Hacker News Reader

Comment by nicoburns | Hacker News Reader

Oh god. This is so accurate. I think the GDPR is overall a good thing, but I wish they'd encoded respecting browser sent preferences into law, rather than requiring a user-visible prompt everywhere.

View on HN

The proposal for the ePrivacy regulation (not the same as the old ePrivacy directive) is supposed to do that but unfortunately there hasn't been much movement on it in the last year.

Can find a short overview of it here: https://www.privateinternetaccess.com/blog/2018/08/beyond-th...

Europe should do this for their cookie law, too. Instead of every website having its own UI for it, we should force browsers to give the user some reasonable options like "accept all cookies", "reject all cookies", and "ask me every time" .. oh wait.

So, a prompt which changes your client side settings for that site? Perhaps driven either by an API or an automatic action prompted by the browser?

Yes, please.

As it stands today, it's too much work to set site-specific cookie privileges.

So, being able to globally allow or disallow cookies, which every browser does already?

It's insane how P3P from 2002 was more advanced than anything the EU can come up with now.

You mean the standard that never caught on and now lives on as a piece of Internet history? Yeah, super advanced shit, let's have that again.

The EU didn't come up with any protocols, advanced or not. The GDPR is not even specific to the internet, let alone specific ways of getting consent. It's up to the industry if they want to use fancy protocols to do so.

Nobody has confidence that an explicit "I don't care about cookies" setting would satisfy GDPR.

My guess is, even if there were some elegant, widely-supported standard for machine-readable privacy policies and even if browsers had some dedicated built-in API for privacy consents with some really polished and frictionless UI, you'd probably still be bombarded with popups begging you to click the "consent" buttons on that UI.

The problem is that it's not a technical problem, but a political. No matter how technically elegant your spec, it doesn't change anything about the underlying conflict of interest: Website operators want to collect personal data and show ads, while users want to keep personal data to themselves and don't want to see ads.

So trying to solve this via any kind of web standard is asking the website operators to act against their own interests. If you have no enforcement or incentive, you will end up with a standard that is either toothless (P3P, DNT with opt-in) or simply ignored (DNT with opt-out).

GDPR (and the cookie law before) do have enforcement, which is why web sites can't ignore them - instead they fight back with a barrage of popups.

What I don't understand is, why are there so many sites that don't remember my previous GDPR response?

Why remember when you can ask again and maybe score an agreement? Naturally, you remember the agreement

Honestly though I think it's sites being dumb and storing the choice in a session cookie or something because you've not agreed to storing cookies

Oh! That’s malicious compliance of the best kind.

I actually meant after I have agreed - it's even more annoying that way round!

Please read the excellent comment of xg15 elsewhere in this thread. It basically suggests that publishers deliberately make the user experience as annoying as possible, as a way of protesting against the cookie and GDPR laws.

The modal could be made easy to dismiss with a simple No button, it's publishers that don't make things easy for users.

I think some of it might also be a function (or consequence) of the CMS being used for the site. You can either figure out a redesign that elegantly solves the problem (as NPR have done, offering a purely plain text version of their site), which might not be so easy depending on the tech; or you can treat the entire thing as pluggable and just add every new feature as a drop-in modal.

Hell, if you've got a marketing team dependent on stuff like Google Tag Manager, then have them throw it in there. Job done. Not great for the users.

Yes of course they don't want to - that's why he's saying they should be forced to do it by law.

Reply on news.ycombinator.com