Hacker News Reader

Comment by k8sToGo | Hacker News Reader

I think consulting tech companies should be something they need to do, otherwise we end up with crap like that cookie banner.

View on HN

That cookie banner is mostly corporations trying to be sneaky and trying to trick people into giving consent, or just flat-out misunderstanding the regulation.

You need no cookie banner if you only use cookies as required by the service you provide to the user.

For instance if a user is trying to log in, you don't need to ask for permission to set a cookie for that. The consent is implicit.

If you want to set tracking cookies on the other hand...

> That cookie banner is mostly corporations trying to be sneaky and trying to trick people into giving consent, or just flat-out misunderstanding the regulation.

If the cookie banner satisfies the regulations and is the path of least resistance, then companies are going to use it.

If the EU doesn’t want the cookie banner everywhere then the regulations need to not allow it.

It is much, much easier to put a banner up than to audit every application and technology used to ensure nothing tracks the user.

> If the cookie banner satisfies the regulations

That's joke though. Most of them don't. And upon getting called out and/or fined, corporations right now just edge a bit further towards an actually compliant implementation - rinse and repeat. Currently we're in the state of "what if we made it really sloooow and convoluted to opt out?" - which is also not compliant because that makes not giving consent harder than giving consent.

At some point we're going to be there, but right now we're not.

The cookie banners as they are implemented right now are mostly wishful thinking by adtech: "Hopefully this will be enough?"

It's not. But nobody wants to be the first to stop widely tracking people and going back to good old contextual ads. They're going to wait until the EU turns the heat up to 100 and maybe even then wait for a competitor to blink first.

Max Schrems' (of the SchremsI and SchremsII court decisions) noyb group is now aiming for sites with non-compliant banners[1], having filed a first round of over 400 GDPR complaints. It will take years before the regulators come up with rulings and those decisions have been litigated, like it usually does, but it's good to see that somebody at least started the process as the regulators themselves have been - as usual - dragging their feet.

[1] https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-ner...

Regulators are massively understaffed. Except maybe the DPA in Ireland, that office seems to have enough resources to rubber stamp whatever comes their way from outside the EU.

> It is much, much easier to put a banner up than to audit every application and technology used to ensure nothing tracks the user.

It is REQUIRED to audit every application and technology to determine what tracks the user. That isn't negotiable, it's the law: you must know where, when and for what purposes you are handling personal data.

After that audit, you can either show a cookie banner etc, or remove the problem applications/technologies.

https://gdpr-info.eu/art-30-gdpr/

You still need to audit every application and technology so that you can create a cookie banner that lets you disable them, if necessary.

At this point, I don’t think they misunderstand. They try to be sneaky.

Thought experiment: if the cookie consent banner was a payment form, things would be A LOT easier to understand. They are ambiguous on purpose. From a UX perspective, most of them don’t make sense at all.

They make perfect sense as dark patterns.

The banner is not because of the law, it's because of the sites. You don't have to put that banner: just don't track people.

When you see such banner, don't get angry at the law, get angry at all those websites that are tracking you.

Why can't they just hire expert advisors themselves? That way they don't need to consult companies who have conflicts of interest.

Imagine the number of ex-bigcorp applicants for those positions that coincidentally left their previous employee on exactly the date the job offers went up ;)

Just exclude anyone with any relation to corporations.

Filling corruption-sensitive positions is a really difficult problem. On one hand it's near impossible to trust the purity of anyone with ties to the opponent, whilst on the other it is precisely and pretty much only those people that have expertise, experience, and inside knowledge that one requires to achieve meaningful success.

Also, if you were chief evil at bigco, wouldn't you keep some people without any backlink around precisely for situations like these?

They do. I know software engineers who work for the government on regulations etc. Then those experts consults with the company experts to talk about what regulations should look like.

They should consult organizations that aren't out to invade privacy for monetary gain. For example, EFF.

There's plenty of EFFs out there in Europe. Most of them are country-specific, but they also have an EU-wide... coalition, for the lack of a better word: https://edri.org/about-us/our-network/

Reply on news.ycombinator.com