No Cookie for You • Hacker News Board

Re: No Cookie for You

#161

Post by saagarjha » Thu, Dec 17, 2020, 6:13 PM UTC

VBprogrammer wrote: post #108

dathinab wrote: post #69

Earlier quoted context omitted.

Except that if the sites don't do annoying things there is no need for annoying popups. The EU law: - doesn't require opt-in permission for essential cookies and similar. So basic non-personalized website usage statistics (analytics) do not need a opt-in only if it's tracking people in any way are such opt-ins needed - if you login you are known to have accepted the terms of service and as such after login no opt-in…

> if you login you are known to have accepted the terms of service and as such after login no opt-in pop-up is needed either Apologies if I've misunderstood your claim here but it seems to me that you are saying you can bury consent to processing inside your legalise. That doesn't comply with the GDPR as I understand it; the consent must be informed and freely given. Informed in that case is debatable since you are l…

You consent to processing related to keeping you signed in. You don't consent to selling all your data away.

Re: No Cookie for You

#162

Post by Macha » Thu, Dec 17, 2020, 6:14 PM UTC

mirekrusin wrote: post #92

s14ve wrote: post #86

Earlier quoted context omitted.

This wording should be required by GDPR. :) If that would be the case, maybe more sites would follow GitHub here.

Yes, like on cigarette boxes with mandatory, non-dark pattern, visible without scrolling 3 meters button to choose "Don't agree, Continue".

CCPA tried this with the "Do Not Sell My Personal Information " requirement, but it was about as ignored as GDPR

Re: No Cookie for You

#163

Post by TACIXAT » Thu, Dec 17, 2020, 6:14 PM UTC

It would be really cool to get an on-GitHub analytics for GitHub pages. I’d like to get view counts but don’t want to embed an external tracker in my blog.

Re: No Cookie for You

#164

Post by munchbunny » Thu, Dec 17, 2020, 6:14 PM UTC

SilasX wrote: post #107

munchbunny wrote: post #90

Earlier quoted context omitted.

That's correct. Using cookies for the user session is fine and does not require consent as long as you really are just using them for the user session. The moment you use them for analytics, you have to request consent for analytics, even if they are primarily for maintaining the user session.

So, this is a case of “tech company thinks they found a clever GDPR hack, but didn’t and is still breaking the law”?

If we're talking about Github, no, I don't think it's a clever hack. I think they've actually ripped out the offending usages.

The reason I find that believable is that their core business is selling a git server with bells and whistles. From Microsoft's perspective, Github doesn't need to be doing any marketing because they kind of are the marketing.

Re: No Cookie for You

#165

Post by Macha » Thu, Dec 17, 2020, 6:14 PM UTC

dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

I think a lot of people are willingly misunderstanding this too

Re: No Cookie for You

#166

Post by Bakary » Thu, Dec 17, 2020, 6:15 PM UTC

jolux wrote: post #25

phil9987 wrote: post #8

Earlier quoted context omitted.

And, in a way, this is the standard by the fact that they are not required to show the banner if no non-essential cookies are being used :)

Right, what I meant is that only using essential cookies should be the default web development practice. Instead the default these days seems to be websites that are positively larded with third-party scripts, analytics tools, and other crap.

Most web development is done to generate income, so that sounds wholly appropriate

Re: No Cookie for You

#167

Post by oneplane » Thu, Dec 17, 2020, 6:15 PM UTC

thomascgalvin wrote: post #128

random5634 wrote: post #103

Earlier quoted context omitted.

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

It's not really about cookies but more about non-essential information gathering, of which tracking is a part, and some forms of tracking use cookies. So basically, three levels deep before we go from the law to cookies. Then again, people have an easier time talking about 'cookie popups' instead of 'information harvesting', which sadly hides the real issue.

Re: No Cookie for You

#168

Post by gostsamo » Thu, Dec 17, 2020, 6:15 PM UTC

See, it is not all that difficult. Hopefully, this will be the first of many big websites to ditch the excess tracking.

Re: No Cookie for You

#169

Post by jwr » Thu, Dec 17, 2020, 6:16 PM UTC

mattmanser wrote: post #137

thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

The new one I'm seening is you opt out easily enough, but there's a subtly hidden tab called 'legitimate interest' and every ad network claims to have a legitimate interest in harvesting your data, even though you've got no business relationship with them. What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.

Yeah, people should start reporting these sleazy sites to their authorities if in the EU. I'm hoping that GPDR enforcement will eventually get up to speed.

Re: No Cookie for You

#170

Post by lez » Thu, Dec 17, 2020, 6:16 PM UTC

kixiQu wrote: post #136

thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

Yeah, I always wonder why this can't be handled like "prefers-dark-mode" and then the answer is always "because then who would let them do it"

What keeps back Mozilla to implement this setting and lobby for a general Web API for expressing cookie consent? As far as I can tell, their users would be extremely happy about that.