Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the least obnoxious way to ask for cookie permissions?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 110 posts

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#61

Post by BrandoElFollito »

starbugs wrote: post #53
mnw21cam wrote: post #45

Earlier quoted context omitted.

If you're doing 1st-party tracking, and you are collecting personal data for that purpose (which is almost by definition going to be true), and the user hasn't explicitly asked for that tracking to take place (for instance by creating an account and logging in, or by putting items in a shopping basket and expecting them to be retained) then yes you will need to ask for consent to do that tracking. The test isn't whet…

I was referring to the grey area of legitimate interest in the law and how I was briefed to interpret it ca. 2021. Things may have moved on and I am not a lawyer. You might be right and what the lawyers told me back then isn't true or was true and is no longer considered true. What I was basically saying is that 1st-party cookies are considered more likely to reflect a legitimate interest than 3rd-party cookies. And…

One of the problems is that it is hardly possible to differentiate connections without gathering PII.

Even an IP address is PII, your may be lucky with some fingerprinting, but this won't be unique.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#62

Post by starbugs »

BrandoElFollito wrote: post #61
starbugs wrote: post #53

Earlier quoted context omitted.

I was referring to the grey area of legitimate interest in the law and how I was briefed to interpret it ca. 2021. Things may have moved on and I am not a lawyer. You might be right and what the lawyers told me back then isn't true or was true and is no longer considered true. What I was basically saying is that 1st-party cookies are considered more likely to reflect a legitimate interest than 3rd-party cookies. And…

One of the problems is that it is hardly possible to differentiate connections without gathering PII. Even an IP address is PII, your may be lucky with some fingerprinting, but this won't be unique.

A cookie used solely for counting anonymous visits without storing individual identifiers generally wouldn't be considered personally identifiable information under GDPR.

At least that's what I was told. Having said that, this is obviously a complicated and nuanced topic with a lot of grey areas. I guess it's a good idea to talk to a lawyer in any case.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#63

Post by mnw21cam »

starbugs wrote: post #53
mnw21cam wrote: post #45

Earlier quoted context omitted.

If you're doing 1st-party tracking, and you are collecting personal data for that purpose (which is almost by definition going to be true), and the user hasn't explicitly asked for that tracking to take place (for instance by creating an account and logging in, or by putting items in a shopping basket and expecting them to be retained) then yes you will need to ask for consent to do that tracking. The test isn't whet…

I was referring to the grey area of legitimate interest in the law and how I was briefed to interpret it ca. 2021. Things may have moved on and I am not a lawyer. You might be right and what the lawyers told me back then isn't true or was true and is no longer considered true. What I was basically saying is that 1st-party cookies are considered more likely to reflect a legitimate interest than 3rd-party cookies. And…

IANAL too.

I'll certainly agree that this is an area where different opinions abound, and also you are much less likely to be prosecuted for this, so it's likely that advice would be that it's probably alright and you'll get away with it. But a strict interpretation of the law says that you can't use information gathered for a purpose for which the user didn't consent (or deliberately ask for, etc), even if you have it lying around because you collected it for a separate reason that is valid.

Regarding arguing that improving the user experience is a legitimate interest - I'm not aware of that having been argued and decided in court, but my opinion is that it is a hopeful misinterpretation of the law, and a slippery slope towards quite egregious data collection.

Yes, you can collect web site metrics without identifying information, for instance how many times are the different links on a particular page clicked on, but if you're linking one page request to another by the identity of the browser that is requesting them, then that is crossing the line.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#65

Post by warrenm »

mnw21cam wrote: post #36
warrenm wrote: post #3

Personally ... I think the best option (if you have to have cookies (and there are plenty of reasons you may want/need them)) is to have screen-wide, contrasting-color, short-top-to-bottom bar with a single OK or Accept button for dismissal Do not give people options about cookies - either they accept (and dismiss the notice), or they leave When I am presented with cookie options , I start to wonder why there are "un…

> Do not give people options about cookies - either they accept (and dismiss the notice), or they leave That's outright and explicitly illegal. (I just thought I'd make that point in a quicker and simpler way than the otherwise great sister post.)

It's not illegal at all

You're allowed to say, "we have cookies - you do not have to stay"

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#66

Post by [deleted] »

mnw21cam wrote: post #63
starbugs wrote: post #53

Earlier quoted context omitted.

I was referring to the grey area of legitimate interest in the law and how I was briefed to interpret it ca. 2021. Things may have moved on and I am not a lawyer. You might be right and what the lawyers told me back then isn't true or was true and is no longer considered true. What I was basically saying is that 1st-party cookies are considered more likely to reflect a legitimate interest than 3rd-party cookies. And…

IANAL too. I'll certainly agree that this is an area where different opinions abound, and also you are much less likely to be prosecuted for this, so it's likely that advice would be that it's probably alright and you'll get away with it. But a strict interpretation of the law says that you can't use information gathered for a purpose for which the user didn't consent (or deliberately ask for, etc), even if you have…

[deleted]

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#67

Post by warrenm »

IanCal wrote: post #26
warrenm wrote: post #3

Personally ... I think the best option (if you have to have cookies (and there are plenty of reasons you may want/need them)) is to have screen-wide, contrasting-color, short-top-to-bottom bar with a single OK or Accept button for dismissal Do not give people options about cookies - either they accept (and dismiss the notice), or they leave When I am presented with cookie options , I start to wonder why there are "un…

> When I am presented with cookie options, I start to wonder why there are "unnecessary" cookies present: why are you letting me accept "necessary" cookies or "all" cookies? Why would you have ones that are not needed? Seems hyper sketch ... and I'll go elsewhere (or reject all) Because some are required for the functioning of the site. They can justify dealing with those without you approving it. Some are there for…

I know why the others are there - but the fact that you have unnecessary cookies makes you look sketchy

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#68

Post by starbugs »

mnw21cam wrote: post #63
starbugs wrote: post #53

Earlier quoted context omitted.

I was referring to the grey area of legitimate interest in the law and how I was briefed to interpret it ca. 2021. Things may have moved on and I am not a lawyer. You might be right and what the lawyers told me back then isn't true or was true and is no longer considered true. What I was basically saying is that 1st-party cookies are considered more likely to reflect a legitimate interest than 3rd-party cookies. And…

IANAL too. I'll certainly agree that this is an area where different opinions abound, and also you are much less likely to be prosecuted for this, so it's likely that advice would be that it's probably alright and you'll get away with it. But a strict interpretation of the law says that you can't use information gathered for a purpose for which the user didn't consent (or deliberately ask for, etc), even if you have…

> [...] but if you're linking one page request to another by the identity of the browser that is requesting them, then that is crossing the line.

Just out of curiosity: That would be crossing a line, because it might be potentially possible to reconstruct an identity from the linked navigation pattern?

If so, I guess I would consider that beyond the realm of what any normal internet lawyer would include in their advice.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#69

Post by danaris »

warrenm wrote: post #65
mnw21cam wrote: post #36

Earlier quoted context omitted.

> Do not give people options about cookies - either they accept (and dismiss the notice), or they leave That's outright and explicitly illegal. (I just thought I'd make that point in a quicker and simpler way than the otherwise great sister post.)

It's not illegal at all You're allowed to say, "we have cookies - you do not have to stay"

Per the GDPR, you are not allowed to condition access to the website on acceptance of tracking.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#70

Post by ploum »

YetAnotherNick wrote: post #58
ploum wrote: post #43

Earlier quoted context omitted.

Exactly. Is it your business to track people? There’s 90% chance that no, it’s not your business. There’s also a lot of chances that your website is about a product. In which case, it doesn’t make sense to know how many people come and read. People only need the information to know "will I buy that or not?" or, even more frequently "I’ve bought that but I don’t understand something". Tracking is counterproductive in…

Europe's parliament website[1] uses cookie banner, even though its job is literally to just show information. If they want to track visitors any non trivial site would. [1]: https://www.europarl.europa.eu/portal/en

Which demonstrates exactly my point: web dev are now incapable of not tracking users even if it’s actually harming their business.

I had an experience with a national meteo application including facebook trackers. I complained and they replied that they were totally unaware of that fact. The tracking was added by default by the contractor as part of his standard template. (note: they removed the tracking after my complain).

But it is also about people in charge, who are completely addicts to statistics about the number of visitors and all information. People like to track others. They actually want that.

The sad part is that nobody in IT really complain nor tell them that it is creepy. We install blockers on our own computers and get over it, writing code that track those without blockers without batting an eye.

Post reply on HN