Hacker News Reader

Comment by watt | Hacker News Reader

Why can't sites just provide simple cookie-less browsing experience, turning off their cookie-based features? Instead of forcing this click-through just to show the article, they should just show what they can in read-only mode (without sending the cookie). This is such a misguided knee-jerk campaign from developers.

Cookies are NOT OK, I don't want to see them, and just show me the article (or page I originally came to view), thanks. And after I have viewed it, and if I decide to become a user of your site - then you will have my permission to use cookies.

The click through pages are the worst (like what www.games-workshop.com has). The pop-up/notification bar some news sites have (like bbc.co.uk) is somewhat acceptable, while obnoxious, as it allows you to read the content without accepting the cookies, and just go your merry way when your're done.

So this plug-in is going to auto-accept the cookies on your behalf. But why would you want to do this?

View on HN

Popular "read-only" sites need cookies. Take sites like NY Times or TMZ.

They need advertising revenue to pay for offices, people in those offices to write the content you want them to "just show", etc. Much of that potential revenue is locked up in advertising networks, and you need cookies to serve them on your site. Even if it were possible to sell out the ad space in-house, you need cookies to accurately track the delivery and results for the advertisers.

They need analytics to bring in the traffic that will view those ads. Especially for large publications, real-time analytics drive the decisions of what content to write, what content to expand, and what content to promote to the front page in order to maximize page views and thus ad views. They're decisions made minute-by-minute throughout the day. You need cookies to do that kind of analytics.

So while technically they can "just show you" the article you want without cookies, the practical implication is that the content you want them to show you wouldn't exist without cookies.

They do not need cookies for adverstising. In fact using cookies for advert networks is sorta what this law is aimed at. Be careful when using them.

Just because a business model currently relies on cookies, doesn't mean we should get rid of the privacy law. Maybe the business model should change. After all, if the business model required employees to work more than 13 hr shift (Working Time Directive), then tough, your business model needs changing.

They do need cookies for advertising. Have you ever sold online advertising before?

Current advertising networks use cookies for analytics and cross site profiling. While useful for advertisers it does have privacy implications and there is no, technical, reason why an advertising network could not serve advertisements without the 3rd party cookies.

It would be perfectly possible to serve ads without cookies (they work just fine if you disable cookies, after all).

However, none of the big advertising networks is going to let the additional value of tracking customer behavior and targeted advertising slip through their fingers.

That's not the same as "needing" cookies for advertising, though, and it is indeed what the directive was meant to put a stop to (among other things).

I presume you have never sold an online ad? While yes, you can technically do anything you'd like, in reality online advertising requires cookies.

I talked over a deal yesterday and like most online campaigns it included a frequency cap (in this case 1/24 for desktop and 2/24 for mobile). You cannot do a frequency cap without cookies. I could have instead tried to sell a static image or whatever you think would work, but that deal would not have gotten done. This was a CPM campaign, so let's forget that as a possibility. How would affiliate advertising work without cookies (hint: it doesn't). So that's out too. Let's try CPC. Perhaps you can do the leg-work for me and find someone willing to pay me per click for anonymous users that may or may not exist, but I have yet to find one.

This is all ignoring the fact that without cookies you have absolutely no idea how much inventory you have and what its profile looks like. Say you get 1M page views a month, but no advertiser in the world cares about that they want to know how many unique visit[ors] you get. A forum with 1M page views could have 10k members and be nearly worthless to advertisers, but a blog with 1M page views could be 500k unique visitors that are very desirable for advertisers. Without cookies you don't know and the result is you won't sell ads. It's very simple.

That's exactly my point? You do not technically need cookies to serve ads. You just find it highly desirable to do so. And yes, I am totally aware that ad networks have built their business models around having this information available and that the marketplace has been shaped by these business model. That still doesn't make them needed in a technical sense. If cookies had never existed, then we'd still have online advertising, just as we have advertising in other media that lack this form of feedback.

I think rmc is saying ads only require cookies because ad networks require them, but they're not absolutely necessary. Newspapers, magazines, billboards, TV ads, and other physical media don't have the equivalent of cookies and companies still pay to advertise that way. I don't know anything about advertising but I don't see why an online ad couldn't just consist of a jpg or text, a url and a contract between 2 parties. Obviously that type of ad wouldn't just be a JS snippet you drop into a page. I'm picturing a process like 1. Create some good content 2. Show it to an perspective advertiser with a 'Your Ad Here' placeholder 3. Agree to display an exclusive ad for a certain amount of time. The advertiser can check you're actually showing the ad however they do for physical media. They can also estimate it's effectiveness however they do for physical media. Obviously reputation would play a big role. If the content creator becomes popular enough advertisers will flock to them, if they're just starting out they'll have to solicit companies to sell advertising at a super low prices or give it away for a while. People would have to talk to each other, establish a little trust with each other and take a few monetary risks but isn't that what business is all about? The JS snippet ads could stay around too, but if this law spreads, which I hope it does NOT, it's going to annoy the hell out of people, a browser plugin is more annoying IMO, so that's not the solution. Again, I don't jack about advertising so I'm probably just being idealistic.

Print publications have circulation audits. TV has ratings. Cookies ad similar legitimacy for websites. It also enables much more in depth accountability which has created a massive new advertising market that could not exist without it (good luck with CPC without cookies). If the same could happen in print or broadcast it most definitely would be used.

Websites have ratings in all kinds of varieties and could have audits of some kind. Maybe the techniques for estimating ratings, audits and click-through without cookies can't be completely automated or 100% accurate, but so what, someone can make a business out of doing that well. Maybe website owners would have to start allowing ad companies to run some code on their servers, LOL. I'm sure cookie like strategies could happen in print and broadcast with extreme measures but it would be expensive and the privacy violations would likely be so glaringly obvious that no one would stand for it. Just because it's easy to do and hide on the web doesn't mean it should be done. CPC is just one business model, maybe it's not the only feasible one. I'm not saying I despise the current model or that I think that law is a good idea, I don't even care about privacy myself and I don't want to have to click more buttons than I have to, but many people do care and have no idea how deeply they're being tracked. Some think something should be done about that, enough to influence some governments. I'm sure there are a lot of historical failed attempts at other models but a lot has changed, I don't think it could hurt to at least consider implementing some other ideas, new and old. Not me of course, someone else.

If you don't want my cookie, feel free to not use my website which is provided to you free of charge (and ironically, if it was not free you would definitely need to accept the cookie). It does me no good to provide you a service when I can't monetize it.

I don't understand the sense of entitlement. The result is annoying, but that's because of the poorly thought out law. If you don't want annoyed, use this extension.

The law doesn't work that way.

If the law says "you must gain users consent before storing things on their computer", then "well if you don't like it, don't visit my site" is not an acceptable legal defence.

Of course, the point was no I will not let you access my content before you decide about a cookie. The OP finds having to make this decision to be annoying and thinks the site should just not set any cookies.

I guess if you are putting some service out there, you actually WANT people viewing your content/using the service. Way to antagonize your potential customers which such "my way or the highway" attitude!

And how do you feel about the 'Do not track' header?

What if the service comes with accepting a cookie? A potential "customer" that does not accept cookies is simply a waste of bandwidth.

Not a big fan of DNT, it relies on trust which prevents it from working when you want it to most. If you don't want tracked, don't accept cookies. If you can't use a service without cookies and are not happy using something like Incognito mode, stop using that service.

Why can't sites just provide simple $INSERT_ANYTHING_HERE experience

Because anything that adds features costs money. This is a non-issue for most website developers.

But why would you want to do this?

Because, pre-law, I (like many people) were happy to exchange a cookie for access to free content from virtually any website.

Accessibility is king.

I am somewhat upset that Rails sets a drive-by session cookie when I visit a site with no intention of logging in or doing anything.

Why?

There are other reasons to have sessions than to facilitate logging in (message flashing being a biggie for Rails, but it's also critical in things like A/B testing). What's the harm? If you don't want to play nice, don't accept the cookie. You will probably never know what you're missing.

Well my point is I guess there should be no cookie set for the read-only experience. Once you do something that requires tracking some state server-side, then the session cookie might be set. For example if you are searching, or you submit some data (that might trigger the message flashed), I guess the page where you perform said action could contain the cookie notice and notify user that to perform such stateful action user will need to accept the cookie.

For example, if you visit a web shop, you shouldn't need to get any cookies when viewing a product page. If you decide to put it into shopping cart - then you would consent to getting a cookie. But no sooner!

...unless there is an A/B test running.

That's a bizarre way to look at things. The good news is you can very easily make this your reality by changing a setting in your browser.

There are tons of reasons why "read-only" could make use of cookies. Here are a few, using your ecommerce example:

1) A/B test 2) General site analytics, to see how many unique visits your shop gets 3) More detailed conversion analytics to figure out things like the value of a visit, how long someone takes before making a purchase, knowing the origination of all conversions, etc. 4) Remembering viewed items so they can be promoted on a future visit 5) Displaying a "Welcome back" message to second time visitors

If you don't do these things you will be beaten by people that do. eCommerce might be the absolute worst example you could have come up with for situations where cookies are not needed.

Why do you set cookies on Celtic Knot Creator?

Those banners (in most cases) are not you turning on or off cookies. The bbc sets cookies immediately (they do allow you to unset some here http://www.bbc.co.uk/privacy/cookies/managing/cookie-setting...), but you already have a session cookie that will last 4 years once the page is loaded.

Most sites will state they are assuming consent based on your continued usage of the site.

That's oversimplifying things a little.

Say I build a website and fill it with content you want to see. I'd run Google Analytics to track popular content etc.

You're saying my default choice is to no longer have analytics on my site at all?

Agreed, all these other solutions are rubbish. But your solution isn't a good solution either.

Note that (at least in The Netherlands) the cookie law does allow you to use Google Analytics for measuring anonymized user statistics, without asking a visitor to accept cookies.

(In Dutch http://www.nu.nl/internet/2987889/cookiewet-versoepeld.html)

Reply on news.ycombinator.com