91–100 of 269 posts
Earlier quoted context omitted.
The proposal includes no JS at all, and will probably reduce the amount of JS because it replaces current cookie consent modals and banners.
It includes JS. See section "8. JavaScript-based interaction". I guess the idea is that just as you can control cookies both via HTTP headers and JS, you will be able to request consent both via HTTP headers and JS.
Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…
All this noise about cookie privacy, fingerprinting, FLoC, tracking, etc. --- what are the actual harms that make these things bad? Has anyone in the real world ever experienced a concrete harm arising from interest targeting? Doubtful.
The EU privacy regime imposes a heavy regulatory burden in exchange for nothing. Information is a non-rivalrous good. Further limiting its dissemination will increase friction all over the internet, impose new transaction costs on previously free interactions, and make the whole network less useful for everyone. And for what? Assuaging the paranoia of a tiny fragile and vocal minority of privacy activists? Sorry, but that's not worth breaking the internet.
I've done some basic reading on GDPR but can't honestly say I have it completely figured out. Can someone help me out with a use case that I come across frequently? Selling tracking data to third parties is the kind of thing noone wants to actually opt in to, and what I imagine GDPR partially tries to combat. (among other things) What about site statistics keeping? If say a newspaper collects statistics about visitor…
You don't need consent to store the IP in your server logs because that serves an undeniable legitimate interest for detecting abuse and diagnosing issues. However, you cannot use that information to generate statistics without consent.
As others said, gather as little as possible, for as short as possible, with a simple explanation and you should be golden. Lazy implementations (slapping Matomo on a server and calling it a day) do not comply with "as little as possible", and limitations in your tech stack ("we use cloudflare so we HAVE to use a cloudflare cookie") don't count either; it has to be as little as possible for the functionality to work, not for your developers to be comfortable.
Consult a professional for legal advice, but most websites don't strictly need consent popups. The advertisers do, and the marketeers want as much info as possible as well, but on a technical level, there's no need for most reasonable use cases to have a consent form. It all comes down to the bad decisions the website owners make.
I think it's disgusting that tracking has become the standard and opting out needs to be something special only some people can choose to do. Your comparison works for self-hosted monitoring (though I doubt a business that loudly proclaims, in text and audio so blind people can enter as well, that it tracks your ever move will get much business). However, most websites use third party trackers, so the comparison becomes closer to your own personal entourage if men in trenchcoats, following you around and occasionally writing something about you down.
Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…
As I understand it, the idea would be to make respecting these automatic signal mandatory in an update to the GDPR. See https://techcrunch.com/2021/06/14/europe-needs-to-back-brows... for some more context. Granted though that enforcement of the existing rules seems to be the biggest problem today.
The most frustrating thing about these cookie banners (more like cookie lightboxes) is that almost none of them are compliant with the rules. Unfortunately I don't have time to find the source right now, but I'm pretty sure I've read official EU guidance docs clearly stating that many "dark patterns" are simply illegal. For example making the "Accept all cookies" button require less effort than only accepting necessa…
It's EU, it varies by country. Each country takes the European GRPR law/guidelines and implements in on the national level. There may be slight differences. Your specific example where opting out must not cost more effort than opting in is specific to the UK GDPR implementation for instance.
The EU GDPR no longer applies in the UK because the UK is no longer a member of the EU. The EU GDPR has been incorporated into UK law (as the UK GDPR) but there's nothing preventing the UK Government varying it at any point in the future[2]
[1] - https://europa.eu/european-union/law/legal-acts_en
[2] - https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…
I don't see how this will be adopted without backing by legal threats. Even if this gets implemented on a voluntary basis, you need a fallback for browsers that don't support it. And if you need to have a version of the prompt with a user experience that isn't controlled by the browser, you might just as well use it to keep pushing the same dark patterns to everyone. Am I missing something?
Cookie banners works because they're everywhere and user has been trained to dismiss them as soon as possible. If this technology would get traction from major players, cookie banners will become an exception rather than norm. It means that users will be scared of those banners and might prefer to leave the website which will hurt the conversion. If this movement is not backed by major web players, probably nothing w…
All my friends and family just click the CTA, "accept", "I'm OK with that", "Mmm cookies yummy!"
The most frustrating thing about these cookie banners (more like cookie lightboxes) is that almost none of them are compliant with the rules. Unfortunately I don't have time to find the source right now, but I'm pretty sure I've read official EU guidance docs clearly stating that many "dark patterns" are simply illegal. For example making the "Accept all cookies" button require less effort than only accepting necessa…
At least in France, there's CNIL (Commission Nationale de l'Informatique et des Libertés) that started going after the top non-compliant websites and sending love letters like "you have N days to become compliant". [1] https://www.cnil.fr/en/home
Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…
But privacy laws are pointless and should be repealed. All this noise about cookie privacy, fingerprinting, FLoC, tracking, etc. --- what are the actual harms that make these things bad? Has anyone in the real world ever experienced a concrete harm arising from interest targeting? Doubtful. The EU privacy regime imposes a heavy regulatory burden in exchange for nothing. Information is a non-rivalrous good. Further li…
And this ability is currently asymmetric. While Big Tech and Big Govt knows nearly everything about everybody, ordinary citizens are denied data and transparency. And even if the data may be hypothetically available, its scale precludes analysis by anyone except highly funded groups.
Lack of privacy does translate to enormous soft power. It doesn't have to result in death, although the potential is there for that too. Democracy and individual liberty become meaningless except on paper.
I'm not sure that's what we want, in exchange for a few conveniences in the palm of our hands.