What if the EU instead mandated that browser makers have to keep up with, implement, and enable by default the highest levels of tracking protection possible? It would be far easier to enforce that on four or five organizations (half of which already do that) than to try and corral millions of websites into compliance.
Cookie Warning Shenanigans Have Got to Stop
121–130 of 509 posts
Re: Cookie Warning Shenanigans Have Got to Stop
#122What I don't understand is why websites hosted outside the EU, for non-EU users have the cookie banners. At least keep it in Europe, use the IP to geolocate, let the EU users deal it. Some companies have outright banned EU traffic, sounds like only showing the banners for EU IPs seems ok.
The law doesn't just apply to pages being served to the EU, it applies to pages being served to EU citizens, wherever they happen to be at the moment. So geolocation is not a satisfactory option.
EU residents, actually, and yes, geolocation is satisfactory -- you can hit EU residents as long as you're not intending to hit them, and are doing nothing in contradiction to that intention (like translating your content into Polish, for example).
Re: Cookie Warning Shenanigans Have Got to Stop
#123Its too bad nobody invented a browser header to be sent with HTTP requests for Allow-Cookies: SURE_YES_WHATEVER_OMG_STOP_ASKING_PLZ
It's too bad nobody came up with the simple idea of forcing browsers to ask permission before sending personally identifying information everywhere.
There are easy ways to do this though, I use uMatrix.
Re: Cookie Warning Shenanigans Have Got to Stop
#124The omnipresent "Please accept our privacy policy (or leave)" is worthless cargo cult GDPR pseudo-compliance. If it's neither freely given nor informed, it's not consent under GDPR. See Art. 7: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of persona…
> If you want to use external tracking and be GDPR-compliant, you must offer a clear choice ("yes/no") and you must not use pre-ticked boxes (i.e. an opt-out approach) Exactly this. Basically what the GDPR says is: if your business doesn't require the data, you cant use it without the user's consent. And data used for better advertising is NOT essential to e.g. a news site. What's more, the regulation syas that you c…
This is the view of a US person: These are private owned and operated web sites. The site owner determines what is "essential." If you do not agree to to the terms, do not use the site. If you don't want to be tracked for advertising, that's on you to install ad blockers.
Re: Cookie Warning Shenanigans Have Got to Stop
#125Earlier quoted context omitted.
It's too bad nobody came up with the simple idea of forcing browsers to ask permission before sending personally identifying information everywhere.
There are easy ways to do this though, I use uMatrix.
The joke is that this is a browser setting. Its just set to "Always accept without asking" by default.
Re: Cookie Warning Shenanigans Have Got to Stop
#126I disagree with a number of premises stated in the article:
> it essentially boils down to "take this cookie or no access for you"
This is something GDPR explicitly bans. "Consent" obtained this way is invalid; the site doesn't even have to bother asking at that point.
> To continue chucking up cookie warnings to everyone and somehow expecting them to make an informed decision about the risks they present? 99% of people are going to click through them anyway
No, sites don't have to chuck up cookie warnings. If the cookie warnings were actually compliant, i.e. didn't try to hide the "no" option behind several clicks, there would be very little incentive for the user to say yes, because "no" means the warning goes away just as well, plus the user doesn't get tracked.
Of course, the sites realize that, and are setting up non-compliant "consent" dialogs that try to trick or pressure the user into "consenting". The solution to that is to prosecute the ones that do that until they stop. (I bet many of the sites set and use tracking cookies even before you close the dialog.)
At that point, the sites can choose whether they want to annoy users or not, but since a large part of the users will click "no" at that point (since the sites can't really provide an incentive to click yes), they might as well stop using the trackers.
And sites using cookies for functionality the user actually wants don't have to ask for consent for those cookies. If the site asks, it's because it wants to track you, and you have no reason to agree.
Re: Cookie Warning Shenanigans Have Got to Stop
#127It's almost as if the GDPR were less a carefully designed way to increase the degree of freedom individuals experience while perusing the web, and more an expensive and highly visible way to demonstrate that EU functionaries are Doing Something About Scary Technology Companies. I mean, obviously, it's totally not that at all, of course but it's almost as if it were.
Re: Cookie Warning Shenanigans Have Got to Stop
#128In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning;
Clicking 'no' should still allow people to view the website, but without placing any tracking cookies.
Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...
Re: Cookie Warning Shenanigans Have Got to Stop
#129Is it possible to write a browser extension that has the browser request access to store cookies just like it does for microphone or location access?
I think it must be. I use uMatrix which essentially does this, except it doesn't use popup requests - if you want cookies, just make a few clicks.
Re: Cookie Warning Shenanigans Have Got to Stop
#130It's not even clear to me how they actually work. Usually what I do when there's no "Deny" button (which is most of the time) is just leave the dialog open in hopes that that qualifies as "not accepting". But then some of them say "by continuing to use this site you agree". But, what does that even mean? Do they wait for a scroll event before setting the cookie, or is it there already before I even click "Agree", and…
Legally, you haven't consented. They're of course tracking you anyways because they're too lazy/greedy to implement it properly, so you should use the usual security measures (adblocker, PrivacyBadger), but they're breaking the law.
It's just that there's too many people doing that for the overloaded DPAs to take care of them all.