I have seen 500+. Which is like wtf is going on.
I can't even name 500+ companies or websites, who the hell are these companies?
--
[1] which I read as “we see you and your privacy preferences, but fuck you and your preferences we want to stalk you anyway”
Meaning “we've vetted our partners and found their security practises to be seriously wanting, but haven't kicked them to the curb because a very small amount of money is far more important to us than our claims to care about your security and/or privacy”.
https://ec.europa.eu/commission/presscorner/detail/en/ip_24_...
"This site uses cookies to offer you a better browsing experience."
Which of course is total crap. There's no better experience, only a worse experience with the banner.
They seems to use this https://piwik.pro/, which as far as i read seems ok (i did not audit the code personally), i think this data might be legit useful for UX (im really shit a UX, you should ask people working on it though).
If you give companies an easy copy-and-paste way to get around a single regional law then they will do the quickest dumbest thing possible to get what they want no matter who the visitor is and where they're located.
The EU laws are poorly conceived, poorly written, and now we all have to live with them. They can make privacy laws, but they need to make them better.
I truly believe that the EU ruined the web for everyone with their haphazard legislation. And now they're trying to do it again with AI but thankfully they're just getting blocked now instead of everyone trying to comply.
With AI what I saw in the news mostly made sense and did not hinder development too much. But again I would rather they regulate the use because it will have real negative consequences for many people if they don't
A lot of EU laws have also been bad. VATMOSS (especially with the very low initial limit to register) was initially a disaster. It actually deterred people from trading within the EU! The commission's attempt at chat surveillance was thrown out by the parliament, but they will try again. The new AI regulations look problematic. The draft I saw of the AI one was far too broad (included old tech like expert systems) - not checked recently whether it has changed. There are also issues with a lack of FOSS exemptions in the other current law (forgotten what it is called) imposing greater liability for faults in some categories of software.
I think it is important to acknowledge that many regulations are not perfect and I would push for more revisions on the details (although changes in the law also have a real cost associated) that don't hit their target.
last time I caught up on it, it was a very narrow exemption that was only of use to pure hobby projects.
Where would you find a lawmaker with an ounce of foresight?
Oh give me a break. There are plenty of great sites without cookie banners, because they respect your privacy to begin with.
Let's be real, the GDPR banners are far less annoying than the ads that HNers love to defend.
news.ycombinator.com
"Please don't sneer, including at the rest of the community."
There's a large (possibly majority) segment of HN's population which is so pro-corporate as to be anti-human. In cases relevant to the previous post, I've had numerous conversations with people on HN where they defend advertisers, including pervasive tracking, ads masquerading as search results, and the belief that advertisers can consent on behalf of users.
Treating such toxic ideology as acceptable in the name of politeness doesn't make HN or the world a better place. The pro-corporate ideologues here say much worse things than anything I said, which was simply an accurate description of HNers' behavior.
Do you have any evidence for that claim? Unless you have access to raw HN data, I suspect not.
> Treating such toxic ideology as acceptable in the name of politeness doesn't make HN or the world a better place.
Well, if you don't, then you're breaking the site guidelines, and you'll be flagged.
https://ec.europa.eu/commission/presscorner/detail/en/ip_24_...
If that site needs a cookie banner I'm guessing nearly all sites do.
Exactly. And this doesn't surprise me.
The law states: if you collect more data than is strictly required for your site[1] to function and/or send user data to third parties, you have to:
- tell the users about it
- let the users to opt out, where opt out must be as easy as opt in
- if the users opt out, the site[1] must continue working
So yes, that site does send some extra data to third-parties, and informs the user about it. And lets the user know about it. IMO it shouldn't use third-party services, but oh well.
These days it's a source of my constant amazement that 8 years after its publication the people who complain about GDPR the most have not had even the tiniest attempt to read anything about it or understand anything about it.
[1] I simplified this to sites. GDPR is General Data Protection Regulation. All this equally applies to sites, apps, offline businesses, governments etc. To cookies, local storage, offline paper documents, tape records, cloud storage etc.
8 years. The law has been around for 8 years. It has been enforced for 6. It takes about half an hour to read the most relevant parts of it (chapters 1—5). An hour if you're not too familiar with legalese. And yet... "I don't know".
What is there to know? Nearly every website on the western internet has these cookie banners including the EU's own government sites.
The practical consequences of the laws are now apparent.
So what did we all miss that was hidden in the legalese?
Rarely do you see people flaunt their willful ignorance.
> Nearly every website on the western internet has these cookie banners
Well, since you approach is "I don't know and what is there to know", it's no surprise that the industry so easily sold you the lie of "the EU's laws are at fault"
> including the EU's own government sites.
Compare the banner on the site linked above and the usual dark patterns employed by the industry.
are you saying that the explosion of opt-in cookie banners on the web is not the result of the EU's privacy laws?
Heck, the way the cookie protocol works the server already says ‘hey, may I store this cookie?’ by sending the Set-Cookie header. The user’s browser doesn’t have to do anything if he doesn’t want it to!
It is not a question of cookies per se. You can use localStorage and other techniques to track users without using cookies. But you still have to show the warning if you are tracking.
And there a plenty of legitimate uses of cookies.
I stopped using it because if you blocked websites from setting cookies, that meant the cookie consent banner showed on every page rather than the first you viewed because the cookie consent cookie had been blocked. That made blocking cookies entirely apart from whitelisted sites impossible.
Not every one is tech-savvy and that is why we have regulations.
Their purpose is to push you towards working against your own privacy.
Even in its worst form, the cookie warning is giving a significant material advantage to the non tracking website over the tracking website, which without the cookie warning the 2 websites would have appeared exactly the same to all users.
None of those are accurate.
The only adverts they've shown which are relevant to my interests are for Babbel, except I already had that years before they started showing me the ads.
In all seriousness so, for all the effort and data companies like facebook have, the product, targeted ads, is just bad. And sometimes hilariously so.
Seriously so, how is something like targeted ads a product worth paying for if the results are, quite often, so incredibly wrong? I get search context ads and such things, but all that targeted stuff is just so pointless. I never got a single one that was relevant for me. Since I aggressively turned off anything ad related on my phone, ad quality actually got better. Still not really relevant for me, but better.
Or you can read what Github has to say about this: https://github.blog/2020-12-17-no-cookie-for-you/
That website basically has an infinite budget and doesn't have to make a single cent. It is also for the group that should have the best understanding of the law. Yet they still give you the cookie popup.
why do you think a banner should not be in this case ? devs are lazy they aren't going to recreate all the service inhouse from scratch. I don't think the dev team has infinite budget either.
- it offers an explanations that cookies are used, and offers a link to read why
- it offers a way to opt out that is as easy as the way to opt-in
- it doesn't prevent the site from functioning
However, I agree that they shouldn't require non-essential cookies to begin with.
It's from a 2002 ePrivacy Directive, which is still in force, but on its way out and therefore less heavily enforced. ePrivacy Regulation is supposed to eventually deprecate it. The initial idea was for both GDPR and ePR to be enforced from the same date, but that obviously hasn't happened.
Yeah it does[0], and no it didn't get updated. ePrivacy Regulation which was supposed to make it deprecated was never voted on.
[0] "Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose."
Not the ones that the industry has barfed up, and I specifically chose this wording
ePrivacy: "their use should be allowed on condition that users are provided with clear and precise information"
GDPR (among other things): "the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language... It shall be as easy to withdraw as to give consent."
Nothing in any law requires the "accept by default, go through hundreds of checkboxes to opt-out". If anything, those are actually illegal.
This is how Brexit happened, remain tried to explain this stuff over and over again and no one wants to hear it. They want the cookie banners gone, or the bendy banana rules gone. The EU makes itself an easy target everytime they add more.
If nothing else was learned from Brexit that should have been the thing. There actually isn't a point where you can spend enough money to convince people of this stuff when they don't want to hear it.
European here. I squarely blame the business, and often turn back when hit by a particularly obnoxious banner.
> This is how Brexit happened, remain tried to explain this stuff over and over again and no one wants to hear it. They want the cookie banners gone, or the bendy banana rules gone. The EU makes itself an easy target everytime they add more.
Nah, that's stupid. The bendy banana thing isn't a law, it's a class descriptor. It just says that if you want to sell bananas labelled as "class A" they can't be bent into a pretzel. Because go figure, when a restaurant buys what is advertised as high quality produce, they don't want to get a shipment full of ugly stuff that doesn't look good on the plate.
But you absolutely can sell weird, ugly but still edible bananas. They just have to be described properly.
That's again, what the article is speaking about here.
> If nothing else was learned from Brexit that should have been the thing. There actually isn't a point where you can spend enough money to convince people of this stuff when they don't want to hear it.
Haven't changed my mind in the slightest on that. Brexit was a stupid idea and as far as I can see, the UK failed to profit from it.
You're in the minority. Most people will not think every business is responsible for that, they'll assume they're being forced into it.
> The bendy banana thing isn't a law, it's a class descriptor.
Missing the point. Even with millions of pounds you can't convince a majority of people that is true.
> Haven't changed my mind in the slightest on that. Brexit was a stupid idea and as far as I can see, the UK failed to profit from it.
Continue to miss the point here. It doesn't have to be a good idea, years of meddling made it so people were willing to vote for a bad idea. That's my point.
They've gotten far less annoying as of late, in good part because the EU made it clear annoying the user into acceptance isn't going to fly.
But early on, when websites had the great idea to make me opt out of 78 "partners" one by one, my annoyance was not at the EU, but at the website forcing me to click 78 checkboxes, and a reaction of "WTF? Why are 78 companies being informed I'm reading an article?"
> Missing the point. Even with millions of pounds you can't convince a majority of people that is true.
Did you know the US also has equivalent banana regulations?
> Continue to miss the point here. It doesn't have to be a good idea, years of meddling made it so people were willing to vote for a bad idea. That's my point.
Yeah, to their detriment to the point that it killed pretty much every other eurosceptic movement, and apparently they're not that happy with Brexit anymore themselves either.
You're very much speaking from inside a bubble here. The only people I ever hear blame the EU for this, are on HN.
A bit chicken and the egg, this. Persistent and well funded influence campaigns are precisely how people came to hold the views you describe. I personally wouldn't treat "leave" logic as some kind of particularly organic position. Rather its success demonstrates how one form of persuasion was more effective than another.
This is true. I'm not sure anyone has demonstrated it working the other way though so it seems to be infinitely more effective.
It's happening again now with EVs. "The EU is forcing you to swap your car for an expensive EV with their Euro6 rules." There doesn't seem to be any come back to it at all.
1. Businesses trying to violate your privacy. 2. A government trying to protect you from said businesses.
Either of these entities could avoid the cookie warning, but there are very different reasons why they do not.
not ah yes, let's go back to having no regulation of corps tracking people.
People would be quite enthusiastic to more regulation which required no cookie banners where users had, eg., expressed a preference for no tracking at the browser level. And likewise, to require the provision of such "no-tracking signals".
I suspect something like this is on the horizon, and in part, something google was trying to head-off with its 3rd party cookies stuff.
"more, better!"
this is so true and kind of hilarious to see Americans not understand this. When a regulation happens and it's day to day effects are not working out great. The answer will always be to regulate more, add more rules and restrict things more.
The EU is inclined not to create regulations at first. They prefer to hold meetings, seminars and inform companies of their effects to encourage them to self regulate. If after years this does not help they will either:
A) create subsidies to help companies implement changes. but only if they have shown they are will to interact with the EU governing bodies.
or
B) Add rules and regulations to force companies to act a certain way.
The beautiful disconnect pointed out in the article where Apple thinks the meetings are negotiation and EU is basically showing that their smiles and friendly words are just formalities and change is happening no matter what Apple thinks or not.
While still protecting the “business freedom” of the said business.
They could have forbidden cookies and tracking altogether, but they are too probusiness for that.
Which, technically, it isn't.
> Which, technically, it isn't.
That's still a dark pattern, because by definition, dark patterns aren't illegal - just barely legal, and detrimental to the consumer.
I think there are very, very few people who are earnestly proud of the work the EU did with this regulation every time they waste finite brain cycles on yet another cookie banner. I don't really know why Europeans use this as an example of their system of governance working as hoped.
The anticipated effect of requiring consent is that by forcing companies to shine a flashlight on their own bad behavior, they will instead choose to correct their behavior. That didn't end up happening in practice.
That said, I just looked at it, and this is my idea of a well-made popup: https://gdpr.eu/what-is-gdpr/
[0] But for the Betteridge law of headlines and Gell-Mann amnesia
I do not care why cookie banners are there. All I know is that they weren't there N years ago and now they are, and they are annoying.
Is there some background reading on this? I would like to use Cloudflare as one of my DNS providers but this issue has always bothered me.
This is false. The GDPR does not mandate privacy - the GDPR mandates the protection of certain kinds of personal data, much of which (e.g. IP addresses) has legitimate reasons for being collected (e.g. abuse protection). Claiming that every business that shows a cookie warning is trying to violate your privacy is not only objectively false, but extremely intellectually dishonest - although that's about par for the course for GDPR enthusiast zealots.
Obviously it's a flawed implementation and the powers that be fought hard against an automated flag, but that's what we should be fighting for to fix it.
Yes, GDPR is absolutely beneficial to citizens. And quite often in invisible ways, since e.g. we never hear about the breach of customer data that didn't happen.
Actually most popups are already in violation since there needs to be a "no to all" option. Lots of them get fined, but there's just so many.
They should probably make the fine more like: "your domain goes down for 2 months" to be taken more seriously.
Teenagers could have predicted this was the likely outcome.
Whoever wrote it was either incredibly incompetent in not predicting this outcome or intended this outcome.
I see you being deliberately antagonistic and strawmanning an opinion you disagree with.
Have you really not noticed how defensive and antagonistic cookie banner supporters become when people say anything negative about it?
>> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.
The correct way to get rid of cookie banners is businesses using cookies in a responsible fashion, and sooner or later this is going to happen.
Also, your framing misses one important point: If I have the choice between mildly frustrating cookie banners that raise awareness for the situation and simply having all your data sent to 500 advertising "partners" the moment you enter a website, like it is in the US, I choose the mildly frustrating cookie banners.
Freedom does come at a cost.
Do not blame regulators for evil forces trying to circumvent those regulations.
It's what the article you are commenting on is all about. Go (re-)read it.
Me: "No. We are not in the EU. I refuse. I also refuse to abide by Congolese law or Peruvian Navy doctrines. If I break Myanmar PII laws, I will take my chances. EU is no better than anyone else, pushing their crappy laws, I refuse to care about."
Boss: "Ok! Np."
Unfortunately there are only so many GDPR compliance officers around, and they have to focus on the bigger fish to fry.
Here is another. Work for a company that made a machine used in automation. Designed around US regulations it had a clamping force of 1600 N, same biting force as an adult panda. This thing can take off fingers and arms.
Only know about the 1600 N because it was risk assessed for EU market. After a year of design changes. Moved to fail-safe motors and changed order of operation. The machine no longer leaves someone limbless, it cannot take off a fingernail.
EU requires safety to be engineered into the product while USA allows for deforming machine operators and victim blaming when something goes wrong. Company has discontinued the USA model and only manufacturers the EU model.
EU regulations can help USA citizens when our politicians reject good regulations for personal profit.
Concretely in this case it seems quite relevant to include GDPR, which consumers seem pretty happy about, and which many Americans look enviously at while their data is slurped up without recourse by credit bureaus and data brokers.
I'd need to be convinced that's true. More regulation was a huge part of the successful campaign to get the UK out of the EU. It seems to get effusive praise in places like this, but in daily business, I generally hear the term GDPR spat. Is anyone expecting the incoming car regulation around beeps and bongs every time you approach the speed limit to be received well by ordinary people? The USBC stuff that this article heaps praise on is a great example, techies love it, everyone else in everyday life I've only heard complain about it. Maybe it improves things long-term, but I can't remember hearing anyone say "more, better" about any of these things.
I would say the overall sentiment I've heard is that there is a general suspicion that the reason European business lags so far behind the US is that we're held back. I don't think the handful of people that will be able to play Fortnite on their iPhones will change this. It certainly wont if they end up needing multiple app stores for their daily apps.
I think the main reason was that populist politicians where allowed to lie unopposed. £350M per week for the NHS anyone? (End: constants strikes in the NHS about small pay rises to mitigate inflation). Singapore on Thames? Easiest trade agreement in the world? Trade agreement with the US? Free ports everywhere? UK world beating (of course world beating, they can't just be good, or even better than others, they have to aggressive beat them down) in everything ? I haven't heard that for a long time.
As a populist you can say whatever you want as you usually don't have to stand up for it. Same here. Three Prime Ministers in the same legislation period since Brexit was done. The liars are mostly gone but Brexit is still there.
The reason for Brexit was in no small amount that pugilistic lies where allowed unopposed.
The UK was and is a cultural outlier in Europe. Even if this were true (which I'm not convinced it was), it's not representative of what's going on in the rest of Europe.
The 52% who voted to leave were not voting for a massive deregulated society. In most cases, actually the opposite: "bring back control"
Depending on your definition of success of course.
https://www.telegraph.co.uk/business/2024/02/28/uk-eu-are-be...
The notion of regulation as being on a sliding scale where "more is worse" was a manufactured American meme created by the Kochs in the 1980s. It emerged from some of their epic fights with the environmental protection agency and their subsequent lobbying and public relations outreach efforts that followed. They set up and funded number of institutions dedicated to telling this story (and others, including that one about hairdresser licensing). The Heritage Foundation, the American Enterprise Institute, and the Cato Institute to name a few.
If you think about it for a few seconds, dumbing down a complex system like laws or regulation to "more vs less" is quite stupid. It's like saying that some programmers believe in "more lines of code" and some believe in "fewer". Do you want more laws or fewer laws? The question doesn't make sense. You want the right kind of laws, right? Ones that are as simple as possible and no simpler. The same for code.
I think it's important to put this type of thing in a historical context though. These ideas and stories don't emerge out of nowhere - there is usually money behind them. In this case, it was money from an oil and chemicals company that had a singular goal - to fight the EPA - so it could destroy the natural environment in America with absolute impunity.
I'm sure they've spent money on promoting this, but there's many reasons you'd come to this conclusion other than having it "manufactured" for you by billionaire conspiracies.
You have to start by considering that your political opponents are capable of thinking for themselves if you want to ever do more than just preach to the choir. Declaring them idiots in the guise of "providing historical context" isn't helpful.
https://www.bostonreview.net/articles/jonathan-m-metzl-dying...
And yes, I do think mockery has become de rigeur in American politics, both left and right.
A lot of effort could be expended by the government to improve the quality of its own workforce and the incentive structure under which they operate, but that is boring and unsexy work, which always gets put aside in favor of some new ambitious piece of legislation that makes a politician feel good about his or her accomplishments.
Then the backers of said legislation turn around and wonder why the purported beneficiaries don't like it. But politicians and the upper-crust live in an alternate universe where their own needs are met through special systems and their own view of government employees comes from the sycophants and yes-men.
I mean, a majority of Republicans want single payer. A majority of the people where I live (in a country with single payer)... also want single payer.
It's objectively a very popular policy. The majority of people on medicare and VA benefits would probably try to fight you if you tried to take them away.
Nonetheless, socialized medical care is objectively not an oligarchy friendly policy. Some of them make EPIC mind bending profits from private healthcare.
And, they have a lot of control and influence over the media, which results in rather a lot of anti-single payer propaganda.
The mix of these two forces can sometimes have interesting results. Like this: https://otb.cachefly.net/wp-content/uploads/2010/10/dont-ste...
Which is definitely more visceral than intellectual.
I don't disagree with the general sentiment though.
Atlas Shrugged was more the manifestation of the wet dreams of snowflake industrialists who felt intimidated by union power and communism (which were significant in the 50s, hence the rise of the middle class).
Also, if you are not selling in the EU you would never start a high tech company in the EU. Whereas people travel across the world to found high tech companies in the US that are not even selling product in the US.
It appears that you were incapable of hearing this message and have responded as if I just said "MORE REGULATION! NOW!"
Almost always more regulation doesn't work in complex markets. Incentives are very very difficult to get right ... the exceptions where the regulations work are extremely rare. And for the most part people don't get them right.
As if the simple incentives of a deregulated market (aka: profit above all) do work in complex markets.
That's OP's whole point, you want the right laws, not more or less, sometimes more regulation is needed due to the complexity of an industry, sometimes less is completely fine. That nuance is what's missing, and it's exactly the hard part of the whole system to be balanced.
> the exceptions where the regulations work are extremely rare. And for the most part people don't get them right.
For the most part, companies don't get it right either. Case in point: Boeing self-regulation, USA's finance industry self-regulation pre-2008, etc.
Just let go of the dogma.
Ever since industrial workers sided with Nixon, the government has become a class warfare tool where highly educated but not-that-well compensated professional managers have worked to denigrate and disenfranchise the rough-and-tumble bullies from their primary school days. This deep-seated resentment explains a lot more than money alone explains, especially since the government itself is in control of the money supply and thus not that beholden to monied interests.
You don't have to let foreign competitors that ruin the environment and oppress their employees compete directly with local competitors. You can slap them with tariffs or even prohibit their goods entirely.
When the US is fighting to maintain influence in Eastern Europe it understands this logic and applies this lever.
When the environment and labor rights are at stake though, it's like "what lever? I don't see a lever anywhere"
The correct sentiment is both "more good ones, better" and "less bad ones, better"
And that's because it's right. That "good ones" is both subjective and a challenge tantamount to "write bug-free code". People aren't worthy of that kind of trust.
To summarize: Laws are like lines of code. Nobody in their right mind would put programs on a spectrum between "more lines" and "fewer lines". Lines of code that help do the necessary work are good, and unnecessary lines of code are bad. And so it is with regulations.
I think I'd nuance it a bit. We see it as necessary. Necessary because otherwise powerful companies take advantage I think most can point to bad places in life for government regulations, but when the opposition is more powerful than most governments you need to fight with the most powerful thing you have.
Since we have so many consumer protections, much of how we end up engaging with the law around business practices is to our benefit. We're always aware we can raise bad business practices with an ombudsman (etc.).
So our lived experience of government regulation is, in large part, positive.
The fringe american "all regulation is bad" is hyped up for certain media causes, but very alien to most in practice. It's essentially unimaginable to the ordinary european that large corporations would have a better social conscience than government.