Live data from Hacker News

Dear Paul Graham, there is no cookie banner law

amazingcto.com

381–390 of 662 posts

Re: Dear Paul Graham, there is no cookie banner law

#381

Earlier quoted context omitted.

How does it show that? Most people I know are annoyed by this and click on "reject" (if they can find it), but for a lot of non-technical people these banners are just a given because they don't even understand the problem. Doesn't mean they don't care

The close to million users now on https://www.stilldontcareaboutcookies.com/ suggests that there's a pretty sizable amount of people that care less about the philosophy of European data laws and more about just getting on with their day.

>pretty sizable amount of people that care less about the philosophy

How does it show that?

It shows that they prefer to get on with their day over clicking cookie banners. It says nothing about whether they agree with the philosophy of the GDPR.

Re: Dear Paul Graham, there is no cookie banner law

#384

Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?. If the cookie law was written properly then it would have jus…

> Hate this way of thinking where the government (with seemingly good intentions) tries to stop something but leaves a loophole where all our lives are made more tedious and then people defend it saying the companies should just not do it, well we needed the law in the first place so it's a bit silly thinking to suggest they stop doing it after the law, no?.

We deal with similar issues developing and releasing software. Instead of not ever releasing software, or only writing perfect software that never has issues, we have a couple of options.

1) In critical life or death situations, spend a ton of time modeling all states of the system and program in a way that very strictly controls for these states, with a lot of testing. See NASA/JPL coding standards for critical systems.

2) For less critical situations, or those were modeling all states of the system are impractical, we release, observe, and iterate. Yes there will be edge cases, bugs, and loopholes. But we can observe them, iterate, and release updates.

I think case 1) is impractical for changes to large legal and economic frameworks in the real world given how many variables are at play. If we could model the entire economy and see how it would react to a given change, the world would be a very different place in lots of ways already.

A lot of politics seems to work against 2) and that hurts our ability to improve things. "I will pass a law that does X" and "I will repeal the law Y that is not working, see look at these loopholes!" are good political campaign statements.

"I will gather and analyze data on the operation of the current system and support an iterative change that intends to improve things, implement that change, and then observe the results to determine if future changes are needed" is hard to rally around either in campaigning or when actually doing the work of getting political support to pass law.

I think decent example of this in government, although far from perfect, is the feedback loop of the NTSB and FAA. The NTSB's job is to observe and report on failures of air safety, and the FAA's job is to apply those lessons to future air regulation. Of course there are many examples of this not working perfectly, but it's a more concrete feedback loop than most governmental action has.

More observation of the analysis of the impact of laws after they are passed, and follow-up iterations where we compare the expected and actual results and make updates, would probably result in a lot less gnashing of teeth over "bad government regulation" but I'm not sure how we get there politically.

Re: Dear Paul Graham, there is no cookie banner law

#385
@KingOfCoders / amazingcto you wrote `Indeed, as an American, there is no need to force them onto you.` - I feel like that suggests some assumptions about PG here that might not be quite correct. Since PG's often in the UK, his place of birth and where he has a residence, he's sometimes in a place that has GDPR obligations, he'll likely be exposed to the full GDPR vs analytics annoyances that IP addresses, email addresses, trackers, and the data protection make likely. I've no idea what internet use would be like in the US though (I haven't surfed via the US for ages though so don't know what the geo-targetted and account targetted consent differences are). PG likely both benefits and suffers from being in multiple jurisdictions. As for his personal identity, with terms like American and British, he might identify with both, but he did write "Keep Your Identity Small" so he might even prefer neither label, I don't know. Regardless, yes there could be better ways at a protocol level, maybe the EU should have foresaw that rather that the noise which we have now. Guess we'll have ML agents to handle it for us soon.

Re: Dear Paul Graham, there is no cookie banner law

#386

Earlier quoted context omitted.

It is not about third party or not, but what it is used for. Consent may be required even if there are no cookies at all.

> It is not about third party or not you're right, I said third party, but I actually meant tracking. I actually went and checked, and our only cookie is the cookie for if you've seen the cookie banner or not... > Consent may be required even if there are no cookies at all. For what?

It's not about cookies. Tracking without cookies also requires consent.

Re: Dear Paul Graham, there is no cookie banner law

#388
post #17

Imagine a market in which companies charge a lot of hidden fees behind their customers' back, and users are not happy when they realize after the fact. The law is updated to say you are not allowed to charge the user a fee unless you tell him in advance. Companies with tons of hidden fees decide to keep them but force you to read all the fees on every page of the menu before you can see the rest of the text, in the m…

This is a bad example because the market usually fixes this problem. The reason why the market doesn’t fix the cookie banner problem and the reason why this is bad law is because users defacto do not care , it is merely annoying. There’s a law in California that says that businesses which have chemicals that might cause cancer on the premises need to let people know. That’s great but the levels they set turn out to b…

The market is working perfectly here, if you remember that users are not the customers. Users are the product sold to adtech, data brokers, law enforcement, etc.

For data-harvesting companies users are like livestock, and nobody cares about livestock's opinion. It only matters how much value can be extracted from users, even if it's annoying, misleading, and relies on dark patterns.

Re: Dear Paul Graham, there is no cookie banner law

#389

Earlier quoted context omitted.

> It is not about third party or not you're right, I said third party, but I actually meant tracking. I actually went and checked, and our only cookie is the cookie for if you've seen the cookie banner or not... > Consent may be required even if there are no cookies at all. For what?

It's not about cookies. Tracking without cookies also requires consent.

See my original post. Our US legal team said that we need the banner if we have visitors from the EU, not if we're tracking them.

Re: Dear Paul Graham, there is no cookie banner law

#390
post #121

Earlier quoted context omitted.

The law is not bypassed, the annoying banners with no simple option to reject are illegal . The issue is that enforcement is slow, not that the law is badly written. GDPR's Article 7 [0] is very clear: > 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving con…

> The issue is that enforcement is slow, not that the law is badly written. The enforcement/implementation of a law is so deeply entwined with the text that it's deceptive to separate them. If a law is written in a way so as to make enforcement hard, or if the government doesn't have the resources to quickly and consistently apply it, then it's a bad law because it enables weaponized targeted/selective enforcement of…

[flagged]
Post reply on HN