Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kill The Cookie Banner

killthecookiebanner.eu

Post reply on HN
Print view View original

371–380 of 621 posts

Re: Kill The Cookie Banner

#371

Post by tremon »

bshacklett wrote: post #361
jackson1442 wrote: post #191

Earlier quoted context omitted.

"necessary only" also tends to have a malicious compliance aspect where they don't store a cookie recording your preference and show the banner on every single page until you click accept.

I don't see that as malicious. Is my consent record "strictly necessary"? No. Don’t get me wrong. I’m sure they love that, but if sites saved that preference when only necessary was selected, I’m sure a bunch of people would be screaming that they weren’t following the law.

Yes, it is strictly necessary to properly honour the user's choice. Not storing a rejection of consent but storing acceptance violates the GDPR because it creates an asymmetry between the effort required to accept vs the effort required to reject user data processing.

Re: Kill The Cookie Banner

#372

Post by gnatolf »

xp84 wrote: post #288
kleiba2 wrote: post #143

Earlier quoted context omitted.

> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data…

It literally does not matter what you pick on these things - most of them don't work anyway. Think about it: Of course they don't. All the third-party javascript is already on the page. Anything you do inside the sandbox with UI provided by, usually, some other third-party, can't just magically force all that other code to behave in a specific way, unless someone has done a great deal of work to integrate the cookie…

Well, joke's on me: I use that extension too. And I never close my browser.

Re: Kill The Cookie Banner

#373

Post by jchook »

The most frustrating thing about the cookie banner is that the solution was always obvious: just use the DNT setting on your browser (Do Not Track). It already existed.

However, powerful interest groups like ad companies that profit from your attention (which hysterically virtually powers the Internet today) were able to stop it from happening.

It was debated way back in 2009 when the GDPR was being developed. Iirc the argument was that browsers accept cookies by default so users do not get a fair consent moment. This is obviously easily fixed by regulation requiring browsers to ask users once.

Seems extremely backwards that we chose to forever darken the entire Web browsing experience just so users can "benefit" from a per-site option to let Google profit from them, with virtually zero payoff for the end user (ad relevance?).

P.S. If ad revenue is an essential pillar of Internet survival and fruition, the clear alternative seems to be sharing a fraction of that revenue with the tracked consumer.

Re: Kill The Cookie Banner

#374

Post by tremon »

zugi wrote: post #321
xp84 wrote: post #288

Earlier quoted context omitted.

It literally does not matter what you pick on these things - most of them don't work anyway. Think about it: Of course they don't. All the third-party javascript is already on the page. Anything you do inside the sandbox with UI provided by, usually, some other third-party, can't just magically force all that other code to behave in a specific way, unless someone has done a great deal of work to integrate the cookie…

> Just set your browser to delete all the cookies at the end of the session except for whatever sites you want to allow to 'remember' you Exactly. I use the "I don't care about cookies" extension, which rejects most cookies automatically without me having to see the popups. But even accepting cookies is fine - I'll be closing my browser soon anyway and they'll be gone.

I'll be closing my browser soon anyway and they'll be gone

Sure, your browser cookie will be gone. But you have already allowed the server-side identifiers of your session to be used for whatever purpose, including reconstituting increasingly larger parts of your identity over multiple disconnected sessions. Please don't make the mistake of thinking that clearing your cookies afterwards is the same as rejecting all server-side processing.

Re: Kill The Cookie Banner

#375

Post by tacitusarc »

otterley wrote: post #153
tacitusarc wrote: post #111

Earlier quoted context omitted.

But it is complicated, no? Even if you click you agree, if the you thought you were agreeing to one thing but actually agreed to another because they buried the lede, “I didn’t read it” is a reasonable defense.

It just won’t fly in court. Full stop. There are perhaps other defenses to be raised, like unconscionable terms, but not that one.

I think that means one of three things: the court system is broken, you are wrong, or I failed to be clear and you misunderstood me. So, to be clear, if a company buries or obscures terms while making it seem like they have presented them, so you agree without reading the actual terms, you cannot defend yourself by explaining that situation?

Re: Kill The Cookie Banner

#377

Post by crote »

lacoolj wrote: post #255

This ones a little tough. Advertising through trackers is a massive portion of how sites get revenue. Going back to the old days would decimate this space, and have widespread effects on the internet (though im not sure it would be noticed by most of us anymore with how dead the internet feels now) I guess what I'm saying is, there is no good solution here. I don't want every site I visit to require a usage fee just…

> Advertising through trackers is a massive portion of how sites get revenue

Sure, but magazines get a massive portion of their revenue through advertising without trackers. Same with television, or radio, or billboards.

And the ad space isn't exactly very healthy either. Take a large Youtube channel like Linus Tech Tips, for example: AdSense only accounts for 10% of their revenue! Youtube has been drowning people in ads and it still barely pays any money.

I think we should seriously consider the possibility that targeted ads might be less profitable overall. Ad blockers didn't become a thing solely because ads appeared on the web. Ad blockers became popular when ads became obnoxious and privacy-invading. With the current state of the web ad blockers are a hard requirement for a reasonable browsing experience, so the only people seeing ads are the handful of suckers too ignorant to install them.

But if ads aren't as invasive and obnoxious, people would have far fewer reasons to install ad blockers. See for example the Acceptable Ads program of Adblock Plus. If switching to user-respecting ads resulted in a significant portion of people turning off their ad blockers, it could very well result in an increase in ad revenue!

Re: Kill The Cookie Banner

#378

Post by rtpg »

mike_hock wrote: post #37
Phemist wrote: post #22

> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner. So lawmakers do know how to make legally binding preferences based on device settings? What a crazy innovation.. now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act…

Don't fall for the "we are just stupid" propaganda, which is used constantly by governments acting in bad faith. Browsers already had settings for deleting cookies. There was never a reason for banners whose only function was pulling the ladder up from smaller competitors and concentrating power in the hands of an oligopoly that could siphon data directly from the OS. This coupled with a law mandating ISPs provide a…

This framing of the banners as cookie banners is a dodge. It's not about cookies.

The cookie banner isn't about the usage of cookies, it's about _the underlying tracking_. You're allowed to "just" use cookies for normal shit! You can make a website where you use cookies to store login state for a user, without a single banner.

The thing is that every company in the world feels the need to add 1000 tracking cookies to anonymous users to track them through conversion funnels (on top of the ad stuff). That's what you have to inform people about

You can use cookies normally without a banner! You can't track without consent! Every cookie banner is actually a "we want to track you" banner. Calling it a cookie banner is playing into the confusion about what those banners actually are meant to communicate

Re: Kill The Cookie Banner

#379

Post by buzer »

lukeschlather wrote: post #304
IanCal wrote: post #296

Earlier quoted context omitted.

In a way it is - or rather it wouldn’t t change anything if we added more features. The default is “no”. Without explicit consent you can’t do a lot of things. You can’t have a default yes, because how can you agree with consent but automatically to everything? And if it’s a no, are you saying you can’t ask a user for permission to use their data for a specific purpose? And if you can ask, that’s what we have right n…

Yeah I think it probably does mean you should be banned from asking in most cases. If you have a legitimate interest you don't need to ask. If you need to ask your interest is not actually legitimate and you know it.

Legitimate interest is not currently enough to read or write cookies. You need either consent or it must be "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." (or "sole purpose of carrying out the transmission of a communication over an electronic communications network", but that's harder to apply to cookies)

Re: Kill The Cookie Banner

#380

Post by yjftsjthsd-h »

tempestn wrote: post #366
yjftsjthsd-h wrote: post #357

Earlier quoted context omitted.

> Aggregated analytics do, Good. > and you can't run a serious website without some kind of analytics. I don't believe you. > Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved. IANAL, but I'm given to understand that this is untrue.

You're right about explicitly set preferences. What do you see as the harm in website owners using aggregated analytics data to improve their sites?

Abstract: It's still spying on users.

Practical: Supposedly-aggregated stats have a history of actually being perfectly possible to analyze back into individually identifiable information. Also, it's conveniently the same tech stack in a way that makes it easier to make an actual slippery slope.

Post reply on HN