Hacker News Reader

Comment by blauditore | Hacker News Reader

What really drives me crazy are prompts that start by showing two options: "Consent to all cookies", or "customize". If you click "customize", it opens a new modal window with a loading indicator that just doesn't seem to finish. I literally waited 60 seconds and then tried again by refreshing the page, ending up with another infinite loading indicator.

This means that users are de-factor forced to click "consent to all". I'm not even sure if that's legal.

Now, this was not some obscure small website, but the official Java documentation on docs.oracle.com! They use some third-party service for that - I just tried again, and though it worked this time, it still took 30+ seconds to submit my settings. I have a very hard time to believe this has technical reasons. Either this was made slow on purpose, or built by a bunch of morons.

/rant

View on HN

DockerHub uses a company/product called "TrustArc: TRUSTe" and they have _exactly_ this method. The slowdown is intentional. People who come up with sort of tactics and those who implement them should go to jail. It's beyond infuriating. I've decided to not upload my images to dockerhub because of this.

Edit: jail time is not for anger obviously, but for intentionally swindling people. It'll be handled on a case by case bases obviously, but data is worth something, people who swindle you out of your data are like those who scam you in the street for your wallet, and as far as I know, there's jail time for that.

Why jail? I think we should just execute them on the spot. /s

Just like we do in the USA for the crime of 'suspicion of selling loose cigarettes'!

Causing you to get angry is all it takes to warrant justification for jail time in your eyes? I am thankful you aren't in charge of any lawmaking.

Jail might be a bit much, but giving them the maximum fine allowed under the GDPR seems quite reasonable to me. I'd even go so far as to try and transfer the debt to the individuals responsible if this causes the company to go bankrupt, as this is clearly malpractice.

> I'd even go so far as to try and transfer the debt to the individuals responsible if this causes the company to go bankrupt

So who's liable in this scenario? Someone in the C suite? The coder monkey who implemented it? Someone in between? All of the above?

Unless I'm mis-remembering, the maximum fine under GDPR is a % of the total revenue of the company, so depending on the size of the company, this could result in bankruptcy of any individuals deemed responsible too.

I'd say the stock owners.

If the risk of investing is goes from (Value of your investment can drop to zero) and is now (Your entire personal fortune is at risk), what do you think is the outcome? Thinking 1 month, 6 months, 12 months, 5 years.

Or to put it another way, is causing another massive economic shock the correct response to a dark patterns on websites?

The stock market is not the economy. All you are ultimately advocating for is keeping the exiting corrupt corporate leadership in charge and preventing market forces from replacing them with ethical leaders.

When you give someone money to do a thing you have responsibility about that thing. If someone is running a clearly illegal business (trafficing illegal drugs, humans) and you are aware of this and invest in their business then you become an accessory you are not immune to liability for crimes you were aware of before investing - you are immune to liability for actions taken without your knowledge (which is what we assume the great deal of actions taken by investees are).

Causing another massive shock to the stock market is the correct response here because nearly everyone is engaged in behavior that harms society and should be stopped. Also, the market will recover and really isn't that important. If a small proportion of actors were engaged in this activity then getting an industry compact or other token gesture might be good enough to correct it.

So pension funds and teacher's unions? Grandpa's nest egg?

If people were affected by the things they give companies money to do, perhaps they'd be a lot more careful about what they give companies money to do.

To the point where it's not worth giving companies money at all. Stockholders aren't involved in day-to-day ops, anyway, so you're placing the blame at the wrong place. It should be placed on the C-suite.

The problem with modern capitalism is that people can get all the benefits but avoid the bulk of the risk

The alternative seems like a strange land where we imprison waste management workers for their pension funds being invested in companies they have literally have no control over and no ability to discover the behavior of.

Or should we restrict the stock market only to the rich and powerful?

So pension funds? That smells dangerous

This should be punishible by law, jailtime included. The intent of the law is to give the consumer a choice. What these companies are doing are trying to circumvent the law by making it extremely difficult and annoying to exercise that choice.

Very similar to trying to cancel a spammy subscription (but that's not mandated by law, so)

It seemed very clear to me from his comment that his justification didn't revolve around him getting angry personally, but the harm these features cause over time. With that being said, your post seems disingenuous. I personally don't believe in jail time for this, but very heavy fines certainly. People need to care about these issues.

No, hurting others and breaking the law justifies jail time and causes anger.

I mean... how much of the world do you want to feel like you married a sociopath (aka people who deliberately make the better option miserable), before someone can say 'lets disincentivise this behavior

I wonder if justice has improved over time because we've gotten better at tolerating things that make us angry, or because we've gotten better at not getting angry.

I'm guessing its more about knowingly and intentionally breaking the law bit, then that he was angry they were breaking the law.

Jail time is probably the only suitable enough deterrent for adtech nightmares. Fines are just treated as a cost of doing business expense, and doesn't directly even hurt the terrible people making these decisions.

When someone commits a wrong, the punishment is in part based on the amount of harm. You might feel that adtech causes small harms, if you look at harm against an individual, but adtech folks harm billions of people, every single day.

If you're Mark Zuckerberg, Larry Page, or Sergey Brin, no fine is large enough to make you regret your life choices. The only way to punish billionaires who get rich off harming others is to take away their time/freedom, the one thing they can't just buy back. As long as corporate CEOs can't get jailed, crime absolutely pays in this country.

Exactly. Facebook and Google have been fined in the past and it’s never amounted to anything for them. When they make more Money from engaging in bad behavior than the fine costs, it’s a law they’d be stupid not to break.

Then make the fines double what they made from it.

Most studies pretty clearly show that harsher punishments are not an effective deterrent.

That may be, but a threat of jail hanging over a director or CEO may make them take the correct course of action - effectively becoming the deterrent.

It won't. Again, this is well studied.

https://www.psychologytoday.com/us/blog/crime-and-punishment...

Your source doesn't actually apply well here. It talks about things like substance abuse and addiction being reasons that criminals don't act rationally to punishment as a deterrent. For white collar crime, there's a very different set of circumstances in play. Crime is often just a business decision based on risk and reward. Raise the risk and the reward becomes less worth going for.

So the alternative is... we don't punish them at all? Bear in mind, CEOs face no real penalty for criminal activity.

> Most studies pretty clearly show that harsher punishments are not an effective deterrent.

It doesn't need to be harsh, 3 days in jail with a review in six months to see if they've fixed it. Then an additional 3 days in jail. Pretty much any jail time would be adequate for typical C-Level execs. Also, not "Raped in the ass" prison time, just a mellow 3 days to contemplate their shiftiness locked in a comfortable room.

This refers to the "normal" people not businesses or rich execs. Giving them for example 20 years instead of 5 doesn't change much, because 5 is already a lot. If someone does crime, because of poverty, being mentally ill, or because of addiction no jail time will be a strong enough deterrent.

If businesses actually would have fines that significantly hurt the business (and not being able to deduct it from taxes, if they were unable to pay, they would have to close down) would absolutely help and would change the calculation from fine being a cost of doing the business to a punishment for illegal behavior.

Having executives be personally responsible for decisions and go to a real jail would be even a stronger motivator.

The current problem is that there's no real deterrent.

No amount of fines would make a difference? I beg to differ. Make the fines high enough, bill them to the executives personally, I guarantee it will make a difference.

A large enough fine could literally take the company and thus their power away from them. A large enough fine could literally bankrupt the company.

The problem is simply that the fines aren't big enough.

That just means you need fines proportionate to wealth, not fixed numbers.

A truly useful penalty would be to forbid them from owning any capital (directly, or indirectly like via a trust or index funds).

> The slowdown is intentional.

Yes, it appears to be. If you check the network tab of your browser, you see it makes about 8 requests. Then it waits for about 5-10 seconds and makes again 5 requests.

I think there should be some sort of public shaming for shady practices like this, so large companies like Oracle would seriously consider alternatives.

Since your edit seems to be taking the jail suggestion seriously:

I think the data-money analogy isn't unreasonable, but you're overloading "swindle" pretty heavily here, in a way that defeats your point. Companies and people "swindle" others out of money all the time with dark patterns, and this predates computing by ten thousand years. Caveat emptor exists for a reason: the legal system is just too inflexible a tool to cram a person's view of "honesty in business" into.

Defining "making one side of an option an iota more of a hassle than the other" as criminal is broad enough that you're pretty much guaranteed to catch many honest transactors too. The law is a really blunt instrument.

There are certain patterns that are illegal though, and presumably have legal penalties (maybe not jail time, but presumably at least fines). False advertising is the obvious example. I don’t think it’s unreasonable to support strengthening the laws around these things.

I agree. I’m certainly taking it from my own point of view, and I might be overloading “swindle”. It’s probably a bad choice of a word here. It would have to be on case by case basis anyway, but even with the inflexibility of the system and the impossibility of jail time for every theft case, I think it would have to be at least an option when the intent on scamming for the purpose of selling the data (like those mailing lists) is clear.

I’m not a lawyer.

If memory serves me, the EU does not Operate on the same legal framework as the US, so the assumptions I hear here: that the exact letter of the law they’re suggesting is worrying, is not How it works in the EU. They also don’t use case law to define exactly how something will be dealt with.

It’s a lot more fluid and ‘spirit of the law’y there.

I think.

What's even worse is the same system (Customize) to then land on a 30 page privacy statement with instructions how to opt-out with each of their 140 "partners".

Alternatively you get advised (also in the context of that 30 page privacy statement) to disable cookies.

Which, after laboriously opting out of all 130 options, will show you an error message that not all partners currently except opt-outs. It's infuriating.

If people _cannot_ opt out, then the opt in is legally meaningless. i.e. people cannot legally opt in.

The GDPR says that you only have consent if it is as easy to opt out as to opt in. So if it's one click to opt in and 140+ to opt out, then the opt ins don't count. So you're processing personal data without consent.

That's the way we prosecute them.

This is like reCAPTCHA all over again.

Sure, we don't block accessing our site from a proxy, we just make you select the traffic lights forever. Is a crosswalk light a traffic light? Sometimes. Does it count if only the edge is in the picture? What if it's almost completely out of shot? Let's also slow down the loading of the images to a crawl for no reason and sometimes even if you manage to wait for all of them to show up and select them all correctly 20 times in a row we just say you fail anyway and send you back to the beginning.

There's no point in creating the line if you make the line endless. I'm not surprised Oracle of all places is doing what you've described, either.

If I can't opt out in two clicks, I leave the website and click the next search result.

Or I just right click open it in private mode

No guarantee that they won’t track you through other fingerprinting methods.

When do you ever have that guarantee anyway, though?

I'm not a statistician, but I'd think the less they can fingerprint you, the more you go in the "noise" bucket.

Yeah, but that's kind of a pity if this one was the official documentation...

OneTrust, Evidon, and the rest of the "privacy management" services...why can't I just click once at their site that I don't want any cookies from any of the companies that use them?

I just went through a thing with Evidon where each of their opt outs is a JS-required redirect, and when you get to a company like Adobe, you have to click on a million things with a million disappointments.

https://imgur.com/a/d2qMJqn

It's intentional, and fuck you if you don't like it. Sorry, more like FUCK YOU if you don't like it.

It's clear, that the GDPR should be amended so the only way that tracking will be allowed is to have user send a notary signed letter every year saying that s/he wants to be tracked with a minimum 3 pages of attachment explanation why tracking is so great (in own words, no templates allowed). The company will be required to keep physical copies of these letters for 10 years for random checkups.

Fuck the adtech industry.

dont you like personalized ad's? btw. I do not get the adtech industry either, most of these targeted ads are definitiv not in my favor.

I don't, the only times that I clicked on ads was by accident or site did some shenanigans to make me click on it. I absolutely never bought anything based on ad on site.

I know exactly which prompt you’re talking about, it’s very common around the web.

Unfortunately, the only solution I found that fixes it is disabling ad and tracker blockers. They seem to break that prompt, though if you set them to be very aggressive, the prompt disappears altogether.

Disabling javascript works pretty well too.

You could report the site to the governing authorities as well.

The solution is to fix your ad-blocker. Any good one will also block the consent management garbage from loading to begin with. uBlock Origin with all the "annoyances" lists enabled will block them all according to my experience.

That’s what I meant by “setting to aggressive”, though I should’ve been more clear on that.

I personally wish that making user-hostile dark patterns on your site would attract the same kind of shame as saying something racist. People would learn _very_ quickly not to do it, and the police/state wouldn't need to get involved.

It's the official solution created by Interactive Advertising Bureau and as the standard way to opt-out for all the companies in this organization: https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

There are serious doubts if this is a complaint way to handle cookie consent.

Slow on purpose.

All incentives for the site owners are against user interests.

No one benefits from users clicking to No Consent.

> No one benefits from users clicking to No Consent.

The user does. Or did you mean something else I am missing?

I meant the owners of the site and advertisers.

Sites already have plenty of information in order to run good advertising on their content.

Are there any good examples where the consent is done right?

You can't take someone's lifeline away and act surprised when they try to get around it. Of course websites will do what they can to remain viable.

There is many people that will change their business model once it's unlawful. Not everybody is willing to break the law.

But, there is people that does not care for their customers nor the law. From safety food violations to illegal pollution of air or rivers. That's why we need more strict law enforcement for companies.

Right now, most places are dragging their feet, because there is at least plausible uncertainty. They're waiting for enforcement actions to see what the limits really are, and then they'll likely comply (or cut off access to EU ips, which doesn't strictly comply, but is more effective than asking people if they are EU persons and then denying service)

Advertising doesn't depend on tracking users, please stop spreading this incorrect idea.

Reminds me of trying to opt out of DAA ads[1]

I have never had much luck using it. I just tried now to see if it's different I managed to successfully opt out of 10 / 123. Clearly intentional or all these billion dollar ad companies are running their servers on broken raspberry pis.

[1] - https://optout.aboutads.info

Someone should write the next level of counter measures that just sends a bespoke cookie that contains the do not track info based on patterns similar to ad block - without ever having visited the site beforehand. Or if that's not working for some sites pretend you accept tracking but just forge the tracking ids with random data every visit

Or just use EFF's Privacy Badger.

I am not even sure, if it is legal to make the opt-in easier than the opt-out. But I guess that is some kind of grey area nobody really cares about, even if it is crucial from a UX perspective.

Just tried that (twice) - it took literally a fraction of second to open. Probably it was a temporary issue?

A dark pattern from Oracle? That's unexpected. That's why people are abandoning Java, by the way.

But yes, isn't there on the GDPR that tracking must be opt-in? I don't see how the pop-up is legal, and making the opt-out inaccessible is probably a large violation.

The standard popups are 100% against the GDPR. In the GDPR, all consent must be explicit, uncoerced, and opt-in. If I recall correctly, there can be a request displayed to the user, but the "No tracking" option must be the default, and must not require any more user interaction than the "Yes tracking" option. If there is a "Yes tracking" button that immediately closes the banner and continues, then even having a "are you sure" dialog on the "no tracking" button breaks the GDPR.

The GDPR gets this exactly right, and advertising companies are flagrantly breaking it. I'm hoping that there is actually some enforcement on it as well.

Can you cite the part of the regulation that requires “no tracking” must not require any more user interaction than the "Yes tracking" option.

Everyone here seems to be unaware of article 7, section 3:

>The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

Emphasis added.

https://gdpr-info.eu/art-7-gdpr/

Also relevant bits from recital 32 https://gdpr-info.eu/recitals/no-32/

> Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

> If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Are there some semantic games being played here whereby the initial “Accept vs Customize” dark pattern dialogs don’t count as “withdrawing” consent because no consent has been given at that point? I.e. the annoying path of clicking Customize isn’t actually the withdrawal process, but is just the method of gaining acceptance?

They're definitely trying that as a loophole, but it won't hold up. "No action/response" can't count as consent, and so if you never granted it, then they don't yet have it to begin with and aren't allowed to collect.

Usually the "no tracking" option requires no action. Simply don't press anything in the banner.

Then you get nowhere. The actually compliant popups (maybe about 1/3?) have a really hard to see "reject" button somewhere, while the others make it impossible or force you to click "learn more" (of course customzation options are behind that, very logical yes) and deselct everything manually.

Asshole design ("dark patterns") should be illegal generally, but in this case it already clearly is. Can we have some enforcement, already? Ideally for both buyers and sellers of the terrible stuff.

Yes, and a lot of dismiss buttons -- not just for this, but all kinds of ads/pop-ups -- flat out don't work on mobile landscape mode, which gives them plausible deniability.

Reply on news.ycombinator.com