131–140 of 395 posts
they could have made the law: >if you collect users data >you must ask first >add a yes or no button on a banner so they can pick but instead the eu citizens were let down by the legislators
Whatever you see in cookie banners is either malicious compliance or directly illegal (and already being prosecuted and resulting in fines).
Earlier quoted context omitted.
It did though? You don't need a banner for actually legitimate use (session Cookie, settings, etc) The things they're calling legitimate use just isn't, which is why they need banners.
I keep seeing this misinformation going around, and it has been going around since almost day 1 of when the directive became known. I'm not sure where it's coming from, or who initially thought it worked like that, but judging by the comments in this submission it seems like a ton of people are very misinformed about how these things actually work.
Earlier quoted context omitted.
> You know the best way of not having to care about GDPR? Don't store PII. I hear this a lot. As an American that hosts casual personal websites, I can't help but worry that I'm in violation of the GDPR. For example, my router logs connections for debugging. And my NGinx server maintains server logs for debugging. These contain IP addresses. I'm pretty sure those are considered PII under GDPR. And there are a lot of…
I get it, but you’re not in violation if you never pass those logs to anyone. GDPR is intentionally obfuscated and made scary by people who have an interest in others thinking the regulation is onerous and silly (so that it is eventually changed/removed). The regulation is not very hard to read, I would recommend you do it if you haven’t and boils down to: “don’t pass on (process) information without informed consent…
Earlier quoted context omitted.
> never seem to blame the web companies for doing the naughty things on their websites Part of the problem is that the law didn't seek to distinguish between tame first-party cookies and the really naughty third-party cookies so the burden is equal regardless of how malicious the service is. > For the company, it's a one time JIRA ticket for a junior software engineer to code up a banner. This is actually not true. T…
It did though? You don't need a banner for actually legitimate use (session Cookie, settings, etc) The things they're calling legitimate use just isn't, which is why they need banners.
There are some analytics companies out there that advertise cookieless analytics, but they are either a) too simple for enterprise or b) a much, much worse privacy and compliance risk.
Earlier quoted context omitted.
> Many cookies (or something like a cookie) are required for a website to operate normally "Essential Cookies" do not need a consent banner. Case in point: Hacker News is 100% compliant AFAIK and has no banner. > Many websites have legitimate need to store PII. If there is actual legitimate interest or legal requirements, such as collecting an address for delivering a package or performing fraud-prevention, there is…
And if that data is "transferred" to a 3rd party for that analysis (aka. a REST call into their API) then you are back to requiring these annoying banners. Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers. Oh the horror!
If so, it is legitimate interest to do fraud prevention, so there's no need for a consent banner, first or third-party. Naturally you can't go and use this data for a purpose that has no basis under legitimate interest.
Another example: Cloudflare is running DDoS prevention under our noses here at HN, for example, but there's no need to ask for consent, even though Cloudflare is a third-party. Why? Because this is considered legitimate interest.
> Or, more common for ecommerce, "transferred" into an advertising algorithm so the business can gain more similar customers
For this you do need consent, if you transfer PII. If you don't want a banner you can replace it with a simple checkbox during the checkout process. Not only less hostile, but also more transparent than a banner.
for me personally out of all these options giving my data is my least painful payment option for one off services.
Instead, we are trusting the very websites we are blaming on tracking us in the most decietful, malicious ways possible to self-regulate and implement these controls. So now every website gets a shitty banner - on top of all the other annoying in-page banners and popups which are a staple of 2020s web design - that asks us if we want cookies. All these banners look different, are positioned differently on the page, appear at different times after the page is loaded, and function differently. So there's no consistency. And 90% of the time you can't disable all the cookies anyway, because there's that little grayed out toggle control for "strictly necessary cookies." How do I know one of those cookies you consider "strictly-necessary" or "crucial for site functionality" doesn't connect back to some evil tracking algorithm, the blocking of which was the whole point of this banner debacle in the first place?
So we have essentially asked websites to self-regulate the way the US's vitamin/supplement industury does, except its worse because I don't have to click a fucking banner before I take a capsule of what may or may not be vitamin C.
So again, why isn't this the responsibility of browser vendors? Am I taking crazy pills? Am I going insane or is the world going insane?
/rant
People blame the cookie banners themselves or the legislation that "made them necessary" but somehow never seem to blame the web companies for doing the naughty things on their websites that make them subject to the law. The "cookie banner problem" exists because it's primarily end users that are shouldering the burden of them, and not the companies. For the company, it's a one time JIRA ticket for a junior software…
The second cookies are blocked the industry moved to fingerprinting and other methods It's like piracy, there's only so much you can do plugging holes Cookie banners always felt like a feel-good solution. Made worse by inconsistent UIs, differing button texts, long explanations, etc.
I say keep on plugging. When you make a law and bad actors find loopholes, the solution isn't to throw up your hands and say "Well, we tried!" The solution is to continuously refine the law as loopholes are found. Laws should get regular patch releases.
Earlier quoted context omitted.
> never seem to blame the web companies for doing the naughty things on their websites Part of the problem is that the law didn't seek to distinguish between tame first-party cookies and the really naughty third-party cookies so the burden is equal regardless of how malicious the service is. > For the company, it's a one time JIRA ticket for a junior software engineer to code up a banner. This is actually not true. T…
It totally does make the distinction. If you use cookies for auth, no need to disclail it. Better, you don't need a banner even of you do track users for anybody with DNT. So you can offer a seamless experience. They just don't care.
This is not true. The specific text of the law requires that websites have to provide details about their cookies, and then document and store user preferences.
If you just honored the DNT, you would still be out of compliance.