Hacker News Reader

There are many examples, including "This product may contain traces of ..." and California's Prop 65: "This building contains substances known to the State of California to cause ..." It's required in some cases, but never forbidden, so one can avoid liability by just posting it everywhere, robbing it of its informative content.

While it's also about liability, there seem to be people deadly allergic to even small amounts of e.g. nuts. Those notices are shown when production machines are also shared used for other products and cleaning is never completely safe.

... and it's a heck of a lot cheaper to put a notice on the product than to make your peanut-free products in a cleanroom.

Yes but as soon as you use Google Analytics, you need to include the notice.

As a EU citizen, I think this example shows how stupid laws can come out of good intentions. Why stupid? Because, no matter what the intentions were, the only practical effect is creating a nuisance for web users, who quickly learn to ignore the consent requests.

I never understood why they didn't force the requirement onto browser makers instead of website operators. Then users could actually enforce their cookie choice by opting out, instead of having to trust every website to be honest in their cookie use.

And browsers have had such options (block all cookies, prompt to accept, etc.) built in to them since the very beginning of cookies, except everyone turned them off because they were annoying! So now websites had to add them! And they are just as annoying! ARGH!

A more useful directive would have been some sort of legally-backed "coloured cookie" type system, where a cookie has to declare for what purpose (session, internal analytics, adverts, site-to-site tracking, etc.) it's for, so browsers can then selectively block those categories. That would be useful, because then you could punish people who lie about the purpose of their cookie.

Sounds like the misguided P3P "standard" that IE implemented which AFAIK only resulted in web developers copypasting a HTTP header they don't understand just to get facebook widgets working.

I couldn't work out why people didn't just use the browser cookie controls. It seems shortsighted to force the server to bundle a message down the wire to me - the browser should tell me that. What if I am a dumb client like telnet that's just done a GET?

Do we also need servers to inform us in large letters that they're making a note of our IP address and adding it to their logs? That they're using our referral info and browser details (I'm using Chromium on a Mac!)? That they'll use those details for analysis? Weirdly people have switched to Google analytics instead of just looking at the server logs (like awstats from yesteryear). Do we need messages telling us that the ISP is throttling us or logging too? That I'm using PPP or something?

It's all daft. Hopefully this madness doesn't make it into mobile telephone calls - "your location can be triangulated from our phone towers"; "you're using GSM which has weak encryption and can be eavesdropped" etc. etc.

We should have the option of authorising all the GET requests it makes too I feel! That'd keep websites from loading too much (and suffering website bloat, as the average website data size has been climbing massively due to all that JavaScript)

Browsers already have the ability to block cookies and at least Firefox allows overriding the choice for individual sites without needing any plugins.

That much is obvious. It's a shame the lawmakers didn't go in that direction.

I don't think it's a nuisance - it tells me they are trying to run analytics on their site.

Except you still see it if you block the analytics ... :(

The execution could be better, but it is certainly not a stupid idea. GA code is esentially a concealed, unconditional transmit of the user data to a third party, and allowing this third party to intercept and modify your communication; pretty high price for a few colorful piecharts, and certainly something that deserves a disclaimer.

GA's Terms & Conditions make disclosing use of the product mandatory but this has to be the most widely ignored and unenforced rule I've ever seen.

If a lawyer somewhere figures out how to parlay this into a class-action/privacy issue (maybe Europe?) they are going to be filthy rich since this is so widespread. Even government websites use GA and fail to disclose it as required.

The worst part is, since I care enough about cookies and privacy that I set up my browsers to delete cookies on exit (minus a small whitelist for sites I prefer to stay logged on to), the sites displaying these notices can't even remember that I already dismissed the notice.

(assuming I'd only see the notice once if I'd keep my cookies, not actually sure if that would be the case, nor do I care to find out ...)

Well, that's pretty ironic I guess!

> Yes but as soon as you use Google Analytics, you need to include the notice.

Good. That's the entire point. The law is there to notify users when their web usage is being tracked, and that's precisely what Google Analytics is for.

So how do you feel about Piwik?

>> This thoughtless behaviour reminds me of the thousands of websites which include a "(c) YYYY" copyright notice in their footers, despite this being completely irrelevant in modern copyright law.

Yes, you are.

> A website — graphics, content, visual elements — is copyrighted at the time of development. So putting the copyright notice on the bottom of a site states that the material displayed is not to be used without permission of the owner. In fact, you don’t even need the notice to claim copyright; the law eliminated the requirement of public notice in 1989.

Source: http://www.sitepoint.com/what-it-means-to-copyright-a-websit...

This source covers only US copyright law, not EU copyright law, not UK copyright law, not Russian copyright law, not Canadian copyright law, etc.

Article 5(2) of the Berne Convention:[0]

"The enjoyment and the exercise of these rights shall not be subject to any formality"

[0] https://en.wikisource.org/wiki/Convention_for_the_Protection...

As I understand it (but I am no lawyer), it was only a requirement in the US until 1989. So if you are a company operating outside the US and none of your copyrighted material dates from before that, I don't see why you should include it. Also, for websites there are many more reliable methods of demonstrating the time of creation.

So for some it might have a use, but it seems to me that thousands of webmasters (including myself) have been copying this pre-1989 US-only best-practice, just because it is nice to have something to put it the footer :-)

The Copyright Office does suggest that it could still be a good idea, even though it's no longer required:

> Use of the notice may be important because it informs the public that the work is protected by copyright, identifies the copyright owner, and shows the year of first publication. Furthermore, in the event that a work is infringed, if a proper notice of copyright appears on the published copy or copies to which a defendant in a copyright infringement suit had access, then no weight shall be given to such a defendant’s interposi tion of a defense based on innocent infringement in mitigation of actual or statutory damages, except as provided in section 504(c)(2) of the copyright law. Innocent infringement occurs when the infringer did not realize that the work was protected.

(http://copyright.gov/circs/circ01.pdf)

It looks professional.

And it has the practical value of informing you than someone maintaining the site has at least looked at it within the last year or so.

Or had the forethought ten years ago to add:

;-)

You're supposed to put the year the material was copyrighted, not the current year.

Even if you use cookies legally without the cookie warning, there would still be the risk of getting a cease&desist or even a lawsuit from someone who does not understand the distinction and/or uses automated tools to find violating sites.

At least in Germany, sending such cease&desists is a lucrative business for many lawyers and organizations.

Seems like that's a problem with the legal system, not this law. Presumably the same thing happens with other poorly understood laws.

> directive isn't as dumb as many believe it to be,

I think directive is exactly as dumb as the effect it causes. Regardless of lawmakers intentions or even the letter of the law.

I agree that the general effect is still dumb, but I meant that the directive isn't as "technologically illiterate as many believe it to be".

I was pleasantly surprised that the legislators were aware of the necessity of cookies for login management. At least it allows me to keep my web app clean of this pollution...

It is very much technologically illiterate not to foresee this exact effect.

Sure, there are allowances for technically essential cookies but in practice almost everybody is using third-party services like Google Analytics. For a physical business with a brochure website, tracking how people use their site is more essential than any session cookie.

I'm not saying I necessarily disagree with the idea behind the law, rather that almost everybody uses cookies and making everybody announce that doesn't mean we're suddenly all informed.

An implicit /cookies/ or /cookies.html or even a domain-level TXT record would be just as informative, without clobbering user experience with a message that everybody is now blind to.

As others have said, copyright notices are as much about preventing infringement as they are anything else. Consider them similar to a "Thieves will be prosecuted" signs in shops.

With regard to the law, at least the UK interpretation, 'essential cookies' aren't ones that are essential for the website-operator's business purposes. The term is restricted to cookies that are essential for what the visitor has requested.

source: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

That's my point. Things that are so commonplace should be implicit.

I guess the legislators didn't think the general public was informed enough about cookies for them to meaningfully, implicitly consent. I don't think many people read the already mandatory privacy policies, so I'd have to agree. That the use of, say, 3rd party analytics cookies is so commonplace seems neither here nor there.

(For the record: I would prefer a technological, rather than legislative solution here.)

> This thoughtless behaviour reminds me of the thousands of websites which include a "(c) YYYY" copyright notice in their footers

https://www.youtube.com/watch?v=6x0cAzQ7PVs&t=6m45s (6:45–8:27)

TL;DW: "It's actually not there for legal reasons, [...] it's there as punctuation."

(No longer necessary for them, still a nice anecdote.)

I think the (C) YYYY notice is more for people who "forget" that items are copywritten automatically.

Maybe also as a point of naming the official institution responsible for that page

Not exactly. It has legal purposes - IANAL (and someone correct me if I'm wrong), but I believe it has to do with proving willful misuse (which matters somehow) and establishing a date of copyright. I believe that the idea is to put the earliest date of copyright, not the current year, which is a common practice.

Thanks for the find!