Hacker News Reader

Comment by lloeki | Hacker News Reader

Ever seen those "here we'll be setting cookies because we're going to track you if you agree (agree/fuck off)" in Europe? A EU directive or something of the best intent mandates that when you're tracking someone beyond technical needs this boilerplate is required before setting a cookie. Guess what if you disagree there's no way to store the user's answer, so the box keeps popping up, forever nagging the privacy conscious. DNT would have solved that so nicely! Header set, no box, easy peasy. Except the difference between theory and practice is that they're the same (in theory). So boxes keep popping up even from good actors.

View on HN

The problem is that most of these websites offer no "fuck off" option besides GTFO and usually "agree" is the only button provided and they are probably tracking you from the get go before you even click anything.

If you now mandated them to respect some special HTTP header instead, most of them would simply 403 all browsers with this header set and you would have to disable it to access these sites. So same thing as with JavaScript and cookies - either tolerate crap or stop using a dozen websites or install yet another extension for management of per-site exceptions.

This law is silly and completely detached from reality. They should either prohibit tracking by law or do nothing.

The best solution would be to remove the real problem which is the useless law.

As far as I recall, the EU cookie law is a bit more global than that: a website needs to get permission/consent whenever it wants to store/retrieve information from the visitor's browser---this isn't just limited to tracking. This means that every single website hosted in Europe/targeted at a European audience need to request the authorisation to use the user's browser storage.

A number of websites formulate this as "By continuing to use this website, you agree that we will access your cookies," accompanied with a "Dismiss" button, but that's not really what the spirit of the law is.

DNT didn't change anything to this, as it was meant for a completely different use. I'd even say using DNT for this is a complete hack, which sort of misses the point of both the cookie law and DNT. You are, however, completely right that it is stupid beyond ridicule that you technically can't store the fact that a user doesn't want cookies on the browser.

Edit: paragraph formatting.

Not all information, only those that are not strictly necessary to provide the service (so e.g. a basic session cookie created once a user logs in or starts using the shopping cart, ... should not require consent)

Interesting, wasn't aware of that distinction. As it turns out, there's quite a few exceptions[1]. Thanks for correcting me!

[1]: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...

> You are, however, completely right that it is stupid beyond ridicule that you technically can't store the fact that a user doesn't want cookies on the browser.

Yes you can, it's pretty simple to do. Add a timestamped entry into your database to not show that notification to the IP address the user comes from, then run a script every minute that clears out entries older than an hour. Granted, if you go back to the website an hour later, it would still pop up the request to access cookies but it certainly beats having it pop up on every page load.

Guess what if you disagree there's no way to store the user's answer, so the box keeps popping up, forever nagging the privacy conscious.

How about a browser extension that hides any overlay divs with the string 'cookies' and input buttons?

Yes. Those exist.

Reply on news.ycombinator.com