Hacker News Reader

Comment by loldot_ | Hacker News Reader

Its ironic that cnil has “accept all” as the default choice for 3rd party cookies on its site

Honestly, I think what they offer might be the best solution you can hope for: one button "I don't care", one button personalize and in it one button "disable all". People who don't care and just want the site to work aren't lost, people who care aren't lost, people who want to personnalize aren't lost. If you care, it's two click total to disable everything, and it's very easy to find (the bright right "deny").

Should they have "refuse all" along with "accept all" ? Yes.

Should "refuse all" be the default and thus features be disabled ? I'm not entirely sure (see what they list in the personnalize, it's youtube videos and twitter cards ...).

In terms of the intent of the law (give control to the user and make it easy to opt out), I would say they are doing fine. As opposed to all those shitty websites where you can't find how to disable, or you have to disable a bazillion things by hand.

Refuse all needs to be the default, because that is the law. Even when it comes to the intent of the law (which is to give control to the user and also not make lazy users "accidentally" give up all of their right to privacy) they are not doing fine. They're doing better than their peers, who have made even more malicious choice dialogs.

I agree as a matter of "how is the law written now", I was talking more of a "how I hope as a user that it could/will be".

If we go with everything off by default by law and try to apply it, we will end up with a broken web, meaning websites will not follow the law because it makes a stupid and not be punished for it because it's become the norm, just like the (bad) cookie law.

I'm ok with how it is on their site (based on how easy it is to disable, myself I disable all on such sites); it's quick with only 2 clics total, and it's easy to figure out with a clear color scheme and wording.

It's important to understand we make the law not for us tech users, but for everyone. Finding a solution that works for everyone and gives them what they want is important.

Why would we end up with a broken web?

Remember that consent is only needed if you can't rely on one of the other conditions for storing that data. If you are, say, selling a product, there's no need to ask for consent at all for using the customer's data to bill them and ship it. If the user changes some setting in your site, there's no need to ask for consent to store that preference.

Websites will learn to follow the law or they will die. And the web will be better off for it. Stacking dark patterns has been a thing for way too long, it is high time that movement dies.

Not only that, but you don't even need to click the 'accept' button, just navigate elsewhere on the site. What about screen readers or custom CSS? I doubt this is informed or specific consent.

Of course, these are different magnitudes of offences, but they do indicate how insidious and normalised are the patterns established by companies like Google, Facebook, Twitter and co.

Very few websites have implemented this properly, I think I've seen only 1-2 newspapers.

The rest either have an "accept all" or "pre-ticked accept" or a tiny, misleading "more options".

I think that the Cnil should lead by example and I suspect that a lot of people see the irony. If they show what can be done, or even better, open-source a working solution, that could disprove the “everyone does it” argument which… hasn’t exactly proven sturdy to even minimal ethical testing so far.

I lived in an asian city where private buses could be fined even if they have one person extra than total seating capacity. Meanwhile govt buses could be so over crowded that people can fall off the door and bus wouldn't stop over that incident.

So government and bureaucracies can be impervious to rules they expect everyone to follows. This site seems humongous fan of bureaucracy as long as it is european.

At least the "Cookies Management" panel is displayed promemently at the top of the page for pretty much every page of the site.

Ahh yes, the ole regulate everyone except ourselves trick

My understanding is that those cookies are covered by a separate ePrivacy rule that isn't fully finalized yet, not the GDPR.

But yeah, it's bad optics.

Reply on news.ycombinator.com