There is a general confusion that the job of a user interface is to simplify the system, where that is the last thing a user interface should do. What a user interface should do is to make it as simple as possible for a user to understand and interact with the system.
Google's system is immensely complex and they have intentionally not given their users all the information and not all the options for interaction. This is intentional of course, but by looking at the user interfaces they provide as is we have to conclude that they are doing a very poor job of giving us access to understand the full complexity.
Imagine if Adobe replaced all their interfaces with a few simplified buttons, one brush to use, filters are automatically applied, lighting automatically adjusted based on personal history etc. No one would use such a program.
The GRPR in this case is pointing out that Google is not showing all the options and when they are they obscure them, ie they have bad user interfaces by making it as difficult as possible for a user to understand and interact with their system.
If anything, this will force Google to make good user interfaces. For, if the measurement of a good interface is about how simple the interface is regardless of the complexity of the underlying system, then all good user interfaces should be reduced to one button. Such a measurement of quality is ignorant and cannot further any skill in designing user interfaces.
This is entirely subjective and meaningless unless you have a way of measuring it objectively.
All it’s actually doing is making people change things, basically arbitrarily, in the hope it’ll make things better.
Maybe the intent is vaguely in the right place, but I’m pretty skeptical of any kind of magic bullet for making people make “good” user interfaces.
I think it is far from clear this will make things better, not worse.
I don't understand what "advanced users" have to do about that, it's about privacy and owning your data, do you think less savvy internet users should just let Google siphon their data? If anything they're the one who most benefit from this change since they're less likely to understand what data they're sharing exactly and implement countermeasures client-side.
>so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all.
That's because of the dark patterns I talk about above. Given clear "I accept/I refuse" controls it wouldn't be any slower or difficult to quickly dismiss the dialog -- without reading it at all.
But of course Google doesn't want you to do that so they make it as hard as they can to find the "I refuse" control, leaving you with a cumbersome UI where you're tempted to click "I accept" to get it over with.
1) It would definitely be slower than not having that dialogue at all (the less UI elements - the simpler).
Do you remember that typical user visits Google web site NOT to setup his privacy settings, but with a totally different goal (such as do web search)?
2) "Accept vs Deny" is easy to read, but how would most users know what choice is better for them?
In order to form a reasonable opinion on that cookie choice -- I personally spent multiple hours (if not days) of reading and thinking.
EXACTLY! Why should the user then have to give up their privacy? All they wanted to do was a simple search, not be tracked and profiled. So it's the unneeded collecting of personal data that's the problem here, not the ux.
I mean have you seen the current dialog you get when you get on a google domain with a "fresh" session? It's a wall of text with a scrollbar redirecting you to multiple other pages if you want to see what exactly Google collects. It's also pretty unclear what each link leads to and how to opt out of everything. Clearly they didn't really optimize for simplicity here, they're the only ones to blame for that.
I'm perfectly aware that people don't go to google.com specifically to setup privacy settings, and that's precisely what Google is counting on. By using an unnecessarily complex interface they hope that people will give up immediately and accept whatever Google is pushing.
>In order to form a reasonable opinion on that cookie choice -- I personally spent multiple hours (if not days) of reading and thinking.
Well that's your choice, my modus operandi is simpler: I systematically refuse everything I can refuse. That's quick and easy. I have yet to witness any degradation of my browsing experience.
I'd be curious to hear what kinds of dilemmas you've had while reading the terms and conditions that lead you to days of thinking.
I just checked - there is no such dialogue on google.com for me. I am in the US. GDPR does not apply here.
My conclusion is that the complex dialogue on google.com you are suffering -- is the result of GDPR. Without GDPR Google (and most other successful websites) delivers simplicity.
> I systematically refuse everything I can refuse.
You can refuse opening google.com in your browser. Do you refuse to open google.com?
> what kinds of dilemmas you've had
I carefully thought about whether I want unneeded complexity in my life or not.
My choice is "No GDPR and no complexity".
Your choice is GDPR which implies complexity (but you do not understand that "GDPR -> websites complexity" causation, because you did not think about that choice hard enough).
If you collect so much diverse data that you exploit in 100 different ways and share with 1000 different companies that you require a hundred pages of individual consent checkboxes, the system is working as intended.
Will most users just accept all? Maybe. But I think the share of concerned users is larger than you believe it to be. And if history is any indication, "reasonable default settings" have a bad habit of never erring on the side of data collection minimization, particularly for new and novel features.
> For vast majority of users advanced configuration options look like mumbo-jumbo, so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all.
Hiding the (pre-ticked) consent boxes in "advanced configuration" UI has been the default strategy so far. This fine made clear that this doesn't actually work to obtain valid consent.
I, personally, when I browse internet, strongly prefer personalized ads (over non-personalized ads).
Most users, probably, do not care either way (because they do not understand the implications). But the business (e.g. Google) cares about ads personalization a lot, because ads personalization significantly increases tax revenue and reduces number of irrelevant ads that users see.
In this situation the reasonable default choice is to allow ads personalization, so the business will have ad revenue to function and deliver functionality users need.
> because they do not understand the implications
This is the point. Relying on people not understanding something is not ethical and certainly not "reasonable".
Do you imply that democratic process never make mistakes?
> Relying on people not understanding something is not ethical
CNIL bureaucrats rely on people not understanding, that these GDPR regulations make internet worse (annoying "accept/deny cookies" questions, less relevant ads, less revenue for businesses to create functionality users want).
Would you say that CNIL is unethical?
Anyway, that's whataboutism.
Which is fine if you want to click the checkbox to enable personalization. But not everyone wants that personalization and tracking. For instance, I've found personalized ads to be worse than generic ads, where Google tries to sell me a product for weeks after I researched and purchased it. If you enjoy the personalized ads, there is nothing to stop you from opting in, but that shouldn't be the default behavior.
... according to GDPR.
My point is that GDPR is bad (for internet users) at the very core (intent) of GDPR legislation.
I claim that it is bad for internet users to force them to make cookies decisions for every website that wants to use cookies.
Which EU law do you think forces this? Please can you link to it?
See also: California's prop 65.
The reasons for those are obvious and somewhat understandable from the companies' POV. Nevertheless, I don't see how a prompt employing dark patterns constitutes free and informed consent.
As such, I'm glad this descision seem to go in the same direction.
https://www.allelectronics.com/
...while not apparent on the main page (I'm sure they'll fix this in time), if you click on any item, no matter which item, there will be a little "Prop 65" warning notice, with a link to this page (rendered as a dialog):
https://www.allelectronics.com/cms/ca_warning/ca-warning/1.h...
The print catalog is even funnier, if you receive it - every single spot of a component or part has the Prop 65 warning.
Someone should print up a bunch of "Prop 65" stickers, and plaster them on everything in California (for all I know, they are already doing this).
It's all kinda absurd.
==========
https://eugdpr.org/the-regulation/
The request for consent must be given ...
==========
The site you linked is not the law, it's some kind of blog. But let's use this site: where does it say that all cookies require opt-in consent?
But this is what we know:
1) Almost all popular web sites, that serve EU audience - added personalization consent form.
2) This is what CNIL defines as "personalization"
---
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
---
My estimate is that over 90% of popular web sites that use cookies -- use users' "personal data" (according to this definition).
That is why I wrote "website that wants to use cookies".
I, probably, should not focus on "cookies" and focus on "website personalization" instead.
Almost all popular websites use "personal data". GDPR forces these websites to present "consent form" to users, whether users want to answer that consent question or not.
I, as a user, do NOT want to be forced to see that "consent" question on my first visit of a website, but GDPR forces me to. That is abuse of government power.
You're conflating interests of internet companies and interests of users a lot here. No doubt, this is not in the interests of internet companies - however, I fail to see how it's actually bad for users.
If you're ennerved by the cookie banners and don't care about your privacy, you're always free to click the prominent "accept all" buttons and continue like before.
This is exactly the reason for the GDPR. Users don't understand the implications and so they shouldn't be automatically opted-in to systems that violate their human rights.
1) "Incognito" mode.
2) "Clear browsing data".
> Seems like nobody cared about it
That is exactly my point: vast majority of users do not care much about removing their cookies.
If users do not really care -- why pollute UI of websites with questions that users do not care about?
>Most websites and web services, including Google's, don't change their behavior when they receive a Do Not Track request. [1]
I prefer bad ux patterns over dark ux patterns.
UX is not about smoothness of the first 5 min of using a product. Long term counts. Let's ask how people feel about facebook these days ? They had a perfect blindfloded way to inboard you, do you still think that is good UX ?
Only if you keep using the same website again and again and do not delete cookies.
Is it your goal to reduce number of websites that users visit?
It doesn't. The current breed of UIs that we see is companies trying to find an easy way out. Easily half of them are illegal under GDPR: they are either ambiguous, or redirect to third-party websites, or employ dark patterns, or require consent to collect data that's not required for website operation, or all of the above and more.
"That does not mean that the GDPR is respected. Indeed, the user not only has to click on the button “More options” to access the configuration, but the display of the ads personalization is moreover pre-ticked. However, as provided by the GDPR, consent is “unambiguous” only with a clear affirmative action from the user (by ticking a non-pre-ticked box for instance)."
I don't think the "More options" issue would have been too much of an issue if all the options weren't preselected.
The correct pattern would be to use reasonable default settings and allow more advanced users to customize.
But EU wants to force Google to present advanced configuration options to all users. For vast majority of users advanced configuration options look like mumbo-jumbo, so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all.
That CNIL change will make the Web worse than it is now, not better.