Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear Paul Graham, there is no cookie banner law

amazingcto.com

Post reply on HN
Print view View original

201–210 of 662 posts

Re: Dear Paul Graham, there is no cookie banner law

#201

Post by niklasrde »

ZiiS wrote: post #100

Whilst, I am very opposed to tracking; especially covert. I do believe the cookie law is bad. Fundamentally, websites can not store content on your computer without your consent. Your "User Agent" is what stores cookies; it is usually a piece of open source software fully in your control capable of only storing them based on any policy you like, including asking you for each site. Whilst it would be nice for all site…

That's not true. "strictly necessary cookies" are allowed without consent (but information on their use must be available).

Examples for what that means given by the EU itself [1] include "cookies that allow web shops to hold your items in your cart while you are shopping".

And on the policing - there are a lot of laws that cannot be "policed". It requires trust, goodwill, collaboration and savy users to report violations to the webmaster or relevant ICO.

[1]: https://gdpr.eu/cookies/

Re: Dear Paul Graham, there is no cookie banner law

#202

Post by fauigerzigerk »

n4r9 wrote: post #107
jasode wrote: post #70

>, Paul Graham came up with the thought, that the EU forces companies to have cookie banners. There is no law for cookie banners. [...] Companies could easily avoid any cookie banner. Just don’t track. KingOfCoders/amazingcto, of course you are technically correct but Paul Graham wasn't talking about the letter of the law. Instead, you have to interpret his complaint with the lens of game theory . I.e. The Law of Uni…

Doesn't that argument work both ways? If you interpret the EU's regulation with the "lens of game theory", it is an unintended consequence of aggressive corporate data collection. Not sure why it makes sense to complain about the EU and not the companies.

No, it does not work both ways. The roles of governments and corporations are not symmetric.

Good regulation is regulation that has good outcomes. If a law has bad outcomes it is a bad law. You can separately complain about what companies are doing but that doesn't change the fact that it's a bad law.

It is of course debatable whether GDPR as a whole has bad outcomes, but if we're talking about cookie banners in isolation then it certainly does.

Re: Dear Paul Graham, there is no cookie banner law

#203

Post by jasode »

hikingsimulator wrote: post #146
jasode wrote: post #70

>, Paul Graham came up with the thought, that the EU forces companies to have cookie banners. There is no law for cookie banners. [...] Companies could easily avoid any cookie banner. Just don’t track. KingOfCoders/amazingcto, of course you are technically correct but Paul Graham wasn't talking about the letter of the law. Instead, you have to interpret his complaint with the lens of game theory . I.e. The Law of Uni…

The blog clearly works from the actual outcome lense. It's repeated. Several times. The companies could just not track . The actual outcome is that they do want to track, and use adversarial patterns and malicious compliance to twist your arm and "force consent." Paul Graham is still wrong.

>The blog clearly works from the actual outcome lense. [...] The companies _could_ just not track.

No, you've inadvertently stated a contradiction. Your use of the word _"could"_ is literally a hope/wish/intention of the law.

In contrast, the actual outcome is that the companies didn't stop tracking. We _wish_ they would stop tracking. (I.e. "The companies _could_ just stop tracking us!") But that hope still doesn't change the observation of reality.

Re: Dear Paul Graham, there is no cookie banner law

#204

Post by mpeg »

ZiiS wrote: post #100

Whilst, I am very opposed to tracking; especially covert. I do believe the cookie law is bad. Fundamentally, websites can not store content on your computer without your consent. Your "User Agent" is what stores cookies; it is usually a piece of open source software fully in your control capable of only storing them based on any policy you like, including asking you for each site. Whilst it would be nice for all site…

What you're suggesting is basically the same thing as what the law is achieving.

Yes, users could block all cookies but this will break functionality on a lot of sites, so it's not reasonable. And yes, sites could communicate which are functionality cookies and which are tracking cookies, but as you say it's hard to police this, so pushing the issues to the user's software won't work.

What the law does is fixes all this by requiring sites to obtain consent in certain scenarios; but if your site only sets cookies required for the site to function (shopping cart, login cookies), or if it tracks users for the purpose of security (eg a bank that detects when you log in from a new device / location) you DO NOT need to obtain consent, no banner required.

Re: Dear Paul Graham, there is no cookie banner law

#205

Post by gred »

polygamous_bat wrote: post #168
n4r9 wrote: post #107

Earlier quoted context omitted.

Doesn't that argument work both ways? If you interpret the EU's regulation with the "lens of game theory", it is an unintended consequence of aggressive corporate data collection. Not sure why it makes sense to complain about the EU and not the companies.

> Not sure why it makes sense to complain about the EU and not the companies. Unfortunately a non-negligible number of people in tech also have libertarian leanings, with a default “gubmint bad!” position, which makes them easy prey for adtech propaganda.

> Unfortunately a non-negligible number of people in tech also have libertarian leanings

Why is this unfortunate? Because you don't agree with us? The "they would agree with me if they were smarter" trope is tired and gets us nowhere.

Re: Dear Paul Graham, there is no cookie banner law

#206

Post by smallerfish »

iEchoic wrote: post #136
crabmusket wrote: post #98

Earlier quoted context omitted.

Shopping carts and notification preferences don't require a consent banner.

Our lawyers told us otherwise. Regardless of the answer here, the fact that there's still a debate about what basic functionality requires a cookie banner is really a testament to how bad this legislation is. How long has this been around, 20 years? And there's still widespread debate and lack of understanding as to what specific functionality requires a cookie banner?

> How long has this been around, 20 years?

No. It took effect in 2018.

Re: Dear Paul Graham, there is no cookie banner law

#207

Post by nicce »

JimDabell wrote: post #128
nicce wrote: post #85

Earlier quoted context omitted.

You are citing directive that does not apply in all cases. It is amended by Directive 2009/136/EC, which changes especially the cookies part. > (66) Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere…

That update doesn’t matter because the original has the same exception. I quoted it.

Then there isn't cookie law?

Re: Dear Paul Graham, there is no cookie banner law

#208

Post by threemux »

whywhywhywhy wrote: post #51

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have jus…

As far as I can tell, politicians don't spend much if any time thinking about second and third order consequences. GDPR is but one example, but instances of this abound. The default should be to mistrust new laws. Reagan takes lots of flak on the internet, but he was right on the scariest phrase being "I'm from the government, and I'm here to help".

Even worse, this thread is full of armchair lawyers that will confidently tell you there's no need for cookie banners in particular cases. Nevermind that there's hardly any case law about this and each country seems to interpret it differently. Any actual lawyer would tell you to slap it on there to stay protected.

Re: Dear Paul Graham, there is no cookie banner law

#209

Post by _v7gu »

VoodooJuJu wrote: post #65

I wonder - why didn't the the EU put the burden on user agents a.k.a. web browsers to handle the cookie notices? When I visit a site, before saving any cookies, have my user agent ask me if I want to allow cookies for that site. Could have a default "no cookies" option with a whitelist, or default "yes" with a blacklist. It would have been so much easier, with a far more consistent UX, wouldn't it have? Now we have t…

DNT existed, but websites decided they could freely ignore that. Hence the regulation

Re: Dear Paul Graham, there is no cookie banner law

#210

Post by madsbuch »

tlb wrote: post #21

Part of what it means to be "good at regulation" is to anticipate the likely consequences of regulations. So a regulation that says that "businesses must now give away their products for free, unless they honk each customer's nose" will result in a lot of sore noses. Which is basically the case here. Almost all websites make money through ads, or at least keep logs of user activity to help them optimize their website…

those pesky regulations. back in the good ol days where I could pillage for a living, but then that damn government came and took away my livelihood!

How dare they!

Just because you made money of it, it doesn't mean it is right.

Post reply on HN