Comment by codeflo | Hacker News Reader

Comment by codeflo | Hacker News Reader

Laws that require software companies to implement a user choice should really contain some wording against dark patterns. EU lawmakers could have been warned: A similar thing happened back when Microsoft was forced to give users in the EU a choice of browsers, when they created the most confusing dialog possible and hoped that users would just click OK to Internet Explorer out of desperation.

For me personally, when those data protection laws where implemented, seeing the extent of the market for user tracking was a shock to me. The respect that I lost for actually quite a lot of companies as a consequence has informed some purchasing decisions. And I don’t think anybody would mind those banners if the opt-out option you want to click is reachable with a single, easily visible button.

Edit: Responses suggest that the GDPR already contains something to that effect. Glad to know. If that’s true, then I guess it’s time for court cases to sort this out.

By law, users must be given a clear yes/no option, companies just ignore that.

Support noyb if you want to improve the situation: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...

There's a reason why facebook/meta/whatever calls Max Schrems "The Devil" internally, at least the Ireland division.

This. noyb.eu is doing an incredible work. I was hoping to see a link to their GDRP/cookie page in the comments. Thank you.

> Laws that require software companies to implement a user choice should really contain some wording against dark patterns

They do.

GDPR explicitly requires

- that denying is easier than accept

- that all choices are denied by default

- that there has to be a single "no" button, but individual "yes" buttons for every single choice

Just everyone breaks the law.

To add to that, we have the effect that some large $megacorps used these dark patterns in the beginning to see if they can get away with it and others unknowingly just copy it. I work as a webdev contractor and very often get requests by customers to implement the same (illegal) tracking popup, thinking they would be lawful as it is identical to what $megacorp uses.

> - that denying is easier than accept

> - that there has to be a single "no" button, but individual "yes" buttons for every single choice

GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners.

> but individual "yes" buttons for every single choice

This is misleading at best - there can be an "Accept All" Button.

You wrote:

> GDPR requires neither of those explicitly, this is just the interpretation by most regional Data Protection Commissioners.

No. https://gdpr-info.eu/recitals/no-32/ says:

> When the processing has multiple purposes, consent should be given for all of them

You wrote:

> This is misleading at best - there can be an "Accept All" Button.

No. https://gdpr-info.eu/recitals/no-32/ says:

> Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

The legal text of the GDPR explicitly bans pre-ticked boxes for types of consent. You have to manually tick each box individually.

> should really contain some wording against dark patterns Something like: "Default option must be 'no tracking cookies'"? Software companies would find a way to complicate things.

They should just make the tracking forbidden in general.

They should have just said, honor the “Do Not Track” signal from the browser.

This is all it should have ever been. People say don't blame the cookie law but no, indeed, the architects of the cookie law are to blame. When you have crafted a bad law with poor enforcement, it looks like the consent nightmare we live with today.

Click yes or no? I don't want to waste a click more than once to say no everywhere. The pain and fallout of these rules and regulations is squarely on Schrems and others who have "pioneered" these awful laws.

Reply on news.ycombinator.com