Hacker News Reader

Comment by mavhc | Hacker News Reader

Do you assume laws cannot be updated?

Low-level EU Regulations like this take approximately 3 years to be drafted and adopted (validated).

A whole decade is often needed if the member states consider a new mandate is needed, typically a directive or regulation or treaty clause giving the EC authority and a framework to regulate something.

Any update to this regulation will have to wait at least 3 years after a new standard has been agreed on. And there will probably be a period for adoption by the industry, typically 2 years. So at least 5 years after everyone has agreed what is needed. It most probably won't be updated for the next 25 years.

Considering the number of stupid laws that haven’t been updated, and the conflicting interests every time an update is proposed, I answer that it can be safely assumed the law will never be updated in most circumstances.

The assumption that a law that directly influences millions of people daily lives and has close to 0 direct budget costs associated with it won't be updated when it becomes counterproductive is quite funny.

Are you American per chance?

The EU's cookie law still requires a banner for everything except "strictly necessary cookies",[1] which means you must have a banner if you use cookies to save preferred language, default location, or any internal analytics data (such as New Relic, Datadog, etc).

So yes, I think updating the law will take a significant amount of time.

1. https://gdpr.eu/cookies/

GDPR isn't the cookie law. It is a law regulating storage of personal data overall. The banners are a result of greed and incompetence. The companies made stupid amount of money by closely profiling every single individual using cookies and fingerprinting. They are in malicious compliance and if the behavior continues the regulation may become more stringent.

I never said the GDPR was the cookie law. I was just linking to a site that summarized the actual law. If storing preferred language in a cookie (without any uniquely identifying info) does not require a cookie banner, then I'd be happy to be corrected on that.

If it cannot be linked to you, it's no longer PII, and doesn't require consent.

As easy as that.

You don’t need an intrusive banner on page open. You just need consent.

If the user is saving a setting like a language preference, just put “by saving this preference you agree for us to store the setting” next to the option/OK button (it’s really implicit just like their shopping cart example, but this is if you want to be really paranoid)

You're linking to a fake website made by the private company behind Proton Mail, that tries to present itself as an official EU site. What they claim will be in their own financial interest, and not what the GDPR law says.

From the horses mouth:

"GDPR.EU is a website operated by Proton Technologies AG, which is co-funded by Project REP-791727-1 of the Horizon 2020 Framework Programme of the European Union. This is not an official EU Commission or Government resource. The europa.eu webpage concerning GDPR can be found here. Nothing found in this portal constitutes legal advice."

You do not need a banner, you need informed consent. I'm sure there are other ways of getting consent other than a half screen pop-up with a big red accept button on first visit, but they probably won't get 70% "opt in" rate.

Law: The optimum behaviour is annoying banners.

Companies: Annoying banners.

Legislators: Mission Accomplished. A win for the good guys!

Situation persists for at least a decade.

A more accurate version:

Law: You have to get some form of affirmative consent if you want to do specific often-abused things.

Companies: We'll do it in the most obnoxious way possible ("here are our 853 technology partners... no, there's not a 'deselect all' option, have fun clicking") so people blame the law instead of the industry that didn't want to allow consent at all.

There's always a deselect all option (or rather, the equivalent "accept only the technically required ones"), because it's required by law. Sometimes the operator tries to hide the option. That, too, is illegal.

There is frequently not a "deselect all" option; there's a reason regulators keep having to warn about it.

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs...

I so wish that "our 1234 trusted partners" was an exaggeration.

Maybe I am dense but I cannot find the requirement for cookie-banners in your link.

Selecting the language you want actually sounds like "functionality that has been explicitly requested by the user" who "did a positive action to request a service with a clearly defined perimeter". This is clearly allowed.

https://ec.europa.eu/justice/article-29/documentation/opinio...

Section 3.6 says that UI customizations such as language preferences are only exempt if they last for a session (no more than a few hours). Anything longer requires a cookie notice, though they do claim that a less prominent notice than a modal is acceptable.

There's no section 3.6.

It doesn't say only a few hours.

The optimum behaviour under the law is not to show a cookie banner. It's not to collect copious amounts of data.

You only had 8 years to learn about the law, and you still remain willingly ignorant and misinformed about it.

Page 8 of the PDF[1]: 3.6 UI customization cookies

> These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted under CRITERION B.

It specifically says that a consent notice is required for UI customization cookies that persist more than a few hours, and it gives an example of preferred language as one of those UI customizations.

1. https://ec.europa.eu/justice/article-29/documentation/opinio...

> Page 8 of the PDF[1]: 3.6 UI customization cookies

What's "Opinion 04/2012 on Cookie Consent Exemption" adopted on 2012, 4 years before GDPR?

Edit On top of that, actual quote:

--- start quote ---

"They may be session cookies or have a lifespan counted in weeks or months, depending on their purpose

... addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration,

--- end quote ---

12 years since this opinion, 8 years since GDPR, and you still have no idea about either.

Sounds perfect to me.

Reply on news.ycombinator.com