> the absence of any option for refusing/rejecting/not consenting cookies at the same level as the one provided for accepting their storage constitutes a breach of the legislation [0]
GO Europe GO !
[0] https://www.cnil.fr/en/edpb-adopts-final-report-outcome-cook...
How many cumulative wasted hours have been spent tapping through cookie pop ups?
I made a game about it if you feel like wasting even more of your precious life on pop ups.
Maybe not quite as privacy conscious, but a quick workaround: (1) Open in incognito (2) Click big, easy to find "Accept" button
However it's deeper since the popups we see today were never recommended nor required by the original regs. The laborious nonsense we endure was invented by websites as a workaround for the regs. So it wasn't obvious that consent parity would ever need to be clarified like this because it wasn't even obvious that the industry would come up with such an awful popup pattern to begin with (though in retrospect we should've known I guess).
The fact the popups were never even compliant anyway is just a combination of wilful ignorance, dark patterns, consulting companies wanting to sell something and - yes - an added set of people innocently misinterpreting regulation.
Lots of things are subjective judgement calls. They are not all nonsense.
Most of our longest standing torts and crimes have subjectivity right at their core, and I'd argue that's not a coincidence but survivorship bias.
The world just isn't black and white, and attempts to legislatively render it so inevitably cause problems (though, obviously too much subjectivity and something because uselessly vague; it's a tricky balancing act for sure).
> The other legal tradition underlying the EU copyright system which is the continental European tradition of droit d’auteur (or Author's Rights). In this system, the authors of cultural works have certain inalienable rights that they cannot sell to a right holder. And, importantly, the exceptions to copyright, the interests of the public are written into the law. [...] The problem with the continental system is that it is quite inflexible because every time a new technological development comes about, you have to change the law to allow this type of use without a copyright infringement. So every new way of dealing with culture is fobidden by default. - https://www.youtube.com/watch?v=wL_Wxu6x1HU
Whereas other legislative cultures prefer to set a general framework, then leave the details to the Courts and or to Government ministers.
I mean the EU published a guideline on what it calls deceptive design patterns. They are quite clear there with what is unacceptable (link to PDF): https://edpb.europa.eu/system/files/2023-02/edpb_03-2022_gui...
When even Google felt they had to make "reject all" equally big and not hise it in a sub menu, you know that everything else is likely not legal.
¹: whether you use cookies for it or not doesn't matter
I think that the poster was saying that the popups themselves as a concept were never recommended nor required by the regulations.
Yeah I guess the word "require" has a few interpretations. The regulation didn't explicitly require popups, it required user consent IFF a company wants to collect/process/sell data the company doesn't need, but the intent was that companies would not do this, with consent being the exception, and the mechanism of consent was neither prescribed nor a focus: it certainly wasn't annoying popups per reg.
Only when deceptive patterns became clear the EU made clear that allowing one simple "ok" option and a million convoluted ways to say "no" is not resulting in informed consent.
Wheter you us a popup or hide it in a menu with the default of not tracking does not matter.
The frontend content screen component of the whole topic was something that emerged afterward as businesses' attempt to get away with continuing rampant unfettered data collection.
A bigger question is: why didn't they go with the DoNotTrack header.
> P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&a... for more info."
The GDPR requires that consent be informed, explicit, freely-given, and limited to a specific use case. Of these, the "DoNotTrack" header could be at most freely-given. Its design as a binary yes/no that can be configured across all sites prevents it from ever being used as a way to grant permission to track.
While the presence of "DoNotTrack=1" could be used to assume that no permission to track has been granted, this is already the default assumption that the GDPR requires companies to make.
There are at least two solutions for that:
1. Force browsers to support the header.
2. Always send the header "DoNotTrack=boolean", then force websites to take action (show a popup) when there is no header.
when you join a poll you do so with consent, when a market/social/political research entity invites you to a focus group (for example) you get at least a coffee and snack if not real money.
websites just get this for granted? it’s like stealing. it will never stop until the industry gets some understanding of these concepts.
This is the industry that perfected psychological manipulation in the pursuit of profits. It's built on decades of research into the best ways to associate brand names with positive feelings, and plant a desire to make a purchase in the subconscious mind of consumers. They will do anything humanly possible to deliver ads to your senses, and they've corrupted every media technology to do so since the existence of public broadcasting.
The internet has just given them the most profitable delivery mechanism, and in turn has made technology companies insanely rich. These adtech giants rule the internet, and can build the playground they need to make ad delivery more efficient than ever. Now these profits can trickle down to website owners, which will in turn take the path of least legal resistance, and employ every dark pattern imaginable in order to maximize _their_ profits.
And if this corrupt business model wasn't enough, adtech companies can perpetually multi-dip by selling the data they collect on shady data broker markets.
So, no, it's not just stubbornness, or lack of understanding. Deceit is built into this industry, and these cookie consent forms are just the tip of the iceberg.
The solution requires much stronger regulation than the GDPR. Unfortunately, this is very unlikely to pass given the influence advertisers have on governments.
Isnt the user getting free content in return?
Archive for life.
Free content was around before advertising on the web, this whole 'but they get free content' spiel was cooked up by advertisers.
Static we pages are cheap to host. Very rare is the article on [news site] getting mllions of simultaneous hits. But they all want videos embedded everywhere, gifs galore when all I want is to read their 20 min video in 2 minutes. They want their website hosted on the cloud with every new/hot architecture out.
How mant nyt articles are reprints of a reuters article the nyt then turns into 10 pages with aforementioned videos etc.
They did this to themselves.
They aren't a form of malicious compliance at all, because they aren't compliant at all.
No banners necessary. Just block 3rd parties.
A lot of users are already blocking third party cookies and that's the default in Safari and Chrome nowadays - but ad companies have moved on.
(Under your analogy maybe the store is putting a beacon in my pocket.)
Physical stores don't do that and therefore your analogy breaks down.
They don't need to sic a minion to sniff after you. The implication of buying condoms and then visiting the hotel only requires to correlate three tables.
https://techgdpr.com/blog/wifi-tracking-retail-analytics-gdp... has some background.
https://www.spring-board.info/differences-between-geo-wifi-f... is from a British company which claims to do compliant tracking in shopping centres etc.
There's a very good reason why I don't have any such client card and will never apply for one.
The store can track your purchases down to the line item if you use one of those. I vehemently disagree with that.
Also, I pay mostly with cash.
Yes, absolutely. I don't have an expectation of having as much privacy as I do when in a private residence with the blinds closed, but I do have an expectation of some forms of privacy.
* The store will not perform a full strip-search of my person upon entering.
* The store will not place a GPS tracker on me as I leave, to determine where I live.
* The store will not have a team of employees with clipboards follow me at all times, making notes of my location within the store.
* The store will not keep a record of my eye movements, correlated against which products are being glanced at.
The problem is that, as technology has advanced, some forms of privacy that used to be protected by impracticality of implementation no longer have that protection. For example:
* The store will keep video record of my visit for a few weeks at the most.
* The store will not analyze video records outside of suspected shoplifting.
* Record of previous purchases is limited to the cashier's memory.
Privacy is not a binary yes/no decision. As technology improves, forms of privacy that were previously protected by limitations of implementation must be protected through other means.
You're agreeing to all — otherwise illegal — tracking they can manage to do, not just some cookies.
Of course the whole issue is that the most popular user agents (i.e. web browsers) did very little to empower users to act responsibly with their cookies. I mean I consider the Cookie Autodelete extension just basic hygiene at this point, just like having a good ad blocker and some kind of firewall/virus scanner.
Wow no one opted in? Shocked.
As a designer I despise mandatory content blocking modals and each one will still have a new design you have to decipher. Maybe if they clarified some design rules (2 or 3 big buttons with clearly defined text in legible colours/fonts etc) then it would be tolerable.
Regardless making it always have Accept/Reject/Custom is a good step forward, even though fingerprinting and browsers like Firefox blocking 3rd party cookies by default pretty much eliminates their utility.
I've only seen a handful of sites do this. Developers inclined to respect Do Not Track seem less likely to add tracking anyway, in which case you also don't need the banner.
Sure, shady surveillance-based businesses can still pilfer your information and sell it to illegitimate businesses regardless of the legality. But it being illegal will stop the vast majority of wanting-to-be-legitimate businesses from collecting it, and prevent the largest group of threat actors (insurance/credit/etc) from using it.
I was responding to this: "There's also nothing stopping a website from showing a cookie banner, getting a user who clicks on "no cookies" and tracking that user anyway". You seemed to be implying that since a website can technically ignore a user's (lack of) consent regardless, that the popups are unnecessary. But legally, the concept of consent is very significant.
The popup mechanism itself isn't designed for you. I do agree that honest businesses don't need "consent" nag walls, as nobody actually wants their personal information datamined as a feature. But the actual dynamic is that these businesses are trying to preserve the status quo of user surveillance by obtaining fig-leaf consent. And the "best" way to do this (from their perspective) is an obtrusive nag wall that makes it easier to submit rather than reject (whether by accident or through attrition).
So nag walls are just a similar user-hostile solution just like surveillance based advertising itself. And the main way the dynamic of malicious compliance will go away is further enforcement, although I fully support technical solutions that delete nag walls as well.
Depends on what legislation the website is hosted and/or the company is ? Not a layer, just trying to learn.
Nothing else.
In addition, legitimate cookies to provide a service don’t require consent.²
If you’re annoyed at the EU instead of the websites, you’ve played right into the hands of the people wanting your data for illegitimate purposes. Every time you agree to a bad cookie banner you validate their shady practices and make the web worse for everyone, including yourself.
¹ https://noyb.eu/en/where-did-all-reject-buttons-come
² https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies+and+...
"Oh you are against x regulation? Yet you aren't against mandatory seatbelts or warnings in cigarette packages, or child labor laws! Curious!"
Like you realize that it is a pretty self defeating argument, since you are inadvertently saying that any regulation is a slippery slope to another one. Which thankfully isn't the case, and people can actually form an opinion on individual laws (and even disagree with them!) even if they are in favor of other regulations.
People sometimes then have the weird reflex to blame regulators for making explicit what garbage they're being fed, when you should take it up with the company who is actually responsible for vacuuming up your data.
Simply not accurate. The GDPR has other, more important accomplishments. See also: "gdpr unsubscribe", "gdpr do not contact", "gdpr consent". e.g. https://ico.org.uk/for-organisations/guide-to-data-protectio...
There are also other, less visible accomplishments. I've been on the inside of companies doing a GDPR data compliance check, and for some data stores, simply deciding that this one is not the "system of record", that passes beyond usefulness and setting a time-to-live of e.g. a month or a year, so that data about user actions is not retained beyond that.
This _absence_ of retained PII ( https://gdpr.eu/eu-gdpr-personal-data/ ) that has been encouraged by GDPR will inevitably make some breach somewhere less severe, but "what could have happened but did not" is not a visible accomplishment.
Thinking that it's all about your cookie banner is shallow, dismissive and egocentric.
Fundamentally, standards as vague as "legitimate" or "necessary" shouldn't be a part of law because they are so subjective. What do you say to the executive who says that without the advertising the company will go bankrupt, and untargeted ads earn no money? That her company is not necessary? That her business is "wrong" in some way? That customers are wrong for not wanting to pay? It's ludicrous that such a situation can ever arise.
Good law is precise. Bad law isn't, regardless of how convenient it may be for the lawmakers to be vague. The existence of bad law doesn't justify the further propagation of it.
Being able to make more money through ad tracking to stay in business to keep the service running is not one of them.