Hacker News Reader

Comment by teekert | Hacker News Reader

This latest trend is so annoying: there is either "Accept" or: "See purpose". And the "Don't accept" stuff is hidden under "See purpose". Infuriating.

View on HN

There are sites (like wwe.com) where after you have successfully located the preference to opt out from everything it shows a "processing" screen which is stuck at 98% for about a minute. But accept is "processed" in an instant. Another dark pattern is showing you have opted out but some sites cannot receive opt out requests through https which is written in small fonts. By doing this they have successfully targeted security conscious people. I know this is not something major, but still, how do these people sleep at night?

edit: I looked it up and wwe.com uses TrustArc, which seems to be a shady org certifying privacy. Mired in controversy, they have even settled a case with FTC in 2014 for $200,000. I'm guessing when push comes to shove and EU actually decides to prosecute they will pay a similar amount. I bet that amount is already in there books, set aside as "future risk management" or something like that. Just the cost of doing business.

> There are sites (like wwe.com) where after you have successfully located the preference to opt out from everything it shows a "processing" screen which is stuck at 98% for about a minute. But accept is "processed" in an instant.

How desperate does one have to be to work as a developer on projects like this?

you assume the people doing this see a problem with it. They could easily...

* just be a nihilist and not give a damn

* Think its fine because they are encouraging people to do something they see as good.

* Think its fine because 'its just ads'

* Think it's someone else's responsibility to make decisions about ethics (as an engineering prof, I see this all the time...students who say engineers' jobs are technology not ethics/morals)

> Think it's someone else's responsibility to make decisions about ethics (as an engineering prof, I see this all the time...students who say engineers' jobs are technology not ethics/morals)

The problem is that they're correct in a practical sense.

The company they work for might get fined, but all the engineers see is the performance review. This system encourages engineers to think of compliance and morality as someone else's problem because: it is.

Many will justify this as "if I don't do it, someone else will" and again: absolutely correct.

Pass a law where engineers themselves may face fines or jail time for implementing immoral code, and they will suddenly discover a keen interest in the ethics of what they do.

> The company they work for might get fined, but all the engineers see is the performance review. This system encourages engineers to think of compliance and morality as someone else's problem because: it is.

Didn't work so well for the VW guy: https://www.theregister.com/2017/08/25/vw_engineer_gets_3yrs...

> "if I don't do it, someone else will"

Maybe, but at the very least it raises the price for companies to buy unethical people.

or lowers the cost because at least some ethics are the luxury of the well-off. (sure, worrying about feeding family might not lead you to kill someone but it might let you make it difficult for users to opt out of privacy invasion)

Morality (definition left as an exercise) is something you have to be able to afford. Get hungry enough, get tired of sleeping on cardboard enough, get tired enough of restrictions imposed on you by society for stupid mistakes you made while out of your mind ... and morality is a luxury you can't afford. (In many countries, that luxury is permanently out-of-reach for the great majority.)

Now add to that the constant reminders that morality doesn't stop a lot of people at the top from immoral behavior. Banks, politicians, Wall-Street, celebrities, billionaires etc. are in the news all the time for pulling shady shit. When they get caught, they say OOPS! They hear: 'don't do that any more, where people can see you' and they're free for another round.

Many people tend to adopt behavior that's rewarded. It takes a strong moral compass; some people never got magnetized. Show people a society that rewards moral behavior (they exist) and they might go there. (Some countries have low recidivism rates because of how well they treat people in prison.) If people can afford to move, they might. Else they may just say screw it, XYZ throws toxins in the river, I'll do it too. Choice: track people or go shoot 'terrorists'. Hmmmm.

I see this argument a lot, I grew up in such an environment. But being moral is really not a luxury because there are several very rich people who are immoral. Being moral is easy or hard depending upon your means, but so is everything else. At the end of the day you have to think about what you are doing and you and solely you are responsible for this.

Also this whole argument is distracting from the fact that this is TrustArc we are talking about. Its an american company with 340 employees and over 20 million american dollars in annual revenue. When a company out of India does this same thing we can argue impact of means on morality then.

You're assuming it's developed in the west. They could've just outsourced that work, too. Here in India, I don't see too many developers who give a damn about user privacy. From privacy international's report on menstruation apps stealing data [1], two of the worst offenders (Maya and My Period Tracker) were from Indian companies.

1: https://privacyinternational.org/long-read/3196/no-bodys-bus...

earning your food and housing tokens is way better doing something like this than a lot of other things.

I guarantee that any engineer working on that product could get another equally well-compensated job which is not so morally bankrupt.

This argument doesn't hold up if you refer back to all engineering ethics dilemmas of the past. If all these engineers could have easily gotten another job, why did they stay? Why did Boeing engineers not speak up, why did Firestone engineers not speak up, the list continues. Not everyone has the same moral compass and that is the bottom line.

There are engineers working at Facebook.

The best thing is that, once you waited for the time, it fails:

> This page transmits information using https protocol. Some vendors cannot receive opt-out requests via https protocols so the processing of your opt-out request is incomplete. To complete the opt-out process, please click here to resubmit your preferences.

Here sends you to the same loading popup

Not everyone has the luxury to say no to unethical work, especially during a time when job security isn't easy to find.

Given that very nearly the entire software industry has either acquiesced to or actively abets practices like these, the real answer is generally "desperate enough to be seeking a job in your field".

I suppose someone could also structure the requirements for the task in such a way that it would have this result without explicitly saying it would have to have this result.

Given that the accept is our default just send off the accepted token = ok and don't wait for the response.

Send array of opting out info and then wait for all responses are ok so you can tell the user that it worked to opt out, the user must see opting out worked! response before going on to next step, because for GDPR reasons we need to tell the if there is a problem so they can try again!

- but that means we will be stuck at 98% for about a minute!

- sorry developer bro, GDPR says.

- (small voice) ok, manager.

>I know this is not something major, but still, how do these people sleep at night?

Easily and without issues. Humans are very good at making sure they do not feel themselves to be evil. A mass murderer will blame everyone except themselves or rationalize their actions as just.

Things which come to mind in 30 seconds:

"The regulation is draconian and it is just to fight it in any way possible."

"Our business helps people and working around this helps our business and thus helps people."

"If people really wanted and weren't simply mindlessly clicking buttons this won't stop them so we're actually helping user's enact their will."

"We put all this effort into the business, it's evil for the government to interfere for wishy washy reasons."

This one drives me nuts! It's just such a brazen and blatent piss-take - "you won't let us hoover up your data and sell it to everyone we can? Then we'll punish you".

Well, that indeed sounds a bit like something Vince McMahon might have said.

> it shows a "processing" screen which is stuck at 98% for about a minute

Proximus [0], the partially state-owned and largest telecom provider in Belgium, uses this pattern too.

Additionally, on mobile, scrolling through the cookie-usage options automatically selects the maximum invasive option. The 'scroll-touch' is registered as a regular touch selecting the option.

It's hard to believe this is by accident.

[0] https://www.proximus.be

This is also Truste/TrustArc [1] that GP mentioned, and they do it on every website they're installed.

Looking at their Javascript code and Timeline in the inspector it is 100% fake. It is all implemented using setTimeout and there's no communication with the server in the meantime.

[1] https://trustarc.com/cookie-consent-manager/

Thanks for this analysis. I knew something like that might be happening but didn't know enough about js to confirm.

Verizon was my, umm, favourite for all this shit.

Shows a popup, saying "we collect your data yadda yadda yadda". Then there were two buttons. One to agree to that. One to manage it. But clicking on the manage button just took a user to screens and screens of garbage information mainly listing the companies that used the information. Without any option to opt out (you could contact them to opt out, I assume individually). There was a button (if you drilled through the screens) which seemed to imply that it would link to a page that allowed opting out, but all it did was take you back to the first screen of the popup. Unreal. Somebody has thought about that; absolute cretins.

They've changed that so that now there is opt out toggles (which are obviously all split into groups and are all on by default and so on), I assume because of someone in legal tapping them on the shoulder?

I think what's really needed is an extension that automatically selects options for you to disable everything.

The default is disable everything (otherwise it's not GDPR compliant). That banner is to try to trick you into accepting the same old.

You're better off finding a good cookie/GDPR banner blocker

ah I see, so basically the uBlock list that blocks from displaying these is all I need.

"EasyList Cookie" is the name of that list.

thank you, there are other sites[1] (mostly non English) that still can get out of it. I'm trying to manually block it, but it uses random ids. Is there a method for that?

[1] example: https://www.wp.pl/

Sorry for the late answer, I've played with it a bit and can't get rid of it reliably.

Do you have tampermonkey or anything like that? Maybe you could make a JS snipped that get's rid of those elements...

And, an "accept" holds for seemingly till the end of time, while a "I don't accept" is valid not much more than the mouse button click echoes through my room before you stand before the dialog box yet again, contemplating why you don't do something more useful with your life.

Even worse, nowadays there's only "accept" and "maybe later"

That's a classic Google move.

Tried to deny some google apps access to fine location, and it would ask at every single opportunity, it was so easy to accidentally enable it as well, which I guess is the point, wear you down until you press the wrong thing or just give in.

Hell I seen one yesterday that was only 'accept' or 'subscribe to newsletter' with the 'not accept' being linked to the 'cancel' button of the subscribe to newsletter popup. Which you had to click into first.

Thank you for mentioning this. I feel as if I have to repeatedly jump through those hoops to decline on the very same sites every other day, if not visit.

Surely the GDPR has to have the foresight of dictating that my choice to accept or decline has to be valid for an equal amount of time, doesn't it? If I'm confronted with that popup as long as I'm declining the regulations are worthless.

The GDPR itself really doesn't delve into that kind of detail. Generally, it's up to individuals to lodge complaints with their national data inspectorates regarding this type of thing, who then determine whether some specific procedure is compliant with article 7 (in this case) of the GDPR.

The worst ones have no opt out at all except for a general referral to the browser page for deleting cookies.

On sherdog.com, you get a giant cookie dialogue that covers half screen on mobile.

If you don't accept, but click on "cookie settings" instead, a page will tell you that you can't choose to block 3rd party cookies unless you accept their 3rd party cookie, because they need to save your setting of not accepting 3rd party cookies in a 3rd party cookie. It's not a Monty Python episode, it's real: https://ibb.co/6YFpGWK

alternatively, if you click on the next link, you will be taken to a page that explains how to disable cookies in all latest-gen browsers such as Netscape 3 or IE 4.0:

http://www.allaboutcookies.org/manage-cookies/

Needless to say, I now exclusively use Sherdog's competitor, Tapology.com

One of the only websites I've seen that offers a big and clear "Decline" button is NextRoll's advertising service [0], e.g. seen on Texas Instruments' website [1]. But I haven't checked whether clicking the "Decline" button actually opts out everything.

[0] https://www.nextroll.com/trust-center

[1] https://www.ti.com/product/TPS543620

My company actually did a very extensive study on this and found that the majority of websites utilize dark patterns. Only 25% of sites are even legally compliant even after deploying consent management software. Companies are openly flouting privacy laws and we actually found some of the worst offenders in the app space where consent mechanisms don't even exist within the apps themselves.

Sometimes it just refers me to the ad tracker's page and there is no option to opt-out except for mail...

I have seen worse. Der Speigel has "Accept" and redirection to sign up page for a paid subscription. I wan under the impression that forcing people to agree to tracking by withholding services until they do is not allowed under GDPR. Well, apparently it is.

https://www.spiegel.de

https://imgur.com/VWBmUzU

> I wan under the impression that forcing people to agree to tracking by withholding services until they do is not allowed under GDPR.

You're 100% correct in your assumption. Der Spiegel is treading on thin ice here, or at least I hope they are.

Here's the relevant GDPR text:

Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment [1]

[1] https://gdpr.eu/gdpr-consent-requirements/

The Washington Post have the same thing. To view articles for free, they require you to sign away your GDPR rights, and they attempt to charge you 2x the money for a subscription without tracking.

Sucks to be them I guess, as I pay for news (and run Ublock) but won't reward this mendacious behaviour.

I'm wondering if enforcing this on the browser level wouldn't make more sense. I mean, if a site use cookies or wants to track you in any other ways it would have to ask for your permission the same way you are asked before accessing your camera or microphone. You could opt-in or opt-out which should be the default if you don't make any choice. Then the sites would have to clearly stop you from accessing their content if you didn't opt-in, the same way you are stopped with paywalls. I think this would be much more transparent if we really want to teach people that they can pay for the content either with their money or their data. Of course another choice would be to just avoid these sites whatsoever.

Cookies are just a mechanism - tracking information about you without cookies (e.g. by associating it with your IP address and/or other identifying bits) needs just as much consent. A purely technical solution cannot work.

Browsers could still provide a consent API but without strict enforcement it would be pointless - and with proper enforcement you don't need it.

You might be interested in the proposed Do Not Track header, which has so far failed to get any traction. https://en.wikipedia.org/wiki/Do_Not_Track

It's worth noting that Microsoft enabled Do Not Track in Internet Explorer by default just after it started to gain traction, which caused a small backlash against its use [0], notably Apache started to ignore all DNT headers from Internet Explorer.

I have to wonder whether it was an intentional effort by Microsoft to discredit DNT and to stop people from respecting it... On one hand, the same outcome (almost ignored everywhere) is likely to occur regardless of whether Microsoft made its move, on the other hand, it may have gave it a greater push.

[0] I have my cynical Fundamental Law of Privacy - it must not be enabled by default, so that the industry will continue profiting from it, while giving the user the illusion of choice. But at least those who enabled it enjoyed privacy, although only to a very limited extent.

This is how it should be. Unfortunately even if this becomes a standard I can foresee Google dragging their feet on this and never implementing, and providers refusing to comply on grounds of "the user didn't reeeeeally mean to block tracking".

also absolutely meaningless. it's essentially then going that when fines get handed out, they just get a warning because they tried.

Wow, autocorrect mangled the 2nd sentence badly.

> It's essentially them hoping that when fines get handed out, they just get a warning because they tried.

This sort of 'dark pattern' can be found even on otherwise reputable websites, like TomsHardware.

I believe it's against the letter of the GDPR, but as it isn't being enforced, we can expect this kind of thing to continue.

The tracking banners frenzy gdpr started is unbearable. It has decreased the usability of the web significantly.

Everyone is obsessed with improving page loading time but what does worth that the page loads instantly if I have to navigate a maze of banner consent screens before I can see the content behind it

Why can't everyone at least agree on the same banner format / ui or have it delegated to the browser behind some native browser functionality like autocomplete

Good question. The downvotes are undeserved.

The reason is that if it's done in the browser then a person's preferences will apply to every website they use with that browser. Publishers will not want that as they hope that users will give them more consent than other web sites (I certainly do give some websites full permissions if I like them, others are a 'reject all' and 'object all')

Also, your consent preferences are stored under that website's cookie. There is the option of a global cookie but nobody uses it. This cookie data is then sent to everyone involved in the adtech chain (which is causing issues since it can be multiple KB's in size). It's format is described in [0]

[0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

Perhaps this is where the regulation should've been aimed at in the first place? Cookie options have been present for a long time, but they don't have the necessary granularity. This would've been a great push to update the system.

It's the website's fault, period.

They want to track you to death, and put the burden of tiptoeing the law on you.

GDPR does not require any banners or consent dialogs at all for cookies that are necessary for authentication, navigation, or keeping track of shopping cart contents in the current session, etc.

It's only the unnecessary tracking that needs explicit consent. So it's a good thing if such sites are slow to load and have to present irritating banners for legal reasons. This will hopefully put them at a competitive disadvantage compared to sites that don't insist on tracking their customers.

The page loads instantly because there's no tracking crud all over it in my experience of forcing* GDPR compatibility on clients

* sorry I meant strongly advising using legalese

P.s. I'll throw an internet party when Hotjar go out of business. Creepy fucks ruin the load time of every site they tarnish.

It's not GDPR compatible by the way.

Unfortunately, it's compatible until the EU decides to hold people accountable for it.

Not even the EU as a whole, it's up to the individual regulators in each country.

On a related note: Since most US companies base their EU subsidiaries in Ireland for tax purposes, it's actually just up to the Irish regulator. There are... concerns.

Individual freedom and sovereignty are always pesky nuisances for foolish centralized schemes.

To be fair to the Irish regulator, the only reason that people have been able to delete Facebook accounts is because of their 2012 investigation.

They are somewhat under-staffed, but this is improving (did you know that they are also suing the Irish Government?)

https://enforcementtracker.com/

This probably needs to be an order of magnitude or more higher, in order to start catching up with the web. To speak nothing of getting ahead.

Reply on news.ycombinator.com