Hacker News Reader

Comment by dspillett | Hacker News Reader

> In europe, all websites require you to accept cookies

It is always worth pointing out that the complex dark-pattern filled forms that many sites use are there choice and not impressed by the relevant legislation.

They could just make it all opt in/out with a single click, but they know that without the trickery very few users will do opt in to being stalked so instead they try make it as difficult as possible in the hope that you agree to everything either accidentally or just because you are such of it and want the form to go away. I just back away from sites like that and in particularly egregious cases I've blocked them at the network level with a DNS blacklist: the information I'm looking for has always also been available somewhere else less irritating.

View on HN

I want to reject all of them, at a protocol level, and never see another one again. That this wasn't written into the "Cookie Law" is proof to me that GDPR and Schrems II are largely written by people who don't understand the technical ramifications of pushing legislation like this through.

"Do not track" is exactly the feature you're talking about and already exists in all common browsers.

What it's missing is a reason for websites to comply, which is what a law could enforce.

But it didn't, again begging the wisdom of the "Cookie Law" authors.

How do you reject server-side tracking based on IP and other unique bits at the protocol level?

Use vpns and software that only communicates the minimum necessary information required for a transaction.

Browsers don't have to provide uniquely identifiable information. Surveillance was a voluntary choice implemented by developers, not a necessary evil.

The dark patterns should be a violation of the spirit of the law.

The dark pattern is that the government can order people what to put on their Web site.

They can order people what not to put on their web site. Unless they put in a notice. Just like in the US, where if you advertise sports betting, you have to point at the hotlines.

They are. Enforcement is on the way, just slow. Belgium just charged the IAB Europe group a big fine.

They literally are. If a consent form has an “allow all” button but no “reject all”, as many do, then it is not compliant. Likewise for “legitimate interest” (that one really gets my hackles up: it basically says “we see your preference, what would you think if we didn't give a crap?”).

There have been some fines related to this sort of thing, and over time some of the dark patterns are getting a little less common, but enforcement thus far has not been sufficient to make the less dark variants the norm.

Reply on news.ycombinator.com