Hacker News Reader

Comment by jstummbillig | Hacker News Reader

I recently spent an inordinate amount of time implementing effective self-hosted cookie control (as in: actually deferring loading of offending scripts until after being accepted, and then loading and executing after being accepted without having to trigger a page reload)

It would be absolutely asinine to assume that a layman could understand, much less implement the currently available solutions in an effective manner, so here are the two scenarios that small businesses are faced with:

a) They still wanna make use of cookie powered tech and just do it without consent, which opens them up to legal trouble

b) They don't do it and give up on functionality, which big biz will be able to provide, putting them at a disadvantage and making the web less democratic in the process once again.

While I have no particular thoughts about the type of providers targeted here, I am certain that the last thing the current setup needs is additional complication.

View on HN

Getting consent for functionality is pretty easy. EU data regulations specifically allow you to set cookies in a scenario that this enables functionality that would otherwise not be possible to provide to a user. Like a classic session cookie, for example. What's affected negatively is the UX for tracking and spying on users – and so it should be. If this forces companies out of business who rely on that for their business model, good.

As long as we are clear, that the businesses who can (and absolutely will) find the narrowest way around any legislation and continue to work in the slimmest legal margins are FANG and increasingly not your local businesses, cool.

Everything tech and privacy is pretty easy looking from the HN ivory tower. Meanwhile half the world runs WP installations that date back to 2016 and can't change a paragraph on their "about us" page without contacting "the web guy".

This whole "won't someone think of the small businesses" shtick is so transparent. I don't want "my" local businesses tracking me any more than the non local ones. I don't want a fiercely competitive market of data leeches any more than five big ones. Big tech can and should still be felled once the bulk of the weeds are chopped.

> I don't want "my" local businesses tracking me any more than the non local ones.

I get that. Seems we have a good news/bad news situation.

The good news is that 99% of local businesses do no systematic privacy invasive tracking of anything, because they have no fucking clue how to do it. Really. That might be hard to believe in a crowd that is fluent in SQL JOINS but in the real world people look at a Google Analytics accounts and learn... well, round about nothing.

It turns out that at small scale it's actually quite hard to invade peoples privacy in a way that you end up with positive ROI: You need enough data AND you need to be competent enough to analyze the data AND you need to be agile enough to act on your findings. You will be hard pressed to find local businesses that check even one of these boxes.

So most privacy "invasion" at this level happens because people are bad with complicated stuff and also at dealing with increasingly complicated regulations, and privacy regulations check both boxes (despite HN claiming otherwise, but alas, the ivory tower strikes again).

The bad news is that that is increasingly less relevant, because while the above is going on, the big businesses are exploiting any of the increasingly hard to catch openings and advancing their market position.

There's a few aspects to this. The first is that Google Analytics is a great example, because while an individual company may not have the competency they may hire another one that does. And while previously some of these companies may have simply added analytics plugins to their site because there was no reason not to, being liable for that processing is a great deterrent.

The second aspect is that this idea of "small businesses" that you are portraying does not really reflec reality. In the anti-regulation lobbyist mythology, small business are all friendly mom and pop stores that are just trying their best. But for example Whatsapp, before it's sale to Facebook, had 55 Employees and half a billion active users. Many hedge funds count as small businesses, as do franchises. Even beyond that, there are plenty of 100-1000 employee businesses here that have more than enough data on hand to cause serious privacy violations.

The third is that violating people's privacy does not have to be for profit as it is in advertising. As the case of a local pharmacy using insurance data to send their customers Christmas cards reminds me, even the smallest business is very capable of violating privacy by treating customer data sloppily.

edit: Oh, also, we might see how big tech really feels when ad exchanges hopefully get declared illegal ;) (see https://www.iccl.ie/news/online-consent-pop-ups-used-by-goog...)

Yeah, it's super easy, I don't know what OP has any issues with. All he has to do is finish law school and go through the laws and regulations of GDPR, there's only like a hundred of them plus references so it shouldn't take more than a few years maximum.

https://gdpr-info.eu/

What functionality would that be? Anything else than targeted ads?

Whatever you want to use Cookies for. Analytics probably most of the time.

I don't think small businesses typically run targeted ads on their own websites.

I think that could actually be a problem. NOYB, a nonprofit GDPR watchdog in Austria, has firmly set its sights in enforcement on Google Analytics and Facebook/Twitter buttons because they are easy to remove. I think small mom&pop shops would have to go back to getting analytics via web server logs. Even small hosters like https://www.dogado.de/website/hosting (wanted to actually link to CampusSpeicher but they seem to have been acquired) offer this (see under Highlights > Website-Statistiken).

To be clear, NOYB allows 60 days after notification for removal (instead of 30 allowed by the law) before complaining to the national data protection agency and even then agencies rarely give out serious fines if you are ready to comply and did not grossly misuse the data, at least in Sweden: https://www.enforcementtracker.com.

There is legitimate business concern. Amazon can collect my home address without consent (i.e. I type in my address but don't need to tick any consent checkbox; see [1]) and even pass it to DHL but without consent they can only use it to deliver me the package, not train ML models in the future. If you have a feature that needs data and the user understands the need AND the user themselves want to use the feature (excluding the legal acrobatics like FB claiming that users sign up to watch ads), you don't need consent (unless the data is biometric, which is another chapter in GDPR).

[1] In fact, I try to use a lot of services without consent while providing my personal data. The trick is that I want to ensure it will ONLY be processed for a legitimate business need.

Absolutely. You will find that I was very specific about the unfairness these regulations impose on the ill equipped.

Amazon is always going to find a way to work within the limits of whatever the EU throws at them. Begrudgingly, certainly, but eventually in strides, and with the confidence that an army of lawyers and other smart people does offer. They can even willingly chose to work outside of it, because heck, breaking the law is just another business expense.

Your typical local mom and pop store is likely unaware of what the boundaries are, where they are, what it all means, how to implement any of it. They are mostly looking in horror at the incomprehensible monster that is GDPR.

The point being: Restrictions on SaaS solutions are not gonna hit Amazon. Amazon does not need a SaaS cookie banner. They can have their own team that does nothing but build well tailored cookie banners for any country in the world and update them daily to whatever standards are required today.

Alas, a small business can not. The rules are the same, and thus the burden is distributed incredibly unfairly.

Reply on news.ycombinator.com