Where did all the “reject” buttons come from?(noyb.eu)
noyb.eu
Where did all the “reject” buttons come from?
https://noyb.eu/en/where-did-all-reject-buttons-come
123 comments
> Most tracking now comes from the "legitimate interest" purposes that you need to actively object to
This is briefly touched on in the article: in the first graph you can see that the "Legitimate interest claimed" violations they detected dropped by 57% after they filed their complaints.
This is briefly touched on in the article: in the first graph you can see that the "Legitimate interest claimed" violations they detected dropped by 57% after they filed their complaints.
I just expect that to be the next step in the long-ish road to improvements. The inaccessibility of the "Reject all" button was the most prominent issue, but as that gets addressed, the next step will probably be court battles to more clearly define what legitimate interest is and isn't, and if the advertisers win that, I'd expect the legislation to be updated to narrow that category down.
At least most websites still offer an object to all button.
not fandom.com, there you need to click on 175 enabled-by-default switches:
not fandom.com, there you need to click on 175 enabled-by-default switches:
div[data-tracking-opt-in-overlay=true] input[type=checkbox][id^=switch]:checkedWhat are these 'legitimate interest' things, and is it even possible to object to them, legally speaking? I have never seen these I believe, unless you mean 'analytics cookies' and 'functional cookies', which I never saw hidden. I did presume that a 'reject all' included rejecting these cookies, if not it would be great to know.
There's some weird thing in the law. You can accept or reject data collection, but they can collect data for which a legitimate business interest exists unless you object - so if the law makes it default to no, you reject, but if it's default yes, you have to object. As far as I know, you have a right to object, so yes, legally speaking, it is possible to object to them. This means that there's frequently a second page of third-party/'legitimate interest' cookies, which might have an additional "Object all" button, or it might be that you have to click object one by one.
One example is https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right.
This is because the BBC hates you and wants you to be unhappy.
One example is https://www.bbc.com. Open it in a private window and you should see the invasion-of-privacy popup. You have a "Consent" and "Do not consent" button, but underneath there's also "Manage options". Click and and now you can see that there's a bunch of enabled toggles mixed in with the disabled ones, each of them headed "Legitimate interest" and the help text warns "Some vendors are not asking for your consent, but are using your personal data on the basis of their legitimate interest". So notice the text says that if you do not consent it is not relevant: they're going to do use your data on the basis of their legitimate interest. You must object to these in order to counter their right.
This is because the BBC hates you and wants you to be unhappy.
Is it possible to 'object' to these legitimate interest?
Is it possible for a website to say, if you object to these, just don't use our website/service?
Is it possible for a website to say, if you object to these, just don't use our website/service?
Some sites certainly do present the only options "accept or go away", it slightly more subtle "by continuing..."¹.
IIRC this is against both the meaning and the letter of the law, but that is not practical to properly enforce so they get away with it.
IIRC this is against both the meaning and the letter of the law, but that is not practical to properly enforce so they get away with it.
IANAL and all that.
This is the most vague part of the law because the law couldn't just forbid everything and then run into issues.
For example, to run a business a merchant doesn't need anything more from you beside you name and address (and login info if they need to show you your order history). They don't need to ask you for your consent to collect this info because this info is required for their service to operate.
However, they also want to run fraud protection. So they need to collect more data (e.g. your birth date, your IP address, perhaps other data). They have a legitimate reason to collect this data even if this data is not strictly required.
As with any vague parts this "legitimate" part is now abused by the ad industry.
This is the most vague part of the law because the law couldn't just forbid everything and then run into issues.
For example, to run a business a merchant doesn't need anything more from you beside you name and address (and login info if they need to show you your order history). They don't need to ask you for your consent to collect this info because this info is required for their service to operate.
However, they also want to run fraud protection. So they need to collect more data (e.g. your birth date, your IP address, perhaps other data). They have a legitimate reason to collect this data even if this data is not strictly required.
As with any vague parts this "legitimate" part is now abused by the ad industry.
> What are these 'legitimate interest' things,
In most cases "legitimate interests" checkboxes, particularly those referring to 3rd parties, basically mean "we see you preference not to be stalked and, while we may claim to respect you and your privacy, fuck you and your silly desire for privacy".
> and is it even possible to object to them, legally speaking?
Legally, in theory, yes.
Practically, not really. You can go through and uncheck the hundreds of preselected consent options some sites present, but do you check that this actually results in tracking information not being dropped?
In most cases "legitimate interests" checkboxes, particularly those referring to 3rd parties, basically mean "we see you preference not to be stalked and, while we may claim to respect you and your privacy, fuck you and your silly desire for privacy".
> and is it even possible to object to them, legally speaking?
Legally, in theory, yes.
Practically, not really. You can go through and uncheck the hundreds of preselected consent options some sites present, but do you check that this actually results in tracking information not being dropped?
> What are these 'legitimate interest' things
While some comments are saying that legislation can narrow this down, I don't think it's anything that can be agreed up front any longer.
Web is heading toward a complete change of protocol. One that can operate between mutually hostile and untrustworthy principles. (that's what the web is now, let's face it)
What the service provider's and your "legitimate" requirements are, will have to be negotiated per transaction.
It's the end of the "uniform" web. But I think that already happened and we're long into "The Splinternet".
As I said in Digital Vegan, technology access will not be defined by the "have and the have-nots", but by the "will and the will-nots".
While some comments are saying that legislation can narrow this down, I don't think it's anything that can be agreed up front any longer.
Web is heading toward a complete change of protocol. One that can operate between mutually hostile and untrustworthy principles. (that's what the web is now, let's face it)
What the service provider's and your "legitimate" requirements are, will have to be negotiated per transaction.
It's the end of the "uniform" web. But I think that already happened and we're long into "The Splinternet".
As I said in Digital Vegan, technology access will not be defined by the "have and the have-nots", but by the "will and the will-nots".
My layman's understanding of the GDPR was that it was the primary website (i.e. the website you are actually and intentionally visiting) that could store your data on the basis of a legitimate business interest -- for example because they need that information to deliver some stuff you ordered from them.
However someone seems to have found a legal loophole whereby third parties ostensibly are able to track you on the grounds that their business is tracking, and they therefore have a legitimate interest in tracking you.
Hopefully this loophole is eventually struck down in some French or German court, and the GDPR will one day be applied as intended. Tracking is not, and will never be, a legitimate business.
However someone seems to have found a legal loophole whereby third parties ostensibly are able to track you on the grounds that their business is tracking, and they therefore have a legitimate interest in tracking you.
Hopefully this loophole is eventually struck down in some French or German court, and the GDPR will one day be applied as intended. Tracking is not, and will never be, a legitimate business.
> Tracking is not, and will never be, a legitimate business.
The problem is, the way the Internet and its services are financed, it is pretty much a requirement.
A lot of services absolutely depend on advertising revenue because affordable micro-transactions still are not a thing, not to mention 20 years of cultural ingrainment that services on the Internet have to be free when they are aimed at the general public. The alternative is philantropy aka rich billionaires footing the bill - we're seeing with the Washington Post (Bezos), Twitter (Musk) or Austrian newspapers just how problematic that is. The only relevant project surviving off of individual donations is Wikipedia and even that has issues (see e.g. the endowment debate that regularly pops up here), Mozilla depends on Google's money. Another alternative that regularly pops up, especially in Europe, is having the government fund services - but let's be real, who wants to use a messenger where the government has any sort of involvement? China shows why this is a very bad idea.
So basically, now that we have established that currently advertising is required, another can of worms opens up: ad fraud, which is incredibly widespread. Everyone but the advertiser clients has a massive financial interest in manipulations:
- ad networks want to claim "x millions of sites use our services to show ads", so they have an incentive to create fake sites that no one ever looks at
- ad agencies want to claim reachout capacity (to their clients) and maximize ad eyeballs because often they're paid as a percentage of ad spend
- content creators want to have as much income as they possibly can get. Click fraud and SEO spam fake sites/content mills come to mind here.
Advertisers, in turn, want to minimize their ad spend and maximize the ROI. That means they need a way to target ads to specific demographic groups, they need a way to weed out fraudulent spending and they need a way to weed out undesirable context (i.e. no popular brand wants to show a pre-roll ad to Alex Jones claiming crisis actors). And that is where tracking and other "middlemen" companies come in - they serve to protect advertisers from overspending and bullshit, and provide the actual data required for targeting.
The only groups that could get away without tracking and countless middlemen services are "household brands" that simply book ads at massive TV and radio stations and niche magazines and their advertising clients (say, a magazine about farming naturally yields itself to equipment manufacturers, pesticide and other farm suppliers) - but even there, media has an incentive to over-inflate their reader/viewer/listener counts to demand more money from advertisers, so they need third parties like Nielsen Ratings as independent "arbiters".
The problem is, the way the Internet and its services are financed, it is pretty much a requirement.
A lot of services absolutely depend on advertising revenue because affordable micro-transactions still are not a thing, not to mention 20 years of cultural ingrainment that services on the Internet have to be free when they are aimed at the general public. The alternative is philantropy aka rich billionaires footing the bill - we're seeing with the Washington Post (Bezos), Twitter (Musk) or Austrian newspapers just how problematic that is. The only relevant project surviving off of individual donations is Wikipedia and even that has issues (see e.g. the endowment debate that regularly pops up here), Mozilla depends on Google's money. Another alternative that regularly pops up, especially in Europe, is having the government fund services - but let's be real, who wants to use a messenger where the government has any sort of involvement? China shows why this is a very bad idea.
So basically, now that we have established that currently advertising is required, another can of worms opens up: ad fraud, which is incredibly widespread. Everyone but the advertiser clients has a massive financial interest in manipulations:
- ad networks want to claim "x millions of sites use our services to show ads", so they have an incentive to create fake sites that no one ever looks at
- ad agencies want to claim reachout capacity (to their clients) and maximize ad eyeballs because often they're paid as a percentage of ad spend
- content creators want to have as much income as they possibly can get. Click fraud and SEO spam fake sites/content mills come to mind here.
Advertisers, in turn, want to minimize their ad spend and maximize the ROI. That means they need a way to target ads to specific demographic groups, they need a way to weed out fraudulent spending and they need a way to weed out undesirable context (i.e. no popular brand wants to show a pre-roll ad to Alex Jones claiming crisis actors). And that is where tracking and other "middlemen" companies come in - they serve to protect advertisers from overspending and bullshit, and provide the actual data required for targeting.
The only groups that could get away without tracking and countless middlemen services are "household brands" that simply book ads at massive TV and radio stations and niche magazines and their advertising clients (say, a magazine about farming naturally yields itself to equipment manufacturers, pesticide and other farm suppliers) - but even there, media has an incentive to over-inflate their reader/viewer/listener counts to demand more money from advertisers, so they need third parties like Nielsen Ratings as independent "arbiters".
Personalized tracking is not a requirement for ads.
Ad agencies were making plenty of money for many years before the internet made this kind of tracking possible.
There's very little evidence that personalized tracking actually makes advertising more effective in terms of ROI.
Let ad companies sell ads, and websites sell their ad space, based on the content of what's posted there. The same way ads were sold in newspapers and magazines for decades.
And ad fraud on the part of any of the business parties involved in the ad transactions are not sufficient justification for tracking every person's entire life online. Let them deal with the fraudsters directly, in ways that don't involve incredibly invasive and privacy-eroding surveillance on a massive scale.
If they can't figure out how to do that, that's not my problem. It's their business model, not mine.
Ad agencies were making plenty of money for many years before the internet made this kind of tracking possible.
There's very little evidence that personalized tracking actually makes advertising more effective in terms of ROI.
Let ad companies sell ads, and websites sell their ad space, based on the content of what's posted there. The same way ads were sold in newspapers and magazines for decades.
And ad fraud on the part of any of the business parties involved in the ad transactions are not sufficient justification for tracking every person's entire life online. Let them deal with the fraudsters directly, in ways that don't involve incredibly invasive and privacy-eroding surveillance on a massive scale.
If they can't figure out how to do that, that's not my problem. It's their business model, not mine.
> The problem is, the way the Internet and its services are financed, it is pretty much a requirement.
It's not. Advertisement can and has worked very well without wholesale collection and trading of private user information.
The next time you feel like presenting the "we require tracking for financing services" bullshit as fact, please provide proof.
It's not. Advertisement can and has worked very well without wholesale collection and trading of private user information.
The next time you feel like presenting the "we require tracking for financing services" bullshit as fact, please provide proof.
> The problem is, the way the Internet and its services are financed, it is pretty much a requirement.
A bad business model doesn't mean you get to ignore the law.
A bad business model doesn't mean you get to ignore the law.
A key part is that, while the GDPR undoubtedly is a good piece of law, it got introduced without a public debate on how the Internet should actually work and be funded.
Basically, GDPR kneecapped the entire business model of everyone but Wikipedia, and almost no thought was spared on how to replace that and make the Internet a better place for everyone.
Basically, GDPR kneecapped the entire business model of everyone but Wikipedia, and almost no thought was spared on how to replace that and make the Internet a better place for everyone.
> Basically, GDPR kneecapped the entire business model of everyone but Wikipedia
GDPR did no such thing. There are thousands, if not millions, of businesses operating online that _actually sell goods and services for money_ and GDPR did nothing to stop those.
On top of all that, you can still show ads while being GDPR compliant. Just not slurp-every-piece-of-data type ads.
GDPR did no such thing. There are thousands, if not millions, of businesses operating online that _actually sell goods and services for money_ and GDPR did nothing to stop those.
On top of all that, you can still show ads while being GDPR compliant. Just not slurp-every-piece-of-data type ads.
I wish cookie settings were part of the browser (e.g. I want to reject all marketing cookies but not essential ones), have a way in JS/HTTP to indicate the type of the cookie, and never see those cookie popups again.
It's not just cookies, it affects all client-side storage that can be used to track people. This means that this kind of API would also be needed for localStorage etc. This is where it things will get complicated.
I don't know if it exists, but it would probably be a good thing to have aria labels for those common buttons on these popups. It would benefit a11y and pave the way for a better automatic approve/reject by the browser (or some plugins). I think it won't end up in a disaster like the DNT header.
There are (at least) two problems with this approach: it requires that the banners actually use these labels (which they might not want to) and if it requires some kind of browser support, the largest browser vendor is also in the tracking business.
I don't know if it exists, but it would probably be a good thing to have aria labels for those common buttons on these popups. It would benefit a11y and pave the way for a better automatic approve/reject by the browser (or some plugins). I think it won't end up in a disaster like the DNT header.
There are (at least) two problems with this approach: it requires that the banners actually use these labels (which they might not want to) and if it requires some kind of browser support, the largest browser vendor is also in the tracking business.
It is not just client storage either, it could also be ephemereal computed fingerprinting with server side tracking.
No, it is just client storage. The law is explicitly only about client storage:
>Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.
-- Article 5(3) of the Privacy and Electronic Communications Directive 2002
("Directive 95/46/EC" being the old Data Protection Directive, which has been replaced by the GDPR)
>Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.
-- Article 5(3) of the Privacy and Electronic Communications Directive 2002
("Directive 95/46/EC" being the old Data Protection Directive, which has been replaced by the GDPR)
Sorry for the misunderstanding on my part. I didn't correctly parse the previous responses.
* Grandparent was talking about getting rid of cookie banners.
* Parent was talking about API to prevent tracking needing an extension for all local storage.
Of course to get rid of the original cookie banners, preventing tracking through other means is irrelevant. But nowadays most sites I visited got rid of the original cookie banners, so in my mind the complaints extend to those, even if it's not correct.
* Grandparent was talking about getting rid of cookie banners.
* Parent was talking about API to prevent tracking needing an extension for all local storage.
Of course to get rid of the original cookie banners, preventing tracking through other means is irrelevant. But nowadays most sites I visited got rid of the original cookie banners, so in my mind the complaints extend to those, even if it's not correct.
It is GDPR and not PECR that sites responded to with the cookie banners that we deal with today, and GDPR covers a much broader surface area ("processing of personal data")
Sort of, but it's still the ePD, really. The ePD was always there, but largely ignored by both companies and regulators.
What happened when the GDPR came in was twofold:
1. Everyone became acutely aware of data protection legislation, because the GDPR actually had teeth when it came to enforcement.
2. The ePD referenced the Data Protection Directive, and when the GDPR came in to force all references to the DPD became references to the GDPR.
The consequence of #2 is that the hand-wavy "implicit consent" that sites relied on to avoid cookie banners (why show a banner asking for consent if you can just assert you do have consent?) went away - the GDPR made it clear that consent must be explicit.
What happened when the GDPR came in was twofold:
1. Everyone became acutely aware of data protection legislation, because the GDPR actually had teeth when it came to enforcement.
2. The ePD referenced the Data Protection Directive, and when the GDPR came in to force all references to the DPD became references to the GDPR.
The consequence of #2 is that the hand-wavy "implicit consent" that sites relied on to avoid cookie banners (why show a banner asking for consent if you can just assert you do have consent?) went away - the GDPR made it clear that consent must be explicit.
Many of these cookies settings can be 'unset' by browser-settings. The HTTP server can set cookies all it wants, but if your browser throws them away between sessions, they can't be used to track you between sessions. (They still can aid tracking you within sessions, to what degree that is bad depends on the specific definition of 'sessions').
Firefox has a pretty decent system for this I believe. They also try to go against alternatives like 'local-storage' and a whole slew of other attempts at fingerprinting / creating super-cookies.
Firefox has a pretty decent system for this I believe. They also try to go against alternatives like 'local-storage' and a whole slew of other attempts at fingerprinting / creating super-cookies.
The most widely used browser is run by the company that serves most of the ads.
So that's pretty unlikely
So that's pretty unlikely
Just be able to block the popups would be enough, block third parties, whitelist your auth provider that’s almost the only legitimate use of third party cookies and call it a day.
It already exists.
https://globalprivacycontrol.org/
But websites will never use it because they make it annoying on purpose.
But websites will never use it because they make it annoying on purpose.
"Reject" being now an options is an improvement of sorts but honestly, the cookie laws in the current form are terrible long-term for privacy. Like recycling plastic, it's a red herring that benefits the big companies, and where everyone else loses.
The burden being on the user to manage everything reminds me more of the dysfunctional US healthcare pricing system, where the uninsured have no negotiating power and are hit with absurd prices.
The burden being on the user to manage everything reminds me more of the dysfunctional US healthcare pricing system, where the uninsured have no negotiating power and are hit with absurd prices.
The issue isn't isn't the law. The issue is every single website tracking you in a privacy invading way. The annoying cookie banners are a side effect of these companies rightfully having to now inform us of when they're invading our privacy.
I think that's the wrong framing. Any one small site tracking me doesn't do anything. It's the shadow profiles that are built by correlating this data accross the web that actually is the issue.
The fact that an information market exists is a legal issue at heart to me.
The fact that an information market exists is a legal issue at heart to me.
This cookie malarkey is about a breakdown of protocol. If two
entities no longer intend to cooperate and honour each others signals,
all bets are off for building reliable economies on that
technology. What's holding "web" together right now is the monopoly of
a few browsers that more or less force users to accept insecure
settings against their interests in order to keep them talking to
hostile services.
I've set my browser to delete cookies at close. You can accept all cookies without problem, and after lunch everything is forgotten.
A few websites that I go to often get special treatment (Hacker News!), because I'm to lazy to press ok each time.
A few websites that I go to often get special treatment (Hacker News!), because I'm to lazy to press ok each time.
That's not the same.
This forces you to close the browser regularly and they can still track you while your browsing session.
Your approach doesn't say no, it's a yes with expiration date.
This forces you to close the browser regularly and they can still track you while your browsing session.
Your approach doesn't say no, it's a yes with expiration date.
In the case of server side fingerprinting (used by any vendor offering cross device linking), it's likely not even providing the time limit people using this strategy believe it does
This is not just about cookies. When you accept tracking, you accept all kinds of it, including those that are not deleted on browser closing.
Cookie Autodelete is the plugin for that :)
I close my browser regularly to delete cookies on close, but i also run ccleaner regularly. Nothing worse than being logged into gmail...open youtube...already logged in. Not cool if i want to check put a video anonymously (ie not linked to my login).
I also change my spoof user aget and change vpn exit, too.
Regularly annoying, but i do enjoy the thought that somebody is not getting from me what they thought they might.
That would mean they get deleted every few months when an OS update forces me to reboot only. Why would I ever close my browser?
Because you'd restart to clear cookies. Why wouldn't you? You don't lose anything when windows reopen, and you recover some leaked memory.
I reboot my browser weekly to service browser security patches.
What browser has weeks security holes?
Firefox fixes security 1-2x per month [0].
Chrome's security page is more difficult to grep since it includes multiple software types, but I see 1-2x per month as well [1].
[0] - https://www.mozilla.org/en-US/security/advisories/ [1] - https://chromereleases.googleblog.com/search/label/Stable%20...
[0] - https://www.mozilla.org/en-US/security/advisories/ [1] - https://chromereleases.googleblog.com/search/label/Stable%20...
In addition to the problems mentioned by siblings, this also sends the wrong message: you're signaling to the website owners that you're OK with tracking (or that you don't care, which is the same).
They don't care what you think, they care how much exploitable data they get.
Just remove cookie banners unless you’re using an ad network (this includes keeping them if you’re using google products). Users want to use your website rather than look it through a porthole, understand that websites remember you, and cookie banners are killing the web in favour of closed app stores.
>Just remove cookie banners unless you’re using an ad network
You also need a cookie banner in EU in case your website uses any cookies that are not necessary to serve the content. This includes analytics, telemetry, and so on. It's not only ads.
You can remove the cookie banner if your website uses cookies only for required functionality like log-on.
You also need a cookie banner in EU in case your website uses any cookies that are not necessary to serve the content. This includes analytics, telemetry, and so on. It's not only ads.
You can remove the cookie banner if your website uses cookies only for required functionality like log-on.
> You also need a cookie banner in EU in case your website uses any cookies that are not necessary to serve the content.
Not quite, for two reasons:
- The law doesn't care about cookies, it cares about personal data, which includes any data which can individually identify someone (like a cookie associating them with a user account). If you're collecting or processing any personal data, that requires consent; even if you have no cookies.
- The law doesn't care about serving-as-in-content; it cares about providing a service, which could be showing content on a Web site, or could be dispatching orders from a warehouse, or whatever. If someone's personal data is required to provide a service for them, then their consent is implied.
The reason analytics, tracking, ad networks, etc. do not have implied consent, is because the people receiving the service (e.g. those buying ad space) are not the people who the personal data is about (i.e. ad companies cannot consent on my behalf!)
Not quite, for two reasons:
- The law doesn't care about cookies, it cares about personal data, which includes any data which can individually identify someone (like a cookie associating them with a user account). If you're collecting or processing any personal data, that requires consent; even if you have no cookies.
- The law doesn't care about serving-as-in-content; it cares about providing a service, which could be showing content on a Web site, or could be dispatching orders from a warehouse, or whatever. If someone's personal data is required to provide a service for them, then their consent is implied.
The reason analytics, tracking, ad networks, etc. do not have implied consent, is because the people receiving the service (e.g. those buying ad space) are not the people who the personal data is about (i.e. ad companies cannot consent on my behalf!)
You're only talking about the GDPR. But the cookie banners aren't there because of the GDPR, they're there because of the ePrivacy Directive.
It's this directive (which pre-dates the GDPR) that makes it illegal to store or access data on the end user's devices without consent unless it is strictly necessary for the provision of the service.
It's this directive (which pre-dates the GDPR) that makes it illegal to store or access data on the end user's devices without consent unless it is strictly necessary for the provision of the service.
> makes it illegal to store or access data on the end user's devices without consent unless it is strictly necessary for the provision of the service.
How is that different to what I said above? (Modulo "s/without consent/implicit consent/g")
How is that different to what I said above? (Modulo "s/without consent/implicit consent/g")
You can have all those things without cookies.
And you will need consent, because it has nothing to do with cookies. You need a telemetry banner.
And you will need consent, because it has nothing to do with cookies. You need a telemetry banner.
Or you just don't use telemetry?
That's the point, if you don't want to request consent, don't use telemetry.
It has nothing to do with cookies.
It has nothing to do with cookies.
Analytics also require consent. There are some non-mainstream solution that promise that no consent is required, but you better make sure with a lawyer.
Sadly, every marketing person and their dog insist on having analytics. Even more sadly, every product person is not capable on putting their foot down against an obviously bad cookie banner UX.
Sadly, every marketing person and their dog insist on having analytics. Even more sadly, every product person is not capable on putting their foot down against an obviously bad cookie banner UX.
Fathom Analytics is quite fool proof. No cookies (hence no consent) required, completely anonymized data that still identifies unique visitors and provided valuable analytics.
> completely anonymized data that still identifies unique visitors
That's an oxymoron. If your "completely anonymized data" is unique enough to reidentify unique visitors with reasonable probability then it isn't "completely anonymized" - it's pseudonymous.
That's the problem with all these supposedly GDPR-compliant analytics things - the GDPR outlaws analytics without consent (there's no case law whether it would fall under legitimate interest, but I doubt it), there's no way around it. It doesn't matter what technical means you use (whether cookies, fingerprinting, or a crystal ball) - if your analytics "work" in the sense that you can tell unique users apart, then you are in breach because you are effectively collecting/computing and storing some sort of identifier that can reidentify a user with reasonable accuracy.
That's an oxymoron. If your "completely anonymized data" is unique enough to reidentify unique visitors with reasonable probability then it isn't "completely anonymized" - it's pseudonymous.
That's the problem with all these supposedly GDPR-compliant analytics things - the GDPR outlaws analytics without consent (there's no case law whether it would fall under legitimate interest, but I doubt it), there's no way around it. It doesn't matter what technical means you use (whether cookies, fingerprinting, or a crystal ball) - if your analytics "work" in the sense that you can tell unique users apart, then you are in breach because you are effectively collecting/computing and storing some sort of identifier that can reidentify a user with reasonable accuracy.
Not true. Consent has nothing to do with cookies. If you look at what the ePrivacy Directive article 5.3. says, it's pretty clear:
"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ... "
So even Fathom, and other analytics tools that use browser fingerprinting or similar methods require consent.
And also, the whole no cookie, no consent -mantra does not respect user privacy. In some ways, browser fingerprinting is even worse because that's much harder for an average user to block than cookies.
"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ... "
So even Fathom, and other analytics tools that use browser fingerprinting or similar methods require consent.
And also, the whole no cookie, no consent -mantra does not respect user privacy. In some ways, browser fingerprinting is even worse because that's much harder for an average user to block than cookies.
It might be true, if the stored data is truly anonymized, as they seem to not be storing any data on the browser.
There is a fuzzy line somewhere between access-logs and user-tracking.
Personally I think that at that point, one should just stop loading analytic scripts and stick to server-side access-log analytic toolg like goaccess.io.
There is a fuzzy line somewhere between access-logs and user-tracking.
Personally I think that at that point, one should just stop loading analytic scripts and stick to server-side access-log analytic toolg like goaccess.io.
What about Plausible?
The thing that really bothers me with these privacy discussions is that everybody talks about cookies. The "no cookies, no consent" -mantra is false and does not respect user privacy because there are other ways to track people, like browser fingerprinting, which is even harder to block for an average internet user.
The other thing, GDPR is not about cookies. The ePrivacy Directive regulates the use of cookies, but it's not about cookies either. Article 5.3. in the ePrivacy Directive says:
"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ..."
So whatever technology you use, you need consent to use web analytics tools. At least at the moment. A draft online suggests there might be a consent exception for audience measurement if the technology used complies with GDPR - again, this has nothing to do with cookies. The point is that the personal information collected, stored, and processed does not violate GDPR.
Another thing is that all the "GA is illegal" cases have nothing to do with cookies. It's about data transfers between the EU and the US and how Google handles the data. GDPR came into force in 2018, and we will see many more legal privacy cases in the future regarding the ePrivacy Directive. The bulletproof solution at the moment for any web analytics product is to ask for consent in the EU.
I've had talks with EU-based privacy gurus; some think everything is clear, and companies are mean just and reluctant to comply. But most of us agree that the messaging is done very poorly - what to do, how to comply etc.
And yes, giant consent banners break the UX. But at the same time, it's important to remember this data privacy regulation stuff is not about companies. It's about the users. And companies who build tracking tools shouldn't be motivated by the idea, "how can we ignore user consent?".
The other thing, GDPR is not about cookies. The ePrivacy Directive regulates the use of cookies, but it's not about cookies either. Article 5.3. in the ePrivacy Directive says:
"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ..."
So whatever technology you use, you need consent to use web analytics tools. At least at the moment. A draft online suggests there might be a consent exception for audience measurement if the technology used complies with GDPR - again, this has nothing to do with cookies. The point is that the personal information collected, stored, and processed does not violate GDPR.
Another thing is that all the "GA is illegal" cases have nothing to do with cookies. It's about data transfers between the EU and the US and how Google handles the data. GDPR came into force in 2018, and we will see many more legal privacy cases in the future regarding the ePrivacy Directive. The bulletproof solution at the moment for any web analytics product is to ask for consent in the EU.
I've had talks with EU-based privacy gurus; some think everything is clear, and companies are mean just and reluctant to comply. But most of us agree that the messaging is done very poorly - what to do, how to comply etc.
And yes, giant consent banners break the UX. But at the same time, it's important to remember this data privacy regulation stuff is not about companies. It's about the users. And companies who build tracking tools shouldn't be motivated by the idea, "how can we ignore user consent?".
I read 90% of the comments on this and everyone seems unanimously onboard with these annoying banners.
The claim is they save the web. I can’t be the only one that feels these banners are destroying the web experience.
There has to be a better way to improve privacy without simultaneously nuking user experience.
The claim is they save the web. I can’t be the only one that feels these banners are destroying the web experience.
There has to be a better way to improve privacy without simultaneously nuking user experience.
I think you're actually running into and mixing up two opposing requirements:
1. Those who support the tracking and see the banners an imposition of the law. They may come across as supporting the banners because they feel companies should be allowed require customers agree to this, though ultimately they'd rather no banners and to just track as done in the wild west days.
2. Those who support the privacy legislation and feel users should be able to prevent tracking and see the banners as dark pattern coercion so companies can claim compliance. They may come across as supporting the banners because of their stance that companies shouldn't track by default, but ultimately they'd rather there are no banners and either:
(2a) companies just deal with the resulting non-viability of privacy invading business models
(2b) advertising returns to a less privacy invading model as its a zero sum game so if everyone is tracking then you feel you must, but if no one is then advertisers have proven their willingness to accept less invasive models in other fields where more intrusive models are already infeasible (broadcast TV ads aren't yet trying to determine who specifically is watching, the viewability rates of "the side of a bus" must be miniscule compared to web ads, etc.)
1. Those who support the tracking and see the banners an imposition of the law. They may come across as supporting the banners because they feel companies should be allowed require customers agree to this, though ultimately they'd rather no banners and to just track as done in the wild west days.
2. Those who support the privacy legislation and feel users should be able to prevent tracking and see the banners as dark pattern coercion so companies can claim compliance. They may come across as supporting the banners because of their stance that companies shouldn't track by default, but ultimately they'd rather there are no banners and either:
(2a) companies just deal with the resulting non-viability of privacy invading business models
(2b) advertising returns to a less privacy invading model as its a zero sum game so if everyone is tracking then you feel you must, but if no one is then advertisers have proven their willingness to accept less invasive models in other fields where more intrusive models are already infeasible (broadcast TV ads aren't yet trying to determine who specifically is watching, the viewability rates of "the side of a bus" must be miniscule compared to web ads, etc.)
Improved privacy without bad UX is super simple: Have privacy by default, and don't use personal information for things which the user hasn't asked for.
But the metrics/tracking crowd - especially the ad vendors - hate that, and they are more important to most companies/websites than the users.
(It also limits what methods you can use for site improvement, so it's a bit inconvenient for you too.)
But the metrics/tracking crowd - especially the ad vendors - hate that, and they are more important to most companies/websites than the users.
(It also limits what methods you can use for site improvement, so it's a bit inconvenient for you too.)
The issue is, you cannot improve privacy, while keeping the ad dollar flowing. And so, websites annoy you to hell with their banners. The way would be to make web advertisement unprofitable, or to outlaw them. As I don't see either happening, what will happen is clear: websites will annoy as long as people don't go away because of it - same with every other power struggle ever.
the banners hinder reading. Mostly i try to ignore the banners and if it is too obtrusive i'll just leave the site again. The banners are a dark pattern.
Cookie pop-ups are incredibly annoying and greatly harm the usability of the web.
Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere, or the consent UI should be moved to the browser where defaults (accept/reject/ask) can be set for all websites.
Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere, or the consent UI should be moved to the browser where defaults (accept/reject/ask) can be set for all websites.
Reject is the default! That's the point of the law in the first place. If you, for example, blocked every consent dialog from appearing, no website would have legal grounds to track you (except for legitime purposes yada-yada).
> "Reject is the default!"
I wish that was true.
> "If you, for example, blocked every consent dialog from appearing, no website would have legal grounds to track you (except for legitime purposes yada-yada)."
Sounds good to me!
I wish that was true.
> "If you, for example, blocked every consent dialog from appearing, no website would have legal grounds to track you (except for legitime purposes yada-yada)."
Sounds good to me!
> I wish that was true.
Is it? He just said it was and he's right.
Is it? He just said it was and he's right.
If reject was the default (or it could be set globally, in the browser) then we wouldn't need pop-ups.
> Either GDPR should be updated [...] simply make “REJECT” the default
The point people are making in response to your post is that GDPRs default is reject. Not necessarily the implementations used on a website default.
The point people are making in response to your post is that GDPRs default is reject. Not necessarily the implementations used on a website default.
> Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere
That is literally in the law. Article 7.3 https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
--- start quote, emphasis mine ---
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
--- end quote ---
Also, Recital 32: https://gdpr.eu/Recital-32-Conditions-for-consent
And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments.
That is literally in the law. Article 7.3 https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
--- start quote, emphasis mine ---
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
--- end quote ---
Also, Recital 32: https://gdpr.eu/Recital-32-Conditions-for-consent
And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments.
> "That is literally in the law."
No, the law does the opposite. It effectively requires the use of pop-ups to "gain consent", it doesn't ban them. At least, that's how it's been interpreted in practice.
> "And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments."
Absolutely. In general the GDPR is a good thing. But it needs a rework to fix the cookie consent situation.
No, the law does the opposite. It effectively requires the use of pop-ups to "gain consent", it doesn't ban them. At least, that's how it's been interpreted in practice.
> "And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments."
Absolutely. In general the GDPR is a good thing. But it needs a rework to fix the cookie consent situation.
> It effectively requires the use of pop-ups to "gain consent", it doesn't ban them.
Once again: the law isn't about cookie banners. The law is about user data.
That is: if you want to collect more data that is strictly required for the functioning of your business, then you must ask user for consent. Note: the law doesn't care if your business is online, or offline, or a combination thereof. If you set up a corner shop selling bread, and start asking customers for their name and address, you will be subject to the same GDPR provisions as a website.
How difficult is that?
Literally nothing in the law requires cookie banners. The only reason these obnoxious cookie banners exist is because the greedy leeches in our industry cannot live without siphoning your data en masse and selling it to the highest bidder, consequences be damned.
Now. Here's what you said: "Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere"
The law already clearly states: REJECT has to be as simple as giving consent. And the entire industry said: yes, of course, here's a default "accept" with hundreds of pre-checked boxes, and you have to go through every single one of them one by one to reject.
How is that the law's fault?
They cannot ban people from asking users for consent to collect data. However, the law is rather explicit: any person has the right to reject this, the rejecton has to be as easy and clear as accepting, and people cannot be denied service just because they rejected collection of non-necessary data.
As the article above states: once the law started to be enforced, sites started obeying the law, and not flaunting it. Well, they still flaunt it with their "legitimate uses" bullshit, but the tide is ever so slowly turning.
Too bad, even developers are so gullible as to have been tricked into parroting the "law is bad" and "law requires obnoxious cookie banners" nonsense. No, it isn't. No, it doesn't.
Once again: the law isn't about cookie banners. The law is about user data.
That is: if you want to collect more data that is strictly required for the functioning of your business, then you must ask user for consent. Note: the law doesn't care if your business is online, or offline, or a combination thereof. If you set up a corner shop selling bread, and start asking customers for their name and address, you will be subject to the same GDPR provisions as a website.
How difficult is that?
Literally nothing in the law requires cookie banners. The only reason these obnoxious cookie banners exist is because the greedy leeches in our industry cannot live without siphoning your data en masse and selling it to the highest bidder, consequences be damned.
Now. Here's what you said: "Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere"
The law already clearly states: REJECT has to be as simple as giving consent. And the entire industry said: yes, of course, here's a default "accept" with hundreds of pre-checked boxes, and you have to go through every single one of them one by one to reject.
How is that the law's fault?
They cannot ban people from asking users for consent to collect data. However, the law is rather explicit: any person has the right to reject this, the rejecton has to be as easy and clear as accepting, and people cannot be denied service just because they rejected collection of non-necessary data.
As the article above states: once the law started to be enforced, sites started obeying the law, and not flaunting it. Well, they still flaunt it with their "legitimate uses" bullshit, but the tide is ever so slowly turning.
Too bad, even developers are so gullible as to have been tricked into parroting the "law is bad" and "law requires obnoxious cookie banners" nonsense. No, it isn't. No, it doesn't.
> ”They cannot ban people from asking users for consent to collect data.”
Why not? This is exactly what needs to happen. Either that, or allow cookie consent to be granted/declined globally in the browser settings, not with a bespoke, intrusive UI on every. single. damn. website.
Let’s ban cookie pop ups!
Why not? This is exactly what needs to happen. Either that, or allow cookie consent to be granted/declined globally in the browser settings, not with a bespoke, intrusive UI on every. single. damn. website.
Let’s ban cookie pop ups!
> Why not? This is exactly what needs to happen.
No, it's not. Because there are actual legitimate reasons for organisations and businesses to ask for user's consent.
> Either that, or allow cookie consent
You keep missing the simple fact that GDPR is not about cookie consents. How many times do I have to repeat this?
> not with a bespoke, intrusive UI on every. single. damn. website.
Again. In as simple terms as I possibly can:
- GDPR is about user data everywhere, not just in the browsers
- GDPR does not mandate cookie pop ups. This is entirely the work of a greedy industry
- GDPR cannot ban asking for user consent. Because that is a) over-reaching, and b) makes legitimate cases for asking for user consent illegal
- And again. GDPR is not about browsers. GDPR is not about websites. GDPR is not about cookies. GDPR is not about cookie popups
Note: if websites actually respected the law and user privacy, you wouldn't even see those popups. But sure. Tell me how it's the law that is responsible for them.
No, it's not. Because there are actual legitimate reasons for organisations and businesses to ask for user's consent.
> Either that, or allow cookie consent
You keep missing the simple fact that GDPR is not about cookie consents. How many times do I have to repeat this?
> not with a bespoke, intrusive UI on every. single. damn. website.
Again. In as simple terms as I possibly can:
- GDPR is about user data everywhere, not just in the browsers
- GDPR does not mandate cookie pop ups. This is entirely the work of a greedy industry
- GDPR cannot ban asking for user consent. Because that is a) over-reaching, and b) makes legitimate cases for asking for user consent illegal
- And again. GDPR is not about browsers. GDPR is not about websites. GDPR is not about cookies. GDPR is not about cookie popups
Note: if websites actually respected the law and user privacy, you wouldn't even see those popups. But sure. Tell me how it's the law that is responsible for them.
> "You keep missing the simple fact that GDPR is not about cookie consents. How many times do I have to repeat this?"
Fine. That's great: if GDPR is not about cookie consents then let's get rid of the damned pop-ups! If that means no more tracking cookies, then so be it. That's a good thing!
This is no different to the behaviour when a user clicks "reject non essential cookies" and also no different to what Apple already did with apps that accessed advertising tracking IDs on iOS. Facebook complained and lost a little money, but the world didn't end and the sky didn't fall. (iOS users can still choose to let apps track, but that UI is provided by the OS, not the app, and can be set globally).
> "makes legitimate cases for asking for user consent illegal"
I'm not at all suggesting that consent shouldn't still be asked for in situations where it's legitimate, like storing actual user personal data that they provide when signing up for an account, for example.
But simply visiting a website should not be considered a legitimate reason to obtain or store a user's data. Therefore there is no reason to ask for consent, and the practice should be banned.
Fine. That's great: if GDPR is not about cookie consents then let's get rid of the damned pop-ups! If that means no more tracking cookies, then so be it. That's a good thing!
This is no different to the behaviour when a user clicks "reject non essential cookies" and also no different to what Apple already did with apps that accessed advertising tracking IDs on iOS. Facebook complained and lost a little money, but the world didn't end and the sky didn't fall. (iOS users can still choose to let apps track, but that UI is provided by the OS, not the app, and can be set globally).
> "makes legitimate cases for asking for user consent illegal"
I'm not at all suggesting that consent shouldn't still be asked for in situations where it's legitimate, like storing actual user personal data that they provide when signing up for an account, for example.
But simply visiting a website should not be considered a legitimate reason to obtain or store a user's data. Therefore there is no reason to ask for consent, and the practice should be banned.
> I'm not suggesting that consent shouldn't still be asked for in cases where it's legitimate, like storing actual user personal data that they provide when signing up for an account, for example.
Guess what. In this case the you don't have to ask for user consent. Because this data is strictly essential to site functionality.
> But simply visiting a website should not be considered a legitimate reason to obtain or store a user's data.
Guess what. It's exactly what GDPR is saying.
Guess what. In this case the you don't have to ask for user consent. Because this data is strictly essential to site functionality.
> But simply visiting a website should not be considered a legitimate reason to obtain or store a user's data.
Guess what. It's exactly what GDPR is saying.
> "Guess what. It's exactly what GDPR is saying."
But that is not how it is being interpreted in practice.
Clearly we just need to go one step further and explicitly say "it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website". Problem solved.
But that is not how it is being interpreted in practice.
Clearly we just need to go one step further and explicitly say "it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website". Problem solved.
> But that is not how it is being interpreted in practice.
No. In practice it's actually being interpreted correctly. What is being willfully misinterpreted is how easily a user can opt-out. Because the industry wants to remain exactly the same: it wants to siphon user data and sell it en masse.
The existing pop ups that use dark patterns to make the user click "accept" are already illegal.
> it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website
So it won't be a pop-up. It will be an interstitial page. You keep focusing in the entirely wrong issue and blaming the law for it.
So, we've banned pop ups. Now what? Now every time you visit a web site, you get a full page asking for your consent.
Then you'll blame the law and ask to ban interstitials.
Ok. We'll ban interstitials. Now it will be banners. Or every second paragraph in text. Videos. Images.
Where the law just says: do not collect user data without user's consent, and the user isn't obliged to give you that consent.
And the industry replies: screw this, we demand this data and make users' life hell for it.
Somehow gullible devs are now fully convinced that the law requires all this.
No. In practice it's actually being interpreted correctly. What is being willfully misinterpreted is how easily a user can opt-out. Because the industry wants to remain exactly the same: it wants to siphon user data and sell it en masse.
The existing pop ups that use dark patterns to make the user click "accept" are already illegal.
> it is not permitted for consent for tracking cookies to be obtained by the use of a pop-up UI that appears when a user visits a website
So it won't be a pop-up. It will be an interstitial page. You keep focusing in the entirely wrong issue and blaming the law for it.
So, we've banned pop ups. Now what? Now every time you visit a web site, you get a full page asking for your consent.
Then you'll blame the law and ask to ban interstitials.
Ok. We'll ban interstitials. Now it will be banners. Or every second paragraph in text. Videos. Images.
Where the law just says: do not collect user data without user's consent, and the user isn't obliged to give you that consent.
And the industry replies: screw this, we demand this data and make users' life hell for it.
Somehow gullible devs are now fully convinced that the law requires all this.
I’m not necessarily blaming the law, but saying that a new law (or change to the existing one) is needed to ban cookie pop-ups.
It’s clear at this point that the problem is not going to go away without intervention. The industry isn’t going to fix itself.
Also, it’s unfair to blame developers here. Devs don’t have some perverse desire to create annoying pop-ups. They’re being told to do it by management and legal teams, because that’s how the GDPR has been interpreted.
> ”So it won't be a pop-up. It will be an interstitial page.”
Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website”
It’s clear at this point that the problem is not going to go away without intervention. The industry isn’t going to fix itself.
Also, it’s unfair to blame developers here. Devs don’t have some perverse desire to create annoying pop-ups. They’re being told to do it by management and legal teams, because that’s how the GDPR has been interpreted.
> ”So it won't be a pop-up. It will be an interstitial page.”
Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website”
> It’s clear at this point that the problem is not going to go away without intervention. The industry isn’t going to fix itself.
Indeed. The main problem with GDPR is that enforcement has been slow. And that the industry has blamed its own behavior on the law.
As the article shows, the tide is ever so slowly turning.
> Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website”
And how, in this case, do you ask for consent for legitimate reasons?
Indeed. The main problem with GDPR is that enforcement has been slow. And that the industry has blamed its own behavior on the law.
As the article shows, the tide is ever so slowly turning.
> Ok, so you phrase it more generally: “it is not permitted for consent for tracking cookies to be obtained when a user visits a website”
And how, in this case, do you ask for consent for legitimate reasons?
The nightly build of Brave will automatically manage the banners for you.
Great! I hope all browsers get this feature.
> Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere
If you ban asking for consent, "reject" is not the default, it is the only option left. If you specifically ban "pop-ups" (or modals), I believe websites will use a standalone page instead of a modal to ask for consent. Same but different.
If you ban asking for consent, "reject" is not the default, it is the only option left. If you specifically ban "pop-ups" (or modals), I believe websites will use a standalone page instead of a modal to ask for consent. Same but different.
noyb bragging about having forced sites to add a "reject all" button when it was partly their fault that cookie banners exist in the first place.
kybernetyk(2)
The EU cookie legislation was a mistake made by tech-illiterate bureaucrats that ruined the Web to a large degree. It's something that could've been built in to the browser. I have a hard time understanding why one would dedicate their time to this.
You are confusing the law with the intentionally bad implementation.
And it was implemented in the browser as Do Not Track but websites ignored it
https://en.m.wikipedia.org/wiki/Do_Not_Track
And it was implemented in the browser as Do Not Track but websites ignored it
https://en.m.wikipedia.org/wiki/Do_Not_Track
And the bad (and actually non-compliant) implementations are getting cracked down on, but that just takes time. But the article mentions an example:
> the French CNIL introduced guidelines and required Google to introduce a "reject" button, which was also seen as a sign to many companies to adjust their banners and lead to major measuarable improvements in France.
> the French CNIL introduced guidelines and required Google to introduce a "reject" button, which was also seen as a sign to many companies to adjust their banners and lead to major measuarable improvements in France.
The problem with DNT is that no one wants tracking, and trackers still want to track. So browsers and users have every reason to always have it set. And trackers have no incentive to acknowledge that and shut their business down.
>And it was implemented in the browser as Do Not Track but websites ignored it
Implemented in the browser AND mandated by law to be respected - in other words, similar enforcement as the current cookie notice, but with a uniform interface and central control.
Implemented in the browser AND mandated by law to be respected - in other words, similar enforcement as the current cookie notice, but with a uniform interface and central control.
No he isn't. The law is precisely what allows the intentionally bad implementations. Anyone could have foreseen this. Hell we already knew this would happen based on the earlier cookie laws.
The EU should have mandated an interaction-free solution like Do Not Track. They could have.
The EU should have mandated an interaction-free solution like Do Not Track. They could have.
There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it, since that would probably be considered over-reach: if Web sites want to break their UI and annoy their users, they're free to do so.
Consent for personal data is implied when performing services for a user (e.g. logging in, shopping carts, remembering high-scores, etc.).
Interactions are only needed when consent is not implied; i.e. when the personal data is not performing a service for a user; i.e. when the user is the product, not the customer.
Consent for personal data is implied when performing services for a user (e.g. logging in, shopping carts, remembering high-scores, etc.).
Interactions are only needed when consent is not implied; i.e. when the personal data is not performing a service for a user; i.e. when the user is the product, not the customer.
>There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it
If it's not mandated it's not a solution, it's more like a pacifist asking for peace in the middle of WWII
>The EU don't mandate it, since that would probably be considered over-reach
I don't think that's the reason, as it wouldn't be any more overeach than mandating the current cookie notice (or, in another domain, USB-C for mobile phones).
If it's not mandated it's not a solution, it's more like a pacifist asking for peace in the middle of WWII
>The EU don't mandate it, since that would probably be considered over-reach
I don't think that's the reason, as it wouldn't be any more overeach than mandating the current cookie notice (or, in another domain, USB-C for mobile phones).
> than mandating the current cookie notice
That's not mandated. You need to notify the users about third parties getting their data and allow them to opt-out. The cookie notice is just a common, terrible implementation of that requirement.
> or, in another domain, USB-C for mobile phones
They didn't do that either. They forced the relevant companies to agree to a standard until next review and the agreement was USB-C. No specific solution was mandated.
That's not mandated. You need to notify the users about third parties getting their data and allow them to opt-out. The cookie notice is just a common, terrible implementation of that requirement.
> or, in another domain, USB-C for mobile phones
They didn't do that either. They forced the relevant companies to agree to a standard until next review and the agreement was USB-C. No specific solution was mandated.
> I don't think that's the reason, as it wouldn't be any more overeach than mandating the current cookie notice
As viraptor says, cookie banners are not mandated; they're a crappy UX invented by ad companies.
In any case, regardless of one's personal opinions on user tracking, I don't understand how 'cookie notices' are at all equivalent to a flat-out ban on all tracking by anyone ever.
As viraptor says, cookie banners are not mandated; they're a crappy UX invented by ad companies.
In any case, regardless of one's personal opinions on user tracking, I don't understand how 'cookie notices' are at all equivalent to a flat-out ban on all tracking by anyone ever.
1. GDPR isn't just about cookies. It's about your data in general. So it covers even offline interactions.
2. Governments shouldn't mandate solutions. Instead, EU stipulated a requirement. And industry as a whole decided that they will break the law for as long as possible until the governments chase after them. In the process the industry has convinced gullible developers that it is the law that it is bad, and not the greedy leeches who flaunt it.
2. Governments shouldn't mandate solutions. Instead, EU stipulated a requirement. And industry as a whole decided that they will break the law for as long as possible until the governments chase after them. In the process the industry has convinced gullible developers that it is the law that it is bad, and not the greedy leeches who flaunt it.
>Governments shouldn't mandate solutions
Huh? That's what we have governments for.
Huh? That's what we have governments for.
There is a YouTube channel called Technology Connections which has a video about American car headlights: https://www.youtube.com/watch?v=c2J91UG6Fn8 which I think illustrated a good example of the difference between mandating a solution, and mandating requirements.
Considering car headlights. Obviously there are some requirements we should make - they need to be bright enough to safely light-up the road. They should not blind oncoming drivers. They need to be reasonably safe in the event of a collision.
Between the sixties and 1984, the government of the USA mandated a solution. Basically one model of headlights was permitted (with a few minor variations introduced over time). If you look at all car models from this time they have a similar appearance, and the same headlights are still in use in some commercial vehicles today.
In most European nations (and other parts of the world) instead a requirement, or series of requirements were made. If you met these standards for lighting level, glare, etc. your headlight was permitted.
This led to European and Japanese cars have very varied headlight models, while most American cars were forced to stick to the same old style. This meant that American drivers missed out on innovations in this space.
Mandates can very easily become out-dates. Whereas well written requirements are much more timeless.
Considering car headlights. Obviously there are some requirements we should make - they need to be bright enough to safely light-up the road. They should not blind oncoming drivers. They need to be reasonably safe in the event of a collision.
Between the sixties and 1984, the government of the USA mandated a solution. Basically one model of headlights was permitted (with a few minor variations introduced over time). If you look at all car models from this time they have a similar appearance, and the same headlights are still in use in some commercial vehicles today.
In most European nations (and other parts of the world) instead a requirement, or series of requirements were made. If you met these standards for lighting level, glare, etc. your headlight was permitted.
This led to European and Japanese cars have very varied headlight models, while most American cars were forced to stick to the same old style. This meant that American drivers missed out on innovations in this space.
Mandates can very easily become out-dates. Whereas well written requirements are much more timeless.
> Governments shouldn't mandate solutions.
They do all the time. USB-C is probably the most recent example but there are a gazillion standards that are mandated by governments. Electrical sockets, traffic signalling, seat belt design, etc.
It's not some weird outlier for them to say "you have to do it like this".
They do all the time. USB-C is probably the most recent example but there are a gazillion standards that are mandated by governments. Electrical sockets, traffic signalling, seat belt design, etc.
It's not some weird outlier for them to say "you have to do it like this".
There is no cookie legislation. There's data protection and privacy legislation. Cookies and banners are just how industry is dealing with it because they're dragged kicking and screaming towards what's actually slowly being enforced.
If you really believe it's a cookie legislation from tech-illiterate, I recommend reading the document. You're in for a surprise. (in a good way)
If you really believe it's a cookie legislation from tech-illiterate, I recommend reading the document. You're in for a surprise. (in a good way)
The part I find funny about people calling the bureaucrats tech illiterate, is so many users on tech forums are illiterate on the topic themseleves, e.g., believing deleting cookies is a solution to tracking.
This is probably the second biggest win by the spyware industry, the first being making spyware effectively legal (by virtue of lack of enforcement - which persists even today with the GDPR) and socially-acceptable to begin with. They've now managed to convince a significant chunk of tech people that merely deleting cookies is totally enough to defeat tracking.
One of the most painful parts is sites that don't even seem to remember your choices. The number of times i've said 'ok' to the canonical ubuntu cookies is infuriating. If i've accepted cookies, please at least use a long held one to remember it!
The ePrivacy Directive originally included this, but was watered down after lobbying from ad vendors based on my understanding.
> It's something that could've been built in to the browser.
It was; nobody cared (due to lack of any legislation/enforcement); it died. https://en.wikipedia.org/wiki/P3P
It was; nobody cared (due to lack of any legislation/enforcement); it died. https://en.wikipedia.org/wiki/P3P
My favourite part of P3P was when Google started returning a P3P header that just had the string "This is not a P3P policy", intentionally letting browsers consider its presence a declaration of P3P compliance while declaring non-compliance in English. Real, refined, stylish evil. I couldn't help but be impressed.
The law was lacking in enforcement mostly. Sure, it could have been better. But if it had been as technically specific as enforcing a browser standard, then it might have been worse or less effective. After all, lawmakers are tech-illiterate.
[deleted]
Because otherwise a business would be violating a law if they serve European customers?
The post you’re replying to mentions many reasons why that law is ill considered.
It might be but it’s still the law?
I don't see any reasons in that post as to why the law is ill conceived.
100%
I think the underlying reason is that most people don’t consider trade-offs.
“Yes, great let’s do the cookie banner thing. But before, let’s also consider how this could be a bad idea?”
“Yes, great let’s ban plastic straws. But also let’s consider what we get instead and if that alternative is really better.”
These conversations rarely take place in my experience. You can still decide to do it, but at least you are aware of the consequences and are able to communicate them properly to the public, to your employees etc
I think the underlying reason is that most people don’t consider trade-offs.
“Yes, great let’s do the cookie banner thing. But before, let’s also consider how this could be a bad idea?”
“Yes, great let’s ban plastic straws. But also let’s consider what we get instead and if that alternative is really better.”
These conversations rarely take place in my experience. You can still decide to do it, but at least you are aware of the consequences and are able to communicate them properly to the public, to your employees etc
In this case, the 'dystopian' situation is not bad, if you consider tracking a bad (lets say 'evil' for exagerated effect) thing.
It means that companies that want to do 'evil' are forced to ask their customers. For now most customers find the question annoying, and some go for the easy option of 'fine do some evil to me' out of convenience. But in the meantime, people are slowly building an awareness of this evil happening to them.
For now the evil is profitable enough with the few people that click agree to evil out of convenience. But people are now being faced with these decisions and will slowly turn against this evil. As this awareness builds, people will start disliking the companies. And as the law gets enforced better, people will find it easier to say 'no' to evil. At some point, this will make the extra friction of cookie acceptance screens no longer worth it, and we will be in a better place.
(Droping the 'evil' shtick here) All the law says is 'if you want to do this generally bad thing, you gotta ask people and you can't trick or coerce them'. This is slowly going to stop the generally bad thing from happening. The alternative "don't do this bad thing" would have a less annoying transition. But that would have been an over-reaching law that doesn't leave space for the few times where the thing is actually not bad.
A more interesting question is 'without surveillance supported adds, how will the internet actually work'. Especially given that the EU laws are aimed at effectively killing the surveillance supported add industry. This is not something the EU laws have an answer to. I find this the most worrying question, though I see little room for a new way to finance the internet that is worse then surveillance supported adds.
It means that companies that want to do 'evil' are forced to ask their customers. For now most customers find the question annoying, and some go for the easy option of 'fine do some evil to me' out of convenience. But in the meantime, people are slowly building an awareness of this evil happening to them.
For now the evil is profitable enough with the few people that click agree to evil out of convenience. But people are now being faced with these decisions and will slowly turn against this evil. As this awareness builds, people will start disliking the companies. And as the law gets enforced better, people will find it easier to say 'no' to evil. At some point, this will make the extra friction of cookie acceptance screens no longer worth it, and we will be in a better place.
(Droping the 'evil' shtick here) All the law says is 'if you want to do this generally bad thing, you gotta ask people and you can't trick or coerce them'. This is slowly going to stop the generally bad thing from happening. The alternative "don't do this bad thing" would have a less annoying transition. But that would have been an over-reaching law that doesn't leave space for the few times where the thing is actually not bad.
A more interesting question is 'without surveillance supported adds, how will the internet actually work'. Especially given that the EU laws are aimed at effectively killing the surveillance supported add industry. This is not something the EU laws have an answer to. I find this the most worrying question, though I see little room for a new way to finance the internet that is worse then surveillance supported adds.
"the cookie banner thing" was essentially created by the ad / tracking industry, so aim your annoyance in the right direction.
The EU did not mandate a cookie banner.
The law requires you to ask for consent before collecting data you do not strictly need. Websites decided that they'd rather bother their visitors with cookie banners than stop collecting their data.
Hacker News does not have a cookie banner - despite using cookies. It doesn't need to ask for consent, because it has no intention of abusing your data.
The law requires you to ask for consent before collecting data you do not strictly need. Websites decided that they'd rather bother their visitors with cookie banners than stop collecting their data.
Hacker News does not have a cookie banner - despite using cookies. It doesn't need to ask for consent, because it has no intention of abusing your data.
Most tracking now comes from the "legitimate interest" purposes that you need to actively object to, which is buried in a tertiary hidden panel or not available at all, or even forces you to object to several dozens of trackers one by one.