What Do You Agree to When You Accept All Cookies(conradakunga.com)
conradakunga.com
What Do You Agree to When You Accept All Cookies
http://www.conradakunga.com/blog/what-do-you-actually-agree-to-when-you-accept-all-cookies/
168 comments
> Another possibility is, that the browser could, in a standard header, with a bunch of standardized flags, tell what the site may or may not do with the data they gather about the surfer.
There was a W3C standard called P3P which is similar to what you describe. It was implemented by Internet Explorer, but fell into disuse long before cookie notices became common. Bringing back something like that would be an improvement over having to deal with cookie banners per site.
There was a W3C standard called P3P which is similar to what you describe. It was implemented by Internet Explorer, but fell into disuse long before cookie notices became common. Bringing back something like that would be an improvement over having to deal with cookie banners per site.
It fell into disuse as compliance was strictly voluntary on the part of websites. So they did not comply.
In an international internet, how would any non-technical requirement get enforced? Legal is easy to skip. Just run the website by a subsidiary housed in a less regulated country.
Isn't that just an "in theory" though? In practice, a ton of sites have these cookie warnings because the EU mandated them. If a large enough legal body mandated that websites obey prescriptive privacy statements from their users, most legitimate sites probably would.
The same way GDPR is enforced. Given the cookie popups I'm seeing everywhere, it doesn't seem to be toothless.
Realistically, if the EU were to impose such a rule, then any ad company doing business in the EU would have to follow it. Thus, any web site deriving any significant revenue from EU advertisers would have to follow it. I'd strongly assume that it's not possible to effectively monetize EU eyeballs without EU advertisers. Of course, anything operated by a EU company or hosted in the EU would also be subject to these rules.
While some local US news would certainly take the "we block all traffic from the EU" approach to avoid dealing with it, the advertising and tracking landscape would quickly and drastically improve.
If now, for example, California would also decide to copy these rules, this would very quickly be the worldwide standard.
Realistically, if the EU were to impose such a rule, then any ad company doing business in the EU would have to follow it. Thus, any web site deriving any significant revenue from EU advertisers would have to follow it. I'd strongly assume that it's not possible to effectively monetize EU eyeballs without EU advertisers. Of course, anything operated by a EU company or hosted in the EU would also be subject to these rules.
While some local US news would certainly take the "we block all traffic from the EU" approach to avoid dealing with it, the advertising and tracking landscape would quickly and drastically improve.
If now, for example, California would also decide to copy these rules, this would very quickly be the worldwide standard.
That isn't much of a solution if you do business in the foreign country whose requirements are being circumvented.
Isn't it also possible that the site will not comply if you ask them to "not use cookies for advertising" via their form?
There's also DNT (do not track) where the standards group was disbanded[1] in early 2019
[1] https://github.com/w3c/dnt/commit/5d85d6c3d116b5eb29fddc6935...
[1] https://github.com/w3c/dnt/commit/5d85d6c3d116b5eb29fddc6935...
A much more naive version of this, the Do Not Track header, was removed from major browsers (partly) because it was actually being used for fingerprinting. I strongly suspect a less naive version would be subject to more abuse: as it gets more granular it becomes a fingerprint all on its own.
I understand that you’re suggesting pairing it with legal force, but I also highly doubt that would or could be effective in any kind of consistent way.
I understand that you’re suggesting pairing it with legal force, but I also highly doubt that would or could be effective in any kind of consistent way.
I think another reason Do Not Track failed is that advertisers (e.g. Google) didn't like it. Microsoft setting Do Not Track on by default in Internet Explorer was likely the death knell.
The on-by-default setting was technically a violation of the standard, which meant that participants felt they could ignore the setting for IE, which didn't help the initiative for sure.
The industry-led-initiatives are all basically bad, for the obvious reasons. So many of them amount to telling ad networks whether or not the massive amount of data they have collected about you should be part of the consideration for what ads to show (for now) — many offer no possible way to opt out of recording and storing such data in the first place.
This is a situation where legislation is probably the only answer.
The industry-led-initiatives are all basically bad, for the obvious reasons. So many of them amount to telling ad networks whether or not the massive amount of data they have collected about you should be part of the consideration for what ads to show (for now) — many offer no possible way to opt out of recording and storing such data in the first place.
This is a situation where legislation is probably the only answer.
>The on-by-default setting was technically a violation of the standard
A standard written for advertisers by advertisers. This is the problem. There are technical solutions, but the biggest advertiser (Google) makes the browser. This is the same as "the revolution will not be televised." The adversary controls the medium.
A standard written for advertisers by advertisers. This is the problem. There are technical solutions, but the biggest advertiser (Google) makes the browser. This is the same as "the revolution will not be televised." The adversary controls the medium.
Attach it with legal force and money, as in allow users to sue for violations, and explicitly permit class actions with the definition of class (all people similarly situated; definition frequently abused by defendants) to be anyone with a browser.
Needs more work,, but the concept is that it needs to incentivize developers to develop track-the-tracker technologies that will catch violators, which then leads fairly directly to a profitable private suit (instead of relying on the overworked govt bureaus to do it).
Needs more work,, but the concept is that it needs to incentivize developers to develop track-the-tracker technologies that will catch violators, which then leads fairly directly to a profitable private suit (instead of relying on the overworked govt bureaus to do it).
For example, for cookies, legally force, with the cookie (with a standard protocol), transmit of "intent", like cross-site tracking, whether it is used for advertisement or something else, whether it may be shared with third parties, etc. Then the browser would simply not accept cookies with intent the surfer disagrees with.
And then you get Facebook spending millions of dollars taking out full-page ads in newspapers telling people that you are an evil demon who kicks puppies and hates small businesses.
(Ever notice that when Facebook wants to reach the most people, and the most important people, it uses newspapers, rather than its own platform?)
And then you get Facebook spending millions of dollars taking out full-page ads in newspapers telling people that you are an evil demon who kicks puppies and hates small businesses.
(Ever notice that when Facebook wants to reach the most people, and the most important people, it uses newspapers, rather than its own platform?)
> (Ever notice that when Facebook wants to reach the most people, and the most important people, it uses newspapers, rather than its own platform?)
They do this when they want to get the attention of legislators, or the gatekeepers/editors of legacy corporate media outlets.
They do this when they want to get the attention of legislators, or the gatekeepers/editors of legacy corporate media outlets.
Who, in your opinion, are "the gatekeepers/editors of legacy corporate media outlets"?
The anti apple ads were run here:
The New York Times, Wall Street Journal, and Washington Post
https://www.google.com/amp/s/www.macobserver.com/news/facebo...
The New York Times, Wall Street Journal, and Washington Post
https://www.google.com/amp/s/www.macobserver.com/news/facebo...
There aren't any anti-apple ads in your google amp link. Not even when I load them up in amp-player. Maybe macobserver.com fixed it, but I doubt it.
I guess that proves his point - Facebook itself admits how worthless their advertising platform is when it come to influencing important/powerful people.
Right, but most of the time I don't want to influence powerful people. I want to sell shoes.
One doesn't exclude the other. Facebook is incredibly valuable.
If they wanted to, Facebook could target directly 1:1 to decision makers on their platforms with their own data. It would probably be creepy though instead of just doing a blanket all of DC type promoted post.
If they wanted to, Facebook could target directly 1:1 to decision makers on their platforms with their own data. It would probably be creepy though instead of just doing a blanket all of DC type promoted post.
Sure, but I don't think FB was ever optimizing for that case. Businesses buying ads to get the masses to buy their stuff is far more lucrative.
How would it look if Facebook started pushing it's own political propaganda in ads on their own site?
Honest... about their scuzzines.
Like it was eating its own dogfood.
Personally, I find that this [0] doesn't break many sites at all, but messes with cookies to an appreciable extent. Combine this to an extensive use of that [1] and clearing your cache and cookies every day, and I think you're in decent shape while some heavy and heavily lobbied government body inches towards doing something about it.
[0] uBlock Origin
https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...
[1] Firefox Multi-Account Containers
https://addons.mozilla.org/en-US/firefox/addon/multi-account...
[0] uBlock Origin
https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...
[1] Firefox Multi-Account Containers
https://addons.mozilla.org/en-US/firefox/addon/multi-account...
I went a step further and installed Temporary Containers. Unless the domain is a special one (and goes in a long-lived container), a new tab cannot share any content with other tabs. Whenever the tab is closed all site-related content is removed.
It's still a bit wonky because some sites do redirections, and it's not properly caught (unless there's some option I missed)
The next step is to disable _all_ cookies, even first-party, by default (unless I have a special relationship with the domain of course). It's working surprisingly well and I believe this should be the default.
It's still a bit wonky because some sites do redirections, and it's not properly caught (unless there's some option I missed)
The next step is to disable _all_ cookies, even first-party, by default (unless I have a special relationship with the domain of course). It's working surprisingly well and I believe this should be the default.
I did this too. Another pain point I've found is when logging into websites with github or other oauth provider requires grouping that website in with the services perminent container.
> clearing your cache and cookies every day
A good extension for the cookie part is https://github.com/Cookie-AutoDelete/Cookie-AutoDelete - it deletes all cookies from a site after you close the tab.
A good extension for the cookie part is https://github.com/Cookie-AutoDelete/Cookie-AutoDelete - it deletes all cookies from a site after you close the tab.
You’re on the right track. Browser makers should be on the users side and websites should have to honour users preferences which are configured and sent to sites in the headers.
Completely agree. At some point, browser ceased to be user agents. They became mere viewers of content.
No one wants to be tracked though but they want the website to work. “All cookies” seem to play with that line. Don’t track me but allow website to work must be enforced on the client side. It’s what we do with uBlock origin and things in the like.
The new GDPR cookie banners are much better.
They are required to have a button to let you manage preferences, and are required to allow you to disable all cookies that aren't necessary for the site to function.
So, on any GDPR cookie banner I always click the smaller "manage" link instead of the "accept all" button. On the manage page, disable every option provided, then close the modal. I've never had a site that offered this kind of banner break in any way because of the disabled cookies.
They are required to have a button to let you manage preferences, and are required to allow you to disable all cookies that aren't necessary for the site to function.
So, on any GDPR cookie banner I always click the smaller "manage" link instead of the "accept all" button. On the manage page, disable every option provided, then close the modal. I've never had a site that offered this kind of banner break in any way because of the disabled cookies.
You probably have had sites that either had no such options, or stuffed some tracking into required/legitimate interest/essential sections and tracked you anyway however.
I probably have.
And I haven't paid close attention, as I'm an American citizen and couldn't pursue sites over such a blatant violation of the law.
Were I a European citizen, however, I would watch extremely closely and absolutely be bringing complaints against sites that did that.
And I haven't paid close attention, as I'm an American citizen and couldn't pursue sites over such a blatant violation of the law.
Were I a European citizen, however, I would watch extremely closely and absolutely be bringing complaints against sites that did that.
This is more clicks, is often broken, and even if the button exist it may be tiny and hidden at the bottom of the list of all partners.
If I just clicked a link to a random article from search or social media, I'm not spending a full minute getting past the prompt on a website I'll probably never visit again. I'll click accept, and make sure my browser is loaded with all possible privacy extensions so none of it works.
If I just clicked a link to a random article from search or social media, I'm not spending a full minute getting past the prompt on a website I'll probably never visit again. I'll click accept, and make sure my browser is loaded with all possible privacy extensions so none of it works.
> all cookies that aren't necessary for the site to function
You know what is necessary for a site to function? Revenue. Therefore advertising cookies are necessary for the site to function and we shouldn't need these banners.
You know what is necessary for a site to function? Revenue. Therefore advertising cookies are necessary for the site to function and we shouldn't need these banners.
That's great and all, but then they're blatantly violating the clearly written rules of GDPR.
I'm an American citizen, so I have no real recourse with that, but their European citizens can bring the case to a regulator and they could very well be fined.
That interpretation goes against the spirit, and the very plain letter of the GDPR regulations.
That dog don't hunt.
I'm an American citizen, so I have no real recourse with that, but their European citizens can bring the case to a regulator and they could very well be fined.
That interpretation goes against the spirit, and the very plain letter of the GDPR regulations.
That dog don't hunt.
I'm aware Europe wouldn't actually accept this argument, it's just another reason I view GDPR as a blight on the web.
I mean, they rightly wouldn't accept the argument, because it's a poor argument given the protections that Europe has decided should exist for the privacy of individuals.
I happen to agree with the European values more than I agree with your values.
My data privacy should be a more important and more fundamental right than your ad revenue.
I happen to agree with the European values more than I agree with your values.
My data privacy should be a more important and more fundamental right than your ad revenue.
Very clever, everyone else who didn't want to comply with the rules had the same thought.
However:
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects [1]
Section 3.3, Paragraphs 51-53:
> 51. Online behavioural advertising, and associated tracking and profiling of data subjects, is often used to finance online services. WP29 has previously stated its view on such processing, stating
> > [contractual necessity] is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his clickstream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example
> 52. As a general rule, processing of personal data for behavioural advertising is not necessary for the performance of a contract for online services. Normally, it would be hard to argue that the contract had not been performed because there were no behavioural ads.This is all the more supported by the fact that data subjects have the absolute right under Article 21 to object to processing of their data for direct marketing purposes
> 53. Further to this, Article 6(1)(b) cannot provide a lawful basis for online behavioural advertising simply because such advertising indirectly funds the provision of the service. Although such processing may support the delivery of a service, this in itself is not sufficient to establish that it is necessary for the performance of the contract at issue.
[1]: https://edpb.europa.eu/our-work-tools/our-documents/guidelin...
However:
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects [1]
Section 3.3, Paragraphs 51-53:
> 51. Online behavioural advertising, and associated tracking and profiling of data subjects, is often used to finance online services. WP29 has previously stated its view on such processing, stating
> > [contractual necessity] is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his clickstream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example
> 52. As a general rule, processing of personal data for behavioural advertising is not necessary for the performance of a contract for online services. Normally, it would be hard to argue that the contract had not been performed because there were no behavioural ads.This is all the more supported by the fact that data subjects have the absolute right under Article 21 to object to processing of their data for direct marketing purposes
> 53. Further to this, Article 6(1)(b) cannot provide a lawful basis for online behavioural advertising simply because such advertising indirectly funds the provision of the service. Although such processing may support the delivery of a service, this in itself is not sufficient to establish that it is necessary for the performance of the contract at issue.
[1]: https://edpb.europa.eu/our-work-tools/our-documents/guidelin...
what about an even simpler mechanism - a website offers cookies to the browser, and the browser can choose to either store or not store that cookie. if the browser chooses not to store the cookie, it's up to the website to inform the user that their browser has rejected the cookie and explain what functionality won't be provided.
Would making all HTTP requests embed a header with a CCPA / GPDR claim be binding? It is as verifiable as any request through their form... its my original connection, so if they associate tracking data with me then they must associate this with me as well. Businesses should agree to my terms to make socket connections to me, else I should be able to see them in court. Proliferation is one way to end the modern shitty tracking madness.
> x-ccpa I do not consent to the sale or disclosure of my personal data and demand the deletion of my personal data per Californa CIV 1798.120, 1798.121, and 1798.105
> x-ccpa I do not consent to the sale or disclosure of my personal data and demand the deletion of my personal data per Californa CIV 1798.120, 1798.121, and 1798.105
At a basic level, you shouldn't have to declare that you haven't agreed to something. You have only agreed to it if you actually do something to agree to it. The only advantage this could possibly have is if the web sites stop asking you to agree if you tell them in advance that you won't. However, I can't see that it would be illegal for them to ask anyway, so they will.
Secondly, this is another thing that would be used to fingerprint the web browser.
Secondly, this is another thing that would be used to fingerprint the web browser.
Legally bound under whose laws?
We sometimes like to pretend that if a law is in force somewhere, it's in force everywhere, but that isn't the case. Otherwise, I'd be in serious trouble for saying I support Hong Kong independence. So you're creating these massively granular permissions and then passing some law, somewhere, saying they can't be used to fingerprint, but that's precisely what they will be used for everywhere the law isn't in force, which will likely be most of the world.
We sometimes like to pretend that if a law is in force somewhere, it's in force everywhere, but that isn't the case. Otherwise, I'd be in serious trouble for saying I support Hong Kong independence. So you're creating these massively granular permissions and then passing some law, somewhere, saying they can't be used to fingerprint, but that's precisely what they will be used for everywhere the law isn't in force, which will likely be most of the world.
I said the same thing in a recent thread about cookies, and someone pointed out that there had been some kind of proposal along these lines, but it hadn't gotten any traction. I don't recall the name of it tho. (it wasn't Do Not Track, it was more complex, where cookies had some kind of "intent"/category associated with them).
Microsoft tried this 20 years ago with P3P: https://en.wikipedia.org/wiki/P3P
It's really really hard to come up with a machine readable code that encapsulates what each cookie means and does.
Also obviously true bad actors would just lie.
It's really really hard to come up with a machine readable code that encapsulates what each cookie means and does.
Also obviously true bad actors would just lie.
In practice, this is what most people do: click "accept" to make the prompt go away, and use extensions to block the tracking scripts and cookies...
eventually all sessions will have to operate like they are in a private window keeping the cookies permanently isolated to the host site visited and quarantine any third party cookies perhaps even find a means to spoof them.
in effect our browsers will need a db type tech to manage cookies and only serve them back when appropriate. a lot of what sites want to preserve for us; log in and such; can easily be done without cookies
in effect our browsers will need a db type tech to manage cookies and only serve them back when appropriate. a lot of what sites want to preserve for us; log in and such; can easily be done without cookies
Now we are back to setting the evil bit on IP packets? Bad behavior will flourish until there are penalties commensurate with the benefits obtained.
I just tell my browser to discard all cookies at the end of every session (with a list of sites to keep).
Take a look at Global Privacy Control (GPC) which aims to do similar to what you’re describing, and is legally binding under CCPA and could be under GDPR too: https://globalprivacycontrol.org/
[deleted]
The most egregious violation I've seen is weather.com's cookie process. Go to https://weather.com/en-GB/ and click "Proceed with required cookies only". It's almost theatrical: first a spinning loading wheel, then the message "We are processing your request, this could take up to a few minutes to process." Then wait for their "Processing 0%" countdown take a few minutes to reach 100%. Anyone would think they are trying to discourage people from choosing that option?
Looking at the network requests when you hit that button it seems to be hitting a lot of tracking providers opt out API endpoints. Which is good I suppose, though better not to even include their scripts until you agree to it
Just the fact that it sends out-out HTTP calls to all those providers means that they now know that you are using that website. It's terrible design.
Pretty sure it's designed with that in mind...
The saying not to attribute to malice what could be explained by incompetance only works if the actor isn't generally malicious. AdTech definitely is.
The saying not to attribute to malice what could be explained by incompetance only works if the actor isn't generally malicious. AdTech definitely is.
So if I opt-out, it (basically) sends my ip address to lots of trackers?
Why? That sounds illegal.
Why doesn't it simply not load the trackers?
Why? That sounds illegal.
Why doesn't it simply not load the trackers?
Ooops, erm, technical reasons I guess.
Well, it could have been really easier to implement the opt out it later by this design, but it is more likely, that the dataflow is intended.
Well, it could have been really easier to implement the opt out it later by this design, but it is more likely, that the dataflow is intended.
Hilarious. While I was observing this I also noticed
> Weather.com - an IBM business
felt like it explained this design pattern perfectly
> Weather.com - an IBM business
felt like it explained this design pattern perfectly
Wasn't it owned by Disney previously? I think that more accurately explains the tracking obsession.
Wasn't it owned by Disney previously? I think that more accurately explains the tracking obsession.
No, it wasn't. It was at one time partially owned by NBC. Perhaps that's what you remember.
No, it wasn't. It was at one time partially owned by NBC. Perhaps that's what you remember.
It was created by Landmark, then offloaded in 2008 to NBCUniversal who still own it under Comcast.
There's another one of these things that's used on lots of sites, that takes three (3!) minutes, with no network requests or anything happening after the first couple of seconds. I forget the name of the company behind it, but it's a large one, one of the ones that sites proudly proclaim with a "protected by X" image.
It's beyond a dark pattern - it's plain fucking disgusting behaviour.
It's beyond a dark pattern - it's plain fucking disgusting behaviour.
> It's beyond a dark pattern - it's plain fucking disgusting behaviour.
As I mentioned in my other comment, I suspect it's actually forbidden by the GDPR, but that doesn't stop anyone.
As I mentioned in my other comment, I suspect it's actually forbidden by the GDPR, but that doesn't stop anyone.
Someone should set up a Wall of Shame for these.
I do wonder if some of the "No" requests are being throttled. Seem to be a lot slower than "Yes" on a lot of sites.
> Anyone would think they are trying to discourage people from choosing that option?
I realise it's comically unenforced, but doesn't the GDPR forbid websites from doing that?
Obvious ugly workaround: use a Private Browsing session for that website.
I realise it's comically unenforced, but doesn't the GDPR forbid websites from doing that?
Obvious ugly workaround: use a Private Browsing session for that website.
Still getting a unique finger print when I open a "private" browsing window. Might as well skip hard hats and use paper bags instead, the effectiveness is similar.
Open Tumblr.
Choose not to accept / options.
You'll be faced with 330+ individual agree/disagree toggles. THERE IS NO REJECT ALL BUTTON. If you're not technically inclined, you have to manually click them all.
You also have to choose block/remove consent (or whatever it is called) for similar crap hidden under the "Legitimate uses" category moniker. Same shit.
For this, and similar idiotic dark patters, there's a Firefox addon called "Unchecker".
https://addons.mozilla.org/en-US/firefox/addon/unchecker/
That, is, of course, until they start using buttons (some already do), double negatives in the wording or some such crap.
Choose not to accept / options.
You'll be faced with 330+ individual agree/disagree toggles. THERE IS NO REJECT ALL BUTTON. If you're not technically inclined, you have to manually click them all.
You also have to choose block/remove consent (or whatever it is called) for similar crap hidden under the "Legitimate uses" category moniker. Same shit.
For this, and similar idiotic dark patters, there's a Firefox addon called "Unchecker".
https://addons.mozilla.org/en-US/firefox/addon/unchecker/
That, is, of course, until they start using buttons (some already do), double negatives in the wording or some such crap.
Once the article got to opening the Dev Tools, I was surprised at the next approach: Copying the HTML into an editor, reformatting, copying into a C# project, setting up build rules for the copied HTML code, etc.
In this case I would always reach for typing a JavaScript oneliner into the dev console, using a couple of tricks:
1. Right click the element in the Inspector and choose "Copy" -> "CSS Selector".
2. Start typing the oneliner in the web dev console: Use [].slice.call(document.querySelectorAll("PASTED CSS SELECTOR")) to turn the elements into a JS array.
3. Use (...).map((o, i) => {...}).join("") to turn the JS array into a long formatted text string.
The result is the following, which took me a minute to type up and debug - from my perspective, a thousand times faster than firing up an IDE and setting up a new "project" to simply run a regex against some HTML.
In this case I would always reach for typing a JavaScript oneliner into the dev console, using a couple of tricks:
1. Right click the element in the Inspector and choose "Copy" -> "CSS Selector".
2. Start typing the oneliner in the web dev console: Use [].slice.call(document.querySelectorAll("PASTED CSS SELECTOR")) to turn the elements into a JS array.
3. Use (...).map((o, i) => {...}).join("") to turn the JS array into a long formatted text string.
The result is the following, which took me a minute to type up and debug - from my perspective, a thousand times faster than firing up an IDE and setting up a new "project" to simply run a regex against some HTML.
{const rows = [].slice.call(document.querySelectorAll("li.vendor-item")).map((o, i) => {const idx = 1 + i; const name = o.querySelector(".vendor-title").textContent.trim(); const url = o.querySelector(".vendor-privacy-notice").href; return `|${idx}|${name}|[${url}](${url})|\n`}).join(""); `Listing As At 30 December 2020 08:10 GMT\n\n|-|Vendor| URL |\n|---|---|---|\n${rows}`}Clever! It depends probably on the tech you are most comfortable with. I would probably copy to vscode and then use search & replace with regex there, or use multiline edit.
It’s cliche but why for the love of god cant they honor Do Not Track that is a toggle in every browser [0].
[0]: https://en.m.wikipedia.org/wiki/Do_Not_Track
[0]: https://en.m.wikipedia.org/wiki/Do_Not_Track
DNT was never going to work, because you're asking scumbags, who make money in scummy ways, to please not be scumbags.
Because browser vendors decided to toggle it to on by default, which made it meaningless.
It isn't meaningless, it just means that users don't consent by default. That's the default state; permission should always be explicit.
Perhaps the header should be made to be easy to apply per domain, so websites can request tracking permissions, but in my opinion the necessity of the header is exactly the point of enabling it by default.
The header is simple: I do not want to be tracked. Do not track me. If you want to track me, ask me to disable the header so I can leave your website.
Honestly, I don't understand why this header wasn't mentioned in the ePrivacy directive the EU passed recently. There's a perfectly good way to communicate intent about tracking options to websites, and it's being blatantly ignored.
Perhaps the header should be made to be easy to apply per domain, so websites can request tracking permissions, but in my opinion the necessity of the header is exactly the point of enabling it by default.
The header is simple: I do not want to be tracked. Do not track me. If you want to track me, ask me to disable the header so I can leave your website.
Honestly, I don't understand why this header wasn't mentioned in the ePrivacy directive the EU passed recently. There's a perfectly good way to communicate intent about tracking options to websites, and it's being blatantly ignored.
It did not made it meaningless, it made it mean that people didn't opt in for tracking. And of course nobody has.
Which is what it should have been to begin with: a “do track” header that no sane person would opt in for.
The whole “people consent to everything unless they go out of their way to say otherwise” thing is a farce.
Which is what it should have been to begin with: a “do track” header that no sane person would opt in for.
The whole “people consent to everything unless they go out of their way to say otherwise” thing is a farce.
Honestly I think people accepted this claim too easily. First of all only one browser did that AFAIK. Second of all even if it were entirely opt in it’s another fingerprinting target and was actively being used for that. I really don’t think the people who would fingerprint DNT care one bit whether it’s an explicit statement of intent or not.
In what way did it make that meaningless?
It didn't. Advertisers like to think that they have a moral right to track people unless explicitly told not to stalk people. In that framework, changing the default means that a DoNotTrack header doesn't necessarily show intent on the part of the user.
Instead, the appropriate framework is that advertisers do not have a moral right to track users unless the user has consented to it. By having the DoNotTrack header be on by default, it means that a user removing it shows consent to be tracked, where previously its absence could also have indicated that the user was unaware of the header.
Instead, the appropriate framework is that advertisers do not have a moral right to track users unless the user has consented to it. By having the DoNotTrack header be on by default, it means that a user removing it shows consent to be tracked, where previously its absence could also have indicated that the user was unaware of the header.
100% agreed. That was the point I was making.
Got it. I have a hard time telling apart a request for information (and receiving MisterTea's misinformation) from the opening to a Socratic dialog.
That would be a good framework!
But that's not what DoNotTrack was. It was supposed to show specific intent. It wasn't there to change the default.
So by removing the intent, the fragile agreement broke entirely.
If you want to change the default, you need something that can be enforced.
But that's not what DoNotTrack was. It was supposed to show specific intent. It wasn't there to change the default.
So by removing the intent, the fragile agreement broke entirely.
If you want to change the default, you need something that can be enforced.
The default has never changed from the point of view of the user. The default is "don't steal my data". DNT was just reflecting the reality of the situation: user not making a choice indicates they don't want you to steal their data.
> The default is "don't steal my data".
It pretty clearly isn't. It should be but isn't.
> DNT was just reflecting the reality of the situation: user not making a choice indicates they don't want you to steal their data.
Advertisers don't need a header telling them what they should do by default. They can get that information from elsewhere. DNT was going to be a way to opt-out, and some advertisers promised to listen to that. Setting DNT without user action removes the "opt".
It pretty clearly isn't. It should be but isn't.
> DNT was just reflecting the reality of the situation: user not making a choice indicates they don't want you to steal their data.
Advertisers don't need a header telling them what they should do by default. They can get that information from elsewhere. DNT was going to be a way to opt-out, and some advertisers promised to listen to that. Setting DNT without user action removes the "opt".
In the sense that browser vendors decided to put on a privacy protection facade by enabling a "privacy protection" flag that webshites can easily ignore. The earn kudos from users while websites can keep abusing said users. Win-win for greed.
Because they unfortunately don't have to legally. It never caught on in politics and lawmaking. Not even the GDPR seemed to bother revisiting it.
By honoring it they would loose an advantage over all the other ones who don't.
By honoring it they would loose an advantage over all the other ones who don't.
Maybe https://globalprivacycontrol.org/ could change that.
If it's enabled by default as it seems to be for DDG [1] then it's gonna probably share the fate of DNT.
[1]: https://spreadprivacy.com/global-privacy-control-enabled-by-...
[1]: https://spreadprivacy.com/global-privacy-control-enabled-by-...
Somewhat related: Just yesterday the EU ePrivacy regulation took the first hurdle in Brussels. This will most likely bring some changes to the whole consent drama.
I'm not good at reading legalese and there seems to be no commentary for the current version[1] yet. What I understand is that they "encourage" browsers to implement "whitelists" (their choice of word, not mine) as a solution to "end-users [..] overloaded with requests to provide consent". I'm not sure there is an update regarding first-party analytics cookies which some hoped will be there.
[1] https://data.consilium.europa.eu/doc/document/ST-6087-2021-I...
I'm not good at reading legalese and there seems to be no commentary for the current version[1] yet. What I understand is that they "encourage" browsers to implement "whitelists" (their choice of word, not mine) as a solution to "end-users [..] overloaded with requests to provide consent". I'm not sure there is an update regarding first-party analytics cookies which some hoped will be there.
[1] https://data.consilium.europa.eu/doc/document/ST-6087-2021-I...
I really wish this law had forced websites to respect a toggle in the browser UI instead of being allowed to engage in all their dark pattern shenanigans.
The cookie policies and laws are broken. The ever-annoying cookie popups are breaking the internet in more ways than it fixes it. The choice to make each website show their own cookie selection screens is part of all this.
I am one of the few that (most of the time) actually takes the time to click "Reject all" whenever possible. Some websites are EXTREMELY shady when it comes to this though and hides their targeted advertisement and user-profile building into their "legitimate interests" section that IS NOT automatically turned off even if you "reject all". You have to manually go trough them and "object" to each and every one of them. Often no "object to all" button.
Imagine if sex used the same notion of "consent": "Ok so you rejected having intercourse with me, but I have a 'legitimate interest' in fellatio that you didn't specifically say no to, so now you have to!". It is just terrible..
"Legitimate interest" is a broken term in those cookie forms. Legitimate to whom? Of course any company has a legitimate interest in making buckets of money.
Every browser should have a mandatory "cookie preferences" section where you can set your preferences for each of the typical use-cases for cookies. Strictly functional cookies? OK. Targeted advertisement? NO. Tracking between websites? NO. Measure site performance? OK. etc.etc.
Whatever role the current cookie panes now fill, the browser should take over using some standard. The preferences could get sent directly over HTTP with the initial page-load and the server/site would have to comply or face extreme fines.
With the browser approach you could maintain your own allow/blocklist for site-specific settings. All this could be synchronized across your various devices.
Only then would we not be annoyed by those popups again.
I am one of the few that (most of the time) actually takes the time to click "Reject all" whenever possible. Some websites are EXTREMELY shady when it comes to this though and hides their targeted advertisement and user-profile building into their "legitimate interests" section that IS NOT automatically turned off even if you "reject all". You have to manually go trough them and "object" to each and every one of them. Often no "object to all" button.
Imagine if sex used the same notion of "consent": "Ok so you rejected having intercourse with me, but I have a 'legitimate interest' in fellatio that you didn't specifically say no to, so now you have to!". It is just terrible..
"Legitimate interest" is a broken term in those cookie forms. Legitimate to whom? Of course any company has a legitimate interest in making buckets of money.
Every browser should have a mandatory "cookie preferences" section where you can set your preferences for each of the typical use-cases for cookies. Strictly functional cookies? OK. Targeted advertisement? NO. Tracking between websites? NO. Measure site performance? OK. etc.etc.
Whatever role the current cookie panes now fill, the browser should take over using some standard. The preferences could get sent directly over HTTP with the initial page-load and the server/site would have to comply or face extreme fines.
With the browser approach you could maintain your own allow/blocklist for site-specific settings. All this could be synchronized across your various devices.
Only then would we not be annoyed by those popups again.
It isn't the law that is broken, but rather the enforcement.
All the concerns you raise here are covered by the law. It's illegal for it to take longer to reject tracking than to allow it, which should ban all these web site that try to get you to scroll through several hundred options turning them all off. "Legitimate interest" means that the whatever data they want to process is a necessary step in order to do what the user has asked for - for instance, the web site has to be able to set a login token cookie when you log in, and that's allowed because you literally just asked to log in, and that's the only way the web site can do what you asked.
All these web site are illegally making the cookie experience dire. They are doing it so that they can:
1. Collect data from people who get fed up and click accept, people who accidentally click accept, etc.
2. Annoy everyone and make people think that the laws are broken, which increases the chances that the laws will be changed in the future.
Enforcement would help with this, but there's little sign of it happening.
All the concerns you raise here are covered by the law. It's illegal for it to take longer to reject tracking than to allow it, which should ban all these web site that try to get you to scroll through several hundred options turning them all off. "Legitimate interest" means that the whatever data they want to process is a necessary step in order to do what the user has asked for - for instance, the web site has to be able to set a login token cookie when you log in, and that's allowed because you literally just asked to log in, and that's the only way the web site can do what you asked.
All these web site are illegally making the cookie experience dire. They are doing it so that they can:
1. Collect data from people who get fed up and click accept, people who accidentally click accept, etc.
2. Annoy everyone and make people think that the laws are broken, which increases the chances that the laws will be changed in the future.
Enforcement would help with this, but there's little sign of it happening.
There's various attempts to enforce the law, the problem is the legal system is pretty slow and it also relies on other websites actually conforming when the law is clarified by another being fined, and they really do not want to.
Laws with no teeth are effectively broken laws.
The law has teeth. It just appears that the regulators aren't chewing.
Isn’t that in practice the same thing?
I would argue no, because the problem can be fixed without changing the laws, and I'm not convinced that it can be fixed by just changing the laws. People doing things that are illegal doesn't get fixed by making another law against it. So no, I don't think it means that in practice it is the same thing.
Early on, browsers had UI to block cookies. Sometimes you had to press "yes" to accept a cookie. No participation from websites was needed.
No one ever used it, and over time it got more and more hidden. It's still there if you look for it.
No one ever used it, and over time it got more and more hidden. It's still there if you look for it.
The concept of tracking as per the GDPR goes beyond cookies though. It includes any kind of personal data collection, and personal data refers to anything that can uniquely identify a person with reasonable certainty.
So cookies aren't the only thing that requires consent - things like browser fingerprinting and even collecting IP addresses for non-essential purposes (aka you can probably claim legitimate interest if you collect them for technical or fraud prevention reasons, but using that data for analytics or marketing would require consent).
This is also why I think clicking "accept all" on the cookie prompts with cookies disabled at the browser level isn't a good idea. You're still giving them permission to stalk you using other means than cookies, and they very well know that. At least use an ad-blocker which blocks the consent prompts completely - technically you never provided permission, so while they might still stalk you at least they don't have a legal basis for doing so.
The GDPR is less about the technical aspect of data collection and more about the intent behind said collection and the planned use for the collected data, something the browser can't really tell.
So cookies aren't the only thing that requires consent - things like browser fingerprinting and even collecting IP addresses for non-essential purposes (aka you can probably claim legitimate interest if you collect them for technical or fraud prevention reasons, but using that data for analytics or marketing would require consent).
This is also why I think clicking "accept all" on the cookie prompts with cookies disabled at the browser level isn't a good idea. You're still giving them permission to stalk you using other means than cookies, and they very well know that. At least use an ad-blocker which blocks the consent prompts completely - technically you never provided permission, so while they might still stalk you at least they don't have a legal basis for doing so.
The GDPR is less about the technical aspect of data collection and more about the intent behind said collection and the planned use for the collected data, something the browser can't really tell.
Yes, I remember this as a kid in the early IE days, like version 4 or something, not sure, but it was there.
TL;DR: Thanks Europe for fixing something almost nobody cared about, by making the internet worse for everyone and by forcing society as a whole to spend money building terrible UIs.
And in the end, people still just Accept All because it's the fastest way to content.
And in the end, people still just Accept All because it's the fastest way to content.
Totally agree. Maybe GPC could become that one day ?
https://spreadprivacy.com/global-privacy-control-enabled-by-...
It kind of seems like a second attempt to the do-not-track switch which was a failure. There must be strong backing in the laws for such feature to be meaningful otherwise nobody will respect it
It kind of seems like a second attempt to the do-not-track switch which was a failure. There must be strong backing in the laws for such feature to be meaningful otherwise nobody will respect it
Gods, but that sounds brilliant. Having a single toggle for non-essential cookies, even if it's on a site-by-site basis, would be a whole lot better than every website having it's own, different (and often highly dubious) way of handling things.
The cookie debacle has been going on for so long now, and is obviously not going away any time soon - surely there must have been draft RFCs or even W3C proposals along these lines at some point?
The cookie debacle has been going on for so long now, and is obviously not going away any time soon - surely there must have been draft RFCs or even W3C proposals along these lines at some point?
If a website had me jumping through too many hoops, I just don't bother. Many websites refuse to work without an egregious amount of third party JavaScript which makes it a pain in the ass to visit if you use uBlock Origin/uMatrix.
Let's be honest most of the websites that won't work without JavaScript aren't even really worth it. The content is usually garbage anyway.
Let's be honest most of the websites that won't work without JavaScript aren't even really worth it. The content is usually garbage anyway.
I find very few sites in my regular browsing where uBlock Origin makes it unusable. The out of the box defaults are very well tuned in my experience.
I have all the filters enabled in uBlock (except language specific ones), and that takes care of most cookie popups.
If I still see a popup, I just leave. I refuse to interact with popups. That was true in the 90's, and it's true today.
If I still see a popup, I just leave. I refuse to interact with popups. That was true in the 90's, and it's true today.
(Warning: hyperbole) I feel like the consent notices are a form of torture. You might browse 10s or 100s of sites a day, and instead of being shown what you want, you're presented a consent notification with all kinds of cognitive processing needed to ensure you don't do something you didn't mean and to get at the information you wanted.
Maybe lockdown is making me cranky, but I'm getting really, really tired of the popups.
Maybe lockdown is making me cranky, but I'm getting really, really tired of the popups.
You're not alone.
I came here for the comments but then went back and read the article. It's a deep dive into the cookie popup and all associated links, including 647 "partners" each with their own privacy policy. There are a lot of screenshots.
One thing I would like to see (and it shouldn't be too hard to code, using the example) would be a mirror of the entirety of text of all the privacy policies and everything else pasted back to back.
The screenshots and implication of having 647 privacy policies is bad enough, but I really want to see my scroll bar shrivel up and die.
One thing I would like to see (and it shouldn't be too hard to code, using the example) would be a mirror of the entirety of text of all the privacy policies and everything else pasted back to back.
The screenshots and implication of having 647 privacy policies is bad enough, but I really want to see my scroll bar shrivel up and die.
It amazes me how bad the internet experience gets when using a VPN server in the EU.
I thought cookie popups were annoying, but I didn't realize how much more ubiquitous they are when you have an EU origin ip address. If you haven't tried it before, it's worth doing it just to see what those poor people put up with.
I thought cookie popups were annoying, but I didn't realize how much more ubiquitous they are when you have an EU origin ip address. If you haven't tried it before, it's worth doing it just to see what those poor people put up with.
I think you got it the wrong way around.
The neighbouring town publishes data on water quality, and you pity the poor souls because the data shoes their water quality is horrible. Thing is, you are using the same water source. If anything, your water is likely worse because there is no transparency and some of the pipes might be leaded and you wouldn't even know it.
Same with cookies. The internet is polluted with aggressive tracking everywhere. In the EU you see how horrible it is - in the rest of the world people aren't even half as aware.
That said, people either start using browser plugins or just click yes and sacrifice their soul to the gods of dark patterns. In either case you don't see those banners as frequently unless you use private browsing.
The neighbouring town publishes data on water quality, and you pity the poor souls because the data shoes their water quality is horrible. Thing is, you are using the same water source. If anything, your water is likely worse because there is no transparency and some of the pipes might be leaded and you wouldn't even know it.
Same with cookies. The internet is polluted with aggressive tracking everywhere. In the EU you see how horrible it is - in the rest of the world people aren't even half as aware.
That said, people either start using browser plugins or just click yes and sacrifice their soul to the gods of dark patterns. In either case you don't see those banners as frequently unless you use private browsing.
You seem to think that the cookie popups are doing something useful, but that's up for debate. Cookie popups could be making it worse by normalizing tracking and programming everyone for an "Accept all or get nothing" compliance culture.
Btw, some of my message was lost in your attempted analogy: If we both are drinking toxic water, then I feel bad that you have to additionally click through a legislator's theater of concern and sign through various permission-granted-to-poison-me slips while you drink from the same tap.
Btw, some of my message was lost in your attempted analogy: If we both are drinking toxic water, then I feel bad that you have to additionally click through a legislator's theater of concern and sign through various permission-granted-to-poison-me slips while you drink from the same tap.
Part of it is lack of enforcement. The GDPR requires that rejecting tracking be as easy as accepting it. If there is an "Accept all" button, then there must also be a "Reject all" button. Furthermore, there can be no penalties for rejecting the tracking. So clicking the "Reject all" button may not bar the user from the site.
[deleted]
doesn't matter how long I need to scroll I always try to reject everything for every website that I know I will visit multiple times.
And I also use NoScript and uBlock Origin
But this is a prime example for a "dark pattern"
And also, if I can't reject most of the stuff I just close the site
But this is a prime example for a "dark pattern"
And also, if I can't reject most of the stuff I just close the site
What the author discovered here is the full list of publishers as given by the IAB consent framework [1], which is an attempt at self-regulation by the ad industry and website publishers.
Presenting the user with the full list of advertisers is indeed silly and not compliant IMHO. We also offer an open-source privacy & security tool for websites (Klaro! - https://github.com/kiprotect/klaro) and we have decided against implementing the IAB framework as it's clear that it does not conform to the intent of the GDPR. We also opted against using dark-patterns and making declining more difficult than accepting. Overall this results in slightly less opt-ins (around 50-70 % for most websites) but in any case those dark patterns will have to go sooner or later.
[1] https://iabeurope.eu/transparency-consent-framework/
Presenting the user with the full list of advertisers is indeed silly and not compliant IMHO. We also offer an open-source privacy & security tool for websites (Klaro! - https://github.com/kiprotect/klaro) and we have decided against implementing the IAB framework as it's clear that it does not conform to the intent of the GDPR. We also opted against using dark-patterns and making declining more difficult than accepting. Overall this results in slightly less opt-ins (around 50-70 % for most websites) but in any case those dark patterns will have to go sooner or later.
[1] https://iabeurope.eu/transparency-consent-framework/
I've seen some French Government websites using orejime, a fork of Klaro. Thank you for making that tool, it's great to use as an end-user!
Thanks, always great to hear that people find it useful :)
Buried at the end of my website's TOS, I informed users that by visiting my website, they agreed to offer their soul to me.
I don't recall receiving any comments or complaints about this.
I don't recall receiving any comments or complaints about this.
Cool! And how many souls do you have? ;)
lemme check MySoulQL real quick... `SELECT * FROM ...`
Not trolling - I genuinely wanted to know what the article says. I tried to read it, and got through, I don't know, 5 or 10 screenfuls before giving up, my mind numb.
The article would be much improved with an opening paragraph that summarises the findings.
It would also be improved with formatting that clearly differentiates the article text from the extensive site text it quotes. That site text is designed to numb users and put them off reading. It worked for me.
The article would be much improved with an opening paragraph that summarises the findings.
It would also be improved with formatting that clearly differentiates the article text from the extensive site text it quotes. That site text is designed to numb users and put them off reading. It worked for me.
I do this for every website I visit
1. First go to cookies and reject all cookies except the strictly necessary ones
2. Then go to “Legitimate interest” and then simply click “Object all”.
At my primary browser level -
3. In Firefox settings, choose “Block all cookies” (Hasn’t messed with my browsing experience, yet)
4. Periodically keep on deleting your browser cache and cookies. Don’t delete browsing history and saved logins.
I am currently looking for ways to minimize JavaScript usage. If anyone has any ideas, kindly proffer.
Caveat :- I am fully conscious that despite the painstaking activity of rejecting all cookies and objecting to all legitimate interest, I cannot rest easy that all websites I visit are scrupulous, cognizant and conscientious of my choice.
Also, I don’t get to option to reject and object on all websites, in which case I first check if there’s an archived snapshot on the Wayback Machine[1], or I simply forego reading the article altogether. For ex - www.BBC.co.uk, and even Reuters as mentioned in the OP’s post.
Ref.
[1] www.archive.is
1. First go to cookies and reject all cookies except the strictly necessary ones
2. Then go to “Legitimate interest” and then simply click “Object all”.
At my primary browser level -
3. In Firefox settings, choose “Block all cookies” (Hasn’t messed with my browsing experience, yet)
4. Periodically keep on deleting your browser cache and cookies. Don’t delete browsing history and saved logins.
I am currently looking for ways to minimize JavaScript usage. If anyone has any ideas, kindly proffer.
Caveat :- I am fully conscious that despite the painstaking activity of rejecting all cookies and objecting to all legitimate interest, I cannot rest easy that all websites I visit are scrupulous, cognizant and conscientious of my choice.
Also, I don’t get to option to reject and object on all websites, in which case I first check if there’s an archived snapshot on the Wayback Machine[1], or I simply forego reading the article altogether. For ex - www.BBC.co.uk, and even Reuters as mentioned in the OP’s post.
Ref.
[1] www.archive.is
FWIW I can't log into twitter without allowing any cookies (chromium)
trying "reject all third party cookies" instead
trying "reject all third party cookies" instead
“Strictly Necessary Cookies” being defined as cookies that are necessary for a site to function always frustrates me. In what way does a news website need cookies in order to function? What exactly would break in showing news articles when I disallow all cookies to be stored in my browser?
I think a common example is any site that requires authentication will need to store some kind of session cookie in the browser. I suspect many news sites have subscriber accounts that you can log in with.
Many subscription news sites might consider the "how many free articles has this visitor viewed this month" to be a strictly necessary cookie, but that's just speculation on my part.
Many subscription news sites might consider the "how many free articles has this visitor viewed this month" to be a strictly necessary cookie, but that's just speculation on my part.
Safari used to make it easy to reject all cookies with an exception list. I wish this feature would return. They have also made it very difficult to access and manage cookies outside of Safari. Seems inconsistent with Apple's public stance on tracking.
Safari rejects third party cookies by default, so I don't see why that feature would be needed anymore?
I have seen the active for 'legitimate reason' or 'legitimate interest' options but I am still unclear what they consider legitimate reason.
Does anyone know what that entails? I couldn't find it in the policy itself.
Does anyone know what that entails? I couldn't find it in the policy itself.
[deleted]
I've taught myself to almost automatically find the reject all-option (which they must provide to be compliant).
IMO, cookie consent should not be a website's reponsibility. It should be built into the user agent, which should block all cookies/analytics by default and prompt for consent when first visiting a site. Of course, this would most likely break adtech so it won't happen.
Why not have a law that your policy must have a summary that is less than 140 characters long?
That law/regulation would seem difficult for a court to uphold – e.g. a company being diligent and detailed in explaining its complicated policies, but getting dinged when someone is misled by their arbitrarily word-count-limited summary. But in any case, the example provided by the article does have a top summary [0] (it's the very prompt that the author investigates). And the individual line item settings are each summarized in a single sentence [1].
That said, the actual example summaries given seem to IMHO make a case for mandating specific and explicit language, akin the "Surgeon General's" warning text on cigarette packs, to accompany whatever euphemistic language companies continue to use. We're far enough into the Internet age to be pretty confident that the vast majority of people just do not and cannot comprehend that "We use cookies to improve the site, measure performance, understand our audience, enhance our experience and provide you with advertising based on your browsing activities" means actual tracking.
[0] http://www.conradakunga.com/blog/images/2020/12/Banner1.png
[1] http://www.conradakunga.com/blog/images/2020/12/Reuters5.png
That said, the actual example summaries given seem to IMHO make a case for mandating specific and explicit language, akin the "Surgeon General's" warning text on cigarette packs, to accompany whatever euphemistic language companies continue to use. We're far enough into the Internet age to be pretty confident that the vast majority of people just do not and cannot comprehend that "We use cookies to improve the site, measure performance, understand our audience, enhance our experience and provide you with advertising based on your browsing activities" means actual tracking.
[0] http://www.conradakunga.com/blog/images/2020/12/Banner1.png
[1] http://www.conradakunga.com/blog/images/2020/12/Reuters5.png
Apple’s privacy labels seem like a step in that direction. Needs the force of law though.
Not a summary, the whole legally binding thing. But I'd allow 280 characters.
It would be good to define some phrases in the law that then have unambiguous legal meaning so that privacy policies don't have to spend time defining things in full.
It would be good to define some phrases in the law that then have unambiguous legal meaning so that privacy policies don't have to spend time defining things in full.
I like the open source license pattern. Anyone can make any agreement they want, but most of the time you just need to see "Apache" or "GPL" and you know the deal. And when you see a new one you wonder what exactly is going on here.
But really, most of the time the cookie deal is "do you agree to have all kinds of information gathered about you and sold at will to other companies, our future management, and mysterious government entities in perpetuity, in exchange for seeing a few cat pictures? oh, and also we can make this even more unfair at any time without your agreement." They really should just be illegal, period.
But really, most of the time the cookie deal is "do you agree to have all kinds of information gathered about you and sold at will to other companies, our future management, and mysterious government entities in perpetuity, in exchange for seeing a few cat pictures? oh, and also we can make this even more unfair at any time without your agreement." They really should just be illegal, period.
All those terms exist, they’re just long and meaningless to native speakers. A summary is fine and can be legally enforceable.
> Why not have a law that your policy must have a summary that is less than 140 characters long?
Not as explicit as 140 characters, but it's already covered the GDPR
From the preamble, paragraph 32:
> If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
From article 7, paragraph 2:
> 2. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
(emphasis mine)
Not as explicit as 140 characters, but it's already covered the GDPR
From the preamble, paragraph 32:
> If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
From article 7, paragraph 2:
> 2. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
(emphasis mine)
The IAB vendor list is a json: https://vendorlist.consensu.org/v2/vendor-list.json
Easy to parse and analyse.
[deleted]
What strikes me as strange is the different levels of scrutiny the web gets vs. real life.
If we walk outside of our house then we're likely on camera, potentially with facial recognition. Cameras will track our cars' license plates. Cellular networks know where our phone is at all times. Our payment card networks and the stores we shop at gather data on what we buy. This is effectively public information because normal everyday citizens can just look around and see us and recognize us and what we're doing. I assume every action I take is probably observed and logged by someone. Those folks share the information with their business partners.
This has been going on since at least the 1980s to various extents; there isn't a way to opt out of participating in public spaces unless one is particularly wealthy, and then the risk is becoming a celebrity and losing even more privacy.
If anything, the web is slightly less intrusive despite occurring in public (I argue that the Internet is just as public as any real public space; we rely on third-parties to forward all our traffic. We use TLS if we want to hide the details of what we're doing). It's not technically us being tracked but our devices and we can wipe them, block javascript or cookies or network requests, etc. Maybe tracking is more effective for being fully automated and granular, but I'm not sure if that's worse from a privacy point of view.
I think collectively we need to decide whether we want more privacy or anonymity. Full anonymity is nearly impossible to achieve but would mean that no matter where we went or bought or did no one else would be the wiser. Presumably we'd only see shadowy hooded figures in public so that even we had no idea who they were. It sounds draconian in the other direction. Privacy, to me, is a polite fiction that we won't individually bother each other by using all the information we know about each other. For the most part this is already done in real life and the web. Companies don't wholesale dump/sell every piece of data they collect about us; they aggregate and categorize it. This is the middle ground of privacy where people mostly mind their own business but don't blind themselves to trends and patterns of behavior occurring in public.
If we walk outside of our house then we're likely on camera, potentially with facial recognition. Cameras will track our cars' license plates. Cellular networks know where our phone is at all times. Our payment card networks and the stores we shop at gather data on what we buy. This is effectively public information because normal everyday citizens can just look around and see us and recognize us and what we're doing. I assume every action I take is probably observed and logged by someone. Those folks share the information with their business partners.
This has been going on since at least the 1980s to various extents; there isn't a way to opt out of participating in public spaces unless one is particularly wealthy, and then the risk is becoming a celebrity and losing even more privacy.
If anything, the web is slightly less intrusive despite occurring in public (I argue that the Internet is just as public as any real public space; we rely on third-parties to forward all our traffic. We use TLS if we want to hide the details of what we're doing). It's not technically us being tracked but our devices and we can wipe them, block javascript or cookies or network requests, etc. Maybe tracking is more effective for being fully automated and granular, but I'm not sure if that's worse from a privacy point of view.
I think collectively we need to decide whether we want more privacy or anonymity. Full anonymity is nearly impossible to achieve but would mean that no matter where we went or bought or did no one else would be the wiser. Presumably we'd only see shadowy hooded figures in public so that even we had no idea who they were. It sounds draconian in the other direction. Privacy, to me, is a polite fiction that we won't individually bother each other by using all the information we know about each other. For the most part this is already done in real life and the web. Companies don't wholesale dump/sell every piece of data they collect about us; they aggregate and categorize it. This is the middle ground of privacy where people mostly mind their own business but don't blind themselves to trends and patterns of behavior occurring in public.
Isn't mass consent, forced consent and opt-outs illegal under GDPR? The legislation is there, why can't we create incentives to enforce it?
Yes those are in breach of the regulation, and technically there are incentives - the maximum fines under GDPR can be quite large.
The problem is that it doesn't seem like the regulation gives the right to a wronged party to sue for those sums of money. You can sue (I guess technically you can sue for anything anyway) but this would involve proving some damages.
The only parties that can enforce the regulation (and levy the promised fines) are privacy regulators (such as the ICO in the UK, or the CNIL in France). Sadly, they've all demonstrated their incompetence and unwillingness to improve multiple times.
There's a non-profit in the UK that wants to take the ICO to court over its incompetence/unwillingness to enforce the regulation - feel free to vote with your wallet: https://action.openrightsgroup.org/help-us-protect-your-data...
The problem is that it doesn't seem like the regulation gives the right to a wronged party to sue for those sums of money. You can sue (I guess technically you can sue for anything anyway) but this would involve proving some damages.
The only parties that can enforce the regulation (and levy the promised fines) are privacy regulators (such as the ICO in the UK, or the CNIL in France). Sadly, they've all demonstrated their incompetence and unwillingness to improve multiple times.
There's a non-profit in the UK that wants to take the ICO to court over its incompetence/unwillingness to enforce the regulation - feel free to vote with your wallet: https://action.openrightsgroup.org/help-us-protect-your-data...
[deleted]
I'm agreeing to the site sending me some Cookie: headers, for my browser (user agent) to ignore.
I've changed my web browsing habits quite drastically: I usually just click "Save preferences", as opposed to the "Accept all" default on the most common form of Cookie dialog which hopefully opts me out of most shenigans. On some sites, I used to accept their defaults even. For example, heise.de (respected German computer news) used to be among the latter group, but when I saw they're carrying Facebook videos/pixels I've stopped going there. I'm leaving many sites when their draconian tracking/Cookies seems not worth it so overall, I visit a lot less sites than I used to, and in particular I find myself ignoring the one-time content marketing sites/blogs often linked from HN submissions greeting me with heavy Cookie dialogs. So for me personally, Cookie dialogs work as expected I guess. But I've yet to see actual figures on surfing behavior post-GDPR published anywhere. And I'm entirely unsure if people across the pond or publishing from other non-EU locations are even aware.
I want to browse every dark corner of the web to discover useful facts and build my own ideas on subjects, not limit myself to the few most popular websites, driven by the wealthiest companies, that 90% of the people see.
Between cookie banners and GDPR forcing newspapers to ban European visitors, I have to go through more hoops in order to see what I want.
Just because you care about a website tracking you, that doesn't mean someone else cares.
Legislation shaping the internet in this way and forcing everyone to think in a certain way is an authoritarian behaviour that I don't tolerate.
Between cookie banners and GDPR forcing newspapers to ban European visitors, I have to go through more hoops in order to see what I want.
Just because you care about a website tracking you, that doesn't mean someone else cares.
Legislation shaping the internet in this way and forcing everyone to think in a certain way is an authoritarian behaviour that I don't tolerate.
Regulatory bodies have failed to protect consumer rights when it comes to enforcing the GDPR as concerns cookies on the web.
it's highly disappointing.
it's highly disappointing.
I like to think the war is not over here. I'd say, they have not succeeded yet.
The only hope left is for Europe to collapse economically and hope websites will stop shoving popups down our throats.
Or fund someone to write better anti-cookie-banner extensions. Ublock works incredibly well for ads, after all.
Or fund someone to write better anti-cookie-banner extensions. Ublock works incredibly well for ads, after all.
Popups are not the problem.
I never click yes.
Always use u block, right click and choose "block element".
Always use u block, right click and choose "block element".
Not clicking "yes" would work if most sites weren't, in fact, sending all tracking/setting all cookies by default, which most are :/
At least it doesn't give them a legal basis for doing so, while clicking "yes" does.
In practice, the real defense is a good ad blocker which would block both the consent prompt and the associated trackers.
In practice, the real defense is a good ad blocker which would block both the consent prompt and the associated trackers.
Same here, as previously learned on HN :)
I find the gdpr-popups themselves to be far worse than any ads I’ve ever encountered. I really don’t care that they profile my data, build models, try to trick me into spending as much money as possible etc. I’m like the meme dog in the house fire - This is fine!
I'm not convinced any of this is legal FYI.
I was using the skyscanner app to check some tickets the other day and there was blatant price manipulation(used another device from browser and vpn from halfway around the world to compare).
Then I tried to use the web page from yet another device from an anonymous chrome tab, the "minimal cookies for essential functionality would not go away. Europe. No declaration what that means anywhere, not sure how this is in harmony with gdpr laws. Infuriating.
Is it legal under GDPR to direct someone to read that much material to agree to use a site?
I’m guessing a simple GDPR complaint supported by this request would be very exciting.
I’m guessing a simple GDPR complaint supported by this request would be very exciting.
For example, for cookies, legally force, with the cookie (with a standard protocol), transmit of "intent", like cross-site tracking, whether it is used for advertisement or something else, whether it may be shared with third parties, etc. Then the browser would simply not accept cookies with intent the surfer disagrees with.
Another possibility is, that the browser could, in a standard header, with a bunch of standardized flags, tell what the site may or may not do with the data they gather about the surfer.