The EU cookie legislation was a mistake made by tech-illiterate bureaucrats that ruined the Web to a large degree. It's something that could've been built in to the browser. I have a hard time understanding why one would dedicate their time to this.
And it was implemented in the browser as Do Not Track but websites ignored it
> the French CNIL introduced guidelines and required Google to introduce a "reject" button, which was also seen as a sign to many companies to adjust their banners and lead to major measuarable improvements in France.
The EU should have mandated an interaction-free solution like Do Not Track. They could have.
Consent for personal data is implied when performing services for a user (e.g. logging in, shopping carts, remembering high-scores, etc.).
Interactions are only needed when consent is not implied; i.e. when the personal data is not performing a service for a user; i.e. when the user is the product, not the customer.
If it's not mandated it's not a solution, it's more like a pacifist asking for peace in the middle of WWII
>The EU don't mandate it, since that would probably be considered over-reach
I don't think that's the reason, as it wouldn't be any more overeach than mandating the current cookie notice (or, in another domain, USB-C for mobile phones).
That's not mandated. You need to notify the users about third parties getting their data and allow them to opt-out. The cookie notice is just a common, terrible implementation of that requirement.
> or, in another domain, USB-C for mobile phones
They didn't do that either. They forced the relevant companies to agree to a standard until next review and the agreement was USB-C. No specific solution was mandated.
As viraptor says, cookie banners are not mandated; they're a crappy UX invented by ad companies.
In any case, regardless of one's personal opinions on user tracking, I don't understand how 'cookie notices' are at all equivalent to a flat-out ban on all tracking by anyone ever.
2. Governments shouldn't mandate solutions. Instead, EU stipulated a requirement. And industry as a whole decided that they will break the law for as long as possible until the governments chase after them. In the process the industry has convinced gullible developers that it is the law that it is bad, and not the greedy leeches who flaunt it.
Huh? That's what we have governments for.
Considering car headlights. Obviously there are some requirements we should make - they need to be bright enough to safely light-up the road. They should not blind oncoming drivers. They need to be reasonably safe in the event of a collision.
Between the sixties and 1984, the government of the USA mandated a solution. Basically one model of headlights was permitted (with a few minor variations introduced over time). If you look at all car models from this time they have a similar appearance, and the same headlights are still in use in some commercial vehicles today.
In most European nations (and other parts of the world) instead a requirement, or series of requirements were made. If you met these standards for lighting level, glare, etc. your headlight was permitted.
This led to European and Japanese cars have very varied headlight models, while most American cars were forced to stick to the same old style. This meant that American drivers missed out on innovations in this space.
Mandates can very easily become out-dates. Whereas well written requirements are much more timeless.
They do all the time. USB-C is probably the most recent example but there are a gazillion standards that are mandated by governments. Electrical sockets, traffic signalling, seat belt design, etc.
It's not some weird outlier for them to say "you have to do it like this".
Implemented in the browser AND mandated by law to be respected - in other words, similar enforcement as the current cookie notice, but with a uniform interface and central control.
If you really believe it's a cookie legislation from tech-illiterate, I recommend reading the document. You're in for a surprise. (in a good way)
It was; nobody cared (due to lack of any legislation/enforcement); it died. https://en.wikipedia.org/wiki/P3P
I think the underlying reason is that most people don’t consider trade-offs.
“Yes, great let’s do the cookie banner thing. But before, let’s also consider how this could be a bad idea?”
“Yes, great let’s ban plastic straws. But also let’s consider what we get instead and if that alternative is really better.”
These conversations rarely take place in my experience. You can still decide to do it, but at least you are aware of the consequences and are able to communicate them properly to the public, to your employees etc
It means that companies that want to do 'evil' are forced to ask their customers. For now most customers find the question annoying, and some go for the easy option of 'fine do some evil to me' out of convenience. But in the meantime, people are slowly building an awareness of this evil happening to them.
For now the evil is profitable enough with the few people that click agree to evil out of convenience. But people are now being faced with these decisions and will slowly turn against this evil. As this awareness builds, people will start disliking the companies. And as the law gets enforced better, people will find it easier to say 'no' to evil. At some point, this will make the extra friction of cookie acceptance screens no longer worth it, and we will be in a better place.
(Droping the 'evil' shtick here) All the law says is 'if you want to do this generally bad thing, you gotta ask people and you can't trick or coerce them'. This is slowly going to stop the generally bad thing from happening. The alternative "don't do this bad thing" would have a less annoying transition. But that would have been an over-reaching law that doesn't leave space for the few times where the thing is actually not bad.
A more interesting question is 'without surveillance supported adds, how will the internet actually work'. Especially given that the EU laws are aimed at effectively killing the surveillance supported add industry. This is not something the EU laws have an answer to. I find this the most worrying question, though I see little room for a new way to finance the internet that is worse then surveillance supported adds.
The law requires you to ask for consent before collecting data you do not strictly need. Websites decided that they'd rather bother their visitors with cookie banners than stop collecting their data.
Hacker News does not have a cookie banner - despite using cookies. It doesn't need to ask for consent, because it has no intention of abusing your data.