Live data from Hacker News

Automating cookie consent and GDPR violation detection

usenix.org

11–20 of 252 posts

Re: Automating cookie consent and GDPR violation detection

#11

I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.

I'd have a lot more patience with this law if it had come with an implementable w3c do-not-track-like signal sites could transparently operate on so it didn't wreck the UX for people who didn't care (or for that matter, people who did!).

(... which, unfortunately, I guess wasn't "do no track" since that pretty much failed, right?)

Re: Automating cookie consent and GDPR violation detection

#12

I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.

Dismissing cookie notices is just a sign of companies outsourcing the cost of being privacy friendly.

They could just run their own analytics tool and you wouldn't need any notice at all for basic visitor counting. But everybody is craving for that shiny numbers from Google Analytics (for mysterious reasons _perfectly_ integrated into all other Google tools), easy ad money and whatever metric marketing wants to see this month.

Re: Automating cookie consent and GDPR violation detection

#13

I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.

That's what browser extensions like Super Agent are good for.

And the fact that we need a browser extension to deal with such incredibly annoying and intrusive "functionality" that is required by law is just insane.

Re: Automating cookie consent and GDPR violation detection

#14

I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.

I wonder what is the GDP cost of millions if not billions of people flushing the toilet every day, often multiple times a day.

We can all make silly arguments, just because something requires you to take action, and it might cost money, doesn't mean we therefore have to just let late stage capitalism run wild.

Re: Automating cookie consent and GDPR violation detection

#16
Handy guide to GDPR for web developers:

* You can't set all your cookies first, then ask permission.

* You can't set all your cookies whether the user accepts them or not.

* You can't tell users to stop using the website if they don't want cookies.

* You can't convince any business owner to follow the above rules.

Re: Automating cookie consent and GDPR violation detection

#18
post #8

Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?

https://en.wikipedia.org/wiki/Desuetude

Three years later, randomly enforced and generally ignored: should GDPR-for-anonymous-browsing be regarded as obsolete by the EU's courts?

Re: Automating cookie consent and GDPR violation detection

#19
It's pretty well known that cookie-walls are rife with anti-consumer patterns. Going to something like formula1.com requires me to click more than a 100 times to object to the 'legitimate interests' of as many companies. Which is a pretty terrible anti-pattern when I don't want to be tracked at all...

After reading the abstract, it seems the authors try to classify cookies using a special browser extension called "CookieBlock" [1]. I hope they are successful, because I hate being tracked on the internet.

[1]https://github.com/dibollinger/CookieBlock

Re: Automating cookie consent and GDPR violation detection

#20

I doubt that very much. A lot of the indieweb sites don't bother collecting information about their users so they don't need to show information pop-ups nor worry about GDPR. I know I don't.

if your site is running on apache with default logging, or a shared host like DreamHost, you are probably not fully in compliance with the letter of the GDPR since you're logging IP addresses and aren't using them for necessary site operations.

... especially if the log just grows and grows and never rotates. The GDPR is a very wide-reaching law.

Of course, there's no real need to worry since, practically speaking, it was intended as a cudgel to beat FAANG with and not a dagger to stab indies with. If you're comfortable with the safety of your operations being "The folks with legal power to enforce won't wield it on you", you have nothing to worry about.

Post reply on HN