Right - agreed - (you'll get downvoted here though - HN moving towards the reddit orthodoxy model vs the discussion model).
Its super off-putting
What about letting users control cookies browser side? No permission needed and total control.
Its super off-putting
What about letting users control cookies browser side? No permission needed and total control.
>Its super off-putting
Nothing about any of your comments on this topic has demonstrated you're the least bit interested in having a discussion.
Open a new incognitio window and go here: https://ec.europa.eu/info/privacy-policy/europa-analytics_en
Do not click accept on anything.
Check your cookies. Tracking cookies have been set before consent.
Many on HN are ranting about how something like this is illegal or that the GDPR is easy. The answer is that the GDPR is NOT easy. That some would say that setting tracking cookies on landing without consent is not legal, others that it is, and the EU is all over on enforcement.
If you browse an EU website, they track you without any explicit consent.
I prefer this approach personally, all their websites used to have a modal pop-up, you could not move forward until you consented. Between phone, desktop etc etc, SO annoying. I'm sure it turned a lot of folks off GDPR, so they cheat with this to try and avoid annoying people (as many others do).
This is you, mate. Look through your comments here; almost all are aggressive, confrontational, and toxic. Some of your comments make assertions with no supporting information and are subsequently dispelled. I can't tell if you're just trolling or are otherwise oblivious to your behavior. If you demand better discourse, practice it.
>Open a new incognitio window and go here: https://ec.europa.eu/info/privacy-policy/europa-analytics_en
>Do not click accept on anything.
>Check your cookies.
"Incognito" mode (or whatever one's browser may call it) is irrelevant in this scenario. This mode of browsing simply eliminates a subset of browsing data upon exit. Such a mode is useful for quickly navigating to some website you don't want showing up in your history or maintaining a session and that's about it.
"Incognito" mode (or whatever one's browser may call it) is irrelevant in this scenario."
No it is not. When looking at what a website does, if you browse in your regular session you may be bringing over a very large cookie store, visit history, prior acceptance of cookie popups. The reason I suggest using a new incognito session is because you start these sessions fresh from a cookie perspective, and the site you are visiting should see you as a new user and re-prompt for cookie acceptance etc. Then you can easily see what they are doing.
It's really actually interesting being lectured and yelled at by "experts" here. I think the GDPR is sort of a bandwagon thing at this point. A fair number of relatively uninformed folks on the issues / technical side jumping on and making a set of fairly strong and often uninformed claims?
You literally have folks saying GDPR is not complicated, and literally on the same threads making plenty of contradicotry claims (ie, totally illegal to not have a deny all button, totally banned to track before acceptance, ok to track before acceptance (default opt-in vs opt-out) etc.
The folks claiming GDPR is easy don't realize how big a consulting industry has sprung up to try and help folks trying to get it right. I mean, tracking rules for the cookie acceptance cookies - is like perfectly up these consultants thing because they make so much money off all this.
I've tried to explain why this isn't sufficient in another comment above: https://news.ycombinator.com/item?id=29122525
TLDR: GDPR covers more than just cookies and restricting cookies does next to nothing when it comes to tracking (in fact modern browsers already do restrict cookies by default, which is a pain to deal with as it does break legitimate usage such as cross-domain SSO).
Just note, politically somehow cookies have become the big privacy boogeyman. Meanwhile personal data is harvested at HUGE scale (cable TV / smart TV/ ISPs etc) at least in the US without consequence. Ripoffs online are insane in quantity without much consequence. Major issues like DoS attacks go unaddressed and more.
And because practically while the EU says ads and analytics are not essential, since for free websites they are in reality pretty essential, there is a lot of natural tension there.
I am bummed about SSO issues now and modal cookie popups particularly on mobile etc.
The other issue privacy folks are missing I think is focusing on this endless consent and reconsent on every website. I've seen data that 95%+ of folks click accept all. So you are delivering a product feature that annoys 95% of your target, it's a losing game.
My own expectation, in long run this compliance overhead will help the mega platforms win out. They are the only ones (youtube / google / microsoft / apple etc) with the scale to really manage the years long investigations, million page doc requests etc. Ie, if you are going to put a video online, you are going to need to put it on youtube if you want anything analytic related to it.
The other side is, vast folks ignore the law and just hope they won't be caught, or do a random (I accept) cookie popup and hope they are covered.
Pop ups doesn't violate GDPR.
Making a system, pop up or otherwise, that is significantly harder to opt out of than opting into and then going on to pretending that users deliberately chose tracking however, that is a violation.
The rules are simple: tracking is opt in. You have to convince users there's something in it for them.
And, as someone who gave especially Google the benefit of doubt for the longest time I can testify that for me at least it did not result in relevant ads at all.
Relevat ads would be:
- local shops (I got two ads for local shops in a decade)
- family cars (I bought three used ones during that decade, not a single Google ad that I can remember)
- programming conferences
- power tools
- programming tools (one for Jetbrains tools five years ago, also a few for WordPress hosting after I searched for it.)
- insurance
- toys for kids
- family holidays
- etc
What I got:
- ads for scammy dating sites
Consent pop-ups as a whole haven't been found to violate the GDPR. Specific patterns that certain consent pop-ups implement were determined to be in violation.
> My understanding is that the cookie set by the consent pop-ups may now be classified as personal data
I have re-read the press release and I don't see that anywhere. A cookie saying consent=true is absolutely not personal data. The problem is that personal data was being collected without proper consent (the pop-up that was supposed to obtain the consent does not comply with the regulation).
> politically somehow cookies have become the big privacy boogeyman
This is partly a holdover from the previous ePrivacy Directive which very much focused on cookies. Consent management solutions (both compliant and non-compliant) were designed to address that. These consent management solutions are now being repurposed to comply with the GDPR and some may not have adjusted their wording and still incorrectly focus on cookies even though the GDPR covers data collection & processing regardless of the technical means of doing so (so it's no longer specific to cookies - you can perfectly breach the GDPR without setting a single cookie).
> Meanwhile personal data is harvested at HUGE scale (cable TV / smart TV/ ISPs etc)
This is something that the GDPR addresses. Unfortunately enforcement has been severely lacking.
> the EU says ads and analytics are not essential
Ads aren't technically forbidden. Non-consensual data collection for targeting is. You are still allowed to serve ads as long as they aren't targeted based on the user's personal data (you can still target based on the currently viewed page's content for example).
Analytics are frankly not essential - you don't lose anything if only 10% of people opt-in for example. But even then, it is absolutely possible to implement analytics in a privacy-respecting way without relying on any personal data (and thus not require consent); for example a single hit counter that just increments an integer every time a button is clicked should not require consent. You'll only need consent if you tie that analytics event to a persistent user session.
> since for free websites they are in reality pretty essential
This is due to a lack of proper enforcement of the GDPR. At the moment the big players violate the GDPR, so any site that decides to respect it will lose out. If the GDPR was enforced and everyone was complying, the playing field will level out and either ad prices for non-targeted ads will go up (as very few people opt into ads, so this leaves a lot of inventory on the table that advertisers will suddenly want to capture) or services will start to ask for payments, normalizing non-ad-supported services.
> I am bummed about SSO issues now
That's a problem because the lack of (enforced) legislation around cookies made browsers delete them aggressively. It would've been better if legislation such as the GDPR was enacted (and enforced) sooner so that abuse of cookies could've been dealt with legally, leaving the concept of cookies itself as-is so it can still be used legitimately.
> modal cookie popups particularly on mobile
That's again due to the lack of enforcement. A proper consent flow should allow you to easily decline all cookies, or even better, just not be there in the first place because the website doesn't have to collect & process any personal data for non-essential purposes (just FYI, cookies essential to the functionality of the website don't require consent - a session cookie on login or for a shopping cart does not need consent).
> The other issue privacy folks are missing I think is focusing on this endless consent and reconsent on every website.
Again see above. Most of the annoying consent flows aren't actually compliant. The reason they're there and are annoying is to trick you into clicking accept (and to hate on the GDPR). Hopefully this ruling will force them to comply with the law which says that it should be as easy to decline as it is to accept.
> I've seen data that 95%+ of folks click accept all
See previous paragraph. That's the intention behind these non-compliant consent flows. If it's too difficult to decline then people will click accept all. On the other hand, when the flow is implemented properly such as Apple's App Tracking Transparency flow (which gives you a system-generated modal that allows you to accept or decline in one-click), the opt-in rate is in the single-digit percentages.
> in long run this compliance overhead will help the mega platforms win out
I am not sure. They are (well, were) currently winning because they are big enough to risk it, but the tide is turning with rulings such as this one. Facebook is in big trouble for example because their business model (which relies on mandatory, large-scale data collection) is at odds with the GDPR and they are trying to legalese their way out of it, unsuccessfully: https://noyb.eu/en/austrian-supreme-court-facebook-dismissed
> if you are going to put a video online, you are going to need to put it on youtube if you want anything analytic related to it
If you put a video online you can easily count the number of views by just analyzing server logs. What you can't do (and Google can't either) is track users to determine unique views for example (as that would require assigning each user a persistent ID).