Hacker News Reader

Comment by ben174 | Hacker News Reader

I’m in Europe on vacation, and while GDPR seems to be a good thing, there is nothing more annoying than a cookie policy pop up for every single site you visit. I know what cookies are. I know how they are used. I don’t need a reminder every time I visit a site. I think they way over shot their goal there.

View on HN

You don't need cookie banners; they're only mandatory when you want to track your users, so when you see one of those on every website, it just means every website wants to track you.

Also, if people are trained to just click them away, that's not really that bad, since tracking has to be opt-in, so if you click the banner away, you don't get tracked by default (that is, in theory; the reality is, many websites disregard this completely and have tracking cookies enabled by default)

>You don't need cookie banners; they're only mandatory when you want to track your users

So they are mandatory, since all websites NEED advertising revenue and analytics to function.

analytics are fine as long as you use GDPR compliant anonymision of the users data. But it’s easier to just ask permission.

You can also run ad’s asking as you are not using targeted ad (which you are allowed to use if you ask for permission)

There are invasive ways of asking for such permission. Sites that do full take overs of the site or persistent bars that follow you around are just trying to annoy the user into clicking agree.

No, some websites can just sell a product or serve some business function, and don't need tracking at all, yet usually have it anyway.

The one you're at right now seems to be doing fine without ad revenue.

> You don't need cookie banners; they're only mandatory when you want to track your users, so when you see one of those on every website, it just means every website wants to track you.

Why does the European Commission's website want to track me? They have a banner, too. In fact, I have yet to visit an EU government website that doesn't have a banner.

It would be so much easier to make the websites honor "do not track" settings in the browsers.

It's training people to ignore those altogether and click "allow" on everything out of frustration. They should have gone with a strategy focused on browser controls. Mandating browsers block 3rd party cookies by default, for example, with explicit opt in.

The cookie policy popups are, at best, an intentionally annoying way of complying with the GDPR or not compliant at all at worst.

GDPR has the great idea that you shouldn't be tracked unless you consent. The popups are a way of forcing consent because users just click through them. However, the default should be that you're NOT tracked and opting in should be explicit, which possibly means all those popups that begin tracking you after one click are not compliant. Then I've also seen sites where opting out is difficult - there's a hard to find link that takes you to some settings page where you need a dozen clicks to disable tracking cookies. That's definitely not GDPR-compliant.

Despite the practical annoyances, I direct my frustration at the cancerous advertising industry that has turned the Web into a giant ad platform, and so the industry is very intentionally undermining GDPR protections.

Eh, no. Cookie warnings were a legislative failure that was fixed with gdpr. But they trained users to click without thinking. So now many companies do disguise the explicit consent to enable tracking to look like the old meaningless cookie pop up. But they're legally a completely different thing.

Cookies are unrelated to GDPR. Completely separate older law.

The stupid thing is that GDPR says nothing about requiring those policy pop ups, that law was discontinued (amended) when GDPR took effect. But no requirements for these pop ups remain

It wasn't discontinued. It was amended to take into account aspects of GDPR, but the rules are very much still in effect.

It's covered by PECR. There's a good overview of the rules here: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

The main change GDPR brought to it (as I understand it) is that it introduced stricter rules about how consent works. But even though GDPR doesn't specifically require cookie warning, it does require that you get informed consent from people before you store personally identifiable information about them; in many cases this effectively means getting their permission before using tracking cookies.

So tl/dr, it's primarily PECR that covers cookie handling, but GDPR also plays a role.

Reply on news.ycombinator.com