Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

French watchdog fines Google, Amazon for breaching cookies rules

fr.reuters.com

Post reply on HN
Print view View original

131–140 of 144 posts

Re: French watchdog fines Google, Amazon for breaching cookies rules

#131

Post by cromulent »

Nextgrid wrote: post #73
dalbasal wrote: post #63

I have mixed feelings. On one hand, the data harvesting targeted by cookie laws and associated privacy stuff is important and legislators/regulators are right to target it. OTOH, effectiveness is pretty marginal. There have been some (minor) gains on disclosure. Somewhat better progress on data selling/sharing/security. But, no real gains on consent, which is a big part of the regulatory effort and this specific case…

> no real gains on consent, which is a big part of the regulatory effort and this specific case Consent is regulated under the GDPR and the majority of consent banners/popups you see today are not compliant. For example, the regulation explicitly mandates that pre-ticked checkboxes are not compliant and that it must be as easy to accept than to decline. According to the article, this fine is for a breach of the ePriv…

The interaction between the "cookie law" and GDPR is a bit complex, and maybe things will become clearer after a few court cases.

For example, the recent clarification said:

"The GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement (for example ‘opt-out boxes’)."

But of course that applies to PII, not all cookies, and so if you have generic analytics cookies that do not result in PII then this does not apply. I think.

https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

Re: French watchdog fines Google, Amazon for breaching cookies rules

#132

Post by throw_m239339 »

Snoddas wrote: post #33

OT, but I feel people who care about this perhaps knows the answer. Is there a browser that pretends to accepts all cookies but never saves them?

The law isn't really just about cookies. You could use local storage, indexed DB, WebSQL (RIP) whatever the law would still apply. Disabling browser storage will break everything single website on the internet that has a session mechanism. The alternative is to append a session ID to every single link on a page. consumer router admin pages often do that instead of using cookies.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#133

Post by marcosdumay »

Snoddas wrote: post #33

OT, but I feel people who care about this perhaps knows the answer. Is there a browser that pretends to accepts all cookies but never saves them?

Accept them for the session only (I guess all browsers have this option). As a bonus, this won't break every site (because yes, cookies are an important part of the web).

Firefox has some extensions for fine grained rules on cookies. After you get annoyed by things breaking because cookies don't live for long enough, you can install one and set a different lifetime for the ones you want.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#134

Post by h_anna_h »

Nextgrid wrote: post #71
jraph wrote: post #48

Earlier quoted context omitted.

> Could someone try standing with a sign saying "A reminder from me" in the google offices reception for 2 minutes and then walk out with whatever wasn't bolted down to see if they themselves consider that an adequate way to ask for consent? That would be hilarious. But I think they know what they are doing (i.e. using dark patterns). I've seen this banner, knew it was related to the RGPD but haven't figured out how…

> haven't figured out how to opt out and to not accept There doesn't seem to be an easy way. A lot of their proposed opt-outs rely on either disabling cookies browser-wide, installing an extension or creating/signing into an account and customizing your advertising preferences there (which means providing them even more info as part of the account creation and relying on their good faith to actually opt you out). To…

Even worse, if you have cookies disabled it will keep asking you for consent over and over even if you decline/accept.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#135

Post by josefx »

distances wrote: post #38
landerwust wrote: post #17

Earlier quoted context omitted.

Hrm fair point. I'm not sure DNT could have been repurposed to imply consent under much newer regulations, but you're generally right, this mechanism predated the EU regs and somehow was passed up.

"Somehow" is because there was nobody enforcing it, so nobody had any incentive to honor the request. Legislative approach is the only way to have an actual effect.

DNT was also intended to be an explicit opt out. However Internet Explorer enabled by default for three years, giving the industry an excuse to question its validity and ignore it. Privacy centric Microsoft or intentional sabotage?

Re: French watchdog fines Google, Amazon for breaching cookies rules

#136

Post by GordonS »

thepangolino wrote: post #45

I never understood why that EU regulation wasn't required at the browser level in the first place.

I really wish it was done in-browser - then we wouldn't have to deal with shitty UIs and dark patterns.

The DNT (Do Not Track) header was far too simplistic, and completely unrealistic.

I'm imagining having to specify a purpose when creating cookies, such as "session cookie", "advertising", "tracking", and then dealing with consent using a consistent, built-in browser mechanism.

Would be really interesting to flesh out this idea and get feedback, in the unlikely case that it hasn't been done before...

Re: French watchdog fines Google, Amazon for breaching cookies rules

#137

Post by mxmel »

h_anna_h wrote: post #134
Nextgrid wrote: post #71

Earlier quoted context omitted.

> haven't figured out how to opt out and to not accept There doesn't seem to be an easy way. A lot of their proposed opt-outs rely on either disabling cookies browser-wide, installing an extension or creating/signing into an account and customizing your advertising preferences there (which means providing them even more info as part of the account creation and relying on their good faith to actually opt you out). To…

Even worse, if you have cookies disabled it will keep asking you for consent over and over even if you decline/accept.

How are you supposed to track that someone has consented if you disable tracking? I’m assuming that declining means you can’t use any form of storage.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#138

Post by kevincox »

zinekeller wrote: post #89
BlueTemplar wrote: post #87

Earlier quoted context omitted.

Still, why isn't there a Web standard for this?

Attempts have been done on this, not once (P3P [1]), not twice (DNT [2]), but multiple times (several expired RFCs, GPC [3]). This sounds like the evil bit (RFC 3514 [4]) at this point. 1: https://en.wikipedia.org/wiki/P3P 2: https://en.wikipedia.org/wiki/Do_Not_Track 3: https://arstechnica.com/tech-policy/2020/10/coming-to-a-brow... 4: https://tools.ietf.org/html/rfc3514

The problem with these standards is that they the operators had little if any incentive to follow them.

Pairing one of these standard with laws would be a powerful solution with good UX.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#139

Post by Nextgrid »

mxmel wrote: post #137
h_anna_h wrote: post #134

Earlier quoted context omitted.

Even worse, if you have cookies disabled it will keep asking you for consent over and over even if you decline/accept.

How are you supposed to track that someone has consented if you disable tracking? I’m assuming that declining means you can’t use any form of storage.

Cookies for functional purposes are allowed without consent.

Re: French watchdog fines Google, Amazon for breaching cookies rules

#140

Post by jokoon »

SiempreViernes wrote: post #10

""" When a user visited the page google.fr, an information banner displayed at the bottom of the page, with the following note “Privacy reminder from Google”, in front of which were two buttons: “Remind me later” and “Access now”. This banner did not provide the user with any information regarding cookies that had however already been placed on his or her computer when arriving on the site. The information was also n…

There is no way to properly refuse those cookies.

I've worked hard to block the HTML div with ublock origin, but recently it's messing with the html, adding overflow:hidden at weird places. I've added a rule to fix it but it's not a silver bullet.

Youtube videos must be restarted because of the consent thing pauses the video or ask to sign in.

I'm wondering if I've been noticed by Googles ad engineers because they must have developed tools related to this rgpd thing.

On Facebook it's even worse.

To be honest it's a fun game of cat and mouse and I'm so happy to have Firefox, containers, strict mode, etc.

Post reply on HN