Hacker News Reader

Comment by tgsovlerkhgsel | Hacker News Reader

I vehemently disagree. This is an exemplary cookie banner.

There are two clearly labeled buttons with good contrast, one for "accept all" and one for "accept selected" (with the latter even being a bit bigger and more visible), plus a third (less visible) "decline" button for those who don't want to check whether the default is checking only essential cookies.

Moreover, if you actually take a closer look, none of the cookies the banner asks for are actually the usual user-hostile ad/tracking cookies. The only thing you can even turn on/accept is third party embeds.

Clicking "accept all" on this dialog puts you into a more privacy-friendly position than clicking "deny all" on many websites (because they then still use 20+ trackers claiming legitimate interest), and IMO this site is one of the few that isn't trying t to trick you into agreeing, and it has two single-click opt-out buttons.

View on HN

I appreciate your insight about the cookies themselves, but I still think the banner is deceitful. If I see "Required" checked and "Features" unchecked I would expect that the primary button respects that decision. The fact that the primary button ignores the content of the form is very surprising to me.

It is easy to think of better UX patterns:

- Check both by default and have only one submit button. This is intuitive but IIUC disallowed by GDPR because it makes opt-out harder than opt-in.

- Skip the checkboxes and simply provide "Required cookies only" or "All cookies". This way there is only one place to make the choice and they aren't ignoring the checkboxes.

- Just remove the "Accept all" button and make the primary form button "Accept accepted".

To me, the banner was clear. But I agree the implementation could be improved.

- There are 2 "required" features. You don't need to get permission to place cookies that are needed to make your site function. Placing a cookie to track your consent is perfectly fine, no need to make that optional, or even mention it in the cookie banner. Same goes for the session cookie: if you need it just set it. You could question if you actually need it in this case, but as long as it's a true session cookie and not persisted I would consider it not personally identifiable.

- There are 2 optional features: Youtube Videos and Google Maps. Why do I have to fold open "Features" to find out what the features are? Just show me the list already. Hiding the list is a dark pattern employed by advertisers to get you to agree. In this case the features are actually valuable: embedded videos and embedded maps.

- Those 2 optional features are not even used on the linked page! Then why does it show me a consent banner?

For some reason people hear gdpr compliance and just slap on an annoying consent modal popup.

A much better solution is to just put an embed placeholder with the title of the linked content, and warn the user that 3rd party wants your personal data. Put a link to a detailed privacy policy, and a link to enable the embed. At that point record the consent and enable the embed.

The checkboxes allow detailed control for those who want it and provide some easy to understand info for what consent is required. Skipping them in favor of some generic "yes to all" is a dark pattern

Reply on news.ycombinator.com