Hacker News Reader

Comment by asynchronous | Hacker News Reader

Cookie banners are so annoying. I support any extension to remove them.

They are probably designed to be like that so you can rush into accepting the tracking across the web.

The web has become a sad place where most of the content is made for showing you ads and tracking you around, therefore tracking cookies are needed, therefore tracking cookie permission banners are displayed.

If you don't click accept on the very first page, websites can't connect you to where you're coming from, which is why they're like that.

I mean, in theory they could do that retroactively, but that would be waaay to complex.

Popular cookie banners enable services by executing their javascript. There's no event tracking mechanism whatsoever. Cringe fact about cookie banners.

It's probably because every engineer spends as little time as possible on it, since it's boring af. It's annoying & boring to implement, and once it's done, annoying to everyone that sees it.

> They are probably designed to be like that so you can rush into accepting the tracking across the web.

Correct (speaking as someone who worked in an adjacent area).

The DuckDuckGo browser automatically manages (auto-refuses) these banners. It also has a lot of privacy-preserving features and a distraction-free youtube player that’s nice. And most of all it’s WebKit based, which is good for engine diversity, I guess.

On iOS, the only engine available is WebKit.

On Android, it uses blink (Chromium)

I was talking about macOS where it uses WebKit when it could use whatever they wanted.

they're designed to be annoying, a perfectly reasonable response to GDPR was to stop being fucking creepy

Is not being creepy sufficient? My understanding is that you need consent to collect literally any PII, e.g. an email address.

No, that's not correct. The GDPR is a surprisingly sensible set of rules, e.g. it allows collection and storage of data under certain circumstances. The salient point here is probably that it is allowed to collect and store all data required to fullfil a contractual obligation, e.g your home address, or if you are shopping at a pharmacy your prescriptions. The important part is not what type of data* is collected, but that the collector is restricted to use that is required to fullfil the obligations. If you want to use it for something different (say direct marketing) you have to ask for permission.

This extends to many areas, including e-mail, if they are required to deliver your services you may just save them. However, you may not use the e-mail to send newsletters. Of course, you want to double opt-in e-mails in any case unless you don't mind false or malicious entries and being labeled as a spammer. But that has nothing to do with the GDPR.

* the type of data is of importance when we are talking about data breaches and fines. Losing e-mail addresses is bad, losing prescriptions is much worse.

No. Consent is only needed for data you collect which is unnecessary to provide the service you are offering and is unexpected by the user. If you require an email address for a mailing list or notifications, you do not need consent. If you have webserver logs containing IP addressees you use for debugging and abuse prevention, you do not need consent (though you probably want to not hang onto them for longer than necessary for those purposes). Same with names and addresses for billing and shipping, etc. If you collect data for analytics or targeted advertising, you need consent (which means rejecting that option needs to be the default and at least as easy as accepting in the dialog, something which many of these dialogues fail at. If it takes more clicks to close the dialog without 'accepting', that is not GDPR compliant in the view of most regulators).

Reply on news.ycombinator.com