With notification spam fixed, how about tackling cookie banners spam next? Let's work on a standard to allow user to set their preferred cookie settings level once in browser UI and keep websites clean.
Wish I had bookmarked the page.
It is 2020 and totally possible to create websites without cookies or with only functionally needed cookies. You do your users a favour and your site will look better.
The very idea of the GDPR wasn’t to force websites to display cookie banners. It was to clarify that cookies can contain identifyable personal data and can be used for tracking, which is why we should avoid using them in that way or ask for consent if it really must be used.
There's no law anywhere that says you need to ask permission for storing cookies. You can perfectly well make a cookie-based login without a cookie banner. This bullshit about un-uncheckable "essential cookies" toggles has to go, you don't need permission for those, they don't need to be in the dialog. The GDPR even specifies this, albeit too vaguely: it should be as easy to accept tracking as it is to reject it, and in practice even a startup 100% focused on solving this problem gives that rule the middle finger.
Seriously, fuck this shit. The banner should say "We'd like to track your behavior so we can improve our service / sell better ads / whatever¹. [Ok] [Rather not]". It's not that hard. Only give Metomic your money if you think your visitors are idiots.
¹ (strike through what does not apply)
Of course, the gold standard is no tracking and no popup.
Bring back P3P, with GDPR acting as the enforcement part (which was quite lacking when P3P was first proposed)? Might work quite nicely, and the support is in browsers already, it just tends to be ignored.
Seems very odd.
The source code can be extracted from the extension file itself.
That said, it makes an ABP-compatible filter list available. This works with ublock origin:
Of course the real solution (and the reason why GDPR introduced the banner) is for website to stop using cookies for tracking their users and thus have no reason to put the banner (you don't need the banner for technical cookies, such as the one used for logins, but only for third party profiling cookies).
I can see why that prevents a browser from auto-accepting all cookies, but how in the world does this logic apply to me if I want to deny consent to 100% of the websites to use cookies?
Set the default on the browser to deny all consent, and show the cookie notification somewhere unobtrusive, the same way it was done for notifications.
As a personal confession I cannot sympathize for this animosity towards banners. Apps usually have a worse onboarding experience than websites.
My only considerations of GDPR notices is to note how many of them manage to be uncompliant and wonder if archiving services can bypass them.
The issue is that websites want to annoy users until they finally maybe actually say yes to get the site to shut up.
Legally, tracking has to be off by default, tracking may not change the usability of the site, and tracking has to be purely optional, and the "no" has to be simpler, larger, and easier to use than the "yes".
The point of the GDPR, over the course of the next years, is to utterly destroy online advertising as a business model, and any and all tracking solutions with it.
The intent of the parts of GDPR which mention cookies (or, at least, what I assume the intent was) was to essentially "upgrade" the banner from a simple and largely useless notification (i.e "By using this site you agree to our use of cookies") to one of informed consent (i.e "Please click accept or deny the use of cookies to continue using this site").
Interestingly, as far as I am aware, no site or company has ever been taken to court or even fined for not using a cookie banner, despite some websites publically declaring they won't use it[0].
So if you hate to put cookie banners onto a site, just stick with storing only strictly necessary cookies without data that identifies your users and you are fine.
The problem is, many people don’t even know what cookies their own site stores with their users and they store a ton of tracking cookies on their user’s devices.
When I visit a random wordpress blog I shouldn’t need any cookie from them — why would I?
When I visit an online shop it should be my choice if they remember me (which is precisely what the GDPR demands). This could be a little toggle switch labled “Remember me” that is off by default and that would be it.
But people seem to prefer forcing their cookies onto users.