Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the least obnoxious way to ask for cookie permissions?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 110 posts

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#101

Post by cm2012 »

kolinko wrote: post #5

I would ask them what is the absolute minimum required by law and to provide citations and the penalties for not applying it correctly. The last time I checked (a few years ago) most websites were doing a serious overkill with the banners, where the law didn't require it. Also, for certain companies the possible penalty for not having a banner was so low that it didn't make sense to have such banners at all.

You can see in this thread that 20 different HNers who are passionate about the subject and done implementation before have 20 different opinions on what the law actually does. So how can we expect random businesses to all be on the same page? And this is not years after GDPR started.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#102

Post by warrenm »

diffeomorphism wrote: post #40
snmx999 wrote: post #19

Earlier quoted context omitted.

Some of Germany's largest online newspapers, like Bild ( https://www.bild.de/ ) demand either that you subscribe to their online paper or consent to all cookies. As far as I see there is no way to reject the cookies.

Ruled illegal already for other websites: https://noyb.eu/de/pay-or-okay-tech-news-site-heisede-illega...

If that is true, why would any sane company/website stay based in the EU (if they want to use cookies)?

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#103

Post by starbugs »

culturedsystems wrote: post #75
TrueDuality wrote: post #55

Earlier quoted context omitted.

This is what is false. You can use first party tracking using cookies, local storage, indexdb, whatever you like without consent as long as it is not tied to any PII and it is essential for _operating_ your service. Diagnostics, page views, flows through the app, even with a unique identifier for that session is fine and 100% acceptable for both GDPR and CCPA unless its shared with third-parties or tied directly to P…

The language in the UK version of the law is "strictly necessary for the provision of an information society service requested by the subscriber or user", which the ICO interprets as meaning "it must be essential to fulfil their request". I don't think tracking page views counts, because it's technically possible to serve a page without using a cookie to track that it was viewed.

You might be referring to some other law than GDPR?

I was referring to the GDPR as pointed out in my comment.

There even is a GDPR recital that explicitly states:

"[...] The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

Source: https://gdpr-info.eu/recitals/no-47/

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#104

Post by starbugs »

pavas wrote: post #80
starbugs wrote: post #59

Earlier quoted context omitted.

Your opinion is comprehensible from a user's standpoint. Once you have worked a while in business or marketing, you will see that it's not that easy unfortunately. There's a lot of pressure to provide certain numbers or at least to collect them "just to be sure". Typically this requirement comes without any willingness to invest money, because "you can just install Google Analytics for free". I don't want to justify…

> Once you have worked a while in business or marketing, you will see that it's not that easy unfortunately Nobody is forcing anybody to do this, this is a personal and business decision to make more money at the expense of users' well-being. When you're surrounded by lots of people that think a certain way, you start to see it as acceptable and even good. Though I know lots of people that disagree, I personally don'…

> Nobody is forcing anybody to do this

Depends on how you define "force".

My experience is that the source of all this is the fear of having a substantial disadvantage against the competition and having to defend your decision of sustaining such a perceived disadvantage against the CEO/board. Understandable from my point of view, even though I don't like the outcome. This then usually trickles down the hierarchy in companies and, yes, someone will somehow implement it to earn their living. I'd define the implication of losing your livelihood as a consequence of not doing what you are told as force, but that is open to opinion I guess.

An anecdote that might be worth mentioning in this context:

I was once told by some CEO that they didn't hire a really qualified person, because that person had enough money to not be dependent on the job. This is, in my experience, an appropriate reflection of the role of money in controlling people's decisions. It's essential that you are dependent so that you can be forced to comply or risk losing your livelihood.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#105

Post by [deleted] »

mrgreenfur wrote: post #94
starbugs wrote: post #4

The best thing one can do is not use cookies -> no need for a consent banner. If that's not an option, the next best thing is to have an overlay that is as honest as possible and most importantly provides not only an "Accept all", but also a "Reject all" button. Don't use dark patterns, basically. That is, use the same color, style and size for each of those buttons. My experience is that most users are so used to th…

Actually not true, the regulation (eprivacy directive /pecr in uk) applies to all trackers including cookies, pixels, scripts,etc. if you can do with only “strictly necessary” across those then youre right. Also consider visitors are used to these prompts, without one they may wonder: does this site follow the law?

[deleted]

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#106

Post by diffeomorphism »

warrenm wrote: post #102
diffeomorphism wrote: post #40

Earlier quoted context omitted.

Ruled illegal already for other websites: https://noyb.eu/de/pay-or-okay-tech-news-site-heisede-illega...

If that is true, why would any sane company/website stay based in the EU (if they want to use cookies)?

Unrelated to where you are based. Also there is no restriction on cookies as such, just on spying. So defaulting to spying seems much less sane now, agreed.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#107

Post by carlosjobim »

viraptor wrote: post #48
ploum wrote: post #43

Earlier quoted context omitted.

Exactly. Is it your business to track people? There’s 90% chance that no, it’s not your business. There’s also a lot of chances that your website is about a product. In which case, it doesn’t make sense to know how many people come and read. People only need the information to know "will I buy that or not?" or, even more frequently "I’ve bought that but I don’t understand something". Tracking is counterproductive in…

You don't need cookies for it, but it very much makes a difference how many people come and read. Optimising the visitor-to-buyer pipeline is an important job for retail. To even begin doing that, you need to know what percentage of visitors bought something.

> you need to know what percentage of visitors bought something.

Why? What will you improve by knowing that, and why couldn't you improve that without knowing it?

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#108

Post by hansvm »

dcminter wrote: post #98
diffeomorphism wrote: post #15

Earlier quoted context omitted.

Also probably illegal. That part of the law is not yet enforced very much, but there have been a few rulings.

> Also probably illegal. Pretty clearly so. It seems weird to me that so many companies put up a cookie banner in order to avoid breaking the law, and then break the law in order to make it less effective. I suppose the win here is that if the (fairly toothless) regulators notice you can say "oh we thought this was enough" and then tweak it. But in that case why not just have no banner at all, and wait until they not…

> Just as daft as the extra-US sites that choose to show no content to EU geolocated origins instead of complying with the law. Which is... also illegal under the letter of the law

Since when? The GDPR explicitly only applies if you offer your shit to EU subjects or monitor EU subject behavior while they're in the EU. By actively rejecting those potential customers and not tracking them (because you refuse to provide them the product), does that not suffice to not have to worry about the rest of the terms?

I know there are a few cases regarding linking to news articles and how the company in question can't stop providing that service, but in all such cases I'm aware of the offending company had other ties to the EU whereby the GDPR might have been enforceable.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#109

Post by t0mas88 »

TrueDuality wrote: post #55
t0mas88 wrote: post #47

Earlier quoted context omitted.

This is completely false. You need permission for any data you store on a user device or retrieve from a user device if that is not strictly needed for the execution of the service the user requested. Nowhere in the law is the word "cookie" even used, so your suggestion that "1st party cookie" is different from "3rd party cookie" is wrong. And similarly, this whole thing also applies to all alternative tracking metho…

This is what is false. You can use first party tracking using cookies, local storage, indexdb, whatever you like without consent as long as it is not tied to any PII and it is essential for _operating_ your service. Diagnostics, page views, flows through the app, even with a unique identifier for that session is fine and 100% acceptable for both GDPR and CCPA unless its shared with third-parties or tied directly to P…

You're forgetting about the ePrivacy directive (or "cookielaw"). That has nothing to do with whether the information is identifying or not, you need permission for everything that isn't strictly necessary to deliver the service the user requested.

Analytics is not strictly necessary to deliver the service.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#110

Post by LinAGKar »

yjftsjthsd-h wrote: post #79
nenaoki wrote: post #74

Earlier quoted context omitted.

It'd be especially great for a hip and cool corporation with a burgeoning browser to automatically set that header all the time, helping ensure nobody actually listens to it.

If the DNT header is absent by default, websites were happy to assume that it was okay to track users. If the DNT header were set to "no" by default, websites would be happy to track users. If the DNT header were set to "yes" by default, websites screamed bloody murder and pretended that it didn't represent user choice.

Thus, it needs to be backed by regulation in order to actually work
Post reply on HN