Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kill The Cookie Banner

killthecookiebanner.eu

Post reply on HN
Print view View original

531–540 of 621 posts

Re: Kill The Cookie Banner

#531

Post by Voultapher »

IanCal wrote: post #296
basch wrote: post #120

Earlier quoted context omitted.

Cookie control always should have been a browser control. The legal route always should have been to force it to be built into browsers that provide sane defaults, and make it illegal to circumvent what the browser declares as far as fingerprinting etc. any sort of elevation prompt, IF I allow them to be popups or an icon in a toolbar, should always be in the same place and not cover the page.

In a way it is - or rather it wouldn’t t change anything if we added more features. The default is “no”. Without explicit consent you can’t do a lot of things. You can’t have a default yes, because how can you agree with consent but automatically to everything? And if it’s a no, are you saying you can’t ask a user for permission to use their data for a specific purpose? And if you can ask, that’s what we have right n…

They are asked _once_ during browser setup, same way on iOS users are asked once during setup if they want to allow Apps to track unique IDs (memory is hazy, they did that a couple years ago). And surprise surprise IIRC 96% of users said no.

Re: Kill The Cookie Banner

#532

Post by inigyou »

ApolloFortyNine wrote: post #414
buzer wrote: post #381

Earlier quoted context omitted.

Well, if you presented them with list of 100 partners each with 20 page of privacy policies and they accept it within 10 seconds it should be tricky to argue that user actually read it all. You could, for example, require that user answers very specific questions regarding 10 randomly selected partners and how exactly they can use the data ("is partner x allowed to build very detailed profile of you and target you wi…

If you did this people would only use the same half dozen sites and competitors would emerge. We're borderline already there today when the cost of switching is typing a different url at the top of the screen. You add some mandatory 20 minute wait and you'll never see a new site again. Google and Facebook would love it though.

Plus sites that don't track you

Re: Kill The Cookie Banner

#533

Post by inigyou »

TurdF3rguson wrote: post #423
preg_match wrote: post #215

Earlier quoted context omitted.

You don't need cookies for basic aggregated analytics. Now if you want to track and record mouse movement, you do, and that's a privacy concern. The law really has nothing to do with cookies, it has to do with privacy, tracking, and PII. You can absolutely save preferences and perform analytics. What you can't do is hoard data that is personally identifiable for purposes that are not obvious to the consumer.

Actually you can't send any cookie that is not essential to the operation of the website without consent and that would include analytics regardless of PII. same for pixel tracking / fingerprinting, it's all a no-no.

There's "legitimate business interest" which I think is a catch-all for things you want to do as long as they don't invade privacy?

Re: Kill The Cookie Banner

#534

Post by TeMPOraL »

donaltroddyn wrote: post #334
xp84 wrote: post #288

Earlier quoted context omitted.

It literally does not matter what you pick on these things - most of them don't work anyway. Think about it: Of course they don't. All the third-party javascript is already on the page. Anything you do inside the sandbox with UI provided by, usually, some other third-party, can't just magically force all that other code to behave in a specific way, unless someone has done a great deal of work to integrate the cookie…

I think you're right that many (most?) CMPs are broken, though usually not deliberately. Most try to gate analytics and ad tracking on consent, just often misconfigured. The common exception is companies that deliberately hide Reject All, which is not complaint My company scanned 209 European regulated sites in June, and roughly 7 in 10 had tracking that wasn't correctly gated by consent. It's rarely indifference, th…

I don't buy it. 70% of the CMPs being "misconfigured" tells us that even if these panels were broken by design, the companies using them must all conveniently not notice this. Strange, given that even a small risk of large fines or prolonged legal process with public entities would warrant someone paying at least a moment of attention to this. I suspect they are, and the choice of leaving things misconfigured is deliberate.

> something added by a dev or LLM without going through proper review

FWIW, this was a problem long before LLMs were a thing, and it didn't get worse with LLMs. If anything, I'd expect LLMs to get it right by default, because ones ~everyone is using are all trained straight, they won't just silently read between the lines and write code/configs to facilitate one's illegal business model.

Re: Kill The Cookie Banner

#535

Post by inigyou »

tappio wrote: post #454
ApolloFortyNine wrote: post #415

Earlier quoted context omitted.

How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask. Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).

That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side. Of course, re…

Or use some JS to put the time-on-page in the next request, right?

Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.

Re: Kill The Cookie Banner

#536

Post by badestrand »

unscaled wrote: post #445
zugi wrote: post #321

Earlier quoted context omitted.

> Just set your browser to delete all the cookies at the end of the session except for whatever sites you want to allow to 'remember' you Exactly. I use the "I don't care about cookies" extension, which rejects most cookies automatically without me having to see the popups. But even accepting cookies is fine - I'll be closing my browser soon anyway and they'll be gone.

Despite this being called a "cookie banner", this is not _just_ about cookie. When you click "Accept all" you are giving your consent to any form of tracking and information sharing mentioned in the details. The site you visit may share everything they know about you with any third party they mentioned. They can even use fingerprinting (if you've agreed to it) to keep tracking you after you've deleted the cookies.

And then? What's the practical, concrete, real-life consequence for me? Nothing, not even a bit more relevant ads as these run into my adblocker anyway.

Re: Kill The Cookie Banner

#537

Post by inigyou »

micromacrofoot wrote: post #388
ymolodtsov wrote: post #106

Earlier quoted context omitted.

Websites need cookies. I don't get why I have to suffer through this for a few puritans who literally lose nothing in the process of this transaction but act as if Stasi is watching them.

if you're talking about cross site cookies, which are the big ones that require consent: no they don't!

Consent has nothing to do with crosssiteness except insofar as that proves it isn't needed for the operation of your own site.

Re: Kill The Cookie Banner

#538

Post by ClumsyPilot »

whstl wrote: post #299
ClumsyPilot wrote: post #196

Earlier quoted context omitted.

> If people really cared, they’d choose browsers that have better control If people really cared, they’d chose reputable suppliers that sell non toxic food. If they are eating food with lead, they don’t care. Don’t force your wordview on people through regulation

> Don’t force your wordview on people through regulation As opposed to enforcing your worldview with a lack of regulation? Because that's precisely what's happening, with the advertisement industry enforcing their worldview through lack of compliance.

That was suppose to be a reductio ad absurdum, not a genuine argument

Re: Kill The Cookie Banner

#539

Post by bwb »

kleiba2 wrote: post #143
chrismorgan wrote: post #60

The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/or clicking a button cannot constitute informed consent”; and see what they try next.) From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them…

> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data…

I run two plugins to just invisibly make them go away, I don't care, they are a waste of my time :)

Re: Kill The Cookie Banner

#540

Post by inigyou »

ChadNauseam wrote: post #145
tempestn wrote: post #112

Earlier quoted context omitted.

"I didn't read it," sure. But, "A reasonable person would not read it?"

Why would a reasonable person not read it? I just visited theguardian.com to see their cookie banner. The banner says this: > Your Privacy (`x` button to close the tab) > US residents have certain rights with regard to the sale or sharing of personal information to third parties. > Guardian News and Media and our partners use information collected through cookies or in other forms to improve experience on our site an…

Notice how they show you those three sentences and don't just put a bunch of small print at the bottom of the page. Because if they did, it would be invalid.
Post reply on HN