Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the least obnoxious way to ask for cookie permissions?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 110 posts

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#71

Post by sshine »

Least intrusive: Make it take up so little space that you don’t even need to close it, make the accept button green and the deny button red, and let there be no consequence if neither is clicked. Don’t make anyone aware of the ambiguity that not clicking it is neither consent or denial.

Pointing out this stuff forces you into the path of requiring that people click on it before being able to navigate the website, which is extremely intrusive, and makes all the marketing people insist that you apply dark patterns.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#72

Post by starbugs »

ploum wrote: post #70
YetAnotherNick wrote: post #58

Earlier quoted context omitted.

Europe's parliament website[1] uses cookie banner, even though its job is literally to just show information. If they want to track visitors any non trivial site would. [1]: https://www.europarl.europa.eu/portal/en

Which demonstrates exactly my point: web dev are now incapable of not tracking users even if it’s actually harming their business. I had an experience with a national meteo application including facebook trackers. I complained and they replied that they were totally unaware of that fact. The tracking was added by default by the contractor as part of his standard template. (note: they removed the tracking after my com…

> The sad part is that nobody in IT really complain nor tell them that it is creepy.

Which may be because if you do, you will typically be called the "technical person" who "doesn't understand anything about 'normal' users" and you should be more focused on your actual technical tasks.

Sorry for being cynical. I couldn't resist.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#73

Post by BrandoElFollito »

starbugs wrote: post #62
BrandoElFollito wrote: post #61

Earlier quoted context omitted.

One of the problems is that it is hardly possible to differentiate connections without gathering PII. Even an IP address is PII, your may be lucky with some fingerprinting, but this won't be unique.

A cookie used solely for counting anonymous visits without storing individual identifiers generally wouldn't be considered personally identifiable information under GDPR. At least that's what I was told. Having said that, this is obviously a complicated and nuanced topic with a lot of grey areas. I guess it's a good idea to talk to a lawyer in any case.

You are right that if this is just a unique identifier that gets into the cookie and you cannot link it to the actual user then it's fine.

My point was rather for non-cookie based kind of identification, but it was no clear enough.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#74

Post by nenaoki »

sigwinch28 wrote: post #9
foft wrote: post #8

Cookie permissions and EU advertising options should absolutely be built into the browser, it makes no sense for the user to have permissions on each site individually like this with a different system on each one. Then the user can centrally review what permissions they gave, revoke them etc. So no sites should have these kind of approval banners.

Perhaps some sort of Do-Not-Track HTTP header sent by the user’s browser

It'd be especially great for a hip and cool corporation with a burgeoning browser to automatically set that header all the time, helping ensure nobody actually listens to it.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#75

Post by culturedsystems »

TrueDuality wrote: post #55
t0mas88 wrote: post #47

Earlier quoted context omitted.

This is completely false. You need permission for any data you store on a user device or retrieve from a user device if that is not strictly needed for the execution of the service the user requested. Nowhere in the law is the word "cookie" even used, so your suggestion that "1st party cookie" is different from "3rd party cookie" is wrong. And similarly, this whole thing also applies to all alternative tracking metho…

This is what is false. You can use first party tracking using cookies, local storage, indexdb, whatever you like without consent as long as it is not tied to any PII and it is essential for _operating_ your service. Diagnostics, page views, flows through the app, even with a unique identifier for that session is fine and 100% acceptable for both GDPR and CCPA unless its shared with third-parties or tied directly to P…

The language in the UK version of the law is "strictly necessary for the provision of an information society service requested by the subscriber or user", which the ICO interprets as meaning "it must be essential to fulfil their request". I don't think tracking page views counts, because it's technically possible to serve a page without using a cookie to track that it was viewed.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#76

Post by muzani »

foft wrote: post #8

Cookie permissions and EU advertising options should absolutely be built into the browser, it makes no sense for the user to have permissions on each site individually like this with a different system on each one. Then the user can centrally review what permissions they gave, revoke them etc. So no sites should have these kind of approval banners.

That'll probably be the death of analytics. Nobody wants cookies, given the option.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#77

Post by aragonite »

There should be a big "X"-shaped button for simply dismissing the banner, deferring the answer to a later time. After all, if someone is visiting your website for the first time, they likely don't know your site well enough to know whether they want to accept or reject.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#78

Post by jacobsimon »

simonw wrote: post #25
jacobsimon wrote: post #16

Earlier quoted context omitted.

Can you explain how server side analytics works without cookies?

You log the IP address, referrer, user agent and the requested page URL but you don't set a unique cookie to identify the user. This still gets you plenty of actionable analytics information: where geographically people are located (via GeoIP), what pages are most popular, what platforms (including desktop vs mobile) people are using. I've been using https://plausible.io for analytics on a bunch of my sites for a cou…

Let’s say I want to know the conversion rate of my payment page. I need to know how many unique visitors viewed a page, and how many of them went on to complete a payment. I’m pretty sure this is not possible without a unique identifier. And if you are using (ip address, user agent) as a proxy for such an identifier, is that any better or legal than using a cookie in the first place?

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#79

Post by yjftsjthsd-h »

nenaoki wrote: post #74
sigwinch28 wrote: post #9

Earlier quoted context omitted.

Perhaps some sort of Do-Not-Track HTTP header sent by the user’s browser

It'd be especially great for a hip and cool corporation with a burgeoning browser to automatically set that header all the time, helping ensure nobody actually listens to it.

If the DNT header is absent by default, websites were happy to assume that it was okay to track users.

If the DNT header were set to "no" by default, websites would be happy to track users.

If the DNT header were set to "yes" by default, websites screamed bloody murder and pretended that it didn't represent user choice.

Re: Ask HN: What is the least obnoxious way to ask for cookie permissions?

#80

Post by pavas »

starbugs wrote: post #59
Pet_Ant wrote: post #32

Earlier quoted context omitted.

> even if you just want to calculate retention or unique visitors. Why is it so hard to for people to understand that I just want you to serve me the page and bugger off? It's like justifying embedding GPS tracking in pamphlets that people hand out on the street. I don't want to be tracked period. Is it that hard?

Your opinion is comprehensible from a user's standpoint. Once you have worked a while in business or marketing, you will see that it's not that easy unfortunately. There's a lot of pressure to provide certain numbers or at least to collect them "just to be sure". Typically this requirement comes without any willingness to invest money, because "you can just install Google Analytics for free". I don't want to justify…

> Once you have worked a while in business or marketing, you will see that it's not that easy unfortunately

Nobody is forcing anybody to do this, this is a personal and business decision to make more money at the expense of users' well-being. When you're surrounded by lots of people that think a certain way, you start to see it as acceptable and even good.

Though I know lots of people that disagree, I personally don't think it's justifiable. If someone finds it justifiable, they should take responsibility for it.

Post reply on HN