Hacker News Reader

Comment by cbeach | Hacker News Reader

The proliferation of irritating cookie consent popups on the web is ENTIRELY the fault of the EU "Cookie Law" 2009/136/EC (amendment to 2002/58/EC)

I repeat - the cookie consent popups, and the resulting de-sensitisation of users to genuinely useful warning popups - that's ENTIRELY the fault of the technocratic leadership of the European Union.

"Big corps" have to follow the rules or they will face hefty fines.

---

Edit: the comments about the consent forms protecting against "spying" are disingenuous. Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent.

View on HN

> I repeat - the cookie consent popups, and the resulting de-sensitisation of users to genuinely useful warning popups - that's ENTIRELY the fault of the technocratic leadership of the European Union.

Repeat as much as you like, you're still wrong. Note that this website you're currently using doesn't have one. Neither does github.

> Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent.

That's the point.

I've seen analytics data. Looks neat. Definitely doesn't need to be granular to the level of individual users.

Also, given how badly I'm categorised by even the giants like FB, I simply don't believe this data is half as useful as it seems from the shiny graphs coming out of most analytics software.

IANAL but my understanding is that if a cookie is strictly necessary for functionality (such as a login token or storing the region the user explicitly selected) then no consent is needed.

"improve performance and UX using simple analytics" I don't see how performance requires persistent analytics. This smells like a flimsy justification or perhaps "we always did it this way" rather than strict technical necessity. You can send events from a current session without keeping state in the client. And if one truly cared about performance, there's a lot of fat to trim from many commercial webpages that shouldn't require any analytics at all, try opening a profiler first and notice how much time is spent on loading all the analytics stuff.

I think you might be reading improve performance to mean “page speed optimization” rather than “profit making optimization”.

This is correct, its not needed for good performance, and most things websites require cookies for dont require the disclaimer, with two caveats. First its pretty clear from the law what requires it, but what if you are wrong, what if corp requires legal to sign off on the engineers statement that it is legal, its not like you gain much from not having the disclaimer, and second, most freemium analytics (e.g. googles) and all ad related services do require it.

> its not like you gain much from not having the disclaimer

Then the "popups" (which aren't actually popups) aren't actually as onerous to users as the web developers on HN would have us believe.

Seriously, I never hear common people complain about it, only people in the industry who have a commercial stake in tracking people without consent

This is an equivalent of your call being eavesdropped, EU forcing the operator to remind you every 60s that they are listening and you getting upset that the EU made calls so annoying.

But I'd rather they ban eavesdropping not make my call really annoying.

Not a well thought through law and clearly needs an update to restore usability to the web

Yet you are happy enough to stop at "the intention was good".

I imagine you smiling happily every time you have to click "set cookie preferences ... reject all".. ahh good old EU looking out for me, how wonderful they made things.

> Not a well thought through law and clearly needs an update to restore usability to the web

Show me where GDPR talks about browsers or cookie popups.

> Yet you are happy enough to stop at "the intention was good".

No, I'm not. I want the EU to slap the maximum possible fines on the biggest perpetrators, as defined by the law.

> I imagine you smiling happily every time you have to click "set cookie preferences ... reject all".. ahh good old EU looking out for me, how wonderful they made things.

The cookie banners you are complaining about are illegal, read the EU law directive [1], it states pretty explicitly:

> Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

It's not the fault of the EU law if companies decide to act illegally. Blame the fucking companies, they are the ones making you miserable.

[1] https://gdpr.eu/cookies/

> Even functionality such as remembering user region, or allowing the website to improve performance and UX using simple analytics requires consent.

no, it does not

Basically EU made sure you are aware that you are being spied upon, that your personal information is being harvested and sold for marketing........and you get angry at the EU?

> s ENTIRELY the fault of the EU "Cookie Law"

i profoundly disagree. the cookie law+gdpr did not force the websites to show their obnoxious overlays, they do that in order to confuse a part of the users and make it hard do not opt in. they could have used a simpler way to show the information, or, you know... not sucking every information about you they can, which would have not created the need to show anything.

edit: maybe it's not well known exception, but cookies that are mandatory for the functionality of the website (and are not used for tracking) do not have to pass through the opt in process. for example, the session cookie for the login functionality.

Nope. (Also IANAL)

- EU Cookie Law is "tell people you're using cookies". And with GDPR it became "if you use that data strictly for the operation of your website, you don't need anything at all"

- GDPR is: if you want to collect more data, and track people, and sell/send people's data to third parties, you have to ask for their consent in a clear unambiguous manner, with opt-out being as easy as opt-in.

The industry's response to that [1]?

---

We value your privacy.

1498 partners

We're building a profile on you

GDPR made us do it

Agree to all

---

And the gullible devs gobbled that up and blame the law for their own industry's failing.

[1] https://twitter.com/dmitriid/status/1733421877119324609

No, ePrivacy article 5(3) always had an exception for strictly necessary purposes, with clear guidance of what it means from DPAs and WP29 (now EDPB). I agree with the rest of your message though.

What is your proposed policy alternative?

Users can disable cookies on their browser if they care about limiting tracking and website functionality.

Or if you insist on regulations that burden every website operator, how about the user ticks a box in their browser once e.g. "I do not consent to cookies regulated by EU Cookie Law" and then that choice is sent in the header of every web request, and website operators are mandated to respect it (and NOT show a banner asking for consent every time the user visits!)

What if the operators don't respect the header? Well, what if operators don't respect the user's responses to cookie consent popups? We're relying on operators doing the right thing in both cases, and the EU cannot guarantee either approach will work.

> Users can disable cookies on their browser if they care about limiting tracking and website functionality.

You seem to be deliberately ignoring the fact that cookies are necessary for normal website functions like logging in to a user account. And also the fact that those types of cookies do NOT require a consent banner.

> how about the user ticks a box in their browser once e.g. "I do not consent to cookies regulated by EU Cookie Law" and then that choice is sent in the header of every web request, and website operators are mandated to respect it (and NOT show a banner asking for consent every time the user visits!)

I agree, that would be ideal. I hope it comes in the next version of the ePrivacy directive.

> What if the operators don't respect the header? Well, what if operators don't respect the user's responses to cookie consent popups?

That's what law enforcement is for. A common critique of new EU laws is that the enforcement is lax at the beginning. However, it ramps up over time and is a one-way ratchet. The EU is like a massive ship with huge inertia. Changing course takes a long time, but once it gets going, you better not be in the way.

By the way, we saw this with those highly infuriating and illegal cookie banners that hide the option to deny cookies behind many clicks. The regulation clearly says it should be as easy to consent, as to not consent. And most cookie banners I see nowadays have an easy opt out button.

> The EU is like a massive ship with huge inertia. Changing course takes a long time, but once it gets going, you better not be in the way.

Yup, Europe is so lucky to have this stubborn, inertia-ridden juggernaut in charge of dynamic and innovative technology like the Internet

Well, I see your point. I also partly agree, in some cases it would be better if the law could catch up to new technologies faster. On the other hand, people here tend to value stability over novelty.

Won't somebody please think of all the "dynamic and innovative" ways that tech companies want to track users with? Curse the EU for putting the brakes on this!!

> And most cookie banners I see nowadays have an easy opt out button.

...which you have to click EVERY TIME you visit nearly every website on the web.

What a great success for usability.

That's entirely the website operator's choice. They could store that preference as a technically required cookie. But they choose to bother you every time. As we discussed, legally mandating a DNT header would be better.

> What a great success for usability.

Forced onto us by the site operators (directly, or via their "partners"), not the regulations.

It is called malicious compliance. In fact many of those popovers are not even properly compliant in various ways (usually breaking the "as easy to opt out as to out in" mandates, to give the most common example).

If you are angry at "cookie laws" and/or GDPR, you are angry at the wrong target.

That's the Do Not Track header, and the moment it was implemented in browsers it was used to track and spy on people.

I guess that, too, was the EU's fault (and not the industry's).

The EU could have enforced DNT, just like how they enfored the GDPR.

The main problem with GDPR is precisely that it's not really enforced. Had it been enforced properly, we wouldn't even have this conversation :)

No.

In fact it's not a “cookie warning pop-up”, it's a cookie consent pop-up.

And there's an easy way to get rid of that pop-up for companies (big or small BTW): stop using cookies that require user consent: that is, stop harvesting people's data.

You're missing the point. The law didn't take into consideration that people are awful and as a result not only didn't accomplish its aims of either reducing the amount of data collected or making users aware of data collection, it made the act of using the web worse.

This is the problem with feel good laws like this. You always have to write laws assuming that those negatively effected will be bad actors that will try to subvert the law. That's just human nature. People want to keep doing what they're doing.

> The law didn't take into consideration that people are awful

Okay. I always ask this: what's your solution to this?

The huge fines suggest that they did take into account bad actors.

> not only didn't accomplish its aims of either reducing the amount of data collected or making users aware of data collection, it made the act of using the web worse.

It made the web worse because companies decided that making it worse was better than changing their business model. But it did reduce the amount of data collected.

> You always have to write laws assuming that those negatively effected will be bad actors that will try to subvert the law.

But they did. But EU was lobbied into being too business friendly, and relied on nudging them into better behavior instead of forcing them, and the businesses said “no way, we'd rather fuck up our website”.

There's no way the European Commission could have convinced the member states to accept a law that would be too detrimental to business interest. When discussing a law, you must always take into account the political forces that drives it adoption process.

Reply on news.ycombinator.com