71–80 of 127 posts
The burden being on the user to manage everything reminds me more of the dysfunctional US healthcare pricing system, where the uninsured have no negotiating power and are hit with absurd prices.
Earlier quoted context omitted.
It's not just cookies, it affects all client-side storage that can be used to track people. This means that this kind of API would also be needed for localStorage etc. This is where it things will get complicated. I don't know if it exists, but it would probably be a good thing to have aria labels for those common buttons on these popups. It would benefit a11y and pave the way for a better automatic approve/reject by…
It is not just client storage either, it could also be ephemereal computed fingerprinting with server side tracking.
>Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.
-- Article 5(3) of the Privacy and Electronic Communications Directive 2002
("Directive 95/46/EC" being the old Data Protection Directive, which has been replaced by the GDPR)
Earlier quoted context omitted.
There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it, since that would probably be considered over-reach: if Web sites want to break their UI and annoy their users, they're free to do so. Consent for personal data is implied when performing services for a user (e.g. logging in, shopping carts, remembering high-scores, etc.). Interactions are only neede…
> There is an interaction-free solution; it's called 'do not track' (as in, not tracking users). The EU don't mandate it If it's not mandated it's not a solution, it's more like a pacifist asking for peace in the middle of WWII > The EU don't mandate it, since that would probably be considered over-reach I don't think that's the reason, as it wouldn't be any more overeach than mandating the current cookie notice (or,…
That's not mandated. You need to notify the users about third parties getting their data and allow them to opt-out. The cookie notice is just a common, terrible implementation of that requirement.
> or, in another domain, USB-C for mobile phones
They didn't do that either. They forced the relevant companies to agree to a standard until next review and the agreement was USB-C. No specific solution was mandated.
Earlier quoted context omitted.
No he isn't. The law is precisely what allows the intentionally bad implementations. Anyone could have foreseen this. Hell we already knew this would happen based on the earlier cookie laws. The EU should have mandated an interaction-free solution like Do Not Track. They could have.
1. GDPR isn't just about cookies. It's about your data in general . So it covers even offline interactions. 2. Governments shouldn't mandate solutions . Instead, EU stipulated a requirement . And industry as a whole decided that they will break the law for as long as possible until the governments chase after them. In the process the industry has convinced gullible developers that it is the law that it is bad, and no…
They do all the time. USB-C is probably the most recent example but there are a gazillion standards that are mandated by governments. Electrical sockets, traffic signalling, seat belt design, etc.
It's not some weird outlier for them to say "you have to do it like this".
Cookie pop-ups are incredibly annoying and greatly harm the usability of the web. Either GDPR should be updated to ban consent pop-ups and simply make “REJECT” the default everywhere, or the consent UI should be moved to the browser where defaults (accept/reject/ask) can be set for all websites.
That is literally in the law. Article 7.3 https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
--- start quote, emphasis mine ---
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
--- end quote ---
Also, Recital 32: https://gdpr.eu/Recital-32-Conditions-for-consent
And also. GDPR isn't just about browsers or cookies. It's about data in general. Which includes all other situations, including offline interactions, gaming, and communication with governments.
Earlier quoted context omitted.
Analytics also require consent. There are some non-mainstream solution that promise that no consent is required, but you better make sure with a lawyer. Sadly, every marketing person and their dog insist on having analytics. Even more sadly, every product person is not capable on putting their foot down against an obviously bad cookie banner UX.
Fathom Analytics is quite fool proof. No cookies (hence no consent) required, completely anonymized data that still identifies unique visitors and provided valuable analytics.
"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ... "
So even Fathom, and other analytics tools that use browser fingerprinting or similar methods require consent.
And also, the whole no cookie, no consent -mantra does not respect user privacy. In some ways, browser fingerprinting is even worse because that's much harder for an average user to block than cookies.
Earlier quoted context omitted.
Fathom Analytics is quite fool proof. No cookies (hence no consent) required, completely anonymized data that still identifies unique visitors and provided valuable analytics.
Not true. Consent has nothing to do with cookies. If you look at what the ePrivacy Directive article 5.3. says, it's pretty clear: "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ... " So even Fathom, and…
There is a fuzzy line somewhere between access-logs and user-tracking.
Personally I think that at that point, one should just stop loading analytic scripts and stick to server-side access-log analytic toolg like goaccess.io.
The other thing, GDPR is not about cookies. The ePrivacy Directive regulates the use of cookies, but it's not about cookies either. Article 5.3. in the ePrivacy Directive says:
"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ..."
So whatever technology you use, you need consent to use web analytics tools. At least at the moment. A draft online suggests there might be a consent exception for audience measurement if the technology used complies with GDPR - again, this has nothing to do with cookies. The point is that the personal information collected, stored, and processed does not violate GDPR.
Another thing is that all the "GA is illegal" cases have nothing to do with cookies. It's about data transfers between the EU and the US and how Google handles the data. GDPR came into force in 2018, and we will see many more legal privacy cases in the future regarding the ePrivacy Directive. The bulletproof solution at the moment for any web analytics product is to ask for consent in the EU.
I've had talks with EU-based privacy gurus; some think everything is clear, and companies are mean just and reluctant to comply. But most of us agree that the messaging is done very poorly - what to do, how to comply etc.
And yes, giant consent banners break the UX. But at the same time, it's important to remember this data privacy regulation stuff is not about companies. It's about the users. And companies who build tracking tools shouldn't be motivated by the idea, "how can we ignore user consent?".
Earlier quoted context omitted.
Fathom Analytics is quite fool proof. No cookies (hence no consent) required, completely anonymized data that still identifies unique visitors and provided valuable analytics.
Not true. Consent has nothing to do with cookies. If you look at what the ePrivacy Directive article 5.3. says, it's pretty clear: "Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, ... " So even Fathom, and…
The claim is they save the web. I can’t be the only one that feels these banners are destroying the web experience.
There has to be a better way to improve privacy without simultaneously nuking user experience.