Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear Paul Graham, there is no cookie banner law

amazingcto.com

Post reply on HN
Print view View original

211–220 of 662 posts

Re: Dear Paul Graham, there is no cookie banner law

#211

Post by layer8 »

cbeach wrote: post #117
whywhywhywhy wrote: post #51

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have jus…

Exactly this. The law could have been written in such a way that we could use a browser setting and avoid incessent popups which irritate users and desensitise them to genuinely useful warnings. Whatever the good intentions of EU lawmakers, they seem inept at technical legislation because they ALLOW companies to continue doing shady things, and rather than tackle it, the legislators create a law that merely annoys us…

The GDPR doesn't prohibit such a browser setting to exist and to be applied. The GDPR however also isn't a technical standard that would prescribe any specific technical protocol.

Re: Dear Paul Graham, there is no cookie banner law

#212

Post by skrebbel »

arbuge wrote: post #89

"Companies could easily avoid any cookie banner. Just don’t track." It seems like a point dear to the author's heart, given the way he highlights this and puts it in bold at the top of the article. But while it sounds good on the surface, it doesn't take much digging to show it's silly. If you store any kind of data about a visitor to make their life more convenient, is that tracking? Shopping carts? Notification pre…

The law takes these things into account just fine. It's not a cookie law, it's a tracking law, and the "tracking" isn't about the technical meaning of "to track" but about the way the data is used (and could be used).

It's not "you're not allowed to store anything about the visitor without their consent", it's "you're not allowed to track them across your site, or share that data with others, except if it's directly necessary to provide the service". That last part refers to session tokens, shopping carts, and yes, also to remembering the "no tracking" choice. If you ask a site to remember something (such as "no tracking plz" or "I want to buy this product" or "keep me logged in plz") then that's explicitly asking it to do something that in technical terms is tracking, but not in operational terms.

It's like, the EU makes a new law that makes it illegal to break into people's houses, and all the pedantic HN'ers start saying "but this is stupid! what if you lose your key? you need to be able to hire a locksmith to let you back in!". That's obviously not how the "no break-ins" laws work, and it's also not how the GDPR works wrt tracking.

If you break the GDPR, there's a fair set of warnings before you can actually get the kinds of humongous fines that the law is infamous for. This means to me, as an entrepreneur, that if I follow the intent of the law as best I can, then worst case scenario if we still get it wrong, then there's a big enough chance we're in the clear. And then if somehow we do get a warning from the local privacy authority, we learn and adjust. This is fine.

We don't need to be maximally pedantically safe. We just gotta not track people and then we don't need a cookie banner. It's great.

Re: Dear Paul Graham, there is no cookie banner law

#213

Post by 63stack »

boxed wrote: post #91
whywhywhywhy wrote: post #51

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have jus…

The law isn't that bad actually, just that the courts have been very slow. The dark UI patterns are actually illegal and have been judged so in court now. This realization just has to trickle down to the companies writing these cookie banners.

  * There was an option of making this non-intrusive, by requiring it to be a browser setting, they chose not to  
  * The law went into effect ~6 years ago  
  * Companies still break the law by employing dark patterns
My take is that it makes both the law, and the courts bad.

Re: Dear Paul Graham, there is no cookie banner law

#214

Post by K0nserv »

whywhywhywhy wrote: post #51

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have jus…

I wrote something elsewhere in the thread about this[0]. I don't think laws mandating specifics of implementations at the level of browser settings is a good idea. To your point about government employees not being competent I don't trust them to get that right. Companies could work with browser makers to fix this but, as the OP points out, they don't want to.

In my opinion the EU's big failure with GDPR has been slow and ineffective enforcement against blatantly illegal implementations.

0: https://news.ycombinator.com/item?id=39742989

Re: Dear Paul Graham, there is no cookie banner law

#215

Post by toyg »

cbeach wrote: post #117
whywhywhywhy wrote: post #51

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have jus…

Exactly this. The law could have been written in such a way that we could use a browser setting and avoid incessent popups which irritate users and desensitise them to genuinely useful warnings. Whatever the good intentions of EU lawmakers, they seem inept at technical legislation because they ALLOW companies to continue doing shady things, and rather than tackle it, the legislators create a law that merely annoys us…

> they ALLOW companies to continue doing shady things

No they don't. But enforcement requires complaints, actions, and budgets. Remember that the EU has no police, it's down to national governments to enforce regulations.

Also, take fraud. There are plenty of laws against fraud in any country - and still it happens every day in one way or another. That's not because all fraud laws are bad, but because enforcement is complex and costly.

Re: Dear Paul Graham, there is no cookie banner law

#216

Post by crabmusket »

iEchoic wrote: post #136
crabmusket wrote: post #98

Earlier quoted context omitted.

Shopping carts and notification preferences don't require a consent banner.

Our lawyers told us otherwise. Regardless of the answer here, the fact that there's still a debate about what basic functionality requires a cookie banner is really a testament to how bad this legislation is. How long has this been around, 20 years? And there's still widespread debate and lack of understanding as to what specific functionality requires a cookie banner?

Fair, I can't argue with that. It's definitely a shame.

Re: Dear Paul Graham, there is no cookie banner law

#218

Post by paulryanrogers »

leononame wrote: post #41
ianlevesque wrote: post #2

The funny thing about legislation is that you're responsible for the unintended consequences of your laws too.

Yes and no? To some extent, sure. As an example: But if companies or people went out of their way to comply with a law that is clearly not complying with the spirit of the law, just the letter of it, are you really responsible for that? Or are they because they're doing everything to not comply? Let's say you make a law to reduce working hours from 40 to 37 hours except in "emergency situations". Now a company will f…

Bonus points if you can convince folks to call it the annoying Sign Off law.

Re: Dear Paul Graham, there is no cookie banner law

#219

Post by rsp1984 »

> Just don’t track.

You're making it sound like it was a switch that I could simply turn on/off as a web dev. The reality is that most sites are a complete clusterf*k of 3rd party components, dependencies, backend services etc.

Doing an audit of which of these components are compliant with tracking / cookie laws is just not a realistic ask. Hence why devs decide to just tack on a cookie banner and call it a day.

Re: Dear Paul Graham, there is no cookie banner law

#220

Post by layer8 »

cbeach wrote: post #196
madsbuch wrote: post #182

Earlier quoted context omitted.

it would be horrible regulation if you tell how to comply instead of telling what to comply with. as written elsewhere (since you obviously didn't read anything) your proposed solution would be just fine. But people opted out of impmenting it that way since it would yield less profit.

Show me the section of the ePrivacy Directive (Directive 2002/58/EC) or GDPR that implies the "Do Not Track" browser setting can override the need for consent banners / popups.

DNT wouldn't work, but a hypothetical "yes, please feel free to track me" setting would, if standardized by browser vendors and implemented appropriately (i.e. ensuring user consent).
Post reply on HN