Hacker News Reader

Comment by capableweb | Hacker News Reader

Off topic but it's interesting how many people get the cookie consent thing wrong. Not only can't you decline to use analytics cookies, the page loads analytics.js before you even accepted it, so the cookie consent popup is literally done just to be in the way, not for actually asking for consent...

Edit: only way you can not accept the tracking cookies is by first accepting the cookies, then manually going to https://marcradziwill.com/cookie-settings/ and uncheck it. Even if you uncheck it, site will still load Google Analytics.

Hurray for the world wide web.

Hint for people who actually care about privacy: if you're asking for consent about storing tracking cookies, you're not caring about privacy in the first place. Use server-side tracking if you really have too, and put everything client-side tracking on fire.

View on HN

> care about privacy

Note that most don't claim that. They say "we value your privacy" which means "we can extract value from taking your privacy".

If you don't want to be tracked and sold the only way is to block the stuff yourself. Some sites won't let you in, which is fine by me I'll no doubt find the same info elsewhere.

I'd rather not block adverts, I know they pay for some half-decent free resources, but there is no way to block the tracking without also blocking the ads.

Oddly I've seen more useful adverts since actively making efforts to block tracking, less being presented with things I've already looked at but dismissed and more random "I hadn't thought of that, but maybe" promotions. I'm not sure if that is a coincidence, or a sign that the tracking isn't actually that useful for advertising purposes. If the latter then the question becomes "then why are they so intent on tracking me?" - I suspect because the other ads are part of a status quo that is desperately trying to hold on despite not being as relevant & useful as is claimed.

Or have uBlock Origin on.

And since this is a login-not-required site how are the other cookies "technically required"?

Or have uBlock Origin on.

I was using its feature that gets rid of cookie/GDPR permission boxes but encountered numerous pages which prevent any scrolling or interaction with page elements.. I was confused for a bit until I noticed uBlock was hiding these approval boxes but was keeping the page locked as if I hadn't yet approved them. Reluctantly I've turned off this feature and am back in GDPR box hell again.

Cookie consent setting page stores 2 reasons for technical cookies:

> Stores the information as to whether the user agrees to statistical analyzes or rejects them

> Stores the information as to whether the user agrees to cookies or rejects them

As for what @capableweb said, did they update something or what? Before consenting to cookies I CAN actually open settings and... analytics cookie by default was disabled for me.

> analytics cookie by default was disabled for me

I've noticed that a lot of permission boxes are disabled by default if you open the settings, but not otherwise. The optics are better that way: it makes any claim to care about your privacy look less dubious. It also catches people who go to settings and blindly click all the options to turn them off without reading the screen: they accidentally turn them on instead.

If these are just boolean flags, there's no GDPR consent required for these. If they're a user ID that is used to look up a database of GDPR consents, then they have PII and there's a need to have another valid reason under GDPR to store them.

The issue is the flow to disable tracking cookies (maybe this is the right flow?):

Step 1: Click Accept to be tracked or settings for details

Step 2: Go to settings. Analytics is unticked. My understanding is clicking accept in the first page would still have granted permission.

Step 3: Go back?

Step 4: Click accept?

Why is clicking accept going to have a different behaviour in step 4 than if I'd clicked it in step 1? I didn't change anything, just viewed settings. Is viewing settings the opt out? Is there no behaviour and then clicking accept on step 4 _does_ allow the tracking cookies? What was the point of the settings page?

Yahoo's GDPR page has much of the same issues for me.

Tooting my own horn here, but I think the way we've done it[1] works in the way you'd expect.

[1] https://supernotes.app

Is this always "wrong" though?

Of course if you load analytics.js from a 3th party server before consent, that's wrong. If you load it AND start tracking before consent, that's very wrong. On the other hand I don't see a problem with loading the script from a server you own and only enable the tracking after consent is given. That's how I did it in a recent project.

Any tool that simplifies collecting and reporting eventos on server side?

https://goaccess.io/

https://github.com/usefathom/fathom

It'd be interesting to see how many sites actually honor custom settings. I have my doubts.

What if browsers had a setting that would manage cookies?

> Use server-side tracking if you really have too, and put everything client-side tracking on fire.

Why would server side tracking be any better (morally or legally) than client side tracking, assuming you are tracking the same thing? GDPR doesn’t care about the technical means. If you’re storing or processing personal data, you need a valid legal ground for doing so (see Article 6[0]), which usually means you need consent for the sort of tracking done on most websites.

[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

I had a bug on my site—Sry about that. I did a quick fix to reject any cookie/tracking settings quickly and that the consent won't pop-up again.

I hate these cookie pop-ups more than you could imagine, but I need to know how my site performs. And as I have my business registered in the EU, I need a cookie consent to my website. On the roadmap, I have a task to replace GA with any other analytics compliant with GDPR, CCPA, and PECR so that I won't need any cookie.

Reply on news.ycombinator.com