Hacker News Reader

Hacker News

Comment by unfunco | Hacker News Reader

Parent Full thread

unfunco

If you don't store cookies at all then you don't need the banner, you don't need consent to be doing nothing.

View on HN

Try explaining that to the non-technical people the requirement came from.

also perfect excuse to introduce some other usage of cookies

https://news.ycombinator.com/item?id=24979895

That shouldn't be very difficult. It's not a complex situation.

I don't have a sign in front of my house saying "Beware of the dog", because I don't have a dog.

OTOH, if you got asked often enough if you had a scary dog, you may consider putting up a sign saying "There is no dog here."

At which point the more common question will become "what's with the sign?", and the sign may become the bigger source of concern.

You might instead consider asking people why they're asking, and figuring out ways to promote more widespread understanding.

Concretely: you might actively promote adblockers and tell people why they should use them. And rather than saying "we don't use tracking cookies", you could explain "here's why so many sites have cookie banners, here's why we don't".

Or you could focus on your business goals... And just be safe legally.

I'm not suggesting doing it proactively; I'm suggesting doing it in response to the question, if people repeatedly ask the question. "No, and here are other ways to protect yourself" is stronger and more definitive than just "no".

Since the topic touches law, it's more complex to some people than you might think. To us it's obvious, but someone else might think that they better be safe than sorry and not get sued for accidentally setting a (non-essential) cookie somewhere without letting the user know. I definitely know some people who'd rather implement such "unnecessary" things than exposing themselves to a potential legal trap.

I would recommend thinking like a lawyer and writing a memo like one. Legal writing and analysis follows a very common pattern known as IRAC (Issue, Rule, Analysis, Conclusion):

(1) Identify the issue; (2) Quote all relevant rules; (3) Analyze the rules in light of your specific factual circumstances; and (4) Reach a reasonable conclusion based on your analysis of the rules.

This is how your company's legal team is making recommendations to management. You have to fight fire with fire. The only advantage your legal department may have over you is access to more comprehensive legal research services like Westlaw and LexisNexis. But at the end of the day, all they're doing is researching what the law is and how the courts are interpreting the law. Search for the right terms on Google, and you can do a pretty damn good job at crafting credible arguments. We don't need the lawyers always acting like they're at the top of the food chain.

Lawyers would argue that it might be a good idea to put up a sign if your neighbors have a dog that could attack them.

(weak argument but somewhat funny).

Lawyers are ultra cautious. If you can -guarantee- that no one is going to magically add tracking/google analytics or some such to your site than sure, tell them you don't need the banner.

I would say big picture wise it is wiser to add the banner unless it hurts your conversions.

What if you might consider adding some analytics later down the road, but are afraid someone will forget about the cookie banner at that point?

Respectfully, educating stakeholders is part of your job. Until you accept and embrace that, you're likely to remain stuck in roles doing useless things.

If they heard from legal they need it and legal hourly rate is greater than engineering hourly rate, they will rather waste engineering time than spend legal time to save engineering time.

Legal won't be maintaining this feature ad infinitum will it?

Also: it might be interesting to try and find some metrics on conversion impact for those stakeholders. You're making the product worse.

How do you know so much about his job role?

Attempting to educate stakeholders is part of your job. Forcing them to accept your reasoning may not be possible and they may have other reasons for their decisions that you may not know about or they may not wish to reveal (legal, marketing, internal politics, etc).

And at some point in pushing back, disagree-and-commit is the right thing to do.

If you don't store cookies at all then you don't need the banner, you don't need consent to be doing nothing.

That was his point. He was illustrating the absurdity he has to deal with.

What if you might consider adding some analytics later down the road, but are afraid someone will forget about the cookie banner at that point?

Maybe the customer wants to not worry if some new developer is tasked with analytics and maybe this developer forgets about the cookie banner.

Reply on news.ycombinator.com