Nice of them to spell out "we don't actually care about the users, get fucked" in such a clear and succinct way.

Aside, wonder how good/bad ip+agent fingerprinting could be combined with a url that feeds a small randomly generated string with a VERY long cache expiration, with server/proxy no-cache headers (e-tag per agent/ip). Effectively similar to a cookie, without technically being a cookie.

/sarc

The regulation explicitly says so. Easy way to accept, reject and choose. A lot of companies seem to be violating the law in that one. By making it difficult for people to reject cookies.

Where do you see that in the ePrivacy Directive?

1. The ePrivacy Directive says that before setting anything in client-side storage you must have the consent of the user unless it is strictly necessary for performing an operation requested by that user.

2. The GDPR requires consent from the user before using their personal data in a bunch of different ways, and provides a lot of details on how that consent may be collected to be considered valid.

My interpretation of Microsoft's behavior here is that they were compliant with (1) and (2) individually, but the problem was the way they were collecting consent for (1) did not follow the requirements of (2).

GDPR Article 7, 3, conditions for consent.

> It shall be as easy to withdraw as to give consent.

https://gdpr-info.eu/art-7-gdpr/

In which case yes, it is the same as refusal in the context of the law being discussed.

Except for the cookies that they dropped on you by default (completely by accident, of course).

Good to know that they're absolutely unshamed of it though.

I've long suspected that these sites default to dropping cookies when my consent is neither asked for nor received, as MS appears to have done here.

It's good to hear that such behavior is probably illegal in the EU.

> It's good to hear that such behavior is probably illegal in the EU.

Huh? What's the problem supposed to be?

They get discussed a lot here on HN so it's easy to assume everyone's familiar with them, but if you're not then you should search up a summary on them.

That's how I read it at least, which would mean they're defaulting to cookies when no consent is reached, but I could be wrong.

But much more importantly, it is completely impossible in the context of the thread:

> [Accusation 3.] On their cookie banner, rejecting took two clicks while accepting took one.

> On 3, Microsoft argued that (a) rejecting was not actually required to be as easy as accepting and that (b) since the default was no cookies and it took a click to get cookies that rejecting was easier than accepting. The CNIL disagreed on both.