> PostHog.com doesn't use third-party cookies, only a single in-house cookie
You're legally required to let me opt out of that cookie. Unless it's essential to the site functionality, in which case you don't need the banner at all.
Even worse: because it makes it seem like the EU law is just meritless pestering of people, they are actually fighting for the right for worse sites to spy on their visitors.
It's baffling.
It is that. It has done literally nothing to improve anything whatsoever, in any country. And most of the "cookie management" scripts that people use, barely even work. Both the law and the way it's complied with in practice are a dumb solution to a problem that the EU should have forced browser vendors to solve. Only the user's browser can choose not to send back cookies, and it would be trivial for the user to be shown a dialog when they navigate to a previously-visited site in a new session saying:
Last time you were here, the site stored information that may help them recognize you or remember your previous actions here.
< I want to be recognized > / < Forget Everything >
[ ] Also keep these third-party cookies <Details...>
[x] Remember my choice and don't ask again for ycombinator.comIn other words, of course Facebook knows you like bacon if you've followed 5 bacon fan pages and joined a bacon lovers group, and they could sell that fact.
But without cookies being saved long-term, Facebook wouldn't know that you are shopping for a sweater unless you did that shopping on Facebook. Today they undoubtedly do know if you are shopping for anything because cookies exist and because browsers are configured to always save cookies across sessions.
Also, I always point this out when this topic comes up: Of all websites I visit and have to click stupid banners on, almost none of them are in the market of "selling data" or building dossiers about individuals ("Steve Smith bought flowers on June 19th. Steve is 28 years old. He has a Ford Explorer. He lives in Boston."). They just want to get metrics on which of their ads worked, and maybe to know aggregate demographics about their audience. My local water utility, Atlassian, and Nintendo to pick 3 sites at random, have never been and are not in the business of data brokerage. But they do need to show cookie banners to not be sued for imaginary harms under CCPA or GDPR (unless they want to not make any use of online advertising or even aggregate analytics).
Given that there is no objective way to differentiate between functional and tracking cookies, your "technical" solution would also boil down to honoring marking certain cookies as such by the website owner, effectively being the same as what we have today.
(Though I do agree that the UX would be nicer this way)
If they can open a port and side-step the security system of Android wholesale, they can probably find a "solution" to the not even that hard of a problem of doing tracking server-side.
Pretty much everyone was willing to give this away for free on the client side, in return for limited social integration, or (in Google's case) free analytics - server side is a significantly harder sell in many companies, and there is a much richer variety of backend languages/frameworks you have to integrate with.
If you're using functional cookies, you don't have to ask. If you're still asking, you're just wasting your time.
The reason every website asks is because:
1. They're stupid and don't even bother to preliminarily research the laws they comply with.
2. They actually are tracking you.
Ultimately if you're using something like Google Analytics, then yeah you probably do need a banner. Even if it's just a blog.
Great, so then don't do that.
It does not take time if you don’t care to read it. Yours click yes, and they will remember you want to be tracked.
In practice these banners regularly break. They are hard to click on certain devices where the button is off screen. If they use JavaScript and there is an error elsewhere, you can’t hide them. And I regularly see them over and over again on the same sites because for some reason they can’t track me effectively for this purpose.
In short they are a regular minor annoyance that does take time and effort.
Other people already get two choices to make here which they didn't get before, which is a win in my book. Seeing the banner, you can decide to avoid the website and if you still wanna use the website, you can chose if you allow them to track you by PII or not.
Also, I am an educated consumer and understand what a cookie is. Most people do not and do whatever is necessary to make the consent screen go away. Because of that, effectively they don't get this choice.
As one of the parent posts said, if it was implemented on the browser level, I would get the choice, and the cost of making the right choice would be smaller. If the defaults were to "reject unnecessary cookies" then most of the population would get the benefit.
The way it is right now feels like a net negative. Most people don't know what the consent is about and will not spend the time to learn it. Companies still find ways to track you that agrees with the letter but not the spirit of the law. I have friction whenever visiting a new website (or an old one that forgot my choice). The only winners are people who don't value their time and are smart enough to understand cookie consent. That's a small percentage of the general population.
That's because the tracking is a net negative.
There's a reason people have always hated popup ads even though "just close them" has always been an option.
I have seen a ton of these ads in the past few years.
All these laws have done is created a ton of wealth for lawyers.
Back in the day browsers offered this natively. When the advertising companies started building browsers there was a lot of incentive to see that go by the wayside of course...
But the earlier comment isn't saying that you shouldn't have options, rather that the law needs to be more specific, such as requiring browsers to work in coordination with website operators to provide a unified solution that is agreeable to users instead of leaving it completely wide open to malicious compliance.
These kind of laws need to be careful to not stifle true innovation, so it is understandable why it wanted to remain wide open at the onset. But, now that we're in the thick of it, maybe there is a point where we can agree that popup dialogs that are purposefully designed to be annoying are in volition of the spirit and that the law should be amended to force a better solution?
1. The law isn't about browsers or websites. It equally applies to all tracking. E.g. in apps. Or in physical stores.
2. The world's largest advertising company could do all you describe. And they do work with websites. First by repackaging tracking through FLoC. Then by just simply repackaging tracking and calling it privacy: https://x.com/dmitriid/status/1664682689591377923
Obviously. And where there are problems in those domains equal specificity would be asked for. But since we're talking about in the context of browsers specifically...
... then we all know it only cookies that matter? I don't understand the ellipsis
Oh look. Here's what I wrote:
--- start quote ---
The law isn't about browsers or websites. It equally applies to all tracking. E.g. in apps. Or in physical stores.
--- end quote ---
> But what does matter was already discussed. Are you reading comments in complete isolation again or what? There is a context that has been built up.
This is literally the only thread around your comment. There are dozens of other discussions, yes. I was specifically replying to your comment, and expecting replies within the context of your comment.
A historical law that hasn't had anything to do with the discussion since conception isn't about browsers, but the discussion about how future laws might improve upon 'malicious' use of browsers is. Said 'malicious' use of browser isn't about cookies, though, so such a new law would not be written about cookies anyway, so where do you think cookies even fit?
> I was specifically replying to your comment
You replied to it in a mechanical sense. But you did not reply to the content of it. And now are apparently doubling down on that even after it was brought to your attention...
The more obnoxious the cookie banner, the quicker you can conclude "I didn't really need to visit your site anyway".
If you want to operate an ad-supported site, you need that consent. Untargeted ads are pointless and they don't make money. If you disagree, can I interest you in some brake pads for a Toyota Corolla? How about a dental chew for elderly cats? No? ok.
If you operate an e-commerce site or a SaaS of some kind, you probably need to advertise it online. To have traffic land on your site from advertising, you need to have ad network 'pixels' on your site. That's what they require. If you won't comply, then you can't advertise and you probably can't get many customers.
Websites which need neither are called "hobby sites." I'm very happy for the personal blogs which use no analytics, have no need to remember anyone or collect any "data." The sites showing the cookie banners are not that. They need to make money in order to exist.
Why didn’t you instead suggest server space or a novel automation tool? You know, things relevant to people visiting HN.
That’s how untargeted ads work. You don’t simply advertise anything anywhere, you advertise relevant things to relevant communities. Advertise the break pads on a community of car enthusiasts and the cat chew on pet forums.
It's not cookie banners that are wasting productivity, it's mutual distrust and the need to protect against it. "Cookie banners" (or more correctly: consent forms) are legal contracts. The reason they are often so annoying to navigate is that the companies that built them want to try to trick you into agreeing to things you have no interest in agreeing to or might even have an interest in not agreeing to. Technically the law forbids this but it's still more profitable to risk the fine than to abide by the law.
Or to put it another way: there's no honest reason to require a consent form to let you read an article. The consent form isn't for reading the article, it's for what the site wants to do to you (or your data - which includes all data collected about you because the GDPR defines that as being yours, too) while you're reading the article.
The GDPR doesn't make you waste time on cookie banners. The GDPR grants you ownership of all personally identifiable information of you and about you - it creates legal rights and protections you previously didn't have. Cookie banners exist because companies want to infringe upon those rights. Most cookie banners are difficult to navigate because most companies don't want you to understand what you're agreeing to (and on second order because they want you to blame the law granting you rights rather than them for infringing upon those rights).
Rights don't make sense without bureaucracy because they only have meaning when you deal with them at that layer of abstraction. You can't respect and infringe "rights" interpersonally. You can act ethically or unethically, you can be nice or a bit of a dick, you can harm or help. But rights only become necessary as a concept when you have processes that need to interact with them and abstract entities that uphold and enforce them. Rights allow you to sue or call the police. But without rights you can't have capitalism. States enforce property rights literally at the end of a gun (and this includes "state property" too in case you were wondering about so-called "communist" states).
Respectfully, this is untrue. The article is there because of the ads that pay the bills. Without ads there is no article and no site. Without consent, under these laws, the ads can only be useless ads that no advertiser wants to pay for, which means they either can't sell the ad space at all, or have to sell it for $0.0001 CPM hoping that like, Coca Cola will want to just remind the readers that Coke exists and not care too much if anyone even clicks it.
When behavioral targeted advertising was new, it vastly outperformed previous ad networks which used a spray-and-pray approach and paid by impressions. In the years (decades?) since, the payouts for behavioral targeted advertising have dropped significantly. "Untargeted" ads on the other hand have mostly vanished simply because the ad networks that used them have moved on to behavioral ads where they had to compete with mass data harvesters like Alphabet and Meta, mostly unsuccessfully.
Behavioral targeted advertising also doesn't live up to its promise for consumers. Nowadays most actual ads people get are either trying to sell products they already purchased or outright fraud - the rest is the same generic drivel that you would expect without targeted advertising. The reduction in tracking surface from sites that don't require these ads to operate (e.g. sites that previously fed into networks like Google's via unrelated services that can now no longer be legally used for that purpose and require opt-in) also means the targeting will become increasingly worse.
The GDPR does allow for making behavioral ads conditional to accessing content, by the way. But it requires providing the user with the option to instead pay for the content. The problem a lot of companies like Meta run into is that it also requires the price to be proportionate to the lost advertising revenue - Meta is infamous for having priced its "ad-free" tier orders of magnitude higher than their actual value of an individual user.
That said, what is killing this kind of site isn't users deciding not to give away their data but services like Google scraping their content and pre-empting user traffic to their websites entirely - first via news feeds and search summaries and now via "AI enhanced search". The ad-driven business model is dying and has been dying for a long time, the GDPR just puts limits on what can replace it. Google wasn't paying sites because it wanted to sell ads, Google was paying sites because it needed access to their users' data.
It doesn’t matter what site I visit and what choice I do. The next day, every single website asks me to pass through the banners again.
That’s because of malicious compliance from all the websites/advertisers. I guess that is partly the lawmakers’ fault for not pre-empting that; but much larger blame lies on the industry that refuses to grant user privacy.
As an example for a site that followed the intent of the law instead: https://github.blog/news-insights/company-news/updates-to-ou...
Github removed excess tracking so they didn’t need to show a cookie banner and that’s what GDPR’s intent was.
Many sites ditched tracking altogether so they don't have to have banners. Everybody is aware of GDPR so you can be pretty confident that when european site has no banner it doesn't track you.
Could the law be better? Sure I would love to ban tracking altogether. But this was lobbied to hell by AD companies. Everybody was kicking and screaming because they want all the data. And we still got something that helps. That is a win.
And you can see how industry hates it in way they implement the banners. It is annoying and confusing on purpose. You could comply in nice way but when you need to share the data with your 141 ad partners and each one gets their own checkbox… good luck.
Same reason nobody was respecting the dont track me flag. The industry is absolutely and exclusively to blame here.
Indeed. So somehow you still end up blaming the EU.
Number of sites using google analytics on my browsing session with my consent has gone down
As an example of true malicious compliance, some companies intentionally add trace amounts of allergens to all their food, that way they can just claim that all their food contains allergens and not be at risk of being accused of improper labeling. but the intention of the law requiring accurate labeling was clearly not to get companies to add more allergens to their food. it requires a level of creativity to even think of complying like that. It requires zero creativity to think “this law requires user consent before tracking, so let’s ask for consent”.
I found a website that lists all fines handed out for violating the GDPR: [1]
[0] Google fined €325 million by French CNIL for placing cookies without consent https://www.cnil.fr/en/cookies-and-advertisements-inserted-b...
[1] https://www.dsgvo-portal.de/gdpr-fines/gdpr-fine-against-goo...
> In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02...
Article 4, Section 21.5
The industry could have come up with a standard, a browser add-on, respect a browser setting, etc but they chose the most annoying one to pester you, the user.
In fact the law pretty explicitly disallows dark patterns like that. Of course tech companies have a loosy-goosy relationship with the law at the best of times.
I'm glad I'm not in EU legal, it's gotta be like dealing with internet trolls ("I didn't ACTUALLY break any rules because your rules don't say I can't use the word "fhtagn"")
Start fining sites with dark pattern banners and they'll start going away.
If they had done that, nobody would be making cookie banners wrong.
Yes. For "cookie banners" the law in fact forbids hiding "Reject all non-essential and continue" to be given less visual weight than "Accept all and continue", let alone hiding it behind "More details" or other additional steps.
It also requires consent to be informed (i.e. you need to know what you're agreeing to) and specific (i.e. you can't give blanket consent, the actual categories of data and purposes of collection need to be spelled out) and easily revokable (which is almost never the case - most sites provide no direct access to review your options later once you've "opted in").
One good example I can think of for a "cookie banner" that gets this right is the WordPress plugin from DevOwl: https://devowl.io/wordpress-real-cookie-banner/ (this is not an ad, but this is the one I've been recommending to people after having tried several of them) because it actually adds links to the footer that let you review and change your consent afterwards.
EDIT: Sorry, I first misread "disallows" as "allows". I've amended my reply accordingly.
And this is a good thing, no? I certainly think so.
> It's a wonder we don't have to force everyone through an interstitial consent page.
If the information being tracked is truly essential to the site/app (session management and authorisation data for instance) then no consent is needed, for anything else ask before you store it, and most certainly ask before you share it with your “partners” or anyone else.
> Private-sector or third-sector organisations will often be able to consider the ‘legitimate interests’ basis in Article 6(1)(f) if they find it hard to meet the standard for consent and no other specific basis applies. This recognises that you may have good reason to process someone’s personal data without their consent – but you must avoid doing anything they would not expect, ensure there is no unwarranted impact on them, and that you are still fair, transparent and accountable.
Session tracking, storing account information, addresses, etc all seem obvious in any e-commerce system but you still have every opportunity to notify and consent that data collection.
I think you and I both think that data protection is a good thing, I'm just a little more wary of leaning on legitimate usage* as a way to skip formal consent.
Also, data collection is fully a choice. You can always choose not to. I've built websites with logins and everything and guess what - no cookie banners necessary. Just don't collect data you don't need.
Kind of. The intent is good and the wording disallows some of the dark patterns. The challenge is that it stands square in the path of the adtech surveillance behemoths. That we ended up with the cesspit of cookie banners is a result of (almost) immovable object meeting (almost) irresistable force. There was simply no way that Google, Facebook et al were ever going to comply with the intent of the law: it's their business not to.
The only way we might have got a better outcome was for the EU to quickly respond and say "nope, cookie banners aren't compliant with the law". That would have been incredibly difficult to do in practice. You can bet your Bay Area mortgage that Big Tech will have had legions of smart lawyers pouring over how to comply with the letter whilst completely ignoring the intent.
Many websites are free because they survive from ads. Ads make more money if you collect data. The EU law essentially cut the revenue of all these websites. Their choice is to not collect data (meaning less revenue) or show a popup (meaning more bounce rate, which means less revenue).
People who think this is a good thing are being short-sighted. That's because this law mainly affects websites that host information that visitors visit from clicking on links on the web. If a website is like Facebook or Youtube, where users must sign up first or probably already have an account, they will be able to collect data for ads with or without banners since they have their own ToS for creating an account, and they can infer a lot from how the user uses their services.
I'm not saying privacy regulation is a bad thing. It made countless businesses reconsider how they handle people's data. But it's clear to me that there are two problems.
First, this regulation hurts all the small websites that need to exist in order for we have to have a healthy "web." A lot of these are making only barely their hosting costs in ads, so there is no way they can afford the counsel to figure out how to comply with laws from another continent. If we had another way to support these websites, this wouldn't be a problem, but ads are really the lifeblood of half of the internet, and almost nobody wants to donate or pay a subscription.
Second, this regulation doesn't even really protect people's private data in the end, which may give users a false sense of security because they have the GDPR on their side. I forgot the name, but there was a recent gossiping app that required the user to upload a photo in order to sign up, which should be deleted afterwards, but they never deleted it and when the app was hacked the attacker had access to photos of all users. It's the same thing with GDPR. We can tell when a website is clearly not complying with the GDPR, but there is no way to tell if they actually complied with the GDPR until the server gets hacked.
Even the way they comply with GDPR isn't enough to protect users' privacy, e.g. if you have an account on Discord and you want your data deleted, they will simply turn every post your made into an "anonymous" post. This means if you sent a message that discloses your private information on Discord, that will never get deleted because its outside the scope of compliance. You could literally say "Hi, my name is XYZ, I live in ABC" and they won't delete that because you consented to provide that information, they will just change your username from "xyz" to "anonymous" or something like that.
I still wonder what are the actual benefits of GDPR with these cookie banners when 99% of the users just stay on Facebook and Youtube anyway.
My business is to get money out of other people's wallets and bank accounts. I could get make much money if you just logged into your bank account and approved transactions whenever I told you to, or screamed less whenever I took the wallet out of your pocket on my own.
That there's a way to earn more money does not justify it as legitimate thing to do, and if you can't figure out how to run a service in legitimate ways does not mean that illegitimate ways that attempt to violate its users in secret suddenly become okay.
The largest websites will still "violate its users in secret." That's why I don't think GDPR is as useful as people purport it to be.
there is nothing healthy about force-feeding ads optimized via collected data.
Bad implementation of the EU law indeed, as another comment said. It fails the purpose completely and just create more problems for nearly everyone.
Most of the "cookie management" scripts that people use aren't compliant.
EU law requires "Accept All" and "Reject All Non-Essential" be both equally easy to access and given equal weight (or rather: the latter can't be given less weight and made more difficult to access, which almost all of these scripts blatantly ignore).
Browser vendors can't solve this because the question isn't technical but legal. It's not about first-party vs third-party cookies (let alone same-origin vs cross-origin) but about the purposes of those cookies - and not just cookies but all transferred data (including all HTTP requests).
You don't need to (and in fact can't) opt into technically necessary cookies like session cookies for a login and such. It's plausible that these might even be cross-origin (as long as the other domain is controlled by the same legal entity). If they're provided by a third party, that would indeed be data sharing that warrants a disclosure and opt in (or rather: this can only happen once the user acknowledges this but they have no option to refuse and still use the service if it can't plausibly be provided without this).
The GDPR and ePrivacy laws (and the DMA and DSA) have done a lot for privacy but most of what they have done has happened behind the scenes (as intended) by changing how companies operate. The "cookie management" is just the user-facing part of those companies' hostile and dishonest reactions to these laws as well as a cottage industry of grifters providing "compliance" solutions for companies that can't afford the technical and legal expertise to understand what they actually need to do and think they can just tick a box by buying the right product/service.
Heck, most companies don't even provide legally compliant privacy policies and refuse to properly handly data access requests. The GDPR requires companies to disclose all third parties (or their categories if they can't disclose identities) your (specifically your) data has been shared with and the specific types of data, purposes of that sharing and legal basis for sharing it (i.e. if it required consent, how and when that consent was given) - and yet most will only link you to their generic privacy policy that answers none of those questions or only provides vague general answers or irrelevant details ("We and our 11708 partners deeply care about your privacy").
This is only an option if you limit tracking to using cookies. But neither tracking technologies, nor the current EU law, are limited to tracking via cookies. It also kills functionality for many web applications without also accepting all tracking. Some browser-flavors went to extreme lengths to prevent tracking through other means (eg fixed window size, highly generic header settings, ...).
Maybe I am mistaken, but it seriously frustrates me how much people within the relevant field make this mistake of conflating tracking and cookies and come to this "it would be so simple" solution.
A welcome update to the law would be to allow a header flag to opt out/in (or force the do-not-track header to have this functionality) preventing the banner from showing.
Maybe we could move towards that end in small steps. The EU should start by banning irrelevant non-sequiturs like "We value your privacy" and other misleading or at best distracting language. It can then abandon the notion that users are at all interested in fine-grained choice, and enforce that consent and non-consent to non-essential statekeeping are two clearly distinguished and immediately accessible buttons. No one wants to partially block tracking.
It seems as though the EU is operating under the notion that this is all a matter of consumer choice, as though any informed consumer would choose to have tabs kept on them by 50 trackers if not for the inconvenience of figuring out which button stops them.
90% of non-tech-nerds have this simple of an opinion about it:
1. Retargeting ads are "creepy" because ... "they just are"
2. Retargeting ads either annoy me because I think they're dumb in that particular instance ("I already BOUGHT a phone case last week, it's so dumb that it keeps showing me phone cases all day!") or because they're too good ("I gave in and bought the juicer after I kept seeing those ads all around the web") and I don't like spending money.
The rest of "tracking" they don't even know anything about and can't verifiably point to any harms.
Data brokers acquire data from thousands of different sources - many of which aren't stemming from Internet usage - and most of the browser data relevant here isn't tied to their actual name and permanent identity (and doesn't need to be to serve its purpose which is usually "to show relevant ads" and the more specific case of "to get people to come back and buy things they saw").
Honestly, just like people are annoyed by pushy car salesmen, and being asked for a "tip" at a self-order kiosk counter-service restaurant, they are going to be annoyed about aspects of the commercial Internet, and it doesn't automatically mean that they're being victimized or that they need regulations to try to help.
What I don't like about cookie popups isn't the popup (which isn't something the EU law dictated btw), it's that someone thought it was okay to have hundreds of advertisement vendors and data brokers on a single news article, and it's better to know so I can just close the tab and never interact with that webpage again if they're being excessive asshats.
They have failed at enforcing this properly though, in particular with the recent proliferation of "legitimate interest" abuse (it is only legitimate interest if it an implied component to a service I am directly requesting), and the general issue of popups illegally making rejection different from acceptance, intentionally making rejection slow, or even requiring payment to continue without cookies. And yes, the occasionally completely defective prompt.
I do agree that it would be neater if the browser handled this though. Would also be neater if the internet wasn't entirely sponsored by privacy violations. :/
Their name is "PostHog", a dirtbag left joke from years ago. If they were trying to make joyless scolds happy with their humor, their site would be very different.
People ranting against cookie banners and GDPR literally never read the regulation itself and they literally never read what these banners are supposed to trick you into
Here, EU is not quite doing the right thing: the web need "noscript/basic (x)html" compatibility more than cookie regulation. Being jailed into a whatng cartel web engine does much more harm than cookie tracking (and some could use a long cryptographic URL parameter anyway).
Basically, a web "site" would be a "noscript/basic (x)html)" portal, and a web "app" would require a whatng cartel web engine (geeko/webkit/blink).
I do remember clearly a few years back, I was able to buy on amazon with the lynx browser... yep basic HTML forms can do wonders.
Which it is?
I am from the EU and I don't see what this law has accomplished apart from making the WWW worse, especially on mobile.
I remember back when Opera was a paid browser, last century, it already have options to accept all cookies, refuse them, or set fine-grained preferences per website. No need for handling it at the website level if the client can do it.
You can argue that the law might not have improved things (at least not as much as intended), but nothing about this law has made the WWW worse. If you believe that, you've fallen for the concerted efforts of the advertising industry spreading misinformation about who's idea the annoying consent popups were & (like this website) perpetuating the myth that they're a legal requirement.
None of the new annoyances on the modern web that you're thinking about are mandated by EU law. It benefits the ad industry massively to scapegoat the EU for these annoyances.
It doesn't matter much what happened behind the scenes to cause that outcome. From a black-box perspective, it could be that
(a) the EU mandated the cookie banners, (b) the EU mandated to provide cookie settings in some generic form, and websites decided to use banners because it's easier, more lucrative, or even to put people against the EU, in spite of having other options that were better for the user. (c) the EU mandated a different thing and the annoying banners don't even comply with the law.
No matter what the case is, the fact is that the EU made the WWW worse with the law. Either due to an outright harmful law, or to a well-intentioned law with too many loopholes, or to a good law but lack of enforcement. Doesn't matter much for the end user. When you make laws that affect people's daily life, good intentions aren't enough.
You can reasonably argue that if the EU had not taken action to reduce advertising companies' ability to abuse customer rights, then advertising companies would not have retaliated, & therefore the web would be a less annoying experience. You cannot reasonably argue though that this is some isolated one-sided situation where ad companies are devoid of culpability.
Your entire comment essentially amounts to ignoring an elephant in the room to sell a narrative that one "side" bears 100% of responsibility for the outcome.
If your government passes some badly-designed regulations that cause a rat infestation, you can be as angry at the rats as you want, but that won't be very useful. If you want things to actually change, it's the government you need to complain against, not the rats.
The law should have been just a browser setting sites had to follow, making it a "banner" has made it meritless pestering while pretending it's for my own good and allowing the worst offenders to make convoluted UI to try and trick you every site visit.
Isn't it even simpler: Unless the cookie is used to track, you don't need the banner? For example, a cookie used to remember sort order would not require a cookie banner, I think.
(It's not about cookies. It's about tracking.)
I’ve created websites with a cookie banner “because it’s required” even though there were no cookies involved. The idea that every website needs a cookie banner is more hurtful than the cookie banners themself.
It's still stupid though as most of the sites I do absolutely still track certain activity, it's just done server side.
In other words, it's not actually legally required in their case, but it's practically required, because it lets everyone know that the absence of the banner is not a violation of the law.
Your "logic" is baffling
That is what I meant by "practically". I mean "in a practical sense" as opposed to in a theoretical sense.
This is how you minimize headaches and your legal bill. And on the day that people come after you for some unforeseeable tragedy or perhaps genuine wrongdoing (covered up by unscrupulous employees or less-than-honest vendors), you'll be better positioned to deflect legal repercussions and bad press.
The unnecessary cookie banner is a no-brainer: it costs you nothing and poses but a minimal irritant to users.
So, cookie banner it is.
Also, literally how the process works is, any citizen of an EU country files a complaint, and you’re suddenly at risk for millions in fines and have to prove compliance to an incompetent non-technical person to stop the inquiries.
It’s easier to throw up a banner, hence why most lawyers recommend this regardless of what you’re doing.
It literally doesn't work like that
> any citizen of an EU country files a complaint, and you’re suddenly at risk for millions in fines
Of course you're not at risk for millions of fines because that's not how the process works.
If the relevant agency gets off its ass and decides to actually work on the complaint (very highly unlikely, unfortunately), they will first contact you and ask you to remedy the situation within some time frame (usually quite generous).
If you don't do that, they contact you again and tell you you might be fined for not doing what you're asked.
The only way for you to risk millions is to repeatedly knowingly violate the regulation.
> It’s easier to throw up a banner, hence why most lawyers
Ah yes. The famously competent technical people, those lawyers.
For regulators in general doing dumb things? Lots and lots of examples all over the place. Talk to any small-business owners you know, get them drunk, and encourage them to rant. You'll hear some stories.
Individuals and other businesses have to complain to regulators about others not complying with the GDPR.
That literally does not happen. What world do you live in?
But just to entertain your scenario let's say that did happen: it still wouldn't matter because they could just reply and tell them why they don't need one...
Example: The identifier you get when you pass anti-bot challenges (Cloudflare, Anubis, etc).
Whatever mechanism they choose to uniquely identify you, they will insist it's necessary for another purpose and they totally are not piggybacking on it for tracking (e.g. for the CAPTCHA example, they would insist it's absolutely necessary to protect themselves from DDoS).
As another example, they can always respond with HTML where all links themselves are an opaque hash that internally contain "route + your id" when decrypted. Then emphasizing that all links are always different even for same routes to "show they are randomly generated", and saying that they do this because... idk, detecting scraping or something random but plausible-sounding. Or whatever sneaky variation of the `?PHPSESSID=` query param from old times.
(Yeah I know the last example doesn't a lot make sense, I didn't think too hard about it, the point is that they will probably find a way somehow.)
The annoyance of the cookie banners is the entire draw for companies. Its not a downside. They're user-hostile. You are their enemy. Their goal is to wear you down and trick you into opting-in, so they can both track with impunity and follow the law.
I know, that is why I am saying you would force them to respect Do_Not_Track by law.
The issue is some sites won't display any content without cookies, even if it's unnecessary. The amount of React-using sites that will load the entire page only to a second later to fully blank out since the JS couldn't set local storage does get annoying (and can regularly be worked around by disabling Javascript if not used for anything substantial). A handful like this have appeared just this past week on the HN front page.
They also embed Youtube if you open the demo, which in turn tracks users (yes, even through the no-cookie subdomain: https://dustinwhisman.com/writing/youtube-nocookie-com-will-...).
Ursula von der Leyen would not be very proud.
Or that this is their way of bragging that they don't use third-party cookies?
No, this is conflating "GDPR consent" and the ePrivacy Directive. According to ePD the banner must always be shown if the company providing the service is based in the EU
Where people who’ve never started a company or spoken to a lawyer about GDPR, the ePrivacy directive, the schrems rulings, etc but just emotionally love idea of what they think it represents (but actually doesn’t), debate with normal sane people.
All I can say is, I’m getting really tired of this one guys.