No Cookie for You • Hacker News Board

Re: No Cookie for You

#231

Post by krsdcbl » Thu, Dec 17, 2020, 6:38 PM UTC

I find it staggering how misunderstood GDPR seems to be at large.

First and foremost, it's not about cookies. EU laws required you to inform visitors about "cookies" and have them acknowledge them long before GDPR passed into law.

Second, it's not about third parties or required cookies vs. marketing cookies.

What the law actually states is that you may not, in any form, make individuals using your service identifiable or track them without prior informed and active consent by the visitor, and you also may not make such consent mandatory for accessing your publications content. plain and simple.

all the "cookie banners" out there are ONE form of solving this problem but are in no way mandated by law. If you find another way of solving this issue, all the better.

But the way these banners are designed and implemented at large are geared towards soliciting consent by means of obfuscating actual selection (think: bright "accept all" buttons with tiny "save settings" links) and by making it hard and tedious to actually select and submit your preferences (think: giant lists of all trackers with opt-out for legitimate interest and optin for consent side by side). These are in clear violation of what the law states imho and are largely in use because there is still no juridical precedent that clarifies what goes and what doesn't.

what we are experiencing is a clash of ethical mandate and economical interest. GDPR is aimed at protecting you, the user, from beeing identified and tracked along your wen history, be it by cookies or fingerprint or whatever.

dropping functional cookies for logged in users is perfectly fine though, as registration itself is likely a process where users can be informed of such personal identification and is an active decision by the user.

saying "the site needs it to function" and tracking users first party only is NOT a way around GDPR, as much as this narrative gets retold.

in short: it's not about cookies and third parties. The law is purposefully formulated in a way that isn't scoped on technicalities and seeks to prevent such "workarounds".

I would love to see more details disclosed by GitHub about HOW exactly they implemented this, as i am certain they have enough professional legal councel to have digged deep into this question.

Re: No Cookie for You

#232

Post by jedberg » Thu, Dec 17, 2020, 6:38 PM UTC

dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Part of the problem is that when it first passed, the advice was to just add a cookie banner no matter what to be safe, since no one really understood the law and exactly when it did or did not apply.

Re: No Cookie for You

#233

Post by buckmar » Thu, Dec 17, 2020, 6:39 PM UTC

heroprotagonist wrote: post #141

This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties. Presumably Microsoft has access to those metrics, though? I wonder how deeply that…

That's a good point. Microsoft has been much less heavy handed than I expected. But your point about how the data is used, I am very curious too. I wonder if they'd be willing to make the privacy policy readable?..

Re: No Cookie for You

#234

Post by danudey » Thu, Dec 17, 2020, 6:39 PM UTC

random5634 wrote: post #103

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

> Then browser vendors can ship a delete all non same origin cookies on tab close or something.

That doesn't prevent Facebook or Twitter or advertisers in general from tracking you across dozens of pages or more, it just means that they'll have to issue you a new cookie each session.

Re: No Cookie for You

#235

Post by bouk » Thu, Dec 17, 2020, 6:39 PM UTC

The EU cookie ban should've just been a ban on third-party cookies, then we wouldn't be in this mess. Props on GitHub for following the rules right!

Re: No Cookie for You

#236

Post by tt433 » Thu, Dec 17, 2020, 6:39 PM UTC

reaperducer wrote: post #202

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

You sound like the guy who wrote this: "We're not going to lie to you. Your privacy isn't our priority. It's not even close. Not because we want to track your every move. But because we simply don't care. We'd rather spend what limited time we have actually improving the web site. We're into taking pictures and adding content, not obsessing over what your dog had for lunch so we can sell it to MegaEnormousBigCo. We'r…

Gotta love some good customer flattery

Re: No Cookie for You

#237

Post by tgb » Thu, Dec 17, 2020, 6:41 PM UTC

munchbunny wrote: post #195

tgb wrote: post #130

Earlier quoted context omitted.

But wouldn't that consent be in the EULA? So long as they only track logged-in people, they'd have agreed to that.

No, it wouldn't be in the EULA. There are two parts of GDPR that would specifically go against putting consent to tracking in the EULA: 1. GDPR requires the consent check to be somewhere obvious and in plain language. That was specifically to deal with EULA's given to you in tiny legally compliant text boxes. 2. GDPR requires that you cannot make consent for non-essential usages of data mandatory as a condition for p…

But wouldn't that be asked for at the same time as signing the EULA, i.e. at account creation? If you're avoiding banners, I can't think where else you'd put it.

Re: No Cookie for You

#238

Post by kawsper » Thu, Dec 17, 2020, 6:42 PM UTC

kixiQu wrote: post #136

thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

Yeah, I always wonder why this can't be handled like "prefers-dark-mode" and then the answer is always "because then who would let them do it"

It can, first iteration used the Do-not-track header, but that died in the standardization process, now there are a movement for the Global Privacy Control header that you can read about here: https://globalprivacycontrol.org/

Re: No Cookie for You

#239

Post by baxtr » Thu, Dec 17, 2020, 6:43 PM UTC

Nextgrid wrote: post #156

baxtr wrote: post #72

Earlier quoted context omitted.

I really wonder genuinely if the regulation has improved anything at all. I just click through the banners without even thinking. It has become so annoying. The value I get is below zero. I wonder if the majority is like me.

The regulation explicitly forbids annoying banners, the problem is that there’s currently zero enforcement of it so websites continue breaching it and lying to themselves (and others) by thinking their consent banners are compliant.

But that’s exactly my point. Why regulate if things get worse. If you regulate think about enforcing beforehand. What’s the use?

Re: No Cookie for You

#240

Post by Sebb767 » Thu, Dec 17, 2020, 6:44 PM UTC

lez wrote: post #170

kixiQu wrote: post #136

Earlier quoted context omitted.

Yeah, I always wonder why this can't be handled like "prefers-dark-mode" and then the answer is always "because then who would let them do it"

What keeps back Mozilla to implement this setting and lobby for a general Web API for expressing cookie consent? As far as I can tell, their users would be extremely happy about that.

Because it won't take off. Right now, the advertisers are basically hoping for you to be too lazy to click around ten minutes to find the 'no'-option. If every user would be presented with a fairly weighted chance once, hardly anyone would click yes. Accepting this standard would undermine their business even more.