preferences are actually respected.
So the consent question comes down to essentially "are the users gifting you this data because they want you to have it?" - if so, knock yourself out, everyone's happy. But any selling or trading that consent is not binding or enforceable.
The most effective analogy that I can think of is sexual consent.
Like, if I sign a contract saying "You can fuck my arse and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my arse fucked unless I really want to (or there's some other legal basis, IDK, a warrant for a cavity search), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be rape no matter what I signed in the contract.
In the exact same manner, under GDPR if I sign a contract saying "You can violate my privacy and I get 5 euros for that" then that by itself does not count as valid consent, that's a nonenforceable term, it's null and void. At every future point I'm free to not have my privacy violated unless I want to (or there's some other legal basis), that's an unalienable right, it's not something that I can sign away in a contract, and doing so without my actual consent would be a privacy rights violation despite the contract.
That’s fine, isn’t it? They want money, I want information. If the information is worth it, I pay.
So it's up to you to decide if the information is worthy? After already seeing that information? And you promise you will forget that information after not liking it and not paying for it?
It's of course classic upfront payment. I realize this only works for larger articles. For news feeds a subscription would probably work better.
This will probably lead to market consolidation over time, but that's capitalism.
Heck, what if they said that everyone doing things their way is their condition on staying in WIPO, and if a country can’t bring its corporations into line, then the EU will declare all WIPO IP-right assertions originating from that country null and void within the EU, free for any EU corporation to exploit?
EU would effectively be declaring war on a significant percentage of the world. They have no jurisdiction beyond their borders.
Taking your ball and going home, while not the best for business, should be an option.
Or, to put that another way: WIPO itself is something the US "forced" on the rest of the world. But it wasn't actually force; it was just a condition on other nations continuing to trade with the US.
As per wiktionary.org: "To cease participating in an activity that has turned to one's disadvantage, especially out of spite, or in a way that prevents others from participating as well."
You are assuming a point I did not make.
Lots of companies won't ship things to certain countries, that doesn't make it a trade war.
What the heck? That seems a bit overbearing.
It's my server. Don't agree to my rules? GTFO. Why should you have the right to ignore my rules and still use my server? That's like having your cake and eating it too.
"Thanks, I don't consent to your monetization scheme but I'll go ahead and use your bandwidth for free."
Remember that the law came only because web site owners took things way too far. Pendulums swing both ways.
It's not that they don't consent to your monetization scheme, is that a monetization scheme that involves tracking people who don't really want to be tracked is illegal as such, you can't have one. You can deny access to whoever you want, but the key point is that if you "threatened" them to deny service if they don't accept, then that does not really indicate that they wanted you to use their data, does it?
You can't say "oh but I gave them some goodies to influence them to click 'Accept'" - nope, if they don't really want to be tracked, then you aren't allowed to do so, the consent is not something that people can trade away in a contract for some content, server time, money, lentil soup or whatever.
I guess it depends wether you consider free plans to be a loss leader for the paid plans.
If you don't want to operate a free service that is without tracking, then don't. No-one is forcing you to, but you should be aware that you still need to follow the law for paying users too.
Or not. Personally I have no problem with cookies. Maybe they will just lose traffic from a small fraction of HN users instead of going out of business.
It’s kind of like paywalls. I get annoyed whenever I visit a news website and a paywall pops up, but I just leave the site unless I’m interested in subscribing. If enough people leave instead of paying (i.e. providing something of value in exchange for accessing interesting content), then the publication goes out of business.
Your point definitely makes a lot of sense, but there are many of us who believe that we should be able to make our own decision to give up certain types of privacy in exchange for something of value.
Everything involves some level of risk/reward. Should I not be allowed to skydive because of the increased risk of death? Generally, I think my rights end where others’ rights begin, so I fail to see how sharing or withholding my personal information affects anyone else.
So invading someone else's privacy, without their consent, for your own monetary gain, should be your decision, because it's fairer?
I didn’t say anything about not getting consent to share personal information. I think almost everyone would agree consent is always necessary.
This is what these laws are all about.
People volunteer personal information because they believe the website will use it with their best interests in mind. There is a well-defined goal and achieving it is the only reason the website even has access to such data. For example, people give their home address to an online store so they can ship orders. Selling this data to marketers so they can spam the consumer's mailbox with advertisements is outside the scope of that goal.
Websites should collect only what's strictly necessary for them to do whatever it is that they do. They should use this data only for this purpose and ideally delete it afterwards.
However, there are two reasons why I think this is still reasonable (with 1. being more important):
1. The reality of the current situation is that invasions of privacy come bundled with other services, which you are pressured to use due to external factors. So I believe that the vast majority of cases are modelled well.
2. I see a privacy as similar to herd immunity, in that society benefits if lots of people have it, even if the individual does not profit from it directly. (In particular, it may prevent certain kinds of power from accumulating or centralising.) In these kinds of situations it can be necessary to restrict individual rights to achieve optimality.
Sure. Just like I didn't click on the techcrunch link above, I'm sure I'll live without your server as well :)
It's european society. Don't agree to its rules? Don't try to monetize european citizens. Why should you have the right to ignore their rules and sell their personal information? That's like having your cake and eating it too.
And then, in the end, you undo all your hard work opting out of hundreds of services by having to press the accept button anyway. :-D
/edit: Heh, yea. It’s not just “hundreds”. It is _way more than 1000_ “partners”. Insane.
There's no reason we can't have sites set an auth token, and send that in under the Authorization header. And then when you want to sign out of a website, you can have a button for that in the browser. The tooling already exists in the HTTP standard, it's just that it's only widely used for server-server communication.
I don't see much of a solution other than making it a matter of policy, eg. Microsoft's "P3P" header. Otherwise authentication credentials need to be supplied with every request. Not a session id or token as a cookie, but the actual username and password being supplied with every request. Basically the old http basic auth, but with a more modern system to replace it.
I understand the core idea behind the EU's desire, but the fact is that cookies are absolutely required for login sessions, and it's impossible to allow users to opt out. The EU doesn't understand the tech behind the laws they are trying to enforce, and this is where it leads to. Absurdity.
GDPR is absolutely not about cookies, it's not about having private information but about uses of it. You may have a legitimate need to collect some data - that auth token for login purposes, the customer's address for delivery, etc. That's fine, it allows you to collect and use that data for that purpose. But it does not mean that you're automatically allowed to use that login token or delivery address you have on your servers for other purposes such as selling or giving it to third party advertisers.
- A/B testing.
- Limiting the number of articles a non-paying user can read per month.
- Persisting form data and shopping cart info. (Not all sites require an account to order stuff from them.)
- Improving recommendations based on what someone has liked or viewed on the site.
It doesn't realise I'm on firefox, so doesn't preferentially serve me a primary focus?
Though you'll need an additional extension to auto-accept.
Plant all the cookies you like, they'll last about 3 minutes.
The bookmarklet:
javascript:(function()%7B(function%20()%20%7Bvar%20i%2C%20elements%20%3D%20document.querySelectorAll('body%20*')%3Bfor%20(i%20%3D%200%3B%20i%20%3C%20elements.length%3B%20i%2B%2B)%20%7Bif%20(getComputedStyle(elements%5Bi%5D).position%20%3D%3D%3D%20'fixed')%20%7Belements%5Bi%5D.parentNode.removeChild(elements%5Bi%5D)%3B%7D%7D%7D)()%7D)()It's breaking the layout of this entire comment thread for me so I have to scroll horizontally to read all of the comments. Thanks!
``` javascript:(function () { var i, elements = document.querySelectorAll('body *'); var style;
document.body.style.overflow-y = 'auto'
for (i = 0; i < elements.length; i++) {
style = getComputedStyle(elements[i]);
if (style.position === 'fixed' && style.top !== "0px") {
elements[i].style.display = 'none';
}
}https://gdpr-info.eu/recitals/no-32/
There's a lot of detail, but the most important part is this: "...inactivity should not therefore constitute consent."
While I'm not sure there's an EU-wide ruling, the Greek DPA has specifically called out the "Consent" option being more visually prominent than the "Not Consent" option. They also mention the anti-pattern of bugging for consent daily but not bugging for un-consent afterwards, but that probably runs more afoul of "consent must be as easy to withdraw as to give" rather than "freely given."
If a site wants to use data in ways that need consent (by the way, most reasonable uses don't need consent because 'legitimate need' applies - it's pretty much only things like "use all your private data for targeted advertising" and "share your private data with these 1000 trusted partners" that need consent) then it's the burden of the site to ensure that the options are presented in a clear, nonconfusing way, that users get fully informed, etc, and demonstrate to the data protection agency that whatever they implemented achieves these goals.
"Just highlighting the ‘no consent button’ after a massive set of options" most likely is not effective to that goal, and a data protection agency can easily verify that (run a study with 10 new users signing up for the site and fill out a questionairre of what they wanted to consent) so it should invite administrative action from the DPAs, with mandates to change the system and/or fines depending on the circumstances. It's just that they're not really bothering with random websites (yet?) since the majority of their work is on how the all the EU non-web businesses (e.g. retailer loyalty programs, phone providers, banks, etc) handle private data.
How is this even possible without setting up a video meeting where a consent officer interviews you and quizzes you to make sure you understood your rights and what you were consenting to?
This seems like an exceedingly onerous thing to demonstrate
The EU does not act like the US - if there's a piece of law, there is guidance on how to comply with that law. You follow it and you're safe, until someone publishes updated guidance.
A number of companies are betting that doing something short of what the guidance recommends will still result in a compliant website. They are in a situation where, if they attract the attention of a regulating body, they may be fined.
And what if your cat walks across the keyboard and accidentally consents, but you never even realized it? Should there be a consent banner across the top at all times? Or what if you are drunk when you are surfing the web and didn't understand your rights when you accidentally consented (drunk people can't consent - the website raped your privacy)?
Person: "I swear I didn't consent! I didn't even see the dialogue! My cat must've walked across the keyboard and accidentally consented"
Ok, you're the judge, what's your call?
Should the dialogue force you to have to type: "I've read and consent to the terms ..." ?
If the company refuse, or if the user claims he was tricked into agreeing, then there is cause for further investigation.
And it's not going to be a judge from the start, but whatever organism is charged with compliance. Then, if they have a case, a judge gets involved.
But this discussion is full of examples of "consent" dialogues that clearly are made to trick users into making a different choice than what they want. In such cases showing the logs and dialogues would demonstrate that a valid consent was not obtained.
It's not a novel thing - for example, I recall that many years ago website opt-in patterns were being reviewed in the Ryanair case where the consumer rights agencies analyzed their website order process where a bunch of 'dark patterns' were used so that people accidentally "opting in" to things they did not want to. There's an administrative process that determines whether your process is honest or tries to cheat users into "agreeing" to things they don't intend to agree. In the latter case, you'll be forced to change how your stuff works.
i am sure there are many databases out there which i am marked as having consented it, although i did no such thing. the standard is to make it hard to express your desire to opt out despite the rules requiring entirely the opposite.
E.g. at the launch of GDPR a local major supermarket chain tried to use a bunch of dark patterns for their loyalty card program (mostly offline) process so as to continue their tracking, they were forced to change last year. It's clear that issues like that have a much larger impact on privacy of people than some foreign news website, and that's prioritized accordingly.
For the major multinational social networks, the delays are (intentionally?) caused by the lack of capacity in the Ireland data protection agency, as many of these multinationals have their EU HQ in Ireland because of tax purposes, so all their cases are being handled there and that means that enforcement for them is going to take a long time. But if I look at random local websites today and compare it to what was happening a year ago, the dark patterns are not prevalent anymore. They appear occasionally, but they're really rare now locally.
I assume they hope you just click agree instead.
And if it doesn't, I leave.
If I was a European citizen, then I believe by default I did not allow anything. They would be in abeyance of the GDPR if they were to track or identify me.
If I can jam up even a bit of tracking with a PiHole, ublock origin, privacy badger, Bypass Paywalls Clean, Containers, and more, good on me. Im already inexorably tied to google at the moment, and working to remove myself from their ties.
Also, they're probably breaking the law.
A better solution is websites actually accepting the “do not track” requests that browsers already send. Unfortunately the most popular web browser is run by the most popular tracking company, who also almost wholly funds the second most popular browser.
It costs money and gives them nothing in return
Also, Ad Blockers are becoming quite prevalent again. Personally, I’ve started using one again for privacy reasons. If a publisher would actually respect my Do Not Track request, I’d happily leave their ads up. I have no problem with contextual advertising.
So that’s revenue left on the table.
I have a website. If I wanted to support DNT, I'd have to take an hour or two to figure it out. To be honest, it wasn't even on my radar.
Techcrunch routinely ends up on the front page on HN, ironically many times for articles that condemn the very practices they engage in. No website will change their practices because of strong, informed opinions when the clicks still come in, especially from a distinguished community like HN that just validates Techcrunch's choices.
So maybe it'll be fax instead of email. Or a weekly letter with a list of all the IPs that have revoked consent? I'm pretty sure this could be done very cost effectively if it's many users and only a small pool of bad UI offenders.
The problem is: how do you get everyone to cooperate at the same time when the incentive for cheating is that your website gets all the revenue?
This dilemma is just one of many in modern society and all are aspects of Moloch [1]. Ultimately we’d like to kill Moloch but that seems very difficult right now.
[1] https://slatestarcodex.com/2014/07/30/meditations-on-moloch/
By cutting to the source and making targeted internet advertisements illegal, full stop, with business-wrecking, revenue-scaled fines implemented for both offending websites and offending ad companies.
An effective ad on a popular website could be a single jpg hosted on the same webserver as that website itself. You wouldn't need any Cookie banner for that.
But ohh, that isn't enough. No they want to be able to show your users content you didn't explicitly approve and run code on your users computers you cannot verify.
If you had a lemonade stand would you let some company film your customers faces? Probably not.
The GDPR law just makes sure you ask them before you do it
Anyway, I boycott TC since they started their war on users.
Prequel, website owners, android developers,... PLEASE, please, check this video. You will more or less understand everything you need to know about GDPR.
GDPR event London 2017 - with Tim Walters: https://www.youtube.com/watch?v=-stjktAu-7k
I think that someone is earning large bucks to trick different websites into believing that they can avoid GDPR by simple tricks while on the other side owners are just too lazy to read simple interpretations made by Article 29 Data Protection Working Party (no, it does not matter what your lawyer thinks if it contradicts recitals). I would call it a scam but I think that some enlightment must be pushed in place:
https://ec.europa.eu/newsroom/just/document.cfm?doc_id=48849
(page 16):
"Without prejudice to existing (national) contract law, consent can be obtained through a recorded oral statement, although due note must be taken of the information available to the data subject, prior to the indication of consent. The use of pre-ticked opt-in boxes is invalid under the GDPR. Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice."
(page 21):
"Article 7(3) of the GDPR prescribes that the controller must ensure that consent can be withdrawn by the data subject as easy as giving consent and at any given time. The GDPR does not say that giving and withdrawing consent must always be done through the same action. However, when consent is obtained via electronic means through only one mouse-click, swipe, or keystroke, data subjects must, in practice, be able to withdraw that consent equally as easily."
and then never shows it again, so i don't really know where i would go to manage consent.
i don't see why companies can't just behave like decent human beings. why do they want me to not trust them?
First you see the warning banner that has the large prominent "CONTINUE (i consent)" CTA button with a tiny "options" link somewhere below.
If you catch that "options" is code for "I don't want to consent", you're then brought to a wall of legalize that you need to scroll to the bottom to find the double-negative-ambiguous-toggle labelled "Do not sell my privacy data". So you need to enable it to disable tracking. I think. But even so, it's a toggle UI instead of a checkbox, so you're not quite sure what state means what.
There's one particular provider of these consent forms out there that a lot of sites use... I'm sure their marketing materials say "our world-class designers have identified the best and most clear user-design principles, which we have inverted to minimize your opt-out conversion rate!"
One additional point should've been added to GDPR: malicious techniques to acquire consent will result in triple the amount of fines.
Cookies allow storage of 4kb data in a file per single origin policy domain. They are slow to access and require an archaic API. At one point this made sense because it’s all we had.
Local storage features an amazingly primitive API, stores 5mb per domain, and is dramatically faster to access. Local storage is achieved universal support since IE8. From a storage perspective localStorage is a complete and superior replacement for cookies.
The only remaining difference is that cookies are artifacts separate from the browser. They can be sent in a an HTTP response without either a unique HTTP request and without appending that data to another artifact, such as hidden text in an HTML file. localStorage does not have that as it is meant to be local and thus would require JavaScript to write data from an HTTP response into storage. One extra step.
In practical terms all that means is that cookies can be written by a server application by developers who lack basic understanding of browser technologies. In software we call this kind of incompetence ”accepted practice”, but other industries call it negligence. I suspect if end users sued individual developers by name every time they were harmed or violated by bad software there would be less negligence in the world.
1. Not everybody has JS enabled (your content site shouldn't require it)
2. If using localStorage, users can write their own data. Depending on how you store data, this ranges from "not a problem at all" to "serious attack vector". At the least, it increases risk if an attacker gets XSS.
3. Data stored in localStorage can't be transmitted upon page load, it has to be transmitted after the initial load, once scripts have executed. For some things, this is fine, for e.g. auth, this is pretty bad.
They are different technologies: localStorage & sessionStorage are not a full replacement for cookies.
That said, tracking is rampant across the web and with it, cookies. Getting rid of them would make some of this harder - but not at all impossible - while breaking other legitimate flows.
It is just as true that not everybody has cookies enabled.
> If using localStorage, users can write their own data. Depending on how you store data, this ranges from "not a problem at all" to "serious attack vector". At the least, it increases risk if an attacker gets XSS.
Users can write their own cookies as well: document.cookie = "whatever"; Users should have control to access and edit the data they are storing on their own devices.
> for e.g. auth, this is pretty bad.
Any data that is embedded in dynamically written HTML is fully available upon page load, so you don't need cookies or any other storage mechanism to solve that problem. You only need a way to send the data in the HTTP response.
> They are different technologies: localStorage & sessionStorage are not a full replacement for cookies.
They are a full replacement unless you lack confidence writing the necessary mechanisms in JavaScript that are typically left to Spring MVC for Java developers on the server.
With a local storage solution I would embed a session hash in some dynamically written HTML or a response header that is then stored in localStorage and then on every subsequent page request in the current HTTPS session send back that session hash prepended with a salt in the https request header. Then it’s always on initial page request but only after the session is established by the server.
localStorage treats http and https as separate sites.
If you're concerned (or aware) about your privacy, you likely have an addon that blocks trackers enabled.
Unequivocally no.
Those that are compliant have. 99% of them are still noncompliant so I think it's too soon for a ruling yet. If this law is actually enforced then websites will only have choices of 1) compliant banners/popups in which few will consent 2) finding alternative business models 3) going out of business.
Right now, most sites do 4) just be noncompliant for now because 1..3 means we go out of business anyway.
This is still a work in progress.
It used to be that in the late 1800s that for example an electricity contract would be a simple one page A4 page which everyone could understand and you signed.
Now its pages up and down of legal content, that you almost need an PhD in law to understand. Many sign without even reading our understanding the contract.
I would call for the simple end user agreement act or put an end to the practice as a whole and just fall back on national/eu law.
Why the contract signing is asymmetrical power and you cannot alter the outcome either than simply opting out of the product.
Further you do tell if it was a person who signed the EULA or the persons cat. Who did the consent?
Finally! Sites that require payment for their content need to return HTTP 402 Payment Required. Sites that make users pay with data should be fined with extreme prejudice.
"Continuing to use the website" isn't consent either. Why do these companies insist on being deliberately obtuse? They know exactly what they need to do but they would rather ask lawyers about how they can get away with not doing it. How hard is it to avoid surveiling people?
Companies are not people - any ethics they have are only there because otherwise it would be bad for business.
Why not just put control in users hands with their browser. Browse in incognito mode if you want less tracking. Block javascript, use an adblocker etc.
This doesn't require that websites allow you to do this, just do it, delete your own cookies.
Am I missing something. The CONSTANT popups on websites that serve EU visitors is SO SO annoying.
If this is meant to have people think big govt is competent and helpful... not sure it's working.
The advertising industry is actively user-hostile.
What's the HN advertiser spin on this? It's to help users find products they want and need, despite the fact that they explicitly say they don't want your help?
This seems like a slippery slope situation. What if you require people to login, signup, or pay to access your content?
There is certainly some sites out there that reasonably require this. How do we define the boundary between the two?
You can still require anything regarding your own website to access it, including cookies, as long as those are needed for the correct functioning of your website.
What this clarifies is that you can longer restrict your website access to people "consenting" to have tens of other companies dropping cookies on them.
This is the same thing as forcing a religious baker to make a statement cakes that violate their religion. If you don't like how a site works don't fucking visit it! Every modern browser has a setting to block third party cookies as well. Forcing web site owners to serve customers who don't like the business model of the site is Orwellian.
There a ton of things you can't ask as payment for your services. It may be physical (let's say body parts), or conceptual (let's say the user freedom of speech). Those things can't be enforced by any contract, however you want to write them, and even if you somehow got someone to sign on it, it would still be void.
In the EU, we deemed suitable to add "privacy" to the list of things you can't legally ask a payment for when providing a service in the form of a website.
That's it. Maybe that's shocking for you, but it's not for me, it's not for the people I voted for, and apparently it's not for quite a number of people and so, it passed.
If you don't like how the law works, well, don't live in the EU ? You can find a lot of countries where this is isn't a consideration, and that may suit you better. Otherwise, well, you've been pwned by democracy. Tough luck !
(I won't begin to adress your comparison with the baker, because, well, I can't begin to make sense of it.)
Democracy? The commission doesn't get elected. The commission is the one to create the laws. Furthermore, most of the voting in the Parliament is done by people not even in my own country. This means that they don't have to care about what I want at all, as my vote has zero effect on them. And if the EU keeps going the way it is then I'd definitely like to get out, because the only thing the EU does is legislate while the bloc's economy has been doing poorly.
Commission (leaders of which are selected by your government that you presumably voted for) makes a draft.
Commission consults widely (usually online consultation) and all national ministries comment.
Commission redrafts and sends to parliament and council.
In the council your government has (most of the time) veto power.
In the parliament your and other countries delegates vote on it.
Then parliament (people's representatives) and council (national government representatives) sit together, find the middle ground of a final draft.
Parliament and council then each do a final vote.
Depending on the exact type of legal document it either enters into force right away or your national administration, parliament and government create their own national version of it conform to the EU document and make that a national law.
That's a pretty heavy process but it's just wrong to say that the voters don't have influence. National governments and delegates both can say no.
Now is the parliament representative just because people are not from just one country? Is your national parliament representative even if there are people from different regions/cities/...? Is your major democratically elected just because that other suburb also got to vote? That's just an absurd position.
After being proposed they are then democratically confirmed by the parliament which you directly elect.
Which part of this is not democratic?
[0]: https://en.wikipedia.org/wiki/Council_of_the_European_Union
Also don’t lecture me about democracy. Democracy is the same thing as gang rape. Majority wins!
on that page there is a login/register button..
registration processes gets consent for any personal information storage and processing..
where do you see the issue? not tracking people and cookie consent etc. only ever seem to be an issue if you are trying to silently track people, i have not seen any issues when you actually genuinely seek consent
Said otherwise, your terms of service must be privacy-sensible, which is indeed the very goal of the law.
And yes, that is exactly what it does. That is the point. We have decided that that is a good thing to require.
Opening the link causes the back button to break. I need to double tap it before the redirect kicks in (hint: don’t push this to HTML5 history, please).
Once you scroll down to the end of the article, it closes the article back to the list view and does a bunch of awkward scrolls just to leave me at the bottom of their list.
iOS Safari
No thank you, happy to exclude all of EU to not deal with this nonsense.
Brought to you by TC, a site with a cookie consent wall (at least here in the UK).
1st: almost nobody cares about cookies let alone knows what they are.
2cnd: people don't read the fine print.
3rd: it just creates an ugly barrier to the experience for 99% of people.
We can solve this 'problem' in a much simpler way:
What is needed for example is possibly a special image/token at the top of the page, like a 'seal' that indicates the 'privacy rating' and whether or not cookies are used. Like films are rated, sites can be rated. A little symbol implies that cookies are used. People can then decide to 'move on or not' but otherwise, the experience is not interrupted.
Is this forbidden by the specifics of the legislation?
But I personally love these warnings and consent messages. I wish there were more of them! I wish there was a consent message before any kind of cross-origin action was allowed. Can you imagine how many there would be on any sites that use ad networks?
Honestly, the more things go on, the more I think the very fact that websites allow fetching resources from 3rd parties is a misfeature. If I go to example.com, my relationship is with example.com. This would eliminate cross-site-scripting attacks, tracking cookies, tracking images, etc.
On the other hand, it would also kill CDNs.
Single sign-on would have to be explicit instead of implicit.
I'm not 100% sure those would be bad things.
I don't know, overall i just wanted to say that i totally agree that it doesn't seem like a good feature you go to site X and your browser loads data and makes connections to wherever based on site x's instruction.
I have noticed a few of the consent pop ups couching the choice explicitly in this manner. If you don't grant consent to us/our 3rd parties tracking you we will still show you ads, they will just be less relevant.
Advertising doesn't actually require the detailed level of tracking that is used today. Physical newspapers survived with a much more limited set of data when convincing advertisers to place ads.
One possible outcome is that publishers have to display even more ads to make up the shortfall. That'll just annoy users even more and so they'll either stop visiting the site make ad-blocking even more prevalent. Either way, the publisher is really the one losing out.
Instead EU should make mandatory that browser vendors create standard "blocker button" clearly visible in the toolbar from which user can globally disable trackers, and perhaps preview them.
This way each site does not have to do the annoying dialogs which users just mindlessly hit accept anyway.
So basically, uBlock Origin?
Maybe it could have some other standardization too, e.g. that if you have third-party trackers you must explicitely list them using <meta /> tags and browsers could make the list of trackers for the "blocker button" like that.
The point being that having every website to implement their own dialogs (that just obscure the content) it has shown to become a terrible mess. None is bothered to read the dialogs, they just hit what ever buttons to get to the content.
Most of my projects are non-commercial, but they still usually have GA, GA tends to be the only thing I have that requires GPDR attention, that I'm aware of anyway.
If you go out of your way, you can implement GA, by itself, the "old way"--which is GDPR compliant out of the box. It's Tag Manager and DoubleClick that are not.
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=[ID]"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', '[ID]');
</script>
The old way would load the JS from https://ssl.google-analytics.com/ga.js instead, and set different options.
Here is how to implement Google Analytics by itself:
https://developers.google.com/analytics/devguides/collection...
I can't talk for other countries, but for France, the local DPA explicitely said so[0]!
Loose translation: "The analytics tool do not fit within the consent exemption when their provider reuse data for their own profit. That includes most big analytics service available (see for exemple Google Analytics confidentiality policy)"
[0]https://github.com/LINCnil/Guide-RGPD-du-developpeur/blob/ma...
Your data, your experience
TechCrunch is part of Verizon Media. Click 'I agree' to allow Verizon Media and our partners to use cookies and similar technologies to access your device and use your data (including location) to understand your interests, and provide and measure personalised ads.
I would be very perplexed if none existed that removed cookie warnings.
Edit: If you open uBlock's options and go to the Filter Lists tab, you can see that https://kb.adguard.com/en/general/adguard-ad-filters#annoyan... and Fanboy's Annoyances List are two that block some privacy popups, but you'd probably need to enable them.
There are actually quite a lot of lists on that page (click the "+" marks to expand the unchecked lists) that are opt-in rather than on by default, so it's worthwhile to give them a whirl and see if any block cookie popups.
Easylist Cookie is another one I found in uBlock filter list that specifically nukes cookie popups: https://easylist-downloads.adblockplus.org/easylist-cookie.t... (disable by default as well).
- Sign up for a newsletter!
- Please turn off your adblocker!
- Please accept our use of cookies to continue
- Pardon the interruption...
Websites don't exist in a vacuum. Nearly always, they have to compete for my attention with other possible uses of my time. I'm going to pick the one that wastes my time the least.
This sounds like GDPR is a bad thing for people like me, but I view it as a long game: as sites see increased bounce rates due to cookie popups, maybe it'll change the equation in favor of not having tracking cookies in the first place. I feel like I'm doing my part to help create that future every time I close the tab when getting nagged about cookies.
(And GDPR doesn't require dialogs about all cookies, you're allowed to use cookies to have sessions/logons without nagging.)
Want a place you can go to find interesting websites, chat, share knowledge... all that the web was supposed to allow, but without being constantly tracked and bombarded with ads?
Try Gemini: https://gemini.circumlunar.space
Gemini is an extremely simplified version of HTTP and HTML, in essence. It is safe by default: the only way to allow user "sign in" is by using mutual TLS. with mutual TLS, YOU control whether the server talking to you should know who you are... and they can't know anything you don't tell them. And you can simply stop using your TLS client certificate if you don't feel like telling the server who you are anymore. This is what security looks like. Not what the mess of the web is right now.
It's time to reboot the internet.
The way I read this cookie "consent" banners are exposed as worthless so web sites should be no better off using them compared to not using them.
The banner/popup has to say "Check this checkbox to continue with third party cookies, otherwise just continue without". (checkbox has to be unchecked at first)
Or "Click [this button] to visit with third party cookies or [this button] to visit without" (buttons have to be the same size).
But yes - in this form banners and popup present an annoyance to the user AND very few will actually consent (if they understand the question). So they will be worthless for the site owner, which is a good thing because no one likes these banners.
You can do basic user statistics without active tracking and for technical cookies the banners (nor any other form of consents) is necessary.
The ad industry (Google & co) have pushed these user-hostile banners, it's not a feature of the law.
I suspect that a number of organizations that post free content and justify some/all of that expense with the marketing data they collect are going to look at changing that practice. More paywalls that require free user registration are the obvious next step. I wonder if that's not a step backwards for the Web.
The GDPR is very clear, that it should be the users choice if he wants to be tracked (freely given, so without any other negative consequences). But many pages out there are trying to trick people into accepting their cookies by accident (playing with buttons (size, color, arrangement, etc.)). Those Paywalls are just the tip of the iceberg. And for those companies who comply with the law, it is just a competitive disadvantage.
Sometimes I am more drawn to accepting some page's cookies, just because they implemented the consent layer in a compliant way.
And what do they mean the user has "no choice"? What… don't they have a choice about? They have as much choice as I have in a store. I have the choice of paying for the thing and getting it, or not paying and not getting it. Why is it mandated that the "get the thing without paying for it" MUST be a choice?
They are pretty great, beyond the examples brought up here. For instance, on the criterion free/freely given, they write the following:
> The element “free” implies real choice and control for data subjects. As a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid.13If consent is bundled up as anon-negotiable part of terms and conditions it is presumed not to have been freely given. Accordingly,consent will not be considered to be free if the data subject is unable to refuse or withdraw his or her consent without detriment.14The notion of imbalance between the controller and the data subject is also taken into consideration by the GDPR.
Regarding the last element they cite the examples of public authorities or employment (e.g. monitoring systems) as situations where there is an imbalance of power that may limit the ability to give consent freely (there are other bases for processing data).
Also, I want to quickly remind HN that the GDPR applies to any data processing and goes far beyond consenting to cookies but also to, e.g., any other tracking, "selling" the email address to an advertising firm, taking a video of you, etc.
Let's be honest, people don't read them they are just annoyed, devs who implement them feel bad about the experience.
If companies choose to comply with EU law because they want to do business in the EU that's up to them, they don't have to.
I believe I'm in the majority on this (though not on HN) and most people simply click the thing that will get them to the content fastest.
For this reason, I think the way to fix this is not with opt-out, but with opt-ins, where the option has a highly specified, by regulation, size, color, location and text for how it must be presented.
https://blog.rikworks.co.uk/2020/02/05/The-RikVerse-rebuild-...
... and this is how the cookie consents page looks on the site:
http://rikverse2020.rikweb.org.uk/cookies
It's not a difficult task to comply with the GDPR requirements in a nice way.
Consumer software that respects your wishes has become such a dying breed that I had forgotten just how deep we've fallen down the rabbit hole on everything until surveillance was pulled back out.
Browsers could improve their UIs for default cookie/storage filtering, but it's still a much more effective way to do this.
Good intentions by dumb people do more damage than good.
if a site has a "gdpr popup" then that means they are doing something that the know is morally and legally questionable - not that the law is wrong ffs.
I wish you guys the best of luck with it, though. I would like for my country's notion of "who owns my data?" resolve more to "me". I'm torn about how much it'll cost me to own my own data, though, in a reduction of frictionless free stuff on the internet.
plus i can now get my data from lots of sites as they cant be bothered to restrict non-eu people to not have the functionality.
plus quite a few more sites / services have options to delete my account and data that only came about because of gdpr
plus it seems like other places are considering similar laws too so then the "benifits" will be felt by even more people.
oh and now you get an indicator of how crumby a company is by how hard it is to opt out of things.
dunno it just seems like a lot of wins. with the main downside being that my person data abuse is regularly brought to my attention via popups etc. but that doesn't seem sustainable - i am hoping its a transitional thing and company actually just start complying.. but i guess that will take the EU laying down some serious fines to make examples - which to be fair this article seems to be a step towards. seems like many other control systems (e.g. dangerous goods shipping or hazardous chemical controls) that the governing bodies are careful in applying the law to make sure they don't just fine companies into oblivion if they are making steps in the right direction and fix anything specifically called out.
How do you think those "free" articles are paid for? They're paid for with cookies.
This is the same wall that separates me from content on paywall sites - it's just that you don't get out your credit card. Instead, you whip out your cookie jar.
There is no universal "right" to view content. If the content is behind a cookie wall, you have two choices - either accept cookies or fuck off.
I'd as soon just not serve content to EU residents than have to make everyone suffer through the nonsense. That won't fly for big companies of course.
Alternatively maybe make those popups only show for EU (geolocated) users.
Advertising is a hell of a drug.
I blame the GDPR for being drafted in a way that allowed this mess.
This "cure" is worse than the problem it tries to solve.
If the answer is "to target advertising" then what is the danger?
If the answer is something else, I'm all ears...
You only need consent if you include Google analytics or ads or a similar platform. Those platforms push the banners on people, pretending that those are needed.
The reason you see the banners everywhere is that a huge number of sites integrate these spy services.
Where does this extract allow for the user be guided off the site? As far as I can see, it demands that the user can ‘freely give’ the choice to access the site without using cookies.
Cookies are a simple yes/no question, with the default answer being no. If everyone did what's in the users' best interests, it would be a non-issue.
This entire EU regulation is a non solution to a not really existing problem. Yes, third party advertisers use cookies to track you. But they can build technologies to use something else. In the meantime you are a) breaking the internet b) wasting hours of each EU citizens time every year.
They do not ask "can I place cookies"; they ask "Can my third-party trackers and advertisers place markers on your system so that your activity can be tracked across this and other websites".
Don't stare yourself blind on the poorly chosen wording. It's not the "cookie law" either, it's the General Data Protection Regulation. It's not about cookies, it's about regaining control over your personal data, your online behaviour, etc.
Matomo was formerly known as Piwik
If a hospital would in secret sell my medical records to drug companies in order to get free medical supplies I would object on several grounds. First because they are doing it without telling me. Second because its not their data to sell. Third because it create an unfair market where drug companies who are more ethical get out competed.
* It helps me focus on the content my users need the most, and see what triggers donations.
* It helps me catch and diagnose traffic dips, and react to them.
* It helps me catch and diagnose unexpected issues. For instance, caching changes broke a component that accounts for 30% of my revenue. It would have stayed broken for a whole month if I didn't see the dip in events.
I will replace Google Analytics soon, but even as a tech-savvy person, it's a dreadful task. Google Analytics is free, simple, and incredibly reliable. Setting up your own self-hosted alternative, or paying a monthly fee for an alternative is a lot less desirable.
There are alternatives but as you say sadly none are as easy - probably because none have as much budget behind them. I see a number of comparison articles for gdpr compliant analytics, so it seems to have become its own market of sorts.
I have opted myself out of most Google services due to the intrusive nature, I wouldn't want to impose it on my site visitors (but I also have no need to monetize, so maybe a different ballpark).
Just knowing what I need to do requires me to wear my lawyer hat. Actually doing it requires me to wear my developer hat, or to pay other people a monthly fee.
I do this because I swore to do the right thing [1], and because I have a lot of time on my hands. I can't reasonably expect amateur bloggers to do the same. It's an unreasonable burden.
Explicitely allowed:
* Cookies for login/session
* Cookies for shopping carts
* Cookies for interface personnalisation (language, etc.)
* Cookies for load balancing
* Cookies to retain user choice regarding cookies
And quite a few other.
1. You can do whatever you need to do to provide the service you're providing. (login cookies, sessions, store their email address, whatever).
2. If you want to process, store, and sell any other user data, you need to ask them first.
So for example if you want to send 100 advertising companies personal data about your users, you need to ask for consent and allow them to decline without restricting their access to you service.
What technology you use to track users is irrelevant, it can be fingerprinting or cookies or anything else.
The only reason why you think the law is bad is because companies are frantically trying to work around it, trying to interpret it in unintended ways to not impact their data tracking ways, and trying to make users hate the law instead of them.
This directive explicitely targets reading/writing into the user terminal without autorisation, hence the application to cookies.
Edit: removed a post, that was not explicative enough.
But the articulation is: ePrivacy says you need to consent to write non-essential trackers. GDPR defines how you can obtain the consent. So both laws take part in this ruling.
I 100% blame the people running the sites and whenever possible just close pages that come up with all this crap - if you are not doing anything dodgey there is basically nothing to get consent for.
Also, besides browsing news/Reddit/shopping, where do you see the GDPR prompt? Banks, AWS, GCP, don't use tracking cookies, so how many "years" of productive work are really being taken away? Sure, its a barrier to shopping which also boosts the economy, but why does Nissan they need to know I just bought a power inverter or visited Tesla if they deliver a solid car on their own merits?
No, they really, really don't.