News for hackers. Stuff that matters.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by rwcarlsen on Friday March 05, 2021 @01:19PM (#26360017)
For me personally - all these popup banners and modal walls for websites about cookies and stuff just really make the internet a worse place. I suspect that empirically, they don't accomplish what the GDPR intended to - and they make the internet less enjoyable. Thanks GDPR.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by Bakary on Friday March 05, 2021 @03:16PM (#26361484)
That's like accusing the flashlight of making rats scurry under the floorboard
Re:Dark patterns after the GDPR: consent pop-ups and their i... by robgibbons on Friday March 05, 2021 @05:32PM (#26363083)
You keep using this when people complain about GDPR consent banners. We get it, cookies are bad and privacy needs to be protected.

It's just a really disingenuous and dismissive comparison. Nobody is complaining about flashlights.

GDPR may have been necessary, but the complete garbage heap of an experience the popups have turned the web into is worth lamenting.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by Bakary on Friday March 05, 2021 @08:29PM (#26364397)
>It's just a really disingenuous and dismissive comparison. Nobody is complaining about flashlights.

I don't make that comparison lightly. I'm not dismissing the issue: it is a serious problem that is widespread over the internet. It's not disingenuous: it describes a series of institutionalized behaviors that are directly parasitic on the user.

Now the reaction is to be angry at GDPR because of the pop-ups, which aren't even GDPR compliant in the majority of cases as directly evidenced by the OP link. This reaction is comically absurd, hence the comparison. This garbage heap is the result of shitty implementation by the websites, and ironically a lack of enforcement of the law.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by robgibbons on Saturday March 06, 2021 @12:58AM (#26365536)
First, thank you for explaining your point.

But, nobody here is complaining about GDPR. They are complaining about the terrible UX, and wasted time, and attention, which the non-compliant implementations have caused. That is not an absurd reaction, it's perfectly reasonable. That's why your comment comes off as dismissive.

If anything, it's more akin to complaining about the shitty, half-rate pest control person your landlord calls to get rid of the rats. They do a bad job, poison your house, waste your time, and the rats never go away.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by Bakary on Saturday March 06, 2021 @10:07AM (#26367841)
At the time of writing, the parent comment I replied to ended with "Thanks GDPR". To me, there can be no clearer indictment of the law instead of the shitty practices. Reading through the thread has been frustrating. There are many users coming so close to the realization contained in the analogy but stopping just short of it. I understand that it is confirmation bias to some extent: many other users have made no such complaints. But I see it often in other places as well, and even have had those arguments in real life. I am willing to consider those perspectives, but I simply disagree with them.

>If anything, it's more akin to complaining about the shitty, half-rate pest control person your landlord calls to get rid of the rats. They do a bad job, poison your house, waste your time, and the rats never go away.

I don't want to stretch the analogy further than it can work, but a more apt comparison in my view would be this: a person discovers that every inch of their floorboard and walls are filled with highly intelligent rats. The pest control comes, creates some measures that have a small effect but does not enforce everything at the outset. It's likely they will come back for another round since they are still learning the ropes for such an enormous job. The rats have been there for decades and it is the only pest control service even trying to fix the problem in the entire city. The rats scurry around in a panic, but keep infesting the apartment. In this scenario, would the person try to get the pest control to enforce the measures and get better at it over time, or would they simply carry on as usual and feel comfortable with the infestation?

Re:Dark patterns after the GDPR: consent pop-ups and their i... by mrweasel on Saturday March 06, 2021 @03:03AM (#26365939)
> But, nobody here is complaining about GDPR.

Yes they are, everyone here is blaming the GDPR.

You're right that the issue isn't the GDPR, it's the tracking industry trying to figure a way around it. The EU learned a lot from the original cookie law, but the industry have not, they still try to continue as normally, until someone is hit with a crippling fine.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by iso1210 on Saturday March 06, 2021 @08:16AM (#26367129)
The companies that want to track you have turned the web into a "complete garbage heap of an experience" (apparently, sites I visit don't seem to have this problem). That's not the GDPR.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by wuliwong on Friday March 05, 2021 @01:33PM (#26360178)
I was just thinking about that the other day. The billions of extra clicks and taps and wasted seconds. And for what gain? I think that this can be discussed outside of the basic "should we regulate" or not. Specifically looking at these modals that have spread all over, what actual protection does the average user get from this modal?
Re:Dark patterns after the GDPR: consent pop-ups and their i... by ratww on Friday March 05, 2021 @02:50PM (#26361226)
The modals don't exist to protect the user. Their goal is merely to annoy users to the point they just give up and blindly click "Accept". They only exist for the benefit of companies, and most of them violate GDPR.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by rwcarlsen on Friday March 05, 2021 @03:52PM (#26361935)
Right. I'm not saying the intent of GDPR was to provoke them. But empirically, they are an effect of the GDPR. An undesirable one - that does not fulfill its intent. I'd say we are in agreement here.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by iso1210 on Saturday March 06, 2021 @08:17AM (#26367138)
The banners tell me what websites are shitty and that I shouldn't visit them. That's a tangible benefit.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by ratww on Saturday March 06, 2021 @03:39AM (#26366057)
I'm not in agreement with that. The banners are an effect of shitty companies being shitty to their customers. They already put as many annoyances and dark patterns on their website as they can, with or without GDPR: newsletter subscriptions, opt-in as default, multiple trackers.

Those banners are merely the effect of shitty companies trying to cover their asses and being non-compliant to a law that's actually sane.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by Nextgrid on Friday March 05, 2021 @02:04PM (#26360668)
The problem is that the GDPR is not being enforced properly. The GDPR explicitly bans annoying/misleading consent prompts, so this shouldn't be an issue if the law was enforced. It explicitly learned from the earlier "cookie law" which merely enforced disclosure and led to stupid & useless cookie banners with no easy way for the user to actually act on them.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by harrybr on Friday March 05, 2021 @04:34PM (#26362411)
Exactly. It’s amazing that this is not widely known. The deceptive GDPR pop-ups we all hate are not GDPR compliant!
Re:Dark patterns after the GDPR: consent pop-ups and their i... by icod on Friday March 05, 2021 @08:47PM (#26364477)
But you can't do anything about it, legally.

You can complain to your country's data protection expert, and they will tell you this or that company blah blah but not act. Nothing ever happened. I filed 3 complaints in 2 countries. 2/3 took over a year to receive a response. 1 took about 6 months and nothing changed.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by anfogoat on Saturday March 06, 2021 @07:21AM (#26366924)
Imagine that, an EU regulation resulted in nothing but unintended consequences and close to zero benefit to anyone -- unless you count consulting gigs of course. Who could have possibly foreseen this!

All this talk about how the problem is lack enforcement is an absolute riot. Hey, I've got an idea! Let's write another law to address the lack of enforcement. Uh, even better, a third one to address the dark patterns!

(I'm very sorry for the low value comment but I've apparently got a condition where I am physically unable to resist the urge when the topic is rage inducing enough.)

Re:Dark patterns after the GDPR: consent pop-ups and their i... by sefrost on Friday March 05, 2021 @01:32PM (#26360161)
Same here. I would be interested to know from people outside the GDPR area - do you ever see cookie banners? Do you know what they are?

Sometimes I hit a USA based news website which simply denies access, because I'm in the UK, on GDPR grounds. Which seems an overreaction.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by bombcar on Friday March 05, 2021 @01:40PM (#26360270)
EVERY WEBSITE I visit from my location in the USA seems to have these stupid cookie popups. We added one to OUR WEBSITE even though nothing is hosted in the EU - simple cargo-culting "everyone is doing it so we must do it also".

I doubt it actually does a @#$@$ darn thing.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by josefx on Friday March 05, 2021 @03:09PM (#26361412)
> We added one to OUR WEBSITE even though nothing is hosted in the EU

Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it.

> simple cargo-culting "everyone is doing it so we must do it also".

If your site is cargo culting everything it probably also has a ton of third party trackers for the same reason.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by Zak on Friday March 05, 2021 @03:24PM (#26361584)
> Serve pages to the EU? You get to follow it.

What can the EU do about it if the company has no physical or legal presence in the EU? Have there been any serious attempts at such enforcement?

Re:Dark patterns after the GDPR: consent pop-ups and their i... by strictnein on Friday March 05, 2021 @04:10PM (#26362170)
It's weird how people keep claiming this.

No one says that all sites should honor China's laws for visitors from China. No one claims that all sites should honor Saudi Arabia's laws for visitors from Saudi Arabia.

But magically the GDPR must be followed by the entire world if a visitor shows up from France.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by josefx on Friday March 05, 2021 @05:28PM (#26363044)
China has the great firewall, the EU tried something similar under the "think of the children" excuse, which promptly failed.

Also a lot of people speaking out against China had to find out the hard way what some western companies will do when you speak out against a cash cow that will happily kick them out if its rules are enforced.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by makapuf on Saturday March 06, 2021 @01:59AM (#26365731)
A firewall is not the only way to enforce this I'd guess. If I open a shop in China and do business here I might have to comply with local laws.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by iso1210 on Saturday March 06, 2021 @08:21AM (#26367158)
USA set the precedent when the FBI arrested Dmitry Sklyarov (a Russian Citizen) for working for a Russian company that apparently, while in Russia, broke US law.

It would be like Wendys slagging off the Thai king on a billboard in Dakota, then an employee of Wendys went on holiday to Bangkok and was arrested.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by strictnein on Saturday March 06, 2021 @05:06PM (#26370962)
That's actually a counter example to what you're trying to say.

In this case you are arguing that Russian law should follow a citizen, where as the US said it shouldn't. So the "precedent" that was set (if in fact there was one set) in a case from 20 years ago in which the case against the accused was dropped, was actually that your laws don't follow you around.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by iso1210 on Sunday March 07, 2021 @07:44AM (#26375449)
The precedent set was that the EU could arrest a citizen of the US for working for a company based in the US if that citizen happened to go to the EU on holiday.

The Meng Wanzhou case had the EU being able to extradite a US citizen from the UK for breaking EU law.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by josefx on Friday March 05, 2021 @05:08PM (#26362786)
If it has no presence, no money, no sales, no partners, basically absolutely nothing in the EU then it may be in the clear. But that is a large difference to just not having hosts in the EU.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by bombcar on Friday March 05, 2021 @04:07PM (#26362128)
I have decreed that anyone who serves pages into my machines owes me $billion.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by strictnein on Friday March 05, 2021 @04:06PM (#26362118)
> Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it.

This is completely false. Your laws do not follow you around on the internet.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by anoncake on Saturday March 06, 2021 @07:44PM (#26371991)
> Location of the host is irrelevant, it depends on the target audience. Serve pages to the EU? You get to follow it.

No, merely serving pages to the world (that happens to include the EU) does not mean you have to follow the GDPR. That is only the case if you cater to EU residents specifically (e.g. by taking payments in Euros).

Re:Dark patterns after the GDPR: consent pop-ups and their i... by shadowgovt on Friday March 05, 2021 @02:13PM (#26360813)
We've had them up long enough for somebody to have generated some hard numbers by now. I wonder what the numbers look like on percentage of users that modify the settings from the default?
Re:Dark patterns after the GDPR: consent pop-ups and their i... by layoutIfNeeded on Friday March 05, 2021 @02:20PM (#26360890)
I don’t have a cookie banner on my website. You know why? Because I don’t track my users with (or without) cookies. Maybe you should stop doing it on your website, and then the cookie banner can be removed.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by celestialcheese on Friday March 05, 2021 @02:07PM (#26360730)
US companies started implementing it as a result of CCPA. So it's everywhere now
Re:Dark patterns after the GDPR: consent pop-ups and their i... by yohannparis on Friday March 05, 2021 @01:43PM (#26360305)
You mean developer or website manager who do not apply the law properly. All those deceptive patterns are not part of the GDPR, they should clearly label accept and refuse. I think it will take time for people to stop gathering so much information from users. Once a competitors start to figure it out, users might start using them (i.e. New York Times & GitHub.)
Re:Dark patterns after the GDPR: consent pop-ups and their i... by dominotw on Friday March 05, 2021 @01:46PM (#26360345)
> . All those deceptive patterns are not part of the GDPR

GP isn't talking about deceptive patterns. Point is that no one really understand what these popups are for and everyone just blindly clicks ok.

I don't think i've ever declined a cookie popup. have you?

Re:Dark patterns after the GDPR: consent pop-ups and their i... by icod on Friday March 05, 2021 @08:44PM (#26364465)
I ALWAYS go through them. Either reject, tediously try to find the hidden settings like legitimate interest. Lately I open some sites in incognito window, accept all, then close the window when I'm done. Some science mag I recently visited set 143!! cookies and that's before even showing the consent screen. I've also started to write scrapers for news sites I visit on a daily basis who go over the top with all the tracking and ads. So I "just" scrape their content and have written a frontend to read the content. Most of the time that content is just blown up but if there's something really interesting I have a link to the original article there and again open it in an incognito window.

It has become such a chore, when ever I visit a new site on my phone and see a cookie screen, I navigate back and/or open an incognito window.

What the EU should do is disallow those cookie full page modal consent windows.

Many use overflow: hidden when showing it so you can't just adblock it without having to modify the markup. It has all gone out of hand.

Re:Dark patterns after the GDPR: consent pop-ups and their i... by Semaphor on Friday March 05, 2021 @02:00PM (#26360597)
pretty much every time. If I can't find it or it's too much work, I load the page in chrome or just close it
Re:Dark patterns after the GDPR: consent pop-ups and their i... by yohannparis on Friday March 05, 2021 @03:19PM (#26361513)
Every time I see one I go to the options to refuse all, if they do not allow me this option, I leave the page and add their domain name to my no cookie blacklist. It's strenuous, but I prefer to do so.
Re:Dark patterns after the GDPR: consent pop-ups and their i... by n3storm on Saturday March 06, 2021 @05:22AM (#26366499)
I click accept all of them cause I use Firefox + Privacy Badger :D Badger icon shows in orange the number blocked resources and cookies and in some sites is an amazingly high number.