Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cookie policy notifications have ruined user experience on the web

reddit.com

Post reply on HN
Print view View original

51–60 of 87 posts

Re: Cookie policy notifications have ruined user experience on the web

#51

Post by pjc50 »

iKevinShah wrote: post #47
littlestymaar wrote: post #15

How ironic, websites have been breaking user experience for years by embedding always more trackers that took forever to load. If a publisher doesn't want to display a GDPR notification to its users there's a simple trick : just don't collect and monetize personal informations!

Even if we use cookies for basic sessions (absolutely no personal tracking, just session ID) - Isn't it mandatory to show "Cookie bar" on the said site?

No.

http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

(Perhaps surprisingly there is an exemption for "third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.")

Re: Cookie policy notifications have ruined user experience on the web

#52

Post by PeterisP »

sumeno wrote: post #39
Bartweiss wrote: post #38

Earlier quoted context omitted.

I'd be interested to know what percentage of sites would actually lose functionality. At a crude estimate, >90% of the sites that show me cookie warnings do everything I actually want them to statelessly. And I have some backup for that, because when I block cookies by default very few sites actually seem to get worse. Are there clever user-aiding tricks with cookies that I don't realize I'm losing? Or is the average…

Pretty much any site with a login is using cookies to do it

Sure, but I do not log in to the vast majority of the websites that I visit, and cookies aren't required for them to function properly unless I choose ('opt in') to log in.

Re: Cookie policy notifications have ruined user experience on the web

#53

Post by Retric »

iKevinShah wrote: post #47
littlestymaar wrote: post #15

How ironic, websites have been breaking user experience for years by embedding always more trackers that took forever to load. If a publisher doesn't want to display a GDPR notification to its users there's a simple trick : just don't collect and monetize personal informations!

Even if we use cookies for basic sessions (absolutely no personal tracking, just session ID) - Isn't it mandatory to show "Cookie bar" on the said site?

Generally no. It's when cookies can identify an individual that it's considered personal data.

Re: Cookie policy notifications have ruined user experience on the web

#54

Post by PeterisP »

joobus wrote: post #45
aarongray wrote: post #41

It would be cool if we could develop a protocol where users could flip a setting on their browser that tells every website they visit that the user has consciously, legally opted-in to all cookies. Heck, it would be cool to also have an option that says I accept all your Privacy Policies and Terms of Agreement, so don't show me any banners related to those either.

> a setting on their browser that tells every website they visit that the user has consciously, legally opted-in to all cookies IMO, you do this when you open the browser. Why does every website need to explain how the internet works?

Many websites legally need opt-in permission to put (and use) a tracking cookie, so unless the user intentionally chooses to do opt in, they're not legally permitted to do so even if the internet technologies enable them to make it happen.

There are many things that are technically easily possible, but prohibited unless certain nontechnical conditions are met. Tracking cookies is one of them.

Opening a browser doesn't constitute freely opting in to your specific use of data; at most it constitutes not opting out, but that's not legally sufficient.

Re: Cookie policy notifications have ruined user experience on the web

#56

Post by tremon »

fasteddie wrote: post #33
littlestymaar wrote: post #10

Earlier quoted context omitted.

You can't do geotargetting here, because to perform geotargetting you need the user consent to use his location (which is a personal data ;) ) if he is european.

This isn't true. You can use cookies for necessary operations of the website, which this almost certainly is. Also, country level location data isn't PII, and also doing a geoip lookup that you don't store anywhere also isn't in violation.

This isn't true either. If you're using an IP lookup to determine the user's current country, that's still processing PII (since many courts have already ruled that an IP address is unique enough to identify a person -- technical challenges notwithstanding).

However, you have a clear and stated use case for processing that PII so consent is not required, but you are required to mention this processing in your privacy policy. Not publishing this processing is (strictly speaking) a violation of the GDPR, but the processing itself isn't.

Re: Cookie policy notifications have ruined user experience on the web

#57

Post by closeparen »

Retric wrote: post #53
iKevinShah wrote: post #47

Earlier quoted context omitted.

Even if we use cookies for basic sessions (absolutely no personal tracking, just session ID) - Isn't it mandatory to show "Cookie bar" on the said site?

Generally no. It's when cookies can identify an individual that it's considered personal data.

How could a session ID not identify an individual?

EDIT: I see there is an explicit exemption for session cookies: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

Re: Cookie policy notifications have ruined user experience on the web

#58

Post by tremon »

pjc50 wrote: post #51
iKevinShah wrote: post #47

Earlier quoted context omitted.

Even if we use cookies for basic sessions (absolutely no personal tracking, just session ID) - Isn't it mandatory to show "Cookie bar" on the said site?

No. http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm (Perhaps surprisingly there is an exemption for "third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.")

The operative phrase in that last one is "for logged‑in members", because in that case the cookies fall under the earlier

provider of an information society service explicitly required by the user to provide that service.

For a user logged-in to a social network, the user clearly consents to the social network providing a service. Note that it is not allowed if the user is not logged in to the social network.

Re: Cookie policy notifications have ruined user experience on the web

#59

Post by Retric »

closeparen wrote: post #57
Retric wrote: post #53

Earlier quoted context omitted.

Generally no. It's when cookies can identify an individual that it's considered personal data.

How could a session ID not identify an individual? EDIT: I see there is an explicit exemption for session cookies: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

Laws operate differently than code. If nobody actually associates session info with anything outside the application then that's enough, if you do then it's a problem.

Think of it as a 3rd dimension of what's going on where you can retroactively change what you did to something else. http://ansuz.sooke.bc.ca/entry/23

Re: Cookie policy notifications have ruined user experience on the web

#60

Post by closeparen »

gruez wrote: post #14

We wouldn't be having this discussion if cookies were opt-in rather than opt-out. I don't sign into 90% of websites I visit, but why are all of them allowed to track me? If cookies were opt-in, then the legal issue of "consent" would be cleanly resolved, and the interface can be handled by the user agent rather than through obtrusive modals.

Cookies rely on the cooperation of the user-agent. From the website's perspective, they are opt-in.
Post reply on HN