Why not just let browsers controls who sets what cookies?
I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups?
Then browser vendors can ship a delete all non same origin cookies on tab close or something.
At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that this is compliant with the law.
There's so much more pressing than just cookies imo.
The very long and well-sourced wikipedia article doesn't even contain the word "cookie": https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
This if from article 7 of the GDPR [0]. Clearly the situation described involves a much harder time withdrawing consent than giving it - which goes against the law.
I may have misunderstood what you meant but how is this being laser focused on cookies? This articles applies beyond the Internet anyway.
[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.
[0] https://ico.org.uk/action-weve-taken/enforcement/?facet_type...
https://www.openrightsgroup.org/blog/parliament-must-hold-th...
They also had a massive budget shortfall which meant they sent out what amounted to a protection racket letters demanding £40 per year from every UK business, even though almost none of those businesses should be paying it.
All this while simultaneously investigating the ad industry, finding it is egregiously breaking the law, but then doing nothing about it.
The UK's ICO is taking an extremely broad definition of who should be paying it, but an extremely narrow definition of who it should enforce against.
I might add that the £40 it is demanding is almost 3 times the normal £15 yearly fee for running a business in the UK.
Everything outside that field cannot, I guess, be considered as legitimate interest.
They have small print after each of their emails that says that GDPR allows them to email me because they believe I might be legitimately interested in purchasing their services.
It failed horribly because it was voluntary. But now that it's a GDPR requirement, perhaps that might have a snowball's chance in hell of succeeding.
As in, this is the first GDPR banner I've seen that is actually legal under the GDPR.
One of the most precious things we have is time and the constant cookie interruptions are a nuisance that should be kept from sight.
1-click to opt-in.
multi-click and losing your current page to opt-out.
Sharing is caring.
Does this mean that sites that offer free but ad-supported content still have to offer that content? So I can watch those free Youtube movies and listen to those Spotify tracks ad-free because EU Law says fuck you.
How is this fair?
Edit: Okay, okay, non-targeted (and no 3rd party) ads are okay, got it xD
The fact that spotify doesn't want to because it's less profitable is where EU law says fuck you.
Also Spotify can easily require a free login and associate everything with that, no tracking cookies required. They just can’t associate your playlist with your web browsing habits.
Tracking is not necessary to show ads. Certainly there are business models which depend on this, but hey who says our society benefits from those? Targeted advertisement and free informed democracies don't mix well IMO.
1. A law that aims to prevent stealing should be deterring thieves, not just regulating padlocks.
2. Technical measures are insufficient because cookies are regulated by purpose. A third-party cookie for fraud detection is allowed; a first-party cookie for analytics requires consent. It also prevents using necessary cookies for secondary purposes, something that literally cannot be accomplished through technical means alone.
As a minor point, the so-called "cookie law" also regulates browser fingerprinting. I have a hard time imagining that you could legislatively mandate effective anti-fingerprinting approaches.
Because it doesn't have anything to do with cookies. You don't need a banner if you use CSRF cookies, you don't need a banner if you use them for stuff like CloudFlare's anti-DDoS script, and you certainly don't need a banner if your site requires cookies for basic functionality like logging in.
The browser can't possibly tell what the server is doing with its cookies. It might even be using a single cookie as CSRF protection and ad tracking at the same time.
isn't that the 'allow 3rd party cookies' setting ?
That doesn't prevent Facebook or Twitter or advertisers in general from tracking you across dozens of pages or more, it just means that they'll have to issue you a new cookie each session.
This is actually the case, what do you mean? All browsers that I know of (firefox, chrome, elinks) allow the user to control what to do with cookies.
Browsers wouldn’t fall for dark patterns.
I would like to store a cookie or a client-side cert to remain logged in, but not the other cr. Granted, they could use that cookie to track me, but this is what GDPR is about.
IIRC, Internet explorer used to ask you for each cookie, circa 2000. These pop-ups became more and more common with time. The web would be unusable with those nowadays.
The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.
Some sites don't even give you a "Disagree." Liberty of London has no way to opt-out: "By closing this box or by clicking accept and close, you agree to our use of cookies."
1. Having some legitimate interest is not necessarily sufficient - the privacy interests of the data subject can override the legitimate interests of the controller (Article 6.1.f itself), so the controller has to explicitly take the privacy interests of the data subject into account, and the reasonable expectations of data subjects matter. So this can be tricky, as it's up to the organization to demonstrate that their legitimate need outweighs the data subject interests.
2. the right to object of Article 21 applies for this clause, with explicit clarification in 21.2 that yes, people do have the right to object to direct marketing profiling;
3. the controller is required to explicitly inform the users "At the latest at the time of the first communication with the data subject" that they have the right to object to this processing (Article 21.4, and Recital 70);
4. As article 21.5 states "the data subject may exercise his or her right to object by automated means using technical specifications", so this opens the way for specifications such as the upcoming Global Privacy Control header (https://globalprivacycontrol.github.io/gpc-spec/) which would be a legally binding "I object" mechanism.
Because of this, whenever an organization can assert some other basis for lawfulness of processing (e.g. consent or performance of contract) then that would be a safer option than trying to assert a legitimate need.
https://blog.gingerlime.com/2020/sonos-is-spying-on-me-and-y...
on mobile so can’t easily post links unfortunately. EDIT: here’s a couple of links
https://noyb.eu/en/noyb-files-complaints-against-apples-trac...
https://blog.gingerlime.com/2020/does-ios-14-protect-your-pr...
"We're not going to lie to you. Your privacy isn't our priority. It's not even close. Not because we want to track your every move. But because we simply don't care. We'd rather spend what limited time we have actually improving the web site. We're into taking pictures and adding content, not obsessing over what your dog had for lunch so we can sell it to MegaEnormousBigCo. We're not tracking you. We're not tabulating you. We're not folding, spindling, or mutilating you. Seriously, your personal life is not important to us. However, you may or may not be of interest to the people who advertise on this web site."
Here's the other perspective: Data brokers don't really want your data if you don't want them to have it. It's a legal liability for them, and most of them are struggling to work at the scale their customers demand already. But publishers want high advertising rates and that means advertisers want to make good bids and that means both actually want a data broker involved to deal with the technical (collection, filtering, aggregation, ETL) and legal (GDPR) bullshit.
But then publishers and advertisers don't do their due diligence or decent engineering and just shovel illegal shit to data brokers on the backend. The ones that shut up and launder it do well; the ones that actually try to do a good (technical, legal) job drown in account management and data processing overhead.
So fuck that site. They are the ones that care about your data, they're just making a show of keeping their hands clean while they pay someone else for the dirty work and hiding behind their (half willful half stupid) ignorance of how their own industry works.
—Another fake quote
Google being the biggest ad company does not give them the right to surveil all that walks the earth.
Is disabling it there globally æquivalent to not accepting on such banners?
This is also why the GDPR requires consent forms instead of relying on browser cookie settings, as it covers the intent of tracking itself as opposed to any technical means by which it is achieved (and this is why functional cookies such as for logging in or shopping carts don’t actually need consent at all).
They talk about cookies, and little more.
what I wanted to say is that cookies are not illegal by gdpr means and gdpr does not make a lot of stuff illegal, it's just that SAVING personal information or information that could identify somebody needs explicit permission.
edit: another thing ip addresses, by german law you are required to save it, when a user can register on your site and your site allows users to submit data. because authorities force you to give them out when a user did something illegal. (§ 7 Abs.1 Satz1 Nr.4 TKÜV, https://www.gesetze-im-internet.de/tk_v_2005/__7.html) In germany it's basically: fuck the privacy if they harmed our law! or at least you need a way to "activate" saving ip addresses.
of course that is forbidden. and that's exactly why it is really hard to tell if companies honor it.
If that would be the case, maybe more sites would follow GitHub here.
And then Facebook takes out full-page ads attacking your company for allegedly hurting "small business."
"The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."