Ask HN: Why have we accepted the cookie pop-up situation across the web?
342 comments
Well, it's basically malicious compliance. They're supposed to be super annoying because the people which need them do things which have been deemed unacceptable from the legislature. Instead of complying, they choose this obnoxious practice so they could continue with what they've been doing for years, which is monitoring every action a visitor does.
You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking.
A session cookie, selected theme etc is all fine without that banner
You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking.
A session cookie, selected theme etc is all fine without that banner
> Well, it's basically malicious compliance.
Agreed. I can't think of a more widespread and effective campaign by an entire industry to gaslight their customers into hating a regulation more than the invasive practice that is being regulated.
Agreed. I can't think of a more widespread and effective campaign by an entire industry to gaslight their customers into hating a regulation more than the invasive practice that is being regulated.
Exactly. We should attack the core issue here;
tracking is a form of invaison of privacy and should be banned in general.
The core issue is people want free shit.
No, the core issue is that advertisments are not enough for them, they want personal data too.
Giving someone with a website an image that they put up there is simple and requires zero cookies. If your goal is to have people see that banner this is literally all you need to do.
But of course advertisers want targeted ads, they want to get metrics (they don't care how truthful those metrics are, but who cares right?).
Giving someone with a website an image that they put up there is simple and requires zero cookies. If your goal is to have people see that banner this is literally all you need to do.
But of course advertisers want targeted ads, they want to get metrics (they don't care how truthful those metrics are, but who cares right?).
I don't think most websites honestly care about personal data. What most sites want to know is what anonymous users are doing on their sites so they can improve them.
I for one need this data on a daily basis to help me decide how to make products better. I think the legislation doesn't do it's job properly. Why not force it so that like apple, the browser informs the websites that they don't want to be tracked, then it is the websites issue if they are caught tracking. Or all browsers forcibly obscure a users PII.
I for one need this data on a daily basis to help me decide how to make products better. I think the legislation doesn't do it's job properly. Why not force it so that like apple, the browser informs the websites that they don't want to be tracked, then it is the websites issue if they are caught tracking. Or all browsers forcibly obscure a users PII.
I have made a living selling a software product for more than ten years without any behavior tracking at all. I just don't think tracking users is necessary.
Analytics companies that try to sell their analytics will of course tell you that you need analytics, but I just don't think it's true.
The only analytics I need are sales numbers. When they go up, I know I'm on the right track :)
The way I learn about my customers is that I put my email address on every page of my website. And then I read emails that folks send me, and this way I learn way more about my customers than any analytics could tell me, all without invading someones privacy.
(There is one exception: My apps do send crash reports, but they only send stack traces, no user data, and I don't log any identifiable info like IP addresses.)
Analytics companies that try to sell their analytics will of course tell you that you need analytics, but I just don't think it's true.
The only analytics I need are sales numbers. When they go up, I know I'm on the right track :)
The way I learn about my customers is that I put my email address on every page of my website. And then I read emails that folks send me, and this way I learn way more about my customers than any analytics could tell me, all without invading someones privacy.
(There is one exception: My apps do send crash reports, but they only send stack traces, no user data, and I don't log any identifiable info like IP addresses.)
No idea what product you make, but thank you! Yours is a company I would like doing business with.
The advertisers who’s advertisements are shown care. And because they pay more for targeted ads the website cares.
The ad industry believes targeted ads are cheaper and more effective in aggregate than un-targeted ads.
Also if the website is selling PII to “partners” as another revenue stream the the website cares.
The ad industry believes targeted ads are cheaper and more effective in aggregate than un-targeted ads.
Also if the website is selling PII to “partners” as another revenue stream the the website cares.
The ad industry used to target ads by aiming at a publication’s audience or subscriber base. The publication would conduct surveys or do Nielsen rating type measures to get a sense who their audience was.
When publications online went from trying to build an audience to trying to drive traffic we ended up with the situation we have now. They don’t have audiences anymore, they have atomized bits of content without much in the way of editorial voice or culture to tie it together. They care not one whit about making their site a destination, just trying to chum the waters for whatever will bring in a catch of fresh eyeballs.
When publications online went from trying to build an audience to trying to drive traffic we ended up with the situation we have now. They don’t have audiences anymore, they have atomized bits of content without much in the way of editorial voice or culture to tie it together. They care not one whit about making their site a destination, just trying to chum the waters for whatever will bring in a catch of fresh eyeballs.
Exactly. I think even if people were to pay for visiting a website, there would still be ads or tracking because that's too profitable a thing to let go.
Or maybe billions of venture funding created unrealistic growth expectations. This turned otherwise good businesses into data hogs.
Nah. People have always wanted free shit. I once volunteered at an event for fancy people. Occasionally we would put out some moderately cool free shit. I saw a lot people worth millions to hundreds of millions leaping into the scrum for things that they could buy for $50-100.
People wanting free shit is a constant. The problem is how we channel that desire, which is very much in our control.
People wanting free shit is a constant. The problem is how we channel that desire, which is very much in our control.
This "you can't have free stuff" argument I've seen way too many times now is based on a false premise.
You _absolutely_ can have free stuff. I remember the web when it was run by hobbyists, and that's exactly how it worked. What people who use the "no free stuff" argument really mean is that there are those who are on the web to make money, and you can't have their stuff for free.
To that I'd say; take your stuff and go home. Your stuff is exactly what ruined the web in the first place.
You _absolutely_ can have free stuff. I remember the web when it was run by hobbyists, and that's exactly how it worked. What people who use the "no free stuff" argument really mean is that there are those who are on the web to make money, and you can't have their stuff for free.
To that I'd say; take your stuff and go home. Your stuff is exactly what ruined the web in the first place.
That stuff that you've consumed wasn't free, those hobbyists paid for it out of the pocket. Sure, some can afford to do this to this day, but this doesn't scale. Nowadays internet is too populous and expectations are set too high for this to keep working.
Sure, I was one of the ones that paid for it out of my own pocket.
> Nowadays internet is too populous and expectations are set too high for this to keep working.
I agree with you on both counts, and would like to see a return to a niche web that doesn't work for most people.
EDIT:
P.S. I realise how unlikely that is, so it's not something I'd waste energy on. What I do think is worth thinking about though, is how impossible certain companies are making it for the niche web of the early days to even exist in its own little corner.
> Nowadays internet is too populous and expectations are set too high for this to keep working.
I agree with you on both counts, and would like to see a return to a niche web that doesn't work for most people.
EDIT:
P.S. I realise how unlikely that is, so it's not something I'd waste energy on. What I do think is worth thinking about though, is how impossible certain companies are making it for the niche web of the early days to even exist in its own little corner.
> I agree with you on both counts, and would like to see a return to a niche web that doesn't work for most people.
That would be a web without Google, and in fact any search engine at all. Do you really want to go back to 1990 level of functionality?
That would be a web without Google, and in fact any search engine at all. Do you really want to go back to 1990 level of functionality?
A thousand times yes, but again, I know that's not something that's possible.
What I'm objecting to is it not being possible for even the old farts like me who want it. Google and co.'s contributions to things like e-mail and websites have made it more and more unfeasible to self-host and manage these services. It's a bit like how you're _technically_ free to farm your own food, only not really because you can't comply with the regulations surrounding growing crops (no I'm not kidding, Google and gasp).
What I'm objecting to is it not being possible for even the old farts like me who want it. Google and co.'s contributions to things like e-mail and websites have made it more and more unfeasible to self-host and manage these services. It's a bit like how you're _technically_ free to farm your own food, only not really because you can't comply with the regulations surrounding growing crops (no I'm not kidding, Google and gasp).
I think expectations are set too low nowadays.
Man, that's so "unclassy" of those millionaires.
Nothing is free.
So people pay with their privacy, some because they are tricked into it, some because they don't care.
Point is that invaison of privacy is bad and you should not have even an option to trade it for "free shit".
So people pay with their privacy, some because they are tricked into it, some because they don't care.
Point is that invaison of privacy is bad and you should not have even an option to trade it for "free shit".
That is far from certain. I happily pay for Netflix and other services that provide high quality content without ads. Consider reading Jaron Lanier's books or content, there is another way.
And there lies problem. You pay 10 bucks a month to behemoth, but would you pay 1 cent to the site which gives you less value than Netflix? That would be way impractical. So the smaller sites have to turn to ads and tracking to keep the lights on
That's the problem Brave is trying to solve. Micropayments have been a potential niche for cryptocurrencies, it just hasn't taken off (yet), even though there's a lot of crypto related "innovations" (DeFi, NFT's, whatnot).
That's so weird, I don't pay any money to Ycombinator. And yet, no cookie popups!
That's because Hacker News _is_ the ad. It helps promote YCombinator itself, by adding prestige.
But as ads go its really benign. No tracking, no constant in your face reminders, no retargeting etc...
I'm not sure if that was their goal when launching HN, but it definitely helps their brand image now.
We're talking about tracking cookies, not ads.
You're being pedantic. Tracking cookies are, in general, in support of ads.
Which is irrelevant, since the converse does not need to be true - we are talking about tracking cookies.
Postulate 1: This website is free.
Postulate 2: This website does not use tracking cookies.
Theorem 1: Tracking cookies are not required for free websites to exist.
Postulate 3: This website is an ad.
Theorem 2: Ads do not require tracking cookies.
Note that my original comment asserted Theorem 1 only.
Postulate 1: This website is free.
Postulate 2: This website does not use tracking cookies.
Theorem 1: Tracking cookies are not required for free websites to exist.
Postulate 3: This website is an ad.
Theorem 2: Ads do not require tracking cookies.
Note that my original comment asserted Theorem 1 only.
There are many forms of free. One of them is that the free product supports the paid product in some manner which is the case with HN and Y Combinator. Something similar applies with the lightly branded content marketing sites and reports that many companies sponsor. Ad-supported is just one approach, albeit a common one.
It was advertising companies that started this trend of giving shit away for “free”. Before then people were used to paying for services.
> "Before then people were used to paying for services."
… and/or were more often genuinely grateful for things that were given freely and generously …
… and/or were more often genuinely grateful for things that were given freely and generously …
Hah, as a European I feel that way about how sales tax is handled by businesses in the US.
Sounds like the McDonald's character assassination of that woman that got burned
Gotta love American's way of doing business
Gotta love American's way of doing business
[deleted]
Tangentially-related, but it's funny that you should say that, and in as many words.
https://youtu.be/hX2aZUav-54
https://youtu.be/hX2aZUav-54
the us tax system would like a word with you.
What’s a better design for asking for consent?
Don't prompt for consent unless there is a concrete benefit to the particular user you are asking, and in that case make the trade off clear.
In other words, for all these news sites doing it, "just stop".
In other words, for all these news sites doing it, "just stop".
1. Default deny – to begin with.
2. In the event (1) is too much to ask, all website importing our privacy setting from a unified service where we can do our privacy customisation once and for all.
2. In the event (1) is too much to ask, all website importing our privacy setting from a unified service where we can do our privacy customisation once and for all.
Most of the banners swap the confirmation, cancel and allow all buttons. Don’t do this. Most of the banners also swap the direction of the on off toggles so it looks opposite of what action you’re taking. Don’t do this either.
Instead, have a simple modal with confirm and cancel in the proper locations, and just use checkboxes. Have every one deselected to start with as if someone is viewing that modal they’re likely about to disable all of them.
Instead, have a simple modal with confirm and cancel in the proper locations, and just use checkboxes. Have every one deselected to start with as if someone is viewing that modal they’re likely about to disable all of them.
Standardized consent first of all, so I know how to get out of useless modal windows as fast as possible.
I think this is key. The opt out must be as easy as the opt in. The common practice seems to be press "ok" to opt in. Then click on "more information" to opt out. But "more information" takes you to a Byzantine click through maze. If it were legally mandated what the allowed language and also graphic design language for this was then much of the problem would be alleviated.
Take the DNT (do-not-track) request for an answer.
> You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking.
That is a common misunderstanding of the ePrivacy Directive [1][2]. It applies to all cookies (and "similar devices") that are not "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user". And "strictly necessary" is quite a high bar.
(not a lawyer)
[1] https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
[2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... See especially (25).
That is a common misunderstanding of the ePrivacy Directive [1][2]. It applies to all cookies (and "similar devices") that are not "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user". And "strictly necessary" is quite a high bar.
(not a lawyer)
[1] https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...
[2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... See especially (25).
It’s not that high. Here’s an official opinion on some usecases that meet the bar and some that don’t: https://ec.europa.eu/justice/article-29/documentation/opinio...
Generally, it matches my expectations. Shopping carts, sessions, and even most user preferences are fine and don’t need a banner. Worst case a small “uses cookies” text next to a language change button is enough.
Generally, it matches my expectations. Shopping carts, sessions, and even most user preferences are fine and don’t need a banner. Worst case a small “uses cookies” text next to a language change button is enough.
It is still very strict. For example, here is what the document you link has to say about cookie lifetimes for shopping carts:
"A cookie that is exempted from consent should have a lifespan that is in direct relation to the purpose it is used for, and must be set to expire once it is not needed, taking into account the reasonable expectations of the average user or subscriber. This suggests that cookies that match CRITERION A and B will likely be cookies that are set to expire when the browser session ends or even earlier. However, this is not always the case. For example, in the shopping basket scenario presented in the following section, a merchant could set the cookie either to persist past the end of the browser session or for a couple of hours in the future to take into account the fact that the user may accidentally close his browser and could have a reasonable expectation to recover the contents of his shopping basket when he returns to the merchant’s website in the following minutes."
"A cookie that is exempted from consent should have a lifespan that is in direct relation to the purpose it is used for, and must be set to expire once it is not needed, taking into account the reasonable expectations of the average user or subscriber. This suggests that cookies that match CRITERION A and B will likely be cookies that are set to expire when the browser session ends or even earlier. However, this is not always the case. For example, in the shopping basket scenario presented in the following section, a merchant could set the cookie either to persist past the end of the browser session or for a couple of hours in the future to take into account the fact that the user may accidentally close his browser and could have a reasonable expectation to recover the contents of his shopping basket when he returns to the merchant’s website in the following minutes."
So? That's totally what I'd expect from a shopping cart cookie. I don't expect something I put in a cart to be there the next day (I will have bought it somewhere else).
I was using the website for a Dutch big box hardware store (Gamma) today, and it had a door stopper I was looking to purchase half a year ago in my shopping cart. I never finished that transaction. That kind of retention is just pointless.
I was using the website for a Dutch big box hardware store (Gamma) today, and it had a door stopper I was looking to purchase half a year ago in my shopping cart. I never finished that transaction. That kind of retention is just pointless.
> I don't expect something I put in a cart to be there the next day
I do. I use the shopping cart as a staging area sometimes when deciding what to buy. In fact, I don't really see a good reason for a shopping cart ever lose items I put in it until I explicitly remove them or they stop being available, since the whole point of a cart is to express intent to buy.
I do. I use the shopping cart as a staging area sometimes when deciding what to buy. In fact, I don't really see a good reason for a shopping cart ever lose items I put in it until I explicitly remove them or they stop being available, since the whole point of a cart is to express intent to buy.
The whole point of a shopping cart is for items that you are going to buy--not for things you may (or may not) buy tomorrow. It's a shopping cart. Not a bookmarking service. You don't go into a physical grocery store, put things in your shopping basket, leave, and expect them to be there when you walk in the next day.
That is your interpretation of shopping carts in web stores. Other people add things to their cart as they need to replace eg: items in the stationery cupboard, then checkout once a week. Some people use the cart as a form of Wishlist, or a picking list while evaluating similar products.
At the very least if a site doesn’t offer Wishlist, shipping list or other bookmarking facilities I would expect the shipping cart to give me a cookie that lasts at least three days to cover the weekend or the option to create an account to save that shopping list/cart to come back to later.
At the very least if a site doesn’t offer Wishlist, shipping list or other bookmarking facilities I would expect the shipping cart to give me a cookie that lasts at least three days to cover the weekend or the option to create an account to save that shopping list/cart to come back to later.
The metaphor is imperfect. It is a staging area for orders in practice, and people like to be able to use it that way. I often build up a shopping cart on several sites while trying to figure out where is the best place to buy from (especially in cases with a shipping is a large proportion of the overall price) and sometimes this takes me several days.
While I do agree keeping items in the cart for a year is not what users expect, if someone puts something in their cart, closes the browser, and then comes back the next day, I think most e-commerce sites would still list the item. And I think that's generally something users want.
It’s worth noting that you do not need cookies to store shopping cart details if you have a user account system. You can store their cart in a database and associate it with a user account.
A session based cookie can then be used to store your identity in a short term session, and the server can easily gather long-term storage on its own.
I think it’s a fair compromise to say “if you want to save this cart, please log in”, which satisfies opt-in data tracking in a user friendly way. You aren’t mandating a user account, but if you opt in you get something potentially useful.
My principle complaint about most of the discourse on this topic is that it is superficial. There are reasonable workarounds for most user-friendly tracking that allow for tacit opt-in via responsible and clear UX. The “hard parts” seem to generally concern the type of tracking that isn’t so clearly user-friendly, such as behavior tracking and PII collection, which is a conversation we should be having anyways without obfuscating the issue by pretending it’s about the easy stuff.
A session based cookie can then be used to store your identity in a short term session, and the server can easily gather long-term storage on its own.
I think it’s a fair compromise to say “if you want to save this cart, please log in”, which satisfies opt-in data tracking in a user friendly way. You aren’t mandating a user account, but if you opt in you get something potentially useful.
My principle complaint about most of the discourse on this topic is that it is superficial. There are reasonable workarounds for most user-friendly tracking that allow for tacit opt-in via responsible and clear UX. The “hard parts” seem to generally concern the type of tracking that isn’t so clearly user-friendly, such as behavior tracking and PII collection, which is a conversation we should be having anyways without obfuscating the issue by pretending it’s about the easy stuff.
I think just about the only "essential" cookies to ensure functionality would be session cookies. But I would be surprised to learn that the point is to eliminate useful cookies. Shopping cart cookies, when designed so they are not shared with 3rd parties, are benign and should not require an opt-in. That's my opinion on most cookie-based functionality, really. Client-side state is useful for a lot of user-friendly functionality.
For example, remembering things like Dark Mode, pop-up re-sizing, slider locations (volume for example) are all legitimate use cases that I would prefer as a user to be isolated per client.
For example, remembering things like Dark Mode, pop-up re-sizing, slider locations (volume for example) are all legitimate use cases that I would prefer as a user to be isolated per client.
I think that works if the site clearly says that your preference will be stored. On the other hand, if it's just a "dark mode" checkbox or something, my reading of the directive is that isn't enough?
I don't want to have to make accounts on websites just for them to remember what is in my cart for my next visit. I don't like having more accounts, especially if I'm not yet sure if I'm going to buy from them.
Since the site does not know you are leaving, it doesn't have any opportunity to prompt you and ask whether you would like to save your cart (and if it did I would find it pretty annoying)
Since the site does not know you are leaving, it doesn't have any opportunity to prompt you and ask whether you would like to save your cart (and if it did I would find it pretty annoying)
If I go to an e-commerce website and I am not signed in to, add a bunch of stuff to my cart and leave, I have absolutely no expectation the cart will persist until the next day, and I really don’t think you should either. Not only is it in an unreasonable expectation as an end user, but also it sounds like an absolute nightmare for businesses (Do you hold physical inventory for things in the cart? What about price changes or products are discontinued? Etc).
In practice, sellers do deal with this. The most common approach is that putting something in the cart does not reserve it or maintain a fixed price. Then if availability or pricing changes, they flag that to the user when viewing the cart.
Also, you initially asserted that the regulations were strict for any and all cookie usage. The person replying to you provided plenty of evidence to the contrary, and now you’re bringing up incredibly niche edge cases, to what end I’m not sure. I think it would be more productive to just concede that the regulations aren’t as strict as you stated.
Most companies will not be compliant unless they do one of (a) get consent from users or (b) hire a lawyer to review each of the things they do in the context of ePrivacy, and make corresponding changes to keep everything within the bounds of "strictly necessary". I'm bringing up these 'edge cases' as part of showing that most sites would have changes they would need to make if they wanted to stop asking for consent from users, and that these changes are not obvious and go beyond removing tracking.
Often you need only the session cookie. Everything else can go into the database indexed by that cookie. This is especially safe if the user has an account and won't lose the data if the cookie is lost.
Surely if someone has instructed the website to remember a setting, then that cookie was explicitly requested by the user?
Storing something in response to an explicit user request seems fine without additional consent, though you still need to explain to users how the cookies are used to fulfill their request. [1]
On the other hand, there are many things that sites do that are not fully explicit. For example, shopping sites often show you items you have recently viewed to facilitate comparisons, or a news site showing ads might want to make sure they don't show you the same one over and over. That doesn't sound to me like it is strictly necessary for the functioning of the site?
[1] "users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using"
On the other hand, there are many things that sites do that are not fully explicit. For example, shopping sites often show you items you have recently viewed to facilitate comparisons, or a news site showing ads might want to make sure they don't show you the same one over and over. That doesn't sound to me like it is strictly necessary for the functioning of the site?
[1] "users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using"
Couldn't sites wait to ask for cookie permission until the actually user tries to do something that may benefit from a cookie? Like put text and a link with an explanation next to buttons to change the theme or regions which may contain recently viewed items.
Preferably this would use a browser cookie setting. I know you use cookies to store my settings, I don't need you to ask. Please stop asking.
Yes.
I've been wondering about that. I have a simple web app and I'd like to gather some basic statistics about what users do, which pages they visit... Not to spy on people, not to share with anyone else, just to have some insight on how to make the app better. The app is just a toy program people use for fun, you couldn't possibly argue that any stats I'd be collecting could be used maliciously. It seems to be difficult to do that while respecting the GDPR and without some annoying pop-up though?
Technical answer: You can use Differential Privacy[1] to collect such data (“what percentage of users used this feature?”, “What is the distribution of time between visits?”, etc) without collecting any data about individuals. Some projects already do this and there are open source libraries that do the math for you.
However, I don’t think the regulations have an explicit safe harbor along the lines of “You’re fine as long as the math checks out”. Perhaps if it did, we wouldn’t be in such a mess.
(A passive observer that sees a JSON POST wouldn’t know that you’re using differential privacy. It would look like typical telemetry. They’d have to read your code or look at multiple samples and notice that the data looks random)
https://en.m.wikipedia.org/wiki/Differential_privacy
However, I don’t think the regulations have an explicit safe harbor along the lines of “You’re fine as long as the math checks out”. Perhaps if it did, we wouldn’t be in such a mess.
(A passive observer that sees a JSON POST wouldn’t know that you’re using differential privacy. It would look like typical telemetry. They’d have to read your code or look at multiple samples and notice that the data looks random)
https://en.m.wikipedia.org/wiki/Differential_privacy
Do you really need cookies for this or could you also use your server logs for this?
Per default you could not gather statistics but ask inside you app if people are willing to participate in making the app better and if they would agree to accept some cookies for this reason.
Per default you could not gather statistics but ask inside you app if people are willing to participate in making the app better and if they would agree to accept some cookies for this reason.
I don't need cookies for this. However, AFAIK the GDPR doesn't just apply to cookies, it applies to any data retention, or at least anything that could be tied to an IP address or a certain user.
Maybe the key is to have stats that are purely anonymous, eg, how many people visited this page.
Maybe the key is to have stats that are purely anonymous, eg, how many people visited this page.
Right, I focused on cookies here. Yes you could just cut the IP out of the logs and check the visited sites and requested resources.
If you're using server logs, without any cookies or other client-side storage, then the ePrivacy Directive is not relevant and you're thinking about the GDPR. Unlike ePrivacy, the GDPR is specifically concerned with personal data, so if you are careful in how you set up your logs you can generally still collect good analytics on how people use your site without accidentally collecting data on how a specific person uses your site.
(still not a lawyer)
(still not a lawyer)
plausible analytics claims to not need consent as it does not do user level tracking or issue clienside state.
https://plausible.io/
https://plausible.io/
Do you really need to know which pages a particular user visits, or just which pages are visited frequently.
The latter is easily gathered from web server logs, the former sounds like a case of "I want to do this bad thing (spying on users) for good reasons", and the law only cares that it's a bad thing, not about your reasons (or arguably it does care slightly about your reasons, but not in enough detail to accommodate your use case). Laws being rather blunt tools and reasons being rather hard to divine.
The latter is easily gathered from web server logs, the former sounds like a case of "I want to do this bad thing (spying on users) for good reasons", and the law only cares that it's a bad thing, not about your reasons (or arguably it does care slightly about your reasons, but not in enough detail to accommodate your use case). Laws being rather blunt tools and reasons being rather hard to divine.
You might want to know, in aggregate, which paths users take through your site so you can make it better. This requires cookies, and the cookies are not, in my reading, essential for the site to function.
Yes... Agreed on both points.
You can get a bit of that via referrers, but not as much as you would like.
You can get a bit of that via referrers, but not as much as you would like.
Just do it server side, with a unique session token.
How do you assign individual web requests to a session without cookies?
Add a session id to the URL and all generated links, I'd guess. Still probably not any more legit than a cookie, though.
I wouldn't be surprised if that fell under "similar devices", just like localStorage.
generate a random ID in js when your page starts, set it in the context and send it as a header on every request
While might not be caught easily, you‘r still not compliant with GDPR by doing it all on the server without consent.
GDPR only applies to PII. If you're just collecting anonymous session tokens you're fine (it's what comes "out of the box" if you host your webapp on AWS for example, you'll see an AWS correlator ID in the request headers)
Cookie banners predate the GDPR: they were initially for the (much older) ePrivacy Directive, though many sites now have combination consent gathering flows for ePrivacy+GFPR.
For your specific question, I think the Planet49 ruling gets pretty close. "It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual's device." [1]
(still not a lawyer)
[1] https://www.twobirds.com/en/news/articles/2019/global/planet...
For your specific question, I think the Planet49 ruling gets pretty close. "It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual's device." [1]
(still not a lawyer)
[1] https://www.twobirds.com/en/news/articles/2019/global/planet...
Yeah, item 25 is interesting, but the way I read this it's more about the informative links instead of the click-to-allow ones
> strictly necessary in order to provide an information society service explicitly requested by the subscriber or user".
Sounds to me then that login/customizations are allowed
> strictly necessary in order to provide an information society service explicitly requested by the subscriber or user".
Sounds to me then that login/customizations are allowed
I was under the impression that for something like a session token stored in a first-party cookie you don't need consent. The second paragraph refers to both GDPR and ePrivacy directive.
> Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. [1]
> Receive users’ consent before you use any cookies except strictly necessary cookies. [1]
[1] https://gdpr.eu/cookies/
> Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. [1]
> Receive users’ consent before you use any cookies except strictly necessary cookies. [1]
[1] https://gdpr.eu/cookies/
It depends on what you're doing with the session cookie. If it is just for holding shopping cart items or tracking whether you are logged in, I agree with you. But there are many first-party things sites want to do which are probably not "strictly necessary".
This is the correct answer. Nobody needs to ask for cookies that are required for providing the service. They choose to annoy people.
Nobody is thinking about it that hard. Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side because throwing a plugin on that adds it is about a 2 minute job and actually figuring out if they need it requires a lot more work.
Path of least resistance wins.
Path of least resistance wins.
> Half the sites don't need it but they don't know for certain they don't need it, so they stick it in to be on the safe side...
That's a pretty bold claim, even steel-manning it. I personally only ever see it on sketchy sites. If you're right, then it would just take a campaign of education to halve the annoyingness rate of the internet.
That's a pretty bold claim, even steel-manning it. I personally only ever see it on sketchy sites. If you're right, then it would just take a campaign of education to halve the annoyingness rate of the internet.
StackOverflow and the StackExchange sites have one. Not sure how you define “sketchy sites” but the practice is pretty widespread among sites that are regularly linked on HN.
Not sure what you're getting at?
I looked just now on StackOverflow in incognito and saw no obnoxious pop-up.
Agreed. The practice is widespread among sites regularly linked on HN.
I looked just now on StackOverflow in incognito and saw no obnoxious pop-up.
Agreed. The practice is widespread among sites regularly linked on HN.
I get a popup every single time I visit Stackoverflow because I click reject all every time.
Just checked again (not even incognito) and it's there.
Your privacy
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.
Accept all cookies
Customize settings
Just checked again (not even incognito) and it's there.
Your privacy
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.
Accept all cookies
Customize settings
They are the worst of any collection of sites I regularly use. They take up a quarter of the screen, refuse to remember your opt out choices from day to day, regardless of whether you are signed in or not, and don't respect your choice when you go between different StackExchange communities.
OK, so where is this education?
I've read this entire thread and I still don't know when I would need to prompt for cookies, or even if I need to prompt if I store everything serverside and id the visitors with a session token in URLs.
There is no easy-to-understand definitive answer for the common use cases.
I've read this entire thread and I still don't know when I would need to prompt for cookies, or even if I need to prompt if I store everything serverside and id the visitors with a session token in URLs.
There is no easy-to-understand definitive answer for the common use cases.
> I've read this entire thread and I still don't know when I would need to prompt for cookies...
Well that's the problem, right there! You're reading random HN threads to get this information. Why not go to the source?
https://ec.europa.eu/info/law/law-topic/data-protection_en
The law itself is fairly easy to read and understand if you're a software developer.
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
Here is what looks to be pretty respectable commentary on when it triggers. Essentially, if you collect any sort of personal data whatsoever: https://gdpr-info.eu/issues/personal-data/
If you store information that can identify the user, e.g. if you collate a user's IP address, you are almost certainly collecting personal data.
Don't, if you can help it. If you must, that same site has some general guidance on how to collect consent: https://gdpr-info.eu/issues/consent/
Read there more info on how to comply with the data collection. Essentially, if it is personal data, you must give the person informed control over their data, including the ability to withdraw consent at any time, in which case you must delete it.
Well that's the problem, right there! You're reading random HN threads to get this information. Why not go to the source?
https://ec.europa.eu/info/law/law-topic/data-protection_en
The law itself is fairly easy to read and understand if you're a software developer.
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
Here is what looks to be pretty respectable commentary on when it triggers. Essentially, if you collect any sort of personal data whatsoever: https://gdpr-info.eu/issues/personal-data/
If you store information that can identify the user, e.g. if you collate a user's IP address, you are almost certainly collecting personal data.
Don't, if you can help it. If you must, that same site has some general guidance on how to collect consent: https://gdpr-info.eu/issues/consent/
Read there more info on how to comply with the data collection. Essentially, if it is personal data, you must give the person informed control over their data, including the ability to withdraw consent at any time, in which case you must delete it.
$ wc cookie-regs
4198 54871 354380 cookie-regs
Or just put up the cookie notice and not worry.
Dotan, I'm dropping into this thread after all that drama. I'm upset that you were insulted like that. That was unnecessary.
Anyway, if you feel the need to implement a cookie pop-up to feel safe, I get it.
The GDPR is really meant to protect users' rights to control their own data. If you implement that single principle in good faith, there won't be any gotcha moments where the EU cyber police fines you over some obscure clause in 50 thousand words of legalese.
It's really the people who ignore or circumvent that principle who will be crushed.
In my opinion, you will be serving your clients better if you take the time to understand the GDPR rather than annoying your client's users by cargo-culting UX from companies that are skirting or ignoring the law.
If you do want to cargo-cult anyway, you could do worse than to crib from the EU website itself. Just saying.
https://ec.europa.eu/info/law/law-topic/data-protection/data...
Anyway, if you feel the need to implement a cookie pop-up to feel safe, I get it.
The GDPR is really meant to protect users' rights to control their own data. If you implement that single principle in good faith, there won't be any gotcha moments where the EU cyber police fines you over some obscure clause in 50 thousand words of legalese.
It's really the people who ignore or circumvent that principle who will be crushed.
In my opinion, you will be serving your clients better if you take the time to understand the GDPR rather than annoying your client's users by cargo-culting UX from companies that are skirting or ignoring the law.
If you do want to cargo-cult anyway, you could do worse than to crib from the EU website itself. Just saying.
https://ec.europa.eu/info/law/law-topic/data-protection/data...
Thanks, but I don't mind the insult. Quite the opposite, I do think that those who display an inability or unwillingness to learn should be shunned from the profession. I should have invested the time to write a response that clarified my position that legal compliance should be taken liberally, rather than just declaring that I don't understand law.
For what it's worth, I completely agree with the spirit of the GDPR and don't really have an issue with the implementation - it's far better than not having it.
For what it's worth, I completely agree with the spirit of the GDPR and don't really have an issue with the implementation - it's far better than not having it.
>And the terms are subject to possible change and different interpretations as one could get sued in any country?
Do you have examples of this? I mean the different interpretations meaning that one country could sue you for an implementation that was deemed fine in another one.
Do you have examples of this? I mean the different interpretations meaning that one country could sue you for an implementation that was deemed fine in another one.
I do not have examples, my field is software not law. My skill is identifying possible attack vectors, whether or not they've been exploited.
>My skill is identifying possible attack vectors, whether or not they've been exploited.
Ok, but EU legal systems (after Brexit) I think are all Napoleonic systems and not common law, furthermore as the 'cookie law' is a directive and not an actual law and is thus supposed to be imposed the same way across all EU lands I don't think this could be as exploitable as it might otherwise be.
Ok, but EU legal systems (after Brexit) I think are all Napoleonic systems and not common law, furthermore as the 'cookie law' is a directive and not an actual law and is thus supposed to be imposed the same way across all EU lands I don't think this could be as exploitable as it might otherwise be.
> ...Napoleonic systems and not common law, furthermore as the
> the 'cookie law' is a directive and not an actual law...
Of course, I could go get an education in law. Or I could implement the cookie popup.
You are supposed to know what civil law and common law is, this is part of general school education. The same goes for the difference between regulation, directive and national law, in case you are an EU resident.
<https://upload.wikimedia.org/wikipedia/commons/9/92/Map_of_t...>
You don't appear to have the aptitude to educate yourself when you notice that something confuses you or you are ignorant about a topic, c.f. post id=29529880.
<https://upload.wikimedia.org/wikipedia/commons/9/92/Map_of_t...>
You don't appear to have the aptitude to educate yourself when you notice that something confuses you or you are ignorant about a topic, c.f. post id=29529880.
Ireland, Malta and Cyprus are common law jurisdictions.
Ok, thanks, I wasn't aware of that, although I guess I should have thought in the case of Ireland it was so. Still a pretty narrow problem area.
But even so as it's a directive I don't think it is open to interpretation the way a law might be.
But even so as it's a directive I don't think it is open to interpretation the way a law might be.
The cookie notices as implemented are not, in most cases, valid.
> Well, it's basically malicious compliance.
I get what you mean but technically its not compliance, as the law requires a simple yes no option. Definitively malicious though.
I get what you mean but technically its not compliance, as the law requires a simple yes no option. Definitively malicious though.
Unfortunately in Germany that’s not true. Putting anything in someone’s computer without their approval is now considered illegal. Therefore even if you’re just using Matomo stats or anything that isn’t tracking and just functional you need to ask for permission.
That is idiotic and doesn’t solve the issue at hand at all
That is a common misconception in the industry here in Germany but that doesn't make it true. I was often told to add a Cookie Consent banner even for sites that don't use any Cookies at all. Fact is, you don't need a Cookie Consent banner for functional cookies.
The issue with Matomo is that even though nicer than Google Analytics it is optional for the working of the website, so it should only activate if the user consents.
There is some serious cargo culting regarding these kind of laws going on. I remember back in the day that you would add "I don't take responsibility for the external links" kind of disclaimers on every website. Or everyone thinking they need a Impressum (legal info/contact info) page on their website because it is required by law. (No only for commercial sites, which is reasonable.)
The issue with Matomo is that even though nicer than Google Analytics it is optional for the working of the website, so it should only activate if the user consents.
There is some serious cargo culting regarding these kind of laws going on. I remember back in the day that you would add "I don't take responsibility for the external links" kind of disclaimers on every website. Or everyone thinking they need a Impressum (legal info/contact info) page on their website because it is required by law. (No only for commercial sites, which is reasonable.)
I largely agree. An Impressum/Imprint is however not only needed for explicitly commercial sites, but also for sites that are not purely personal. E.g. just earning some cents with an ad banner on your personal site means you need an imprint. There have been lots of lawsuits, it's really ugly, and I totally can understand that people want to be on the safe side.
Yeah it still good style to always provide Imprint.
I just listed it as an example where people don't understand the nuance around an issue. "You better provide some Imprint if you are in doubt" becomes "You are required by law to always have an Imprint"
I just listed it as an example where people don't understand the nuance around an issue. "You better provide some Imprint if you are in doubt" becomes "You are required by law to always have an Imprint"
Even if you don't earn a cent but the website is not only intended for close friends and family...
> Unfortunately in Germany that’s not true.
It is. There is no other law about cookies.
https://curia.europa.eu/juris/document/document.jsf?docid=21...
Part of this case at the german 'Bundesgerichtshof'.
https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilung...
It is. There is no other law about cookies.
This shall not prevent any technical storage or access for the sole purpose
of carrying out the transmission of a communication over an electronic
communications network, or as strictly necessary in order for the provider
of an information society service explicitly requested by the subscriber or
user to provide the service.
https://curia.europa.eu/juris/document/document.jsf?docid=21...
Part of this case at the german 'Bundesgerichtshof'.
https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilung...
There is now Art 25 TTDSG Deals with it. The law Was passes this month
TTDSG is finally a correct implementation of the 2005 ePrivacy directive. § 25 TTDSG literally just rephrases the exact ePrivacy requirements. The pendant to the above quote is § 25 Abs 2 Nr 1:
> Die Einwilligung nach Absatz 1 ist nicht erforderlich, wenn der alleinige Zweck [der Speicherung oder des Zugriffs] die Durchführung der Übertragung einer Nachricht über ein öffentliches Telekommunikationsnetz ist oder wenn [sie] unbedingt erforderlich ist, damit der Anbieter eines Telemediendienstes einen vom Nutzer ausdrücklich gewünschten Telemediendienst zur Verfügung stellen kann.
> Die Einwilligung nach Absatz 1 ist nicht erforderlich, wenn der alleinige Zweck [der Speicherung oder des Zugriffs] die Durchführung der Übertragung einer Nachricht über ein öffentliches Telekommunikationsnetz ist oder wenn [sie] unbedingt erforderlich ist, damit der Anbieter eines Telemediendienstes einen vom Nutzer ausdrücklich gewünschten Telemediendienst zur Verfügung stellen kann.
This shifts the consent down to the the feature:
>vom Nutzer ausdrücklich >gewünschten Telemediendienst >zur Verfügung stellen kann.
Now we have to document that the user wanted the feature that needs the cookie...
>vom Nutzer ausdrücklich >gewünschten Telemediendienst >zur Verfügung stellen kann.
Now we have to document that the user wanted the feature that needs the cookie...
> Putting anything in someone’s computer without their approval is now considered illegal.
Citation needed.
Citation needed.
Agreed that doesn’t make a lot of sense. You need to “put” html, css, images in the visitor’s computer just as much as you do a session cookie. How is one allowed and not the other?
It doesn't make a lot of sense.
Now we have to interpret what was intended with the law.
What about In Browser databases? Or Javascript?
It's much more than just cookies that are stored on computers.
What about In Browser databases? Or Javascript?
It's much more than just cookies that are stored on computers.
Art 25 TTDSG
"The storage of information in the end-user's terminal equipment or the access to information already stored in the terminal equipment shall only be allowed if the end-user has consented on the basis of clear and comprehensive information. The information to the end-user and the consent shall be provided in accordance with Regulation (EU) 2016/679."
"The storage of information in the end-user's terminal equipment or the access to information already stored in the terminal equipment shall only be allowed if the end-user has consented on the basis of clear and comprehensive information. The information to the end-user and the consent shall be provided in accordance with Regulation (EU) 2016/679."
There is a second paragraph to this article that contains exceptions to this.
If it is absolutely necessary for the requested functionality then it is allowed. Therefore it doesn't really change anything.
If it is absolutely necessary for the requested functionality then it is allowed. Therefore it doesn't really change anything.
I bet this will be settled in court
There is like 15 years of official guidance and case law on ePrivacy, with relevant guidance from the Art 29 Working Party (precursor to the current EDPB) published around 2014. But I don't think regulators are in a hurry to get into arguments about the finer points when the ePrivacy Regulation could be passed any year now, which would allow a more nuanced approach to cookies (e.g. allowing legitimate interest instead of consent).
Any year now for the last 4 years.
I don't think the regulators want to got to court over this but noyb will
https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner...
https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner...
Why do you think this would result in a different outcome in Germany?
The language of the new law in Germany is virtually identical to the language of the EU directive. So why would it be different in Germany versus other countries in the EU that also have to implement the directive?
The language of the new law in Germany is virtually identical to the language of the EU directive. So why would it be different in Germany versus other countries in the EU that also have to implement the directive?
Following the German debate the courts and watchdogs interpretation of the law is that strictly necessary means that the functionality is not possible without cookies or other technology and the consent has to be of the same quality as per GDPR.
Privacy law in Germany is usually stricter than in other EU country's even if the text is identical.
Privacy law in Germany is usually stricter than in other EU country's even if the text is identical.
Which is exactly what the EU directive intends.
You are literally just stating the acceptable exceptions from the EU directive.
And the main argument of this thread initially was that you don't need to ask if you are only using cookies for such use cases.
And the main argument of this thread initially was that you don't need to ask if you are only using cookies for such use cases.
I assume from your handle that you understand German (?):
This Podcast explains the topic much better than I could:
Rechtsbelehrung - Recht, Technik & Gesellschaft: TTDSG – Cookies unter Aufsicht – Rechtsbelehrung 102 https://rechtsbelehrung.com/102-ttdsg-cookies/
This Podcast explains the topic much better than I could:
Rechtsbelehrung - Recht, Technik & Gesellschaft: TTDSG – Cookies unter Aufsicht – Rechtsbelehrung 102 https://rechtsbelehrung.com/102-ttdsg-cookies/
Matomo calls its cookies "tracking cookies":
> It’s possible to disable tracking cookies in Matomo by adding a line on the javascript code. When cookies are disabled, Matomo data will become slightly less accurate
So it seems there's no "functional cookies" in Matomo, and so all cookies from Matomo without consent popup is not in compliance. You can disable all Matomo cookies and allow for compliance:
> By disabling tracking cookies, you may also use Matomo without needing to display a cookie consent screen.
> It’s possible to disable tracking cookies in Matomo by adding a line on the javascript code. When cookies are disabled, Matomo data will become slightly less accurate
So it seems there's no "functional cookies" in Matomo, and so all cookies from Matomo without consent popup is not in compliance. You can disable all Matomo cookies and allow for compliance:
> By disabling tracking cookies, you may also use Matomo without needing to display a cookie consent screen.
"Therefore even if you’re just using Matomo stats"
That's not functional though, is it?
I understand entirely the desire to use such a thing, to understand how your site is being used, but it's not functional in a "delivering service to the end user" way.
(Personally I like the way it sounds, analytics without signing over the world to Google, but it's still not functional)
That's not functional though, is it?
I understand entirely the desire to use such a thing, to understand how your site is being used, but it's not functional in a "delivering service to the end user" way.
(Personally I like the way it sounds, analytics without signing over the world to Google, but it's still not functional)
Don't get me wrong, I love self-hosted analytics like Matomo, but there is never a situation where a cookie for any form of analytics is "functional".
What about affiliate systems? Knowing who referred you to the site when you purchase so they can get their cut.
Arguable either way in my opinion, but irrelevent because not analytics
False, since the BGH ruling in the "Planet49" case (judgment dated May 28, 2020 - I ZR 7/16), the following applies: Cookies and comparable technologies may only be used with consent in Germany as well, regardless of the processing of personal data. This is only different if the cookies are "absolutely necessary" for the technical provision of the respective service or they serve solely to transmit a message via a public telecommunications network.
So technically necessary cookies still don't need consent.
So technically necessary cookies still don't need consent.
When you load a webpage you're putting images, text, and other files "in someone's computer."
I don't think it's as simple as that.
I don't think it's as simple as that.
That sounds nonsensical, when people visit your website they run your code using their CPUs and electricity. You also get their attention and may even influence their heart rates and breathing patterns.
> Putting anything in someone’s computer without their approval is now considered illegal
Selling Windows by default with every computer is now illegal in Germany then?
Selling Windows by default with every computer is now illegal in Germany then?
I wish it was, but no, selling a computer system with Windows installed is consensual, either by explicit customer request or by the customer agreeing to a sale offer as advertised.
No one gets tricked into approval (here: buying) because every customer is able to request a different or no OS, or to reject an immutable sale offer; except if you think that not knowing what an operating system is and what it implies constitutes a trick, but that does not meet the legal definition.
No one gets tricked into approval (here: buying) because every customer is able to request a different or no OS, or to reject an immutable sale offer; except if you think that not knowing what an operating system is and what it implies constitutes a trick, but that does not meet the legal definition.
Not malice, just lazy ass covering. It's easier to throw up a cookie banner and not get fined rather than reading laws and changing business practices instead and potentially get fined.
Also lawyers are expensive and many of them will just tell you to add a cookie banner to your site. They're also lazy and just trying to cover their asses too.
Also lawyers are expensive and many of them will just tell you to add a cookie banner to your site. They're also lazy and just trying to cover their asses too.
This could have easily been a requirement for web browsers.
Imagine if instead of the obnoxious cookie banner, browsers ship with a default “don’t accept cookies” or “don’t accept 3rd party cookies” setting. When a website needs to establish a session, the browser would prompt the user, “this website uses cookies to track…”
If the user gets annoyed with that setting, they could change the default to let any website use cookies.
It’s really obnoxious how this issues was pushed into website operators and not browsers.
Imagine if instead of the obnoxious cookie banner, browsers ship with a default “don’t accept cookies” or “don’t accept 3rd party cookies” setting. When a website needs to establish a session, the browser would prompt the user, “this website uses cookies to track…”
If the user gets annoyed with that setting, they could change the default to let any website use cookies.
It’s really obnoxious how this issues was pushed into website operators and not browsers.
"we value your privacy" I am offended every time I read that.
Most if not all legislation comes with unintended consequences, if it has any consequences at all. Usually they are entirely predictable. Then, when people adapt their behavior to stay out of trouble by doing objectionable but legal things, we don't blame the careless legislators, we blame those we knew or should have known would respond this way to the legislation as it was written.
And so it marches on - most legislation ends up making things worse instead of better, and there is no accountability because we blame the wrong people for it.
And so it marches on - most legislation ends up making things worse instead of better, and there is no accountability because we blame the wrong people for it.
Exactly.
My favorite example are sites which require you to opt out of hundreds of third party processors individually (advertising partners who may receive data). That's as dark a pattern as it gets.
It's also in clear violation of how opt-out is actually supposed to work, at least in the EU.
And with the Do Not Track header, I shouldn't even have to opt out in the first place. A GDPR decision to that effect could solve this banner madness once and for all.
My favorite example are sites which require you to opt out of hundreds of third party processors individually (advertising partners who may receive data). That's as dark a pattern as it gets.
It's also in clear violation of how opt-out is actually supposed to work, at least in the EU.
And with the Do Not Track header, I shouldn't even have to opt out in the first place. A GDPR decision to that effect could solve this banner madness once and for all.
I don't remember the exact timeline but MS decision to enable DNT header by default was basically a poison pill for the entire concept before it had a chance. It would have failed one way or another though. Adtech industry doesn't give up that easily.
That's the argument I've heard from the ad industry, but I don't really buy it. Previously, the DNT header was missing by default, so it's presence could be seen as user intent to forbid tracked, while its absence is ambiguous. Afterwards, the DNT header was present by default, so its absence could be seen as user intent to allow tracking, while its presence is ambiguous. That's exactly what should be the case should be, where only explicit consent to be tracked counts.
Safari/Chrome/Firefox enable by default some ad-blocking today, just like they disable popups or screen for phishing sites.
The whole "users didn't opt in" thing was a false narrative manufactured by the ad industry. You don't need to ask a customer to disable bad behaviors without asking.
The whole "users didn't opt in" thing was a false narrative manufactured by the ad industry. You don't need to ask a customer to disable bad behaviors without asking.
Or in others word, opt-in is not an option for the ad industry.
Do Not Track was a joke from the word go.
"Let's ask these bad actors to play nice, I'm sure they'll respect that, I mean, they probably think we all want to be tracked so let's just tell them we don't and it'll all be fixed. And make sure the option isn't obvious enough that normal people start to use it and ruin the whole thing".
"Let's ask these bad actors to play nice, I'm sure they'll respect that, I mean, they probably think we all want to be tracked so let's just tell them we don't and it'll all be fixed. And make sure the option isn't obvious enough that normal people start to use it and ruin the whole thing".
> And with the Do Not Track header, I shouldn't even have to opt out in the first place. A GDPR decision to that effect could solve this banner madness once and for all.
Enforced DNT is part of the ePrivacy Regulation, which was supposed to launch alongside GDPR, but got delayed. Expect it to arrive somewhat soon.
https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r...
Enforced DNT is part of the ePrivacy Regulation, which was supposed to launch alongside GDPR, but got delayed. Expect it to arrive somewhat soon.
https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r...
IIRC, DNT header was such a failure that not even Firefox has it anymore: I think it's an abandoned feature.
No, Firefox still has it
Thanks for the correction!
At the very least, I've stopped setting it since no website respects it.
At the very least, I've stopped setting it since no website respects it.
With DNT on, Medium actually behaves differently! When viewing an article with embeds (like an iframed YT video), each embed is replaced with a small privacy warning, then clicking it loads the embed.
> choose this obnoxious practice so they could continue with what they've been doing for years, which is monitoring every action a visitor does.
You're right, but I'd like to mention that, in pretty much every jurisdiction with laws like this, you cannot set or retrieve information from a user's computer without getting their consent first. Which means that accessing cookies on page load, then showing a consent banner, is no more protection then just not having a consent banner. I would always tell clients this, and even send them the relevant wording, but I don't believe it ever made the tiniest bit of difference because, as you say, they just want to keep tracking users.
You're right, but I'd like to mention that, in pretty much every jurisdiction with laws like this, you cannot set or retrieve information from a user's computer without getting their consent first. Which means that accessing cookies on page load, then showing a consent banner, is no more protection then just not having a consent banner. I would always tell clients this, and even send them the relevant wording, but I don't believe it ever made the tiniest bit of difference because, as you say, they just want to keep tracking users.
The consent data collected by the cookie preference pane may not be GDPR compliant. IAB who created the TCF protocol appears to be losing the battle. https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach...
I'm not a lawyer, but I bet those buttons are legally binding.
Clicking "I accept" means you can't sue a website if they have your data.
I'm not sure but I don't see why those websites would annoy users.
Clicking "I accept" means you can't sue a website if they have your data.
I'm not sure but I don't see why those websites would annoy users.
> You don't need a cookie banner to be allowed to create Cookies. You only need them if...
You don't need a "banner." The requirement, as I understand it, is to be conspicuous. Conspicuous just means visible, easy to notice. Contrary to the industry's apparent position, conspicuous and obnoxious are not synonyms.
You don't need a "banner." The requirement, as I understand it, is to be conspicuous. Conspicuous just means visible, easy to notice. Contrary to the industry's apparent position, conspicuous and obnoxious are not synonyms.
There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it.
Trying to regulate the option for cookie preferences at the individual site level was always a stupid idea. The average person visits thousands of websites every year. Of course nobody is going to take the time to do that.
If the lawmakers in the EU were intelligent, they would have created a law that forced all web browsers to provide "X" privacy setting features for EU-domiciled users (where X is what they were aiming to achieve).
In addition to not burdening the entire world with time wasting popups all day, this option would have also had the bonus of not burdening millions of small businesses around the globe with complex regulation and legal liability.
Not to mention the total lack of enforceability of the current law when it comes to websites operated outside of the EU.
If done at the browser-level you really only have to police <10 companies.
Trying to regulate the option for cookie preferences at the individual site level was always a stupid idea. The average person visits thousands of websites every year. Of course nobody is going to take the time to do that.
If the lawmakers in the EU were intelligent, they would have created a law that forced all web browsers to provide "X" privacy setting features for EU-domiciled users (where X is what they were aiming to achieve).
In addition to not burdening the entire world with time wasting popups all day, this option would have also had the bonus of not burdening millions of small businesses around the globe with complex regulation and legal liability.
Not to mention the total lack of enforceability of the current law when it comes to websites operated outside of the EU.
If done at the browser-level you really only have to police <10 companies.
I totally agree that this should be a browser setting.
However it’s not only about cookies: What we abusively call the cookie law and cookie popups are about tracking, and there are many ways to track you without cookies, some of which are not easily blocked by browsers.
Ideally the browsers would indicate the user’s preference via a headers (e.g. the DNT header) and websites would be constrained by law to obey that.
However it’s not only about cookies: What we abusively call the cookie law and cookie popups are about tracking, and there are many ways to track you without cookies, some of which are not easily blocked by browsers.
Ideally the browsers would indicate the user’s preference via a headers (e.g. the DNT header) and websites would be constrained by law to obey that.
Sites could provide a cookies-manifest.json with the entities they provide data to. Then the browser could show a standardized cookie banner, if needed. The user could also disable the cookie banner completely, if they so desire.
> There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it.
This. I've always had 3rd party cookies disabled at the browser level, and never noticed any website breaking. The "solution" by the EU has been terrible, and everyone just clicks "accept all".
This. I've always had 3rd party cookies disabled at the browser level, and never noticed any website breaking. The "solution" by the EU has been terrible, and everyone just clicks "accept all".
3rd party cookies are orthoganal to tracking. There are tracking methods that don't need them, or need any cookie.
> If the lawmakers in the EU were intelligent
If bureaucrats helping create these laws were less out of touch. I think they are reasonably intelligent, they just don't know anything about technology. The criteria for selecting them is outdated.
If bureaucrats helping create these laws were less out of touch. I think they are reasonably intelligent, they just don't know anything about technology. The criteria for selecting them is outdated.
Honestly this legend needs to die.
I've worked as a consultant for the EU Parliament and they are a lot more knowledgeable than you think and for things they are not, they hire consultants (like me)
There are a number of people directly elected in EU Parliament that have a background in technology, I personally know a couple or computer scientists, with lots of publications in their curricula.
Problem is the law cannot be written the way you are arguing about, that could be in the form of a directive not as a regulation[1], the regulation must be general enough and cannot address issues that have different legal bindings in the 24 EU countries.
[1] A "Regulation" is defined as a binding legislative act. It is immediately applicable in its entirety in all Member States and it overrules national laws. A "Directive" is a legislative act setting objectives that all EU countries must reach and translate into their national legislation within a defined time frame.
I've worked as a consultant for the EU Parliament and they are a lot more knowledgeable than you think and for things they are not, they hire consultants (like me)
There are a number of people directly elected in EU Parliament that have a background in technology, I personally know a couple or computer scientists, with lots of publications in their curricula.
Problem is the law cannot be written the way you are arguing about, that could be in the form of a directive not as a regulation[1], the regulation must be general enough and cannot address issues that have different legal bindings in the 24 EU countries.
[1] A "Regulation" is defined as a binding legislative act. It is immediately applicable in its entirety in all Member States and it overrules national laws. A "Directive" is a legislative act setting objectives that all EU countries must reach and translate into their national legislation within a defined time frame.
So if the law couldn't be written in a rational way without creating bizarre outcomes, then why create it at all?
When you create legislation, you're implicitly saying; "these rules we're writing down are important enough to enforce with the full monopoly on violence given the powers of government." The cookie popups seem extremely silly in that context.
I don't doubt you've run across some well-intentioned people. But as the saying goes, the road to hell is paved with good intentions.
Seeing a structurally dysfunctional system from the inside, and being able to empathize with the individuals in it, does not make the design of the system any less dysfunctional.
When you create legislation, you're implicitly saying; "these rules we're writing down are important enough to enforce with the full monopoly on violence given the powers of government." The cookie popups seem extremely silly in that context.
I don't doubt you've run across some well-intentioned people. But as the saying goes, the road to hell is paved with good intentions.
Seeing a structurally dysfunctional system from the inside, and being able to empathize with the individuals in it, does not make the design of the system any less dysfunctional.
Cookie popups are bad, but they're pretty similar to a no smoking or no parking sign. In this case, it's the reverse. The whole internet bans cookies, but it informs you that you're entering a cookie zone.
These companies may think they're protesting the cookie law with popups but it's achieved what I expected it to achieve. It's given me fair warning that the site intends to track and monetize me, so I can walk away if I don't think it's worth it. And it adds a higher cost to it too.
These companies may think they're protesting the cookie law with popups but it's achieved what I expected it to achieve. It's given me fair warning that the site intends to track and monetize me, so I can walk away if I don't think it's worth it. And it adds a higher cost to it too.
> So if the law couldn't be written in a rational way without creating bizarre outcomes, then why create it all?
Nobody said that, I don't know why you're saying it, because it also makes no sense.
Do you also believe that we shouldn't have made murder illegal because murderer still exist?
There are always gonna be bizzare outcomes, pop-ups only speak about how lousy advertisers and tracking freaks are, but there have been certainly more bizzare outcomes, think about people refusing vaccines...
Compared to that pop-ups are just an annoyance that we can avoid by punishing the perpetrators directly not visiting their websites.
> But as the saying goes, the road to hell is paved with good intentions
it's all simple, until you have to convince hundreds of politicians to agree on a law that's gonna be enforced on 450 million people from 27 different countries, with 27 different legal systems.
Nobody said that, I don't know why you're saying it, because it also makes no sense.
Do you also believe that we shouldn't have made murder illegal because murderer still exist?
There are always gonna be bizzare outcomes, pop-ups only speak about how lousy advertisers and tracking freaks are, but there have been certainly more bizzare outcomes, think about people refusing vaccines...
Compared to that pop-ups are just an annoyance that we can avoid by punishing the perpetrators directly not visiting their websites.
> But as the saying goes, the road to hell is paved with good intentions
it's all simple, until you have to convince hundreds of politicians to agree on a law that's gonna be enforced on 450 million people from 27 different countries, with 27 different legal systems.
Especially because many people that consider themseleves tech savy are more out of touch, e.g., thinking the privacy aspects could be solved through local cookie policies only, or that it would be a suitable solution to solve even just the cookie aspect in a nuanced, non-techie friendly manner.
Cookie consent should be the responsibility of user-agent cookie policy. And virtually all of the consent banners I've seen are about cookies. And I certainly think it has a better shot of being comprehensible by users in general than having a separate UI for consent for every site. Especially when it's in those sites' interest to confuse or annoy users into allowing the cookies.
In this thread I had the impression that the discussion widened to more than just cookie-banners, more general privacy on the web.
One of the problems I have with the pure-local approach is that I want certain cookies (or certain cookie functionality) of sites but not others. Some functionality I want and some I don't want can be implemented with the same cookie.
I think I would need tagged cookies (so I can disallow those that are used for things I don't want) as well as an assurance to not use the other cookies in the "wrong" ways.
That's why I think purely local cookie management is severly lacking and not suitable to tackle the problem in a user-friendly and nuanced manner - beyond an all-or-nothing approach.
I personally do not think a browser level approach can enforce the privacy goals without cooperation of (and therefore enforcement against the companies providing) the serverside implementation.
That, of course, does not mean that a browser level setting that has to be honored by the server side and can be transfered between sites would not be preferable to clicklists and banners.
One of the problems I have with the pure-local approach is that I want certain cookies (or certain cookie functionality) of sites but not others. Some functionality I want and some I don't want can be implemented with the same cookie.
I think I would need tagged cookies (so I can disallow those that are used for things I don't want) as well as an assurance to not use the other cookies in the "wrong" ways.
That's why I think purely local cookie management is severly lacking and not suitable to tackle the problem in a user-friendly and nuanced manner - beyond an all-or-nothing approach.
I personally do not think a browser level approach can enforce the privacy goals without cooperation of (and therefore enforcement against the companies providing) the serverside implementation.
That, of course, does not mean that a browser level setting that has to be honored by the server side and can be transfered between sites would not be preferable to clicklists and banners.
Haha. Exactly. I just commented above that the better way to have written the regulation was to say, “Thou shalt honor Do Not Track.”
>There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it
GDPR is not only about browsers , it applies outside our web dev bubble. Then if the law was is only about cookie some "smart" webdev would use localStorage , if then we add localStorage then some other dev (probably working on Google Chrome) would create something new... so maybe those EU politicians and consultants are a bit smarter then you(no offense, maybe you are a smart person but either you are having the wrong perspective or you did not really thought more then 5 seconds about the problem).
GDPR is not only about browsers , it applies outside our web dev bubble. Then if the law was is only about cookie some "smart" webdev would use localStorage , if then we add localStorage then some other dev (probably working on Google Chrome) would create something new... so maybe those EU politicians and consultants are a bit smarter then you(no offense, maybe you are a smart person but either you are having the wrong perspective or you did not really thought more then 5 seconds about the problem).
Sorry, you’re mistaken.
Cookie popups weren’t the result of GDPR.
They were the result of the earlier “ePrivacy” directive from 2002 and revised in 2009.
Many people confuse these two pieces of legislation, but cookie popups were already an endemic problem long before GDPR.
Cookie popups weren’t the result of GDPR.
They were the result of the earlier “ePrivacy” directive from 2002 and revised in 2009.
Many people confuse these two pieces of legislation, but cookie popups were already an endemic problem long before GDPR.
I know that, my point still relevant because it was related to:
>There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it.
This is really not a solution, browser already had a black and white option to allow cookies or not, or allow JS or not. The proposed idea is to give only 1 place where you can accept or not accept tracking, then you want to really read a website or your work/bank forces you to read a page and you have no choice then allow cookies for everything and accept all possible tracking because some HN web dev did thinks is mmuch smarter then a group of consultants. lawers and privacy advocates.
If tracking is legal then Allow/Disallow tracking should be per website and always should be 100% transparency on what is tracked and shared with, Tech people could create browser APIs for example, you could have a in browser cookie popup where web devs could populate the text message about "We care about privacy" , an array where web devs can populate with the names, links and terms of use for the 100+ partners. Then all websites will share same native popup, and implement it correctly with no dark patterns, there could be a 3 line extension to click allow or not allow for people that really want to accept or not accept. But this browser APIs won't happen because Google controls the web , Mozilla is on it's last breath and Safari is still screwing around with missing JS and Webgl features and other bullshit.
Edit: Also a simple law as propsed with "make cookies a setting for all websites per browser) is not good since you can use the localstorage,fingerprinting or other tricks to go around the law, so proposed idea is bad.
>There already is a better solution and always has been, it's called setting cookie preferences at the browser level and then leaving it.
This is really not a solution, browser already had a black and white option to allow cookies or not, or allow JS or not. The proposed idea is to give only 1 place where you can accept or not accept tracking, then you want to really read a website or your work/bank forces you to read a page and you have no choice then allow cookies for everything and accept all possible tracking because some HN web dev did thinks is mmuch smarter then a group of consultants. lawers and privacy advocates.
If tracking is legal then Allow/Disallow tracking should be per website and always should be 100% transparency on what is tracked and shared with, Tech people could create browser APIs for example, you could have a in browser cookie popup where web devs could populate the text message about "We care about privacy" , an array where web devs can populate with the names, links and terms of use for the 100+ partners. Then all websites will share same native popup, and implement it correctly with no dark patterns, there could be a 3 line extension to click allow or not allow for people that really want to accept or not accept. But this browser APIs won't happen because Google controls the web , Mozilla is on it's last breath and Safari is still screwing around with missing JS and Webgl features and other bullshit.
Edit: Also a simple law as propsed with "make cookies a setting for all websites per browser) is not good since you can use the localstorage,fingerprinting or other tricks to go around the law, so proposed idea is bad.
That true, but simion314 is still right that the law doesn't specifically target browsers.
The question is how would you regulate browsers? I would personally hate any regulation that government would try to do for software, because we know that the next thing they would do is ban encryption. No browser/IETF member would voluntarily do this for sure, not even firefox.
Firefox, safari, etc. already have pretty advanced anti-tracking and privacy features in place.
If you care about that sort of thing, you use those browsers and automatically make all cookie popups irrelevant. After that they simply turn into pure annoyances.
And no regulation was needed at all, since the free market has already satisfied those customer wants and found the optimal solution for all parties.
Legislation should be the absolute last resort to a problem that has proved otherwise unsolvable. This was not one of those problems.
If you care about that sort of thing, you use those browsers and automatically make all cookie popups irrelevant. After that they simply turn into pure annoyances.
And no regulation was needed at all, since the free market has already satisfied those customer wants and found the optimal solution for all parties.
Legislation should be the absolute last resort to a problem that has proved otherwise unsolvable. This was not one of those problems.
I agree with what you said, but I was wondering about a little detail you mentioned:
> The average person visits thousands of websites every year.
Is this true? Is there any data that would back this? A commonly used argument comes to my mind, that for most internet users the internet is about a handful sites...
> The average person visits thousands of websites every year.
Is this true? Is there any data that would back this? A commonly used argument comes to my mind, that for most internet users the internet is about a handful sites...
But you can't create an industry selling faux-compliance with only 10 companies!
In Finland, the law implementing the GDPR used to be interpreted so that browser settings were enough to opt out of cookies and you just had to inform the user about what cookies you were setting. This interpretation was suggested by Traficom (the government office in charge of traffic and telecommunications). Some individual complained to the Helsinki Administrative Court, which issued rulings (H1515/2021 and H1516/2021) stating that this interpretation is incorrect - as far as I understand, this is because browser settings cannot differentiate between necessary and optional cookies. The new Traficom advice requires the same annoying pop-ups as everywhere else in the EU.
But I agree it shouldn't technically be too hard to standardize the settings so that your browser could communicate to each site what the user consents to. The hard part is enforcing compliance - we already had Do Not Track, which had very little effect.
But I agree it shouldn't technically be too hard to standardize the settings so that your browser could communicate to each site what the user consents to. The hard part is enforcing compliance - we already had Do Not Track, which had very little effect.
Laws that require software companies to implement a user choice should really contain some wording against dark patterns. EU lawmakers could have been warned: A similar thing happened back when Microsoft was forced to give users in the EU a choice of browsers, when they created the most confusing dialog possible and hoped that users would just click OK to Internet Explorer out of desperation.
For me personally, when those data protection laws where implemented, seeing the extent of the market for user tracking was a shock to me. The respect that I lost for actually quite a lot of companies as a consequence has informed some purchasing decisions. And I don’t think anybody would mind those banners if the opt-out option you want to click is reachable with a single, easily visible button.
Edit: Responses suggest that the GDPR already contains something to that effect. Glad to know. If that’s true, then I guess it’s time for court cases to sort this out.
For me personally, when those data protection laws where implemented, seeing the extent of the market for user tracking was a shock to me. The respect that I lost for actually quite a lot of companies as a consequence has informed some purchasing decisions. And I don’t think anybody would mind those banners if the opt-out option you want to click is reachable with a single, easily visible button.
Edit: Responses suggest that the GDPR already contains something to that effect. Glad to know. If that’s true, then I guess it’s time for court cases to sort this out.
By law, users must be given a clear yes/no option, companies just ignore that.
Support noyb if you want to improve the situation: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
There's a reason why facebook/meta/whatever calls Max Schrems "The Devil" internally, at least the Ireland division.
Support noyb if you want to improve the situation: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
There's a reason why facebook/meta/whatever calls Max Schrems "The Devil" internally, at least the Ireland division.
This. noyb.eu is doing an incredible work. I was hoping to see a link to their GDRP/cookie page in the comments. Thank you.
> Laws that require software companies to implement a user choice should really contain some wording against dark patterns
They do.
GDPR explicitly requires
- that denying is easier than accept
- that all choices are denied by default
- that there has to be a single "no" button, but individual "yes" buttons for every single choice
Just everyone breaks the law.
They do.
GDPR explicitly requires
- that denying is easier than accept
- that all choices are denied by default
- that there has to be a single "no" button, but individual "yes" buttons for every single choice
Just everyone breaks the law.
To add to that, we have the effect that some large $megacorps used these dark patterns in the beginning to see if they can get away with it and others unknowingly just copy it. I work as a webdev contractor and very often get requests by customers to implement the same (illegal) tracking popup, thinking they would be lawful as it is identical to what $megacorp uses.
> - that denying is easier than accept
> - that there has to be a single "no" button, but individual "yes" buttons for every single choice
GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners.
> but individual "yes" buttons for every single choice
This is misleading at best - there can be an "Accept All" Button.
> - that there has to be a single "no" button, but individual "yes" buttons for every single choice
GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners.
> but individual "yes" buttons for every single choice
This is misleading at best - there can be an "Accept All" Button.
You wrote:
> GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners.
No. https://gdpr-info.eu/recitals/no-32/ says:
> When the processing has multiple purposes, consent should be given for all of them
You wrote:
> This is misleading at best - there can be an "Accept All" Button.
No. https://gdpr-info.eu/recitals/no-32/ says:
> Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
The legal text of the GDPR explicitly bans pre-ticked boxes for types of consent. You have to manually tick each box individually.
> GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners.
No. https://gdpr-info.eu/recitals/no-32/ says:
> When the processing has multiple purposes, consent should be given for all of them
You wrote:
> This is misleading at best - there can be an "Accept All" Button.
No. https://gdpr-info.eu/recitals/no-32/ says:
> Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
The legal text of the GDPR explicitly bans pre-ticked boxes for types of consent. You have to manually tick each box individually.
> should really contain some wording against dark patterns
Something like: "Default option must be 'no tracking cookies'"?
Software companies would find a way to complicate things.
They should just make the tracking forbidden in general.
They should just make the tracking forbidden in general.
They should have just said, honor the “Do Not Track” signal from the browser.
This is all it should have ever been. People say don't blame the cookie law but no, indeed, the architects of the cookie law are to blame. When you have crafted a bad law with poor enforcement, it looks like the consent nightmare we live with today.
Click yes or no? I don't want to waste a click more than once to say no everywhere. The pain and fallout of these rules and regulations is squarely on Schrems and others who have "pioneered" these awful laws.
Click yes or no? I don't want to waste a click more than once to say no everywhere. The pain and fallout of these rules and regulations is squarely on Schrems and others who have "pioneered" these awful laws.
I haven't accepted it. Out of all the websites i've designed over the years, exactly 0 have cookies for visitors. When there is login for members, then there is a cookie which is not used for tracking (but rather for providing the service the member asked for) and therefore legally does not require a consent banner.
Would that I could give you more than an upvote. Are these your personal or business sites, or for employers and clients? If the latter, how do you combat the hunger for analytics that drive non-users into users?
It's not all personal, but it's all unrelated to business. As an anarchist, I refuse to work on projects i find unethical, which includes any form of profit-driven project. Sorry i can't give you pointers on how to hack around capitalism, my only solution is pure abolition :-)
I should note that i'm also not a professional hacker. Programming/sysadmin is more of a passion than a trade to me, and i'm just a lowly amateur unworthy of much praise.
But to be fair, there's amazing non-profits and worker cooperatives building cool software (Framasoft comes to mind). If only more fellow hackers stopped working for evil bosses and started to work for public interest...
I should note that i'm also not a professional hacker. Programming/sysadmin is more of a passion than a trade to me, and i'm just a lowly amateur unworthy of much praise.
But to be fair, there's amazing non-profits and worker cooperatives building cool software (Framasoft comes to mind). If only more fellow hackers stopped working for evil bosses and started to work for public interest...
How does one find out more about this scene, and more importantly does it actually provide you with enough income to live on? (Rent is expensive in cities)
There's not exactly a centralized directory of cool tech coops, but there's a few places that list some or where they hang out. [1] There's also a fair bunch of coop orientation in the XMPP/ActivityPub ecosystems.
Some projects are driven by direct donations, some others via grants (all NLNet-supported projects) and business partnerships (Blender foundation), some provide paid services to fund R&D (SourceHut).
Overall, it's technically possible to derive a decent income from such schemes, but that's not exactly widespread. Many dedicated hackers will work for minimum wage or less, but some will arrange either:
- to reduce their expenses, by moving to cheaper places [2] or living in shared flats or communities; if you're organized as a collective even food and furniture can have close-to-zero cost [3]
- or to have a high-wage part-time job on the side, or support contracts to pay the bills; if you get half-time to work on your pet projects, that's already quite an achievement
Overall, building a cooperative economy asks the question of where does the money go? The more autonomy we can achieve, and the more money we can "recycle" into other cooperatives, the less of our resources leak into the pockets of the 1%.
So yes, if you make a really cool project people appreciate and/or can depend on for their business, you can sure make a living out of it: just be sure to use copyleft licenses (eg. aGPLv3) so you're not scammed out of your work by big businesses. But personally, i'm more interested in non-profits driving R&D with a vision (like Framasoft does with the Degooglize Internet campaign and eg. Peertube/Mobilizon project).
[1] for example libreho.st, chatons.org (french-speaking) for hosting coops
[2] for example in France, if you don't insist on living in the big cities, you can find places to rent for close to free once you subtract housing support from the rent ; i guess the same is true in many places
[3] skipping unsold food from (super)markets or growing food in the backyard; we could also mention utility hacking for free electricity/water but i can't say most devs i know do that
Some projects are driven by direct donations, some others via grants (all NLNet-supported projects) and business partnerships (Blender foundation), some provide paid services to fund R&D (SourceHut).
Overall, it's technically possible to derive a decent income from such schemes, but that's not exactly widespread. Many dedicated hackers will work for minimum wage or less, but some will arrange either:
- to reduce their expenses, by moving to cheaper places [2] or living in shared flats or communities; if you're organized as a collective even food and furniture can have close-to-zero cost [3]
- or to have a high-wage part-time job on the side, or support contracts to pay the bills; if you get half-time to work on your pet projects, that's already quite an achievement
Overall, building a cooperative economy asks the question of where does the money go? The more autonomy we can achieve, and the more money we can "recycle" into other cooperatives, the less of our resources leak into the pockets of the 1%.
So yes, if you make a really cool project people appreciate and/or can depend on for their business, you can sure make a living out of it: just be sure to use copyleft licenses (eg. aGPLv3) so you're not scammed out of your work by big businesses. But personally, i'm more interested in non-profits driving R&D with a vision (like Framasoft does with the Degooglize Internet campaign and eg. Peertube/Mobilizon project).
[1] for example libreho.st, chatons.org (french-speaking) for hosting coops
[2] for example in France, if you don't insist on living in the big cities, you can find places to rent for close to free once you subtract housing support from the rent ; i guess the same is true in many places
[3] skipping unsold food from (super)markets or growing food in the backyard; we could also mention utility hacking for free electricity/water but i can't say most devs i know do that
Thanks for this. Didn't know about the 'tech co-op' scene, so appreciate the detailed info!
Hmmm...so you are an anarchist (so don't want government) but also think profit seeking is unethical?
I'm genuinely curious what mechanism you would like society to function under? Like why would people...do stuff if not for value in exchange?
Honestly the only thing I came up with is basically if you forcibly modified humans in one generation, making people want to help each other for no benefit to themselves. Then, abolish the government I'm the next generation so this group of modified-humans runs with no profit motive or government. So it's like super dark and authoritarian, but only for a little bit?
Anyway, this was a fun thought exercise for me so thanks!
I'm genuinely curious what mechanism you would like society to function under? Like why would people...do stuff if not for value in exchange?
Honestly the only thing I came up with is basically if you forcibly modified humans in one generation, making people want to help each other for no benefit to themselves. Then, abolish the government I'm the next generation so this group of modified-humans runs with no profit motive or government. So it's like super dark and authoritarian, but only for a little bit?
Anyway, this was a fun thought exercise for me so thanks!
> Like why would people...do stuff if not for value in exchange?
People do stuff because they're curious or bored. Because they want to help and feel useful. Sure if you've worked all your life, you may spend a few months just doing nothing and just reconnecting with your inner feelings and environment. But after a while i can assure you you won't be able to stand lying around: pathological laziness is very rare. [0] Many people without employment suffer from not having a sense of purpose.
But what about the tasks nobody wants to do, like collecting garbage? Why can't we distribute those tasks? Why would a certain caste of people have to do the unpleasant tasks for others? If some task is a burden to the community, it's only fair the unpleasantness is distributed somewhat-equally. If i lived in a big city, i personally wouldn't mind collecting garbage once or twice a year, and the value i would derive from that would be that all garbage including mine is duly collected. [1]
Likewise, why would i help another person with some task i'm competent with? It can come out of simple empathy, but there's another way to look at it. The capitalist system treats exchanges as a zero-sum game where if i don't get my share at every step of the way i'm getting screwed because someone else will have it. A Commune without private property [2] treats exchanges as some form of creative process: the more we share, the more we have, and the more we can share... the better off everyone is in the end.
> Honestly the only thing I came up with is basically if you forcibly modified humans in one generation, making people want to help each other for no benefit to themselves.
Haha, that sounds like a pretty cool scenario for a movie in which you're not sure if it's a utopia or dystopia. Can't wait for the trailer to come out ;)
> Anyway, this was a fun thought exercise for me so thanks!
Cool! It can be more than a thought experiment, though. No person (myself included) is going to come up with the solutions to all our problems. The point of anarchism is that distributing power (so that everyone has a voice) is a prerequisite for finding the better outcomes for everyone. This can be practiced in every field of life on a daily basis.
If you enjoyed the thought experiment, i can only recommend to read some more anarchist literature: i've personally profoundly enjoyed Emma Goldman's autobiography, among others. Submedia's Trouble [3], in video form, documents various questions/practices related to anarchism.
[0] I hear Devon Price has some good works lately on that topic, but i haven't given it a read yet.
[1] Of course in a better world, we wouldn't have a garbage-oriented society. Capitalism produces waste on so many levels it's hard to imagine a less-efficient system. I take this example because that's something all people who live in cities can relate to.
[2] Private property does not designate personal belongings. Of course in a free Commune everyone still has personal stuff. Property is the authority derived from a piece of paper over resources you have no use of.
[3] https://sub.media/c/trouble
People do stuff because they're curious or bored. Because they want to help and feel useful. Sure if you've worked all your life, you may spend a few months just doing nothing and just reconnecting with your inner feelings and environment. But after a while i can assure you you won't be able to stand lying around: pathological laziness is very rare. [0] Many people without employment suffer from not having a sense of purpose.
But what about the tasks nobody wants to do, like collecting garbage? Why can't we distribute those tasks? Why would a certain caste of people have to do the unpleasant tasks for others? If some task is a burden to the community, it's only fair the unpleasantness is distributed somewhat-equally. If i lived in a big city, i personally wouldn't mind collecting garbage once or twice a year, and the value i would derive from that would be that all garbage including mine is duly collected. [1]
Likewise, why would i help another person with some task i'm competent with? It can come out of simple empathy, but there's another way to look at it. The capitalist system treats exchanges as a zero-sum game where if i don't get my share at every step of the way i'm getting screwed because someone else will have it. A Commune without private property [2] treats exchanges as some form of creative process: the more we share, the more we have, and the more we can share... the better off everyone is in the end.
> Honestly the only thing I came up with is basically if you forcibly modified humans in one generation, making people want to help each other for no benefit to themselves.
Haha, that sounds like a pretty cool scenario for a movie in which you're not sure if it's a utopia or dystopia. Can't wait for the trailer to come out ;)
> Anyway, this was a fun thought exercise for me so thanks!
Cool! It can be more than a thought experiment, though. No person (myself included) is going to come up with the solutions to all our problems. The point of anarchism is that distributing power (so that everyone has a voice) is a prerequisite for finding the better outcomes for everyone. This can be practiced in every field of life on a daily basis.
If you enjoyed the thought experiment, i can only recommend to read some more anarchist literature: i've personally profoundly enjoyed Emma Goldman's autobiography, among others. Submedia's Trouble [3], in video form, documents various questions/practices related to anarchism.
[0] I hear Devon Price has some good works lately on that topic, but i haven't given it a read yet.
[1] Of course in a better world, we wouldn't have a garbage-oriented society. Capitalism produces waste on so many levels it's hard to imagine a less-efficient system. I take this example because that's something all people who live in cities can relate to.
[2] Private property does not designate personal belongings. Of course in a free Commune everyone still has personal stuff. Property is the authority derived from a piece of paper over resources you have no use of.
[3] https://sub.media/c/trouble
Why do you find profits unethical as an anarchist? Capitalism is not a form of government.
TLDR: Capitalism is a form of government historically and in the present. Even if it was not (as suggested by right-wing libertarians like Ayn Randt), anarchism stands against all power over others (read authority/domination/privilege/exploitation) not just government.
"Property is theft" is a famous quote by Proudhon [0], who was the first person to coin the term "anarchist" to describe a desire for Freedom & Equality as complementary goals which should never be opposed. By this, he means that profit is always derived from someone else's exploitation downstream: for example, as computer people, even by working "ethical" jobs, we still widely profit from the exploitation of miners and factory workers in the Global South who produce our devices, and from the pollution and climate change (that also mostly affects the Global South) derived from that. It's also worth noting, as we've seen at the height of the COVID lockdowns, that the people the most essential to society (food/health, logistics, maintenance/construction workers) are also those who get the smallest share of the pie.
Private property is the State religion that makes it possible to have homeless people yet millions of empty dwellings, and that core tenet of capitalism is enforced by the Nation State and its police/military forces [1]. This, despite the fact that many jurisdiction (including the law in France since the liberation in 1945) explicitly allows authorities to requisition empty dwellings to prevent civil disorder ("trouble à l'ordre public"). Capitalism relies on early indoctrination (via childhood education) and a great amount of physical force/threats in order to perpetuate itself. Why do we have to pay to live? Because if you don't pay rent, some psychopaths with guns are gonna knock down your door and kick you out.
Would there be equality without a centralized government? Sure, some influential person could employ a militia (as already happens despite our having a central police [2]), but:
- the scale of that would be fairly limited to crush popular unrest, compared to a Nation State's forces
- without a central State to indoctrinate since childhood (preparing us for competition in a cruel world) and ensure millions of people live in misery (and have to take the job) it would be harder to mount such schemes
- the incentives would be more balanced: if we can live decently and quietly (as most people desire), what interest would i have to attack someone else's community for a corrupt overlord?
- power would be more balanced: in many parts of the world (including France), the State has a legal monopoly on justified violence which makes community vulnerable by not having a right to arm and defend themselves
Both outcomes are possible if we abolish the State from one day to the next (anarcho-capitalism and anarcho-communism). However, given the history of capitalism and the sheer amount of national force it took to set that up (eg. armies colonizing foreign countries, public schools to teach the young to fuck other people before they fuck you and that "copying is cheating"), i would argue that tearing down such centralized structures may bring us closer to our tendencies for empathy and mutual aid which are common throughout animal societies. [3]
Overall, anarchism is focused on distribution of power, responsibilities, and resources: in society at large, in the family, in the workplace, in interpersonal relationships... It's not focused on "rights" as a legal construct but on the practical power you can yield as an individual. Sure, in a capitalist society we are all "free" to own a castle just like we are all "free" to get decent healthcare: but if we aren't given the practical means to achieve this "right", it's entirely meaningless.
Or, as Bakunin put it: "liberty without socialism is privilege, injustice; socialism without liberty is slavery and brutality.”
To finally answer your question, i'm not morally opposed to making a profit in this profit-driven society in order to survive. I'm also not morally opposed to cooperatives making a profit in order to build a parallel economy. What matters to me is the next step: how to build a society based on needs and desires, not profit. Or, as the old anarchist saying goes: "To each according to their needs, from each according to their capacity".
On a high-level, you need money because everybody else needs money: the carpenter needs to pay the peasant, who needs to pay the plumber, who needs to pay the baker... Workers cooperatives, when they have a sense of revolutionary purpose [4], can be a trojan horse that extracts money form our overlords in order to build material autonomy that can lead to the irrelevance of profit. Money is an abstract layer of indirection, and at each step leaks into the pockets of the owners.
Having lived for quite a while in communities where money is irrelevant [5], I personally feel that in order to achieve our goals, it's much more efficient to base the discussion on actual needs and how to build concrete autonomy [6] rather than center the talk about monetary goals in which we can loose sight of what we were trying to accomplish in the first place.
I hope to have answered your question.
[0] If you're interested in cooperative economy and don't read what he has to say about women and the jews, his writings are sound. Fortunately the more recent anarchist movement (since the last quarter of the 19th century) has evolved to be fundamentally incompatible with misogyny and racist sentiment and to be on the frontlines against such power structures (see for example the rise of anarcha-feminism since the 1930s).
[1] The military is not just a construct against foreign invasion, as seen throughout the history of the workers emancipation movement and the many times armies have been called to bloodily suppress strikes and other forms of popular uprising. Although since the second half of the 20th century, modern Nation States have developed "counter-insurgency" techniques in which the military becomes a last resort, and focus is placed on both propaganda and cooptation on one hand, and more vicious political repression on the other hand (targeted assassinations, legal proceedings, mutilation by police forces, etc).
[2] In the squatting scene, that's not unheard of. Bigger landlords often have ties to different strains of mafia. In other spheres of life, you could probably read about Pinkerton (the history as well as modern occurrences such as Amazon's anti-union campaign), about the Coca-Cola murders in South America, or about companies such as Ikea mounting their own intelligence agency.
[3] See also the recent HN threads about Kropotkin and his studies on mutual aid.
[4] Unlike recent straits of workers coops who have been coopted by capitalism (so-called social economy) which is only concerned about working conditions and not about broader social questions.
[5] We do use money to interface with some segments of society, but in a squat/Commune you can as an individual live without money if you don't have any, and still find purpose and access to resources. Also worth noting, some interactions with neighboring structures is not necessarily based on money: it's not uncommon for a local market/bakery to give away "dying" foods, for neighbors to help out one another on construction work, etc.
[6] Autonomy is not independence. Noone is truly independent, and autonomy accepts and accounts for inter-dependence relationships.
"Property is theft" is a famous quote by Proudhon [0], who was the first person to coin the term "anarchist" to describe a desire for Freedom & Equality as complementary goals which should never be opposed. By this, he means that profit is always derived from someone else's exploitation downstream: for example, as computer people, even by working "ethical" jobs, we still widely profit from the exploitation of miners and factory workers in the Global South who produce our devices, and from the pollution and climate change (that also mostly affects the Global South) derived from that. It's also worth noting, as we've seen at the height of the COVID lockdowns, that the people the most essential to society (food/health, logistics, maintenance/construction workers) are also those who get the smallest share of the pie.
Private property is the State religion that makes it possible to have homeless people yet millions of empty dwellings, and that core tenet of capitalism is enforced by the Nation State and its police/military forces [1]. This, despite the fact that many jurisdiction (including the law in France since the liberation in 1945) explicitly allows authorities to requisition empty dwellings to prevent civil disorder ("trouble à l'ordre public"). Capitalism relies on early indoctrination (via childhood education) and a great amount of physical force/threats in order to perpetuate itself. Why do we have to pay to live? Because if you don't pay rent, some psychopaths with guns are gonna knock down your door and kick you out.
Would there be equality without a centralized government? Sure, some influential person could employ a militia (as already happens despite our having a central police [2]), but:
- the scale of that would be fairly limited to crush popular unrest, compared to a Nation State's forces
- without a central State to indoctrinate since childhood (preparing us for competition in a cruel world) and ensure millions of people live in misery (and have to take the job) it would be harder to mount such schemes
- the incentives would be more balanced: if we can live decently and quietly (as most people desire), what interest would i have to attack someone else's community for a corrupt overlord?
- power would be more balanced: in many parts of the world (including France), the State has a legal monopoly on justified violence which makes community vulnerable by not having a right to arm and defend themselves
Both outcomes are possible if we abolish the State from one day to the next (anarcho-capitalism and anarcho-communism). However, given the history of capitalism and the sheer amount of national force it took to set that up (eg. armies colonizing foreign countries, public schools to teach the young to fuck other people before they fuck you and that "copying is cheating"), i would argue that tearing down such centralized structures may bring us closer to our tendencies for empathy and mutual aid which are common throughout animal societies. [3]
Overall, anarchism is focused on distribution of power, responsibilities, and resources: in society at large, in the family, in the workplace, in interpersonal relationships... It's not focused on "rights" as a legal construct but on the practical power you can yield as an individual. Sure, in a capitalist society we are all "free" to own a castle just like we are all "free" to get decent healthcare: but if we aren't given the practical means to achieve this "right", it's entirely meaningless.
Or, as Bakunin put it: "liberty without socialism is privilege, injustice; socialism without liberty is slavery and brutality.”
To finally answer your question, i'm not morally opposed to making a profit in this profit-driven society in order to survive. I'm also not morally opposed to cooperatives making a profit in order to build a parallel economy. What matters to me is the next step: how to build a society based on needs and desires, not profit. Or, as the old anarchist saying goes: "To each according to their needs, from each according to their capacity".
On a high-level, you need money because everybody else needs money: the carpenter needs to pay the peasant, who needs to pay the plumber, who needs to pay the baker... Workers cooperatives, when they have a sense of revolutionary purpose [4], can be a trojan horse that extracts money form our overlords in order to build material autonomy that can lead to the irrelevance of profit. Money is an abstract layer of indirection, and at each step leaks into the pockets of the owners.
Having lived for quite a while in communities where money is irrelevant [5], I personally feel that in order to achieve our goals, it's much more efficient to base the discussion on actual needs and how to build concrete autonomy [6] rather than center the talk about monetary goals in which we can loose sight of what we were trying to accomplish in the first place.
I hope to have answered your question.
[0] If you're interested in cooperative economy and don't read what he has to say about women and the jews, his writings are sound. Fortunately the more recent anarchist movement (since the last quarter of the 19th century) has evolved to be fundamentally incompatible with misogyny and racist sentiment and to be on the frontlines against such power structures (see for example the rise of anarcha-feminism since the 1930s).
[1] The military is not just a construct against foreign invasion, as seen throughout the history of the workers emancipation movement and the many times armies have been called to bloodily suppress strikes and other forms of popular uprising. Although since the second half of the 20th century, modern Nation States have developed "counter-insurgency" techniques in which the military becomes a last resort, and focus is placed on both propaganda and cooptation on one hand, and more vicious political repression on the other hand (targeted assassinations, legal proceedings, mutilation by police forces, etc).
[2] In the squatting scene, that's not unheard of. Bigger landlords often have ties to different strains of mafia. In other spheres of life, you could probably read about Pinkerton (the history as well as modern occurrences such as Amazon's anti-union campaign), about the Coca-Cola murders in South America, or about companies such as Ikea mounting their own intelligence agency.
[3] See also the recent HN threads about Kropotkin and his studies on mutual aid.
[4] Unlike recent straits of workers coops who have been coopted by capitalism (so-called social economy) which is only concerned about working conditions and not about broader social questions.
[5] We do use money to interface with some segments of society, but in a squat/Commune you can as an individual live without money if you don't have any, and still find purpose and access to resources. Also worth noting, some interactions with neighboring structures is not necessarily based on money: it's not uncommon for a local market/bakery to give away "dying" foods, for neighbors to help out one another on construction work, etc.
[6] Autonomy is not independence. Noone is truly independent, and autonomy accepts and accounts for inter-dependence relationships.
I was worried by the size of this reply that it was some kind of copy-pasta at first. That doesn't seem the case. I am genuinely interested in digesting this and giving you a thoughtful reply, but it will take some time.
I use Plausible, which gives me enough useful information to run my website, but doesn't collect any more than needed. It's a lot less useful than Google Analytics, but it's a big privacy and UX improvement for my readers.
My personal website has no tracking at all.
My personal website has no tracking at all.
I use the "I don't care about cookies" browser extension with "Cookie AutoDelete". Cookies are managed client-side, those banners are redundant. The purpose of open standards is that you can have a user-agent that does whatever you want it to do, so take advantage of that.
Cookie banners are the dictionary definition of a meme. They give the site makers a piece of mind, helping them sleep better at night, even if they may have no other practical purpose. Other site makers see them and reproduce them because it gives them the same piece of mind, exposing the banners to more site makers. Obviously, there are better ways to get a piece of mind as webmaster, but you'd need first to explain the problem to a lot of people before anything changes.
Cookie banners are the dictionary definition of a meme. They give the site makers a piece of mind, helping them sleep better at night, even if they may have no other practical purpose. Other site makers see them and reproduce them because it gives them the same piece of mind, exposing the banners to more site makers. Obviously, there are better ways to get a piece of mind as webmaster, but you'd need first to explain the problem to a lot of people before anything changes.
Cookies are not the only way to tack you.
Websites can track you with localStorage, ETag headers and other cache-based methods, etc.
Some methods don’t event require any persistence on the client side, e.g. fingerprinting.
Websites can track you with localStorage, ETag headers and other cache-based methods, etc.
Some methods don’t event require any persistence on the client side, e.g. fingerprinting.
Cookie Autodelete also takes care of things like local storage and various caches.
There's not much you can do about fingerprinting though. You can try to limit it in firefox with the resist-fingerprinting option, but that has its limits.
There's not much you can do about fingerprinting though. You can try to limit it in firefox with the resist-fingerprinting option, but that has its limits.
And besides all that, most people use the same public IP address anyway…
peace of mind, not a piece of mind
I like them. They are a sure signal which websites to avoid.
Same as 'allow notification' banners.
Although, to be honest, some (smaller) sites do it just because 'everybody does that' and they think they have to to comply to the law.
Although, to be honest, some (smaller) sites do it just because 'everybody does that' and they think they have to to comply to the law.
It hasn't made me stop visiting any sites because the banners are almost omnipresent, but I've started using incognito mode way more, so I can blindly accept whatever the site wants me to.
An ad provider might connect your incognito session with your regular session. Especially if you blindly click “accept”, since then you might agree to being tracked across sessions and devices.
Well, many sites include cookies to link devices as required cookies anyway. So even if you reject the rest, you are still accepting some form of "device linking". It's hopeless.
A clickbaitey site I visited recently detected incognito mode and would not let me in. I don't remember if it had a simple overlay or missing content, since I immediately went away.
> I like them. They are a sure signal which websites to avoid. Same as 'allow notification' banners.
Agreed. I learned to ignore banners, but when I see a modal forcing me to do an action before proceeding, I can be 100% sure they're up to something slimy. So most of the time I just give up, I don't care that much about your website to lose my precious time clicking on stupid buttons.
Agreed. I learned to ignore banners, but when I see a modal forcing me to do an action before proceeding, I can be 100% sure they're up to something slimy. So most of the time I just give up, I don't care that much about your website to lose my precious time clicking on stupid buttons.
Same here. It's very off-putting, no matter how interested I am in the content. Some other such deterrents for me are the usual autoplaying media, newsletter popups, and blog-spam recommendations.
Lately, I've also included in-your-face code of conduct or diversity rules, and fixed-position author portraits in blogs.
For YouTube it's opening with "hey guys!11!", forced hand gestures, manic editing (where pauses between phrases are shorter than between words), and superfluous stock imagery.
Life's too short and it's only getting shorter.
Lately, I've also included in-your-face code of conduct or diversity rules, and fixed-position author portraits in blogs.
For YouTube it's opening with "hey guys!11!", forced hand gestures, manic editing (where pauses between phrases are shorter than between words), and superfluous stock imagery.
Life's too short and it's only getting shorter.
yeah, i've set firefox to always reject notification and location requests unless i override it (for e.g: notifications for whatsapp web or a few other websites) - i'd rather not waste the mental energy being grumpy at a site for requesting location for the most trivial crap.
This approach doesn’t seem viable. The banners are on >95% of the sites I visit.
Same for me. But now it's mostly 'used to visit'.
I hate them. But yes, whenever I see a banner, I close the browser tab. And that happens to more and more sites, which tell me: more and more sites are crap. I'm better off living without them.
It's a checklist item in marketing agencies
The worst part is, after all this time, most users are desensitized by all the banners and ads that pop up so they click whatever button they can to get rid of it. I’m guilty of it myself.
This isn’t the privacy solution we needed. It hasn’t changed the way users are tracked — it’s only annoyed people. The law needs to be reshaped to punish abusive companies, not users.
This isn’t the privacy solution we needed. It hasn’t changed the way users are tracked — it’s only annoyed people. The law needs to be reshaped to punish abusive companies, not users.
California has a warning for cancer-causing chemicals and sites. It's called the Prop 65 Warning.
And it's _everywhere_. Turns out there are qualifying cancer-causing agents around every corner. Including gas stations, and no one doesn't go to the gas station because of the posted Prop 65 Warning.
So everyone ignores it. It has no effect for all the trouble they took to implement it.
And it's _everywhere_. Turns out there are qualifying cancer-causing agents around every corner. Including gas stations, and no one doesn't go to the gas station because of the posted Prop 65 Warning.
So everyone ignores it. It has no effect for all the trouble they took to implement it.
There's a great Safari extension for this called Hush[1].
After installing this, I rarely see any cookie popups.
[1] https://oblador.github.io/hush/
After installing this, I rarely see any cookie popups.
[1] https://oblador.github.io/hush/
And this https://www.i-dont-care-about-cookies.eu/ for a number of other platforms like Firefox and Chrome, and it's recommended by Firefox.
uBlock Origin will take care of blocking tracking popups/banners for you if you enable the "EasyList cookie" filterlist in the settings. It is not activated by default.
My life became so much better when I activated EasyList. Makes me wonder why is it not activated by default.
There is too much to gain from tracking website visitors. Most companies that run websites would rather subject visitors to the pop-up in order to satisfy the law, than to remove tracking.
The blame is at least partly on the economic models of the modern web. Tracking increases the payout of ads, ads are the main source of revenue... cookie popups allow this all to continue.
Without a fundamental reshaping of the web economy, this isn't likely to change.
Without a fundamental reshaping of the web economy, this isn't likely to change.
> Without a fundamental reshaping of the web economy
That's actually quite easy: leave any webpage with cookie banners as fast as possible. Or at least disable everything.
That's actually quite easy: leave any webpage with cookie banners as fast as possible. Or at least disable everything.
That's exactly what makes it hard: you need everybody to do the same (ok, a majority, but that's not as dramatic :)).
Of course that's true too :)
The problem is that most people blame 'the EU'.
The problem is that most people blame 'the EU'.
To add to that, the world's economy depends on capital growth, at any cost(pun intended). Considering the blow to GDP if those trillions disappeared, the governments & policy makers would never let that happen.
I love the banners! Sites don't need them for basic functionality, so when you see one you know that you're at a site out to sell your data and violate your privacy.
I feel like I can immediately tell how shady a site is by how annoying and passive aggressive their cookie banners are.
I feel like I can immediately tell how shady a site is by how annoying and passive aggressive their cookie banners are.
You can't, really. Analytics, and the type of compliance that comes with it, may be the responsibility of site operators, but it is usually never in the operators' wheelhouse. So instead of tailoring a solution for their specific sites, operators outsource this to an industry leader. The banners tell you little about the site operators, and a lot about the adjacent industry.
What do you generally do when you get faced by a popup and the site has the content you need? If you just click yes, then it would have been better if EU just regulated privacy policy to be more readable. It would be easier for sites and better for users who don't care about privacy, and in some ways better for users like you who care about privacy.
But 99 % of websites use cookie banners, even when it’s unnecessary, so it doesn’t really tell you anything.
I am bitterly disappointed by Atlas Obscura in that respect. I really liked them before their GDPR malicious compliance dark pattern revealed themselves to be sketchy.
https://news.ycombinator.com/item?id=29348637
https://news.ycombinator.com/item?id=29348637
Here's how it works:
1. Privacy advocates are worked up about cookies.
2. Lawmakers decide to do something, it'll look good.
3. Web depends on ads, so they find workarounds.
4. Everyone suffers.
5. Return to step 1. <-- You are here.
1. Privacy advocates are worked up about cookies.
2. Lawmakers decide to do something, it'll look good.
3. Web depends on ads, so they find workarounds.
4. Everyone suffers.
5. Return to step 1. <-- You are here.
Being pedantic here, but please stop calling them cookie popups. You are only helping the industry which uses this terms to disguise their intentions. They were never about cookies, they are only about tracking. You don't need consent to use cookies, you just need consent for using them for tracking. If you were not using any cookies at all, but would rather use Etag/Canvas/AdId etc., you would still need the consent popup.
So please everyone, lets call them what they actually are, they are tracking popups.
So please everyone, lets call them what they actually are, they are tracking popups.
"We" in the EU haven't, really. Lawsuits are taking place regarding how the dialogs are designed but they take forever to go anywhere.
I agree, if anything we should have one accept banner when you open a web browser.
I'd prefer to have a single prompt for all websites read something like: "You are about to browser the internet. The internet can track you, just like a native application but transparently such that you can inspect and see who and how it is done easily using built in tools to the web browser. Click accept to keep it this way? Otherwise, expect vendors find harder to understand and detect methods." [Proceed to the Internet, Stay home Instead]
I'd prefer to have a single prompt for all websites read something like: "You are about to browser the internet. The internet can track you, just like a native application but transparently such that you can inspect and see who and how it is done easily using built in tools to the web browser. Click accept to keep it this way? Otherwise, expect vendors find harder to understand and detect methods." [Proceed to the Internet, Stay home Instead]
Why don't we make browser plugins that automagically click through the popups and reject as many cookies as possible? It seems like this could be crowdsourced such that when the plugin doesn't already know the site, it asks the user to manually go through the process of rejecting as many cookies as possible, and then submits those actions to a database such that future visitors don't need to go through all the clicks.
there are extensions that click through already though im pretty sure they "accept" because if you dont accept cookies sites will limit their functionality... try
- i don't care about cookies and - cookie auto delete
pair those and no more popups but your cookies arent preserved. I havent thought about the implications of this yet so if you have any detractions lemme know
- i don't care about cookies and - cookie auto delete
pair those and no more popups but your cookies arent preserved. I havent thought about the implications of this yet so if you have any detractions lemme know
consent-o-matic is an attepmt at this i believe.
Awesome! Made in my own university and I never even heard of it. Thanks for the tip!
What's much worse: These popups have basically trained the average user to simply click the biggest, most colorful button with "OK" | "Accept All" on it, whenever something suddenly pops up on a website.
This is what happens when politicians, completely divorced from technical realities design "solutions" to something...
This is what happens when politicians, completely divorced from technical realities design "solutions" to something...
I have not accepted the situation and there is zero cookies popups on any of my sites / apps (some of them are huge businesses in EU).
Guess what, no legal issues at all :)
The call for help for "isn't there a better solution" and "this is a tech board" make me want to say what follows, hoping it doesn't sound too nasty:
Vote, that's the best solution when it comes to stuff that affects everyone around you.
Vote, that's the best solution when it comes to stuff that affects everyone around you.
>Why have we all accepted this ridiculous situation?
Because we use blockers? I hope yall do.
>Isn't there a better solution?
You decide what cookies you want to store. No one needs to aks you and you dont need to comply with any nonsense someone puts up and "forces" you to read.
Because we use blockers? I hope yall do.
>Isn't there a better solution?
You decide what cookies you want to store. No one needs to aks you and you dont need to comply with any nonsense someone puts up and "forces" you to read.
Theoretically, you should have UX advantage by not showing annoying cookie pop-ups. The catch is, you are not allowed to share their data with 3rd parties, therefore if you like to have no cookie pop-up's you should respect your visitors privacy.
These cookie warnings are not compulsory or anything like that, what is compulsory is to inform the user and let them choose what information you are going to share with others about them.
My only guess is, those who operate the websites value the returns from data sharing more than the returns of a good user experience. They even engineer those pop-ups to be as annoying as possible to opt-out so that the users compel to share their data.
These cookie warnings are not compulsory or anything like that, what is compulsory is to inform the user and let them choose what information you are going to share with others about them.
My only guess is, those who operate the websites value the returns from data sharing more than the returns of a good user experience. They even engineer those pop-ups to be as annoying as possible to opt-out so that the users compel to share their data.
There is a solution which balances site owners' need to track with a respectful consent UX (e.g. no immediate consent prompt): https://transcend.io/blog/defeating-cookie-banners
Many sites prompt right away because they want to begin tracking right away. Transcend Consent transparently converts all unconsented web tracker emissions into local tracking, which can be replayed later with consent.
Instead of prompting for consent on first visit, these prompts could be integrated into the sign up or checkout flow in a website.
Many sites prompt right away because they want to begin tracking right away. Transcend Consent transparently converts all unconsented web tracker emissions into local tracking, which can be replayed later with consent.
Instead of prompting for consent on first visit, these prompts could be integrated into the sign up or checkout flow in a website.
> Why have we accepted the cookie pop-up situation across the web?
I've never accepted that. When I stumble upon a website harassing me with obnoxious cookie (or whatever) pop-ups right away, I just feel overwhelmed and oppressed, and then I hit the 'Back' button in a second without even thinking about it because it seems so natural to react like that. (Just imagine the same situation IRL: you enter in a shop and suddenly someone rushes at you to get you to sign some papers: naturally, you'd leave the place without thinking about it.)
I've never accepted that. When I stumble upon a website harassing me with obnoxious cookie (or whatever) pop-ups right away, I just feel overwhelmed and oppressed, and then I hit the 'Back' button in a second without even thinking about it because it seems so natural to react like that. (Just imagine the same situation IRL: you enter in a shop and suddenly someone rushes at you to get you to sign some papers: naturally, you'd leave the place without thinking about it.)
The solution is to click "deny" and stop visiting those websites.
Another solution is to attempt to reform governments to pass laws much faster and amend them quickly when workarounds like this come up. It took 4-5 years for this law to go from being first proposed to passed, and about 1 week for every website to throw up the banner.
Another is to directly pay for the services that these websites currently use ads to fund.
All solutions require significant effort or sacrifice on our part, so they probably won't happen.
Another solution is to attempt to reform governments to pass laws much faster and amend them quickly when workarounds like this come up. It took 4-5 years for this law to go from being first proposed to passed, and about 1 week for every website to throw up the banner.
Another is to directly pay for the services that these websites currently use ads to fund.
All solutions require significant effort or sacrifice on our part, so they probably won't happen.
I have just given up and disabled JavaScript on mobile. It has made browsing the mobile web much less awful even if I occasionally run into a site that doesn't work with js. It's reasonably trivial to enable on a per site basis if you need it.
Most sites are semi broken, but at least you can read them.
Most search engines are hilariously broken though which is sort of a bonus. Bing can't search from the input in the page. Google infinite redirects.
Most sites are semi broken, but at least you can read them.
Most search engines are hilariously broken though which is sort of a bonus. Bing can't search from the input in the page. Google infinite redirects.
It's important to understand that while people might think that the pop-ups are required by the law, this is not true and most pop-ups today have no legal effect regardless of what you click. The GDPR requires express consent. If the pop-up uses a dark pattern to make "refusing consent" difficult, then clicking on whatever it takes to make the pop-up go away isn't consent.
And just setting a cookie doesn't necessarily need consent either, if it's used directly to provide the service (eg. a cookie to track your login session or your shopping basket).
A change requires the authorities to actually start enforcing this. https://noyb.eu is campaigning for this.
And just setting a cookie doesn't necessarily need consent either, if it's used directly to provide the service (eg. a cookie to track your login session or your shopping basket).
A change requires the authorities to actually start enforcing this. https://noyb.eu is campaigning for this.
I wish this "wilful consent" was more often challenged in court as it has become ubiquitous in todays IT landscape. The most offending example outside of the web is WhatsApp in the EU: They show me a "We need your consent for our new privacy policy" banner every day, with only two options: Accept, and the "x" in the corner, which basically is a "nag me again tomorrow" button. There is no "deny" option. I would seriously think that any nudging/nagging dialogs like this should not be considered wilful consent.
That isn't consent under Art. 5 (1) Sentence 1 a GDPR, only acknowledgement of a new Privacy Policy. There needn't be an option to deny it.
Well non-profits like NOYB are starting to create automatic systems to send GDPR complaints to non-compliant websites.
"Blame it on the GDPR? Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR."
See: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
"Blame it on the GDPR? Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR."
See: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
It's a combination of a certain group of people who will fight to the death for their "right" to maintain complete ignorance of all things "computer" (beyond the absolute requirement of locating the power button to get started, and knowing that "(e)" icon for "Explorer"/"Edge" means "Internet"), and an out of control advertising industry who will fight to the death for their "right" to abuse such people's lack of understanding of everything "computer" in order to monetize and spy upon every little detail of everyone's every single move upon the Internet that the advertising industry has inexplicably and arbitrarily decided that they alone own and control all the rules and operations thereof.
people like to think they are "doing something" even if it clearly does nothing. Kind of a collective guilt complex
The solution is to use they "i don't care about cookies" chrome extension
The solution is to use they "i don't care about cookies" chrome extension
That's not it at all - the banners are not required unless they intend to track you - stuff like sessions data or theme selection does not pertain to the 'cookie law', itself.
The way most popup exist does not constitute an affirmative choice, which makes their existence & purpose misleading on purpose.
The way most popup exist does not constitute an affirmative choice, which makes their existence & purpose misleading on purpose.
What do you mean by “we” have “accepted” any such situation?
Most of the people working on sites with those banners aren’t here on this board. Even if they were, what do you want them to do? Refuse to work? Quit on principle? It’s not like we’re talking about unsafe bridges that are going to kill people.
Users? Plenty of users are annoyed by these things but obviously not enough to dent traffic numbers or encourage the rise of alternatives. Plenty of technical hacks throughout the comments here if you’re looking for a solution for yourself, but nothing scalable is really possible.
Regulatory agencies? They take a very long time to work and can only go after so many websites at a time. As others have mentioned, lawsuits are happening but it will take time for it to work through the courts and agencies and even more time beyond that to propagate through industry as “doing this will can get your company sued” for those companies that even care about such things.
Most of the people working on sites with those banners aren’t here on this board. Even if they were, what do you want them to do? Refuse to work? Quit on principle? It’s not like we’re talking about unsafe bridges that are going to kill people.
Users? Plenty of users are annoyed by these things but obviously not enough to dent traffic numbers or encourage the rise of alternatives. Plenty of technical hacks throughout the comments here if you’re looking for a solution for yourself, but nothing scalable is really possible.
Regulatory agencies? They take a very long time to work and can only go after so many websites at a time. As others have mentioned, lawsuits are happening but it will take time for it to work through the courts and agencies and even more time beyond that to propagate through industry as “doing this will can get your company sued” for those companies that even care about such things.
> Even if they were, what do you want them to do? Refuse to work?
Yes, if an employer asks an employee to help violate any law, the employee has the legal right to refuse to do so. (I'm sure there'll be some country where that's not true, but generally...)
The responsible thing to do there would be to work with the employer to come up with a different design that does not have the same issues. If the employer explicitly insists on an illegal design, be sure to save proof that you informed the employer that it's illegal. Beyond that, it's tough and not everyone will be up for continuing the fight, and I don't blame the employees if they don't. A decent employer, however, of which there are many, will be okay with a legal alternative.
Yes, if an employer asks an employee to help violate any law, the employee has the legal right to refuse to do so. (I'm sure there'll be some country where that's not true, but generally...)
The responsible thing to do there would be to work with the employer to come up with a different design that does not have the same issues. If the employer explicitly insists on an illegal design, be sure to save proof that you informed the employer that it's illegal. Beyond that, it's tough and not everyone will be up for continuing the fight, and I don't blame the employees if they don't. A decent employer, however, of which there are many, will be okay with a legal alternative.
The funny thing is, the tracking cookies aren't even necessary. There is plenty of data in things like canvas, fonts, GPU capabilities, IP address etc which are perfectly capable of de-anonymising anybody on the web, and the storage for the tracking could be done entirely server side. Cookies are just used for this because devs are lazy.
Well, GDPR superseded the cookie banner thing and the banners are now trying to gain dubious "consent" about being tracked in all kind of ways, since GDPR is trying to make PII into "radioactive waste" in a way - i.e. the plan is that the best way to avoid dealing with GDPR is to minimize contact (and thus gathering of) with PII.
Have we accepted the popups? The tracking agencies have clearly set the goal to make the user experience as bad as possible if you want to deny the prompts.
As far as I'm concerned, we should just blanket ban these trackers all together. The industry has been given the chance to play nicely and to care about the people they're collecting data from, and they chose war on consent.
Fuck it, make the DNT header a legally binding way to deny consent.
I consider every company with these invasive popups to be antisocial. Not enough people care enough for the practice to disappear, but I definitely don't just accept it. I accept the simple prompts that go yes/no/specify, with the yes and no equally easy to use, but that's the best you'll get from me.
Any website claiming that trackers have "legitimate interest" is made by absolute assholes.
As far as I'm concerned, we should just blanket ban these trackers all together. The industry has been given the chance to play nicely and to care about the people they're collecting data from, and they chose war on consent.
Fuck it, make the DNT header a legally binding way to deny consent.
I consider every company with these invasive popups to be antisocial. Not enough people care enough for the practice to disappear, but I definitely don't just accept it. I accept the simple prompts that go yes/no/specify, with the yes and no equally easy to use, but that's the best you'll get from me.
Any website claiming that trackers have "legitimate interest" is made by absolute assholes.
I have not accepted it: I immediately close the tab almost every time I see the first pop-up on a website.
For example, I no longer use Stackoverflow since they started showing these pop-ups, ostensibly to force me to accept what I regard as an invasion of privacy. When reading a web page, I would like to be able to concentrate on the content without any distractions, and my feeling is that a site that shows pop-ups does not respect this sufficiently.
As to solutions: Wherever I can, I support all measures that let a website get rid of any existing pop-ups, for example by advocating for less tracking and more respect for users' privacy and ability to quickly obtain the information they want.
For example, I no longer use Stackoverflow since they started showing these pop-ups, ostensibly to force me to accept what I regard as an invasion of privacy. When reading a web page, I would like to be able to concentrate on the content without any distractions, and my feeling is that a site that shows pop-ups does not respect this sufficiently.
As to solutions: Wherever I can, I support all measures that let a website get rid of any existing pop-ups, for example by advocating for less tracking and more respect for users' privacy and ability to quickly obtain the information they want.
I personally use the Tor Browser for such websites. Sure, track me and my non-unique fingerprint for the next minutes until i close my browser again and everything is deleted :)
How do you get any work done?
Personally I haven't found Stack Overflow useful for anything in a looong time. At work, usually my problems are specific to whatever proejct I'm working on and my peers are the only real source of answers regarding that. At home, if I want to work on some cool new thing then a Wikipedia page or good write-up on someone's blog is the goto source for useful, structured information.
The few times I have seen SO recently have been from friends trying to do Linux things, looking for answers on SO, and finding some ludicrous answer that is either just wrong or an extremely roundabout (and overcomplicated) approach to solving it.
The few times I have seen SO recently have been from friends trying to do Linux things, looking for answers on SO, and finding some ludicrous answer that is either just wrong or an extremely roundabout (and overcomplicated) approach to solving it.
The only time Stack Overflow is useful to me is when I'm trying to find something to do with Javascript which I barely touch. Even then it's barely useful because of how much browsers change.
I've never used SO. Why are people so reliant on it?
While I don't remember if and how much I've used it, I have to actively restrict my searches not to give me SO results, but the reference material I am looking for.
So my guess is that SEO is what takes people to SO first, even if it might not get the best results. (And sure, some of that search ranking is due to people recommending it left and right for real: it is actually organic and not fake)
I've long ago accepted that my brain doesn't like learning how most others seem to (I also don't like flowcharts, and prefer dense reference material) — this is not to discredit their way of learning, just recognizing the differences.
So my guess is that SEO is what takes people to SO first, even if it might not get the best results. (And sure, some of that search ranking is due to people recommending it left and right for real: it is actually organic and not fake)
I've long ago accepted that my brain doesn't like learning how most others seem to (I also don't like flowcharts, and prefer dense reference material) — this is not to discredit their way of learning, just recognizing the differences.
Curious what kind of work you do?
Java development, mostly.
I've also built this search engine from scratch: https://search.marginalia.nu/ , not once did I consult SO.
I've also built this search engine from scratch: https://search.marginalia.nu/ , not once did I consult SO.
I don’t use it often. Before SO, I’d read man pages and still do. But when I want to remember how to do something like sort in awk, seeing an example is a lot faster than than reading the man page again.
You could argue that if I sucked it up and read the man page a few more times, I’d stop needing awk. You’d be right. But I don’t have your aversion to SO, so it’s not so bad for me.
You could argue that if I sucked it up and read the man page a few more times, I’d stop needing awk. You’d be right. But I don’t have your aversion to SO, so it’s not so bad for me.
It's not that I hate SO, I just don't find it particularly helpful.
Feels like going to the 13th century catholic church for answers: The answers are as old as they are doctrinal and detached from practical reality, whereas my practical experience is that the honest answer to almost all programming related questions starts with "It depends".
The fact that the medium is set up for each question having a definitive answer just doesn't seem to be a great fit for the open-ended nature of programming questions.
Feels like going to the 13th century catholic church for answers: The answers are as old as they are doctrinal and detached from practical reality, whereas my practical experience is that the honest answer to almost all programming related questions starts with "It depends".
The fact that the medium is set up for each question having a definitive answer just doesn't seem to be a great fit for the open-ended nature of programming questions.
Clearly you're just too clever for it.
SO is useful for entry level work mostly - topic that I'd be barely familiar with. At some point SO was so prevalent even w/o a search bubble that I had to exclude it from my searches...
I used to think this way and then one day I realized I had gone years without visiting that site.
I think stack overflow is mostly a series of training wheels that you can simply grow out of.
I think stack overflow is mostly a series of training wheels that you can simply grow out of.
This question really bothers me as well. I remember the time when designers came in and taught developers not to use pop ups, because pop up annoy and scare users.
I prefer browsing the web using uBlock Origin just to get rid of all the bloat. However there are several sites that are not compatible. And I’m pretty much directly closing the browser tab.
I wonder, whether it’s just me staying away from sites that annoy me to hell, because all the sites still use such pop ups. Following I wonder, whether site maintainers use all the analytics crap tools anyway. I mean, all the pop ups must have some sort of impact? Honest question: are there any site maintainers analyzing there logs and might answer my questions?
I prefer browsing the web using uBlock Origin just to get rid of all the bloat. However there are several sites that are not compatible. And I’m pretty much directly closing the browser tab.
I wonder, whether it’s just me staying away from sites that annoy me to hell, because all the sites still use such pop ups. Following I wonder, whether site maintainers use all the analytics crap tools anyway. I mean, all the pop ups must have some sort of impact? Honest question: are there any site maintainers analyzing there logs and might answer my questions?
This should be temporary. The popups are basically just dark patterns. Once there has been a few fines for sites using dark patterns, it will hopefully be better. These fines though have to be making a proper example, using all the available opportunity to impose penalties.
We need to see a few proper company-ending fines dealt before it gets better. If a couple of massive sites are wiped off the face of the internet for using a generic pre-packaged cookie wall, that should (hopefully!) scare everyone into compliance.
Cookie questions should be unobtrusive and single click to be without tracking, never limit the service provided (no “we need to show tracking ads to pay the bills”).
We need to see a few proper company-ending fines dealt before it gets better. If a couple of massive sites are wiped off the face of the internet for using a generic pre-packaged cookie wall, that should (hopefully!) scare everyone into compliance.
Cookie questions should be unobtrusive and single click to be without tracking, never limit the service provided (no “we need to show tracking ads to pay the bills”).
[deleted]
Because some people at some point just didn’t have balls to put stupid people (it’s not a world of geeks anymore) in place, while others didn’t care.
Same pattern is happening everywhere and has been happening since the beginning of times.
Same pattern is happening everywhere and has been happening since the beginning of times.
Yes, changing the colours so green means no, dark patterns within dark patterns.
Perhaps a plug-in to go via archive.is, but that’s a slippery slope and really people would need to contribute to archive.is to keep it alive.
Perhaps a plug-in to go via archive.is, but that’s a slippery slope and really people would need to contribute to archive.is to keep it alive.
In Norway it's super strict. We have a very non-intrusive popup on our site https://tvangssalgbolig.com/
I actually like a lot of them, and they've improved a ton since the start in general.
I'm fine with measuring performance, and sometimes tailoring content, but prefer to opt-out of ad targeting and offline matching.
Most all of them are missing proper opt-outs that really should be there, however it's a good start.
Thinking about it, the one I have the most disdain for is The Guardian's; it has a quick UI but the accept-all button is labelled "Yes I'm Happy".
I'm fine with measuring performance, and sometimes tailoring content, but prefer to opt-out of ad targeting and offline matching.
Most all of them are missing proper opt-outs that really should be there, however it's a good start.
Thinking about it, the one I have the most disdain for is The Guardian's; it has a quick UI but the accept-all button is labelled "Yes I'm Happy".
The solution is to build cookie confirmation dialog into browser. Exactly the way we're dealing with camera/microphone/geolocation/notification permissions.
This will provide a stnadardized way and then you can have a big red "no cookies unless absolutely necessary" button
that or https://www.i-dont-care-about-cookies.eu/
This will provide a stnadardized way and then you can have a big red "no cookies unless absolutely necessary" button
that or https://www.i-dont-care-about-cookies.eu/
Is there really any enforcement taking place? What happens if sites just refuse to implement the cookie banner/question and go on with business as usual?
I’m more interested in the 99% of websites that are relatively low volume. It just simply wouldn’t be a regulatory priority for me if I was launching a new site, yet I see newly launched sites/MVPs/etc that already have the banners implemented.
I’m more interested in the 99% of websites that are relatively low volume. It just simply wouldn’t be a regulatory priority for me if I was launching a new site, yet I see newly launched sites/MVPs/etc that already have the banners implemented.
There is enforcement going on, but they don't have enough resources to go after every single violation. They are focusing on the biggest violators and the most flagrant violators.
Right now, most companies can get away with giving lip service to following the law, but not really following it, e.g. having a cookie banner but one that doesn't really comply with the law. You probably can't get away with openly refusing to follow the law.
Right now, most companies can get away with giving lip service to following the law, but not really following it, e.g. having a cookie banner but one that doesn't really comply with the law. You probably can't get away with openly refusing to follow the law.
It's just like clicking "Accept" when installing something, a fact of life we're all stuck with.
We all realize that this is the law in Europe, and the pop-ups are consistent enough that its safe to just accept the cookies.
If enough people (not in the EU) break this pattern in a bad way, the shit will fly. You could do something like that, but reputation points will be lost in the process.
We all realize that this is the law in Europe, and the pop-ups are consistent enough that its safe to just accept the cookies.
If enough people (not in the EU) break this pattern in a bad way, the shit will fly. You could do something like that, but reputation points will be lost in the process.
I prefer uBlock Origin that I am anyway using and not having another extension for this. But you need to enable it using: Filter lists -> Annoyances -> EasyList Cookie
Usually I don't accept cookies. Sometimes it's not that hard, but sometimes you would need to click through like hundreds(!) of checkboxes, so you don't want the cookie from them, which is ridiculous.
I would accept only one cookie, that I don't want to accept any other cookie, but surprisingly usually they don't store this information. :(
I would accept only one cookie, that I don't want to accept any other cookie, but surprisingly usually they don't store this information. :(
uBlock Origin blocks cookie pop-up modals, and also prevents most tracking so even if you accept something you shouldn't, it won't have any effect (or so I believe -- I have not actually tested this myself).
Anyway it's not perfect, but it's good enough for my needs.
Anyway it's not perfect, but it's good enough for my needs.
Do we need cookies at all in a modern web browsers with LocalStorage and SessionStorage? I beleive it is time to selectively turn on cookies on relevant websites, like we do with camera, geolocation and notification access in browser. Whitelist, problem solved.
It should have been mandatory to obey the do not track flag.. Then that flag would have made actual sense and the cookie popups could have been done away with. Just one setting in the browser itself.
I think it's legislators that messed this one up.
I think it's legislators that messed this one up.
Are there any good browser extensions for dealing with these banners? (auto clicking or blocking?)
On a side note, recently I built a website and did not need cookies at all (even though you can buy stuff, but there's not shopping cart)
On a side note, recently I built a website and did not need cookies at all (even though you can buy stuff, but there's not shopping cart)
uBlock Origin but default off. You need to enable it using: Filter lists -> Annoyances -> EasyList Cookie
Great, thank you!
My company has these banners even though we don't share information with 3rd parties. We are too scared of lawsuits based on the vague language of the law. Seems silly to me, but it's above my pay grade.
There must be a better solution. Basically the legislative body needs to be more nimble and adjust a law based on its real world effects.
If you think these pop ups "solve" user privacy in any way, let me suggest you another wonderful measure to "solve" climate change: all light switches will need to have a tiny touchscreen display next to them and if their energy source is not 100% renewable then you'll need to tap through a bunch of warning popups to agree to the terms. Each light switch manufacturer can also design this however they see fit.
That will totally solve climate change, right? Based on some comments here I'm sure some would love it and would wear headlamps to places and won't turn on the lights that have those tiny touch screens.
If you think these pop ups "solve" user privacy in any way, let me suggest you another wonderful measure to "solve" climate change: all light switches will need to have a tiny touchscreen display next to them and if their energy source is not 100% renewable then you'll need to tap through a bunch of warning popups to agree to the terms. Each light switch manufacturer can also design this however they see fit.
That will totally solve climate change, right? Based on some comments here I'm sure some would love it and would wear headlamps to places and won't turn on the lights that have those tiny touch screens.
I also don't know why we have accepted them. I would have wished that browser vendors made these dialogues a part of the web specification so that the UX/UI is at least streamlined.
Of course not. But the popup situation is a mere aftereffect from the base cause - abuse of user's private data. It is there that all anger and frustration should be directed at.
I think the cookies acceptance should be done by browser settings.
That's what happens when we glorify the legal system and let lawyers inflict the nonsense upon people.
This absolutely has no useful utility and causes moderate harm on everyone.
This absolutely has no useful utility and causes moderate harm on everyone.
Has to be a browser preference and not a site preference.
I guess this is because most people never clear their cookies and visit mostly the same sites, so they see these popups infrequently enough.
I agree, I always thought that simply using a web browser should be considered consent to accept cookies since it’s part of how they work.
Not really related to the question but I find it amusing that we have cookie popup blockers similar to ad blockers now.
Ha! I think the real question is whether LightG is on advertiser's payroll, or just really ignorant.
I am betting on evil
I am betting on evil
> Why have we all accepted this ridiculous situation?
Because we have JavaScript turned on by default?
Because we have JavaScript turned on by default?
Accepted? Do you have a choice to opt-out?
Isn't this the fault of EU regulators? GDPR says that a website cannot degrade the service for users who decline to be tracked, yet almost all these popups make it harder to reject cookies than to accept.
see: GDPR, law of unintended consequences.
The solution is to stop voting corrupt idiots into the EU parliament.
The EU directive actually requires that opting out of cookies be as simple as opting in, which hardly any of these pop-up systems allow. Unfortunately, because of the limited power of the EU, it is up to members states to actually enforce these rules. So the corrupt idiots you should stop voting for are members of your own national assembly.
No, the solution is: Don't save unnecessary data about your visitors. Then you don't need any Cookie banner.
If you follow EU politics closely, you'll notice the corrupt idiots are mostly (though not exclusively) in national politics and in the European Commission (which is nominated by member States, not elected). The European Parliament is by far the most progressive and humane legal institution we have across Europe, if only any government cared to apply the laws they pass.
We have this pattern in Western Europe (eg. France/Germany) where everything is blamed on the EU when in fact the most malicious legal interpretations come from national politics. Example: EU regulations state network service operators MAY keep logs for a maximum of one year, FR regulations claim they MUST for minimum two years.
We have this pattern in Western Europe (eg. France/Germany) where everything is blamed on the EU when in fact the most malicious legal interpretations come from national politics. Example: EU regulations state network service operators MAY keep logs for a maximum of one year, FR regulations claim they MUST for minimum two years.
The problem is not the EU directive; it's the lack of enforcement. See https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner...
I have a user agent that don't accept cookies. So I do not care what the sites tries to give me, they just go to /dev/null. Why oh why do I need to see those stupid banners then?
Wow, this is exactly the "solution" that all the tracking companies love to hear from the people.
[deleted]
Can you imagine how much time in total we all lose to this?
And yet, these "solutions" to the data privacy questions have become widespread.
It's bad enough at normal times, let alone those who double triple quadruple bluff you into choosing the wrong setting.
This is a tech board.
Why have we all accepted this ridiculous situation?
Isn't there a better solution?