Hacker News Reader

Comment by ceejayoz | Hacker News Reader

> every website has a bunch of regulatory-required pop-ups asking for permission to simply operate as normal websites, which means collecting the data necessary to provide whatever experience you are trying to access

No, these popups are only regulatory-required when you're collecting data unnecessary to provide the experience.

View on HN

Absolutely right and seems to be wishfully unaware that visiting US sites will trigger the same insane data collection as in the EU (but you can object as a EU citizen). A typical site might integrate 100 to 1000 trackers. Neither Google nor Meta have solved any of that.

My understanding is that permission is required for nonessential usage of data in addition to nonessential collection.

So it’s okay to collect IP addresses for load balancing but not targeting adverts.

This “essential usage” is where things get dicey with whether it’s okay to collect info for logs, customer support, fraud prevention, law enforcement cooperations etc

Tobacco manufacturers have to provide warning labels on cigarettes, so unfair!

Indeed unfair. Vine producers are not required to put cancer warning labels in EU.

Not to mention of any food containing carbs or fats...

The EU regulation states that tobacco health warnings must use an image from the EU approved gallery. Come to think of it, the next iteration of the ePrivacy Directive should force vendors to use only pre-approved designs for the consent prompt. No more "legitimate interest" bs.

I still can’t wrap my head around the fact that supposedly tech-savvy people would completely miss the point of the _tracking_ (not cookie) prompts. It’s the industry that’s going too far, not the EU.

Frankly, the EU didn't go far enough. Instead of allowing this popup bullshit, they really ought to have enforced do not track.

Indeed. A browser sending a “do not track” is already a good indication that the answer to tracking is no.

This is marginally true but misleading. There is not a consistent definition of what data is considered "essential" so the current consensus is that for all cookies - whether it be a first-party non-tracking or not - you are safest to just have the consent banner.

I've worked with four separate GDPR legal teams over my career and none have ever agreed that there is was any such use case as "essential-only" data.

Then they're bad legal teams.

Github.com, free.fr, 42.fr probably a lot of others as those are 3 of the first 4 fqdn I thought about when asking myself 'which website does not need advertising or tracking)'.

Github eliminated cookies for anonymous users on their repo pages, but absolutely still uses tons of cookies for authenticated users, which lets them skirt around the banner requirement: https://github.com/privacy/cookies

They also use an internal analytics system which eliminates the need for a tracking cookie, though they are still able to track website activity.

Visiting free.fr prompts a cookie banner for me, as does 42.fr. Analyzing their websites, they use Didomi and Axeptio as their cookie consent systems - respectively.

Further down this thread you point at a specific website and claim it doesn't have popups, even though it does. The same is true of free.fr (modal popup) and (sliding cookie banner). It's not great that you keep defending cookie popups when you not only very clearly block them, but did it so long ago you forgot about it.

Reply on news.ycombinator.com