It was included. The rule hasn't been changed. The interpretation of the rule in one specific case has been confirmed, without having changed the rule. That means that, as written, this dark pattern was always illegal.

> How many cumulative wasted hours have been spent tapping through cookie pop ups?

Maybe not quite as privacy conscious, but a quick workaround: (1) Open in incognito (2) Click big, easy to find "Accept" button

Note that "cookie" popups are about tracking, not cookies. If you agree in incognito, they might fingerprint your browser and track you outside of incognito too, since you've agreed.

Thanks for that. This game should probably be mandatory, for anyone involved with the cookie legislation. If they succed, they may propose a new draft.

On one hand, this was required from the beginning (this is just a clarification of original intent, not a change or addition)

However it's deeper since the popups we see today were never recommended nor required by the original regs. The laborious nonsense we endure was invented by websites as a workaround for the regs. So it wasn't obvious that consent parity would ever need to be clarified like this because it wasn't even obvious that the industry would come up with such an awful popup pattern to begin with (though in retrospect we should've known I guess).

The fact the popups were never even compliant anyway is just a combination of wilful ignorance, dark patterns, consulting companies wanting to sell something and - yes - an added set of people innocently misinterpreting regulation.

This is nonsense talk. How do you differentiate between compliance with the regulation, and a "workaround" to the regulation? I guess it's at each of our discretion, right? It's subjective? Or are they the same thing? You can keep calling them "workarounds" but that distinction only exists in your own mind.

It's a workaround if a website manages to make users accept cookies that would otherwise refuse just by making it so inconvenient UI wise to refuse them. The limits and edge cases on this may be subjective but then again so are most laws.

Why do you consider something nonsense just because it’s a subjective judgement call?

Lots of things are subjective judgement calls. They are not all nonsense.

Many people sadly have this mindset that if something is not explicitly and comprehensively spelt out then anything goes, therefore any complaints for bad implementations is purely on the regulations for not being explicit and comprehensive enough. Now, obviously, there's SOME truth to this, but too often people think in black and white.

I often think it usually goes the other way. If a regulation is too specifically defined, it often ends up having gaping holes and other issues.

Most of our longest standing torts and crimes have subjectivity right at their core, and I'd argue that's not a coincidence but survivorship bias.

The world just isn't black and white, and attempts to legislatively render it so inevitably cause problems (though, obviously too much subjectivity and something because uselessly vague; it's a tricky balancing act for sure).

Depends on the legislative culture. For example, from the Copywrongs talk from now Felix Reda:

> The other legal tradition underlying the EU copyright system which is the continental European tradition of droit d’auteur (or Author's Rights). In this system, the authors of cultural works have certain inalienable rights that they cannot sell to a right holder. And, importantly, the exceptions to copyright, the interests of the public are written into the law. [...] The problem with the continental system is that it is quite inflexible because every time a new technological development comes about, you have to change the law to allow this type of use without a copyright infringement. So every new way of dealing with culture is fobidden by default. - https://www.youtube.com/watch?v=wL_Wxu6x1HU

Whereas other legislative cultures prefer to set a general framework, then leave the details to the Courts and or to Government ministers.

The rules are very clear: if you collect personal data¹ for other purposes than legitimate interest you need to give people an easy choice to deny that collection and the service should not be worse because of it.

I mean the EU published a guideline on what it calls deceptive design patterns. They are quite clear there with what is unacceptable (link to PDF): https://edpb.europa.eu/system/files/2023-02/edpb_03-2022_gui...

When even Google felt they had to make "reject all" equally big and not hise it in a sub menu, you know that everything else is likely not legal.

¹: whether you use cookies for it or not doesn't matter

I think you're misunderstanding what the poster was talking about. You're taking "the popups we see today were never recommended nor required by the original regs" to mean that the popups have become something that wasn't intended by the regulation (but the regulation did require popups).

I think that the poster was saying that the popups themselves as a concept were never recommended nor required by the regulations.

> but the regulation did require popups

Yeah I guess the word "require" has a few interpretations. The regulation didn't explicitly require popups, it required user consent IFF a company wants to collect/process/sell data the company doesn't need, but the intent was that companies would not do this, with consent being the exception, and the mechanism of consent was neither prescribed nor a focus: it certainly wasn't annoying popups per reg.

The regularion required informed consent. Nobody ever said it has to be done with popups. This is what people ended up doing afterwards.

Only when deceptive patterns became clear the EU made clear that allowing one simple "ok" option and a million convoluted ways to say "no" is not resulting in informed consent.

Wheter you us a popup or hide it in a menu with the default of not tracking does not matter.

This should have always had been implemented by the user agent, not by web authors.

You're still thinking of it exclusively in terms of frontend web development (consent popups) whereas the original regulation was largely concerned with reducing data collection by the business in general, at a backend/database level & even things like manual in-person/on-paper collection.

The frontend content screen component of the whole topic was something that emerged afterward as businesses' attempt to get away with continuing rampant unfettered data collection.

To add to this, the law allows for data collection for a bunch of reasons. However, it intended to put a stop to a lot of data collection practices that were not to the benefit of the user, and informed consent is an exception to still allow for that, but only in the case that the user is actually actively OK with it. But of course, companies then started harassing users to make them agree, and the narrative arose that the EU "forced" them to do it.

> How did they not include this to begin with?

A bigger question is: why didn't they go with the DoNotTrack header.

A bigger question is: why didn't they go with the Platform for Privacy Preferences (P3P) header?

> P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&a... for more info."

Because the absence of a "DoNotTrack" header does not imply that a user has consented to being tracked, as a user may be using a browser that doesn't support "DoNotTrack". Nor does the setting of a "DoNotTrack" header necessarily correspond to a specific user, as it may have been set by a administrator policy. Nor would it be informed consent, as it is configured before the user has been informed as to the uses for which private data will be applied.

The GDPR requires that consent be informed, explicit, freely-given, and limited to a specific use case. Of these, the "DoNotTrack" header could be at most freely-given. Its design as a binary yes/no that can be configured across all sites prevents it from ever being used as a way to grant permission to track.

While the presence of "DoNotTrack=1" could be used to assume that no permission to track has been granted, this is already the default assumption that the GDPR requires companies to make.

> as a user may be using a browser that doesn't support "DoNotTrack"

There are at least two solutions for that:

1. Force browsers to support the header.

2. Always send the header "DoNotTrack=boolean", then force websites to take action (show a popup) when there is no header.

i really don’t understand how it came to this anyway. the industry is so stubborn. what is not clear here? you should not spy on your site visitors for marketing purposes.

when you join a poll you do so with consent, when a market/social/political research entity invites you to a focus group (for example) you get at least a coffee and snack if not real money.

websites just get this for granted? it’s like stealing. it will never stop until the industry gets some understanding of these concepts.

understanding is not the issue, caring is

We're talking about the advertising industry here. Calling these companies stubborn is a gross understatement.

This is the industry that perfected psychological manipulation in the pursuit of profits. It's built on decades of research into the best ways to associate brand names with positive feelings, and plant a desire to make a purchase in the subconscious mind of consumers. They will do anything humanly possible to deliver ads to your senses, and they've corrupted every media technology to do so since the existence of public broadcasting.

The internet has just given them the most profitable delivery mechanism, and in turn has made technology companies insanely rich. These same adtech giants rule the internet, and can build the playground they need to make ad delivery more efficient than ever. Now these profits can trickle down to website owners, which will in turn take the path of least legal resistance, and employ every dark pattern imaginable in order to maximize _their_ profits.

And if this corrupt business model wasn't enough, adtech companies can perpetually multi-dip by selling the data they collect on shady data broker markets.

So, no, it's not just stubbornness, or lack of understanding. Deceit is built into this industry, and these cookie consent forms are just the tip of the iceberg.

The solution requires much stronger regulation than the GDPR. Unfortunately, this is very unlikely to pass given the influence advertisers have on governments.

> websites just get this for granted? it’s like stealing.

Isnt the user getting free content in return?

If the website decides to offer content for free, then it may do so. If not, the website is entirely allowed to put up a paywall, or to display *non-targeted* advertisements. What the website is not allowed to do is mandate payment in the form of private information.

Absolutely not. If I see a cookie popup or subscribe modal, or even get interrupted reading with a pop-up prompt I immediately leave the site and add it to my blacklist.

Archive for life.

Free content was around before advertising on the web, this whole 'but they get free content' spiel was cooked up by advertisers.

Static we pages are cheap to host. Very rare is the article on [news site] getting mllions of simultaneous hits. But they all want videos embedded everywhere, gifs galore when all I want is to read their 20 min video in 2 minutes. They want their website hosted on the cloud with every new/hot architecture out.

How mant nyt articles are reprints of a reuters article the nyt then turns into 10 pages with aforementioned videos etc.

They did this to themselves.

It became painfully obvious over time that the people who drafted the legislation did not think through either the ways malicious compliance could work against their goals or the incentives of all actors in this story.

I think the possible forms of malicious compliance were considered, and are explicitly forbidden by the GDPR. The GDPR requires that consent be freely given, and be as easy to withdraw as to provide. The various end-runs around that requirement, such as redirects on rejected consent, click-through to privacy policy, click-through to a list of 3rd-parties, and so on, are all violations of the GDPR.

They aren't a form of malicious compliance at all, because they aren't compliant at all.

Naively, I'd expect a lot more enforcement action if so many sites were non-compliant. Did the EU create a policy it couldn't enforce, and that's the larger issue here?

From the gradual ramp-up of enforcement, my optimistic view is that they are closing out the deliberate "misunderstandings", establishing precedent for each one. I really should start collecting links as they come out, as they're a pain to track down later, but they've established things like "Targeted advertising is not a legitimate interest for the purpose of Act 6, and requires consent."

This is because their goal is to get a consent, not to give the user a choice.