Hacker News Reader

Comment by tomcooks | Hacker News Reader

Now if only they forced websites to have a single, standardized, accessible, unobtrusive popup~

The worst is that it punishes the most privacy conscious of us, who clear cookies on every session, and are forced to click and reclick again on the same popups. I think the law should have been enforced at the browser level, mandate browser makers to prompt for authorization and once it has been refused, to never ask again.

In other words you want to delete a cookie and still have a cookie.

They should have mandated treating the Do Not Track header as opting out of all tracking.

I wonder whom is to be blamed, maybe If politicians asked technicians and accessibility experts before taking decisions we'd have a better world.

This what happens when people who don't know how to use the internet make laws for those who do.

I'm implying every politician involved in the decision, or at least the majority, uses a couple or sites and had to approve cookies and data handling only on a handful of sites, once in their life. I shouldn't generalize but, even as an able bodied internet user, I find it extremely cumbersome to surf.

Even better, force them to respect something like https://globalprivacycontrol.org/

and prohibit showing an obtrusive popup.

I'm surprised there is no standard for this yet. Just build it into the browser like all other privacy-related requests (location, webcam etc.) are handled. If sites don't implement it, don't accept their cookies. That way I can also manage a blanket yes/no list without getting an obtrusive popup every time.

Expecting another smash success like the Do Not Track header.

If you could sue people for real money when they violate said header it might be taken more seriously pretty quickly.

I don't believe that you can sue under the GDPR. I've always understood it to be something that you can lodge a complaint against someone with your local authorities. No idea about the CCPA but I wouldn't be surprised if you could considering how lawsuit-happy Americans are.

> I don't believe that you can sue under the GDPR.

I don't believe that either, I just think that flags like these can only be taken seriously if all actors have maximum incentive to take these seriously.

Do not track is a gentleman's agreement in a world of thugs. But you could block cookies at the browser level if the user clicks No.

Do Not Track didn't work because (1) it was not enforced at the browser level, (2) it had no legal backing and (3) it was not granular enough to be useful. With GDPR, CCPA etc. in place the online privacy landscape is very different, and a new standard is very much possible today. Why did every site in the world implement all the consent popups in the first place when they could have continued to do nothing?

The problem is that I can't possible imagine Google implementing this, as it would hurt their data hoarding

Why? The browser has access to it at all times, and you can still ask for it anywhere. So Google (via Chrome) isn't losing anything.

In fact, everyone else (including Google via analytics) is probably get more data; make it so that in the same way the browser form fills address and phone number and things automatically based on past fills, have a standard API in the browser to handle that. Now users just have to click "okay" to share all that data, rather than enter it in.

Well seeing as a lot of sites use dark patterns to confuse users into accepting more liberal tracking, I'm not sure I would agree that this would lead to more data collected

It may surprise you, but Google was not the villain here:

https://www.cnet.com/news/apache-web-software-overrides-ie10...

The problem is that sites will just pretend that any such standard doesn't actually exist. All of these sites could suppress cookie popups for clients that send a do-not-track header, but choose not to.

They did. It was called Do-Not-Track and Microsoft had the bright idea to pull an iOS 14 and turn it on by default in IE. At that point the few ad companies that had supported it basically told the browser vendors to pound sand and it became entirely useless for anything but fingerprinting.

Do not track should have been on by default. But the idea that anyone would ever obey it without the legal force was always a fantasy. If 90% of people checked "do not track" do you think they would have started to follow it? Of course not. They would just have some other reason.

Everyone's talking about DNT, but P3P from Microsoft circa 2002 is probably more instructive: https://en.wikipedia.org/wiki/P3P

Privacy is nuanced. It's' really hard to encode all ways you may or may not want your data used into a few boolean questions.

One of my favourite Stack Overflow answers still is making your privacy policy a potato.

https://stackoverflow.com/a/16475093

I definitely spent time in like 2004 trying to understand what to put in the field to make my SSO work in IE until I found out everyone just lied.

In France, we're starting to see sites where they give you two options:

1) accept advertising/tracking cookies

2) pay a monthly subscription

I've seen this on AlloCiné (French IMDB), and "aufeminen" which is a random forum that a Google search led me to.

I believe that this is likely not GDPR compliant, although this view doesn't seem to be shared by many. My basis for saying it's not is https://www.privacy-regulation.eu/en/recital-43-GDPR.htm

> Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

I take this to mean that you cannot rely on consent that a user has given you to process their personally identifiable information if they did it in order to access a service you wouldn't let them have access to otherwise.

But the provision of the service is not made dependent on the consent if you can alternatively pay the monthly subscription. So I would assume, “accept all cookies or enter paid subscription” is Gdpr compliant.

> Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

https://gdpr.eu/Recital-42-Burden-of-proof-and-requirements-...

I think having to pay a monthly subscription, or losing access to a service when you withdraw consent and don't pay a subscription should be regarded as a detriment.

I ban the domains that do these kinds of things, and forget about them forever. It's at the cost of my experience online and convenience, but freedom is never convenient.

Or force websites to obey the Do-Not-Track HTTP header.

https://en.wikipedia.org/wiki/Do_Not_Track

that's a lot of trust in the fly-by-night ad industry

That's being encouraged by California law: either honor DNT or come up with something else: https://www.dwt.com/blogs/privacy--security-law-blog/2020/07...

The point of that is to make you click and maybe by mistake give them their consent.

We already had do-not-track in the browser, why do you think companies refuse to honour it?

because they're not getting fined 200m for it?

What about having a law that makes it clear that an popup does not create informed consent, and then have companies decide to ignore that part of the law because it would be super inconvenient if they had to actually get informed consent.

Maybe EU should write a new law by copying the GDPR text that defines consent and make it bold, all in caps, and underlined.

Cookies are somewhat out of scope of the GDPR. The GDPR was designed to have a twin who should regulate somethings like Cookies, Email and Telecommunications; it is now stalled for 3 years and everyone hopes it will come out next year.

So much this, I'd actually rather opt-in if that meant the cookie popup would go away once and for all.

They should fine organizations for providing a worse experience while people choose what settings to accept

Basically I see a quick experience for accepting everything, and a degraded experience for not clicking that but getting a list of what to accept or denying all

Reply on news.ycombinator.com