We're continuing investigation to the performance issues, you can follow and react here: https://lemmy.world/c/friendicaworld

mastodon - Link to source
Look, EU, it is difficult to take you seriously when you forced all this cookie notification bullshit on us. That feature a) should not exist and b) if it did, should be a BROWSER feature not "every website in the entire world now has to bother everyone forever about this stupid thing" blog.codinghorror.com/breaking…

Breaking the Web’s Cookie Jar

The Firefox add-in Firesheep caused quite an uproar a few weeks ago, and justifiably so. Here’s how it works: * Connect to a public, unencrypted WiFi network.
Jeff Atwood (Coding Horror)
This entry was edited (3 months ago)
Unknown parent

mastodon - Link to source

Cassandrich

@leymoo It's also that the garbage web frameworks make it basically impossible to comply. EVERY SINGLE ONE automatically generates a session cookie for you on first access, despite having no legitimate reason to track a session for you. Instead this should happen only when you opt to log in, or add something to your cart or whatever (at which point you should *then* get the prompt for consent to store that data, and an option to store cart contents locally instead of server-side).
@Ashley Rolfmore (leymoo)

Perma reshared this.

in reply to Jeff Atwood

mastodon - Link to source

Cassandrich

That's a myth perpetrated by adtech industry. There is no EU obligation to spam cookie notices. There's an obligation not to track without explicit consent, and everyone illegally uses the cookie nag popups as a basis for claiming consent (which it's not). A legitimate, non malicious site has no need for cookie nags. Ever.
in reply to Cassandrich

mastodon - Link to source

Matthew Miller

@dalias
Here is how my company's compliance lawyers explained it to me. There aren't really EU-wide laws. There are "directives", and each individual country then passes laws that aim to meet the goals of that directive. To make sure you're compliant with all of them, it's easiest to err on risk-avoidant side, even though it is all deeply stupid.
@Cassandrich
in reply to Jeff Atwood

mastodon - Link to source

Enno T. Boland

@dalias German here: the gist of GDPR is: people must know when someone collects personal data.

You can perfectly live without a cookie banner if you don't set one for arbitrary visitors. That was the intended result. But reality instead invented this UX nightmare, because we can't have nice things.

For me it just shows how fucked up today's web actually is.

@Cassandrich
This entry was edited (3 months ago)

reshared this

in reply to Jeff Atwood

mastodon - Link to source

Davey

What if I told you that site owners could just show a Yes/No popup instead of sending visitors down a rat maze to subdue them into data collection?

This is 100% malicious compliance and if you can't see it, you're not looking closely enough in this matter.

Signed, someone whose sites don't have popups cus I'm not invested in collecting user data.

This entry was edited (3 months ago)
in reply to Jeff Atwood

mastodon - Link to source

lj·rk→⁽³⁹ᶜ³⁾

@dalias Oh ffs, this isn't true and you should know better than perpetuating that lie.

I host multiple websites. None with cookie banners. This works even for news, e.g. @gamingonlinux -- and Liam isn't even hosting in the EU but AUS. But he, correctly, thinks that just not needing a cookie banner is exactly the right thing to do.

@Liam @ GamingOnLinux 🐧🎮 @Cassandrich
in reply to Cassandrich

mastodon - Link to source

Cassandrich

Moreover there *was* a browser feature to set it globally and all the assholes running websites refused to honor it and instead used your setting as an additional fingerprinting bit to track you.

reshared this

in reply to Cassandrich

pleroma - Link to source

Furosshu

do you mean the dnt header? I just recently visited geizhals.de and noticed that they honor the Do-not-track header and set the cookie settings accordingly. But it's the only website I came by since this hole cookie banner shit show started which does this.
@codinghorror

Geizhals Preisvergleich Deutschland

Preisvergleich für PC-Hardware, Software, Video/Foto, Unterhaltungselektronik, Sport & Freizeit und Haushalt in Deutschland
Geizhals.de
@Jeff Atwood
in reply to Gerard Cunningham ✒️

mastodon - Link to source

Matteꙮ Italia

@faduda @frosch @dalias I kinda remember a sentence by a German court that went in that direction, but all I can find is stackdiary.com/german-court-ba…, which is related but that's not what I was remembering 🤔

German court bans LinkedIn from ignoring "Do Not Track" signals

The Berlin Regional Court found LinkedIn's ignoring of "Do Not Track" signals and publishing of profiles without permission to be illegal. The ruling supported consumer control over personal data.
Alex Ivanovs (Stack Diary)
@Gerard Cunningham ✒️ @Cassandrich @Furosshu
in reply to Token Sane Person

mastodon - Link to source

Koen 🇺🇦

they have an EU justice system, it just doesn't work - mainly because the EU laws are impotent because lobbyists have made sure they are - I mean not enforcing the web to conform to a browser/web header is just stupid legislation - curia.europa.eu/jcms/jcms/j_6/…

Home - Court of Justice of the European Union

Court of Justice of the European Union
CURIA
This entry was edited (3 months ago)
in reply to Koen 🇺🇦

mastodon - Link to source

Token Sane Person

@bonno @dalias You can't be arrested by the European police becausethere is no such thing.

In Ireland data protection is the responsibility of these guys dataprotection.ie/en/who-we-ar…

So what exactly are you talking about?

SMC | Data Protection Commission

We are the national independent authority responsible for upholding the fundamental right of the individual in the EU to have their personal data protected.
SMC | Data Protection Commission
@Koen 🇺🇦 @Cassandrich
in reply to Cassandrich

mastodon - Link to source

Matt Lewis

@dalias However, even official EU websites spam you with cookie consent notices - see european-union.europa.eu/cooki…. It seems this is because they embed other services (YouTube, Facebook, Google Maps, see link for list).
It's a pity that it's now apparently so hard to make a big website without using privacy-invading 3rd-party services. It would be great if the EU dropped/replaced these, but I imagine that would involve work to keep the same functionality.

Use of cookies on our websites | European Union

Learn what a cookie is, which types of cookie are used on European Commission websites and why, and how you can manage them.
European Union
@Cassandrich
in reply to Matt Lewis

gotosocial - Link to source

Daniël Franke

The web is a sad state of affairs, and the EU also puts almost all tech out for public tender, like the good neoliberals they are. This means that the sites are usually built by companies that make the lowest offer and have no ideals, and have no issue with any dark patterns themselves.

That said, @dallas is fully correct that if you don't track, or only keep your data to what is deemed essential for the service you offer (for example, address if you are shipping physical goods), there is no need for an annoying banner. But the tech sector has shown many times now, that it much prefers malicious compliance than following the spirit of a law meant to curtail their horrendous practices. See also how Apple tried to remove PWAs when they were forced to allow browsers that use a different web backend.

I think the main thing the EU can be blamed for is not treating the tech sector more as an adversarial industry.

@dallas
in reply to Cassandrich

mastodon - Link to source

RevK

@dalias Indeed, but I would say it was 100% entirely predictable that this would be the outcome, and so on that basis the regulations were really badly thought out.

Personally, I think some rules on this are a tad far, it makes sense for a site to have logs and track sessions - if only to improve the site or understand traffic. The bad bit is the third parties and cross site targeted ads and profiles and shite we see in the advertising industry.

@Cassandrich
in reply to Cassandrich

mastodon - Link to source

Kristoffer Lawson

@dalias that’s all very nice in theory, but it was always going to end up with what we have, due to the way this regulation was brought in. With having to incessantly click Accept on every single website out there. Only a small fraction of people care to do anything else. Thus reducing the experience for almost everyone and annoying millions every day. The cookies are not just used for ads, but every analytics tool out there. Key to running sites.
@Cassandrich
in reply to Mark Koek

mastodon - Link to source

Kristoffer Lawson

@mkoek @dalias tell that to the thousands of startups desperately trying to balance with a billion other things they're trying to do. That's just not a practical suggestion when the third party analytics are much faster to set up, better understood, and generally superior too than some self-hosted thing cobbled together.

As mentioned, the reality we are in today with cookie popups everywhere was 100% predictable and the regulation was thus poorly considered.

@Cassandrich @Mark Koek
in reply to Kristoffer Lawson

mastodon - Link to source

Mark Koek

@Setok @dalias I would not advise startups to behave unethically because it’s easier, no. In fact, shouldn’t it be an eye opener that a law that requires people to do the right thing (don’t track people without consent) is viewed as wrong simply because it takes a tiny bite out of the ability to move fast and break things?
@Cassandrich @Kristoffer Lawson
in reply to Mark Koek

mastodon - Link to source

Kristoffer Lawson

@mkoek @dalias frankly, yes. The law hasn’t changed anything of substance. Companies still use the same analytics tools. But now users are constantly nagged at, and companies have increased costs and slower go to market times as they need to faff with these things.

Perfect example of regulation that is completely misguided, and is a nuisance to almost everyone, bar a few people on Mastodon. Wrong approach.

@Cassandrich @Mark Koek
in reply to Mark Koek

mastodon - Link to source

Jeff Atwood

@mkoek @Setok @dalias it hasn’t changed anything because it does not address root causes. Users want everything for free, forever, and content creators want to make money to feed themselves and their families. Until we resolve THAT, we will be stuck in endless combat between these two opposing forces. And the money is going to find a way to inevitably win because it has to. You have to make a living somehow. Free everything is great and all but it is never ever ever gonna be “free.”
@Cassandrich @Kristoffer Lawson @Mark Koek
This entry was edited (3 months ago)
in reply to Liam Proven

mastodon - Link to source

Jeff Grigg

@lproven @mkoek @Setok @dalias

Even being the "card-carrying Libertarian" that I am, I have long said that the most fundamental errors of Libertarian philosophy are to assume that

(1) reliable information is free

[It is not. It is expensive and difficult to obtain. There's no "want" about that; it's just reality.]

and

(2) people are rational.

[Like, do I really need to explain this? Especially in the context of current politics? 🙄 ]

@Cassandrich @Kristoffer Lawson @Liam Proven @Mark Koek
in reply to Jeff Grigg

mastodon - Link to source

Stryder Notavi

@JeffGrigg @lproven@vivaldi.net @codinghorror @mkoek @Setok @dalias Honestly, fully realising the consequences of 1 and 2 are one of the reasons I'm no longer a Libertarian - because the best way to address 1 and to a lesser extent 2 is through shared resources (public library, weather service, schools, etc) as infrastructure that we all pay for.

Suddenly having some kind of shared social obligation actually starts making sense.

@Jeff Atwood @Cassandrich @Kristoffer Lawson @Jeff Grigg @Mark Koek

Jeff Grigg reshared this.

in reply to Stryder Notavi

mastodon - Link to source

ermo | Rune Morling

@StryderNotavi @JeffGrigg @mkoek @Setok @dalias I would be curious to hear what your journey of realisation looked like?

As in: "Which problems and questions did you encounter that made you rethink your approach? And how would you explain your own journey of the mind to someone who was brought up to breathe libertarianism like a fish breathes through water?"

@Cassandrich @Kristoffer Lawson @Stryder Notavi @Jeff Grigg @Mark Koek
in reply to ermo | Rune Morling

mastodon - Link to source

Jeff Grigg

@ermo @StryderNotavi @mkoek @Setok @dalias

Personally, I was always attracted to "personal AND economic freedom," and "what (rational well-informed) consenting adults do in private is none of my business."

But, as a rationalist and computer programmer, I have to confront, daily, the issues of how costly, time-consuming and difficult it is to get reliable information, and to convey it well, for rational decision making.

—

@Cassandrich @Kristoffer Lawson @Stryder Notavi @Mark Koek @ermo | Rune Morling
in reply to Jeff Grigg

mastodon - Link to source

Jeff Grigg

@ermo @StryderNotavi @mkoek @Setok @dalias

It's been obvious to me that most Libertarians take for granted most of the "socialist" benefits of society, like education, health, and safety.

I've never really liked the (U.S.) Democratic or Republican parties.

And I've had to conclude that any philosophy, taken to extremes, is harmful.

So my perspective has been that "Libertarians bring some good ideas to the table that we should discuss and consider."

@Cassandrich @Kristoffer Lawson @Stryder Notavi @Mark Koek @ermo | Rune Morling
in reply to ermo | Rune Morling

mastodon - Link to source

Stryder Notavi

@ermo @JeffGrigg @mkoek @Setok @dalias This is going to be a long and somewhat disorganised thread that I'll add to over time since there isn't really one moment or insight that lead to the change so much as it was multiple threads of observations that chipped away at different parts of the belief system in parallel over time.

But it's a worthy thing to write about, so I'll do my best to cover it.

@Cassandrich @Kristoffer Lawson @Jeff Grigg @Mark Koek @ermo | Rune Morling
in reply to Stryder Notavi

mastodon - Link to source

Stryder Notavi

I guess I'll start with the pandemic, because that was one of the more significant points in the journey.

Both because it showed me how many of my "compatriots" likes the freedom side of the story but weren't interested in the responsibility side of things - I find myself echoing Penn of Penn and Teller here. I had to realise that I was not the same as others who I thought I shared a cause with.

The pandemic also pushed me away from Libertarianism because the successful responses were all collective responses. There might be a theoretical individualist response that could have worked (where everyone appreciated their responsibility to others, and recognised that supporting that was also in their own enlightened best interests), but it was abundantly clear that idea was not much more than a nice thought that wound not survive contact with human nature.

This entry was edited (3 months ago)
in reply to Stryder Notavi

mastodon - Link to source

Stryder Notavi

@Cassandrich @Kristoffer Lawson @Jeff Grigg @Mark Koek @ermo | Rune Morling
in reply to Stryder Notavi

mastodon - Link to source

Jeff Grigg

@StryderNotavi @ermo @mkoek @Setok @dalias

If you're in a small community where everyone knows you, and they communicate and coordinate well with each other, then you'd better treat them well.

But if you can "move on" and take advantage of others who don't know you well, then it the "unenlightened self interest" is to "burn your bridges and move on," for maximum personal benefit.

@Cassandrich @Kristoffer Lawson @Stryder Notavi @Mark Koek @ermo | Rune Morling
in reply to Jeff Grigg

mastodon - Link to source

Stryder Notavi

@JeffGrigg @ermo @mkoek @Setok @dalias Unfortunately very much the case, and it shows up in a lot of different ways in modern life.

For example, it's not uncommon to see people in the corporate world optimizing for short term results that look nice on their resume, then jumping ship to a new, better role elsewhere before the shortcuts they took become a problem.

Which also gives us situations where a corporation may take irrational actions simply because for the managers or execs involved those actions are actually rational, even if they're detrimental to their employer.

@Cassandrich @Kristoffer Lawson @Jeff Grigg @Mark Koek @ermo | Rune Morling
in reply to Jeff Atwood

mastodon - Link to source

Mark Koek

@Setok @dalias I am actually fine with Facebook charging €6 (iirc) for a privacy-friendly account. Also fine with the new kind of cookie banners on some newspaper websites that say up front that either they track you, or you pay for access. Just be honest about it. It’s the sneaky profile building that I totally agree with being illegal.
@Cassandrich @Kristoffer Lawson
in reply to Jeff Atwood

mastodon - Link to source

Cassandrich

@mkoek @Setok When the behavior of some humans is actively hostile towards others I care about, I absolutely am going to work against that behavior, and encourage others to do so too.

Not doing that is how we got where we are. Letting bad people keep pushing norms and boundaries to do harmful things they wanted to make money doing.

@Kristoffer Lawson @Mark Koek

webhat🔜#39c3 reshared this.

in reply to Jeff Atwood

mastodon - Link to source

Open Risk

dunno, imho thats overstating it. People pay for pretty much everything, either directly, or indirectly via taxes. And many of the things that are now supposed to be "free" used to be paid for (newspapers, magazines etc.) without even thinking about it.

rather than a deep homo sapiens malfunction, the issue is more of a silly mix of adtech conditioning (here, free email for your data) and publishers not gettting their act together for the digital age.

@dalias @mkoek @Setok

@Cassandrich @Kristoffer Lawson @Mark Koek
in reply to Jeff Atwood

mastodon - Link to source

Greg Hills

@mkoek @Setok @dalias
"Users want everything for free, forever, and content creators want to make money to feed themselves and their families"

Wait a minute. Who are the users and who are the content creators on Stack Overflow? All the content creators were users. The ones who decided to monetise that site were a third category, site owners. Their desire for income was legitimate, but don't pretend it was the downtrodden content creators crying for money for their children.

@Cassandrich @Kristoffer Lawson @Mark Koek
in reply to Jeff Atwood

mastodon - Link to source

Bert

@mkoek @Setok @dalias false dichotomy: there is more than the 2 extremes “free” and “personalised adds” …
There’s still the “passive advertising” choice where
advertisers/ad platforms study which sites their target audience frequently stop, and post non-tracking ad’s there.

As frustrating as cookie banners are, they are a EU symptom for a (mostly) US cause.

These are not the indignations you’re looking for …

@Cassandrich @Kristoffer Lawson @Mark Koek
in reply to Jeff Atwood

mastodon - Link to source

justJanne

@mkoek @Setok @dalias

As society, we've decided that some business models shouldn't exist.

You could make the same argument about root causes and money trying to find a way about many other business models society has deemed unwanted.

Of course it's a game of whack-a-mole, but that's true whether the business model is ad telemetry (aka surveillance capitalism), fake gucci bags or cooking meth.

Luckily, the tide is slowly and surely turning against telemetry driven content.

@Cassandrich @Kristoffer Lawson @Mark Koek
in reply to justJanne

mastodon - Link to source

Kristoffer Lawson

@justjanne @mkoek @dalias the business model hasn’t been made illegal. It’s just been made to exist through endless popups that users click blindly. It’s a nuisance nag for the vast majority of people, only causing extra effort (and costs) for everyone. Exactly the kind of regulation we should never have. Hell, there are even plugins that click Accept for you.
@Cassandrich @Mark Koek @justJanne
in reply to Kristoffer Lawson

mastodon - Link to source

justJanne

@Setok @mkoek @dalias None of those dialogs are legal.

Recent court decisions have forced even Google and Meta to add "reject all" buttons that are just as easy to click as "accept all". Some court decisions have found that if the Do Not Track header is set, the dialog should just automatically reject all.

Nag dialogs as you've described them are illegal. They only exist because crime is more profitable than doing things legally (e.g., Uber).

@Cassandrich @Kristoffer Lawson @Mark Koek
in reply to Irenes (many)

gotosocial - Link to source

Irenes (many)

anyway: during our time at Google we were occasionally party to VP-level decision-making around privacy topics

we can attest, from our own direct knowledge, that tech companies habitually intentionally refuse to engage with public-policy debates so that they can later paint the laws and regulations that come out of those debates as uninformed by industry realities

reshared this

in reply to Jeff Atwood

mastodon - Link to source

scy

@javier Websites that don't use cookies are not involved. Neither are websites that only use cookies that are _required_ for the website to function, e.g. session tokens.

It's only when you'd like to use cookies to track users and deliver personalized ads that you have to deal with this stuff.

It's a choice.

Most websites simply don't choose the privacy-friendly option.

@javier
in reply to scy

mastodon - Link to source

Claudius

one of the big problems nobody talks about: tech is largely only explained by entities who have no incentive to explain it *well*.

Google, Meta, large ad networks are all like "stupid EU makes us do Cookie banner".

While the actual regulation is actually pretty good. The regulation is basically "don't fuck around with user data. But if you do, you at least need to tell the user".

This entry was edited (3 months ago)

reshared this

in reply to Världens bästa Kille™

mastodon - Link to source

Don Marti

@thelovebing @Zenie GitHub managed to get to a compromise: cookie banners only on content for "marketing to enterprise users" but don't hassle most users on most pages github.blog/news-insights/comp…

(EU law requires consent to be "freely given, specific, informed and unambiguous" and nobody knows enough about today's surveillance business practices to do that in most places, so it's an open question how long these will work anyway. Depends on status of the EU/USA trade war I guess)

No cookie for you - The GitHub Blog

The developer community remains the heart of GitHub, and we’re committed to respecting the privacy of developers using our product.
Nat Friedman (The GitHub Blog)
@Världens bästa Kille™ @Zenie
in reply to Jeff Atwood

mastodon - Link to source

Lori M Olson

in reply to Jeff Atwood

mastodon - Link to source

luap42 soon at a 39c3 near you

I'm sorry I usually really like your takes but this one is just not true: the only thing the EU Cookie Law requires is consent for cookies that are not technically necessary, so mostly tracking features in our current internet, which are extremely privacy-intrusive. Useful features such as login, shopping cart, settings etc. -- none of that requires any cookie banner. So websites making use of cookie banners only do that because they don't want to respect their users' privacy
in reply to Jeff Atwood

mastodon - Link to source

Marcus Müller

@luap42 the donottrack header is exactly that at the browser level; if it's set no need to ask the user about consent they're explicitly denying. For non-tracking, i.e., technically necessary (auth,user settings) cookies, that banner is not necessary

the browser setting exists, it's not honored by website operators, which choose to show banners instead, and is being torpedoed by google, who is earth's dominant ad network and browser supplier.

the EU (in that case) isn't at fault.

@luap42 soon at a 39c3 near you
in reply to Ashley Rolfmore (leymoo)

gotosocial - Link to source

Irenes (many)

(our own beliefs, especially around ethics, changed dramatically during our time at that company. we're ashamed to admit that, when we were young, we bought the industry lines. we never pretended to hold a view we didn't actually hold, it's only that we worked hard to see the world as it really is, with unclouded eyes, and when we finally saw past our own ideological blinders, we realized we'd been horribly wrong.)
Unknown parent

gotosocial - Link to source

Irenes (many)

yes. after leaving the company, we did a few years of soul-searching, and part of what we were asking ourselves was: do we still believe in that dream, of making a better world in part by actually making stuff?

we concluded that we do, but that the dream itself is grievously wounded and needs our help.

in reply to Jeff Atwood

mastodon - Link to source

William Oldwin

That the EU 'forced' cookie banners is flat-out false. It was a *choice* for sites like yours to persist in the intensive collection of data about your users to feed in to the surveillance capitalism machine. As genuinely admirable as your philanthropy is, it was built on this.
in reply to William Oldwin

mastodon - Link to source

William Oldwin

As for why this isn't a browser feature, it was and is! It is a *choice* by your industry to disregard this, by ignoring DNT and not implementing GPC in major browsers. Did your site honour DNT? Does it honour GPC in places where it is not legally obliged to?

developer.mozilla.org/en-US/do…
globalprivacycontrol.org/

Global Privacy Control — Take Control Of Your Privacy

Exercise your privacy rights in one step via the “Global Privacy Control” (GPC) signal, a proposed specification backed by over a dozen organizations.
globalprivacycontrol.org

reshared this

in reply to jonny (good kind)

pleroma - Link to source

Blurry Moon

I won’t subject you to my lengthy argument about why effectively you have to do this because anything you store for any purpose has to be defensible in a complaint so it is safer for you to always just tell everyone you’re potentially tracking and you don’t have to deal with it. We already went through a claim last year by a guy saying completely client side anti Adblock on YouTube (literally just if Adblock then don’t show video) was violating his privacy in the EU and he got them to agree.
in reply to populus mental

pleroma - Link to source

Blurry Moon

what is the telos of a video site

Well for YouTube it is to make money by showing ads on videos so why do you even need a consent banner where the value proposition is that you watch ads to get free videos. I actually like think if it made sense you wouldn’t have the banner on anything ad supported because you are the product to advertisers. If tracking consent made sense you’d only see it on sites where it’s not obvious they are monetizing your data

in reply to Djoerd Hiemstra 🍉

mastodon - Link to source

Robert Riemann 🇪🇺

@djoerd
Hi! Nobody stops the industry to comply through different means, it's just that the industry was mostly not so much interested and invested instead more in #DeceptiveDesign #DeceptivePattern.

forbrukerradet.no/side/compani…

arxiv.org/abs/1909.02638

#DNT #GDPR #Cookies

Companies use design to take our time, money and personal data

Many companies use deceptive design to hold on to customers, increase sales, or acquire personal data. In many cases, this is illegal, the Norwegian Consumer Council says.
Øyvind Kaldestad (Forbrukerrådet)
#cookies #gdpr #dnt #DeceptiveDesign #deceptivepattern @Djoerd Hiemstra 🍉

Kuba Orlik reshared this.

in reply to Kuba Orlik

mastodon - Link to source

GunChleoc

@kuba The one mistake that the EU has in the regulation is to strictly outlaw dark patterns, but id I remember correctly they did push that the decline option has to be as easy as the accept option. Compliance is still somewhat iffy though.

Speaking of browser implementation, vendors could simply have used the already existing "Do Not Track" option to comply and made a little footer with an explanation on where to set it if people haven't opted out.

@Kuba Orlik
in reply to GunChleoc

mastodon - Link to source

Fazal Majid

No. The mistake was not allowing individuals to sue and collect damages, only Data Protection Authorities, and letting the DPA of the company to consolidate cases. Since most Big Tech companies EU presence is incorporated in Ireland, the Irish DPA is it and it has a track record of malicious compliance, as if it thinks its job is to promote Ireland as a HQ venue for foreign companies, not to defend the privacy of Irish and EU citizens. The EU fixed this in the DSA and DMA, but have not retroactively fixed it for GDPR enforcement.

noyb.eu/en/eu-court-irish-dpc-…

EU Court: Irish DPC must investigate noyb complaint

The DPC refused to comply with a binding decision by the EDPB. Instead, the DPC sued the EDPB before the European Courts. The case can now be appealed to the CJEU
noyb.eu
This entry was edited (3 months ago)

Veza85UE reshared this.

in reply to Fazal Majid

mastodon - Link to source

Kuba Orlik

@fazalmajid @gunchleoc afaik the CCPA regulation on tracking cookies is that it has to have an "opt out" option. So websties still can legally track you by default... The EU regulation mandates tracking to be "opt in" - meaning websites cannot track you unless you explicitly consent. In my opinion EU has a stricter regulation in this regard
@GunChleoc @Fazal Majid
Unknown parent

mastodon - Link to source

William Oldwin

Your complaint is disingenuous. The EU didn't require cookie banners, it required that collection of personal information only be done with explicit user consent. This hardly bans free advertising-supported content, and it has always been entirely possible for the web content industry collectively to define a less intrusive mechanism for collecting that consent. Your industry just hasn't bothered. Why might that be?
in reply to Jeff Atwood

mastodon - Link to source

mhoye

True, but my point remains. This shitty experience we're collectively having here this isn't "the EU forcing cookie notification on people", it's "the malicious compliance of companies that profit from user tracking."

Every company that shows you an cookie popup has made the choice to put a few fractions of pennies of possible future profit ahead of your experience.

gdpr.eu/cookies/

Cookies, the GDPR, and the ePrivacy Directive - GDPR.eu

Cookies can give businesses insight into their users’ online activity. Unforunately they are subject to both the GDPR and the ePrivacy Directive, making compliance difficult.
Richie Koch (GDPR.eu)

reshared this

Unknown parent

mastodon - Link to source

Koen 🇺🇦

http->https was enforced/nudged by Google/chrome. Google/chrome really likes cookies as they're an ad-firm. What we need is the EU to enforce rules seriously - but they won't because they're afraid of the ire of the orange monkey with a small 🍄-shaped dong in charge of a neo-fascist global power
This entry was edited (3 months ago)
in reply to Cassandrich

mastodon - Link to source

Ashley Rolfmore (leymoo)

@dalias We got decent progress on encouraging https by mainstream browsers soft blocking http.

I can see a route where:
- html (new version) has some sort of header “data collected” statement with categories
- browsers can flag or not depending on personal settings
- browser defaults encourage broadly decent behaviour from companies or risk getting soft blocked for the general population.

@Cassandrich
in reply to William Oldwin

mastodon - Link to source

Osma A 🇫🇮🇺🇦

Cookie banners also predate the GDPR, which, being technology neutral, doesn't even discuss cookies. They came from the 2002 ePrivacy Directive, UK's implementation of it (Directives are guidance to national law, Acts being laws themselves), and specifically, UK IAB's malicious compliance, maximum annoyance approach, designed to create opinions like Jeff's.
@willegible @codinghorror
@Jeff Atwood @William Oldwin
in reply to Koen 🇺🇦

mastodon - Link to source

Koen 🇺🇦

same for this app-install control apple and Google have/are setting up (these NSA-controlled companies like to call it sideloading instead of just app-install). Just fine these criminal companies seriously for once. Maybe a similar amount (or better % of annual revenue on continent) as the US took from EU car companies for diesel-gate
This entry was edited (3 months ago)
Unknown parent

mastodon - Link to source

Cassandrich

@lispi314 @leymoo They may be well-intentioned* but they're not well-designed or doing everything right. They're tracking visitors without their consent.

* Normally I would not even call this well-intentioned, but as I said upthread, the fact that every web framework *automatically sets session cookies assuming you want to break the law and track users* even when the user has not indicated that they want to do something like log in or store a shopping cart, means a lot of people *don't even know they're doing it*. But this doesn't excuse it; it just makes them "well-intentioned".

@Ashley Rolfmore (leymoo) @LisPi
in reply to Santaji

mastodon - Link to source

Fazal Majid

it exists, it's called Global Privacy Control:

globalprivacycontrol.org/

It's basically the same thing as Do Not Track, but legally binding this time. California has already adopted it (loeb.com/en/insights/publicati…), but sadly not yet the EU. But passing laws does nothing if it is not followed with robust enforcement.

Global Privacy Control — Take Control Of Your Privacy

Exercise your privacy rights in one step via the “Global Privacy Control” (GPC) signal, a proposed specification backed by over a dozen organizations.
globalprivacycontrol.org
This entry was edited (3 months ago)
Unknown parent

mastodon - Link to source

Koen 🇺🇦

what I want is to be able to say once I only want required cookies (in my browser f.ex.) and then NEVER EVER see any cookie-banner anymore. Seeing all these cookie-banners constantly without a possibility for me to opt-out generally and with the "only required" button hidden behind 5 more clicks is a EU-travesty made possible by eu-rules made by lobbyists and no real EU enforcement. For clarity : ad-related cookies aren't required.
This entry was edited (3 months ago)
in reply to Koen 🇺🇦

mastodon - Link to source

Michał Kawalec

@bonno
Note that the restrictions and enforcement here is not on the fact of having session cookies at all. You can store as many session cookies as you wish, the purpose of using these cookies is the crux of the matter.

As long as the cookies are essential for functionality of the service, you can use them without any banners whatsoever.

@leymoo @dalias @codinghorror

@Jeff Atwood @Koen 🇺🇦 @Ashley Rolfmore (leymoo) @Cassandrich
in reply to Jeff Atwood

iceshrimp - Link to source

🪨

The EU didn't force cookie notifications. The tech industry found cookie banners as a (bad) way to uphold GDPR, and that became the norm, but the GDPR text only talks about cookies once, saying "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as IP addresses, cookie identifiers or other identifiers such as RFID tags."
There is a very simple way to respect GDPR without a cookie banner: don't use cookies for your 256 "partners" that syphon all user interactions by default, and make functional but optional cookies opt-in on the elements they require (for instance, a Google Maps element can be unloaded by default and have a small text with a button on it, explaining that it requires consent to send data to Google).
So really, the only thing that shouldn't be taken seriously regarding cookie notifications is the good will of web developers.
in reply to Jeff Atwood

mastodon - Link to source

Davey

If it only it was possible for websites to exist without tracking the shit out of every user.

But no, these evil popups which the EU definitely said every site must have stand in the way of the newsletter sign-up popup, the three overlaid autoplaying videos, the half screen ads, and the push notifications popup that we're all just dying to see.

Wait no you can just not treat visitors like a commodity to be shopped around. Because that's gross.

in reply to Jeff Atwood

mastodon - Link to source

🌈☔🌦️🍄🌱🍉

Yes it should be a browser feature. But no, this blame is not with the EU. They just require consent if you do overt user tracking. Even if you would want advertising, this form is toxic as fuck and enough sites do the invasive tracking without advertising.

There is a related browser feature that helps here: the do not track header. If you honor that, you do not need to show a cookie banner when set.

in reply to Eric Vitiello

mastodon - Link to source

Jernej Simončič �

@pixel Browsers did have a function for this, called Do Not Track. But ad networks loathed it, so instead they made the cookie prompts as obnoxious as possible (btw, that cookie banner is illegal – there should've been a "Deny" option next to "Accept all").
I do agree that EU not requiring adherence to Do Not Track was a missed opportunity.
@Eric Vitiello
in reply to dusoft

mastodon - Link to source

Fazal Majid

@dusoft @pixel mine does, Vivaldi

You can test yourself at global-privacy-control.vercel.…

Global Privacy Control — Interacting With The GPC Signal

Learn how to detect the “Global Privacy Control” (GPC) signal, a proposed specification backed by over a dozen organizations.
global-privacy-control.vercel.app
@dusoft @Eric Vitiello
This entry was edited (3 months ago)
in reply to Eric Vitiello

mastodon - Link to source

StarkRG

@pixel
Everyone should install Privacy Badger from the @eff

privacybadger.org/

You can also disable cookies more broadly or set your browser's security higher, though that can sometimes break things that you don't want broken.

To be honest, though, privacy badger and ublock manage to disable most tracking without breaking anything else, even if those notices continue to pop up. Turning on the Do Not Track browser functionality can actually make you easier to track.

Privacy Badger

Electronic Frontier Foundation
@Electronic Frontier Foundation @Eric Vitiello
in reply to Cassandrich

mastodon - Link to source

Jeff Atwood

@dalias @lispi314 @leymoo the issue is far too nuanced to cover to cover in this limited medium. The short version is, users should have sane, safe defaults they don't have to think about for 90% of their activity. For critical web sites, perhaps. Forcing everyone to constantly think about minutiae is an overwhelmingly bad strategy.
@Ashley Rolfmore (leymoo) @LisPi @Cassandrich
Unknown parent

mastodon - Link to source

Davey

those points I can agree with, but it was the industry that decided something which is a privacy disaster was a cool and normal solution to this.

And any time people are asked, overwhelmingly they hate being tracked for targeted advertising, in the US or the EU.

And now ad revenue has gone off a cliff anyway thanks to AI scrapers, so I dunno, maybe it was an evolutionary dead end when every hot B2C start-up always settled on targeted advertising. So much for innovation, like.

in reply to Ashley Rolfmore (leymoo)

mastodon - Link to source

Daniel Schildt

It's the problem with lobbying: very few highly skilled people have enough free time to help decision makers without getting paid for the advice. It would help if leaders would pay for the advice of professionals, but somehow that is seen as a bad thing in the public sector (as a "waste" of tax money).

And people who mainly work in the consulting industry have gotten so used to fulfilling almost any requests from their customers that it's incredibly difficult to find consultants who would be willing to promote ethics and safety (without increased risk of losing their own jobs for keeping people's digital safety in mind).

in reply to Jeff Atwood

mastodon - Link to source

webhat🔜#39c3

@dalias @lispi314 @leymoo this is a cop-out. Website creators, who have the intention to use the data poorly, are intentionally making the user experience poor, and not even actually complying with the letter law. Saying that this medium is to limited to cover this nuanced topic, shows you don't even understand the topic being discussed
@Ashley Rolfmore (leymoo) @LisPi @Cassandrich
in reply to Jeff Atwood

mastodon - Link to source

Augier (fr & en) 🇵🇸🇺🇦☭🏴

GDPR never mandated cookie banners. GDPR mandated user consent. There was a browser feature for that: the DNT HTTP header. That header was deprecated because nobody respected it. It was just easier to enforce user consent through cookie banners and dark patterns.

Nothing here is EU's fault. You want a better option? Campaign for a legislation to enforce the website to respect DNT.

Or… Just don't track?

This entry was edited (3 months ago)
in reply to Jeff Atwood

mastodon - Link to source

Marcus Bointon

@leymoo @dalias @lispi314 it’s not nuanced at all; it’s very, very simple: Don’t do dodgy shit, and you don’t have to request consent. Your take merely underlines that you have fallen completely into the bogus malicious compliance trap that adtech set for you. It’s not the regulation’s fault, though you could legitimately blame the lack of enforcement for its prevalence.
@Ashley Rolfmore (leymoo) @LisPi @Cassandrich
in reply to Marcus Bointon

gotosocial - Link to source

zrb

the fact that most frameworks with a cookie opt-in popup will remember your decision ONLY if you click "accept all", but if you click "reject all" they popup again and again, is clearly indicative of the dark pattern the data collector wishes the user to fall into.

It's likely that they excuse this behavior by saying some variation of "but if the user rejects all cookies then we can't store the fact that they rejected all cookies, and we'll have to ask them again next time" which is bullshit because they're ABSOLUTELY storing OTHER basic information about that user, they just choose not to store this. The only lasting solution to eliminate opt-in popups is to not be tracking user information in the first place.

reshared this

in reply to Koen 🇺🇦

glitchsoc - Link to source

Leeloo

@bonno @dalias@hachyderm.io @leymoo @codinghorror
The problem is more that the EU makes the law and then leaves enforcement to the member countries.

As a result you get countries like Germany and France handing out big fines, and countries like Denmark where the data protection authority doesn't have enough staff to do anything more serious than a somewhat harshly worded letter, and politicians who refuse to spend more money on said data protection authority even though a few of those 2 billion EUR fines could pay for a lot of the stuff we "can't afford anymore".

@Jeff Atwood @Koen 🇺🇦 @Ashley Rolfmore (leymoo)
Unknown parent

hometown - Link to source

Tyler Smith

@dalias @lackthereof @pgcd @leymoo

That's what advertising is for. Is it no longer possible to do advertising without surveillance?

Reverting to advertisements based on the content of a page, rather than who is viewing it, would also make it easier to break Google's stranglehold on the web.

And maybe it's time to stop promising everything can be free forever. That's the first lie that enshittification is built on.

@Ashley Rolfmore (leymoo) @pgcd @Cassandrich @The Lack Thereof
Unknown parent

mastodon - Link to source

Cassandrich

@lackthereof @pgcd @leymoo Maybe we're going by different definitions of "session". It sounds like you think it's a short-lived thing that disappears when you terminate the browser. Which, even if that were the definition, would still mean it... never disappears. Most of us have browser "sessions" 10+ years old. Mobile doesn't even have a sense of terminating the browser.

The definition I'm going by is an identifier, regardless of lifetime, that establishes distinct HTTP requests as originating from the same browser. There is no "strictly necessary" reason to do this unless the purpose of the site is maintaining a stateful interaction with the user. If the visitor is just reading your site, there is no legitimate business interest in knowing whether the load of page A and the load of page B came from the same person.

@Ashley Rolfmore (leymoo) @pgcd @The Lack Thereof
Unknown parent

mastodon - Link to source

The Lack Thereof

@dalias @pgcd @leymoo
under GDPR, session cookies as normally understood meet the definition of "strictly necessary" and do not require explicit consent

If your session cookie is persistent, it's not a session cookie anymore. Not persisting from one browser session to another is kind of a defining characteristic of a session cookie.

@Ashley Rolfmore (leymoo) @pgcd @Cassandrich
Unknown parent

mastodon - Link to source

Cassandrich

@pgcd @leymoo Nope, a session cookie is tracking. It enables processing data on you like "the same person who looked at products A, B, and C yesterday bought products C and D today". Likewise choosing what to show you based on that profiling. It might also reveal things about you to other ppl you share a computer with like "somebody using this computer was looking for information on contraceptives or HRT" etc.

Session cookies are unlawful tracking unless you consented to it by logging in to the site with the understanding and intent that you have a persistent profile and what that profile will be used for was made clear.

@Ashley Rolfmore (leymoo) @pgcd
in reply to Jeff Atwood

mastodon - Link to source

dragonfrog

the EU didn't force cookie consent pop-ups, it forced consent pop-ups *if the cookies are used for third party surveillance*.

The obnoxious behaviour isn't the pop-up it's the surveillance. The pop-up just makes the obnoxious behaviour visible. If website owners don't want to be seen to be obnoxious, they used to be able to choose to hide what they were up to, now they must choose not to be obnoxious.

That's a good thing.

This entry was edited (3 months ago)
in reply to Jeff Atwood

mastodon - Link to source

Gregory

then the plan needs to be reconsidered based on how it was interpreted. Regulate the way these consent forms should look, how much space they can occupy, how much functionality should be still available to a user who ignores the thing, etc. Something akin to tobacco packaging laws.

The long-term solution would be to abolish support for third-party cookies in browsers, but that's hard considering all of them are either owned or heavily influenced by an interested party, Google.

This entry was edited (3 months ago)
⇧