Microsoft fined $64M by France over cookies used in Bing searches
scmagazine.com
scmagazine.com
Jfyi if curious, cookie law technically isn't part of GDPR. It's from an older law that was ignored for many years called the e-privacy directive.
Bigger companies is supposed to have resources to implement GDPR properly the first time.
Imo the law should be structured such that people who care can opt out of cookies programmatically, but every day people who don't care don't need to see a pop up on every site. That causes psychic load and makes us hate the internet.
Also, people should get together and vote on what constitutes "strictly necessary" cookies that don't require consent and "non-essential" cookies that do. It's currently up to some nerds in EU.
Why can't we have people make these calls?
It's hard to craft good law when the mismatch between public stated desire and public behavior is so wide.
Yet, we consume documentaries about how evil zuck is and love to hate him.
But shouldn't we take both into account or just think about it hard once and then be done with it? We're wasting a lot of time and energy.
The "Global Privacy Control" header is apparently the second attempt to cook this goose.
Oh wait - it was a thing, and was used as just another data point for tracking.
You raise an interesting point about this apparent disconnect.
> Because behavioural psychology tests reveal
What do you know abot these "psychology tests"? Isn't the reality that both things you assert are really inferences based on anecdotal tales on forums like this one?
Do you know of any large-scale cross cultural, long term studies that show who will part with sensitive private data for small compensation? How are these studies controlled for situation, perceived reward, time pressure, trust levels?
What do we really know about widespread beliefs regarding the misuse of data? What are people's threat models? How do they assess harm?
I'm not disputing the truth of what you say - both ring true.
I think we instinctively know all rational people are strongly anti-surveillance. For complex social reasons we humans dislike creeps and snoops and treat them as social outcasts. But we also know that many people will sell their grandmother for a slight convenience or advantage. Do these two facets really clash, and if so why?
> It's hard to craft good law when the mismatch between public stated desire and public behaviour is so wide.
Is is though?
Aren't both positions reconcilable if people make no causal link between the two? What if people just don't have the capacity to make that connection? Could good laws still protect them in the way that laws about asbestos protect people from harms related to chemistry and disease they cannot possibly understand?
They may not understand the chemical mechanisms, but the end effect is super easy to understand: “hey if you breath this in you get cancer”; “hey if you eat this, you die”
Compared to the threat of something like cookies… “hey if you let these companies spy on you then…?”
Then you'll suffer multiple digital, and eventually physical harms;
- You'll lose money on bandwidth that's robbed from you
- you'll lose access to goods and services on the basis of calculated prejudice
- you risk identity theft, impersonation, having loans taken out in your name...
- you'll be exposed to manipulation, targeted disinformation
- you'll experience increased targeted attacks like phishing
- friends, relatives, spouse and others close to you will also be targeted
- your time will be wasted dealing with more spam and nuisance
- you will lose CPU, memory and battery life as the concrete resources of your devices are given over to the advertising burden
- you will eventually suffer tangible harms, loss of employment, impacted credit score, loss of medical access...
Sure, it needs more words to explain. Not quite so punchy and succinct as the real deal. But digital cancer caused by these companies' products can well be explained to the average "consumer" if they just stuck an ugly picture on the carton of a destitute homeless guy and the message "Surveillance capitalism can ruin your life".
What does it mean to have bandwidth "robbed" from me?
What do I care if my gigabytes-of-RAM multi-core CPU is burning some cycles? Have those cycles also been "stolen" by, like, articles I don't want to read or useless comments?
Is there more identity theft risk from targeted ads than, say, the LastPass breach? Google, in particular, keeps that data deeply vaulted and protected.
Am I really exposed to meaningfully targeted disinfo relative to self-sorting by watching Fox News? What about meaningfully-targeted info, like Facebook making it easy to find my elected representatives because they know my address?
Do we have evidence of correlation between targeted ads and phishing? Most phishing I'm aware of just uses big popular names and the law of averages... You don't need targeted info on a consumer to guess they use Amazon.
I worry that bans based on this shaky ground would look more like Prohibition than asbestos bans.
It's hard to support an argument that we should change the law if the harm isn't proven, and "someone directed my computer to use more CPU cycles than it otherwise would (after I voluntarily accessed their server)" isn't a story of self-evident harm.
(And that's leaving out the unsupported strong assertions that "you will eventually suffer tangible harms, loss of employment, impacted credit score, loss of medical access," which... What? Loss of employment because companies spy on me? That screams "lack of causality."
As an employed tech worker in the United States, I operate under the assumption that my employer has access to my corporate inbox. Is your assertion that I could be fired for something I say there [in which case the harm is I said something damaging to my company, not that my company knows about it] or some other mechanism?).
But it is, shadowgvt my friend please dig deeper. It absolutely is! Over and again in multiple quality peer reviewed studies and analyses by prominent security engineers and psychologists...
This "big tech = bad" thing isn't just some matter of sloppy marginal opinion. It's tediously mainstream thinking now. The only real question is what to do about it. We both know that's not easy. But at this point attacking the premise just seems like a waste of time.
A fair place to start is here, with the "ledger of harms" [1]
Good laws will protect the public from themselves, even at the cost of supposed freedoms (think schedule A drugs, production, revenge porn, tobacco).
Some people would also sell their right to vote for $5 if that was legal. It's not hard to make such a law. You simply could make it illegal e.g. to offer money for PII during a purchase that doesn't strictly require it. Or to not respect the automatically transmitted cookie choice. Those who oppose such laws are the lobbyists of the big companies, not "the people".
This was not good law. Badly-thought-out law has unintended consequences (or even maliciously-crafted intentional consequences at the cost to the public).
https://thehill.com/homenews/nexstar_media_wire/3709676-is-i...
Isn't a cookie (or local or session storage) needed in those cases?
Never rely on your security adversary not doing something to break your security for its efficacy. It is the same thing with KM AntiCheat (which is best handled by the OS, and even then virtualization breaks it) - unlike an antivirus the target user is adversarial to the application.
For shopping carts, you can have a season token as a query parameter, like jsessionid used to be for ages. Does not help across browser sessions, but a session cookie would not help there either, much.
Not sure why the chat bot would need the cookie. To track across sessions? If so, I would posit that this is no longer anonymous access. The identity of the user is defined as the cookie you use to track her.
Edit: Typos. Typos everywhere!
https://developers.cloudflare.com/fundamentals/get-started/r...
The law says cookies that aren't "necessary" are illegal without explicit consent. Perhaps there's room for "necessary" to include cookies that are helpful technically even if not absolutely the only way things could be done.
> cookies are strictly necessary to provide the services requested by our customers
Cloudflare's customers are websites, not users, whereas the latter are protected by Cookie Law / GDPR.
That's exactly why Microsoft was fined (according to [1]):
> Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision).
So to try to construct a way one could do this, the are some constrains on the possibilities:
* Deleting the cookie should not improve chances of "allow" * There should not be a magic value of the cookie that is known to improve chances of allow
Thus, this should be used as a transient identifier with the TTL set to less than the expected time to discover "good values" to spoof.
The fact that the system needs to be able to work in the case of an adversary deleting these cookies (potentially at the cost of hitting more CAPTCHAs than otherwise) means that I cannot honestly call the cookies "essential" in the colloquial meaning of the word. Another poster explained that there are specific carveouts in the law for this situation.
I'd consider it a basic feature that if I reload a website, or open it in a new tab, I'm still logged in, the shopping cart is still full, and I see past messages in the chat window.
While technically all of the above can be implemented without cookies (in a very user-unfriendly way), it's so below the expected user experience that I'd argue that cookies are strictly necessary for these purposes.
The real shame is that Apple has decided IndexedDB is too powerful to allow outside of their walled garden and will auto-delete it after a week or so. Worse still, Service Worker caches are cleared so offline-available websites break after a week.
https://stackoverflow.com/questions/50795409/is-indexeddb-on...
And if some EU kangaroo court forces me to click through a “clicking add to cart will save this item in your cart, do you agree to performing the action you explicitly just requested” on every website… I cannot.
That is, as if, to the site owner, you were not anonymous.
It's ok for you to want that, the law is there to protect the ones that don't want it. Because, as it is, websites tend to side with you already.
You can, of course, always use a private browser window if you want to limit everything to just that one tab.
------
* - others might too, but I only have access to Chromium/Win right now.
You seem to be calling for some kind of regulation that defines how identities are stored and managed on the internet. And that sounds really interesting to discuss.
But it's absolutely a much bigger problem than one "should" clause on HN
There also used to be another standard called "P3P" that tried to integrate privacy into browser UIs with a more or less standardized interface and that, too, failed. Among other reasons because companies wanting to track people subverted it.
Some sites like geizhals.de respond to DNT and only use the bare minimum, but that's the exception, not the norm (for some reason hint hint).
Usually laws don't prescribe some specific technical implementation unless absolutely necessary because they're often not optimal and go out of date quickly.
Make it opt-in programatically rather than opt-out and we may agree.
Cookies are already under the control of the end-user, why does the site operator need to ask/worry at all? if the user does not like the cookies can't they just delete them?
I work with tech product companies in both the EU and US. EU companies are completely stymed by GDPR/privacy implications. Features are often delayed for weeks/months as it goes through endless cycles of GDPR etc compliance discussion, which often doesn't have a concrete answer in the end!
Smaller tech companies in the US are in the whole not doing this. They are moving far, far, faster because of it. It really is night and day.
Sidenote: EU tech companies tend to be much more risk averse than US ones in general. This means GDPR really scares leadership there and the often lose the bigger picture.
The worst thing about these laws are that the regional/national courts are all interpreting them differently, often with major implications.
I think we will actually get to the point where many tech products just block the EU from using them. It is impossible to comply with the law IMO with so many conflicting interperations from regional courts and if the fines keep ratcheting up it will become uneconomic to serve the EU market.
It's a giant pain for my work for sure. Anything which could potentially have some intersection at some point with European customers has to fully comply with all of these EU privacy regulations.
Usually that means taking an already clunky internal system and adding a bunch of restrictions to it to make it even more clunky. Also banning some useful practices and tooling that me and people like me use for our day-to-day.
Yes, some of this is due to internal dysfunction.
My reason for not wanting to give details is because this could reveal things about my employer which would possibly put me at compliance risk.
>The website also lacked a button for users to reject cookies as simply as accepting them, CNIL said, where two clicks were required to refuse all cookies while only one was needed to accept them.
No need for FUD and fear mongering, "oh no it's so complicated, every town in Europe has different laws, what can we doooooo we are doomed someone please help us"
And it's not even difficult. We do it every day. When I go to the shop I take products in my basket, and then I extend cash (or a card) to the cashier. I don't ask them if they are sure they want to accept payment, or offer them to take the money only in the form of 10,000 coins of 2 cents, or throw the money in the air and ask them to catch it, etc.
If American corporations were not run by psychopaths this would not even be a debate. Dark patterns are evil and I hope corporations using them cynically will continue to get punished to the tune of millions of dollars.