Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kill The Cookie Banner

killthecookiebanner.eu

Post reply on HN
Print view View original

331–340 of 621 posts

Re: Kill The Cookie Banner

#331

Post by xp84 »

thom wrote: post #242
ryukafalz wrote: post #156

Earlier quoted context omitted.

> But in many cases, you could just click "reject" and the banner would also disappear... Oftentimes the reject flow is substantially more annoying than the accept flow. I click reject myself when it's an option, but I can absolutely understand how people might get conditioned to click accept when clicking reject might result in more popups.

A lot of UK sites (Reach local news stuff) now explicitly say take cookies or pay, which tbh I always thought was illegal.

It's wild to me that anyone thinks that would be a reasonable law (whether or not it is law, I have no clue, I don't live in UK or EU).

If you made a website and you said "To view the private content on my website, you have to either pay me, or sign a name, any name you wish, in my guestbook" what business is it of the government to say "No, this random person refuses to pay or sign the book, but Thom, you have to let them see all your articles anyway."

Note that I used "sign any name" as the metaphor, not "show ID," since it is trivial to not allow any important information exchange if you simply delete the cookies yourself, which is easy to configure a browser to do. The end-user has the choice, if it's so important to them, to configure their browser. Even Chrome can be configured for which sites to allow cookies, which to disallow, and which to clear when the browser closes (the smart choice, since accepting them and throwing them away soon after is the undetectable option that accomplishes your main aim).

Re: Kill The Cookie Banner

#332

Post by Phemist »

frollogaston wrote: post #176
Phemist wrote: post #28

Earlier quoted context omitted.

Malicious compliance. You do not need a cookie to "store" the fact you have rejected them. They can simply assume you have rejected them from the lack of cookies. They can store a cookie once you (have gone out of your way to) accept them.

Lack of cookies could mean you never visited the site before.

Safe to assume I reject things on my first visit as well

Re: Kill The Cookie Banner

#333

Post by inigyou »

dotancohen wrote: post #319
inigyou wrote: post #217

Earlier quoted context omitted.

Well for instance if the other party is pressuring you to sign it then it can't be assumed that you had adequate time to read it and understand it

Contract law of every civilised land already has a process for considering and accounting for duress.

It only accounts for "sign this or I'll kill you" not for "you have ten seconds to make a decision or the dream vacation goes to the next person"

Re: Kill The Cookie Banner

#334

Post by donaltroddyn »

xp84 wrote: post #288
kleiba2 wrote: post #143

Earlier quoted context omitted.

> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data…

It literally does not matter what you pick on these things - most of them don't work anyway. Think about it: Of course they don't. All the third-party javascript is already on the page. Anything you do inside the sandbox with UI provided by, usually, some other third-party, can't just magically force all that other code to behave in a specific way, unless someone has done a great deal of work to integrate the cookie…

I think you're right that many (most?) CMPs are broken, though usually not deliberately. Most try to gate analytics and ad tracking on consent, just often misconfigured. The common exception is companies that deliberately hide Reject All, which is not complaint

My company scanned 209 European regulated sites in June, and roughly 7 in 10 had tracking that wasn't correctly gated by consent. It's rarely indifference, though. DPOs in the EU hold too much weight for that. It's usually a tag added that was never wired into the CMP or something added by a dev or LLM without going through proper review

Full disclosure: I run https://consentmark.com, which measures what tags actually fire under each consent state to create evidence packs companies can show regulators

Re: Kill The Cookie Banner

#335

Post by SlightlyLeftPad »

kleiba2 wrote: post #143
chrismorgan wrote: post #60

The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/or clicking a button cannot constitute informed consent”; and see what they try next.) From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them…

> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data…

There is also the fact that by rejecting, the cookie that remembers that preference expires after like a day, so you have to click that dumb banner almost every time you visit the site.

Re: Kill The Cookie Banner

#337

Post by jebronie2 »

tcfhgj wrote: post #29
TechSquidTV wrote: post #14

The EU has been on a decade-long crusade to destroy the internet.

Advertisement has been on a decade-long crusade to destroy the internet.

Advertising funds large parts of the open internet. Killing ad means killing independent content creators for example. Over-regulation and censorship like "chat-control", that only benefits big players like Amazon, Meta etc. is what kills the internet.

Re: Kill The Cookie Banner

#338

Post by fnord123 »

xp84 wrote: post #328
fnord123 wrote: post #203

Earlier quoted context omitted.

> To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning. There is one. It's a DNT header. Knucklehead websites ignore it.

Because it doesn't mean anything specific and breaks entire business models (merely logging that you landed from an ad click and seeing if you check out counts as 'tracking,' doesn't it?) if interpreted purely literally. So, the only way to treat it is to either ignore it or to just send back an error code and message that says "Sorry, having some tracking is the condition to get this free content. Accept or don't."…

> "Sorry, having some tracking is the condition to get this free content. Accept or don't."

The law that caused the cookie banners also says companies cannot block access to the site if the cookies are not required for the functioning of the site.

Some German news sites have broken this and have "accept or pay" and I think this leaked to news sites in other countries. Facebook even tried it.

So, sure, if DNT is true, try to make people pay. Fine by me.

Re: Kill The Cookie Banner

#339

Post by gbalduzzi »

SlightlyLeftPad wrote: post #335
kleiba2 wrote: post #143

Earlier quoted context omitted.

> it’s well-understood that very few people actually read those things, they just want to get them out of the way. This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data…

There is also the fact that by rejecting, the cookie that remembers that preference expires after like a day, so you have to click that dumb banner almost every time you visit the site.

And that is malicious, it is not supposed to happen

Re: Kill The Cookie Banner

#340

Post by alexandre_m »

Paracompact wrote: post #179
alexandre_m wrote: post #154

Earlier quoted context omitted.

That works well for controlled devices like phones, tablets, and TVs, but it’s much harder on desktops unless you expect parents to become IT administrators.

What's wrong with asking the user on account creation and OS install?

It'd need to be vertically integrated from OS to user space apps, and restricting what can be installed.

I'm not sure to understand the proposed solution here, but it seems someone could just use a different web browser client who don't inherit these restrictions.

Post reply on HN