Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop whining about “The EU Cookie Policy” and improve your ways

social.wildeboer.net

Post reply on HN
Print view View original

101–110 of 272 posts

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#101

Post by friendzis »

olivierduval wrote: post #11

Actually it's a bit more complex (but not much) than what is described: 1st party may need user consent when they will use personal datas for something that is not the intended service (legitimate use). For example, for a shopping cart: cookies are necessary for the service, so no problem. For fraud detection : no problem because it's a legitimate use. But if you start tracking with a user cookie what pages your user…

While legitimate interest is one of possible exemptions to GDPR blanket ban, legitimate interest justification must be accompanied by a rights and freedom test.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#102

Post by Nextgrid »

wongarsu wrote: post #22
senttoschool wrote: post #2

The vast majority of people DO NOT care about cookies nor do they care about trackers. However, there is a very real productivity loss with all the cookie prompts - both trying to implement them, getting around them, and the billions of people who have to click on them every single day. We've got to come up with a better solution.

At least part of the intent of the law was that websites would reduce the amount of tracking if they have to explicitly ask for consent. You can build your website with just functional cookies (session cookie, storing preferences like dark mode, etc) and cookie-less tracking, and go without any cookie popups. Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the…

> Somehow the industry decided it's better to annoy your users with consent for 50 different trackers with the most in-your-face popup possible to cause users to reflexively hit consent instead.

GDPR actually has provisions against this kind of malicious compliance - the problem is a chronic lack of enforcement, despite it being trivial to detect with a web crawler.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#103

Post by olivierduval »

oneeyedpigeon wrote: post #87
pelorat wrote: post #67

Earlier quoted context omitted.

Why? Just store lists of bought product ids in its own database, then compute some statistics on it. Zero customer or user involvement is needed in that process.

So is that tracking or not? It's definitely storing personal information, so it feels like it counts, but surely the intent is for a self-contained order database to get a pass on this? Maybe not.

I think that it's a matter of implementation, because all you need really is the order correlation, not the user that passed the order. So

- if you keep a reference to specific user (like "your friend toto bought this") then you need consent

- if you keep a reference to "user category/generic profile" then it's anonymized so no need for consent

- if your profile is build on all the orders of your different users but without user informations, then it seem fine to me... because of anonymity

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#104

Post by raverbashing »

ActorNightly wrote: post #63

>So stop blaming "the EU" and ask yourself if this is the internet we want. ...Yes, thats exactly the internet "we" want. I don't get why it so hard to accept that people simply dgaf about privacy, and much prefer free products online paid for by ads. And there is nothing wrong with that, because for those that actually care about privacy, there are plenty of tools.

Ah yes, the "internet we want", where Ad geniuses will spam you for the same thing you just bought off Amazon and mobile sites turning your phone into a hand warmer with all the ad crap they have to load and all the 3rd party cookies they add

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#105

Post by gbalduzzi »

luckylion wrote: post #20
rapnie wrote: post #3

Earlier quoted context omitted.

The author states this: > To make this very clear: user/visitor consent is only needed for data going to 3rd parties. All cookie laws, including GDPR and CCPA, allow essential first-party cookies to be exempt from collecting user consent before performing their actions. So your session tracking cookie on your site DOES NOT need a consent popup AT ALL. Most consent dialogs can be avoided, were it not that the surveill…

Is he right though? I work with affiliate people a lot, and they hate cookie-consent popups. Even when you do all your analytics inhouse with self-hosted matomo, if you want to use a cookie, you need consent is what the lawyers say unanimously. And these aren't "we want you to ask for consent because we secretly want more privacy" lawyers, these are "I get paid to find a way for you to do your tracking in the easiest…

> Even when you do all your analytics inhouse with self-hosted matomo, if you want to use a cookie, you need consent is what the lawyers say unanimously

If you use a cookie for Matomo tracking than yes, you need consent. You are using a cookie for a non essential service (analytics), so you need to ask consent.

But you can use Matomo as cookieless: https://matomo.org/cookie-consent-banners/

If matomo gathers data without a cookie, you can still use technical / essential cookies without consent.

As an example Github.com, owned by Microsoft, does not have a cookie consent popup and sets at least 5 cookies as soon as you open it:

- color mode (dark / light)

- user timezone

- whether the user is logged or guest

- a session cookie

- _octo, that I don't understand.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#106

Post by Nextgrid »

jillesvangurp wrote: post #99

This is correct. Bad UX with modal popups and very ambiguous/deliberately vague verbose language designed to make you click some ok button are a choice not a legal requirement. Being deliberately obnoxious is of course a weird choice if you are trying to actually get people to engage with your website. The more obnoxious the UX, the less you should trust websites to do the right things when it comes to your privacy a…

Dark patterns aren't actually a valid approach of complying with the regulation - if you do that, you may as well just track and collect data without consent, because any consent obtained by misleading or annoying the user does not count as valid anyway.

Here's what the UK legislation has to say (which is still identical to the EU GDPR as far as I know, though subject to change post-Brexit): https://ico.org.uk/for-organisations/guide-to-data-protectio...

> Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent.

> Explicit consent requires a very clear and specific statement of consent.

> Keep your consent requests separate from other terms and conditions.

> Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough.

> Be clear and concise.

> Make it easy for people to withdraw consent and tell them how.

> Avoid making consent to processing a precondition of a service.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#107

Post by friendzis »

oneeyedpigeon wrote: post #87
pelorat wrote: post #67

Earlier quoted context omitted.

Why? Just store lists of bought product ids in its own database, then compute some statistics on it. Zero customer or user involvement is needed in that process.

So is that tracking or not? It's definitely storing personal information, so it feels like it counts, but surely the intent is for a self-contained order database to get a pass on this? Maybe not.

You don't need cookies for that

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#108

Post by scrollaway »

ActorNightly wrote: post #96
germanier wrote: post #78

Earlier quoted context omitted.

It's hard to accept because many, many people won't agree with you and do give a fuck.

To anyone that doesn't agree with me, please show me your rooted android phone that has no popular apps installed that collect any data, and doesn't use a sim card. Because if you say you give a fuck about privacy, and use a modern android phone with OEM rom or an iPhone, you either don't understand what privacy is and shouldn't be talking about it in the first place, or you are a hypocrite.

Someone can give a fuck about privacy in the areas they can, while not going overboard or trying too hard, you know. what you are describing is no true Scotsman nonsense. “You dgaf about privacy unless you wear a balaclava all the time”.

It’s also possible they understand the trade off with privacy wrt, say, google and their isps/mobile providers, versus the trade off with random websites on the internet.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#109

Post by mnw21cam »

Varqu wrote: post #88
ActorNightly wrote: post #63

>So stop blaming "the EU" and ask yourself if this is the internet we want. ...Yes, thats exactly the internet "we" want. I don't get why it so hard to accept that people simply dgaf about privacy, and much prefer free products online paid for by ads. And there is nothing wrong with that, because for those that actually care about privacy, there are plenty of tools.

I don't understand why it isn't solved in this way: You get a banner on your first visit, with a list "here are all the cookies and ways how we use your data, if you are not fine with it, please leave this website" This should be an option for small private websites (different rules for FB, Google and alike), because no one forces you to use a site, same as "my house, my rules"

Because that is very explicitly illegal. Consent to harvest personal data that isn't necessary for pure access to the site must not be used as a condition of access.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#110

Post by martin_a »

goodluckchuck wrote: post #54
mschuetz wrote: post #17

The problem is that GDPR doesn't go far enough. It should completely prohibit third party tracking without the possibility to agree to it. Third party cookies/tracking simply should not exist.

The problem is they picked the wrong parties to be responsible. It’s not the websites that are doing the tracking. The websites are merely asking to save a cookie. It is the users’ own web browser that is storing the cookie and sending the cookie back to these websites. It’s the browsers that should be regulated if anybody but it’s a lot easier to regulate the little guy than to regulate Google and apple.

Who integrated the tracking scripts and tools that want to set a cookie?

The "little guy" or the browser?

Post reply on HN