Live data from Hacker News

Cookie policy notifications have ruined user experience on the web

reddit.com

31–40 of 87 posts

Re: Cookie policy notifications have ruined user experience on the web

#31

Do these notifications actually help with GDPR compliance or are they just a CYA for the websites?

IMHO not really, GDPR isn't really about (and thus can't be satisfied by) notifications and click-OK-to-continue "consent".

For the common use cases of data by random websites, there really are two common scenarios GDPR-wise:

1) Whatever you're (not) doing with the user data falls under one of the multiple GDPR valid reasons for use that do not require user consent: in this case a clear and informative description in an easily accessible privacy policy is sufficient, and the notification/"agreement" isn't needed for GDPR compliance, the popup is useless.

2) Whatever you want to do with user data requires user consent, but you're not going to get GDPR-valid (informed, specific, freely given and opt-in) consent. There are specific sites that can get meaningful consent because users really want it (e.g. genealogy sites come to mind), but for the random "we want to track you for advertising purposes and share it with 200 third parties", it's not realistic. And the popups don't (can't) help you with that. A popup that allows you to opt out... well, if it's not opt-in, the consent isn't valid in the first place; if the user goes "meh, whatever", then that doesn't count as opt-in consent. If the user is required to "agree" to continue, then that doesn't count as freely given consent. If the user isn't clearly told everything before they intentionally opt-in to every single use case because they want you to do that particular thing, then that doesn't count as specific, informed consent. If you do implement all these things properly, then most users aren't going to opt-in in the "ad-tracking" scenario (which is the GDPR intended result), so companies don't want to implement it properly.

So the nasty popup doesn't really grant you consent anyway (the process is inevitably missing at least one of these key criteria for valid consent), so GDPR-wise it's useless anyway.

Re: Cookie policy notifications have ruined user experience on the web

#32

Here is an idea: instead of a cookie policy notification, have a setting in the browser with the user's cookie setting. That way a website can look at that setting and store cookies or not.

You can already have your website check for the Do Not Track header, don't set non-essential cookies and don't show a notice when it's set. Basically no website does that.

Re: Cookie policy notifications have ruined user experience on the web

#33
post #7

I'm a really big fan of geotargeting these notices only to the EU. If the EU wants cookie notices, give the EU cookie notices. Don't give anyone else cookie notices, because they're garish and few people reasonably care.

You can't do geotargetting here, because to perform geotargetting you need the user consent to use his location (which is a personal data ;) ) if he is european.

This isn't true.

You can use cookies for necessary operations of the website, which this almost certainly is. Also, country level location data isn't PII, and also doing a geoip lookup that you don't store anywhere also isn't in violation.

Re: Cookie policy notifications have ruined user experience on the web

#34
post #14

We wouldn't be having this discussion if cookies were opt-in rather than opt-out. I don't sign into 90% of websites I visit, but why are all of them allowed to track me? If cookies were opt-in, then the legal issue of "consent" would be cleanly resolved, and the interface can be handled by the user agent rather than through obtrusive modals.

The problem is, the purpose of cookies isn't tracking, they're a hack to maintain state between requests for what's supposed to be a stateless protocol (and until HTML5 came along with session storage and local storage, they were the only way to do that in the browser.) So cookies are useful (and often used) for purposes besides tracking and advertising.

Having cookies be opt-in by default would just punish anyone using cookies for benign purposes.

Re: Cookie policy notifications have ruined user experience on the web

#35
post #12

Do these notifications actually help with GDPR compliance or are they just a CYA for the websites?

GDPR compliance requires opt-out, so cookie notifications are useless as far as compliance now. If you don't/can't comply, then you might as well not mention cookies at all - in both cases you're in breach of GDPR but at least you won't be ruining your UX.

GDPR compliance can not be done by opt-out, if consent is required, it requires opt-in - recital 32 (https://gdpr-info.eu/recitals/no-32/) "Consent should be given by a clear affirmative act [...]", "Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

No matter what your notifications and T&C says, the default UX path where the user clicks "meh, whatever, go on" until the popup disappears won't give the site any legal consent to use data because informed, specific, freely given opt-in consent didn't happen.

Re: Cookie policy notifications have ruined user experience on the web

#36
post #6

then there's reddit and its giant full page ad for the app before finally redirecting me to the content once i find the tiny link to continue instead of opening the app store... yes reddit and fb and gmail and the like are intentionally crippled when viewed on mobile. why? maybe because the data an app can suck up off your phone is much more valuable. no pesky same-origin policies! i digress :(

I noticed that reddit now has three separate "use our app" prompts, which don't seem to communicate so they can all appear on the same page. There's the loading-in system popup, the bottom-of-screen one, and the internal popup with a picture and two choices.

And then the bottom-bar one, instead of having two buttons, makes the entire field open the app store except for a tiny 'x' in the top right. Talk about unsubtle dark patterns.

Re: Cookie policy notifications have ruined user experience on the web

#37

How ironic, websites have been breaking user experience for years by embedding always more trackers that took forever to load. If a publisher doesn't want to display a GDPR notification to its users there's a simple trick : just don't collect and monetize personal informations!

Notifications should be for exceptions that require action.

Re: Cookie policy notifications have ruined user experience on the web

#38
post #34
post #14

We wouldn't be having this discussion if cookies were opt-in rather than opt-out. I don't sign into 90% of websites I visit, but why are all of them allowed to track me? If cookies were opt-in, then the legal issue of "consent" would be cleanly resolved, and the interface can be handled by the user agent rather than through obtrusive modals.

The problem is, the purpose of cookies isn't tracking, they're a hack to maintain state between requests for what's supposed to be a stateless protocol (and until HTML5 came along with session storage and local storage, they were the only way to do that in the browser.) So cookies are useful (and often used) for purposes besides tracking and advertising. Having cookies be opt-in by default would just punish anyone us…

I'd be interested to know what percentage of sites would actually lose functionality.

At a crude estimate, >90% of the sites that show me cookie warnings do everything I actually want them to statelessly. And I have some backup for that, because when I block cookies by default very few sites actually seem to get worse.

Are there clever user-aiding tricks with cookies that I don't realize I'm losing? Or is the average site with cookies purely for tracking and advertising?

(This is all a separate question from "should cookies be blocked by default"; I know a few uses really do suffer badly.)

Re: Cookie policy notifications have ruined user experience on the web

#39
post #34

Earlier quoted context omitted.

The problem is, the purpose of cookies isn't tracking, they're a hack to maintain state between requests for what's supposed to be a stateless protocol (and until HTML5 came along with session storage and local storage, they were the only way to do that in the browser.) So cookies are useful (and often used) for purposes besides tracking and advertising. Having cookies be opt-in by default would just punish anyone us…

I'd be interested to know what percentage of sites would actually lose functionality. At a crude estimate, >90% of the sites that show me cookie warnings do everything I actually want them to statelessly. And I have some backup for that, because when I block cookies by default very few sites actually seem to get worse. Are there clever user-aiding tricks with cookies that I don't realize I'm losing? Or is the average…

Pretty much any site with a login is using cookies to do it

Re: Cookie policy notifications have ruined user experience on the web

#40
post #39

Earlier quoted context omitted.

I'd be interested to know what percentage of sites would actually lose functionality. At a crude estimate, >90% of the sites that show me cookie warnings do everything I actually want them to statelessly. And I have some backup for that, because when I block cookies by default very few sites actually seem to get worse. Are there clever user-aiding tricks with cookies that I don't realize I'm losing? Or is the average…

Pretty much any site with a login is using cookies to do it

Sure but to create a login there is a transaction of consent.
Post reply on HN