Hacker News Reader

Comment by hnarn | Hacker News Reader

The most frustrating thing about these cookie banners (more like cookie lightboxes) is that almost none of them are compliant with the rules. Unfortunately I don't have time to find the source right now, but I'm pretty sure I've read official EU guidance docs clearly stating that many "dark patterns" are simply illegal. For example making the "Accept all cookies" button require less effort than only accepting necessary cookies, which almost every page does.

I feel like the current state of cookie consent is completely broken, partly due to the complete lack of enforcement, and having a browser-specific setting that propagates to all pages would be great -- but again you have to think about incentives. If pages are not required to accept these settings, their incentive is to ignore them and to claim that since it's unfortunately not supported "yet" (read "ever"), you still have to wade through the cookie form.

View on HN

At least in France, there's CNIL (Commission Nationale de l'Informatique et des Libertés) that started going after the top non-compliant websites and sending love letters like "you have N days to become compliant".

[1] https://www.cnil.fr/en/home

And then Europeans complain when the rest of the world geoblocks them.

No one's complaining about not being able to access shitty websites that can't be arsed to make clear which companies are tracking you.

Where are these fictional Europeans who want strong enforcement of privacy laws and complain about geoblocking?

The whole point is that either you follow our laws or you lose access to Europe. Geoblocking is just self-regulation.

Here's one. I hate it how I can no longer access 90% of local US news websites.

Every single time I've had this problem I've just used the Google cache or archive.org

No, we politely inform you that geoblocking is not actually required. But thanks for protecting us from your privacy-violating website anyway.

I have been building some sites where I have explicitly tried to remove or avoid cookies completely. It is really tricky as any third party script or embed can set cookies, which may be retained depending on browser version. We end up using generic cookie prompts just in case to appease corporate compliance even when nothing is usually set on the page. And the http nature of cookies make automating things much more difficult. You can't just drop in some javascript that overrides document.cookie, and even if you could it would not be supported by all browsers.

What I would like is to be able to whitelist domains in content security policy and reject everything else by default.

Why avoid cookies entirely? You don't need a cookie banner for cookies essential to the functioning of your site.

You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner.

It's also significantly easier to convince a lawyer that you don't need these things if you can prove that there are no cookies whatsoever. And even then they'll be suspicious.

It's harder than it looks, just embedding a YouTube video for example already sets third-party cookies. Same with embedding a Twitter feed or Google Analytics. There are solutions for all of these things, but the standard/easy way of doing these things means your user gets a third-party cookie, which means you need the banner.

> You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner.

Wrong. Functional cookies are exempt.

What are "functional cookies"? Are analytics/telemetries cookies functional? Are cookies identifying google users so they can receive targeted content but also ads "functional"?

GDPR never bothered to specify. This is why GDPR is broken and sadly it broke the web.

Have you tried finding the answer to your question online? There are clear examples of what "functional cookies" mean, even straight from the EU.

There are many opinions online, but there is no authoritative, definitive answer. GDPR was made vague by design "to prevent future exploits". Even lawyers are arguing the details, three years after its introduction.

This made GDPR in effect one of the most expensive regulations we had to implement as IT companies. It is also so incredibly punitive that everybody choose to implement it in the most conservative way possible, at the expense of the UX. Thus the cookie popups and banners.

The GDPR doesn't even mention cookies.

It's the ePrivacy Directive that regulates them (or, more precisely, "information stored in the terminal equipment of a subscriber").

And the ePrivacy Directive does, in fact, define what's allowed without notifying the user:

"any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user."

This kind of vague, high-level language is exactly why, if you reject cookies, you'll receive the same damn popup next time you visit the website until you relent and click Yes.

They never tried applying their abstract concepts to the real world until we had to and the result is "The Web of Cookie Popups".

You have a point, but at the other end of the spectrum, writing precise legal terms can cause problems as well.

If the terms refer specifically to "cookies" and "browsers", it'd be entirely possible that the advertising industry and other players would simply change their own wording to evade the law.

An effective legal claim might be able to find out about and catch up with those kind of tricks; but it'd be partly a game of time, and simply by delaying legal challenges while their operations continue, the ad industry would have achieved their goals.

Instead of ranting and providing nothing but conjecture about how "expensive" GDPR is (whatever that means), or insinuating that lawyers "arguing" about something proves that legislation is ineffective (that's literally their job), refer to first hand sources and ask constructive questions in good faith about what you don't understand. Here's one example: https://gdpr.eu/cookies/

Both first party session cookies and "shopping cart" cookies are mentioned as explicit examples of cookies that do not require prior consent and are unlikely to cause any concern.

Then why does the very gdpr.eu website have a cookie banner at the bottom of the page?! There is clearly no session or shopping cart going on.

Uh, are you asking why a site with that doesn't use cookies in a purely functional manner has a cookie banner?

In any case, it's the usual reason: they have google tracking, and it seems like they embed content from other sides the easy way. You too can learn the answer to the mystery of why there is a consent banner by clicking the "Privacy policy" button, this one actually explains it clearly, like it was supposed to be a model example or something.

Actually the unobtrusive cookie banner as implemented on that site is illegal under GDPR. Check out https://ico.org.uk/ for a correctly implemented popup with its dismal UX.

Please do not use that website. It presents itself as an authoritative resource, but it is not actually an authoritative resource. Nor, frankly, even a very good one.

Actual first party resource: https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

ICO is literally the agency that issues fines for GDPR violations in the UK. They have a lot of explicit guidance about what's OK and what's not.

More detailed guidance on the "strictly necessary" exemption: https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

The statement isn't "Wrong.", it's just overly strict.

Of course I know that, but did you ever talk to someone who is not in technology but does have a say in determining what "we" need to do to cover "our" asses?

Say, a lawyer with the responsibility that all of our websites implement all of the relevant regulations?

You would think that they are up to date on what regulations you need to follow, but you'd be surprised. Many take a blanket "no risks under any circumstances" approach. These types can only be placated with the "we don't have any cookies at all" argument. And even then only barely.

Still, the boss said: "add a banner anyway." Better safe than sorry, and everyone expects it by now.

These particular sites didn't need essential cookies and discussion about privacy/cookies was taking lots of time for no real benefit.

Also, I believe philosophically in trying to reduce things like analytics and tracking.

> For example making the "Accept all cookies" button require less effort than only accepting necessary cookies, which almost every page does.

Like those that make you uncheck 10 or 20 entries one by one.

Or like those that make the "Accept all cookies" button green and the "accept necessary" white/colorless/default.

I recently came across a website that makes the "Accept all cookies" button secondary and the the "accept necessary" primary. It's such an effort to actually press the primary button — I have been so trained by the completely disdainful behavior of the majority of websites.

I saw the exact same thing and was surprised too! I wonder if it was a site that was on HN...

I press "accept all" by accident and thought "wow".

Well I needed to visit the website due to an unfortunate event in meatspace - in no way hacker news related. So it seems there's definitely at least two sites which do it!

Those are the worst. And calling them “legitimate interest” only adds insult to injury.

Also the providers that appear to offer a even choice of accept all/reject all, except you realise that they've classified a second "legitimate interest" option for everything which the reject all doesn't cover (because that would be objecting, not rejecting)

The best ones are the ones that provide a list to 100 partners and ask you to visit them to opt out. Usually just close the tab when I hit one of those.

Max Schrems now has a foundation you can donate to: https://noyb.eu/en

But they pretend to be legal. They at least make an attempt to seem kind of legal. And that's what matters.

If you only accept a spec like this there is no way to pretend to be legal other than to accept it anymore. Make custom cookie banners totally illegal. Force the use of this. No dark patterns, no semi-legal trickery. Either you use it and accept it, or you don't. Take out the grey area.

That's my point: that if you create a standard like this but don't enforce it (which is not the same thing as its legality) it won't matter. What is the consequence going to be of ignoring it? Will it be enough to actually create an incentive more attractive than breaking the law?

Instead of permitting sites to request consent of the user directly, they should be required to request consent via an official EU site. It could work like an authorisation redirect flow. This would standardise the consent UI, and prevent sites from implementing dark patterns.

Then the EU tracks everything everyone does. Nice.

The site could provide an opaque ID for user. Also, anti-tracking on the part of the EU could be enforced by law.

Ignoring the many obvious privacy issues with this proposal, have you considered how this would result in a legally mandated single point of failure for (nearly..) all web sites?

This is an awful idea.

Better yet, a standard browser interface.

Yup, this is absolutely the case. Consent in order to count as consent has to be clearly affirmative, freely given, specific, informed, unambiguous and can be withdrawn.

https://gdpr-info.eu/art-7-gdpr/

It's EU, it varies by country. Each country takes the European GRPR law/guidelines and implements in on the national level. There may be slight differences. Your specific example where opting out must not cost more effort than opting in is specific to the UK GDPR implementation for instance.

The point is that it's not being enforced, so if we assume what you say is true for the sake of argument, then the only way that would be OK was if a different cookie banner was shown for visitors from the UK, which I highly doubt happens in any meaningful percent of cases.

No. The GDPR is an EU Regulation which is, by definition, a binding legislative act. It applies in its entirety across the EU - no exceptions, no opt-outs. EU Member States are allowed to interpret (to a greater or lesser degree) EU Directives when they translate them into national law[1]

The EU GDPR no longer applies in the UK because the UK is no longer a member of the EU. The EU GDPR has been incorporated into UK law (as the UK GDPR) but there's nothing preventing the UK Government varying it at any point in the future[2]

[1] - https://europa.eu/european-union/law/legal-acts_en

[2] - https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...

'A "directive" is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to devise their own laws on how to reach these goals.'

And the GDPR is not a directive.

But cookie banners must also adhere to the ePrivacy Directive, which is a directive (as the name implies).

> A "directive" is a legislative act that sets out ...

Maybe my wording was a bit vague. How about: "The GDPR is an EU Regulation which is, by definition, a binding legislative act which applies in its entirety across the EU without the need for Member States to pass any further national legislation. This is different to EU Directives, which EU Member Sates will implement by translating them into their own national law - which in turn does give Member States room to 'interpret' the Directive's requirements - subject to legal challenge in the Court of Justice of the European Union"

Reply on news.ycombinator.com