Dear Paul Graham, there is no cookie banner law • Hacker News Board

Re: Dear Paul Graham, there is no cookie banner law

#421

Post by tremon » Mon, Mar 18, 2024, 1:45 PM UTC

iEchoic wrote: post #136

crabmusket wrote: post #98

Earlier quoted context omitted.

Shopping carts and notification preferences don't require a consent banner.

Our lawyers told us otherwise. Regardless of the answer here, the fact that there's still a debate about what basic functionality requires a cookie banner is really a testament to how bad this legislation is. How long has this been around, 20 years? And there's still widespread debate and lack of understanding as to what specific functionality requires a cookie banner?

Yes, and if you ask the CFO about the best way to increase profits, the answer is always to fire all your staff. That doesn't mean that that answer is the most optimal solution.

Re: Dear Paul Graham, there is no cookie banner law

#422

Post by rchaud » Mon, Mar 18, 2024, 1:45 PM UTC

IanCal wrote: post #72

tlb wrote: post #21

Part of what it means to be "good at regulation" is to anticipate the likely consequences of regulations. So a regulation that says that "businesses must now give away their products for free, unless they honk each customer's nose" will result in a lot of sore noses. Which is basically the case here. Almost all websites make money through ads, or at least keep logs of user activity to help them optimize their website…

> Almost all websites make money through ads, Doesn't require tracking of individuals. > or at least keep logs of user activity to help them optimize their website Doesn't require tracking of individuals.

> Doesn't require tracking of individuals.

Only if you maintain your own ad inventory, instead of using Google/Facebook ads like 90% of online advertisers do. And neither of those platforms work without installing their scripts on your site.

Re: Dear Paul Graham, there is no cookie banner law

#423

Post by rchaud » Mon, Mar 18, 2024, 1:50 PM UTC

arbuge wrote: post #89

"Companies could easily avoid any cookie banner. Just don’t track." It seems like a point dear to the author's heart, given the way he highlights this and puts it in bold at the top of the article. But while it sounds good on the surface, it doesn't take much digging to show it's silly. If you store any kind of data about a visitor to make their life more convenient, is that tracking? Shopping carts? Notification pre…

> If you store any kind of data about a visitor to make their life more convenient, is that tracking? Shopping carts? Notification preferences? etc.

These are first-party cookies as they're served by the host domain, so they wouldn't need an opt-in under GDPR. Site owners should try to limit that to core functionality, like updating shopping cart state as you navigate from page to page.

> It's actually a bit ironic to ask visitors if it's ok to track them. If they say no, you have to track them to at least remember that choice.

That's not how it works. The cookie banner opt-in asks if you want to accept cookies aka tracking. If you say no, no cookies are downloaded, so the site has no idea that you have visited it. So the next time you arrive on the site, it will provided the popup again, as though it's your first time visiting.

Re: Dear Paul Graham, there is no cookie banner law

#424

Post by lesuorac » Mon, Mar 18, 2024, 1:52 PM UTC

aleph_minus_one wrote: post #262

flipbrad wrote: post #19

Note that this isn't a cookie law, it's also the EU's main anti-malware law. The principle is that no piece of third-party controlled software should write information to your computer/phone, or read info from it, over the Internet, without your prior informed consent (with narrow exceptions for storage/reads that are needed to provide a service you've asked for, or equally narrow functions like load balancing). This…

> Note that this isn't a cookie law, it's also the EU's main anti-malware law. The principle is that no piece of third-party controlled software should write information to your computer/phone, or read info from it, over the Internet, without your prior informed consent So it is a responsibility of the browser vendor to implement this.

I mean it currently isn't.

The Cookie banners aren't from the browser they're really from the site.

That said, it seems fair to require the browser vendor to implement it. The browser is the one that exposes a method to store data on the machine (ex. Cookies, LocalStorage) so it seems fair that they should know the user wanted data to be stored.

Re: Dear Paul Graham, there is no cookie banner law

#425

Post by rchaud » Mon, Mar 18, 2024, 1:52 PM UTC

iEchoic wrote: post #136

crabmusket wrote: post #98

Earlier quoted context omitted.

Shopping carts and notification preferences don't require a consent banner.

Our lawyers told us otherwise. Regardless of the answer here, the fact that there's still a debate about what basic functionality requires a cookie banner is really a testament to how bad this legislation is. How long has this been around, 20 years? And there's still widespread debate and lack of understanding as to what specific functionality requires a cookie banner?

Maybe your shopping cart is served through a third party domain, like a Shopify iframe or something?

Re: Dear Paul Graham, there is no cookie banner law

#426

Post by [deleted] » Mon, Mar 18, 2024, 1:53 PM UTC

raverbashing wrote: post #283

maccard wrote: post #250

Earlier quoted context omitted.

My company recently announced a game, and we launched a website for the game. There's no ̶t̶h̶i̶r̶d̶ ̶p̶a̶r̶t̶y̶ e:tracking cookies (I didn't make the site, but I do run it). Our US based legal team told us we needed a cookie banner if we were going to have visitors in the EU. I pushed back, but I lost, and ultimately it's not my fight.

Thanks for this, it seems a lot of cookie popups are there just due to cargo culting

[deleted]

Re: Dear Paul Graham, there is no cookie banner law

#427

Post by iainmerrick » Mon, Mar 18, 2024, 1:55 PM UTC

master-lincoln wrote: post #335

iainmerrick wrote: post #153

Earlier quoted context omitted.

Yes, I know. It’s infuriating but understandable that the regulations aren’t enforced properly.

Why is it understandable that the regulations aren’t enforced properly?

It would be time-consuming and expensive to take some of these companies to court, and likely difficult to win as they'd nitpick over fine details and pass the buck over who's responsible.

Re: Dear Paul Graham, there is no cookie banner law

#428

Post by n4r9 » Mon, Mar 18, 2024, 1:56 PM UTC

fauigerzigerk wrote: post #406

ragnese wrote: post #345

Earlier quoted context omitted.

> No, it does not work both ways. The roles of governments and corporations are not symmetric. > > Good regulation is regulation that has good outcomes. [...] You don't seem to explain what the role of corporations is or what a good corporation looks like. If these things are not symmetric, you need to finish your explanation of why or how they aren't. Corporations and the whole of property rights only exist because…

Governments are supposed to represent the whole of society. The justification for their policies is ideally based on democratic legitimacy. No entity outside of government can possibly have that legitimacy. In my opinion it is not audacious at all to reject the idea that corporations should intentionally pursue societal goals or claim to act out of a sense of duty. Of course we want the effect of what corporations do…

I would regard it as a duty of government to ensure that using the internet is safe and respects user privacy, but not to ensure that the internet has a clean UI. To that extent, I'd argue that the EU is achieving good outcomes. Ensuring a clean UI and smooth user experience is one of those things that should manifest as a result of market economics, but does not manifest because markets don't really work that way.

Re: Dear Paul Graham, there is no cookie banner law

#429

Post by lesuorac » Mon, Mar 18, 2024, 1:56 PM UTC

loftsy wrote: post #97

isodev wrote: post #10

Earlier quoted context omitted.

You mean the EU should have foreseen that people in tech have no conscience and sensitivity for right or wrong?

It's not enough to write a law on principles alone. It must be clear and practical to comply and clear how it will be enforced. The EU should not have created a situation where the most practical solution for 1000's of companies is a cookie banner.

Eh, I think people have the wrong take-away from all of this.

Imagine if the banner said "This website is known to the state of California to cause cancer". Would you keep visiting the site?

Like if every time you went the bar, the bouncer asked "Hey, can I punch you in the face?". Would you keep going to that bar?

As annoying as the banners are, they actually aren't annoying enough to change mass-behavior.

Re: Dear Paul Graham, there is no cookie banner law

#430

Post by voxic11 » Mon, Mar 18, 2024, 1:56 PM UTC

hikingsimulator wrote: post #146

jasode wrote: post #70

>, Paul Graham came up with the thought, that the EU forces companies to have cookie banners. There is no law for cookie banners. [...] Companies could easily avoid any cookie banner. Just don’t track. KingOfCoders/amazingcto, of course you are technically correct but Paul Graham wasn't talking about the letter of the law. Instead, you have to interpret his complaint with the lens of game theory . I.e. The Law of Uni…

The blog clearly works from the actual outcome lense. It's repeated. Several times. The companies could just not track . The actual outcome is that they do want to track, and use adversarial patterns and malicious compliance to twist your arm and "force consent." Paul Graham is still wrong.

Can you really say that confidently? I think a lot of these companies would go out of business if they didn't track users so it seems like under the law they have no option but to show cookie banners. Or are you claiming the law exempts companies in such circumstances?