If I see an ‘accept cookies’ banner on a website, I close it immediately | Hacker News Reader

If I see an ‘accept cookies’ banner on a website, I close it immediately

medium.com

47 pointsbehnamoh46 comments

Any "friction" (ads, cookie banners, modal subscribe popups, create an account to read, etc) I weigh against how I value the content. For most random clicks, e.g. a HN article, I value it at zero, I'm just browsing, so I close it with any friction. If for whatever reason I'm actually seeking something out, I may go to a little more effort (to be fair though, if it's Bloomberg or FT for example I just use archive.md) And if it's actually content I want, I may sign up or pay for a subscription, e.g. some substack. So bottom line I see closing the browser on a cookie banner as just part of the market negotiation taking place.

I guess I truly don’t understand what most sites are thinking here. If they actually want me to have the slightest clue what their site is about, they have to let me USE it first. How can it possibly help them (it certainly doesn’t help me) when they interrupt scrolling literally 1-2 seconds after arrival, or possibly blocking every other possible action on the site for some reason? Do they really think I will see all that and say: “oh I am SO glad you asked, let me just get right on that!!”? Nope, sorry: I leave immediately, every single time. In fact if I am really enraged, I will go out of my way to set up a few blockers to make sure I never see any part of that site on any other site, too.

They're thinking about the laws they have to comply with to collect analytics data on you without being subject to fines.

Did you really not know that? That's a genuine question. I really want to know if that thought ever crossed your mind before. Not trolling or trying to be a dick, although granted it comes off that way.

Really, please respond because I don't understand how I keep seeing this sentiment. I don't like the popups either, but that doesn't stop me from understanding the how/why I'm subjected to them.

Imagine if you had to sign a consent form before entering a supermarket.

They would go out of business pretty fast.

The amount of data collection that's been present and is being added to B&M retail is itself terrifying.

This goes back to loyalty-card tracking, and now includes facial recognition, WiFi and Bluetooth trracking, and more. As well as purchase history surveillance through credit and debit cards or "smart pay" systems.

You seem to be deliberately misunderstanding a post to try to make a point. It was clearly about sites that ask you to subscribe with a modal pop-up when you hit their landing page.

I don't understand. We're discussing cookie banners here, its in the title, in the article, and nothing in gp contradicts that. How did you jump from that to accusing someone of "deliberately misunderstanding" that we're discussing cookie banners?

Reading what you said, it just hits me if you value it at zero, don't you also value your time at zero?

I am not trying to attack you or imply that you should always be maximally productive.

For me, the biggest issue is that it's incredibly annoying to reject non-essential cookies. It usually involves clicking "Cookie Preferences", scrolling through a bunch of options (which are mercifully unchecked by default, thank god), and finding the "Reject All" button somewhere. (As the author points out, this experience is significantly more painful on mobile.) If every site simply had "Accept All" and "Reject All" as options, I don't think it'd be a big deal.

Which is actually what GDPR requires. Essentially, rejecting must be as easy as accepting.

That is the case on some government websites.

The added friction to reject unnecessary cookies is a type of dark pattern, I believe.

I do wonder how necessary invasive cookies are. Site file access logs, referral addresses, and geolocation of client ip addresses would greatly improve on info gathered as compared with traditional advertising, and shouldn’t require cookies.

At this point this should be implemented as a browser API so every cookies preferences dialogue would be the same across all sites. This would even enable browsers to present less intrusive dialogues UIs on mobile. Having to decipher poor UI implementations of the same thing for each site is really annoying.

Wasn’t that tried with Do-Not-Track? The issue isn’t that there isn’t a way to know what the user wants; it’s that companies deliberately make these decisions so some users click “accept” because it’s easier than rejecting everything one by one. Then the users blame the government for this mess when the companies are actually violating the law.

Unfortunately I couldn’t read the article due to the cookies banner…

Yes, I don't read medium blogs because it has a cookie "consent" banner with no option to reject. Oh, the irony.

More irony - they originally posted it directly on HN but it got flagged. https://news.ycombinator.com/item?id=30978283

it is ironic to host a post like this on medium...

Is it only me who finds the headline ambiguous? Closing the site or the banner? (No, medium.com does not sound like an invitation to read.)

Well, I just accept all cookies immediately, but I run Cookie Auto Delete and close used tabs aggressively. So cookies don't live very long.

I also use Firefox account containers for more important accounts where I need to log on.

It's a minor nuisance, but nothing I lose my sleep about.

Probably they could track me by more advanced techniques like the WebGL canvas. But why would they still yes cookies if the already did that?

This was posted a bit ago and it struck a nerve. It basically packs in every one of these patterns into one demo site.

- https://how-i-experience-web-today.com/

- https://news.ycombinator.com/item?id=28280051

Agreed 100% that I'm increasingly more inclined to instantly close a site and move on instead of put up with all the attention hi-jacks.

I like the reader-mode ideas folks have mentioned. In some cases I maintain custom Tampermonkey scripts for automating this, but have yet to try any add-ons around pop-up management. Maybe it is time...

So the author doesn't visit their own site? It is incredibly trivial to host a web site these days. Screw medium.com.

I replaced Google Analytics with the privacy-friendly Plausible specifically to get rid of the cookie banner.

My website - the one I live from - works really well without annoying or deceiving its users. It looks and feels exactly the same with and without an ad blocker. I consider this a competitive advantage.

That's why I'm working on a cookieless authentication platform on which I can base all my future projects.

https://github.com/zelon88/HRCloud3

Eh?

Cookies have very little to do with any of the laws like GDPR in the EU.

The issue these laws cover is obtaining consent for using personal data for non-essential purposes.

Things like authentication are typically deemed to be "essential", and therefore do not require consent.

If you do something which does require consent, then you must ask for permission - regardless of what technology you are using to implement that (cookies or not).

This absolutely correct yet very few seem to know this.

One other no one seems to know is, that it's not only about cookies but every information someone saves on your pc

The goal is not to circumvent consent.

I find cookies to be an outdated concept in general.

More developers should be embarrassed about making a client fire up 52 connections to 20 domains with 17 cookies just so they can read 0.6kb of text.

Why are cookies outdated in general?

What does 52 connections to 20 domains and 17 cookies have something to do with cookies in general?

To me it follows a pattern of always taking the easy route at the expense of the user.

Don't host your own fonts, just link to Google. Don't host your own scripts, link to Google. Who knows who sees those access logs. Need to Auth the user? Here store this encoded personal data for me. Gee, I like this feature <copy/paste in 2mb worth of frameworks to enable 6 lines of functionality>.

I still don't see how this is related to cookies.

Everybody except devs hate cookies.

Everybody hates hearing about them, answering questions about them, having some that are innocuous and some that are "scary." So why do devs force them on everybody? They aren't required unless you require them. So stop requiring them. Nobody cares how useful they are for you. They have a bad reputation and make for a bad experience. So stop using them. Just take that tool out of your toolbox, and burn it.

The public has spoken but apparently I'm the only one listening.

Everyone hates cookiebanners. Noone except devs know that browsers use cookies and noone cares.

Cookiebanners are no restricted to cookies, it's about tracking, storing and sharing the information with third parties.

If you use cookies for login you don't need a cookiebanner, because it's necessary.

If you use cookie for tracking you need a cookiebanner, if you track the user with another technology you still need a cookiebanner.

You seem to be attributing issues to cookies that are actually problems with what people are doing with them.

Nobody dislikes cookies - when used correctly, users don't know they exist. This site seems to be doing a great job with them - there's a single cookie to store my login session.

What people don't like is annoying prompts - they claim to be about cookies, but really they're asking permission to track users for nefarious purposes.

If you don't track users, you don't need to ask - and that's the case whether you use cookies or not.

If you track users, you need to ask permission no matter what technology you use.

Again, that's the case on this site - no tracking = no need for annoying popups.

Not sure why you would want that - a login cookie is very, very much a functional cookie and you don't need permission to use them.

On the other hand, if you do tracking that is personally identifiable you need permission no matter what technology you use.

Casual users will trust a platform more if they know it contains no cookies at all.

Funfact. The regulation isnt the problem, the companies simply not implementing them are. There SHOULD be a button that accepts only essential cookies, but most companies simply obfuscate it so its not clear anymore.

You don't need a button for essential cookies. Essential cookies can be set without the user's consent. The popups are for non-essential cookies, like analytics, ads, etc.

Yes, but if you do have nonessential cookies you should have an obvious button to reject them.

Unlike Medium, where this article is hosted...

I don't like, but do usually tolerate sites that ask me to accept cookies but still let me read their content even if I select accepting none at all. Or sites that don't insist on you disabling your ad blocker in order to read their content. Sites that do insist on your closing an ad blocker to see their content absolutely deserve to be closed immediately.

Am I wrong or does this prevent the author from using any website that saves user state?

Like, I'm considering adding preferences to my game dudo.ai, and maybe saving the score from visit to visit (like Wordle does), but then I would have to add a cookie banner and I would lose people like the author.

You just need to make it obvious that saving these preferences will cause some state to be written to the client browser, and not use this state for any other purpose than what the user consented to. Placing a “these preferences will be saved in a cookie” next to the respective save button is enough.

Cookie banners aren’t a requirement, they’re a legal consultant meme with a dash of dark patterns.

No you don't. What you are describing is a functional cookie, which does not require permission.

If you want to share peoples high scores then just let them choose to share it or not when they get the high score.

Also your game is cool, but I thought that the winner got to keep a die? Having less information makes the game harder, not easier.

There is a simple solution:

https://www.i-dont-care-about-cookies.eu/

There are lists for adblockers as well but thats does not work as well as the plugin does.

Obviously you do not read European websites as I thought the button you dislike is mandated by their enhanced privacy laws for computer usage (along with things like restrictions on file retention).

The banner is only mandated for malicious purposes such as spyware or targeted advertising, and even then, it's only compliant if the banner allows you to decline as easily as it is to accept. You do not need such a banner if you don't use spyware.

I close any website that has unblockable or difficult to block ads.

Like "Sign in with Google" is any better.

Reply on news.ycombinator.com