I had a discussion with my CFO about removing the cookie banner from our website (because we don't set any tracking cookies, and cookies for things like login are exempted) and he said "yeah, but it makes the site seem less legitimate.
Companies could stop selling and storing your data. They could only use cookies when absolutely essential. They could use lots of kinds of UX.
This is the equivalent of businesses who put a big visible "20% the state says we have to give our employees healthcare" fee on their bill to throw a hissy fit and hope customers get angry at the government for protecting them instead of the business for exploiting them.
As many have said before:
it's basically malicious compliance. They're supposed to be super annoying ... Instead of complying, they choose this obnoxious practice so they could continue ... monitoring every action a visitor does.
You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking. [1]
Regulators didn't enforce cookie banners. Cookie banners are a form of malicious compliance. When you complain about them, you are doing the lobbying work of ad companies for free. The correct solution is to just not spy on people, and the problem is that the EU didn't go far enough and just ban the behavior altogether. [2]
Cookie pops are malicious compliance to regulations that legitimately protect consumers. You’ve cherry picked one bad side effect to throw out all the ways the EU is way ahead of anyone else in protecting consumers [3]
We are just conditioned to see it without difference in basic tracking and tracking all your clicks across site and selling it to advertisers.
There's a reason you don't hear about people "maliciously complying" with HIPAA or PCI laws. Because that's just called compliance.
No excuses for poorly done EU regulations.
A comparison would be a store who was angry the law says you have to be 21 to buy alcohol and starts requesting everyone, even people not buying alcohol, to show ID or be kicked out. That's not a bad law, that's a bad business maliciously complying.
It's like those warnings in cigarettes packages saying they will kill you. I know cigarettes are bad, but the warnings also make me believe there's at least "some" control in how bad they are. Now if I buy one without the warnings, I will worry those in particular are extra-shady and likely to kill me even faster.
Oh how I miss those warnings. Nowadays the packages are covered in graphic body horror pictures. And there's no branding on them any more, just white text on a black background, so I have to carefully check that the illiterate teenagers at the store gives me the correct ones.
Do anyone else hear circus music?
When I see these dialogs listing they have 1289723 gazillion vendors they share data with, I know that whoever is in charge of analytics, privacy or both at the company is incompetent.
The obvious conclusion is that when you try to regulate something like this you arent going to get the behavior you want.
It's trivial to make a site that doesn't need a cookie banner: don't set any cookies. Modern web devs have probably forgotten, but this is actually the default behavior. Cookies don't get set unless you do something to make it happen.
And cookies that you actually need for functionality don't need a banner either. If you're setting a session cookie for logged in users so they stay logged in when navigating between pages, you don't need one.
Why, then, does practically every site in existence now have one? Because they set unnecessary cookies. Because they choose to set unnecessary cookies in order to track you for purposes that are not necessary to the actual functionality of the site.
Every single cookie banner you see is a big sign that says, "We value our ability to track you for marketing purposes more than we value your time."
Apparently they're willing to say that. I still see it as a win. No tracking and no banners would be ideal, but at least the regulation forces them to be honest and up front about what they're doing. I'd rather have tracking and cookie banners announcing it than tracking with zero indication of tracking.
They could have instead targeted it, and applied it, to third party ad providers only, like Google. And, btw, Google is big enough they could have just outright named it. They're worth as much as the GDP of Germany. Why not just make a Google law?
So yeah, maybe good intentions but it clearly shows the EU parliament is still too young and inexperienced.
And if you decide you need them, you can do them server side. That's not as good? Oh well. See above about want vs need.
Why not just make a Google law? Because Google is far from the only abuser. Using a VPN that routes through Europe is a real eye-opener. At least whatever country I got routed through apparently required that cookie banners include a list of every single partner who got your data. Pretty much every site had hundreds of them. One was literally over a thousand. No, the entire industry is rotten. And the epidemic of cookie banners just shows how rotten it is. They can't even be shamed into behaving.
I think it was something like Google knows what you eat, or will eat, for breakfast. Ok, Facebook too and some other trillion dollar companies. That is cross websites infrastructure, data mining, etc, etc - platforms in one word. Why not apply all this to the ones doing it though, instead of making all websites responsible?
In regards to analytics, the library needs to know what book you borrowed. Sure, a website doesn't 'need' in some platonic sense to know what article was most read today, but the EU parliament clearly does.
It is a hard problem though, what they were trying to address, but arguing that they were effective beyond showing that there is an EU jurisdiction is not at this point a persuasive argument.
It's fine though. This is still a very new parliament. It can and hopefully will learn from the experience and maybe even make an effective use of that very new EU jurisdiction, like maybe break up these tech monopolies, or try.
The only cookie is a functional one.
Most small business owner's I've spoken to are keenly aware they are only one bad lawsuit away of closing down. Almost no one care's about the cookie banner. Most just mindlessly click to allow cookies and go on with their life. There's almost no cost to having it.
Back in the day, this is how we introduced AWS at a large company. We just did it. And once done, they couldn't deny that it cost a fraction of what we were paying our supplier and that things took minutes to set up rather than weeks. And that they worked a lot better.
Yes, there was shouting in meeting rooms. And yes, people said "you can't do this". Turns out they were wrong. A few years later I mentioned this to Werner Vogels. During a meeting. Where my CEO and CTO were present. And where everyone was feeling very good about us being one of AWS' biggest customers in our region.
So when someone says "you can't do that", sometimes you should make them prove it.
(At the time AWS was a good idea. Today dependence on a US service provider is a harder sell in Europe. The _first_ question you get today is if we can host it ourselves if we need to or if we can use a local service provider.)
I have yet to head that cookie prompts are a sign of legitimacy. What business has customers that would think that way?
Although if you've ever worked retail, you'll know that plenty of customers are idiots.
Whatever "Surely no one is that stupid!" assumptions you make will be proven wrong no matter what you do.
One of the best indicators that something was not spam was the unsubscribe button.
E.g. "we don't set any tracking cookies, so we're already compliant with the law even without banner, so there's nothing to decline or agree to".
He may be right, sadly. I’ve seen the lack of a cookie banner used to suggest that a site was doing something shady or not complying with the law.
Most people don’t have knowledge about the finer details of cookie laws. They’ve been trained to believe that legitimate sites who comply with the laws will implement the cookie banner, and not seeing it feels suspiciously unprofessional.
So how would you do ePrivacy Directive compliance/risk avoidance in a non-obnoxious way?
Completely eliminates the need for a cookie permission bar.
If you want to remember dark mode with a cookie, then you can just gate that setting behind a “allow functional cookies” toggle.
Getting consent for functional cookies doesn’t have to be done with an intrusive cookie bar on landing. You can request consent as it becomes needed. There’s other ways of complying that aren’t dark patterns.
In any case here is a plain text interpretation from the EU (https://gdpr.eu/cookies/):
"Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.
Preferences cookies — Also known as “functionality cookies,” these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your user name and password are so you can automatically log in."
Farther down:
"To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:
Receive users’ consent before you use any cookies except strictly necessary cookies. ..."
So a preference cookie is categorized differently than "strictly necessary" by the ePrivacy rules predating, but now part of, GDPR. But elsewhere in this thread someone asserted that a cookie that is placed and the data never sent back to the server is exempt, so if you handle dark mode entirely client side you might be ok?
I'm beginning to understand why the lawyers in the EU just say "fuck it, put a banner up"
Google “lex especialis eprivacy GDPR”.
You are correct that people keep stating such things. But it is incorrect.
That example would be an essential cookie, also known as a strictly necessary cookie.
A shame this FUD is still being spread.
I suggest actually reading the GDPR if you think it applies to you. The EU put it up on a website for everyone to see. Here's the most relevant section: https://gdpr-info.eu/art-6-gdpr/
Notice how cookies are not mentioned, popups are not mentioned, and strictly necessary is not mentioned. Those are requirements the data harvesting industry invented out of whole cloth. They are not the actual requirements.
I'll just repeat that one more time: the GDPR does not mention cookies or popups. Let that sink in. It's all cargo-cult.
The GDPR also doesn't give a shit about dark mode preference. Literally nothing in it has any relevance to a dark mode preference, even (and especially) if you store it in a cookie.
In short: the GDPR doesn't mention it but it is covered by the ePrivacy directive/regulations which does cover cookies very specifically, and which is enforced through GDPR.
Have a good day.
What's more, if the 'cookie' is entirely local (i.e. it's never sent back to your own server, e.g. you're using the local storage API and the javascript on your page never puts that information into a request), like how this would normally be implemented nowadays, then these requirements don't apply at all (because a cookie according to the law is just something your server gives to the user's device and then the device gives back later).
b) Please don't re-implement OS/browser functionality in your website.
At least for GDPR...
The only ways to actually track without a consent pop-up are:
(1) stay off the device entirely and process server-transmitted data under legitimate interests with a privacy notice, or
(2) confine any device storage to what's strictly necessary for the service the user requested
in fact. you probably don’t need to track users.
It would be extremely beneficial to businesses to put a clause in their terms and conditions that limit damages to 1 cent in the event of any dispute. For obvious reasons we don't allow anything like that to be enforced.
I'm not saying whether tracking should or shouldn't exist, but "the business can make more money" is not a valid argument in my book.