Hacker News Reader

This is one of the most stupid and anti-user laws on the books. Worse, it's probably the only law I've ever seen have an instant and devastating effect on the UX of a swathe of websites.

Hopefully they are going to start suing people regularly (unlike the inaction being taken in the UK) so that business wakes up to this stupid law and finally gets it repealed, the sooner the better.

The best balance would be to present the user with a page that lists all the things the site would like to track and let the user opt out of anything they don't want tracked.

Some people may value a "degraded" experience over being tracked.

I put "degraded" in quotes because it's often a degraded experience for the company's profits not the end-user.

Please, give us some examples of how this is "devastating" for the UX of a swathe of websites.

> The best balance would be to present the user with a page that lists all the things the site would like to track and let the user opt in to any way in which they would like to be tracked.

FTFY.

That's not a balance. That makes the cookies effectively unusable since 99% of people stick with defaults, and even more so in this case because they'll see the boilerplate so often that a spinal reflex will kick in before they even see the box with their conscious brain. This will, in turn force all websites to force users to accept the tracking in order to use the service.

Ok, better option.

Give the user four big buttons.

(1) "Deselect all tracking options. I will choose the ones I want" (2) "Select all tracking optimal user experience, but don't opt me into additional tracking metrics for your use" (3) "Opt me into all tracking options, both those for an optimal user experience and ones that help you improve the service." (4) "Give me the most commonly selected options by previously registered users"

(1) is privacy mode. (2) is privacy mode with some concessions for optimal experience. (3) is okay I'll help you guys out. and (4) is I trust the wisdom of the crowds.

Endless popups, pop downs, moving content around. The absolute worst is pages that create a 'popup' at the top and move the content down just as you're about to click something. So you end up clicking something else.

And for what!? To scare the user about cookies? We had the scare about cookies in the 90s when they were explained as "bits of code that websites can infect your machine with".

Cookies are ONE method websites can use to track you. If you click "don't use cookies", the website will just use another method to track you. It's absolutely trivial to bypass.

And it's trivial for any user to configure their browser to reject cookies for any website they wish to.

So what has been achieved by this idiotic law?

Absolutely nothing.

It's yet another fantastic demonstration why the EU is such a bad idea.

Cookies are just ONE method, that's why the law is not limited to cookies, but instead refers to all client side saving technologies (of which the cookies are the most common). Your post is yet another fantastic demonstration why criticizing the EU, without knowing what you're talking about, is such a bad idea.

I am by no means expert of particular EU laws, but as far as had been explained to me, the laws adopted in member states do not specifically point out cookies. They are more general. To simplify, they state that users should not be tracked without them consenting. The exact technology used is irrelevant.

I know precisely what I'm talking about.

Still, I guess I should have been clearer - there are several "non client side" saving technologies which are outside the scope of this law, and make the law completely useless.

Further though, I would criticise the EU whatever the content of this law. We do not need a law to enforce rules about a specific technology of HTTP. What the hell business is it of the EU?

The EU is absolutely obsessed with writing up laws to invade into absolutely every area of our lives.

> The EU is absolutely obsessed with writing up laws to invade into absolutely every area of our lives.

That is a funny way to frame it! Being European I, for one, welcome a government trying to protect me from the massive, for-profit, privacy invasion and user data trafficking that the internet business currently is.

And, as said before, the "cookie law" applies to any form of user tracking and storing or exchanging user-specific data. You can't code around it. Sending visitor data to Google Analytics server-side could technically hide the cookie, but it would legally be exactly the same as using the cookie based client-side javascript.

Up next, "large image law".

The internet is blighted by large images, which use up peoples valuable bandwidth. These should be opt in. Before giving the user a large image, a popup should display to ensure the user wants to download a large image.

Can you not see how crazy it is to start down this road?

I find it really annoying as a non-EU citizen using a site in a non-EU country but still having to dismiss these warnings even on mobile devices (where it can be much harder to hit the link/button).

The Internet doesn't care what country I'm from, so why are we designing it that way? The same goes for non-US content restrictions as well.

> The Internet doesn't care what country I'm from, so why are we designing it that way? The same goes for non-US content restrictions as well.

Because the two other options are either to have no laws around the internet, or to designate one organisation (or one country) to define and enforce laws.

I'll take the former, please.

No laws whatsoever? So someone can buy childporn.com and charge people for access?

I know issues like child safety are often used for over-reaching legislation that's bad for everybody, but that doesn't mean there aren't also valid reasons for governments to be involved here.

Just because the current implementation is often shitty, it doesn't mean we should go the exact opposite way. The same way that disliking things like anti-terrorism legislation don't make most of us think "we need to get rid of all laws".

Yes. No laws whatsoever online. Let it remain out in the open on the internet. A site like that has content that much be illegally made in real life. Real life is where the police should be enforcing the laws. Letting it exist out in the open would probably make their job of finding the people exploiting kids to create such content that much easier. Those sites aren't the real crime, they are the documentation of the crime. Allowing these the consumption to be out in the open, would probably reduce the stigmatization of such content to fall to the level where those doing the consuming can feel comfortable seeking help and therapy to overcome their vice. Hiding things away and criminalization of consumption just leads people to go longer and longer down their own dark personal rabbit hole without getting help.

If such sites existed, you could probably, at the country level, inject ads for free state-sponsored psychiatric therapy services for users.

AFAICT any thing that is illegal on the internet is usually also illegal in real life. Things that cause no real life damages have no reason to be illegal.

Child porn is already against the law. We don't need legislation that takes existing legislation and adds "..but on the internet" as it's generally ill-thought-out, "feel good" ineffective garbage. As the cookie law shows us.

Think of the children man... I wondered how long until I see this argument

In some limited cases it's a perfectly valid argument. I'm against most of the current internet legislation, and hate seeing children used as a reason for it, but that doesn't mean there aren't any good laws.

Take my specific example. If someone hosts a childporn.com that is exactly like any legal porn website but with children, should that be legal or illegal?

It should be illegal. And it is illegal. The point is that there doesn't need to be laws specifically designed for "... but on the Internet", because those laws already apply. The person putting content on that site is already breaking the law in his country, and if he's not breaking the law in his country then he's just not breaking the law.

"... but on the Internet" is becoming a digital version of the USA's "interstate commerce" clause [1]. Yes, the Internet crosses national borders, but as we see from Megaupload, it can be used by one nation to enforce their laws in another nation that may not have the same laws. Just because activity X is illegal in the US but legal in Germany does not mean there should be a law banning activity X ... but on the Internet. In areas where this should be enforcable, it's already illegal.

[1] Generally the Interstate Commerce Clause is used to regulate economic activity that affects trade between US states. Trade that stays in one US state is regulated at the state level, not the national level. Sometimes this clause can be used/abused to enforce laws the federal government wants enacted just by the government going out of their way to find a reason that an activity is affecting interstate commerce, see http://en.wikipedia.org/wiki/Wickard_v._Filburn

It's a perfectly valid argument. However it is being abused to the point where it is considered the root for every explanation. Yes, our children is the very first thing that we should protect but if you want it as a good argument, "think of the children" should start the discussion not end it.

For example, you want to tape everybody and then explain this away with "think of the children: we can catch child molesters this way". This argumentation works only for those who don't know any better. You take them for fools and thus you are not a good partner: you must have some ulterior motives.

Can it really be repealed by the Spanish government if they're required to enact such a law as a result of an EU Directive? They could take the UK's approach of turning a blind eye, but I tend to feel it's wrong for a country to pick and choose which laws to enforce.

Well this is the EU and countrys ignore or adjust EU directives to suit all the time - Spains implementation of TUPE is a total FY to the eu has no relation to the Spirit of the Directive.

Italy also does this a lot remember the you tube fiasco where they ignored EU law.

The EU is a set of treaties between sovereign states. The Parliament in each state supercedes the EU bodies (commission and parliament namely). So, yes they can repeal the law. It violates the treaty, and they'll be fined, but that's about it.

Can Spain even afford such a fine?

Afford? Yes. Willing, not really in this case. The fine is high enough to hurt, but low enough to be supportable if a country really wishes to violate the directive. Think of a ballpark in the order of 20 million euros per year (fines are paid until the directive gets transposed into national law).

A bit of fun about all this:

The local government site of my spanish country, uses even javascript to record your mouse clicks in US (and cookies without advise, of course), pixel based tracking in case you block javascript, and more on the same line...

And it has been said in their "opengob" sessions two years ago... and you know what? the local gov does not have any proceeding about their faults.

The same than we have known grabbers (with proceedings that always finish the same), as politics and monarchy, which in turn, control the lawyers and the public security we pay (in the figurative sense of the word).

It's not nice to be Spanish these days. A Spanish (writing from other country).

This is interesting. Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case?

My initial reaction is that this seems fair. The fine is substantial, but not deadly to an enterprise, so it would serve as a warning without being catastrophic for them.

I'm not a EU citizen - but presumably the EU's rather strict laws re: cookies derives from privacy and a desire not to be tracked at all. A user who has accepted Google cookies from other sites need not submit to the same tracking cookie on your site - but even if you delete the cookie aftewards, presumably Google Analytics has already captured the visit.

And there is, as far as I know, no way to remove that event from Google Analytics.

> Is it clear in the law that no cookies shall be set until the user has accepted the warning, or is that an open interpretation in this particular case?

This is a very liberal translation of the relevant part of the law[0]:

"Those who provide services will be allowed to use storage devices in remote computers, provided that the owners have given their consentment AFTER [my emphasis] they have been informed clearly and completely about the utilization of the private data".

[0]: http://noticias.juridicas.com/base_datos/Admin/l34-2002.t3.h..., article 22.2.

That sounds like technically the consent has to come after being informed, not the storage.

But they may only use the storage once consent has been given, which can only happen after a warning has been issued.

The two clauses seem to indicate that consent must be before storage, and warning before consent, hence there must be a warning /before/ the storage on the remote machine.

In either case, storing the cookie before consent, in the Google context, seems to run directly counter to the intent and spirit of the law.

I'm not big on technicalities. Normally I would put this in the "not a big deal" bucket, but in this case the specific cookies do not belong to the website itself. This means that you cannot retroactively "untrack" a user once they refuse your warning.

If this was just the website's own cookie, and if the cookie could be deleted and all tracking data would vanish from the site's own backend, then I'd be inclined to give it a pass.

"provided" means a condition.

so in parsed order: 1. informed. 2. consent. 3. storage.

"Provided that" as a condition does not imply any temporal order (in English at least).

Don't rely too much in my bad translation :)

Please also note that according to the post if the sites are hosted in third party platforms like Facebook, Tumblr, that install tracking cookies the owner of the site can still be sued, even if it's without his control.

In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued.

This is just Spanish law at it's best (I'm Spanish, too)

> In practical terms this means that any individual or business hosting having a Facebook profile page or blog on Tumblr could be sued.

This just says that they're responsible for the effects of the services they contract, in addition to acts they undertake directly.

Should a person building a bridge get out of the liability because they contracted out parts of the work? No.

Neither should the operator of a website because they opted to use services provided from a third party for part (or all) of their web services.

If you bought on an online store, an it used an insecure third-party payment provider which leaked your CC number all over the web, would you say the same?