No Cookie for You • Hacker News Board

Re: No Cookie for You

#261

Post by asimops » Thu, Dec 17, 2020, 7:02 PM UTC

What I would wish is for the next iteration of the law to mandate a standard way of opting in. From looking at the real world, there are several categories for cookies. Technically, tracking, okay I can only think of two. A standard opt-in procedure could client side set a cookie with a certain level of consent for each page at the browser level. A default setting for this can then be set globally in the browser. A site specific setting could then be overwritten by the server or the browser UI.

You could then nicely ask your users to agree to tracking in the places where there were the privacy intrusion banners of the shady tracking networks.

Re: No Cookie for You

#262

Post by lmkg » Thu, Dec 17, 2020, 7:03 PM UTC

tgb wrote: post #237

munchbunny wrote: post #195

Earlier quoted context omitted.

No, it wouldn't be in the EULA. There are two parts of GDPR that would specifically go against putting consent to tracking in the EULA: 1. GDPR requires the consent check to be somewhere obvious and in plain language. That was specifically to deal with EULA's given to you in tiny legally compliant text boxes. 2. GDPR requires that you cannot make consent for non-essential usages of data mandatory as a condition for p…

But wouldn't that be asked for at the same time as signing the EULA, i.e. at account creation? If you're avoiding banners, I can't think where else you'd put it.

If a cookie is not necessary (or you are using a necessary cookie for secondary purposes), then you need GDPR-valid consent. This means:

1. Consent must be separate from other terms being agreed to. So consent in the EULA would not be valid.

2. Consent must be an affirmative, unambiguous action. Pre-ticked boxes or bundled consent are not valid.

3. Consent can be revoked at any time. Revoking consent must be as easy as giving it.

So yes, you can ask for it from a user when you're having them agree to the EULA. However you can't have it as part of the EULA, it has to be an optional add-on. And you still need to let people turn it off afterwards.

Re: No Cookie for You

#263

Post by kevin_thibedeau » Thu, Dec 17, 2020, 7:03 PM UTC

oneplane wrote: post #173

> EU law requires you to use cookie banners if your website contains cookies that are not required for it to work. No it doesn't. EU Law requires you to not harvest data at will, and you either must have a basic functional requirement (i.e. 'remember my login'), or you must ask the user if you can have their data to profile them so the advertisements can make a few percent more money (yes, the whole profiling thing d…

The cookie law predates GDPR.

Re: No Cookie for You

#264

Post by dullgiulio » Thu, Dec 17, 2020, 7:03 PM UTC

munchbunny wrote: post #227

lez wrote: post #170

Earlier quoted context omitted.

What keeps back Mozilla to implement this setting and lobby for a general Web API for expressing cookie consent? As far as I can tell, their users would be extremely happy about that.

That existed. https://en.wikipedia.org/wiki/Do_Not_Track It failed horribly because it was voluntary. But now that it's a GDPR requirement, perhaps that might have a snowball's chance in hell of succeeding.

No, it failed because it acts on the wrong side. If you don't want to be tracked you shouldn't send cookies in your request.

Re: No Cookie for You

#265

Post by kennywinker » Thu, Dec 17, 2020, 7:05 PM UTC

prima-facie wrote: post #220

Or they could use localStorage instead, which is a superior storage mechanism.

I’m not a lawyer, but I’d be shocked if you could get around gdpr by using a different api. If gdpr was actually limited to `document.cookie` and `Set-Cookie` it’d be a laughable attempt to protect users.

Re: No Cookie for You

#266

Post by layer8 » Thu, Dec 17, 2020, 7:06 PM UTC

jedberg wrote: post #232

dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Part of the problem is that when it first passed, the advice was to just add a cookie banner no matter what to be safe, since no one really understood the law and exactly when it did or did not apply.

The banners are an opportunity to have the user consent to more than they would otherwise consent to (“allow all”).

Re: No Cookie for You

#267

Post by ocdtrekkie » Thu, Dec 17, 2020, 7:06 PM UTC

atoav wrote: post #208

OzzyB wrote: post #181

Earlier quoted context omitted.

> the entity cannot offer a degraded service Does this mean that sites that offer free but ad-supported content still have to offer that content? So I can watch those free Youtube movies and listen to those Spotify tracks ad-free because EU Law says fuck you . How is this fair? Edit: Okay, okay, non-targeted (and no 3rd party) ads are okay, got it xD

Billboards, newsletter ads, flyers etc won't track whether you look at them as well, and last time I checked print advertisement still kinda sold. Tracking is not necessary to show ads. Certainly there are business models which depend on this, but hey who says our society benefits from those? Targeted advertisement and free informed democracies don't mix well IMO.

Especially ironically, Facebook has been taking out newspaper ads to whine about how it needs targeted advertising to survive, and how mean Apple is harming them.

Re: No Cookie for You

#268

Post by mewpmewp2 » Thu, Dec 17, 2020, 7:07 PM UTC

reaperducer wrote: post #202

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

You sound like the guy who wrote this: "We're not going to lie to you. Your privacy isn't our priority. It's not even close. Not because we want to track your every move. But because we simply don't care. We'd rather spend what limited time we have actually improving the web site. We're into taking pictures and adding content, not obsessing over what your dog had for lunch so we can sell it to MegaEnormousBigCo. We'r…

This honesty is refreshing.

Re: No Cookie for You

#269

Post by wpietri » Thu, Dec 17, 2020, 7:07 PM UTC

jedberg wrote: post #241

abdullahkhalids wrote: post #121

Earlier quoted context omitted.

> How can Plausible Analytics count unique visitors without cookies? > So if you don’t use cookies how do you count the number of website visitors and report on metrics such as the number of unique users? > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippet…

A one way hash of an IPv4 address is no more private than the address itself. If you know the has algorithm, you can build a rainbow table of all the hashes in under a second. Even with a random salt it doesn't take long to build a rainbow table with all possible salts.

Doesn't that depend on the size of the salt?

Re: No Cookie for You

#270

Post by type0 » Thu, Dec 17, 2020, 7:09 PM UTC

swyx wrote: post #186

interestica wrote: post #145

Earlier quoted context omitted.

I hate the implication that those banners are some sort of consent. They're so commonplace now that people blindly click 'okay' or close them just to be able to read the site. If the wording was something else ("you agree that we can take your first born child") would it even hold up? The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.

disagree button is the "Close" button unfortunately.

and often it works like - please leave the site nothing here for you button. Amazing how irl businesses use such types of third party booking systems with ads and other crap showed down your throat, that's for anything from hairdressers to carpenters, one would think at least they don't require you to login via fb, ah waaaait, some of them do. The web dystopia is here now, enjoy it.