Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop whining about “The EU Cookie Policy” and improve your ways

social.wildeboer.net

Post reply on HN
Print view View original

221–230 of 272 posts

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#221

Post by ericb »

friendzis wrote: post #211
Myrmornis wrote: post #146

Earlier quoted context omitted.

Aren't you failing to account for the following? In theory, website owners could do as GitHub did and remove inessential cookies and get rid of annoying banners: https://github.blog/2020-12-17-no-cookie-for-you/ But in practice, website owners are worried about breaking laws and aren't experts and just follow what they see everyone else doing, and so put up banners. So in practice, the regulations are indeed the ulti…

> But in practice, website owners are worried about breaking laws That is weird argument. If one genuinely cannot bother to read the law or does not feel capable of fully comprehending the law why don't they simply consult a lawyer? Hiring professional accountants is somehow standard practice.

> why don't they simply consult a lawyer?

Sure. Are you offering to pay?

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#222

Post by mariusor »

luckylion wrote: post #204
mariusor wrote: post #199

Earlier quoted context omitted.

After navigating for a couple of pages in incognito (without clicking on any option on the banner) I see two cookies set: one which I suspect tracks if I accepted cookies or not, and one that tracks the fact that I closed the EU/European Commission survey. I'm not sure what you're seeing, or if you're thinking that these two are not OK to be set.

Pure chromium private window, zero interaction with the page, first load, they're all set via JS. _pk_ses.c9513597-70e6-4b84-80c5-36f9dddf8c7c.9f33: * (Expires 2023-04-14T11:55:32.000Z) _pk_id.c9513597-70e6-4b84-80c5-36f9dddf8c7c.9f33: 067c09531fc49591.1681471532.1.1681471532.1681471532. (Expires 2024-05-11T11:25:32.000Z) cck1: %7B%22cm%22%3Afalse%2C%22all1st%22%3Afalse%2C%22closed%22%3Afalse%7D (Expires 2023-10-11T1…

I was in Ff and I only got the last.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#223

Post by herbstein »

mnw21cam wrote: post #128
GranularRecipe wrote: post #89

> "To make this very clear: user/visitor consent is only needed for data going to 3rd parties." I think this statement is categorically false. Art. 6 GDPR ( https://gdpr-info.eu/art-6-gdpr/ ) lists exhausively the reasons for lawful processing of personal data which applies not only to cookies, but also IP addresses etc. The "cookie consent" addresses Art. 6 Point 1(a). Whether third-parties (data processors) are inv…

Agreed. It isn't the third party that is the issue - it is the separate purpose. For example, if I access a web page, I'm giving my IP address to the server, so that it knows how to sent the data I just asked for back. That IP address is personal information, but it is necessary for the server to fulfil the purpose of the task I just asked for. That server also gives the IP address to a third party - the router in be…

> However, if the company running the web page were to take that IP address and store it and use it for deep analytics

Or, in fact, sending off to Google Fonts. As a German court case reveals, that is considered sending the IP to Google -- breaking GDPR since it is done without consent on first launch of the site.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#224

Post by scarface74 »

friendzis wrote: post #211
Myrmornis wrote: post #146

Earlier quoted context omitted.

Aren't you failing to account for the following? In theory, website owners could do as GitHub did and remove inessential cookies and get rid of annoying banners: https://github.blog/2020-12-17-no-cookie-for-you/ But in practice, website owners are worried about breaking laws and aren't experts and just follow what they see everyone else doing, and so put up banners. So in practice, the regulations are indeed the ulti…

> But in practice, website owners are worried about breaking laws That is weird argument. If one genuinely cannot bother to read the law or does not feel capable of fully comprehending the law why don't they simply consult a lawyer? Hiring professional accountants is somehow standard practice.

Yes because reading and interpreting an 11 chapter 99 section law is really simple…

So now every website owner should have to consult a lawyer who his technical enough to understand the intricacies of the law?

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#225

Post by olivierduval »

scarface74 wrote: post #224
friendzis wrote: post #211

Earlier quoted context omitted.

> But in practice, website owners are worried about breaking laws That is weird argument. If one genuinely cannot bother to read the law or does not feel capable of fully comprehending the law why don't they simply consult a lawyer? Hiring professional accountants is somehow standard practice.

Yes because reading and interpreting an 11 chapter 99 section law is really simple… So now every website owner should have to consult a lawyer who his technical enough to understand the intricacies of the law?

Mmmmm... There's a lot of tutorials about the general guidelines of GDPR on internet.

Then:

- either it's a simple website for fun... and then, why is tracking users so vital?

- or it's a real business, with real money... and then you should have a lawyer anyway for GDPR and others

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#226

Post by GranularRecipe »

ThunderSizzle wrote: post #169
mnw21cam wrote: post #128

Earlier quoted context omitted.

Agreed. It isn't the third party that is the issue - it is the separate purpose. For example, if I access a web page, I'm giving my IP address to the server, so that it knows how to sent the data I just asked for back. That IP address is personal information, but it is necessary for the server to fulfil the purpose of the task I just asked for. That server also gives the IP address to a third party - the router in be…

Wouldn't that depend on perspective? Wouldn't the router e.g. cloudflares purpose be to ensure fast delivery and that it's not an attack. Both require capturing the ip address and analyzing behavior. A faster road where no one wants to go isn't a faster way, so the router needs to capture it so they know where to build their roads.

Good point. Sounds like the start of a fun conversation between data protection officers (DPO) and data protection agencies (DPA).

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#227

Post by PaulKeeble »

Arguably most of these cookie popups are not compliant with GDPR law anyway as all cookie acceptance has to default to opt out, its only if the user wants to opt in that the data can be collected. Almost all of the popups default the wrong way and use dark patterns including making you wait minutes to avoid the popups.

This is all by design, they will happily show you that popup everytime you come to the site and you'll never see it again if you accept them. When you see such a pop up you know what sort of entity you are dealing with, one that is willing to fight with the EU and the law to get that data as well as enormously hurting its customers in preference.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#228

Post by soneil »

OJFord wrote: post #160
olivierduval wrote: post #94

Earlier quoted context omitted.

You're right... I'm french ;-) Sorry about the wrong acronym (RGPD = GDPR)

Isn't it inconvenient and search result partitioning to use this? I haven't come across/noticed it before. In English for example we use the French order acronym UTC, not UCT or CUT. (Though to be fair in the UK outside of a computing context we mostly use GMT.)

It's my understanding that we use UTC because it favours neither the english nor the french. English wanted CUT, french wanted TUC, so UTC was chosen to favour neither.

Re: Stop whining about “The EU Cookie Policy” and improve your ways

#230

Post by krsdcbl »

jwildeboer wrote: post #97
olivierduval wrote: post #11

Actually it's a bit more complex (but not much) than what is described: 1st party may need user consent when they will use personal datas for something that is not the intended service (legitimate use). For example, for a shopping cart: cookies are necessary for the service, so no problem. For fraud detection : no problem because it's a legitimate use. But if you start tracking with a user cookie what pages your user…

Toot/thread author here. You are of course right. I couldn't pack all details in those toots. I had to break it down to the absolute basics that are often misunderstood: Not every cookie needs consent. The way this is presented nowadays in these popups is deliberately misleading and trying to move the blame to some anonymous political entity when in reality it simply isn't that way.

I'd have one very important addition, as you tend to use the word yourself even if you basically term at pointing out this distinction:

The law itself does not even mention "cookies", afaik.

It aims at regulating ANY kind of detection or storage of PII, regardless of it's technical nature.

"Cookies" are preferred nomenclature partly because non technical users kinda understand what it means, but it's VERY MUCH also part of the very tactics you are writing about: because "do you accept cookies?" is a really really cute obfuscation of "do you consent to us taking your fingerprints and tracking everything you do online?".

That also goes for calling the GDPR the "EU cookie law".

The EU already had a "cookie law" long before GDPR that already mandated informing users about the site's usage of cookies, but it was widely ignored or even unknown to publishers outside of the eu since it: didn't regulate consent & storage, referred to cookies specifically and had thus become easy to kite with modern tracking techniques even if anybody gave a damn, and also didn't impose any kind of substantial sanctions when breached.

The GDPR aimed to fix that and therefore explicitly avoids specifying any technology it should be applied to. It's applicable to cookies, server side tracking, fotos of you or paper forms just the same.

Post reply on HN