Title should be "Github admits abusing users with non-essential cookies".
No Cookie for You
211–220 of 634 posts
Re: No Cookie for You
#212Earlier quoted context omitted.
This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…
The new one I'm seening is you opt out easily enough, but there's a subtly hidden tab called 'legitimate interest' and every ad network claims to have a legitimate interest in harvesting your data, even though you've got no business relationship with them. What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.
I always look for that - and the 'deny all' button.
They do not have a 'legitimate interest' to track the hell out of me.
Re: No Cookie for You
#213I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."
I hate the implication that those banners are some sort of consent. They're so commonplace now that people blindly click 'okay' or close them just to be able to read the site. If the wording was something else ("you agree that we can take your first born child") would it even hold up? The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.
The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.
Some sites don't even give you a "Disagree." Liberty of London has no way to opt-out: "By closing this box or by clicking accept and close, you agree to our use of cookies."
Re: No Cookie for You
#214I wish there was a browser option "I don't care about being tracked" and that would get rid of all cookie banners (and, more often than not, full page popups). This EU law comes from a good idea, but it's terribly implemented - it implies that everybody out there is a lawyer and can make sense and agree on multiple pages of confusing legalese, and this every time they open a new website. This is so absurd, and the re…
The EU law does not require these multiple pages of legalese. Not even a little bit.
In fact it says "it shall be as easy to withdraw as to give consent".
So you shouldn't attribute complexity to the EU law, when the law actually insists on simplicity.
It's a myth that the GDPR requires complex forms, or even just banners. One that website operators (mainly 3rd party advertisers and trackers who provide the banners/popups to sites) would like you to believe.
A genuine GDPR-compliant banner/popup is much simpler.
In fact you can make a GDPR-compliant site without any banner/popup/form at all, while still using cookies, logins, shopping carts and analytics etc. You just need to do it in a privacy-respecting way, which isn't hard.
The complexity is website operators attempt to half-comply and half-violate the law, frustrate and arm-twist users into something most people would not agree to if it was easy to decline. The obnoxious complexity is deliberate, to annoy and frustrate you so that you give in to the "easy" option they very much want you to "choose".
Re: No Cookie for You
#215Earlier quoted context omitted.
Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.
I feel that browsers should implement a permissions grant pop-up for when a site attempts to set a cookie with SameSite=none, and the cookie api can be extended to enable explanations to be given by the developer.
This essentially moved the banner into the browser, and will make will make ad networks tell websites to not use SameSite=none, but use SameSite cookies and tell those ad networks behind the scenes. There are plenty of ads now already that are seemingly first party hosted (and go as far as transmitting the ad content through e.g. websockets to avoid adblocker detection).
Re: No Cookie for You
#216Earlier quoted context omitted.
Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.
This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…
Once, and only once, since GDPR was implemented, I found a banner that was actually compliant with the GDPR. It defaults to allowing only necessary cookies, requires affirmative consent before any other cookies are used, and makes rejection of tracking have no additional steps compared to accepting tracking. Every other banner I have seen will violate those in some way, either saying that continued use of the site constitutes acceptance, or requiring unchecking of several boxes before clicking accept, or requiring going to dozens of affiliate websites in order to search out and disable tracking settings there.
As in, this is the first GDPR banner I've seen that is actually legal under the GDPR.
Re: No Cookie for You
#217Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics API at GitHub for augmenting and cross-referencing user data.
The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com.
The privacy policy page which lists third party data subprocessors and cookies used on GitHub [1] seems to be outdated. Does the announced change also mean that Google Analytics and other subprocessors have been eliminated, or has some of the tracking merely moved server-side?
[1] https://docs.github.com/en/free-pro-team@latest/github/site-...
Re: No Cookie for You
#218[deleted]
Re: No Cookie for You
#219Earlier quoted context omitted.
True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets
Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?
you can see the exact method on our data policy: https://plausible.io/data-policy
Re: No Cookie for You
#220Or they could use localStorage instead, which is a superior storage mechanism.