Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear Paul Graham, there is no cookie banner law

amazingcto.com

Post reply on HN
Print view View original

531–540 of 662 posts

Re: Dear Paul Graham, there is no cookie banner law

#531

Post by sanderjd »

pornel wrote: post #388
AbrahamParangi wrote: post #303

Earlier quoted context omitted.

This is a bad example because the market usually fixes this problem. The reason why the market doesn’t fix the cookie banner problem and the reason why this is bad law is because users defacto do not care , it is merely annoying. There’s a law in California that says that businesses which have chemicals that might cause cancer on the premises need to let people know. That’s great but the levels they set turn out to b…

The market is working perfectly here, if you remember that users are not the customers. Users are the product sold to adtech, data brokers, law enforcement, etc. For data-harvesting companies users are like livestock, and nobody cares about livestock's opinion. It only matters how much value can be extracted from users, even if it's annoying, misleading, and relies on dark patterns.

Yes, but that "livestock" can vote with their feet. If people cared about this, it would be a good opportunity for new entrants to take market share from incumbents by not using tracking cookies and thus not needing to have the cookie banners. But (to the parent comment's point) that isn't happening because this is not a compelling feature to offer, because people do not care about this, no matter how much we want them to.

I used to think this was just an education issue, that people just didn't understand the implications of privacy concerns on the web. But I no longer think this is the case. I think people do mostly understand, and just do not consider this a priority.

Re: Dear Paul Graham, there is no cookie banner law

#533

Post by shafyy »

raydev wrote: post #472
shafyy wrote: post #224

Earlier quoted context omitted.

> If the cookie law was written properly then it would have just been a browser setting that had to be respected and this whole thing would have been completely transparent to the end user and they would have benefitted by default. The law does not mandate websites to display a cookie banner. There are already "Do not track" settings in browsers. A website could choose to honor that setting and don't track you withou…

But the websites are still putting up banners in my way, and they never remember what I consent to anyway, they just ask every time. They didn't do this before the regulation. It doesn't much matter whether a website could do better, they simply aren't going to do better unless forced to. > A website could choose to honor that setting and don't track you without ever showing you a cookie banner. But most don't. Exact…

> They didn't do this before the regulation

Yes, because they just tracked you and you didn't have a choice and didn't even know that they were tracking you probably.

You don't seem to understand what GDPR does. Very simply, it says: "Hey, if you run a website and want to store cookies in your visitors browsers that helps you track them, you need to ask them first if that's ok".

There are multiple paths websites could take:

1) Don't set tracking cookies -> No need to ask the visitor for consent

2) Honor "do not track" headers sent by browsers -> Only need to ask visitor for consent if the browser didn't set "do not track" header

3) Ask the visitors, but do it in a nice way that doesn't disrupt the whole browsing experience -> some examples are given in the blog post

There are a lot of browser extension that hide or click reject cookies for you, so you don't need to see 99% of all cookie banners. Have you tried using some of them?

Re: Dear Paul Graham, there is no cookie banner law

#534

Post by bmicraft »

astura wrote: post #433
maccard wrote: post #389

Earlier quoted context omitted.

See my original post. Our US legal team said that we need the banner if we have visitors from the EU, not if we're tracking them.

>Our US legal team said that we need the banner if we have visitors from the EU, not if we're tracking them. This actually makes sense - because if you didn't have the cookie banner then some fucking weirdo would come to Hacker News and make a self righteous post about how you're "tracking residents of the EU without their consent and abusing them" (even though you're not). Instant karma. Next thing you know these we…

Do you have any basis at all for such an absurd claim? The law actually works in the opposite direction (kinda):

You may use "legitimate interest" cookies/tracking without saying so, but as soon as you show a privacy dialog you actually have to disclose everything you're doing including legitimate interest.

Basically by having a list of what youre're doing with your user's data you're giving up your right to do anything not listed.

Re: Dear Paul Graham, there is no cookie banner law

#535

Post by bmicraft »

onel wrote: post #514
nolok wrote: post #17

Imagine a market in which companies charge a lot of hidden fees behind their customers' back, and users are not happy when they realize after the fact. The law is updated to say you are not allowed to charge the user a fee unless you tell him in advance. Companies with tons of hidden fees decide to keep them but force you to read all the fees on every page of the menu before you can see the rest of the text, in the m…

I think this is a good analogy and I agree that the intent of the law was not to force websites to have a cookie banner, it was just the side effect. What I think we are missing is a browser option/API that lets the user choose the acceptable tracking level. Similar to the do not track header but more fine grained. As we are missing that, extensions are doing a good job ATM https://chromewebstore.google.com/detail/co…

We have that, it's called DNT. Unfortunately companies argue that:

- it's not really a user choice when some browsers set it by default and therefore ignore it

- it's set globally for a browser but a user might want to give away their privacy to my specific site

... and show the banner anyway

Re: Dear Paul Graham, there is no cookie banner law

#536

Post by paulmd »

maccard wrote: post #373
almostnormal wrote: post #324

Earlier quoted context omitted.

It is not about third party or not, but what it is used for. Consent may be required even if there are no cookies at all.

> It is not about third party or not you're right, I said third party, but I actually meant tracking. I actually went and checked, and our only cookie is the cookie for if you've seen the cookie banner or not... > Consent may be required even if there are no cookies at all. For what?

> For what?

GDPR actually doesn't specifically mention cookies at all. Tracking is what's illegal, not cookies.

Let's say you keep website logs with IPs on them, and you do analytics for non-essential purposes. You can do this under GDPR, but you must gain consent from the user before logging this PII.

It actually is completely and totally orthogonal to cookies. Some cookies are fine without consent. Some things that are not cookies are illegal without consent.

Re: Dear Paul Graham, there is no cookie banner law

#537

Post by paulmd »

rglullis wrote: post #491
danaris wrote: post #473

Earlier quoted context omitted.

I mean, that would be great , but I suspect that even just here on HN you'd get a lot of people strongly disagreeing with you. Because that would infringe upon the companies' "freedom" to profit in whatever way they see fit—and the people's "freedom" to let their data be vacuumed up and sold for massive profits.

Whether they agree or not is irrelevant. I think that PG's argument is that all the "regulation" and "strength of the EU" amounts to nothing . It's just people pretending to play power games, doing privacy theater and solving absolutely zero problems.

have him register a new, anonymous HN account and go say that in one of our weekly "apple bad" threads

Re: Dear Paul Graham, there is no cookie banner law

#538

Post by zpeti »

master-lincoln wrote: post #144
zpeti wrote: post #18

Earlier quoted context omitted.

Come on, this is such a ridiculous take. Adding google adsense to a website needs a cookie bar. That’t not "doing sketchy shit with people's data" I can’t believe how many people have bought into this EU regulation hook line and sinker. It’s ridiculous, imagine the man hours that have been wasted in the last 7 years just clicking cookie bars. And as OP says, it’s completely unrealistic to not have them.

Of course this is "doing sketchy shit with people's data". Selling my personal info to external companies so that they can manipulate me easier is sketchy in my eyes if I don't consent

“ Selling my personal info to external companies”

What? What are you even talking about? Google does not sell your personal info. You’re delusional

Re: Dear Paul Graham, there is no cookie banner law

#539

Post by zpeti »

zelphirkalt wrote: post #46
zpeti wrote: post #18

Earlier quoted context omitted.

Come on, this is such a ridiculous take. Adding google adsense to a website needs a cookie bar. That’t not "doing sketchy shit with people's data" I can’t believe how many people have bought into this EU regulation hook line and sinker. It’s ridiculous, imagine the man hours that have been wasted in the last 7 years just clicking cookie bars. And as OP says, it’s completely unrealistic to not have them.

Using anything Google on your website without asking for consent before loading it from Google, is in my definition quite sketchy. It may be either uninformed, no conscience, or not properly thinking about the ethics of ones choices, or whatever, but it is definitely not right and not ethical to do so. I am quite happy with regulations coming down on people and especially businesses, who continue to do this.

Many websites that you rely on would not be around if it wasn’t for Google ads.

You think it’s some sort of choice you have between being tracked or not, but it’s not, it’s between having a fairly decentralised internet or not.

And unfortunately with recent google SEO changes almost all small blogs at this point have been wiped out. Googles own properties, Reddit and Quora, and large websites like NYT and CNET are the only websites left in search rankings.

Re: Dear Paul Graham, there is no cookie banner law

#540

Post by paulmd »

aurareturn wrote: post #106
piva00 wrote: post #94

Earlier quoted context omitted.

> Not only that, I'm not an EU citizen and I'm not browsing websites based in EU but I'm still bombarded with cookie banners non-stop. Again, that's the fault of the companies putting those up, they could make it opt-in to collect your data, they could just put a small notice on the footer with 2 simples links "Accept all/Reject all". But they chose, they decided to pester you with those banners as annoyingly as poss…

The fact that companies are doing that says more about the bad law than the companies which is exactly Paul Graham's point.

"this is what you get for trying to handle us with kid gloves" is an understandable reaction/blowback from advertisers but I don't think it's something we should be giving any real weight or merit.

it's also generally an indictment of the modern neoliberal regulatory approach in general. asking people nicely to follow train safety regulations etc isn't going to get you results. even fines/penalties largely end up just as cost-of-doing-business (even in the EU). if you really want behavior to go away, make it illegal and give people at the top Sarbanes-Oxley-style legal culpability if it happens on their watch.

again, if you want to know the right way to set incentives so that people don't do a thing, you need only look at the way rich people want their money handled. you can bet that ripping off rich people is an ultra-mega-crime and doesn't just get a 1%-of-the-takings slap on the wrist. And lo and behold SOX does actually hold important people accountable as a result, not just some fall guy at the bottom.

Post reply on HN