Tell HN: I wish “we use cookies” messages could be globally turned off
138 comments
I also used to hate this directive, but when I read the description on the website of the European Commission, it is actually much more nuanced than I thought:
"However, some cookies are exempt from this requirement. Consent is not required if the cookie is: used for the sole purpose of carrying out the transmission of a communication, and strictly necessary in order for the provider of an information society service explicitly required by the user to provide that service." Source: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...
So it turns out the directive isn't as dumb as many believe it to be, but a lot of webmasters wrongly believe that any cookie usage implies having to put up the notice. (Or the nuance was lost on the in-house legal team who briefed the webmaster.)
I run a software-as-a-service company in the EU, but only use cookies for login management. Therefore, I do not need to use the warning. But if I would track my users for advertising etc. I'd have to insert the warning in my web app.
This thoughtless behaviour reminds me of the thousands of websites which include a "(c) YYYY" copyright notice in their footers, despite this being completely irrelevant in modern copyright law.
"However, some cookies are exempt from this requirement. Consent is not required if the cookie is: used for the sole purpose of carrying out the transmission of a communication, and strictly necessary in order for the provider of an information society service explicitly required by the user to provide that service." Source: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...
So it turns out the directive isn't as dumb as many believe it to be, but a lot of webmasters wrongly believe that any cookie usage implies having to put up the notice. (Or the nuance was lost on the in-house legal team who briefed the webmaster.)
I run a software-as-a-service company in the EU, but only use cookies for login management. Therefore, I do not need to use the warning. But if I would track my users for advertising etc. I'd have to insert the warning in my web app.
This thoughtless behaviour reminds me of the thousands of websites which include a "(c) YYYY" copyright notice in their footers, despite this being completely irrelevant in modern copyright law.
There are many examples, including "This product may contain traces of ..." and California's Prop 65: "This building contains substances known to the State of California to cause ..." It's required in some cases, but never forbidden, so one can avoid liability by just posting it everywhere, robbing it of its informative content.
While it's also about liability, there seem to be people deadly allergic to even small amounts of e.g. nuts. Those notices are shown when production machines are also shared used for other products and cleaning is never completely safe.
... and it's a heck of a lot cheaper to put a notice on the product than to make your peanut-free products in a cleanroom.
Yes but as soon as you use Google Analytics, you need to include the notice.
As a EU citizen, I think this example shows how stupid laws can come out of good intentions. Why stupid? Because, no matter what the intentions were, the only practical effect is creating a nuisance for web users, who quickly learn to ignore the consent requests.
As a EU citizen, I think this example shows how stupid laws can come out of good intentions. Why stupid? Because, no matter what the intentions were, the only practical effect is creating a nuisance for web users, who quickly learn to ignore the consent requests.
I never understood why they didn't force the requirement onto browser makers instead of website operators. Then users could actually enforce their cookie choice by opting out, instead of having to trust every website to be honest in their cookie use.
And browsers have had such options (block all cookies, prompt to accept, etc.) built in to them since the very beginning of cookies, except everyone turned them off because they were annoying! So now websites had to add them! And they are just as annoying! ARGH!
A more useful directive would have been some sort of legally-backed "coloured cookie" type system, where a cookie has to declare for what purpose (session, internal analytics, adverts, site-to-site tracking, etc.) it's for, so browsers can then selectively block those categories. That would be useful, because then you could punish people who lie about the purpose of their cookie.
A more useful directive would have been some sort of legally-backed "coloured cookie" type system, where a cookie has to declare for what purpose (session, internal analytics, adverts, site-to-site tracking, etc.) it's for, so browsers can then selectively block those categories. That would be useful, because then you could punish people who lie about the purpose of their cookie.
Sounds like the misguided P3P "standard" that IE implemented which AFAIK only resulted in web developers copypasting a HTTP header they don't understand just to get facebook widgets working.
I couldn't work out why people didn't just use the browser cookie controls. It seems shortsighted to force the server to bundle a message down the wire to me - the browser should tell me that. What if I am a dumb client like telnet that's just done a GET?
Do we also need servers to inform us in large letters that they're making a note of our IP address and adding it to their logs? That they're using our referral info and browser details (I'm using Chromium on a Mac!)? That they'll use those details for analysis? Weirdly people have switched to Google analytics instead of just looking at the server logs (like awstats from yesteryear). Do we need messages telling us that the ISP is throttling us or logging too? That I'm using PPP or something?
It's all daft. Hopefully this madness doesn't make it into mobile telephone calls - "your location can be triangulated from our phone towers"; "you're using GSM which has weak encryption and can be eavesdropped" etc. etc.
We should have the option of authorising all the GET requests it makes too I feel! That'd keep websites from loading too much (and suffering website bloat, as the average website data size has been climbing massively due to all that JavaScript)
Do we also need servers to inform us in large letters that they're making a note of our IP address and adding it to their logs? That they're using our referral info and browser details (I'm using Chromium on a Mac!)? That they'll use those details for analysis? Weirdly people have switched to Google analytics instead of just looking at the server logs (like awstats from yesteryear). Do we need messages telling us that the ISP is throttling us or logging too? That I'm using PPP or something?
It's all daft. Hopefully this madness doesn't make it into mobile telephone calls - "your location can be triangulated from our phone towers"; "you're using GSM which has weak encryption and can be eavesdropped" etc. etc.
We should have the option of authorising all the GET requests it makes too I feel! That'd keep websites from loading too much (and suffering website bloat, as the average website data size has been climbing massively due to all that JavaScript)
I don't think it's a nuisance - it tells me they are trying to run analytics on their site.
Except you still see it if you block the analytics ... :(
The execution could be better, but it is certainly not a stupid idea. GA code is esentially a concealed, unconditional transmit of the user data to a third party, and allowing this third party to intercept and modify your communication; pretty high price for a few colorful piecharts, and certainly something that deserves a disclaimer.
GA's Terms & Conditions make disclosing use of the product mandatory but this has to be the most widely ignored and unenforced rule I've ever seen.
If a lawyer somewhere figures out how to parlay this into a class-action/privacy issue (maybe Europe?) they are going to be filthy rich since this is so widespread. Even government websites use GA and fail to disclose it as required.
If a lawyer somewhere figures out how to parlay this into a class-action/privacy issue (maybe Europe?) they are going to be filthy rich since this is so widespread. Even government websites use GA and fail to disclose it as required.
The worst part is, since I care enough about cookies and privacy that I set up my browsers to delete cookies on exit (minus a small whitelist for sites I prefer to stay logged on to), the sites displaying these notices can't even remember that I already dismissed the notice.
(assuming I'd only see the notice once if I'd keep my cookies, not actually sure if that would be the case, nor do I care to find out ...)
(assuming I'd only see the notice once if I'd keep my cookies, not actually sure if that would be the case, nor do I care to find out ...)
Well, that's pretty ironic I guess!
>> This thoughtless behaviour reminds me of the thousands of websites which include a "(c) YYYY" copyright notice in their footers, despite this being completely irrelevant in modern copyright law.
I'll bite :-) Are you automatically covered then? - companies like Apple still do it .... 'Copyright © 2015 Apple Inc. All rights reserved.'
I'll bite :-) Are you automatically covered then? - companies like Apple still do it .... 'Copyright © 2015 Apple Inc. All rights reserved.'
Yes, you are.
> A website — graphics, content, visual elements — is copyrighted at the time of development. So putting the copyright notice on the bottom of a site states that the material displayed is not to be used without permission of the owner. In fact, you don’t even need the notice to claim copyright; the law eliminated the requirement of public notice in 1989.
Source: http://www.sitepoint.com/what-it-means-to-copyright-a-websit...
> A website — graphics, content, visual elements — is copyrighted at the time of development. So putting the copyright notice on the bottom of a site states that the material displayed is not to be used without permission of the owner. In fact, you don’t even need the notice to claim copyright; the law eliminated the requirement of public notice in 1989.
Source: http://www.sitepoint.com/what-it-means-to-copyright-a-websit...
This source covers only US copyright law, not EU copyright law, not UK copyright law, not Russian copyright law, not Canadian copyright law, etc.
Article 5(2) of the Berne Convention:[0]
"The enjoyment and the exercise of these rights shall not be subject to any formality"
[0] https://en.wikisource.org/wiki/Convention_for_the_Protection...
"The enjoyment and the exercise of these rights shall not be subject to any formality"
[0] https://en.wikisource.org/wiki/Convention_for_the_Protection...
As I understand it (but I am no lawyer), it was only a requirement in the US until 1989. So if you are a company operating outside the US and none of your copyrighted material dates from before that, I don't see why you should include it. Also, for websites there are many more reliable methods of demonstrating the time of creation.
So for some it might have a use, but it seems to me that thousands of webmasters (including myself) have been copying this pre-1989 US-only best-practice, just because it is nice to have something to put it the footer :-)
So for some it might have a use, but it seems to me that thousands of webmasters (including myself) have been copying this pre-1989 US-only best-practice, just because it is nice to have something to put it the footer :-)
The Copyright Office does suggest that it could still be a good idea, even though it's no longer required:
> Use of the notice may be important because it informs the public that the work is protected by copyright, identifies the copyright owner, and shows the year of first publication. Furthermore, in the event that a work is infringed, if a proper notice of copyright appears on the published copy or copies to which a defendant in a copyright infringement suit had access, then no weight shall be given to such a defendant’s interposi tion of a defense based on innocent infringement in mitigation of actual or statutory damages, except as provided in section 504(c)(2) of the copyright law. Innocent infringement occurs when the infringer did not realize that the work was protected.
(http://copyright.gov/circs/circ01.pdf)
> Use of the notice may be important because it informs the public that the work is protected by copyright, identifies the copyright owner, and shows the year of first publication. Furthermore, in the event that a work is infringed, if a proper notice of copyright appears on the published copy or copies to which a defendant in a copyright infringement suit had access, then no weight shall be given to such a defendant’s interposi tion of a defense based on innocent infringement in mitigation of actual or statutory damages, except as provided in section 504(c)(2) of the copyright law. Innocent infringement occurs when the infringer did not realize that the work was protected.
(http://copyright.gov/circs/circ01.pdf)
It looks professional.
And it has the practical value of informing you than someone maintaining the site has at least looked at it within the last year or so.
Or had the forethought ten years ago to add:
© <?php echo strftime('%Y'); ?>
;-)
© <?php echo strftime('%Y'); ?>
;-)
You're supposed to put the year the material was copyrighted, not the current year.
Even if you use cookies legally without the cookie warning, there would still be the risk of getting a cease&desist or even a lawsuit from someone who does not understand the distinction and/or uses automated tools to find violating sites.
At least in Germany, sending such cease&desists is a lucrative business for many lawyers and organizations.
At least in Germany, sending such cease&desists is a lucrative business for many lawyers and organizations.
Seems like that's a problem with the legal system, not this law. Presumably the same thing happens with other poorly understood laws.
> directive isn't as dumb as many believe it to be,
I think directive is exactly as dumb as the effect it causes. Regardless of lawmakers intentions or even the letter of the law.
I think directive is exactly as dumb as the effect it causes. Regardless of lawmakers intentions or even the letter of the law.
I agree that the general effect is still dumb, but I meant that the directive isn't as "technologically illiterate as many believe it to be".
I was pleasantly surprised that the legislators were aware of the necessity of cookies for login management. At least it allows me to keep my web app clean of this pollution...
I was pleasantly surprised that the legislators were aware of the necessity of cookies for login management. At least it allows me to keep my web app clean of this pollution...
It is very much technologically illiterate not to foresee this exact effect.
Sure, there are allowances for technically essential cookies but in practice almost everybody is using third-party services like Google Analytics. For a physical business with a brochure website, tracking how people use their site is more essential than any session cookie.
I'm not saying I necessarily disagree with the idea behind the law, rather that almost everybody uses cookies and making everybody announce that doesn't mean we're suddenly all informed.
An implicit /cookies/ or /cookies.html or even a domain-level TXT record would be just as informative, without clobbering user experience with a message that everybody is now blind to.
As others have said, copyright notices are as much about preventing infringement as they are anything else. Consider them similar to a "Thieves will be prosecuted" signs in shops.
I'm not saying I necessarily disagree with the idea behind the law, rather that almost everybody uses cookies and making everybody announce that doesn't mean we're suddenly all informed.
An implicit /cookies/ or /cookies.html or even a domain-level TXT record would be just as informative, without clobbering user experience with a message that everybody is now blind to.
As others have said, copyright notices are as much about preventing infringement as they are anything else. Consider them similar to a "Thieves will be prosecuted" signs in shops.
With regard to the law, at least the UK interpretation, 'essential cookies' aren't ones that are essential for the website-operator's business purposes. The term is restricted to cookies that are essential for what the visitor has requested.
source: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
source: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
That's my point. Things that are so commonplace should be implicit.
I guess the legislators didn't think the general public was informed enough about cookies for them to meaningfully, implicitly consent. I don't think many people read the already mandatory privacy policies, so I'd have to agree. That the use of, say, 3rd party analytics cookies is so commonplace seems neither here nor there.
(For the record: I would prefer a technological, rather than legislative solution here.)
(For the record: I would prefer a technological, rather than legislative solution here.)
> This thoughtless behaviour reminds me of the thousands of websites which include a "(c) YYYY" copyright notice in their footers
https://www.youtube.com/watch?v=6x0cAzQ7PVs&t=6m45s (6:45–8:27)
TL;DW: "It's actually not there for legal reasons, [...] it's there as punctuation."
(No longer necessary for them, still a nice anecdote.)
https://www.youtube.com/watch?v=6x0cAzQ7PVs&t=6m45s (6:45–8:27)
TL;DW: "It's actually not there for legal reasons, [...] it's there as punctuation."
(No longer necessary for them, still a nice anecdote.)
I think the (C) YYYY notice is more for people who "forget" that items are copywritten automatically.
Maybe also as a point of naming the official institution responsible for that page
[deleted]
Not exactly. It has legal purposes - IANAL (and someone correct me if I'm wrong), but I believe it has to do with proving willful misuse (which matters somehow) and establishing a date of copyright. I believe that the idea is to put the earliest date of copyright, not the current year, which is a common practice.
Thanks for the find!
The idea behind this proposal was a noble one: companies should ask permission before invading the privacy of consumers.
Unfortunately, companies collectively decided that their businessmodel does not need changing at all, and simply implemented a "cookie wall" for all their consumers. This led to consumers, like you, to quickly get "cookie wall fatigue" and try to click 'OK' as soon as possible, without thinking at all.
And all the while, we complain that privacy on the Internet is going to hell, and there is nothing we can do about it, because consumers don't care enough, or have given up...
Unfortunately, companies collectively decided that their businessmodel does not need changing at all, and simply implemented a "cookie wall" for all their consumers. This led to consumers, like you, to quickly get "cookie wall fatigue" and try to click 'OK' as soon as possible, without thinking at all.
And all the while, we complain that privacy on the Internet is going to hell, and there is nothing we can do about it, because consumers don't care enough, or have given up...
Pretty much every political failure can be described as a noble idea with a dumb outcome. And this one was obviously predictable.
what bothers me is that most websites just show the warning but sends you the cookie anyway while they are mandated to wait till you agree to do that, and basically there is no enforcement so even if I were upset about a site tracking me without consent, I cannot report it and no penalty will actually ever happen to people in violation of this law.
anyway, I think this is mostly a social and educational failure and shows how much more we need to do before we actually own our own hardware instead of relying on the god will of third parties, which never actually works.
moreover this should have been fixed at browser level, and it already was. anyone caring for privacy already had configured the browser for this stuff; at most people just needed more awareness on what was already available in term of privacy controlling extensions
instead we got retarded regulations which explicitly exclude session, authentication and social cookies so basically does nothing about the real issue - 'oh this is not google analytics, it's google plus tracking you - wink wink' - and data mining proceeds as usual.
anyway, I think this is mostly a social and educational failure and shows how much more we need to do before we actually own our own hardware instead of relying on the god will of third parties, which never actually works.
moreover this should have been fixed at browser level, and it already was. anyone caring for privacy already had configured the browser for this stuff; at most people just needed more awareness on what was already available in term of privacy controlling extensions
instead we got retarded regulations which explicitly exclude session, authentication and social cookies so basically does nothing about the real issue - 'oh this is not google analytics, it's google plus tracking you - wink wink' - and data mining proceeds as usual.
if I were upset about a site tracking me without consent, I cannot report it and no penalty will actually ever happen to people
Why can't you report it? In the UK, head to the IPO (https://ico.org.uk/concerns/), for example. Other countries have similar bodies.
Why can't you report it? In the UK, head to the IPO (https://ico.org.uk/concerns/), for example. Other countries have similar bodies.
in italy they just saw it fit to put a 130 eur registration tax, but I haven't seen any official enforcement body being assigned
The idea was noble, but the law was poorly done.
If you want to have a Remember me checkbox (=writing a cookie with a session id), you'll have to get the user autorization. It effectively protects from nothing, it justs makes more popups in everyones life (yay!).
I think we are living in an era where there is a huge knowledge and perception gap with the people making the laws (At least in Europe). Hopefully this gap will narrow in the next 10-20 years, and things will be shapen more correctly in the future.
If you want to have a Remember me checkbox (=writing a cookie with a session id), you'll have to get the user autorization. It effectively protects from nothing, it justs makes more popups in everyones life (yay!).
I think we are living in an era where there is a huge knowledge and perception gap with the people making the laws (At least in Europe). Hopefully this gap will narrow in the next 10-20 years, and things will be shapen more correctly in the future.
Nobel is not the exact word I'd use. It's been unenforceable from the get go.
If anything, think, just for a second, how much this law has costed the EU, and how many hours has been wasted reading/participating in the law. Of course, it could be one way of stimulating the economy, but I'd like to think it wasn't.
If anything, think, just for a second, how much this law has costed the EU, and how many hours has been wasted reading/participating in the law. Of course, it could be one way of stimulating the economy, but I'd like to think it wasn't.
The Netherlands has seen some refinement of the cookie law, and there are some sites, for example http://www.ns.nl where you now have a choice in what kind of cookies you want to allow.
Again, companies are trying very hard to hide this choice, but a tiny result from the study is that you do get this choice.
Again, companies are trying very hard to hide this choice, but a tiny result from the study is that you do get this choice.
Even more popups, choices and waste of energy if you ask me :)
> If you want to have a Remember me checkbox (=writing a cookie with a session id), you'll have to get the user autorization.
[X] Remember me (uses a cookie, see _terms_)
That should do, so long as the box is unticked by default.
[X] Remember me (uses a cookie, see _terms_)
That should do, so long as the box is unticked by default.
It's pretty easy for the very small minority of people who don't want cookies to disable them in their browser.
Also it's pretty easy for any website that wants to track you, to track you using something other than cookies.
Also it's pretty easy for any website that wants to track you, to track you using something other than cookies.
> It's pretty easy for the very small minority of people who don't want cookies to disable them in their browser.
No it's not. At least for Firefox, the cookie preferences feature has been neglected for years. It's hidden beyond an increasing number of clicks and has long standing bugs (for instance, my whitelist of sites I allow cookies from is wiped each time Firefox upgrades)
> Also it's pretty easy for any website that wants to track you, to track you using something other than cookies.
The specific law (details are slightly different in each European country) I'm familiar with concerns storing and processing identifying information. For various reasons, everybody focused exclusively on HTTP cookies, but tracking using, say, ETAGs would fall under the same requirement of notifying the users as far as I know.
No it's not. At least for Firefox, the cookie preferences feature has been neglected for years. It's hidden beyond an increasing number of clicks and has long standing bugs (for instance, my whitelist of sites I allow cookies from is wiped each time Firefox upgrades)
> Also it's pretty easy for any website that wants to track you, to track you using something other than cookies.
The specific law (details are slightly different in each European country) I'm familiar with concerns storing and processing identifying information. For various reasons, everybody focused exclusively on HTTP cookies, but tracking using, say, ETAGs would fall under the same requirement of notifying the users as far as I know.
At least for Firefox, the cookie preferences feature has been neglected for years. It's hidden beyond an increasing number of clicks and has long standing bugs (for instance, my whitelist of sites I allow cookies from is wiped each time Firefox upgrades)
I think the fact that they're actually making it harder with each new UI revision - and trying to make it go away in some sense - is a sign that their interests are not aligned with those of their users' desire for privacy. It's not so surprising, really, as their revenue largely comes from an ad-supported search engine, and so they would not want to be defeating ad-networks' tracking by making cookie management/blocking easier...
I think the fact that they're actually making it harder with each new UI revision - and trying to make it go away in some sense - is a sign that their interests are not aligned with those of their users' desire for privacy. It's not so surprising, really, as their revenue largely comes from an ad-supported search engine, and so they would not want to be defeating ad-networks' tracking by making cookie management/blocking easier...
That's not a really fair assumption - I recall the stated reason for this change (and the removal of another few checkboxes, like ones that disable javascript and images globally) is that idiot users would turn it off for some reason, and then complain that sites don't work right.
As much as I hate the idea of protecting people from themselves, there's some merit to this.
As much as I hate the idea of protecting people from themselves, there's some merit to this.
Or, they're not putting it front and centre because it's a feature only used by a limited number of (power) users, and generally only set once after install and never looked at again?
It is easy, you're just doing it the wrong way.
https://addons.mozilla.org/en-us/firefox/addon/ghostery/
https://addons.mozilla.org/en-us/firefox/addon/ghostery/
Sure, the law is ridiculous though. It'd be like trying to make it illegal for a shop assistant to remember you shopped there last thursday.
It's completely unenforceable.
It's completely unenforceable.
> my whitelist of sites I allow cookies from is wiped each time Firefox upgrades
weird, I don't have that problem? (Firefox 38 Linux)
weird, I don't have that problem? (Firefox 38 Linux)
The sad thing is that this development was perfectly foreseeable.
I don't even think this law makes any sense from a privacy standpoint since cookies hold very small amounts of data (thus are seldom used for much aside preferences and IDs). What's more, cookies are stored locally anyway.
If there was a law passed that users had to agree to being tracked (be that via tracking cookies, or any other medium), or that users had to agree to having persistent sessions (eg entries on a session table), then that might have actually made some impact. Though I'm sure even then, there's easy workarounds (eg web server logs).
If there was a law passed that users had to agree to being tracked (be that via tracking cookies, or any other medium), or that users had to agree to having persistent sessions (eg entries on a session table), then that might have actually made some impact. Though I'm sure even then, there's easy workarounds (eg web server logs).
It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked!
However they made the law too broad and had it cover on site cookies too, which get used for the typical session information that powers features that every consumer expects these days (recently viewed, shopping baskets, etc.). So the companies got caught in the general stupidity.
However they made the law too broad and had it cover on site cookies too, which get used for the typical session information that powers features that every consumer expects these days (recently viewed, shopping baskets, etc.). So the companies got caught in the general stupidity.
I never really understood why this was mandated as a server-side issue.
Rather than mandate every server behave nicely (an enforceability nightmare), why not mandate every client protect users' privacy with deeper cookie control? Sort of like the one time preference request option when installing something from an app store:
"This site tried to set a cookie to <adtracker.site-you-are-not-on.com>; do you accept (y/n)? (more info link) --> Cookies can be used to track you across websites; some people feel this is an invasion of their privacy."
You could even mandate browsers allow for whitelisting and blacklisting. For the people who care, it'd break the back of the tracking industry within one generation of browser evolution.
Rather than mandate every server behave nicely (an enforceability nightmare), why not mandate every client protect users' privacy with deeper cookie control? Sort of like the one time preference request option when installing something from an app store:
"This site tried to set a cookie to <adtracker.site-you-are-not-on.com>; do you accept (y/n)? (more info link) --> Cookies can be used to track you across websites; some people feel this is an invasion of their privacy."
You could even mandate browsers allow for whitelisting and blacklisting. For the people who care, it'd break the back of the tracking industry within one generation of browser evolution.
Browsers already can whitelist and blacklist IPs (though you'd possibly want a extension / addon to help manage that for you).
The problem is that:
1) every site writes cookies and some cookies are needed for sites to behave properly (eg it would be impossible to use online shopping without cookies). So the amount of "do you accept" messages you'd see would be insane. It would get to the point that users would just give up and accept everything (pretty much like we do now, in fact).
As a fun experiment, lynx (the terminal based web browser) asks you to accept cookies by default. So try browsing around the web with that. You'd see how very quickly it becomes the most annoying thing ever!
2) what happens when your tracking cookie comes from the same domain as site which you might want cookies stored from? You either have to accept being tracked or break that site.
3) lastly, there are methods of being tracked without the use of cookies. Cookies are by far the easiest and thus most common. But it's possible to work around disabled cookies.
The problem is that:
1) every site writes cookies and some cookies are needed for sites to behave properly (eg it would be impossible to use online shopping without cookies). So the amount of "do you accept" messages you'd see would be insane. It would get to the point that users would just give up and accept everything (pretty much like we do now, in fact).
As a fun experiment, lynx (the terminal based web browser) asks you to accept cookies by default. So try browsing around the web with that. You'd see how very quickly it becomes the most annoying thing ever!
2) what happens when your tracking cookie comes from the same domain as site which you might want cookies stored from? You either have to accept being tracked or break that site.
3) lastly, there are methods of being tracked without the use of cookies. Cookies are by far the easiest and thus most common. But it's possible to work around disabled cookies.
> It does make sense that 3rd parties should not be allowed to log cookies without your consent, i.e. all the ad trackers. If they had targeted those overly intrusive ad companies, great! It would have worked!
I agree, but cookies aren't the only method of being tracked. So we're back to my original point that legislating against cookies specifically isn't the right way to go about addressing privacy concerns. Hense why I said they should be targeting the tracking data that is stored remotely, as that will cover a multitude of sins.
I agree, but cookies aren't the only method of being tracked. So we're back to my original point that legislating against cookies specifically isn't the right way to go about addressing privacy concerns. Hense why I said they should be targeting the tracking data that is stored remotely, as that will cover a multitude of sins.
You might be surprised how much data cookies can hold. Google Ads cookies (anything with __ga, etc.) are in almost every site do indeed appear to hold some tracking data.
But I agree with you that this is some misguided legislation for many reasons.
But I agree with you that this is some misguided legislation for many reasons.
I know full well what data is stored in cookies, and you're still only describing IDs. The actual tracking data would be stored remotely, with the cookie used just as a "car licence plate" of sorts. On it's only it's a harmless unique identifier but the privacy issues arise when persistent data is held against that identifier. So my point was, the actual privacy issues isn't the data stored in the cookie itself, it's the data on the remote servers - and thus that's what needs to be legislated against if the EU want to address privacy issues.
I do agree that ideally we don't want these cookies either, but those cookies would be useless without any data against anyway.
I do agree that ideally we don't want these cookies either, but those cookies would be useless without any data against anyway.
> ...because of some European law I have no interest in.
Nobody in Europe does either. The whole thing is generally considered completely pointless and unenforceable.
Nobody in Europe does either. The whole thing is generally considered completely pointless and unenforceable.
I think Rock Paper Shotgun's cookie warning sums this up nicely:
> Rock Paper Shotgun uses cookies. For some reason we are now obliged to notify you of this fact. Not that you care.
> Rock Paper Shotgun uses cookies. For some reason we are now obliged to notify you of this fact. Not that you care.
While funny, RPS is disingenuous:
after visiting RPS, you'll get cookies from the following additional domains:
I can see how you might think: "who cares if Google Analytics tracks me? Google already has all my web searches", but it's not that simple... every one of these entities can share information about your visits with any other (search for "cookie matching"), and yet... with a visit to a single (!) website, you're loaded with cookies from 12 external different domains, all of which have the exact same purpose.
Personally, I never cared that much about privacy (or at least, this kind of privacy) but now... if only out of spite... I disable storage of 3rd party cookies in my Firefox.
So it's not only a matter of privacy, but also a matter of respect for the (your) user:
as a videogames site, you can easily (?[1]) provide advertisement targeted only to your main audience (for advertisement metrics and fraud prevention, the advertiser could just use the referrer and ip of the source, at least for a first approximation)... so it's not true that giving up (tracking) cookies would prevent advertisement
OTOH: by including random 3rd party javascript (and not simply static resources like images, css, etc. with their own tracking cookie) you are completely leaving your user to the good faith of these other companies, which are then able to use javascript to load other resources, and so on and so on... reselling your visits to other companies again
Not only is this wasteful and never done according to the explicit will of the user, but since the visits span multiple domains, this is something that not even HTTP2 will be able to help for.
Lastly, I think it's antithetic to the very original purpose of HTTP: HTTP nowadays is used for webapps and plenty of different things, but reading articles, seeing images (and possibly videos, just like on RPS) aligns quite well with the original purpose: downloading and transmitting simple documents or data thereof
Cookies are a way to circumvent the stateless nature of HTTP, but why shouldn't a news site like RPS be stateless? (the exception would be for comments, but that isn't necessarily always true either, and anyhow for that the issue is more nuanced)
[1] I have never done it, but I hope so... I hope that inserting adwords is not the only way
after visiting RPS, you'll get cookies from the following additional domains:
- adaptv.advertising.com
- adjs.net
- b3-uk.mookie1.com
- mookie1.com
- doubleclick.net
- iasds01.com
- m6r.eu
- mathtag.com
- quantserve.com
- scorecardresearch.com
- openx.net
- adnxs.com
I can see how you might think: "who cares if Google Analytics tracks me? Google already has all my web searches", but it's not that simple... every one of these entities can share information about your visits with any other (search for "cookie matching"), and yet... with a visit to a single (!) website, you're loaded with cookies from 12 external different domains, all of which have the exact same purpose.
Personally, I never cared that much about privacy (or at least, this kind of privacy) but now... if only out of spite... I disable storage of 3rd party cookies in my Firefox.
So it's not only a matter of privacy, but also a matter of respect for the (your) user:
as a videogames site, you can easily (?[1]) provide advertisement targeted only to your main audience (for advertisement metrics and fraud prevention, the advertiser could just use the referrer and ip of the source, at least for a first approximation)... so it's not true that giving up (tracking) cookies would prevent advertisement
OTOH: by including random 3rd party javascript (and not simply static resources like images, css, etc. with their own tracking cookie) you are completely leaving your user to the good faith of these other companies, which are then able to use javascript to load other resources, and so on and so on... reselling your visits to other companies again
Not only is this wasteful and never done according to the explicit will of the user, but since the visits span multiple domains, this is something that not even HTTP2 will be able to help for.
Lastly, I think it's antithetic to the very original purpose of HTTP: HTTP nowadays is used for webapps and plenty of different things, but reading articles, seeing images (and possibly videos, just like on RPS) aligns quite well with the original purpose: downloading and transmitting simple documents or data thereof
Cookies are a way to circumvent the stateless nature of HTTP, but why shouldn't a news site like RPS be stateless? (the exception would be for comments, but that isn't necessarily always true either, and anyhow for that the issue is more nuanced)
[1] I have never done it, but I hope so... I hope that inserting adwords is not the only way
There is a list for adblock[1] with our own mike-cardwell contributing but it doesn't have the kind of coverage you're used to from ad lists.
[1] https://github.com/r4vi/block-the-eu-cookie-shit-list
[1] https://github.com/r4vi/block-the-eu-cookie-shit-list
There is also https://raw.githubusercontent.com/liamja/Prebake/master/obtr... which I use to great effect in uBlock Origin.
Another unfortunate aspect of this law is that it is especially annoyng for those who delete cookies after leaving a website or closing the browser. Since the users acceptance of cookies is stored in a cookie, I get that pop-up repeatedly on most sites, instead of once for each.
Using NoScript works wonders. In addition, I rarely see the annoying "Sign up for our newsletter" popups that assault immediately on most sites.
You could browse with Lynx, then you wouldn't see any annoying images
Wow, what an impractical suggestion. At least scripting is possible with NoScript, but images are impossible on Lynx.
Hey, watch it. I use Lynx all the time. It's fast, and works in my terminal.
it's also super-incompatible with a lot of websites, but I know that going into it.
it's also super-incompatible with a lot of websites, but I know that going into it.
I also use it in a console when needs must. Using dillo over SSH/X forwarding is painful sometimes (particularly as dillo wouldn't compile due to bust FLTK source).
We wish. Us European webmasters REALLY wish.
It is unlikely, however, since it is a EU directive and is now law in most European countries. Here's my take on why it is totally idiotic and ignorant of the underlying problem: http://cfenollosa.com/blog/the-ignorant-eu-cookie-law.html
It is unlikely, however, since it is a EU directive and is now law in most European countries. Here's my take on why it is totally idiotic and ignorant of the underlying problem: http://cfenollosa.com/blog/the-ignorant-eu-cookie-law.html
'I don't care about cookies' for Chrome:
https://chrome.google.com/webstore/detail/i-dont-care-about-...
It's $FREE too.
https://chrome.google.com/webstore/detail/i-dont-care-about-...
It's $FREE too.
And it only has access to all your bank logins, emails, passwords and more!
That blanket message appears to be another way of wording "it has access to what you type into a browser" (plus an Internet connection).
Who would have thought that the browser has access to what you type into it???? Surely keyboards should come with massive warning stickers to highlight the danger.
Who would have thought that the browser has access to what you type into it???? Surely keyboards should come with massive warning stickers to highlight the danger.
Relevant, although mostly just to the UK. The ICO in the UK generally only goes after "worst offenders" or the biggest companies. This means anyone under a certain size can either ignore most of the laws they enforce or at least only bother to resolve the issues when ICO chase them up.
I really wish the other browsers would have something like this to quickly turn on/off settings for specific sites:
http://i.imgur.com/9qvdOfW.png
(Opera, before it turned into yet-another-webkit-browser - and removed that very useful feature.)
Since I have JS (and cookies) off by default I don't get the cookie messages much if at all, but for sites which need JS or cookies, it's almost trivial to enable them immediately.
http://i.imgur.com/9qvdOfW.png
(Opera, before it turned into yet-another-webkit-browser - and removed that very useful feature.)
Since I have JS (and cookies) off by default I don't get the cookie messages much if at all, but for sites which need JS or cookies, it's almost trivial to enable them immediately.
I really miss Opera's site-specific settings.
IMO, the web has gotten considerably worse in the last few years.
IMO, the web has gotten considerably worse in the last few years.
I highly recommend gorhill's umatrix, it's perfect. Alternatively you could give this a try: https://addons.opera.com/en/extensions/details/site-specific...
AFAIK Firefox also has site specific settings hidden somewhere but I am not sure.
RIP Opera 12... I wish they'd just freely release the sources.
AFAIK Firefox also has site specific settings hidden somewhere but I am not sure.
RIP Opera 12... I wish they'd just freely release the sources.
Firefox had site-specific settings...
http://www-archive.mozilla.org/projects/security/components/...
...and there was even a bug to create a nice UI for it...
https://bugzilla.mozilla.org/show_bug.cgi?id=38966
...but look at the last comment on that bug. :(
Interestingly enough, IE11 still contains much the same UI for white/black/default-listing sites in different zones with configurable options that has been there since at least IE4:
https://support.microsoft.com/en-us/kb/174360
http://www-archive.mozilla.org/projects/security/components/...
...and there was even a bug to create a nice UI for it...
https://bugzilla.mozilla.org/show_bug.cgi?id=38966
...but look at the last comment on that bug. :(
Interestingly enough, IE11 still contains much the same UI for white/black/default-listing sites in different zones with configurable options that has been there since at least IE4:
https://support.microsoft.com/en-us/kb/174360
Typical. I guess someone needs to implement the functionality as proprietary website then Mozilla could add it back in!
IMHO browsers never should have gotten cookies in the first place, and they certainly shouldn't have ever allowed them to be accessed from different sites. Sure, it's very convenient for a site to recognize you when you return, but there are other way to get much of the way there.
But hey, rather than scaling back HTML 5 includes a client side database! WTF?
But hey, rather than scaling back HTML 5 includes a client side database! WTF?
I'm not sure why you're being downvoted, but I agree: cookies are enormous (bad) hack, and we knew they were an enormous hack when they were implemented many moons ago. I think it would be far better for HTTP to get a better auth system, and stop using cookies for auth, which would certainly mean it's far more fe. Also locking down session cookies to only get sent back to the host that generated them in the session would be excellent. It's highly unfortunate that this isn't fixed in HTTP/2, but it probably goes to show where the controlling powers interests lie.
Out of curiosity, what would you have recommended, had you been on the web steering committee at the time?
>> Out of curiosity, what would you have recommended, had you been on the web steering committee at the time?
Cookies should have been at most a GUID for a single session on a single server.
With a little dynamic content you can put a session GUID in every link on a site and not have anything stored locally on the users machine. Back in the day this was a more significant problem than it would be today. Note that this would also preserve the user ID in bookmarks. Also, it really begs for HTTPS.
There are probably other ways to do these things, but people will either claim they are inefficient or just keep their blinders on and make excuses in favor of the status quo. Of course many of the alternatives could probably be abused as well, it's just harder.
Cookies should have been at most a GUID for a single session on a single server.
With a little dynamic content you can put a session GUID in every link on a site and not have anything stored locally on the users machine. Back in the day this was a more significant problem than it would be today. Note that this would also preserve the user ID in bookmarks. Also, it really begs for HTTPS.
There are probably other ways to do these things, but people will either claim they are inefficient or just keep their blinders on and make excuses in favor of the status quo. Of course many of the alternatives could probably be abused as well, it's just harder.
That might very well have legs. I wonder how one would support keeping a user logged in across sessions, but that might still be a solvable problem.
I'm failing to understand the supposed nobility some people are commenting on. 99% of people don't understand or don't care anyway. Annoying and confusing those people is not noble. The people that do care will likely find that turning off cookies break their favourite sites, so the warning is not practically actionable.
Some sites now offer me the choice of cookies, the choice to participate in a quick survey, a choice to use the iOS app, another iOS app choice that is identical to the first, the choice to instantly connect to a live customer service representative and no choice about watching a partner video. Might as well bring back all the animated GIFs and marquee text.
Some sites now offer me the choice of cookies, the choice to participate in a quick survey, a choice to use the iOS app, another iOS app choice that is identical to the first, the choice to instantly connect to a live customer service representative and no choice about watching a partner video. Might as well bring back all the animated GIFs and marquee text.
This can be said of lots of other issues like Safari's war on internet infrastructure by banning 3rd party cookies for no reason. Cookies are a known entity, easy to check and easy to clear, not to mention they also held opt-out status for all those networks that offered it. Progress should be understanding and choice, not brute force approaches like these that just fatigue users and undermine the entire cause.
Users who don't like Safari's privacy defaults can just change them, though. If you like understanding and choice, why not let users understand and choose turning third party cookies on, instead of turning them off?
The defaults are the issue, by going against the greater convention on something that only a few minority really have a big concern with. None of the other browsers do this and it hasn't really led to any privacy benefits, rather it's increased the level of tracking from something that was easily controlled and understood to now fingerprinting and even ISP level identification.
Tracking users is internet infrastructure? For one, I'm sorely disappointed that Firefox never went trough with changing the default.
Cookies are internet infrastructure. Identity/state management is just a natural part of the way the internet works. This sort of thing would be better solved through regulation on the network side rather than just browsers doing whatever they want.
The original requirement was for sites to obtain "prior informed consent", and this is essentially impossible - you cannot educate a user about the implications of cookies in a pop-up.
Further, the ICO here in the UK refused to provide meaningful advice as to what was actually required, so it's far from certain that these pop ups are a legal requirement anyway. We use them if the client wants them, but otherwise we simply make sure there is a "Cookies and Privacy" link in the footer that interested users can follow. I'm sure one day some jobsworth will tell me I need to join in this charade, but until that happens, no pop ups from me...
Further, the ICO here in the UK refused to provide meaningful advice as to what was actually required, so it's far from certain that these pop ups are a legal requirement anyway. We use them if the client wants them, but otherwise we simply make sure there is a "Cookies and Privacy" link in the footer that interested users can follow. I'm sure one day some jobsworth will tell me I need to join in this charade, but until that happens, no pop ups from me...
It's not only a distraction but outright dangerous. People got used to accept every banner with word "cookie" in it. There were cases in Poland where scammers would add "and I subscribe to X and will pay Y monthly" onto the cookie banners and then send invoices to customers (as long as they could get their address, e.g. when they came via email link).
These annoying messages are a bad attempt to follow a bad law. But to just block these messages in the browser seems like a bad approach. The point is to get informed consent to write+read cookies from the user. One could argue that the act of installing a plug-in for this purpose = implicitly consenting to accepting any and all cookies, but that seems like a weak inference.
Given the law, it would be better to be able to pre-emptively, explicitly blanket-consent to all cookies, or specific types of cookies (e.g. analytics tracking, or saving user settings) in one's browser (or at first, before it's standardised, with a plugin).
Of course, this solution would require web developers to follow certain standards in implementing their cookie-consent-getting method. (It would have been even worse if they tried to legislate this from the outset.)
Given the law, it would be better to be able to pre-emptively, explicitly blanket-consent to all cookies, or specific types of cookies (e.g. analytics tracking, or saving user settings) in one's browser (or at first, before it's standardised, with a plugin).
Of course, this solution would require web developers to follow certain standards in implementing their cookie-consent-getting method. (It would have been even worse if they tried to legislate this from the outset.)
I propose a new "standard" role="bullshit" to the W3C. Developers around the world could use it to mark those bullshit fragments of their pages. Users could filter them with a browser plugin "Bullshit Block".
I would actually love it. If it worked. As it is, all it says is "by using our site you agree to everything" while you already have a ton of cookies from god knows where implanted into your browser.
I just moved to Europe and this started annoying me to no end. Thankfully, this Chrome extension kills them all https://chrome.google.com/webstore/detail/i-dont-care-about-...
WARNING: This website contains cookies known by the State of California to cause cancer, and birth defects or other reproductive harm.
so... has anyone made a chrome plugin to just click all the buttons yet?
We can keep a list of [ webistes -> $('#TheCookieDiv').click ] - commands which we keep on github and shake like homebrew does (`cookieThing update` could be run daily)
We can keep a list of [ webistes -> $('#TheCookieDiv').click ] - commands which we keep on github and shake like homebrew does (`cookieThing update` could be run daily)
On a legal note, I would imagine we could say "By using/downloading the plugin, I opt into all cookies, all the time"
Companies would like this too because they then could keep doing exactly what they are doing (to be complaint), but perhaps we could convince them to add a file to their websites specifically for our tool to look up the DIV. Something like www.site.com/cookieAcceptDiv.txt which would list the clickable region to suppress the pop-up
Companies would like this too because they then could keep doing exactly what they are doing (to be complaint), but perhaps we could convince them to add a file to their websites specifically for our tool to look up the DIV. Something like www.site.com/cookieAcceptDiv.txt which would list the clickable region to suppress the pop-up
There is at least one:
https://chrome.google.com/webstore/detail/peeshkot/idfkeeahc...
I don't recommend using it though. Last time I looked at it it used a very broad heuristic to find the cookie consent buttons. I wouldn't trust it not to click something more important by mistake.
https://chrome.google.com/webstore/detail/peeshkot/idfkeeahc...
I don't recommend using it though. Last time I looked at it it used a very broad heuristic to find the cookie consent buttons. I wouldn't trust it not to click something more important by mistake.
As web developer and user of web sites I feel your pain but for the small web sites it's a matter of better being safe than sorry. Some countries have pretty hefty fines against sites that send cookies without notice.
What's the point of having a pop-up that tells you "this site uses cookies" when tools can tell you exactly that without the webdeveloper's having to make a single modification to the website?
The most annoying part is that blocking first-party cookies (e.g. with µMatrix) causes this message to appear every time since you are not sending your "consent" back to the server.
I wish cookies could be made completely illegal worldwide. You want to track me, use your database should I choose to create a business relationship with your site and login.
Sites can now use server-side cookies, where different sites even share info they glean from you. So they can auto-fill forms because you filled out a similar form on another site. Your browser is no longer complicit in 'cookie storage'.
What can be done about that? Its not unreasonable for vendors to keep and share information. Its not practical to have personal control over what they're doing up there in the cloud.
What can be done about that? Its not unreasonable for vendors to keep and share information. Its not practical to have personal control over what they're doing up there in the cloud.
That too is subject to the EU ePrivacy Directive, so the idea is you're supposed to be able to report someone who does this to your national ombudsman, like the ICO's office in the UK, and they'll fine the offender.
The language in the ePrivacy Directive always talks about tracking terminals (devices.) It's not just about cookies, or browsers. You need the user's consent to track their device, period. (However you don't need consent for e.g. basic cookies that are necessary for a site to function, and which aren't used for tracking.)
The language in the ePrivacy Directive always talks about tracking terminals (devices.) It's not just about cookies, or browsers. You need the user's consent to track their device, period. (However you don't need consent for e.g. basic cookies that are necessary for a site to function, and which aren't used for tracking.)
I'm wondering if 'cloud cookies' are tracking the device, or tracking me. E.g. if I enter my name and address, it fills in the rest from the cloud. Maybe that wriggles through because there's no device tracking.
That doesn't really sound like tracking, though.
How do sites know who is which client without cookies?
It's funny how many sites have that "I agree"-option. Because they still put 15 cookies on my computer before I even agree to it.
I don't understand why websites have these at all. Have anyone ever been fined or anything for lacking one?
Javascript alert API? And not just an X-I-consent-to-your-use-of-cookies HTTP header? Please. :b
This is another example of old corportate red tape getting in the way of progress
New corporate red tape. ;)
...or autoaccept TOS that no one reads or cares about.
I'm in the EU so stupid EU laws apply to me and it is irritating, just forget it EU, no one gives a shit about cookies. ( I obviously talk for everyone in the EU)
[deleted]
dudul(1)
If you are in the UK, please vote to withdraw from the EU. This sort of meddling into every minute detail of our lives is only going to get worse. (See also banning vacuum cleaners and light bulbs). Also checkout cars that aren't powerful enough to go up hills due to trying to meet EU emission laws.
Or making porn opt-in on the internet. Stupid EU. Oh wait.
It's like saying "this website uses HTTP, we do it to get data to and from your browser, click to agree".
Maybe the major web browsers should built a standard warning Javascript alert API in that can be globally turned off.