Hacker News Reader

Comment by rmunn | Hacker News Reader

What I mean is that if they don't add it, they're going to get threatening emails from regulators saying "Hey, you don't have a cookie banner". Those regulators don't have any way of knowing how their site operates, so the small banner at least manages to inform them and keep Posthog from receiving emails.

That is what I meant by "practically". I mean "in a practical sense" as opposed to in a theoretical sense.

View on HN

> they're going to get threatening emails from regulators saying "Hey, you don't have a cookie banner".

That literally does not happen. What world do you live in?

But just to entertain your scenario let's say that did happen: it still wouldn't matter because they could just reply and tell them why they don't need one...

They don't even have to reply, just make a note on your footer or something or have a page you can link to that explains it. I've done this before

What's your source for regulators sending emails to sites not having banners for essential cookies?

For that specific question, none; I'm extrapolating from past experience, mostly not mine but other people's (who told me stories).

For regulators in general doing dumb things? Lots and lots of examples all over the place. Talk to any small-business owners you know, get them drunk, and encourage them to rant. You'll hear some stories.

For that specific question, none. End.

So you don't believe in extrapolating from past experiences elsewhere? Good luck with that as you go through life. Personally, I don't do anything so formal as calculating Markov chains, but I certainly think that patterns of past behavior allow you to guess what other people are likely to do.

And they can reply back: "Hey, you're wrong".

Doesn’t usually go over well with regulators. If they have to prove their site is fully compliant in court it would become mighty expensive to do so.

So, cookie banner it is.

That's not how the process works.

GDPR has nothing to do with cookie banners first of all.

Also, literally how the process works is, any citizen of an EU country files a complaint, and you’re suddenly at risk for millions in fines and have to prove compliance to an incompetent non-technical person to stop the inquiries.

It’s easier to throw up a banner, hence why most lawyers recommend this regardless of what you’re doing.

> Also, literally how the process works is

It literally doesn't work like that

> any citizen of an EU country files a complaint, and you’re suddenly at risk for millions in fines

Of course you're not at risk for millions of fines because that's not how the process works.

If the relevant agency gets off its ass and decides to actually work on the complaint (very highly unlikely, unfortunately), they will first contact you and ask you to remedy the situation within some time frame (usually quite generous).

If you don't do that, they contact you again and tell you you might be fined for not doing what you're asked.

The only way for you to risk millions is to repeatedly knowingly violate the regulation.

> It’s easier to throw up a banner, hence why most lawyers

Ah yes. The famously competent technical people, those lawyers.

The same spine that makes companies say "No, I think we will keep our DE&I programs".

A cookie banner still doesn't prove compliance. You're still going to have to prove that you don't track users who didn't opt-in. A cookie banner doesn't help anything with that.

You famously do not have to prove that you're innocent in court. Prosecution has to prove that you're guilty.

So, this story is from people who heard things? I can guarantee you that regulators have zero time for proactively looking for MISSING cookie banners. If they had time, they'd crack down proactively on the cookie consent management systems used by thousands of websites that do not comply with the regulation, because they implement the reject option as a dark pattern. Furthermore, this weird fantasy request you just described can easily be dismissed by the website operators with a single sentence: We don't use cookies, hence no cookie banner.

Individuals and other businesses have to complain to regulators about others not complying with the GDPR.

Those regulators will need to study their own laws better then.

There's a general principal in regulated businesses that it's best to be above suspicion and below the radar at all times. You don't want to give regulators or opponents (such as competitors or advocacy groups) any ammunition.

This is how you minimize headaches and your legal bill. And on the day that people come after you for some unforeseeable tragedy or perhaps genuine wrongdoing (covered up by unscrupulous employees or less-than-honest vendors), you'll be better positioned to deflect legal repercussions and bad press.

The unnecessary cookie banner is a no-brainer: it costs you nothing and poses but a minimal irritant to users.

Reply on news.ycombinator.com