Hacker News Reader

Comment by aargh_aargh | Hacker News Reader

Wow, I got two different cookie consent overlays on android chrome on top of each other. That's a first. They must REALLY care about my privacy.

View on HN

As each year goes by, I get more and more annoyed by the cookie consent pop-ups.

Does U.S. law really require cookie pop-ups? And don't most websites store the cookies before consent is given anyways?

https://olivergrimsley.com/2022/03/04/please-stop-putting-co...

IMHO it’s because they can try to apply a dark pattern to have users accidentally consent to more tracking than they might normally agree to.

100%. This also bugs me: Why can’t websites set a cookie that stores whether I’ve consented to the cookie pop up? On some sites I have to keep consenting over and over (IKEA comes to mind).

This is mostly malicious compliance - the law does not require these annoying popups, but the websites want them to a) make you dislike the law that prevents them from freely collecting your data and b) wearing you down, so you just accept instead of making the effort to go and deny the data collection. Also, at this point it's probably also a lot of cargo culting.

It's mostly ignorance now. Most people don't know the law and don't know how to comply with it. If the popup method hasn't been invalidated by a court, why spend more on time, energy, and risk doing something different?

Is there really much risk in just not tracking by default?

I think ignorance is part of it, but also, they don’t actually want to do what users want them do to, which is just not track unless the user goes looking for options that actually require tracking at a technical level.

> Is there really much risk in just not tracking by default?

Let’s see… I can’t even stop Marketing from breaking our site with Google Tag Manager.

A significant portion of our sales come from the ability to track users and email them useful product recommendations.

We do not sell customer data and try to avoid vendors who do. It’s only used internally.

Absolutely not. The people implementing know, and the people designing know. This represents intentionality.

Stack Exchange is downright malicious in having you click it on each subdomain.

No, I don't care that one user created the Math forum and another created the Sysadmin forum, it's all run by you Jeff, that's who I am engaging when clicking the popup, not MathFan1982

I always assume that they'd stop asking if and only if you say yes to all -- is that not the case?

Having a pop up for only cookies is silly, but at least as often they’re used for data processing consent and that makes more sense than putting the consent form on a splash screen or in the body of the page I guess.

Happily reader mode works just fine with this page.

They are being super-solicitous: you need to allow the cookie consent dialogue to record your preferences, using a cookie.

https://archive.is/l68pV

I know this is a pretty unoriginal point, but I wish cookie consent could be a browser setting you set once and never have to deal with again unless you need to change it for a specific site. The nag screens have got to be the worst possible implementation, it's like none of the people who decided this was the way it ought to be done ever heard of alarm fatigue.

That's exactly the point: it's to make people angry at the "stupid politicians" instead of the data thieves.

It's malicious compliance. Websites are free to simply not track you.

Its also malicious legislation. The EU could have easily wrote a line in the GDPR requiring companies to respect the Do Not Track header. But they chose not to. They also included various loopholes such as "legitimate interest". The legislation was just enough that it looks like they're doing something, without actually hurting the surveillance industry's bottom line too much.

The DNT header was devalued when Microsoft enabled it by-default in Internet Explorer, because it made it impossible for websites to determine if the DNT header was actually set by user-choice or not: any in-page cookie-consent popup that collected actual consent wouldn't change the DNT header sent by the browser, for example.

I honestly don't know if Microsoft in 2011 was doing this for unsurprising business reasons (e.g. as a ploy to hurt Google (AdSense was still all-the-rage), because it's good PR, because they had any genuine concern for their users' privacy, and to do anything to win-back market-share from Chrome and Firefox) - or if it was an intentional move to torpoedo the DNT header by showing how useless it is but only because they implemented it precisely so that it would be useless... but Microsoft wouldn't benefit from user-tracking over the Internet anywhere near as much as Google did/does/would-do.

It should be the default. Maybe we could add a new 'Track Me Please' header that users can opt into

In that case just like anti ad-blockers, the first thing we see on a page will be a very helpful guide to enable the opt-in header for that particular browser.

When third-party cookies get blocked by-default this whole thing will be moot, imo.

DNT, if respected, also applied to first party cookies as well as other tracking mechanisms.

The EU is willing to force every user to go through an annoying browser ballot upon buying a new phone or computer, but can’t force the browser to include a DNT prompt up front if it’s that much of an issue?

Plus it’s not as if these companies weren’t willing to assume consent in the absence of the DNT flag. It sounds like a bit of BS to suddenly worry about what consent really means when it goes against their bottom line. I don’t see many hands being wrung about whether the user is meaningfully consenting when they click the easiest and most visible button to dismiss a banner that obscures a quarter of their screen.

> because it made it impossible for websites to determine if the DNT header was actually set by user-choice or not

Somehow that never bothered sites when the default let them track users.

Isn't this the Do Not Track (DNT) header? https://en.wikipedia.org/wiki/Do_Not_Track

If it was a browser setting, which already exists but gets ignored, it would get ignored and would throw up a popup anyway. You can use Consent-O-Matic[0] though, you can even select the types of tracking you do want.

0: https://github.com/cavi-au/Consent-O-Matic

P3P looked so hopeful, but died long before the legal requirements were there.

https://en.m.wikipedia.org/wiki/P3P

No sites want that though because everyone would either check 'no cookies' or 'only necessary cookies' which would ruin their ability to make money off the vast majority of visitors to their sites.

Reply on news.ycombinator.com