Hacker News Reader

Comment by kempbellt | Hacker News Reader

Sensitive topic, so I feel the need to state that I am not trying to troll by saying this:

I do not see this argument as idiocy.

Many stores have signs out front stating, "If you enter this building, you accept that you are being filmed". Many are recording you before you even enter. They do not require explicit consent from people willfully choosing to enter.

Should we really assume that the client has not taken any responsibility when they willfully type in https://www.somewebsite.com/ and hit enter?

Since users can block cookies/javascript, or simply not visit websites they don't trust, I genuinely do not understand at which threshold of manual intervention we can finally conclude that a user has accepted responsibility - if their voluntary decision to visit does not count.

I get that companies sharing data and doing nefarious things with your personal information is not great, but I don't see how this does anything to help with that.

View on HN

Although it does depend a bit on what the cookies they are storing here are used for you cannot use implied consent to workaround the law.

Taking your example of signs in stores: if a store had a sign saying "if you try to steal from this store you will be shot on sight" it does not suddenly make that legal because a customer saw the sign and still decided to enter.

Additionally with a website you do not see the message until you have already entered and they have already placed the cookie so again, there can't be implied consent. It's just notification of what they have already done.

The EU cookie laws are basically, for non-essential cookies (e.g. mostly tracking/ad stuff) users must be given the option to reject them before they are enabled. Seems pretty simple + pretty fair to me. The problem is that most websites fail to implement it correctly. When they do implement it correctly it's really useful in my opinion.

There is a massive difference. A proper analog is stating that "web requests you make will be logged". If you don't want to be recorded as having walked in, don't walk in.

To make this a fair comparison, the sign would say:

  If you enter this building, you accept that you are being:

  - filmed
  - probed for all wifi and electrical emissions
  - weighed
  - measured
  - secretively (as much as can be managed) pinned with tracking beacons
  - lured into unknowingly entering other buildings w/o realizing it
  - fingerprinted by any surfaces you touch
  - associated with the means of transportation to arrive/depart
  - and on and on and on

Since people can just wear masks, electro-blocking hazmat suits, high heels, a fresh change of cloths for every outing and come equipped with high-resolution GPS and building blueprints... it's a perfectly reasonable assumption.

You forgot gait analysis [0] so remember to put a stone in your shoe.

What amazes me is how many people were worried about the distopian future of minority report [1] 20 years ago, yet (especially on HN) now it's here they welcome it. I guess Upton Sinclair was right: It is difficult to get a man to understand something when his salary depends upon his not understanding it.

[0] https://blog.ansi.org/2018/05/gait-analysis-walk-biometric-i...

[1] https://medium.com/context/personalized-advertising-is-an-ox...

>They do not require explicit consent from people willfully choosing to enter.

The GDPR however does require explicit consent.

>Should we really assume that the client has not taken any responsibility when they willfully type in https://www.somewebsite.com/ and hit enter?

I didn't type in anything or click enter to get to that site.

>Since users can block cookies/javascript,

Except when that breaks stuff.

> The GDPR however does require explicit consent.

I think you missed my point. I not asking about what the law says. I'm asking why a person willfully choosing to visit a site is not considered a form of consent, since it requires an intentional action from a user. If intentionally visiting the site isn't consent, how is it that clicking an "Accept" button magically is? Both are intentional actions by the user.

Feels like walking into a store and saying, "I don't consent to be here". That's fine, but you chose to be here, so now here you are. Feel free to leave and not come back. You have that choice.

Answered by another user: It depends on what the cookie is used for, and I understand this perspective to a degree.

Session cookies are required for a lot of basic functionality and have been around forever - people are used to them. But cross-site tracking and other telemetry tracking for targeted advertisement is a bit of an overreach, and very invasive. I get that people don't like it, but you can block a lot of that, and opt out of visiting the site entirely. I don't understand how adding an "Accept" does much. Feels like a superficial change.

> I didn't type in anything or click enter to get to that site.

Are you being pedantic...? If you clicked the link, you engaged in an intentional action - which is my point.

> Except when that breaks stuff.

Then don't visit?

Reply on news.ycombinator.com