It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.
The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid.
So it would put the companies in danger and therefore no company could honor this standard.
Sadly - as it would make live more easy. But it would be enough if companies would just not use dark patterns. If there is a banner the "Accept all" and the "Deny all" must be both be the same level of "easy-ness" and the same amounts of clicks (and wait time). Only if you want to you would need to dive into the detailed categories.
And even there: Most sites abuse "legitimate interest". Everything non essential should by default be inactive. But sadly it isn't.
Disclaimer: I am a data analyst/Web analyst. I do this stuff for a living for clients. Still I value these things highly. And would love for it to be implemented correctly.
Non-essential cookies could be enabled via a configuration menu opened by the user at a time of their choosing. But everybody knows no user is going to do that, particularly unprompted. So they create a pop-up banner to do both the prompting and the configuration.
And everybody knows most users, when they see a pop-up, are just looking for the sequence of button presses needed to remove the pop-up. So they make sure that that's "enable all cookies" because they know if it's "only enable essential cookies" vanishingly few users will enable non-essentials. Why would they?
If everything non-essential were required to be inactive by default I think the pop-ups would disappear entirely. There'd be no point to them because vanishingly few users would ever change the defaults.
According to the GDPR, all non-essential tracking should be off by default, so "decline" is already the default if companies were compliant with the regulation (which is a big "if").
Left the code in anyway but that’s the thing about these things: consumer behavior reveals that they don’t actually give a fuck about whether anyone obeys this or not except for the time when they want to be outraged.
Then the browser could take care of displaying it in a uniform way together with the “accept” and “reject” buttons in a uniform way.
Would be much easier for the website and it would make it impossible to use dark patterns.
By pretending that advertisement and tracking are part of Legitimate Interest, and having a "secondary section" that is not only pre-accepted, but also overrides the proper consent part.
To really decline consent in those cases, you must uncheck all "Legitimate Interest" checkboxes. Not only those things are not legitimate interest, this also overrides the lack-of-consent provided by users for a couple vendors.
Legitimate interest is not a get out of jail free card. You can't apply it to everything and pretend you got consent.
The full list of the LI purposes claimed by adtech players is available at [0]
As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything.
In any case, it's not sites that are the issue. It's the CMP screens.
I never said the opposite and never said that was problem. Presenting non-Legitimate Interest as if it were, however is shady and probably illegal.
> The user's choices for each Legal Basis are sent separately in the TCF consent strings and entities are expected to adhere to these rules.
I never said that being separated is a problem. The problem is using anything that is firmly NOT in the Legitimate interest camp as if it were, and using that to mislead customers.
> One does not override the other.
It does in this case, and it is easily verifiable. Even if I disallow a certain tracking vendor, it will still load stuff from this vendor in websites, even though nothing from this vendor configures "Legitimate Interest". And all my data will still be piped to those adware, etc, vendors, that provide no functions other than adware, tracking and other shady stuff that GDPR requires consent for.
> As for why they're enabled by default... I'd imagine there's a legal reason. GDPR doesn't just apply to adtech, it's everything.*
That's beside the point. If it were really Legitimate Interest, there would be no need for asking.
Just as writing and running an install script with --accept-tos is valid.
A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent.
Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could.
Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.
IANAL so it's pointless for me to argue on that point. Of course if somebody is happy to accept in advance any privacy policy and will confirm all of those automated choices in a court (if they'll ever be challenged, can't think why), no problem with that.
My point was that we shouldn't expect a major browser vendor to go through all the process to build an API with those legal implications. I wouldn't bet on major websites adopting that API anyway. It looks so much following the letter of the law and circumventing the spirit of it. Very risky, both legally and as a middle finger to the regulators.
I dont think this is true either. The consent options would typically come under a few pretty well defined headers (e.g. advertising) and could include the capability of raising specific exceptions for nonstandard requests.
A feature saving 2 seconds on 90% of sites is a big deal.
In the same way, GDPR requires informed consent about the specific use of data by a specific data controller. From https://gdpr-info.eu/issues/consent/ :
> For consent to be informed and specific, the data subject must at least be notified about the controller’s identity, what kind of data will be processed, how it will be used and the purpose of the processing operations as a safeguard against ‘function creep’.
The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent in the context of the GDPR, because the consent was given prior to the human being informed about the specific use by the specific site.
Medical consent is a whole different kettle of fish and I may be off base here but I am pretty sure you can preauthorize consent for, e.g. theres a risk you may become unconscious and need follow up treatment.
>The proposed browser-based solution that sends an automated acceptance on behalf of the user would not qualify as informed consent
It's absolutely possible to have all of this information sent in an API to software acting on behalf of the user. The user has been informed and the obligations of the website will have been discharged. What the users browser does with this is the users business.
That road leads to banning street photography and CCTV, and being able to get a gag order to stop people from saying "Yeah I saw Brian at the bar last night". When does it stop?
There are no uses of cookies an average user cares about that aren't already illegal.
They are basically all for the same thing, to spy on you and sell your data to third parties to the fullest extent of the law, excluding any data you would actually notice being sold like credit card numbers, and many users don't care.
* Asking if somebody saw Brian at the bar last night is acceptable. Asking everybody if they saw Brian somewhere is acceptable in limited circumstances, such as Brian having been kidnapped. Asking everybody to list out who they saw and when is an unacceptable violation of privacy.
* Street photography is acceptable. Taking a picture once every day of the same house may be acceptable, such as if it is a historically interesting building, or if it is your own house. Collecting millions of street photographs, along with the time they were taken and who was in each photograph, is an unacceptable violation of privacy.
* CCTV is acceptable. Maintaining records of CCTV indefinitely may be acceptable, depending on the type of building. (e.g. The Pentagon may be justified in keeping CCTV recordings indefinitely, but the local laundromat is not.) Linking CCTV cameras together into a centralized query-able network that tracks people between locations is an unacceptable violation of privacy.
There are two common features that I realized in these examples. First, even if an individual action is acceptable and justified, repetition and coordination of that action may not be. This is similar to how saying hello when crossing paths with somebody is a courtesy and a pleasantry, but saying hello to the same person every 30 seconds is stalking. The difference in scale produces a different in outcome.
Second, there exist gradations of privacy, rather than being a binary divide between public and private spaces. Between a completely private space, such as a person inside their own home with the windows drawn, and a completely public space, such as a person giving a speech on live TV, there are intermediate spaces. A person who is walking down the street has partial privacy, where their actions may be remembered by passersby for a day or two, but wouldn't be remembered a month or a year later. In the past, these gradations of privacy were maintained by the limits of human memory and the high cost of technological memory, but the cost of technological memory has fallen to a point where this social construct is breaking down.
Summing up, I would say that we cannot have a modern technological society if we *don't* treat tracking with the same concern we treat medical consent.
Install scripts run with --accept-tos have nothing to do with personal data or privacy, and are outside the scope of GDPR.
They're treating "Accept cookies" with the same seriousness you'd expect from "Do you consent to me putting a whole package of cookie dough up your rear".
The whole GDPR seems to be one step away from censorship. And it seems almost like the real intent has less to do with user choice and informed consent, and more to do with just trying to kill off data collection as a business model completely, before we have a replacement for it.
"Accept all" and the "Deny all" must be both
be the same level of "easy-ness"
Many websites now have two offers: Free with 3rd part ads and paid.
Surely paying is much less easy than clicking "Ok, show me the content with 3rd party ads".
It will be very interesting, how courts see this.
The current situation is, that the courts decided, that the business model (advertising and by that tracking the sh*t out of people) is valid if they offer an alternative were people pay them for access to the content.
were already in court
Do you have a link to such a case?
Sorry.
The really problem is enforcement has been lacking, this is what NOYB are co. are working to fix.
https://gdpr-info.eu/art-7-gdpr/
I don't think it means that when asked for consent, the user must have an easy way to deny that consent. As the user can always decide to simply not use the website.
It was very ineffective.
Something similar but actually enforced (easier said than done) and utilized would be very nice indeed.
There is a misconception, they don't want it do be convenient, the all purpose is to as annoying as possible and legal, to force you to use the easy allow-all-path. So even if there is an API they won't use it. They don't want to give you a choice, they want that you to allows all access.
Even with a deny all feature, they will use it if it's legally mandated, since apparently that's how we handle privacy now
There was: https://en.wikipedia.org/wiki/P3P
AdTech companies want to track you, and it's naive to think they will ever honestly and voluntarily use any APIs that blocks it.
Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws.
The context has obviously changed: there used to be no consequences for lying/bypassing (I didn't actually know about the Google case you mention; although it doesn't surprise me!), and most importantly: there were no consequences for not bothering to put it on a site at all. Hence the low adoption, and hence it died away. That's now changed, there's a chance some "non evil" sites might bring it back.
> Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws.
Yep. That's why machine-readable requests, with default-deny responses from user agents, won't appear any time soon; especially in browsers made/sponsored by adtech giants! The inconvenient, manual-effort is a feature of consent popups (at least, for those who came up with the idea; most sites just jumped on the band-wagon)
If the number of people who would use "Deny all nonessential" is less than the number of people who currently deny consent, it's a win for them.
I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it?
I mean I know that Chrome and Firefox won't block ads by default because it affects their bottom line (Chrome through Google ads, Firefox through Google money), but what about GDPR consent forms and newsletter sign-up popups?
There was Do-Not-Track, but the industry decided it shouldn't be respected.
Grandparent post asked for a technical solution to hide cookie banners forever.
A websites don't have to show any cookie banner whatsoever if they honor Do-Not-Track.
If they don't show a banner but still track, they're breaking the law.
The problem of cookie banners is easy to solve. All that's lacking is honesty from adware vendors and website operators.
Do-Not-Track can already be honoured by website operators. The issue is just that they choose not to do it.
* https://www.cnil.fr/en/cookies-google-fined-150-million-euro...
GDPR isn't about cookies, it's about collecting, storing and transferring data. Done properly, GDPR notices should allow users to opt in to having data about themselves collected by the interested company (and other things like acknowledging the relationships and responsibilities formed by that consent - like requesting deletion and having it honoured).
We just happen to use cookies to do much of that collection. We also already had "the cookie law", so it seems "pragmatic" to piggy back the two things, for the sake of "user convenience".
GDPR creates responsibilities and guidance on all the database tables, the system designs, the job descriptions and so on which operate around data about people.