Stop whining about “The EU Cookie Policy” and improve your ways • Hacker News Board

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#71

Post by ginko » Fri, Apr 14, 2023, 10:04 AM UTC

veltas wrote: post #43

>Tech bros love to whine about "The EU cookie policy" that simply doesn't exist the way they imagine it. All these popups are the most radical way to interpret the explicit consent demanded by regulations when sending data to a 3rd party. An ongoing provocation by the ad/tracker industry to blame their ruthless data hoarding on the EU. The official EU website has one of these annoying pop-ups. Are they part of the pr…

That one's the pretty much the optimal implementation though.

* it's a small bar on the bottom

* the site works without clicking on the consent buttons

* it has clear "opt-in" or "opt-out" options

* no annoying "customize my permissions" sub-menu with tons of enabled switches and dark patterns

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#72

Post by harha » Fri, Apr 14, 2023, 10:04 AM UTC

oneeyedpigeon wrote: post #42

olivierduval wrote: post #11

Actually it's a bit more complex (but not much) than what is described: 1st party may need user consent when they will use personal datas for something that is not the intended service (legitimate use). For example, for a shopping cart: cookies are necessary for the service, so no problem. For fraud detection : no problem because it's a legitimate use. But if you start tracking with a user cookie what pages your user…

> if you start tracking with a user cookie what pages your users are viewing (statistics collection), then... you need the user consent What about if you're Amazon and you want to show 'people who bought this also bought this' content? Then the tracking is necessary.

What if you could only buy bundles of goods which are dynamically generated (and look like a basket to the user) and the seller just shows frequently purchased bundles or combines subsets of these? Curious where to draw the line.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#73

Post by goodluckchuck » Fri, Apr 14, 2023, 10:04 AM UTC

jeltz wrote: post #56

febeling wrote: post #45

This should have been solved technically, not politically. Why not set cookie rules in the browser settings, and handle at http standard level?

Because Google owns the largest browser. The problem could only be solved politically.

No, that proves the problem could not be solved politically, because regulators lacked the political power needed to regulate google

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#74

Post by Nextgrid » Fri, Apr 14, 2023, 10:05 AM UTC

oneeyedpigeon wrote: post #25

no_time wrote: post #13

Earlier quoted context omitted.

>We've got to come up with a better solution. I've got an easy one for you: stop embedding google analytics and others. You don't need a cookie banner when you only have operational ones or better yet, none at all.

Are you sure that out-of-the-box GA requires it? I thought the only info it recorded was anonymised.

Anonymization (if you actually believe Google despite their conflict of interest and previous GDPR breaches) still happens on their server, so the IP address (which counts as personal data) is still transmitted there.

I guess you may actually make it truly anonymous from a GDPR point of view if you proxy all calls through your own server and strip out anything that can be used to reidentify a user - so no IP addresses, session IDs, etc.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#75

Post by pdpi » Fri, Apr 14, 2023, 10:05 AM UTC

Circuitstorm513 wrote: post #57

olivierduval wrote: post #21

Earlier quoted context omitted.

As a side note: cookie management is just A PART of RGPD, that is based on personal information. So RGPD implies to inform the user about the ways their information is used, how it can be accessed, modified, deleted and so...

It's GDPR as in General Data Protection Regulation.

Given that OP's username starts with Olivier, I assume they're French. The French name is Règlement Général sur la Protection des Données. You just get used to your native language's abbreviations.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#76

Post by clnq » Fri, Apr 14, 2023, 10:05 AM UTC

no_time wrote: post #13

senttoschool wrote: post #2

The vast majority of people DO NOT care about cookies nor do they care about trackers. However, there is a very real productivity loss with all the cookie prompts - both trying to implement them, getting around them, and the billions of people who have to click on them every single day. We've got to come up with a better solution.

>We've got to come up with a better solution. I've got an easy one for you: stop embedding google analytics and others. You don't need a cookie banner when you only have operational ones or better yet, none at all.

You can have GDPR-compliant analytics, like what Fathom does.

I also built my own analytics solution that simply shows me my blog article reads per day, week, month, and year (that is all I care about). It's a simple bit of JS that sends a request to my endpoint when the user spends 30 seconds on a page with an article. I also do some light user agent filtering (no "curl" or "python" in the agent string, for example).

I might start logging the referrer in the future to see where my traffic is coming from. However, I am very far from needing cookies or a GDPR notice. I doubt there's a need for cookies at all for most analytics. Even if you wish to track user flow in your website, you can do it with IPs (or hashed IPs to not store the actual IPs) only. An IP is unlikely to change while a user is browsing the website.

It seems to my mind that we only see so many GDPR notices because many websites use dinosaur software like Google Analytics that hasn't been keeping up with the times.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#77

Post by pelorat » Fri, Apr 14, 2023, 10:05 AM UTC

veltas wrote: post #43

>Tech bros love to whine about "The EU cookie policy" that simply doesn't exist the way they imagine it. All these popups are the most radical way to interpret the explicit consent demanded by regulations when sending data to a 3rd party. An ongoing provocation by the ad/tracker industry to blame their ruthless data hoarding on the EU. The official EU website has one of these annoying pop-ups. Are they part of the pr…

If you click on "how we use cookies" you'll see the reason is 3rd party services outside of the control of the EU (like embedded YouTube) that they are using on some of their pages.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#78

Post by germanier » Fri, Apr 14, 2023, 10:06 AM UTC

ActorNightly wrote: post #63

>So stop blaming "the EU" and ask yourself if this is the internet we want. ...Yes, thats exactly the internet "we" want. I don't get why it so hard to accept that people simply dgaf about privacy, and much prefer free products online paid for by ads. And there is nothing wrong with that, because for those that actually care about privacy, there are plenty of tools.

It's hard to accept because many, many people won't agree with you and do give a fuck.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#79

Post by ActorNightly » Fri, Apr 14, 2023, 10:06 AM UTC

mschuetz wrote: post #17

The problem is that GDPR doesn't go far enough. It should completely prohibit third party tracking without the possibility to agree to it. Third party cookies/tracking simply should not exist.

Id be willing to bet that there is a large overlap of people who dislike tech company layoffs and people who have this sentiment about 3d party tracking.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#80

Post by matsemann » Fri, Apr 14, 2023, 10:06 AM UTC

febeling wrote: post #45

This should have been solved technically, not politically. Why not set cookie rules in the browser settings, and handle at http standard level?

How would the browser discern between legitimate 1st part cookies and illegal privacy violating ones? It's not a technical problem, it needs laws.

And for GDPR and other privacy rules, cookies aren't even a thing. The laws doesn't care about the medium you use. They apply beyond technicalities. For instance you could track IP addresses and a browser would have no way to stop you. GDPR makes it illegal without involving new crazy tech.