Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dark patterns after the GDPR: consent pop-ups and their influence

dl.acm.org

Post reply on HN
Print view View original

121–130 of 234 posts

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#121

Post by that_guy_iain »

danShumway wrote: post #11
MereInterest wrote: post #2

Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no indication as to whether the "Got it" button is taken as consent for tracking, nor is there a "Reject all non-essential tracking" option on the main banner. Whether or not this site is compliant depends on whether the "Got it" button is taken as affirmative conse…

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodical…

One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but not login and use the actual system. I am still not sure if I am compliant or not.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#122

Post by TeMPOraL »

unix_fan wrote: post #101
ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

I feel like this is a point the HN crowd likes to ignore when it calls for governments to regulate certain aspects of tech. Do regulations like this really protect consumers, or just make their experience worse?

That point has been beaten to death here in case of GDPR, though. The problem isn't with regulation, but enforcement. The fines aren't applied nowhere near enough, so almost no site cares.

The consumer experience being worse is, in a large way, purposeful UX degradation done by the sites themselves. The typical consent popup tries to simultaneously walk the line between "illegal under GDPR" and "just scummy" (often crossing to the illegal side; see the problem of low enforcement), and shift the blame for bad UX on those pesky, no good regulators.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#123

Post by TeMPOraL »

planb wrote: post #69
ddddfdohvsyknn wrote: post #65

These regulations seem worse than nothing. We already have browsers, we can block and filter cookies based on our individual preference and adjust depending on our tolerance for privacy vs functionality. How has this changed the data collection practices of Facebook or Google in any meaningful way? Not enough people are asking what effect the many new regulatory burdens will have for the internet. It entrenchs the ex…

Why is this downvoted? This is exactly what happend. Speaking with non tech savvy users here in Germany, they feel safe and secure on Facebook and fear the „world wide west“ that the open Web has become, where you need to click 20 consent messages on every website without knowing what all that stuff means. This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.

> This is just like EULAs - one more annoying thing they simply accept with a slightly bad gut feeling.

The point of GDPR is that they shouldn't have any bad gut feeling about accepting these terms - because anything even slightly shady, in any way beyond the most basic necessities for performing the service, must be opt-in by default, set to "no consent".

Alas, national data protection agencies are way too reluctant to chase the offenders and issue fines, so a big chunk of the sites on the Internet are breaking the law with impunity.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#124

Post by TeMPOraL »

Guest42 wrote: post #52
scotu wrote: post #38

My favorite deceptive pattern I encountered is "double click the checkbox to disable". Literally a checkbox but it wouldn't do anything. I got a little frustrated and started clicking furiously just to discover that a double click would reliably disable the items... (I don't remember if this was on desktop or mobile, on mobile s/click/tap/g) Also, I personally lean towards being in favor of GDPR and cookie law (wish…

Yes, seems as though those opinions are the loudest and perhaps it encourages the dissenters to stay quiet for fear of down-votes. Ive noticed that with certain viewpoints and have adjusted towards censoring myself a bit. The crowd seems bimodal but perhaps that's the nature of the conversations and the voting tool reinforces that.

Depends on the timezone, perhaps. I hail from the EU, post mostly during EU wake hours, and often comment in favor of GDPR, and I very rarely if ever get negative karma on those comments.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#125

Post by dheera »

danShumway wrote: post #11
MereInterest wrote: post #2

Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no indication as to whether the "Got it" button is taken as consent for tracking, nor is there a "Reject all non-essential tracking" option on the main banner. Whether or not this site is compliant depends on whether the "Got it" button is taken as affirmative conse…

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodical…

Why does a site even get to know when cookies are disabled?

I feel like this is a horrible implementation of this browser feature. If the user disables cookies, the browser shouldn't tell the website "I don't support cookies", but rather let the website's JS think it happily set a cookie but not store anything when you navigate to any other page.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#126

Post by satellite2 »

that_guy_iain wrote: post #121
danShumway wrote: post #11

Earlier quoted context omitted.

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodical…

One of the areas on the cookie consent that confuses me is if a cookie is required for the website to function it doesn't need consent. Since the only cookie my website uses is a session cookie, I don't use a cookie banner. My site won't without it due to the security login area. If you're in a public area and your browser doesn't accept cookies you can still do public things such as reading things and sign up but no…

It depends on what you do with the session cookie.

If you use it only to keep track of the logged in status and access management of the user then you are compliant.

If you use it to track the user server side, then depending on the use case consent is probably required.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#127

Post by satellite2 »

dheera wrote: post #125
danShumway wrote: post #11

Earlier quoted context omitted.

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodical…

Why does a site even get to know when cookies are disabled? I feel like this is a horrible implementation of this browser feature. If the user disables cookies, the browser shouldn't tell the website "I don't support cookies", but rather let the website's JS think it happily set a cookie but not store anything when you navigate to any other page.

Your system wouldn't prevent detection as a simple fixed cookie on the landing page and a redirect on a robot prohibited page, with js on this page expecting the cookie and you get yourself a detection mechanism.

(Note that you could also check server side on the redirection page)

I believe (but I cannot formally prove it) that it's actually impossible to prevent detection.

It's a bit similar to private browsing mode (which in that case should in theory not be detectable) but has revealed to be a challenging problem.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#128

Post by underwater »

1vuio0pswjnm7 wrote: post #94
MereInterest wrote: post #2

Interesting that this site itself may use one of the described dark patterns. The banner on the main page has options "Got it" and "Learn more". There is no indication as to whether the "Got it" button is taken as consent for tracking, nor is there a "Reject all non-essential tracking" option on the main banner. Whether or not this site is compliant depends on whether the "Got it" button is taken as affirmative conse…

"Interesting that this site itself may use one of the described patterns." Is it really interesting, though. For example, we have seen this as a very common retort in HN comments every time an author is critical of advertising, tracking/analytics, etc. Someone points out the author's site itself uses the thing being critiqued. Is that supposed to detract from the argument being made by the author. That does not make…

It seems like a valid complaint to me.

If it's so hard to do the right thing that someone who apparently both cares and understands the problem space still messes it up, then the issue is more fundamental than education.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#129

Post by hansvm »

dheera wrote: post #125
danShumway wrote: post #11

Earlier quoted context omitted.

The site itself completely stops working if cookies are disabled, it just forwards me to a "cookie absent" error page. Their privacy policy says: > Other than in the restricted-access portions of the Web Site that require an ACM Web Account, ACM does not log the identity of visitors. However, we may keep access logs, for example containing a visitor's IP address and search queries. We may analyze log files periodical…

Why does a site even get to know when cookies are disabled? I feel like this is a horrible implementation of this browser feature. If the user disables cookies, the browser shouldn't tell the website "I don't support cookies", but rather let the website's JS think it happily set a cookie but not store anything when you navigate to any other page.

Detection is hard (impossible for arbitrary JS) if the cookie isn't physically stored somewhere (at least in memory).

That said, I think cookie auto deletion basically satisfies that use case? I personally have cookies set to wipe when I close my browser, and I close my browser fairly frequently. That's not quite as often as you're suggesting though.

Re: Dark patterns after the GDPR: consent pop-ups and their influence

#130

Post by Macha »

butz wrote: post #98

How about introducing a standard way to declare and categorize cookies and let browser take care of consent? On first start set your default cookie preferences for all websites and adjust per website, when needed. It could be quickly build as an extension first and later moved to browser core.

This was P3P.

Without legal backing, advertiser's will weasel out of any technical measure. You can even see this in the common practice of showing a app specific permission prompt ahead of browser/OS level prompts because they no that being rejected at the OS level removes their ability to prompt again later.

Legal systems are not so willing to prescribe specific technical solutions to avoid the "oh, you had very specific rules about advertising on radio, but this is TV so we get a few years of free roaming before you can update the law" issue

Post reply on HN