Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the least obnoxious way to ask for cookie permissions?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 110 posts

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#41

Post by RobertRoberts »

bglazer wrote: post #10
starbugs wrote: post #4

The best thing one can do is not use cookies -> no need for a consent banner. If that's not an option, the next best thing is to have an overlay that is as honest as possible and most importantly provides not only an "Accept all", but also a "Reject all" button. Don't use dark patterns, basically. That is, use the same color, style and size for each of those buttons. My experience is that most users are so used to th…

Yes, if you put the “reject all”, button behind a “customize cookie settings” click, you’re a bad, anti-social person.

How would you save the "reject all" selection without using a cookie for that user's session?

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#42

Post by starbugs »

RobertRoberts wrote: post #41
bglazer wrote: post #10

Earlier quoted context omitted.

Yes, if you put the “reject all”, button behind a “customize cookie settings” click, you’re a bad, anti-social person.

How would you save the "reject all" selection without using a cookie for that user's session?

The cookie for saving the preference is technically required. Hence, it doesn't need consent.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#43

Post by ploum »

Pet_Ant wrote: post #32
YetAnotherNick wrote: post #29

Earlier quoted context omitted.

Except this is not the question. Why is it so hard for people to understand cookies are absolutely needed even if you just want to calculate retention or number of unique visitors.

> even if you just want to calculate retention or unique visitors. Why is it so hard to for people to understand that I just want you to serve me the page and bugger off? It's like justifying embedding GPS tracking in pamphlets that people hand out on the street. I don't want to be tracked period. Is it that hard?

Exactly. Is it your business to track people?

There’s 90% chance that no, it’s not your business. There’s also a lot of chances that your website is about a product. In which case, it doesn’t make sense to know how many people come and read. People only need the information to know "will I buy that or not?" or, even more frequently "I’ve bought that but I don’t understand something".

Tracking is counterproductive in most scenarios. (but very few understand that)

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#44

Post by btilly »

mnw21cam wrote: post #39

Make sure that if someone visits your web site with Javascript turned off, and that means that the cookies won't be used anyway, then they can still read the content without a non-functional cookie banner covering all the content up.

No JavaScript does nothing to reduce the use of server side cookies.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#45

Post by mnw21cam »

starbugs wrote: post #35
YetAnotherNick wrote: post #29

Earlier quoted context omitted.

Except this is not the question. Why is it so hard for people to understand cookies are absolutely needed even if you just want to calculate retention or number of unique visitors.

I'd like to point out that I answered the question even if not using cookies is not an option. But to elaborate a bit: At least in Germany (and I believe this applies more or less everywhere) if you install a 1st-party tracking method based on 1st-party cookies, that doesn't fall under the 3rd-party consent requirement and you don't need consent. That means you can track your valuable retention numbers and won't need…

If you're doing 1st-party tracking, and you are collecting personal data for that purpose (which is almost by definition going to be true), and the user hasn't explicitly asked for that tracking to take place (for instance by creating an account and logging in, or by putting items in a shopping basket and expecting them to be retained) then yes you will need to ask for consent to do that tracking.

The test isn't whether collecting that data is required to do your business - it is whether collecting that data is required to do what the user is asking you to do. So if (for example) you are tracking your users to see where they click in your web site in order to improve your web site, then that is only required for your business - your user has no interest in that, didn't ask for it, and therefore must be asked for consent for you to do it.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#46

Post by viraptor »

YetAnotherNick wrote: post #29
starbugs wrote: post #4

The best thing one can do is not use cookies -> no need for a consent banner. If that's not an option, the next best thing is to have an overlay that is as honest as possible and most importantly provides not only an "Accept all", but also a "Reject all" button. Don't use dark patterns, basically. That is, use the same color, style and size for each of those buttons. My experience is that most users are so used to th…

Except this is not the question. Why is it so hard for people to understand cookies are absolutely needed even if you just want to calculate retention or number of unique visitors.

You won't get precise numbers anyway - if you're large enough, adblock will kill even your first-party analytics. On the other hand, people with multiple devices will be undercounted. At that point, you may as well start counting access per IP and adjust for the known cgnat endpoints.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#47

Post by t0mas88 »

starbugs wrote: post #35
YetAnotherNick wrote: post #29

Earlier quoted context omitted.

Except this is not the question. Why is it so hard for people to understand cookies are absolutely needed even if you just want to calculate retention or number of unique visitors.

I'd like to point out that I answered the question even if not using cookies is not an option. But to elaborate a bit: At least in Germany (and I believe this applies more or less everywhere) if you install a 1st-party tracking method based on 1st-party cookies, that doesn't fall under the 3rd-party consent requirement and you don't need consent. That means you can track your valuable retention numbers and won't need…

This is completely false. You need permission for any data you store on a user device or retrieve from a user device if that is not strictly needed for the execution of the service the user requested. Nowhere in the law is the word "cookie" even used, so your suggestion that "1st party cookie" is different from "3rd party cookie" is wrong. And similarly, this whole thing also applies to all alternative tracking methods, so you cannot avoid it by using localStorage for example.

A 1st party tracking solution is in no way considered needed to deliver the service the user requested. Only things like remembering my shopping basked are necessary to deliver the services of a webshop. And you cannot use that cookie for other purposes (like counting visitors).

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#48

Post by viraptor »

ploum wrote: post #43
Pet_Ant wrote: post #32

Earlier quoted context omitted.

> even if you just want to calculate retention or unique visitors. Why is it so hard to for people to understand that I just want you to serve me the page and bugger off? It's like justifying embedding GPS tracking in pamphlets that people hand out on the street. I don't want to be tracked period. Is it that hard?

Exactly. Is it your business to track people? There’s 90% chance that no, it’s not your business. There’s also a lot of chances that your website is about a product. In which case, it doesn’t make sense to know how many people come and read. People only need the information to know "will I buy that or not?" or, even more frequently "I’ve bought that but I don’t understand something". Tracking is counterproductive in…

You don't need cookies for it, but it very much makes a difference how many people come and read. Optimising the visitor-to-buyer pipeline is an important job for retail. To even begin doing that, you need to know what percentage of visitors bought something.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#49

Post by mnw21cam »

btilly wrote: post #44
mnw21cam wrote: post #39

Make sure that if someone visits your web site with Javascript turned off, and that means that the cookies won't be used anyway, then they can still read the content without a non-functional cookie banner covering all the content up.

No JavaScript does nothing to reduce the use of server side cookies.

Agreed. I'd like to point out that the and in my post above should be viewed as a logical and, not an "and therefore".

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#50

Post by TrueDuality »

starbugs wrote: post #35
YetAnotherNick wrote: post #29

Earlier quoted context omitted.

Except this is not the question. Why is it so hard for people to understand cookies are absolutely needed even if you just want to calculate retention or number of unique visitors.

I'd like to point out that I answered the question even if not using cookies is not an option. But to elaborate a bit: At least in Germany (and I believe this applies more or less everywhere) if you install a 1st-party tracking method based on 1st-party cookies, that doesn't fall under the 3rd-party consent requirement and you don't need consent. That means you can track your valuable retention numbers and won't need…

Thank you. I have done so many implementations of GDPR. The cookie consent pop-ups everywhere are only needed because of how aggressive these third parties collect information (and that they _are_ third parties).

Just don't collect PII beyond was is absolutely essential for your application, and don't share it with third parties. Bam you don't have to get consent. Knowing what classifies as PII is still a hard problem because its full of so many conditionals. Email is not PII unless you have some part of their name for example and it counts if your company receives an email from that person that includes their name in the From field.

All the cookie banners out there are designed to make people weary of them into just accepting the previous practices. It's malicious compliance.

Post reply on HN