I couldn't care less about web fonts though. I'm not downloading them from Google or "bunny.net" or anywhere else. My computer has some of the nicest-looking fonts around as system defaults, and websites can either work with that or get put into reader mode.

Enacting legislation is one thing. Somalia is excellent at enacting gun control legislation.

They are never geo-filtered either so everyone is forced to see them.

I’m usually a big advocate for privacy and this was obviously done with good intentions but there were so many better ways to do it and I doubt 99% of people do anything but click okay without reading it.

At least if the browsers did it the UI would be standardized and you could have default persistent settings.

Now that there has been a massive effort to implement it I doubt it will ever get fixed or go away. Even though the decline of supercookies and Firefox’s new 3rd party policy has largely made it obsolete.

No we can't. We can think of scummy adtech companies who feel entitled to their business model.

The GDPR very specifically says that the option to decline tracking must be at least as easily accessible as the option to accept.

The only way the EU is to blame for the pop-ups is that the regulation hasn't been enforced strictly enough.

If they asked anyone with atleast a minimal technical knowledge, they'd get a lot better solutions.

>If they asked anyone with atleast a minimal technical knowledge, they'd get a lot better solutions.

This sentence implies that: (1) Nobody with even minimal technical knowledge was consulted when writing GDPR. (2) The problem of websites tracking their users can be solved through technical means. (3) One or more of the solutions are so trivial anyone with minimal technical knowledge could come up with them.

I disagree with all of the above assertions.

I don't understand this line of thinking. You are declining the cookies, so obviously you prefer not to be tracked. And it's obvious that it's not the EU who made the varying, annoying, and often purposely misleading dialog boxes to decline the cookies, but the companies who want to force their tracking on you. Without the EU law, they would just do it without asking for permission. So why blame the EU?

Would some design guidelines be helpful? Maybe but it's still fundamentally flawed and I doubt it'd be enforced.

As I said the only possible option where there could be design cohesion is via the browsers (or maybe a EU-controlled open source JS plugin but that's even worse).

I don't ever use the cookie popups because fine-tune control of cookies doesn't have much privacy ROI. I want to use cookies on most sites and ublock does the rest.

I highly, highly doubt the tiny percentage of people not using an adblocker but are still technical enough to uses cookie popups regularly and effectively is really worth the cost.

I get the impression people want this to be a good idea, because it sounds like one, instead of considering whether it is.

Has the ever been a study that shows the real-world utility of forcing sites to use cookie popups?

"Of course burglars choosing less protected houses is the only predictable outcome... so why wouldn't the makers of security systems be responsible? Who else would be?"

I still don't get it. Without the EU laws, it wouldn't be magically easier to block tracking cookies, they wouldn't offer a choice at all? What are you arguing for?

> As I said the only possible option where there could be design cohesion is via the browsers (or maybe a EU-controlled open source JS plugin but that's even worse).

We tried that, it failed: https://en.wikipedia.org/wiki/Do_Not_Track

> I don't ever use the cookie popups because fine-tune control of cookies doesn't have much privacy ROI. I want to use cookies on most sites and ublock does the rest.

The cookies for functionality/session are not affected by the cookie popup.

> I highly, highly doubt the tiny percentage of people not using an adblocker but are still technical enough to uses cookie popups regularly and effectively is really worth the cost.

I use an adblocker and still decline on the cookie popups. I assume you are doing, too, otherwise you wouldn't complain about popups you don't see?

> Has the ever been a study that shows the real-world utility of forcing sites to use cookie popups?

Me able to decline them is real-world utility. If a majority or at least significant portion of users is successfully tricked into accepting the cookies, then that calls for a refinement of the law along with better enforcement, not for retraction of the law. "Let them have it", what a bleak, defeatist thing to suggest.

You are blaming the makers of the law for what is very obviously the fault of the perpetrators, who are trying to get around the law in profoundly shady and just downright shitty ways.

I am glad the EU law exists, without it there wouldn't even be the option.

I'm being serious. If there are better ideas, which there probably are, let's put them out there.

In contrast, the GDPR does not place requirements for cookies if they're not used for storing or processing personal data (the ePrivacy directive which I'm less familiar with might require a notification about them). It does not even require a popup or user's confirmation if personal data is processed on a legal basis other than consent (though these uses may need to be listed in some kind of available privacy policy document). Finally, as GDPR is mostly technology agnostic, its requirements remain the same regardless of whether the data collection is done using cookies or any other means.

I've never heard anybody who wasn't in or adjacent to the tech surveillance industry complain about this.

Feigning ignorance. People in or adjacent to the tech surveillance industry (either working in it or having a substantial portion of their net worth invested in the industry) whine about cookie consents constantly, but nobody else gives a shit.

Are you telling me that you have no financial or professional stake in the matter? You haven't worked for or invested in a company that profits from tracking people online? Nor any of your friends or family?

https://oblador.github.io/hush/

You're welcome!

European countries do the same for USA gov on US citizens.

In the US at least, any spying is illegal when both parties are within the US and the packets never leave the US.

And no doubt it must be even more illegal to then perjure yourself in front of congress about not having engaged in such illegal spying, when in fact you have.

These laws are a formality and have no teeth.

Noone? Why am I not surprised?

Laws can be enforced without executing people.

What is important here, and why these laws matter, is how trivial it is to get access to your data, or for companies to sell your data. That’s why I appreciate the European’s effort to have better laws for our privacy.

If you really want to be government proof, then you better host everything in a server in a remote secret location out of their reach.

`SELECT * from citizens where data_points < 50;`

And then somebody aims a botnet armed with zero-days in your direction. But yeah, that requires dedicated adversaries that actually notice you -- which is not a given, I'll agree.

EU privacy laws are a step in the right direction. It’s progress. We can build on it.

Against modern sophisticated governments who are busy, lazy, distracted to ask Netherlands to give them my data. I'm not exactly a high priority target. All I have to do is to make it a little harder for them to access my data.

Also, proper client side encryption is really difficult to break. Usually they need to compromise the client in order to read it.

What are they going to do, fly to my fringe country, knock on my door and politely ask me to stop storing encrypted blobs on their servers? No, they will not. First, their TOC does not forbid it and second, they are way too lazy to scope me out of the crowd, and third, they will only start shutting users down if their free plan starts costing them too much. I've been doing this for years and nobody seems to give a frak (Google included).

And I am just a regular guy who wants to make sure his code and passion projects (and personal / family photos) are never going to get lost even in a case of disaster. I never in my life did anything to warrant government attention.

Let's be honest: all those big players sing all our data to whoever they like, any moment they like. Pretending one is better than another is dishonest.

At this point we're supposed to believe what amounts to feel-good talk.

But I keep asking: "How do we know for sure?"

I haven't done anything illegal nor do I need to protect some mega-important knowledge but I still dislike giving easy access to my data so I automated parts of my workflow to double-encrypt my most important data and send it to several off-sites plus an own self-hosted server.

Sure, they likely know remote Linux network zero-days but the odds of them wanting to target me in particular are minuscule so... ¯\_(ツ)_/¯

You are trusting them just as much as a server in any other country. Saying "Switzerland" is all marketing for privacy enthusiasts who aren't going to do anything on their own.

Be angry at the sites, not the legislation.

And if it makes people angry at the legislation, the lying back-stabbing “your privacy matters to us” arseholes in marketing are successfully making that goal backfire.

It usually isn't compliance, malicious or otherwise.

It is malicious “we know we are breaking both the letter and the intent, but we know they don't have resources to properly enforce against everyone, so we are going to chance it for as long as we can”. The vast majority of these consent systems are not compliant with any of the relevant regulations (ePrivacy Directive, GDPR, CCPA, …). They will fix it when they get a slap on the wrist. If they get anything it will be a slap or a warning because while anyone in their right mind is pretty sure that the non-compliance is deliberate, that is nigh-on impossible to conclusively prove.

Have you... have you seen our politics? What makes you think that we think other people trust our government? We don't trust our government. Hell, it's trusted so little that one of our large political parties is basically entirely devoted to making sure that the government can't get anything done.

The public-facing excuse for Joe Q Public is "they can't be trusted!", "less taxes on your hard-earned money" (when corporate share of taxes has plunged from the 50-50 split it used to be, increasing individual taxes), "the government is not efficient" (usually because of lots of onerous regulations and reporting and oversight that, ahem, a certain political party insisted on to fight "abuse")

Can you think of a reason people would do that if they didn't trust those corporations more than the federal government?

But when it comes to surveillance on this quotidian level, I think private/corporate surveillance it’s far more relevant and problematic. In that regard, I’d slightly prefer a European country with good privacy laws like those you listed, because (probably) Bunny is not itself at the level of a panopticon such as Google, and the likelihood it has or would avail of avenues for resale to panopticon capable data brokers is less than it would be for US companies.

But even there, it does seem like a quite incremental improvement. The door is still wedged open, but now probably less wide, and probably with a stronger doorstop. It would be nice to not leave the door open at all.

I use DDG because I don't like Google. I can't do the same with my government.

You can only trust services like signal which make it impossible for the operators to access your data

GDPR is mainly against corporations making money out of knowing who you are across the web, it won't save you from a government actor

So you're safer from the USG inside the US.

Then again, they don't have a great track record of following those restrictions, so I doubt it really matters.

Of course it is. After American Wars in the Middle East killed and displaced millions, there is good reason to be wary of Americans and the American government.

What? Your government is the worst one to go not respecting your rights.

I think this is important to consider. In practice, it's difficult to have any recourse with an American company. In Europe it's more expected and common that government and consumer orgs take an active role. Both legal culture and culture-culture (?) are just very different, leading people to preferring to steer clear of this expensive and adversarial (compared to EU climes) environment.

Crypto AG was based out of switzerland.

You don't know who secretly owns any companies in Switzerland today. Your favorite Swiss VPN could be owned by Equifax or Acxiom for all you know.

> and is a warmonger.

This is flamebait unrelated to data privacy risk. If you don't want to use American companies because you have an political opposition to supporting US companies, that's also a valid opinion. You don't have to twist it into a data privacy argument.

It's not flamebait, it's a legitimate reason. A country who has been killing people in various wars/invasions is unlikely to behave ethically when it comes to privacy.

If you behave unethically in one area, I have every reason to assume that you'll also behave unethically in another area.

Rather than drawing a broad hand-wavy link between ethics concerns and respect for privacy, you'd be much more accurate in measuring privacy by directly considering their practical legal frameworks that protect privacy.

> A country who has been killing people in various wars/invasions is unlikely to behave ethically when it comes to privacy.

This doesn't hold up. There are many countries that will straight up man-in-the-middle internet traffic with no oversight that have been at peace longer than Germany.

Some are worse than others. America is one of the worst. War, invasions, mass surveillance, mass incarcaration...

A country like America that has been murdering people in many wars around the world without hesitation is unlikely to take my privacy seriously. They don't respect my right to live, do you think they will respect my right to privacy?

Several countries in SE-Asia have been at peace for much longer and will happily man-in-the-middle your internet traffic at the whim of their unchecked government powers [e.g. https://en.wikipedia.org/wiki/Internet_censorship_in_Vietnam].

A country's participation in war and their effective protections for privacy are not strongly correlated, demonstrably so.

I can understand why people have strongly held views about foreign policy but this sort of political flamewar is repetitive and predictable, and therefore off topic here. It has veered particularly extremely off topic in a "Bunny fonts" thread. And I'm afraid you've been posting flamebaity/unsubstantive comments in other threads too.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

or any government, especially our own, for that matter. Some just have a better track record at being bound by the rules they give themselves than others.