Hacker News Reader

Comment by BiteCode_dev | Hacker News Reader

Everytime I read about this, it makes me think about this game:

(SSL warning)

These shenanigans are not required, they are very much designed on purpose.

Indeed, corporations can follow the "Do Not Track" header. There is nothing in the EU law that requires a banner, only informed consent.

So if I have DNT=1 set in my browser, pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that". Solved.

I'm informed. I made my choice.

But that's not what it's about.

Because the vast majority of people would not consent. Who are you kidding? This tracking is not benefiting us. It's like when politician says it's "for the children" or "to fight terrorists". Everybody knows there are full of it.

So the banner is just the most annoying way that is legally allowed to try to get people to force-accept tracking. In fact, some banner are crafted to make rejection the hardest path for this very reason.

Those corps chose to make the web terrible a little bit more every day: tracking, auto play, scroll hijacking, dark patters, cookie banners...

We should thank the UE a 1000 times to reveal who are the bad players.

View on HN

> In fact, some banner are crafted to make rejection the hardest path for this very reason.

Something that's also illegal. National regulators don't seem to care though, which is a shame as a couple of fines and operators would mysteriously, simultaneously and suddenly realise there _was_ a way to make rejection at least as easy as acceptance all along.

I think they do care, but with limited means they cannot tackle the whole problem at once. So they go after one bad actor after another, and the others eventually adjust their practices to be a bit less illegal.

On the French web you can see the evolution on newspaper websites, which used to have these popups with an easy accept button and difficult, hidden paths for refusal, which eventually moved to a simpler "reject" button with subdued colours or a "reject and read the article" a bit less visible than accept, but still easy enough to spot, and now many have two equal buttons... but "reject" leads to a page that says "you can reject cookies but then you can't read the newspaper, you can pay instead".

You can really see how they try to go as far as they think they can, and adjust their behaviour even without having been targeted themselves. I have good expectations that everything will eventually get better even if it will take time.

The same happened with Google and Youtube. They used to have pop-ups with large and obvious "Accept" button and a clicking game if you wanted to reject tracking. The EU put a pressure on them and now the popups have two equal "Reject" and "Accept" buttons.

The current situation is still a problem. If you disable cookies, you get the banner every single time.

The law should outlaw that behavior so that people can continue to conveniently block cookies. Google is an ad network and controls chrome. They could come up with a universal opt out (like X-DO-NOT-TRACK) that works with such a law.

It's up to your user agent what it displays and which cookies to store. It's the user agent that needs to change to stop bugging you. That's what brave are doing

My point is that Brave shouldn't have to do this.

> I think they do care, but with limited means they cannot tackle the whole problem at once.

That always seems like such a cop out. Ooohhh, I'm government, I'm so poor I can't enforce the law! Maybe let regular people help. If every time I found a web site that didn't follow cookie rules or GDPR or whatever, I could one-click sue them and get $1,000 or so, I would probably quit my job and just browse the web all day. There are so many naughty sites that count on toothless enforcement, people could make a fortune AND the law would get enforced.

Luckily for us, in this age of centralized internet, you only need to hit with fines a couple of cookie dialog providers and you are set.

OneTrust, who seems to do a sizeable fraction, get it right on their own website. I have never seen a OneTrust dialog elsewhere have equal prominence given to the reject and accept pathways.

Nope. Apparently selling conconformant GDPR-compliance services is not against the law, only buying them is? Which makes some sense, but in any case OneTrust still sell dark-pattern banners to (at least) hundreds of websites even after a sizeable batch of them has been ruled illegal[1].

[1] https://noyb.eu/en/226-complaints-lodged-against-deceptive-c...

Scummy as that is, I don't think that providing the banners should be illegal, as otherwise it's a hop and a step to "providing software that can be used illegally is in itself illegal". Which makes text editors illegal without "safeguards" baked in.

However, if OneTrust are selling the software under the promise that if the customers configure it that way, then it's compliant, then that's some kind of misrepresentation (which is illegal, software or not). Just as if I sell a USB flash drive as an anti-5G-field dongle, that's illegal, but it'll not illegal to just sell the flash drive.

> pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that"

That's the same thing as a cookie banner. I don't care what the words say; don't show it to me at all.

- non modal

- don't require action or decision on you

- can be put at the bottom right on the corner

- don't prevent accessing the main content

It's the same thing as a cookie banner in the way a HN comment and a double blind study are the same thing.

You’re describing the annoying cookie banners on half the sites I visit, including stack overflow.

This solves nothing.

I think you underestimate how much of the world loathes that cookie law that applies itself across borders.

The option for the company is between the "more money" and "less money" option. There is a general sense in which the average individual benefits from the "more money" option; websites are better funded, they can provide better services, etc. There is also a incredibly minor way that they are worse off, in that some of their data (consisting of a field that says when they viewed certain news articles) might show up in a data leak in the future. But when you put it as "do you want to be tracked", of course it sounds bad, so all else being equal most people will say "no".

The "informed consent" framing of this issue is quite ridiculous. When someone is asked to pay for an item at the store, we don't say that they should also have the choice to take the item for free, and only pay for it if they want to. We recognize that, individually, most people would rather pay less, but that we collectively benefit when businesses are profitable. The situation with cookies is even worse, because unlike with money, most people have no idea what a website even uses their data for.

Th EU trying to rewrite the issue as concerning "consent" is thus idiotic, and innevitably lead to the cookie banner issue. If you think tracking is bad, then ban it, and let websites figure out how to target ads and improve their product without it. If you recognize tracking as overall beneficial, then permit it, and throw out this charade of informed consent. The EU can't make this decision themselves, so they expect every single individual to make this decision for themselves, every time they visit a website. This despite the average individual having no idea what their data is even being used for.

The issue is existential for websites, since it concerns their ability to remain profitable. As such, the website that stays in business longest is the one that can coax the most people to hand over their data. It is entirely inevitable that websites would go up to and beyond the letter of the law in pursuing this.

That’s an extremely obtuse justification for immoral behavior.

Consumers are informed, and they say “no” when given the choice. Respect their “no”.

Tracking builds a massive, exploitative, dangerous information asymmetry. You claim the cost to consumers is small; the aggregate cost is very clearly not small.

This should be an existential issue for websites, and it should force the closure of websites that can only exist through exploitative abuse of consumers.

The cookie banners exist because of bad actors on the web who have become too dependent on abusing user’s data. The problem is with them, and their use of dark patterns to purposefully confuse and mislead consumers.

Consumers are informed, and they say “no” when given the choice.

That's the point. If your position is that consumers don't want tracking and that it's harmful on balance, then just ban it altogether rather than incentivizing sites to use dark patterns to trick users into "agreeing".

GDPR literally bans tracking without informed user consent. Hiding that content behind dark patterns is not providing user with information.

But sure. Do tell me how it's the law that is the problem, and not the greedy leeches that present these dark patterns.

Don't worry though. A ban on dark patterns isn't far away. Once it's in effect I guess you'll blame the law for something else.

>Consumers are informed

No, they are not. They have no clue what they are not consenting to.

>the aggregate cost is very clearly not small.

$0 is small.

Exactly right. It reminds me of the Wells Fargo scandal where branch managers were given unattainable quotas and resorted to fraud to meet them. Incentives matter.

"Ads only work if they have intrusive tracking" is presented by you and others as a fact. It's not.

>This tracking is not benefiting us.

Well unless you don't consider free access to video streaming (YouTube) or free access to news a benefit.

My honest opinion on all this has always been that the majority of people, if properly explained to that 'tracking' is never even viewed by a human, and even if it was, your identified as user 563758, would consider this a fair trade.

People largely think you can remove the tracking and access all the same content for free. But when the ads pay 90% less, it becomes much more difficult for the free content to survive.

If you think a human never sees your information, you're sadly ill informed, I know 563758 lives in ottowa, the porn he searches for and that he's a vegan who is into electronic music from the 70s. These profiles are incredibly detailed, and available to every average advertiser.

These banners start with "your privacy is important to us", but they omit the next part of the phrase, but we'd like you to allow our partners to invade it.

The banners are there because the process is so abusive they need your consent to make 90% more.

>The banners are there because the process is so abusive they need your consent to make 90% more.

The banners are there because if you take away 90% of their revenue, they cease to exist. Imagine your salary reduced by 90% tomorrow unless you beg your boss daily for your full pay.

>If you think a human never sees your information, you're sadly ill informed

Are you under the impression ads are manually targeted? The only time someone at Google has ever laid eyes on your profile would be if somehow your profile bugged out and caused something to crash. And even if they did look at a single user's data, it would be meaningless without having the name attached. And even if the name was attached, it'd still be meaningless, because there's 300 million people in the US alone.

You have to strawman the absolutely perfect situation for it to even remotely matter.

> The banners are there because if you take away 90% of their revenue, they cease to exist.

I accept these conditions

You went to the website for some purpose no? So you'd rather not have gone to the website at all? So why did you attempt to visit the website in the first place?

It's just so irresponsible to take extremes like this, ignoring the amount of information and entertainment available on the internet.

In my experience, the number of ads, cookie banner shenanigans, and embedded Twitch streams is inversely correlated with the usefulness and quality of the website. Maybe if all of these websites went away, I could actually find useful information or entertainment on Google.

An internet maturing over twenty years full of hobbyist bloggers and forums rather than megacorp media and affiliate review sites is a world I’d be curious to experience.

Yes, I'd rather go to the ad-free website that they displaced (or at least out-SEO'd).

Look at the cookie consent page of any news article you read - your article is worth often 100+ people sharing my data. It's not, it's just not.

Do you know how many people get access to my search data? One. But your news article is worth 100x. How many get access to my streaming preferences? One. But your news article needs to violate my privacy 100x more.

Your arguments are sound in an imaginary world where six seconds of attention is worth being followed around for years. No.

Advertising does not require tracking. Remember over the air television and all it’s free news broadcasts.

Just look at Google. They became big by ads on the search site. Analysing the intent, not the history. If I search for a pen I want to buy a pen, thus an ad for buying a pen might be effective. If I bought a pen a day ago it is unlikely I am interested in pens for next few weeks. Look at the context of where the ad appears and match that.

To some degree that is how ads worked in print: In a magazine about horseback riding you will find ads about riding equipment, as readers are into that while reading.

"If I bought a pen a day ago it is unlikely I am interested in pens for next few weeks"

And yet whenever I buy anything online I'm inundated with ads for said item. In fact I almost wish there were an officially sanctioned/ standardised way of updating your status as a tracked user on various products you might be interested in or have in fact now purchased with no need to buy another soon. As it is I still see ads for baby formula on YouTube despite having had no need to purchase it for over 16 years (and I honestly would expect Google should know that about me, though when I ask Google Assist how old my children are it refuses to tell me...)

Google ad became big, television and news papers advertisement became small. The reasons were very obvious.

Google don't need to follow local law and regulations.

Google don't need to employ people to verify content or take legal responsibility.

Google can track users and thus categorize users in much more fine details than television and news papers ever could. A magazine about horseback riding might have a vague idea about who their readers are, but google can find out that a pregnant teenage girl has yet to tell her parents.

I think the biggest difference is simply a reduction in the relative amount of time watching TV. People see Google’s Ads at work, at home, and while waiting at line looking at their cellphones.

Google bought doubleclick early on which is definitely ad tracking and not intent. It's important to remember the full history.

Google launched in 1998 and didn’t buy double click until 2008 when they could afford to spend 3.1 billion on it. So that was hardly an early purchase or required for extreme profitability.

Oh, I remember. They sucked! Both the ads and the news they funded.

Feel free to link to all these advertising supported websites better than Seinfeld. I could use a good laugh.

News was hit or miss. They did a lot of serious investigative reporting, but newspapers where simply a better medium for personalized in depth coverage.

If I had to choose between network television and YouTube, I would choose YouTube every day of the week and twice on Sunday. I mean, I enjoy Seinfeld too, but on the whole YouTube is both more entertaining and vastly more useful and educational than network television. Not because the content has the highest production values, but because the content matches my interests and needs. That's the true power of targeted advertising. It allows creators to focus on niches that can't be served by content produced for a mass audience. Even large 'niches' get dumbed down to the lowest common denominator for network television.

Case in point: Here's Jay Leno interviewing Elon Musk about SpaceX Starship for network television [1] vs YouTuber Tim Dodd [2]. Leno's program is fine for people who don't follow space. For my niche Dodd is vastly better, but he can't draw a wide enough audience to make money on non-targeted ads like Leno can.

And the thing is, everyone has their niches. There is no large population of people out there who are average in every way and need the network television version of everything. The average person doesn't exist.

[1] Leno: https://www.youtube.com/watch?v=wluBlr1j4qk

[2] Dodd: https://www.youtube.com/watch?v=t705r8ICkRw

Dodd got 6 million people watching a 1 hour segment. That valuable even without advertising targeting beyond estimates of viewership based on content.

Now, you can quibble about how much targeting increase revenue but the funny thing about total advertising is it’s fairly consistent through time. Tracking failed to significantly increase worldwide advertising spend, it only redirects it.

6 million views (a view only requires 30 seconds of watch time, not the full hour) over a period of 14 months, for the most viewed video ever on his channel. If he could draw that for every video, maybe he could come close to competing with Leno. But he can't. I mean, looking at YouTube numbers alone, Leno's show's most viewed video has 34 million views. And of course the vast majority of his viewership and revenue is elsewhere.

Dodd simply couldn't have a network television show with this kind of content. It wouldn't come close to making sense. If he did a network television show it would have to be a lot different, almost certainly in a direction that would make it less interesting for me personally.

My argument has nothing to do with global ad spend, that's a red herring. The key is how those ad dollars get distributed. Targeted advertising makes niche content viable in a way that non-targeted advertising can't match.

You can have non targeted advertising on niche content. In fact YouTube will display advertising to any user even those it knows nothing about.

The only difference is relative pricing, but again the global population and global advertising spend doesn’t depend on tracking so if it was banned little would actually change.

> global advertising spend doesn’t depend on tracking so if it was banned little would actually change

> The only difference is relative pricing

... the relative pricing difference is the whole difference I'm talking about. Without targeted advertising niche content makes less money, general audience content makes more. So you agree with me that this is true. Then you say that this is a small change. I say it has enormous effects on the content that gets produced. Honestly, this is transparently obvious.

It’s not that simple. Tracking doesn’t universally increase spend to all niche content, it reduces spend to some niche content and increases it to other niche content. So there would be some changes to which niche content is created but it’s not going away.

Just look at how much YouTube content is sponsored via an Ad inside the video. That isn’t tied to your personal history.

Certainly I wouldn't say that every single niche benefits from targeted advertising without exception. There are exceptions to every rule. But the vast, overwhelming majority of niche content would be worse off without targeted advertising, and this would overall have a strongly negative effect on the diversity of content produced.

Ok that I disagree with, if anything niche content in a world without tracking should attract a higher percentage of advertising.

If I manufacture say jigsaw puzzles and I can’t target individuals then I want to link to show up on a YouTuber with puzzle related content. But with tracking I shouldn’t care about the videos content as much and should be happy to show up on cat videos as long as tracking supports the association. That same logic would seemingly extend to any activity with associated products which is basically everything.

On the other hand soda manufactures are presumably less picky and could advertise on both.

Advertising soda is always worth it without targeting. But advertising jigsaw puzzles might not be. That jigsaw marketing money goes elsewhere, not YouTube, and YouTube jigsaw people don't have a lot of ads for their videos, because nobody else is choosing to specifically advertise on jigsaw videos. Maybe even if jigsaw people do advertise, they don't have a ton of money to spend on ads, so jigsaw content is still hurting. But with targeting, there are effective ads on every video, and content matters more than ad spend targeted at your niche. People choose the content they like by watching it, instead of advertisers choosing the content they like by steering their spending. Because there are far more people than there are advertisers, this promotes more diverse content.

We could continue to make up just-so stories about the effects of targeting on niche content. But I doubt we would convince each other. Is there any research on this topic?

Do you actually find that reasoning convincing or are you just trying to make a point?

Advertising with tracking barely covers costs, imagine without it.

Competitive markets reach equilibrium. With or without tracking it’s going to barely cover costs because otherwise more people enter the market due to minimal barriers to entry.

Sometimes equilibrium is 0.

We had ad supported websites well before tracking, so that seems like a non sequitur.

It think that means that advertising is not going to save content, and people will have to think of alternative revenue streams, because revenue from advertising is only going to go down.

Advertising without tracking would arguably cost less. Even if it makes less, it's not clear that the margin would be worse or non-viable.

Let us test that theory.

Imagine that I went to a hospital and asked to get a copy of all the patients records. The contract I sign will say that no record should ever be viewed by a human, and if any human did read a record, patients would be identified by patient ID like 563758. In return patients would get services worth ~50 cent.

How many patients would consider this a fair trade?

In addition, drugs would get targeted advertisement, and the funds for advertisements would be raised through the profits of said drugs (ie, patients would be paying for it, by an average of $1 more per patient). Still, patients would get free services that costs the advertisement network ~50 cent per patient.

This is a fair point. If you don't want to be intrusively tracked, you should not expect "free" services.

However, IMHO the answer here is to find a different model for funding online software/services. Letting advertising firms run the internet does not really seem to be taking software in a user/consumer-friendly direction.

Plenty of services were free prior to commercialization of the web because they generated nom-monetary value (community, knowledge, etc.). Plenty of creators and artists also make money directly via donations (Patreon, etc.). I'm not sure we need the existing ad model for either free content or to make money on the internet.

"Ads only work if they have intrusive tracking" is presented by you and others as fact. It's not.

> reveal who are the bad players.

This is one of the reason I don't use a cookie banner blocker. I would rather close the page upon seeing one, or circumventing it manually using ublock origin's element zapper.

Generally, I think these discussions are poisoned by disingenuous web developers who pretend to be extremely annoyed by the banners as users, but really they're annoyed at the banners as website operators. They are the aforementioned 'bad players' who feel outed and targeted by the EU's regulations. Why are supposed user complaints about cookie banners so prevalent on this site, but virtually unheard of in 'normie' spheres of discussion?

I recently came across a cookie banner in real life that reminded me of that game. I'm still not sure whether I successfully refused cookies.

https://soccerwhizz.com/if-i-speak-i-am-in-big-trouble-meani...

"In fact, some banner are crafted to make rejection the hardest path for this very reason."

Some? I don't think I've seen a single banner where "accept only necessary cookies" was an obvious/upfront choice.

I remember that Medium (yes, the one that is now notorious about paywall) used to have banner to that wording when I set DNT in my browser to "On". This [1] shows how it actually appeared at that point. Medium also has an FAQ about its DNT at [2].

[1] https://www.eff.org/deeplinks/2017/10/do-not-track-implement...

[2] https://help.medium.com/hc/en-us/articles/213690167-Medium-s...

> Because the vast majority of people would not consent.

Many people would click No when asked "Can we track you?". Yet, fewer people would click No when asked "Can we show you ads that are closely related to your interests"? Likely even more people would agree with "Are you willing to share some data so we can improve our product?". And maybe most people would actually be ok with websites including Google Fonts [1].

Of course, when too many people agree with the proposition, then the question must be legally mandated to be more scary.

The truth is that "people" are fundamentally not on the side of the privacy advocates. This is the whole reason for the GDPR. People are perfectly happy to share their data in exchange for using those services. Fundamentally, GDPR advocates are claiming that people just don't get it, and should not be allowed to make this choice. Which is why websites are not allowed to make their service conditioned on consent to tracking.

> So if I have DNT=1 set in my browser, pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that". Solved.

This is still an annoying banner somewhere. Please no.

[1] https://www.theregister.com/2022/01/31/website_fine_google_f...

"can we track you" is not a scary proposition, this is the only objective fact.

"Can we show you ads that are closely related to your interests" and "Are you willing to share some data so we can improve our product?" are not facts, they are excuses like "fight terrorist" and "protect the children". And not as good, because nobody would object protecting children while some people do for the former.

The reality is rather "can we get enough data so we can manipulate you better in order to make more money?", "can we create a knowledge graph powerful enough to kill all our competition and influence democracy in our favor?" and "can we follow you everywhere to prey on you once we know enough to find a way in your life?"

You think those sentences don't reflect reality? I think they are as realistic as yours.

So the law finds a middle ground and use facts: "do you accept tracking?". Simple. Objective.

> This is still an annoying banner somewhere.

A non modal notification, just like stated in the original comment, is not a banner. It can be safely ignored, doesn't prevent you from getting to the content, nor require you to act or take a decision to progress.

I mean, you just stated that tons of people are ready to accept obnoxious interruptions in the form of ads that benefit corporations, and you think a small notification on the bottom right on the screen to benefit the consumer is unacceptable?

I'm answering your comment for the sake of other readers, but given how much bad faith I felt in it, I'm expecting any answer would be of the same caliber and will just ignore them.

> The reality is rather "can we get enough data so we can manipulate you better in order to make more money?", "can we create a knowledge graph powerful enough to kill all our competition and influence democracy in our favor?" and "can we follow you everywhere to prey on you once we know enough to find a way in your life?"

Sometimes people just want to know which buttons users click because, yes, (gasp) it helps their business (the one that is employing people).

> I mean, you just stated that tons of people are ready to accept obnoxious interruptions in the form of ads that benefit corporations,

There aren't any fewer ads. We now have the same amount of ads + 3 privacy popups on every page you visit. I don't want any popups. EU regulation / the GDPR is clearly to blame for the popup. Supporters have to take responsibility for the internet experience they have wrought. Complaining about "bad actors" is an excuse. This is our reality today. It's because of these rules. Own it up.

In the vast majority of cases I reject analytics and telemetry not because I don't want the company knowing which buttons perform better, it's because I don't want some third-party scum like Google Analytics to know that.

Analytics can be done in a privacy-friendly way, but the vast majority of them aren't, and as a user there's no way to know whether that's the case, so the default "safe" option is to reject.

Also, it's not the GDPR that's to blame for the popups, it's the non-enforcement of it. GDPR explicitly outlaws annoying consent flows - here's the guidelines one of the regulators suggests, which 90% of implementations out there don't comply with: https://ico.org.uk/for-organisations/guide-to-data-protectio....

> Also, it's not the GDPR that's to blame for the popups, it's the non-enforcement of it.

A distinction without a difference. This is the result of the law. If you think this can be improved by better enforcement, maybe the EU should give this a try. But this comes in a package. You can't pass a law and then say, "sure we ruined the internet, but its just because the law is scary enough that companies add terrible popups, but not scary enough to make them actually compliant.

Also, to be clear, I personally don't care about dark patterns in those consent popups. I click whatever is the biggest button (like lots of people), the one that hopefully gets me the quickest to the content I want to see. The popup itself is the annoying thing. Because it appears on every. single. link you click.

96% percent of users opted out on iOS. Prompt engineering can only reduce that number so much.

> Which is why websites are not allowed to make their service conditioned on consent to tracking

Is that clear yet? Because most bigger newspapers in Germany do exactly that, try Spiegel.de

I wouldn't be surprised if German data protection agencies give news "publishers" more leeway given that they seem to be extremely influential in other domains of digital law in Germany.

But yeah, it's debatable whether "my business model depends on showing you ads from services that harvest your data via those ads" is a legitimate interest. If it is, that sets a bad precedent IMO.

FWIW, many of the data protection agencies are nowhere near as corrupt as other places. But those things tend to require court decisions.

> So the banner is just the most annoying way that is legally allowed to try to get people to force-accept tracking. In fact, some banner are crafted to make rejection the hardest path for this very reason.

Just FYI, a banner that tries to skew a choice by using pre-ticked checkboxes, making one option more prominent than the other or makes it more difficult to decline than to accept is not "legally allowed". It's merely tolerated because nobody gives a shit about enforcing the GDPR, but it's not actually compliant with the regulation in any way.

This is the problem with mixing law with tech, the requirement should not have been with the websites. but each browser, should have come with the capability of auto destroying cookies and also making cookies isolated.

That would just make it a race between fingerprinting and fingerprinting resistance tech. The point is to prevent tracking without purpose / permission regardless of the technology used.

The race is already here, just look at all the extensions one has to use just to get some usability out of the web. There's no security panacea, just an endless game of whack-a-mole

>Those corps chose to make the web terrible a little bit more every day: tracking

Tracking can make sites better because it gives them data to improve the site.

You don't need tracking to find out that the million layers of javascript make the thing too slow to be useable.

Reply on news.ycombinator.com