undefined | Better HN

0 pointsalerighi6y ago0 comments

Unfortunately, they are required by law (at least in Europe) and we can't do much about it. You can't say use a browser API to set a global setting for them, because GDPR explicitly requires that every website must get the user consent for them.

Of course the real solution (and the reason why GDPR introduced the banner) is for website to stop using cookies for tracking their users and thus have no reason to put the banner (you don't need the banner for technical cookies, such as the one used for logins, but only for third party profiling cookies).

0 comments

worble6y ago

A minor nitpick, but the "Cookie Law" that introduced these banners was way before GDPR, although the GDPR does have articles that also talk also about cookies.

The intent of the parts of GDPR which mention cookies (or, at least, what I assume the intent was) was to essentially "upgrade" the banner from a simple and largely useless notification (i.e "By using this site you agree to our use of cookies") to one of informed consent (i.e "Please click accept or deny the use of cookies to continue using this site").

Interestingly, as far as I am aware, no site or company has ever been taken to court or even fined for not using a cookie banner, despite some websites publically declaring they won't use it[0].

0: https://nocookielaw.com/

atoav6y ago

Important point: GDPR allows you to use strictly necessary cookies without asking for consent.

So if you hate to put cookie banners onto a site, just stick with storing only strictly necessary cookies without data that identifies your users and you are fine.

The problem is, many people don’t even know what cookies their own site stores with their users and they store a ton of tracking cookies on their user’s devices.

p1necone6y ago

Isn't the whole point of cookies to identify users (for session persistence and the like, not just ads)? If you're not identifying users what are you achieving?

atoav6y ago

For some sites it could be enough to store the state of the site (e.g. display settings, language, etc) instead of a profile.

When I visit a random wordpress blog I shouldn’t need any cookie from them — why would I?

When I visit an online shop it should be my choice if they remember me (which is precisely what the GDPR demands). This could be a little toggle switch labled “Remember me” that is off by default and that would be it.

But people seem to prefer forcing their cookies onto users.

arkh6y ago

Storing the language they want to use or other configuration.

frabcus6y ago

Some sites store local settings in cookies, that the user has explicitly set.

Tilian6y ago

Since most websites seem to prefer slapping banners and modals on their pages as opposed to actually ridding their sites of tracking cookie usage I've found that just blocking the elements using a filterlist[0] is a nice solution.

[0] https://www.i-dont-care-about-cookies.eu/abp/

antisthenes6y ago

> You can't say use a browser API to set a global setting for them, because GDPR explicitly requires that every website must get the user consent for them.

I can see why that prevents a browser from auto-accepting all cookies, but how in the world does this logic apply to me if I want to deny consent to 100% of the websites to use cookies?

Set the default on the browser to deny all consent, and show the cookie notification somewhere unobtrusive, the same way it was done for notifications.

efreak6y ago

The browser already has logic/settings controlling which cookies are accepted (first party, all, none). These settings have existed in most browsers for years. It's unfortunate that the cookie law didn't build on this in some way.

kuschku6y ago

The cookie law is very flexible. It considers any and all ways in which the user makes their intent explicit as good enough.

The issue is that websites want to annoy users until they finally maybe actually say yes to get the site to shut up.

Legally, tracking has to be off by default, tracking may not change the usability of the site, and tracking has to be purely optional, and the "no" has to be simpler, larger, and easier to use than the "yes".

The point of the GDPR, over the course of the next years, is to utterly destroy online advertising as a business model, and any and all tracking solutions with it.

afiori6y ago

I suspect that it would be far to expensive to make it work on the hard 20% of websites and brittle on the easy 80%.

As a personal confession I cannot sympathize for this animosity towards banners. Apps usually have a worse onboarding experience than websites.

My only considerations of GDPR notices is to note how many of them manage to be uncompliant and wonder if archiving services can bypass them.

gpvos6y ago

AFAIK, this was a separate law that existed already before GDPR came along.

j / k navigate · click thread line to collapse

0 comments

worble6y ago

A minor nitpick, but the "Cookie Law" that introduced these banners was way before GDPR, although the GDPR does have articles that also talk also about cookies.

Interestingly, as far as I am aware, no site or company has ever been taken to court or even fined for not using a cookie banner, despite some websites publically declaring they won't use it[0].

0: https://nocookielaw.com/

atoav6y ago

Important point: GDPR allows you to use strictly necessary cookies without asking for consent.

So if you hate to put cookie banners onto a site, just stick with storing only strictly necessary cookies without data that identifies your users and you are fine.

The problem is, many people don’t even know what cookies their own site stores with their users and they store a ton of tracking cookies on their user’s devices.

p1necone6y ago

Isn't the whole point of cookies to identify users (for session persistence and the like, not just ads)? If you're not identifying users what are you achieving?

atoav6y ago

For some sites it could be enough to store the state of the site (e.g. display settings, language, etc) instead of a profile.

When I visit a random wordpress blog I shouldn’t need any cookie from them — why would I?

But people seem to prefer forcing their cookies onto users.

arkh6y ago

Storing the language they want to use or other configuration.

frabcus6y ago

Some sites store local settings in cookies, that the user has explicitly set.

Tilian6y ago

[0] https://www.i-dont-care-about-cookies.eu/abp/

antisthenes6y ago

> You can't say use a browser API to set a global setting for them, because GDPR explicitly requires that every website must get the user consent for them.

I can see why that prevents a browser from auto-accepting all cookies, but how in the world does this logic apply to me if I want to deny consent to 100% of the websites to use cookies?

Set the default on the browser to deny all consent, and show the cookie notification somewhere unobtrusive, the same way it was done for notifications.

efreak6y ago

kuschku6y ago

The cookie law is very flexible. It considers any and all ways in which the user makes their intent explicit as good enough.

The issue is that websites want to annoy users until they finally maybe actually say yes to get the site to shut up.

The point of the GDPR, over the course of the next years, is to utterly destroy online advertising as a business model, and any and all tracking solutions with it.

afiori6y ago

I suspect that it would be far to expensive to make it work on the hard 20% of websites and brittle on the easy 80%.

As a personal confession I cannot sympathize for this animosity towards banners. Apps usually have a worse onboarding experience than websites.

My only considerations of GDPR notices is to note how many of them manage to be uncompliant and wonder if archiving services can bypass them.

gpvos6y ago

AFAIK, this was a separate law that existed already before GDPR came along.

j / k navigate · click thread line to collapse