Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kill The Cookie Banner

killthecookiebanner.eu

Post reply on HN
Print view View original

361–370 of 621 posts

Re: Kill The Cookie Banner

#361

Post by bshacklett »

jackson1442 wrote: post #191
readread wrote: post #155

Earlier quoted context omitted.

"Accept all" always makes it go away immediately. Some variant on "reject" takes more effort like 70% of the time. Which is on purpose, of course. The ones that aren't maliciously-complying have a "necessary only" button that insta-closes it, but tons pretend that you might want to allow some spying but not all of it and make you go through another screen if you don't just "accept all". > To me, having a browser sett…

"necessary only" also tends to have a malicious compliance aspect where they don't store a cookie recording your preference and show the banner on every single page until you click accept.

I don't see that as malicious. Is my consent record "strictly necessary"? No. Don’t get me wrong. I’m sure they love that, but if sites saved that preference when only necessary was selected, I’m sure a bunch of people would be screaming that they weren’t following the law.

Re: Kill The Cookie Banner

#362

Post by thom »

xp84 wrote: post #331
thom wrote: post #242

Earlier quoted context omitted.

A lot of UK sites (Reach local news stuff) now explicitly say take cookies or pay, which tbh I always thought was illegal.

It's wild to me that anyone thinks that would be a reasonable law (whether or not it is law, I have no clue, I don't live in UK or EU). If you made a website and you said "To view the private content on my website, you have to either pay me, or sign a name, any name you wish, in my guestbook" what business is it of the government to say "No, this random person refuses to pay or sign the book, but Thom, you have to le…

Allowing bad actors to act badly against all but the most sophisticated users is exactly where lawmakers should be stepping in. Sorry you find that controversial.

Re: Kill The Cookie Banner

#363

Post by ethin »

dotancohen wrote: post #212
ethin wrote: post #208

Earlier quoted context omitted.

IMO any contract, waver, etc., shouldn't be legally enforceable unless the signatory has actually read it. It's always seemed to me to be one hell of a pathway of abuse (in a way) to just be able to bind someone to be legally required to do anything you want, for example, by just relying on them not reading the thing they signed.

How to know if they actually read it? The signature implies that the contract has been read, understood, and accepted. I see no need for any alternative mechanism.

Is that not what the courts are for? I imagine that if a court had to enforce a requirement like this, knowledge would generally be the best kind of proof. If you know what the contract said (or even it's terms in general) that would be enough.

The reason this isn't done is because corporations legal departments love writing 10-100 page contracts that absolutely nobody is going to read.

Re: Kill The Cookie Banner

#364

Post by crote »

m000 wrote: post #285

This just doesn't make sense. EU regulations are already making progress in improving online privacy: (a) No cookie banner required for functionally necessary cookies, (b) there needs to be an option to refuse tracking cookies in the cookie banner, (c) the dreaded cookie banner appears only the first time you visit a site. I would say, we are like 80% there. Yes, there are still some dark patterns employed by cookie…

> Yes, there are still some dark patterns employed by cookie banners, trying to trick you into accepting tracking. But they are not too hard to make out. And they can be fixed by tuning the regulation a bit: Require the opt-out to be the first choice and the only one with highlighting.

The fact that we are still talking about this literally a decade after the GDPR was adopted shows that this isn't working. It has turned into a cat-and-mouse game, and the regulators just don't have the manpower to effectively rules-lawyer every tiny change.

> when e.g. the Do Not Track header was tried, it just fell flat.

... because there was no reason to follow it. There was literally zero consequence for ignoring it.

This new proposal makes the Do-Not-Track v2 header legally binding. User sends the header and you still show a consent popup? You're breaking the law, simple as that. No weaseling yourself out of it, a simple screenshot is enough.

Any regulator could build a fully-automated scanner in half a day: ask the local TLD registrar for a mapping of websites to companies, have some script request the page and do a regex search for "cookie" (or use AI if you are feeling fancy), take a screenshot, pass it to an intern to double-check, then automatically send out a €100 fine. Double it every X weeks they haven't fixed it yet. Want to fight it in court? They have screenshot, you lose, now pay.

Re: Kill The Cookie Banner

#365

Post by goodrubyist »

swat535 wrote: post #253
goodrubyist wrote: post #237

Earlier quoted context omitted.

Agreeing to terms and contracts without reading or at least skimming them is not responsible adult behavior and should not be used as a model for legislation, no matter how many people do it. I agree that we do have a culture where private law is not taken very seriously, and that's very unfortunate. People do not have a right (morally speaking, not legally) to access or use a service (or a website) etc without havin…

Terms of services and contracts are written for lawyers and not the average people. If your terms require people to get a law degree and take a week to parse the 400 page document, then I would argue that it's a tactic to get people to sign up for the service without fully understanding it. We need legislation that forces companies to communicate the terms in a way that an average person can comprehend.

I'm an average person and I read them all the time. It's not usually 400 pages long. More like 3-4 pages. If a person genuinely can't understand, they should not use the service. That's not sarcasm, I, myself, do not like to sign contracts I cannot understand -- but that's rare when you can look up stuff.

Re: Kill The Cookie Banner

#366

Post by tempestn »

yjftsjthsd-h wrote: post #357
tempestn wrote: post #119

Earlier quoted context omitted.

Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.

> Aggregated analytics do, Good. > and you can't run a serious website without some kind of analytics. I don't believe you. > Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved. IANAL, but I'm given to understand that this is untrue.

You're right about explicitly set preferences.

What do you see as the harm in website owners using aggregated analytics data to improve their sites?

Re: Kill The Cookie Banner

#367

Post by goodrubyist »

TheScaryOne wrote: post #238
goodrubyist wrote: post #232

Earlier quoted context omitted.

[flagged]

>If someone does not read a contract or a legal agreement, before accepting or signing, it's on them When was the last time you read an entire EULA before installing software? I'm going to guess the time frame is somewhere around "never." These are nuisance contracts designed to jade people with legalese while stealing their rights to things like class action and enforcing binding arbitration. Standard contracts soun…

I skim or read all the time, and so should people -- but ultimately they're adults and if they want to agree to them without reading, it's their choice (they shouldn't expect to later say they didn't read - this doesn't work, and that's how the current American legal cases were decided as well, thankfully, see e.g. regarding arbitration). Btw, regarding class action and arbitration, many of us already know that these are present in bold in the terms of many services we use or are going to use without even actually reading them.

Re: Kill The Cookie Banner

#368

Post by novafunc »

bshacklett wrote: post #361
jackson1442 wrote: post #191

Earlier quoted context omitted.

"necessary only" also tends to have a malicious compliance aspect where they don't store a cookie recording your preference and show the banner on every single page until you click accept.

I don't see that as malicious. Is my consent record "strictly necessary"? No. Don’t get me wrong. I’m sure they love that, but if sites saved that preference when only necessary was selected, I’m sure a bunch of people would be screaming that they weren’t following the law.

I don't think anything is actually "necessary" if you want to be strict on definitions.

I think it's absolutely fair and unlikely to be illegal to use a cookie to remember cookie preferences. Unless the cookie value was not yes/no, but something like a precise timestamp that could be used for uniquely identifying.

Re: Kill The Cookie Banner

#369

Post by goodrubyist »

Maxion wrote: post #244
goodrubyist wrote: post #237

Earlier quoted context omitted.

Agreeing to terms and contracts without reading or at least skimming them is not responsible adult behavior and should not be used as a model for legislation, no matter how many people do it. I agree that we do have a culture where private law is not taken very seriously, and that's very unfortunate. People do not have a right (morally speaking, not legally) to access or use a service (or a website) etc without havin…

Try to get anything done then, there's so many places these days where you have to approve 300 page legal documents to e.g. record day care times, pick up packages and so forth. There is literally not enough time in the day. The option for me would be to not put my kid in daycare (I lose the spot if I don't put in the daycare times, and the only way to do that is a 3rd party service) and not pick up packages (have to…

They're usually not that complicated. And most of them say usually almost the same things with some edits thrown here and there. E.g. compare the disclaimer of warranty/liability sections of two different EULAs. E.g. this kind of text in Apple macOS Tahoe EULA is found almost everywhere:

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE APPLE SOFTWARE AND SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”

https://www.apple.com/legal/sla/docs/macOSTahoe.pdf

The same point applies to most of the text. But yes, some text is specific to the service. E.g. the same doc above says in bold:

"By using the Content Caching Features of the Apple Software, you agree that Apple may download and cache such Apple Eligible Content on your Caching Enabled Mac."

I'd say that's something worth knowing if you use that OS.

Re: Kill The Cookie Banner

#370

Post by NopIdoN »

reorder9695 wrote: post #48
alt227 wrote: post #34

I still don't get why every website has a cookie banner by default. I am data controller for several companies and have lots of exposure to GDPR. All my websites have no cookie banner, as they are not required. I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? Who knows.

Don't underestimate the argument of "just to be on the safe side". Someone running a business who doesn't know a lot about cookies will often just put a banner on as an easy arse covering mechanism even when not required.

That doesn't work, because you have to list what cookies you're asking for.

If the banner's not required, it ends up saying stuff like "we'd like permission to share your data with 0 partners". Ever see that?

The fact is most website operators want to use your data for non-essential purposes.

Post reply on HN