No Cookie for You • Hacker News Board

Re: No Cookie for You

#221

Post by reaperducer » Thu, Dec 17, 2020, 6:35 PM UTC

mirekrusin wrote: post #92

s14ve wrote: post #86

Earlier quoted context omitted.

This wording should be required by GDPR. :) If that would be the case, maybe more sites would follow GitHub here.

Yes, like on cigarette boxes with mandatory, non-dark pattern, visible without scrolling 3 meters button to choose "Don't agree, Continue".

Yes, like on cigarette boxes with mandatory, non-dark pattern, visible without scrolling 3 meters button to choose "Don't agree, Continue".

And then Facebook takes out full-page ads attacking your company for allegedly hurting "small business."

Re: No Cookie for You

#222

Post by Justsignedup » Thu, Dec 17, 2020, 6:36 PM UTC

thomascgalvin wrote: post #128

random5634 wrote: post #103

Earlier quoted context omitted.

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

they sort of opt in. its pretty ingenious really.

1-click to opt-in.

multi-click and losing your current page to opt-out.

Re: No Cookie for You

#223

Post by einarfd » Thu, Dec 17, 2020, 6:36 PM UTC

sildur wrote: post #48

fluidcruft wrote: post #34

Earlier quoted context omitted.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

Implementing session handling as URL parameters makes no difference from a legal perspective. It will be covered by the law excatly the same as if one used cookies. It's the tracking the law is about, not the implementation of it. Your just picking a worse technical solution for no legal gain.

Re: No Cookie for You

#224

Post by Animats » Thu, Dec 17, 2020, 6:36 PM UTC

thomascgalvin wrote: post #128

random5634 wrote: post #103

Earlier quoted context omitted.

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

My favorite of the week: Doordash. Doordash does not use two-factor authentication, except for one thing: opting out of having your data sold. For that, it sends an SMS message to your phone. Since I signed up for them using a landline, the SMS message is lost.

Re: No Cookie for You

#225

Post by MereInterest » Thu, Dec 17, 2020, 6:36 PM UTC

pdpi wrote: post #183

tornato7 wrote: post #152

Earlier quoted context omitted.

If a company is going to lie or skirt the law about their cookie use, why show the banner at all? It's almost worse to show a decline option that does nothing.

It's basically a form of malicious compliance.

Malicious compliance is still compliance. Somebody being told "Please watch the pressure gauge." and then staring at it as it goes outside of safe regions is doing exactly what they were asked to do. This is blatant noncompliance with the thinnest veneer of respectability.

Re: No Cookie for You

#226

Post by thewebcount » Thu, Dec 17, 2020, 6:36 PM UTC

interestica wrote: post #145

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

I hate the implication that those banners are some sort of consent. They're so commonplace now that people blindly click 'okay' or close them just to be able to read the site. If the wording was something else ("you agree that we can take your first born child") would it even hold up? The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking the law.

Re: No Cookie for You

#227

Post by munchbunny » Thu, Dec 17, 2020, 6:37 PM UTC

lez wrote: post #170

kixiQu wrote: post #136

Earlier quoted context omitted.

Yeah, I always wonder why this can't be handled like "prefers-dark-mode" and then the answer is always "because then who would let them do it"

What keeps back Mozilla to implement this setting and lobby for a general Web API for expressing cookie consent? As far as I can tell, their users would be extremely happy about that.

That existed. https://en.wikipedia.org/wiki/Do_Not_Track

It failed horribly because it was voluntary. But now that it's a GDPR requirement, perhaps that might have a snowball's chance in hell of succeeding.

Re: No Cookie for You

#228

Post by scarlac » Thu, Dec 17, 2020, 6:37 PM UTC

prima-facie wrote: post #220

Or they could use localStorage instead, which is a superior storage mechanism.

localStorage and cookies are the same in terms of GDPR. It encompasses all local storage mechanisms such as IndexedDB, cookies, localStorage, sessionStorage, etc.

(source: I read the directive way back when it came out, and also skimmed large sectoins of GDPR)

Other sources: https://softwareengineering.stackexchange.com/questions/2905... and https://law.stackexchange.com/questions/30739/do-the-gdpr-an...

Re: No Cookie for You

#229

Post by markonen » Thu, Dec 17, 2020, 6:37 PM UTC

mattmanser wrote: post #137

thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

The new one I'm seening is you opt out easily enough, but there's a subtly hidden tab called 'legitimate interest' and every ad network claims to have a legitimate interest in harvesting your data, even though you've got no business relationship with them. What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.

The absolutely funniest interpretation of ”legitimate interest” is in a recurring spam message I get from (of all things) an email lead marketing company.

They have small print after each of their emails that says that GDPR allows them to email me because they believe I might be legitimately interested in purchasing their services.

Re: No Cookie for You

#230

Post by privacylawthrow » Thu, Dec 17, 2020, 6:37 PM UTC

oneplane wrote: post #173

> EU law requires you to use cookie banners if your website contains cookies that are not required for it to work. No it doesn't. EU Law requires you to not harvest data at will, and you either must have a basic functional requirement (i.e. 'remember my login'), or you must ask the user if you can have their data to profile them so the advertisements can make a few percent more money (yes, the whole profiling thing d…

This is wrong. EU law absolutely does require cookie banners if a website uses non-essential cookies, even if those cookies are not used to harvest data.