Fine them all! Europe will collect billions.
Automating cookie consent and GDPR violation detection
41–50 of 252 posts
Re: Automating cookie consent and GDPR violation detection
#42I run a website with a few hundred thousand monthly active users. I get tons of mails from users telling me how much they love it. One unintrusive, smallish Adsense banner pays for everything. For years now, everyone was happy.
Now Google sent me an email that they want me to gather user consent before showing Adsense. They offer an automatic consent modal. But the problem with that one is that it not only displays the consent modal but also injects a smaller widget into the site. It looks like the widget only pops up when the user scrolls down to the bottom of the page. Unfortunately, that also makes it pop up when the page is not longer than the screen. So pages where the content fits on the screen behave really really shitty. Maybe that is the reason why I have never seen it used anywhere.
And of course loading the consent script from Google before getting consent is not in line with GDPR in the first place.
Other consent solutions I see around the web are heavy third party widgets that do a lot of complicated stuff. And because they are third party scripts, they are also not in line with the GDPR.
I have not found any indie developers who have implemented their own consent solution. And as far as I understand it, Google has no communication channel. They just threaten to kick you off Adsense. So all I can do is implement my own solution and wait if it happens or not.
I started to implement my own consent banner now. Not sure if I will get it right so that it pleases Google.
I fear that this whole GDPR thing might be the end of my website.
Re: Automating cookie consent and GDPR violation detection
#43Given the amount of confusion and conflicting interpretations of GDPR we get on HN, I'm not really surprised. Then there's always the vocal minority that is fully convinced that GDPR is very simple and clear.
Re: Automating cookie consent and GDPR violation detection
#44Handy guide to GDPR for web developers: * You can't set all your cookies first, then ask permission. * You can't set all your cookies whether the user accepts them or not. * You can't tell users to stop using the website if they don't want cookies. * You can't convince any business owner to follow the above rules.
GDPR is about far more than just cookies. Once you get into it, the GDPR is extraordinarily vague. It obviously wasn't written by engineers or even people with domain experience. You can easily interpret common server-side logging operations as GDPR violations if you're not careful.
Seems a very patronising response. Personally, I have found the GDPR clear and well thought-out. Of course, there are some things that are annoying that you have to comply with like "IP addresses are personal data" but that is a problem with the web, not with the intention and implementation of GDPR.
Re: Automating cookie consent and GDPR violation detection
#45Earlier quoted context omitted.
> Did we consider that if everyone is breaking the law, the law itself might need a rework? Agreed - IMO, make cookie banners illegal and make 'minimum cookies' the default. Done?
What's the definition of minimum cookies?
For each cookie present, an independent third party expert would be willing to testify that the cookie is required in order for the website to operate as the user expects.
Re: Automating cookie consent and GDPR violation detection
#46It's pretty well known that cookie-walls are rife with anti-consumer patterns. Going to something like formula1.com requires me to click more than a 100 times to object to the 'legitimate interests' of as many companies. Which is a pretty terrible anti-pattern when I don't want to be tracked at all... After reading the abstract, it seems the authors try to classify cookies using a special browser extension called "Co…
TrustArc's consent popup disappears instantly on Accept All but shows a loading spinner for "up to several minutes" if you reject cookies. I emailed them about this (because in my experience it's only their software that implements such a dark pattern), they replied "customer misconfigured our software, not our fault" lol.
Re: Automating cookie consent and GDPR violation detection
#47Isn't every webserver that uses the standard access.log format (thus including IP address) already non-compliant?
No. You are allowed to keep such logs for a limited time in order to be able to analyze attacks on your web server.
Re: Automating cookie consent and GDPR violation detection
#48I wonder what is the GDP cost of millions if not billions of people dismissing a cookie pop-up every day, often multiple times a day.
Dismissing cookie notices is just a sign of companies outsourcing the cost of being privacy friendly. They could just run their own analytics tool and you wouldn't need any notice at all for basic visitor counting. But everybody is craving for that shiny numbers from Google Analytics (for mysterious reasons _perfectly_ integrated into all other Google tools), easy ad money and whatever metric marketing wants to see t…
Please don't make glib statements about what people do and don't want. If you don't want the metrics that you get from something like Google then that's fine but a lot of companies, ourselves included, find the insight massively valuable when we are trying to work out which parts of our product are or aren't working properly.
Sure, we could roll our own but that creates its own problems and doesn't exempt you from cookies notices at all.
Re: Automating cookie consent and GDPR violation detection
#49Isn't every webserver that uses the standard access.log format (thus including IP address) already non-compliant?
This is a very poor default, and I think it's a good thing that the legal environment challenges that default.
It's not automatically non-compliant, of course, but you might have to clear some legal hurdles to make it so.
Re: Automating cookie consent and GDPR violation detection
#50Oh the irony of this site itself having a "we use cookies, got it?" banner while lamenting this exact perceived lack of choice. I always laugh a little when I see those anyway, knowing that my browser's settings and privacy extensions are blocking the cookies and tracking connections either way. Did we consider that if everyone is breaking the law, the law itself might need a rework?
The law is fine. Great even. It is just that most websites don’t comply and developers misunderstand it. You can freely use cookies like we used to do, for session id’s, shopping carts etc. Once you add stuff to your shopping cart, you have a business relationship with the site, and they can store cookies necessary basic functionality. You can not use them to track users on third party sites, or store personally iden…
very much this.
I'm getting so tired of people implying the law is wrong just because sites still want to perform the tracking and data gathering it intends to limit.