Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

251–260 of 634 posts

Re: No Cookie for You

#251

Post by type0 »

jwr wrote: post #169
mattmanser wrote: post #137

Earlier quoted context omitted.

The new one I'm seening is you opt out easily enough, but there's a subtly hidden tab called 'legitimate interest' and every ad network claims to have a legitimate interest in harvesting your data, even though you've got no business relationship with them. What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.

Yeah, people should start reporting these sleazy sites to their authorities if in the EU. I'm hoping that GPDR enforcement will eventually get up to speed.

Except that those authorities are often stripped of resources toothless organizations often made to serve as digital potemkin villages to the public, everyone knows this and can't be bothered one second of their life to be wasted on that bs.

Re: No Cookie for You

#252

Post by rndgermandude »

lmkg wrote: post #203
smarx007 wrote: post #41

Earlier quoted context omitted.

No, it applies to every resident in EU and EU citizens all over the world. Edit: https://gdpr-info.eu/art-3-gdpr/ ("where Member State law applies" and "subjects who are in the Union" [...] "regardless of whether the processing takes place in the Union or not" respectively) Edit 2: https://gdpr.eu/companies-outside-of-europe/ for more info: "The whole point of the GDPR is to protect data belonging to EU citizens and…

The cookie banner is NOT regulated by the GDPR. It's related to the ePrivacy Directive, which is deeply intertwined with GDPR but a separate piece of legislation. It's not clear whether the GDPR's territorial applicability also holds for ePD. France in particular is drawing a divide between GDPR and ePD, because ePD lets them fine Google directly but GDPR require they mediate through the Irish DPA.

The "cookie law" as part of the ePD is indeed older than the GDPR, but the GDPR kinda supersedes it by including all tracking/data collection not just cookie data collection.

It's also not entirely correct that the GDPR would require going through the Irish DPA or wherever a company in violation has their primary EU presence for tax purposes. True, the GDPR says the nation where a company has the primary presence of business within the EU take lead within the EU should take lead, but the French courts figured out that Google's Irish subsidy is actually not making any decisions, the US parent is, and therefore it's fine for the French watchdog to issue fines skipping Ireland [1].

[1] https://techcrunch.com/2020/06/19/french-court-slaps-down-go...

Re: No Cookie for You

#253

Post by anticensor »

smarx007 wrote: post #91
outside1234 wrote: post #79

Earlier quoted context omitted.

They can't apply EU law to citizens residing outside of the union.

Well, somehow we in EU have to comply with DMCA, which is not an EU law. Every company that _does business in_ EU can get in trouble for not following EU law irrespective where it violated that law.

EU has DOCDSM instead.

Re: No Cookie for You

#254

Post by robgibbons »

Bakary wrote: post #180
robgibbons wrote: post #116

I understand the need for GDPR, but its consequence of obtrusive cookie consent banners is easily one of the worst things to happen to the web in recent memory.

That's like blaming the flashlight for revealing rats under the kitchen sink

I'm not blaming the popups. I'm lamenting the fact that every damn site opens with a pop-up now. They are the negative consequence of an otherwise well-meaning bill.

As good as GDPR was for privacy, it's equally bad for UX.

Re: No Cookie for You

#255

Post by privacylawthrow »

Much of the statements about cookie requirements in this thread are wrong.

The rule is simple: If a website uses non-essential cookies, it must inform users and, in most EU jursidctions, collect consent prior to placing a cookie on the user's machine.

The rationale behind the rule is that companies should not store company information on end-user devices without the user's consent. The rule applies to all non-essential cookies regardless of whether the cookies collect personal data or are used for tracking. The rule does not cover cookieless server-side tracking of users. Sites do not violate the law when they track users without consent using server-side tools. Sites do violate the law even without tracking users if the site does not collect consent for non-essential cookies.

GDPR enhanced the cookie rules by applying GDPR consent requirements to all cookies that involve personal information. Many sites ignored the old cookie rule because EU law did not give data protection authorities much enforcement power. GDPR increased the power of the DPAs to issue fines of up to 4% of annual turnover. Sites previously ignoring the rules put out cookie banners once GDPR came into effect.

edit: To be clear, Github isn't saying that it stopped tracking users. It's saying that it doesn't do cookie-based tracking and therefore it does not need a banner.

Re: No Cookie for You

#257

Post by layer8 »

random5634 wrote: post #103
AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

> Why not just let browsers control who sets what cookies?

Browsers wouldn’t fall for dark patterns.

Re: No Cookie for You

#258

Post by oauea »

Wowfunhappy wrote: post #147
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing…

> not self hosted

you'll need a cookie banner then

Re: No Cookie for You

#259

Post by Semaphor »

dorgo wrote: post #246
thewebcount wrote: post #226

Earlier quoted context omitted.

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking the law.

the law requries either consent or legitimate interest ( there are even more options - but not relevant here ). So they can track you without consent and not breaking the law.

There are somewhat strict rules of what is legitimate interest. And sending data to a US company (Google Analytics) even requires some extra steps beyond normal consent, now that the privacy shield has been scrapped.

Re: No Cookie for You

#260

Post by eitland »

jwr wrote: post #169
mattmanser wrote: post #137

Earlier quoted context omitted.

The new one I'm seening is you opt out easily enough, but there's a subtly hidden tab called 'legitimate interest' and every ad network claims to have a legitimate interest in harvesting your data, even though you've got no business relationship with them. What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.

Yeah, people should start reporting these sleazy sites to their authorities if in the EU. I'm hoping that GPDR enforcement will eventually get up to speed.

I have now started reporting stuff. It was easier than I thought :-)
Post reply on HN