Live data from Hacker News

People who press on cookie banners anything except “agree” – why do you do that?

news.ycombinator.com

231–240 of 265 posts

Re: People who press on cookie banners anything except “agree” – why do you do that?

#231
post #142

I still remember the day, when the browser would show you a pop-up "Allow somesite.com to set a cookie? Yes - No"... Something like that (with a "remember this choice" checkbox) would be so much more economical, than making every single website implement it individually. When the browser does it, then websites also can't ignore it, cheat it, or use dark patterns to avoid it.

The big misconception is that the consent forms are only about cookies. They aren't - they are about data collection and processing in general, no matter the technical means. It could be cookies, but it could be IP addresses, browser fingerprinting, or information you manually entered for a specific purpose (delivery address to receive a package) and don't want to be reused for other purposes such as marketing or tracking. None of that can be communicated at the browser level unless you want to have a gigantic spec that encodes every possible use of personal data imaginable.

Re: People who press on cookie banners anything except “agree” – why do you do that?

#232
post #177

The EU really should update the cookie law so that it applies to browsers, not sites. After all the browser's cooperation is needed to send cookies. This should be a mandatory standard part of the browser UI. Since there are just two browser engines in widespread consumer use, and the engines are made by two of the world's most valuable corporations (Google and Apple), requiring browsers to implement specific UI is b…

The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163

Re: People who press on cookie banners anything except “agree” – why do you do that?

#233

1. Sure. Though in my case this applies to both options, I'm not storing cookies for webpages I don't deliberately want to be remembered by. 2. If present I'll click 'Deny', but I'm not hunting it down. Blocking the prompt with an adblocker is my preferred option. 3. Cookie Autodelete is the only sensible way to manage cookies IMHO. Store cookies for webpages you trust, delete all others. Annoyingly there's no offici…

> Cookie banners are entirely pointless since I'm fully in control of which cookies I am sharing.

The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163

Re: People who press on cookie banners anything except “agree” – why do you do that?

#234

What if one uses an extension which blocks cookie banners? Does that mean not agreeing to any tracking? Since the extension hides the cookie banner it's effectively the same as ignoring it, not pushing any buttons (nor accept, nor reject), so it means the site is not allowed to track me, because I did not agree to anything, right?

Assuming it's implemented correctly, yes. The tracking should be opt-in, so by default none of it should happen until a positive opt-in is received from the user.

In practice, most are poorly implemented though so I wouldn't count on it. The solution is to lobby for proper GDPR enforcement and in the meantime defend yourself by using antimalware solutions such as uBlock Origin and blocking malicious domains/ASNs at the network level if you can (Facebook is entirely blocked on my network, so even if my blocker fails it won't be able to do anything).

Re: People who press on cookie banners anything except “agree” – why do you do that?

#235
post #27

Because I suspect it is legally binding and that it can be used in court. I'm not sure, but I think that companies can legally protect themselves if they have records of people clicking accept. They can still delete the data of people who don't click. Simple as that. It is a dark pattern, I think, especially when there is no refuse button.

It is against the GDPR if there's no refuse button. The problem is that the regulation has yet to be enforced anywhere near enough so websites can get away with this kind of malicious pseudo-compliance.

Re: People who press on cookie banners anything except “agree” – why do you do that?

#236
post #57

These banners have made me more aggressive about using DDG browser on phone. I do click “accept” because it’s the fastest path to read whatever article or view whatever picture I came to the site for, then use the DDG flamethrower to destroy everything. It’s a bit of a win-win because I get to read the site without having to figure out the site-specific cookie settings but the site also doesn’t get any of my data.

Many people here seem to forget that cookies aren't the only way to track, and fingerprinting a user is easy without having to use cookies (via UserAgent, IP, canvas data, and a myriad other techniques). Now, I wonder what does the GDPR and similar legislation say about those, but my uneducated guess is that a user accepting the site's policy regarding user data collection would approve the use of fingerprinting as w…

The GDPR indeed covers fingerprinting and anything data that can be used to identify someone - the idea that these consent forms are specifically about "cookies" is a lie that's being spread by stupidity or malice. See my other comment for more details: https://news.ycombinator.com/item?id=30964163

This is also why there is value in not clicking "accept" even if you already block cookies and/or run in private browsing mode.

Re: People who press on cookie banners anything except “agree” – why do you do that?

#237

Earlier quoted context omitted.

This is a good time to remind people that these prompts not only concern cookies (or even all cookies), but any form of non-essential visitor tracking. Some tracking methods will more effectively be able to track you across the boundaries of your "incognito" sessions. For example, the modern browser has a huge API surface that makes accurate finger printing using tuples of individually only moderately narrowing infor…

I use separate and fresh isolated firefox (running within podman container) to make fingerprinting a bit more difficult, it's still fingerprintable and probably this new fingerprint can be easily associated with the other but I like to imagine I make it more difficult to track me. Every little helps :)

A user-agent and IP address alone is enough to track you. The mere fact that you're using a browser with a single-digit marketshare is unique enough.

Re: People who press on cookie banners anything except “agree” – why do you do that?

#238

I use Brave in incognito modus and accept all your stinking cookies which will last for exactly the duration of my current browser session. My "serious" browser I use only for these "10" sites where I need state (authentication or preferences).

The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163

Re: People who press on cookie banners anything except “agree” – why do you do that?

#239
post #69

The EU needs to just ban non-authentication use of cookies and client side marketing data collection altogether. I can't stand those annoying prompts, something out of a hellish carnival.

Good news: prompts that make it easier to accept than decline, or make it confusing or use dark patterns are already illegal and don't actually comply with the GDPR.

Bad news: enforcement is nowhere near enough, so the problem remains. But when/if enforcement does finally pick up, this problem will be resolved.

Re: People who press on cookie banners anything except “agree” – why do you do that?

#240

I accept all of them, and my browser is set to clear all cookies and history when I close it. I also use an ad blocker. They may track me while I'm on their site, but not before or after so I don't really care.

The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163
Post reply on HN