That is to say, each one cannot make much of an impact, but the responsible thing to do would be to not contribute or at least openly advocate for change from within. If enough people inside shift, then change can happen.
Can't wait until first party isolation is the default in browsers.
Oh and default no js means that I typically don't see those pubups in the first place.
Archive.is, it is.
AND drop all cookies from all domains.
> There are many, many, ways
There probably are. I haven't ever seen it work though. If I get into incognito, my ads show something different my normal profile.
In theory, they can track you from your OS/browser combination (and many more variables), but is there a way to test it?
[0] https://www.gizmodo.com.au/2020/06/google-facing-us5-7-billi...
It’s not theoretical; it’s used in practice today.
I found a very convoluted way of opting out: https://twitter.com/pos43/status/1001331147110957056
It is now 2020 and I would be interested to see if these methods have been changed to make them easier or harder.
I use everything I can to prevent tracking on my machine. But for a general solution for everyone, I don't know what would be the answer, but I don't think it's GDPR. If it's to work, acts forbidden by GDPR need to be handled very fast, and without interaction from user nor legal mumbo jumbo. Without a zero-tolerance policy, the cheap tricks will only grow stronger.
Edit: So apparently if you criticize gov/bureaucrats on HN you get downvoted.
When they can set up anywhere and access everywhere it is asking to be flouted. Geolocated financial intergration is about the only area they can start to touch with enforcement. Without that they have about as much sway as a backwater dictatorship writing hate mail threatening arrest to every first world newspaper which refers to him as a dictator. Right or wrong morally they just look stupid and delusional.
The reason it is unenforced is that the agencies that seem to have the responsibility to do so are understaffed and afraid of the drawn out litigation and political backlash.
All this on top of the larger concerns in the GDPR - for example, companies that, once they've collected data for one purpose, proceed to process it for another purpose without any legal basis at all.
If you think that was an easy feat, then I don't know what to tell you.
Do you know how it was achieved? With finely tuned and ruthlessly efficient bureaucracy.
When people really care, bureaucracy works wonders.
Bureaucracy is basically formalizing social interactions for a specific topic. Formalizing something ossifies it, but it also prevents your pilot telling your copilot "Shut up!" just as the plane is about to crash into the mountain.
> Bureaucracy is basically formalizing social interactions for a specific topic.
One could even say that bureaucracy is one form of organized collective action. Which in general is quite necessary for humans as a social species.
I presume you meant commercial aviation, rather than aviation in general. Unfortunately not quite true even there. Your broader point stands though.
https://en.wikipedia.org/wiki/Category:Aviation_accidents_an...
Well no, you've neatly disproved it.
The reason it works for commercial aviation and not anything else -- not even aviation in general -- is that the bureaucratic processes used for commercial aviation incur a massive overhead. When you have a product which costs a hundred million dollars a unit anyway and can kill 300 people in one shot if it fails, you pay the cost. For anything else it's too expensive, but spending less money causes the bureaucracy to be ineffective.
And even in commercial aviation, the overhead is still there, it's just capable of eating the loss. (Or maybe it isn't, given the miserable lack of competition in that industry now. And then where does that lead us on safety, Boeing?)
Not to dispute the effectiveness of a finely tuned and ruthlessly efficient bureaucracy, but pilots and airlines have a strong incentive to not have fatal accidents; websites however have a strong incentive to track their users.
To use an analogy, enforcing this will be less like mandatory driving exams and more like net-zero carbon emissions.
It could be in an individual manager's interest because then they get a bonus and are working for some other company by the time the plane crashes, but the airline itself has the aforementioned incentive to put processes into place all on their own to prevent that from happening.
It’s not like a major airline is going to intentionally crash an airplane, but if they can trade 1 billion dollars for an extra crash every 20 years that’s a net financial benefit.
A 50 year old aircraft still costs tens of millions, and the biggest cost of a crash is the lawsuits anyway.
> especially when the options are to retire it or keep flying.
50 year old planes fly all the time. The options aren't retire it or keep flying, they're maintain it properly or don't.
> Further risking a crash when your airline is facing bankruptcy suddenly looks like a reasonable trade off.
Which is where the insurance company comes in, and we're back to having an existing bureaucracy with an incentive to prevent that from happening.
> It’s not like a major airline is going to intentionally crash an airplane, but if they can trade 1 billion dollars for an extra crash every 20 years that’s a net financial benefit.
The value of a statistical life is generally regarded as being about ten million dollars. Times 300 passengers that's $3 billion. So that's how much they can expect to get sued for when the plane crashes, in addition to whatever the plane was worth. If they're "only" saving a billion dollars, they're losing money.
And if they could somehow save more than 3 billion dollars then that's what they're supposed to do -- at some point safety measures cost more than the value they provide and VSL calculations tell you where that is. (And if you don't think so then I assume you never travel by automobile or buy anything that has ever been in a truck.)
Your lawsuit numbers are also wildly off. Ex: “The US aviation giant has settled the first in a series of lawsuits filed by families of 737 Max crash victims. Boeing will reportedly pay $1.2 million to 11 families of victims killed in the 2018 Lion Air crash.“ https://www.dw.com/en/boeing-settles-first-lawsuit-with-737-...
Imagine if we took car safety so seriously.
I am curious? How does regulation prevents that?
(and how does it prevent a suicidal pilot, from locking out the co pilot and crashing in a mountain on purpose?
https://en.m.wikipedia.org/wiki/Suicide_by_pilot
)
Why don't we just skip a few steps ahead - delete the internet and go back to cable TV? That's where we're headed for anyway.
The GDPR is actually sufficiently abstract IMO to make government enforcement possible and practical. And if you look at how tracking evolved, much of it is still the same old cookie-setting (from what, 25 years ago?) and the stuff that isn't (like ultrasonic profile matching and other shady stuff) is pretty clearly illegal. So it just needs political will on the national level where the enforcement agencies reside. Max Schrems' cases against facebook have shown time and again that these enforcement agencies are often simply unwilling to do their job, with the Irish one being a particularly bad example. But it is possible to do this.
EDIT
Also, regarding the personal responsibility aspect: we're being tracked by platforms we don't even have a user/customer relationship or any other contract with. Someone uploads a picture of me on facebook, and they build a profile based on that? Uncool. Is that a problem between me and the uploader? Certainly. Does that take responsibility from facebook to not mine that data? Nope.
But here's the big question: would these services have even existed in the first place if these laws had been in place? The internet has gained massive popularity because most of the resources on it are free. Look at porn - all of the known sites and run on ads, all the paid sites are essentially unknown. I don't know anybody who uses the latter. Wouldn't Facebook, Twitter, news sites etc have gone the same way if they required you to pay? Just look at what happens when a paywalled article gets posted. Either somebody posts a way to bypass it or a lot of people will never read the article.
Somehow they managed, without the need to track ones every move.
Would the internet look the same, with the same players and behaviours if these laws existed? No probably not. But I also don't think the internet is in a very desirable state.
Maybe, we would have had more invention and uaee acceptance in different ways to pay and consume services instead of this race to the bottom of cheap ads.
Yes, but aren't most of those newspapers essentially partisan politics? Every free newspaper I've seen IRL has been backed by somebody trying to push for politics. From my experience they also tend to not be that informative.
>Maybe, we would have had more invention and uaee acceptance in different ways to pay and consume services instead of this race to the bottom of cheap ads.
The problem is that there is no price equilibrium that will work. People from poor countries can't afford to pay what is a reasonable price for people from rich countries. Poor people in general can't afford to pay. Kids/teenagers can't afford to pay. And this gets complicated even more by the fact that we don't even have payment methods available to everyone. Even if you could afford it, you couldn't pay. Ie I've never owned a credit card in my life and as far as I know I'm not eligible for one. They have a minimum income limit that I fall under.
I'm saying that the ad model is what made the internet so commonplace for a lot of information.
As for informational value. They were good enough to keep up to date what is going on, and then use other sources to dig deeper.
I'm not against ads, in fact in small populations like Switzerland where I'm from, fully subscription funded news papers have never been viable to my knowledge. They were always majority advertisment funded. The subscriptions basically pays for having the news paper printed and delivered, not much more.
But the ads that used to pay the peoples bills were those full pagers, clients payed tens to hundreds of thousand of dolars for a single issue. It still worked reasonably well online on desktop with plenty of screen real estate, but with the raise of mobile prices collapsed.
I worked at one of the largest publishers in Switzerland during that time and saw first hand what got cut during re-org: Fact checkers, specialists, investigative departments, international correspondents, etc. News rooms from supposedly independent news papers in the portfolio got merged. More and more pressure to write article to perform on facebook.
All things that a normal reader will not immediately notice, but that severly affect quality and journalistic integrity long term.
While I think having all information available for everyone worldwide would be amazing, I don't see the current situation sustainable quality wise for anyone beyond the few top percent of market leaders.
I don't know how to solve it either, why I said, maybe we would have come up with different models if we didn't go down the path we did. And a lot of these old organisations have to take a lot of the blame of just not reacting to change for years.
But whoever you point fingers at, as it it stands, we are headed for a lose-lose information wise in my opinion.
If there was an easy way to anonymously pay the site the five cents they get from the advertiser without incurring 500% payment processing overhead then would sites even be using advertising?
But then we get to much the same result. What we need isn't new privacy rules, it's to delete the old banking rules that prevent efficient payment systems from operating.
You can actually make more money using a pricing model like that, because you get to charge $1 to everyone who will pay $1 (everybody wants everything ASAP), but in a few months you still get the quarter from the guy who would only pay a quarter. And having a large volume of free old works to show the world you can produce good material is how you get new customers.
Which also solves the problem for people without money. (This is, incidentally, how copyright was originally intended to work. Screw you again, Mickey Mouse.)
A lot of what we have online just isn't viable on pricing models like this. The main divide you'll see is likely by country due to wealth differences.
What do you say we try it and find out?
> So the moment you run into a paywall you will turn around and start searching for the same thing you were just looking for but for free.
Because the existing paywalls are some nonsense where you have to give them your home address and sign up to pay a recurring monthly fee which you know is going to be a bear to cancel and costs dollars rather than cents, whereas what it ought to be is a browser plugin that just pays them automatically when you visit the site as long as the amount is below your threshold (with a circuit breaker that requires you to manually approve if you get charged more than like $5 over the course of an hour).
None of them caught on though because when it comes down to it, most sites that successfully make money can probably make more money from advertising than they can from this microtransaction system so there's no incentive for them to adopt it.
We as society implement laws to prevent undesirable behaviour all the time. You can certainly argue that the law against robbing banks for example has prevented business innovation around bank robbery, but I believe this is a desirable outcome, and I think most would argee.
I think the internet providing so much information for free is what made it so amazing. I understand that it's not really free, but it's at no monetary cost to the user. The moment you slap a monetary cost on it you create a disincentive for the user to engage with the service.
I do understand though that nothing is free. We are probably going to pay a large price as a society for it.
Ads must die.
It's a proven, efficient, and universally approved way to already enforce food, fire, travel safety and so on. It's only logical that privacy safety follows the same steps. GDPR seems to be a good approach for it, just pending on widespread enforcement of the rogue entities that aren't yet following the law.
I liken the difference between actors to a housecat and a large dog with a lamb. The cat at worst could give some scratches but at worst would probably just annoy the lamb jumping into its wool and kneading it. The dog ideally would look after tbe lamb but could also inflict serious bites or even rip out its throat if it wants. Both may want the meat but only one has the ability to kill it to get what it wants. When it comes to unknowns as the lamb I would go with the cat as opposed to the dog out of sheer distrust.
First, there's the historic precedent of collected information eventually making it into the wrong hands. The Preussian "pink lists" are a classic example, but essentially everything that ended up as PRISM can be taken as a more modern example.
And yes, putting power into government hands so regulate the collection of that data, and then arguing that it's dangerous because of the government might seem a bit contradictory. It's not in my mind. These types of legislation are supposed to disincentivize the collection by private entities after all. Government and intelligence services are (too) close but they are distinct.
And then there's the very real [1] ([2] if you want it more juicy) possibility of corporations targeting individuals for one reason or another directly. Here in the west, this sort of thing would result in your Uber becoming more expensive or unavailable, but imagine being a government critic (or activist against e.g. organized crime) in Brazil right now. All that data going god-knows-where, with the express intent of the collectors to sell it to anynone? Not a great outlook.
[1]: https://en.wikipedia.org/wiki/Greyball [2]: https://news.ycombinator.com/item?id=23529035
It's just a question of how much the companies in question believe that the EU is going to come after them. Once the cost calculus shifts to being on the safe side it'd quickly turn into a norm, but it requires showing some teeth.
Additionally, the risks to advertisers and websites are quite large, which I'm not sure they fully appreciate (unless I'm misunderstanding something here?) - it's not that the consent form is illegal, after all - perfectly legal to have a confusing consent form. Rather, it's that all the personally identifying information thus collected is illegal acquired and held (and it's hard to argue the violation wasn't intentional, to boot!), and the fines for that can be quite large, and can be applied retroactively to whenever the GDPR came into force. Rules always get stretched, but specifically in this way sounds pretty unwise (unless they're cynically trying to have some subsidiary go bankrupt or otherwise encapsulate the risk).
With any luck, the GDPR norms on this front will become global norms, but it's too early to tell.
A coercive opt-in isn't so much illegal; it's simply void. Having a coercive opt-in would be fine yet weird (as I understand it) if you then proceeded to only retain and process personal information to the extent you would be permitted without the opt-in. (IANAL, and only as far as the GDPR is concerned, perhaps if it's misleading enough that violates some fraud statutes somewhere, but that's a different issue).
I can't stress enough how much of a game changer that is, by revealing the amount of third-party trackers on websites (in the order of up to 500 on a single site) alone.
So I guess GDPR works for me. There's a lack of enforcement, though. But that could change; for example, in Germany, bored law firms (eg those not having clients currently), or anybody actually, can print money by starting an "Abmahnwelle" eg. insist on GDPR compliance within a certain period of time, then sue any site for non-GDPR compliance, all the while being entitled for compensation of their expenses if they have a cause.
Sounds to me like it's not in general permitted (but with a huge exemption), but is possibly permitted to the extent that failure to comply with the GDPR constitutes unfair competition. So that means you can't simply use the "Abmahnen" procedure to enforce privacy rights, but rather need to demonstrate you're a market competitor and that it's relevant to your competitive position. Edit: no, I think I misread- that may be a possible conclusion but it's just not clear.
IANAL and all that.
This is very much not true. GDPR isn't restricted to regulating tracking on websites. It also restricts and regulates what companies can do with the customer data they are in possession of. Through my day job I constantly interact with large enterprises (Fortune XXXX) that have vast amounts of personal data through their regular operations (banks, telcos, car manufacturers, airlines, insurance companies and the likes). Nearly without exception they go to great lengths to ensure the data is managed correctly, not used for purposes the customer hasn't explicitly consented to etc. This is as a direct result of the GDPR.
I also do my best to avoid tracking (Firefox add-ons, Hosts file). But up until now I had no leverage against any companies. Now they ought to be afraid when they play dirty.
GDPR is about a lot more than the tracking stuff though, it is about the personal data companies hold and are responsible for, your permission to request it, the risk of fines if they don't comply. Whatever dark patterns they use for tracking logic, they are still bound to use best practice security on the personally-identifiable-information they may hold and may be fined if they do not. That is what GDPR is mostly about, as I see it.
And judging from comments here on HN, it seems to be working. Just two post above yours there's a comment stating that any government solution cannot fix the tracking issue, and it can only be addressed by a company or an individual
And I just upvoted for this piece of comedy:
> So apparently if you criticize gov/bureaucrats on HN you get downvoted.
It's useless because only a few people care enough to report these violations. If anything we need a campaign to get people to start reporting sites which violate the GDPR requirement of an informed opt-in.
? That the site exists in the first place ?
Why is it so hard for people to do business math and these conversations on HN never have anything to do with material reality of the parties involved?
It's understandable that we all want something for free - that's easy - but it's not understandable that we can't grasp how revenue is used to pay journalists etc.. We know they're all on the edge of going out of business and that thousands of news organisations are gone.
Whatever our 'personal cost' is, targeting ads definitely works, it makes money.
So that's the 'benefit' - you get people doing labour for you which otherwise, you'd have to pay for.
Structurally obviously we are now in a situation where “well targeted ads” can generate some revenue, and “well behaved ads” barely can. The future has to be one where dumber ads pay more because tracking isn’t technically possible and/or illegal.
The other option is that everything ad supported goes out of business because the ROI on dumb ads is negative.
I don't want to sound like I know this for a fact, but I'd just like to point out that the future doesn't "have" to be anything. There are always multiple options.
Yes by “has to be” I was expressing a personal desire and prediction, nothing else.
It’s probably not one or the other but somewhere in between.
You have a nice day.
There may be some reason why this can't work again, but all of the reasons I can come up with point to a higher ROI for those ads, not lower.
So you're inching closer to the reality. Read your statement again though: where is this 'magical ad tech' that enables newsies to make a decent dolllar?
It's non existent.
Ergo, they are out of business and you get severely limited content.
So, either people can chose to share some basic information, pay, or get very little in return - that's the current 'business math'.
GDPR fails to take into consideration that math unfortunately.
A more progressive solution would be to create solutions not just legislation that doesn't actually change the dynamic.
Random bloggers generally don't have credibility, they can in some instances check facts and even break big stories and so so in a very credible way, however, there's little incentive and they have no power, because they don't make money and mostly don't have an audience. More importantly, nobody cares about them. If they want to speak to 'The Minister of Defence' about an important event, the Minister will not respond. When the BBC/CBC/CNN needs that interview, the Minister will likely, if there's something on the agenda.
Because they don't have credibility, sources won't trust them which is the most major source of difficult-to-get-at information.
Wikileaks and other teams had to build credibility.
And of course the fact that news rooms cover a massive array of subjects.
Resigning the entirety of news to 'some checks on Google' is glib.
But if we assume that tracking ads provide enough revenue, and we make the tracking illegal, once the market settles I bet that non-tracking ads will be reasonably close.
Yes. That’s a side effect I think needs to be taken into account. I see ad blocking and the GDPR as a way of cleaning out bad actors (and their content), but hopefully also a way to give an advantage to good actors. Like authorities shutting down restaurants that don’t pay their taxes. The selection short term goes down, jobs are affected etc., but it’s unfair competition if they aren’t playing fair.
> where is this 'magical ad tech' that enables newsies to make a decent dolllar? It's non existent.
To be clear I don’t mind if ad blocking and the GDPR in concert work to kill 90% of the 2000-2020 era web in terms of “free content”. Should the survival of online firms, content producers, the adtech industry etc even be a consideration here?
> people can chose to share some basic information
I’m all for that. But without transparency like what the GDPR tries to enforce, people aren’t making an informed decision.
I never consent to anything even on sites I really enjoy and wish would survive, because I don’t trust the chain of actors involved, nor do I understand exactly what I consent to.
But I’d be happy to fill in an extremely detailed survey about everything I’m interested in down to my shoe size, and have that data accessible by any site without even asking me. That together with the browsing context should be more than enough to show targeted ads.
In the end this discussion usually comes down to the question “yes you think subscriptions etc is better but don’t you think others should be free to pay with PII if both sides of the transaction agree? They are adults after all” to which my answer is basically “no”.
If tracking means the website I enjoy get more money out of me, and that I get better ads for it, I'm all for it. For website I don't enjoy, I agree completely, I wouldn't share anything with them, but I would also try to avoid them, so essentially, I do that naturally consent or not.
Then they decided to track everybody, so the ads stopped being relevant and were just about stuff you were already looking for and for the pages you have already opened. Useless as it became, people stopped clicking and they had to start the dark patterns of mixing the ads with content, and filling the first page with it.
Now you are saying tracking is improving your experience, but you just said the ads are useless. Why is that? Are the original ads harmful? And you are protecting from that by surrendering extra information?
Where did I say that ads are useless? That's kind of scary that you come to that conclusion from my comment.
Is it because I am talking about ads available on Youtube? I hope you don't get theses ads, but there's some crappy ads on there that most people will see, unless Google believe you fit in theses criterias (thus crappy ads some people gets).
Normally I would have suggested you to go find a conspiracy theory channel and then watch what Youtube would give you afterward, but I think Google fixed that. At one point I was interested in watching people debunk flat earth conspiracy theory, and god my whole Youtube experience changed, I stopped doing that quickly.
> Google (search) had that kicking-ass feature that it would show you some 20 ads relevant to your query clearly marked on the side bar. It was incredibly useful.
Incredibly useful for what? The end goal of any ads is to make a sale (it can be extremely long term, but still, it's to get cash out of you). In the past few days I watched videos on theses 3 channels:
- Baumgartner Restoration
This one is about art restoration. I like to watch it on the side while doing something else, or right before sleeping, it's amazing, you should try it. Will I ever buy any art related stuff? Unlikely... Art restoration? Unlikely...
- Mathilda Hogberg
Someone that did a MTF transition. I got her on my suggestion feed, no idea why, but I was interested in the result of a full transition so I decided to watch it and then some others of her video. I'm not considering transition, I don't have her taste, I don't have much related to her. Would I buy anything then in this sphere? Unlikely
- Micarah Tewers
She makes dress and is quite interested into historical dresses. She is funny, have a quirky personnality, is quite ressourceful, and what made me enjoy her content is a rant she did about historical dresses on a recent winner of a Best costume award. I'm not considering buying a dress, nor am I interested in making one (I am male just in case it make it more relevant to you).
So in total, for theses 3 channels, ads would have been a waste on me considering the content. I watched at least 3-4 hours in between all 3 channels and they deserve to be paid for producing that content that I enjoyed. Luckily I am a Youtube Red subscriber, so they'll get paid whatever happen, but if I wasn't, then they would have gotten nothing out of my views.
I should receive a Ryzen 5 3600 tomorrow (not an XT sadly, but $/performance a 3600 is better). Google knew it, perfectly well believe me, my suggestions confirm it ;). If any reseller had any ads over one of theses videos, I would have most likely brought it from them. That's what happened when I bought my first netbook in 2010, Google Ads on Gmail (never mentioned it on any email, Google got it from a previous search). So if I had an ad about that processor or any related component, well maybe Baumgartner Restoration, Mathilda Hogberg or Micarah Tewers would have gotten a bit more from ads that I viewed ;).
> Useless as it became, people stopped clicking
That's a big assumption. Google is a trillion dollar industry and that's not from Youtube, it's all from ads. You don't become a trillion dollar industry by doing worst, but by doing more. Why would you then assume it made less money and not that it was simply a way to make more money? It's crazier considering then that you consider that their next step was a solution to make more money... Both tracking and mixing ads with result were to make more money.
> Are the original ads harmful?
What? Harmful? I'm really interested in your thought process, third time now that I ask myself how you get to a conclusion, in 3 paragraphs. The original ads were not as useful. I don't care about dress, please don't show theses ads to me, you will lose screen estate and you are assured to get no click from me, you are losing money by providing me a service that I can't pay for. Show me what I may be interested in buying, and that's most likely be technologically related, even on a art restoration channel.
> And you are protecting from that by surrendering extra information?
I am protecting? Like myself? No I protect the service and his likeliness to get money out of me. That extra information, I give it voluntarily already. If I search on Google, I am telling Google that I am interested in theses things. It's not extra information.
They don't want peanuts from solar charge controller companies, they want big money from say political campaigns whose ads or news articles will read "<opposing-politician> wants to defund solar" or "<our-politician> loves solar".
They never ask for consent to track on the general sense. So I use extensions to stop that.
It starts with "allow necessary cookies" enabled, and the rest disabled, and presents 3 buttons, a 2 small gray ones and a big green one, and unless you're REALLY careful, you'll end up accepting all cookies.
The text is something along the lines of "Cancel", "Save Changes", and finally the big green one is "Accept all cookies".
The trick here is that the small gray "save changes" button is actually the one you want, as the "accept all" effectively enables ALL cookies.
What then comes to my mind is the thought: "Well, would I try to do an ongoing delicate business with a well-known notorious asshole and trickster?". Obvious answer is "no".
So, in most cases, I just leave that site.
Shady sites that use dark patterns are about to go the same route.
And I have privacy badger, uBlock origins, as well as Pi-hole/PFBlockerNG (not at the same location). Our phones have ad blockers as well, though I doubt they’re as effective.
Does anyone have an example of a site with a clear opt-in/out? I'm curious about what's actually stored on my machine in each case. And of course it's not really what's stored locally that's the issue: it's what is stored on their server.
I wonder what's the best of shaming/reporting these examples and if an effective way exists[1]. If you have any ideas, sources, anything—please share.
GDPR consent screens are pure dark UX.
Yes, sometimes the information/actions are buried under a dozen of useless screens, but in some cases these changes are fairly subtle, like reversed the 'active' and 'inactive' states for Reject and Accept buttons on mobile, or things glitching, just a little bit. There's an obvious effort put into make things not only complicated, but also buggy.
So _fear, uncertainty and doubt_ all over again.
As someone who worked both on GDPR/Adtech/consent frameworks and privacy I still struggle to understand how some of these things are legal and what can we do to change it.
[1] Digression: Publisher pressure is one potential solution, but a limited one. Some premium publishers don't want to be associated with this kind of creepy UX. But, at the same time until we've completely killed cookie-driven behavioural targeting (and the alternatives, behavioural, not contextual) higher CPMs/ad revenue will keep the other publishers quiet. Ironically, behavioural targeting is mostly bullshit, and CMPs inflated, but that's a different story.
Obviously this is all pending enforcement actions actually taking place, but it's not obvious that will never happen.
And yes, I'd assume the "phony consent" rate to be much higher, because in some cases I also cannot find the no button and/or accidentally tap on the huge yes button on my phone when my intention was to click the tiny no link next to it.
I hoped that he would repeat the experiment with a tricky one, like the horrendous forms served by Quantcast. In those, if you click "Reject all" nothing happens! How is that even allowed boggles my mind.
It is not. But GDPR is sorely lacking enforcement with regard to tracking consent. The last time I checked only 3 cases were brought up (all in spain), and all of those would already have been illegal before GDPR in my non-lawyer opinion.
If I understand correctly, this sort of trickery is forbidden by the GDPR, but so far no-one has seen any consequences for doing do.
This is precisely the problem with the GDPR to date.
Last August the ICO (British regulatory body) stated that you can't run Analytics such as Google Analytics without a GDPR standard of consent. They've yet to enforce this despite tens of thousands of non-compliant websites.
I don't wonder about their numbers, it's obvious their numbers are good for them. What I wonder is how are they getting away with something that is clearly illegal.
As already explained, in properly implemented GDPR survey, it should be equally easy to accept, decline or ignore tracking, with the default being decline if user doesn't give explicit consent.
I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header.
† the consent (or rather, intent not to consent) is explicit, and although non-interactive at the site level it was interactive at the browser level until MS defaulted it to `1`. Now I'm wishing it were like those notifications/location/webcam/mic access and the dialogs were required to go through the browser itself.
Then I think that's the best kept secret of the industry.
A law enforcing DNT would be good, but honestly it would change the semantics of the header.
Oh, there's nothing like that in the so-called "HTML standard"? Maybe, just maybe, Google being the standard body might have something to do with it, when Apple have been blocking third-party cookies for years now [1], and is in the progress of banning browser APIs that can be used for fingerprinting.
Best of all, this might rollback all those HTML5 APIs that have no business being shipped with browsers, and bring back the web content we want.
[1]: https://webkit.org/blog/10218/full-third-party-cookie-blocki...
It would be much better to make a browser-side dialog like it's done with location tracking and desktop notifications, and also provide a checkbox in the settings. Most importantly it would take away control from shady websites to implement it on their shady terms(though admittedly giving that control to Google's browser may not be ideal either).
The old-school equivalent was small print, and in many jurisdictions there are limitations to how small a font can be used (e.g. no smaller than half the main body size and no smaller than 8 point).
I wonder what results you would see for something like yahoo, the daily mail, reddit, or other sites that heavily rely on ad revenue, which attempt to force the user to accept the cookies through non-obvious no buttons, or long processes to opt out of cookies.