"This is not an official EU Commission or Government resource"
Which explains idiocy like
> We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
Is simply not on. You can't assume acceptance.
Law experts don't code webpages. But this is embarrassing nevertheless.
I do not see this argument as idiocy.
Many stores have signs out front stating, "If you enter this building, you accept that you are being filmed". Many are recording you before you even enter. They do not require explicit consent from people willfully choosing to enter.
Should we really assume that the client has not taken any responsibility when they willfully type in https://www.somewebsite.com/ and hit enter?
Since users can block cookies/javascript, or simply not visit websites they don't trust, I genuinely do not understand at which threshold of manual intervention we can finally conclude that a user has accepted responsibility - if their voluntary decision to visit does not count.
I get that companies sharing data and doing nefarious things with your personal information is not great, but I don't see how this does anything to help with that.
To make this a fair comparison, the sign would say:
If you enter this building, you accept that you are being:
- filmed
- probed for all wifi and electrical emissions
- weighed
- measured
- secretively (as much as can be managed) pinned with tracking beacons
- lured into unknowingly entering other buildings w/o realizing it
- fingerprinted by any surfaces you touch
- associated with the means of transportation to arrive/depart
- and on and on and on
What amazes me is how many people were worried about the distopian future of minority report [1] 20 years ago, yet (especially on HN) now it's here they welcome it. I guess Upton Sinclair was right: It is difficult to get a man to understand something when his salary depends upon his not understanding it.
[0] https://blog.ansi.org/2018/05/gait-analysis-walk-biometric-i...
[1] https://medium.com/context/personalized-advertising-is-an-ox...
Taking your example of signs in stores: if a store had a sign saying "if you try to steal from this store you will be shot on sight" it does not suddenly make that legal because a customer saw the sign and still decided to enter.
Additionally with a website you do not see the message until you have already entered and they have already placed the cookie so again, there can't be implied consent. It's just notification of what they have already done.
The EU cookie laws are basically, for non-essential cookies (e.g. mostly tracking/ad stuff) users must be given the option to reject them before they are enabled. Seems pretty simple + pretty fair to me. The problem is that most websites fail to implement it correctly. When they do implement it correctly it's really useful in my opinion.
The GDPR however does require explicit consent.
>Should we really assume that the client has not taken any responsibility when they willfully type in https://www.somewebsite.com/ and hit enter?
I didn't type in anything or click enter to get to that site.
>Since users can block cookies/javascript,
Except when that breaks stuff.
I think you missed my point. I not asking about what the law says. I'm asking why a person willfully choosing to visit a site is not considered a form of consent, since it requires an intentional action from a user. If intentionally visiting the site isn't consent, how is it that clicking an "Accept" button magically is? Both are intentional actions by the user.
Feels like walking into a store and saying, "I don't consent to be here". That's fine, but you chose to be here, so now here you are. Feel free to leave and not come back. You have that choice.
Answered by another user: It depends on what the cookie is used for, and I understand this perspective to a degree.
Session cookies are required for a lot of basic functionality and have been around forever - people are used to them. But cross-site tracking and other telemetry tracking for targeted advertisement is a bit of an overreach, and very invasive. I get that people don't like it, but you can block a lot of that, and opt out of visiting the site entirely. I don't understand how adding an "Accept" does much. Feels like a superficial change.
> I didn't type in anything or click enter to get to that site.
Are you being pedantic...? If you clicked the link, you engaged in an intentional action - which is my point.
> Except when that breaks stuff.
Then don't visit?
https://gdpr.eu/privacy-policy/ suggests they share data with third-party Google Analytics, which seems to breach guidelines - except that they respect Do Not Track in this case.