GDPR was designed around the "Do not Track" browser flag, so that websites can get a semblance of consent using those annoying cookie prompts, with dark patterns like hiding the "Decline All cookies" inside the second page of the prompt, or using very small fonts and gray colors + very confusing language. and they have carried on with complete impunity for 5 years now.
this post was submitted on 31 Oct 2023
933 points (99.9% liked)
Technology
59207 readers
2520 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Luckily in Germany the law states that at least the "Decline all cookies" button has to be in the same place as the "Accept all cookies" one. So at least the local sites are kind of easy to navigate.
Only problem at the moment are "Accept all cookies or buy a subscription" banners. But as far as I know the courts are inclined to side with the customers on this one as well.
I mean, most companies still don’t abide by it tho. There’s lots of sites where you can accept all cookies or you have to jump through a few hoops to decline the non essential ones.
Am I supposed to trust the company to correctly define 'essential?' Seems easy to weasel around and makes me nervous.
It's almost certainly going to be litigated at some point, so a court is going to define "essential"... eventually.
Also a good point, I agree
I install the extension consent-o-matic and let it jump through the hoops for me.
I just open any site with one of those cookie-banners in a private window so that any cookie it creates will be deleted as soon as the window is closed.
Another ridiculous half measure that I need to actively engage with a website to avoid being harvested.
They should have made websites not track be default. If I want to be tracked, then I can go and hunt down a link for the pleasure.
Do not track is the default position. However websites really want to track you. They choose to gate their website behind that popup.
Remember you can follow gdpr without these popups on your website.
Totally. If we’re going make real change with this we need hard enforcement that says “you must provide a default setting that can be set per browser” or something that avoids the entire need for sifting through their cookie menu to find out I left one turned on. But this is peak example of ineffective laws to govern the internet made by people who don’t have any experience in computer science. I’m sure we will continue to see “do not track is just a suggestion” messages continuously. Or the requirement for each individual website to specify what type of tracking in absurd detail.
A while ago I ran into a site that had a toggle for your selection of being tracked or not, but there was no text indicating which side of the toggle meant yes/no and it stayed green no matter which way you toggled it. Can’t imagine it would hold up in court but I’m not the one with the money to deal with it.
My personal favorite is the one that defaults to "off", but when you go to the detailed page it puts "legitimate interest" on every single goddamn option with no "disallow all" option.
Oh, I hope this goes to higher courts and cascades down to be an alternative to the stupid cookie banners.
Also, what exactly are "essential cookies"? Why does the website get to decide if they are essential?
Something like your login session would be an essential cookie.
There are certain things you are allowed to use cookies for even without asking for permission (i.e. they wouldn't even need to tell you about them). These are effectively the kinds of things that are necessary for your website to work in the first place: For instance if you have a dark and a light mode and you want people to change this even without logging in, another example is language settings (this is why sites like e.g. duckduckgo can have a "settings" tab despite the fact you are not logged into anything).
The rule-of-thumb is that everything that is directly related to the functionality of your website is fair even without asking (they are "essential").
Of course the specifics are a little more tricky: For instance you could have a shop in which you can put things into your "shopping basket" without being logged in. This is fine since it's core functionality. However, if you use that same cookie to also inform your recommendation algorithm, you could get into trouble. Another aspect is 3rd party cookies: These, while not theoretically always requiring permissions, in practice do need expressed permission since you, as the website host, cannot guarantee what happens with these cookies (and 3rd party cookies are, in general, an easy way to track users, which isn't core functionality for most websites).
Thank you for the thorough response. Personally, I would like to reject absolutely everything and then have the website tell me which functionality won't work without a cookie as I try to use it.
It would quickly get very annoying because one of those essential cookies is remembering that you rejected the rest.
The law doesn't actually mention cookies at all. Its about tracking users, they need your explicit consent to track you or to share data about you with third parties. Cookies are the primary way of doing this but there are others and they need your consent too.
Personally, I would like to reject absolutely everything and then have the website tell me which functionality won’t work without a cookie as I try to use it.
This is really excessive - the fear of cookies in general is vastly overblown. The only issue is whether cookies are being used for "site functionality" or for "3rd party tracking" purposes. The latter can be achieved through other means as well (a website could simply track your usage if you login and sell that info).
It's not the cookies that are the problem, it's the tracking and the data sharing that are the problem.
If you're really that concerned you can browse in "incognito" mode, use the "Tor Browser" or just disable cookies entirely.
To be fair, some websites do need certain cookies to function correctly. As a random example, if a user goes to their bank's website, they're more than likely not going to know what to enable/disable cookie wise so that the website is still functional for logging into their account. So I can understand lumping those actual essential cookies into one category in those instances. However, I agree that it's almost certainly being abused.
Probably worth noting: Only things like non essential third party cookies need consent. Essential cookies for things like the users active session that are not shared don't need a cookie banner.
Source: gdpr.eu/cookies
Yeah. And sites are still more than happy to show those in the popup, just to muddy the waters and make it more complicated than it needs to be. Same with "legitimate interests".
And sites are still more than happy to show those in the popup, just to muddy the waters and make it more complicated than it needs to be.
As far as I see it, displaying information regarding strictly necessary cookies that do not require consent is good practice.
The website linked above states that "While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user."
I think the complicated part is mostly the deliberately bad UI that is often used for cookie banners. They purposefully use a bad layout and color scheme in an attempt to push the user to just click "Accept all". As far as I understand if a websites only had strictly necessary cookies then I think they wouldn't even need a cookie popup in the first place though and could simply list this information on a separate "Privacy Policy" page or such.
Good to know, thanks for pointing that out
Meanwhile the "Remember Me" checkbox only works on maybe half of the websites I use.
Every request your browser makes to a website is like the first time that website has ever seen you. Each image, content request, etc. All from somebody completely new and unknown[1].
The only way a website can identify you as a user is to ask your browser to store a unique ID (generated by the website) that you can then present with each request. This is a 'cookie'. It gives you a temporary identifier that can be used to recognize later requests as coming from the same person.
Without a cookie you couldn't login to any sites. Even if you're not logging in, without a cookie the website couldn't remember what your language preferences were (important in Quebec or other government sites), or timezone, etc. It couldn't even remember that you wanted to reject all "non-essential" cookies and would prompt you on every page request. Every single request would be from an unknown person visiting the site for the first time.
[1] Yes, I've simplified some with keep-alive etc.
Just to add up, the "session" cookie is a special case for the browser which identifies them as such, and handles them as temporary because usually it expires in a few hours. Also, they must have an expiration, and it clears them as soon as you close your browsing session no matter if they expired or not.
The cookie which stores the "Do Not Track" request is pretty essential don't you think? Cookies is just what we call a particular websites local device cache. You can store whatever you want in there but they are best used for user settings, what user configurable theme should the site use, maybe you have a login token in there. Essential cookies (cache) the site needs to function properly.
Cache isn't scary, it's the tracking info and other related data they use to sell you ads.
I don't mind "essential cookies". Otherwise I would just configure my browser to not accept them at all.
But what really interests me is what "legitimate interests" are.
But in the end it's not about the cookies, it's about the tracking. The technique is irrelevant.
First off, INAL, and my data protection training pre-dates the GDPR.
Things like security, fraud prevention, but also direct marketing. In the sense of a shop you already bought something at sending you an email "hey we've got a new shipment and you bought these teas before so we think you might like this one". The last one has to be opt-out, and indeed be direct, they can't do "hey check out our parter stores and have you heard of Raid Shadow Legends". Essential in that context would only be processing information strictly necessary to fulfil the contract, which would be more restrictive than IRL (where your tea guy indeed does remember what you like).
The data you collect has to be necessary for that legitimate interest, and you have to balance it against the consumer's right to privacy. In a nutshell: If someone would complain, or someone reasonable (legal term :) wouldn't expect you to use the data in the way you do, better get a lawyer.
Meta tried to argue that it covers all the tracking and all the advertisement they want to do "because we have a legitimate interest to earn money and the user wants a service and privacy doesn't matter", they ran against a brick wall with that one. Legitimate marketing in their case would be to tell you about their other platforms.
How about the cookie to store the setting that you don’t want non-essential cookies?
Turn off all cookies and find out.
I went to one major website and look at their privacy policy page (can't recall which one now, wish I did), and they explicitly said something to the effect of "yeah we see your 'do-not-track' header, but since there's no law that defines what that means from a technical implementation perspective, we're just ignoring it".
I am not exaggerating either, they plainly said (1) we see your flag, and (2) we're going to ignore it.
And it's like motherfucker, you've got the technical chops to be able to detect the flag and acknowledge as much, but in the same breath are trying to tell my you don't know what to do about it?!
My ass they don't. Like Judge Judy used to say: Don't piss on my leg and tell me it's raining.
Yeah, I've had similar experiences when requesting account deletions for services. Basically "we are under no legal mandate to delete your data, get bent", because I'm not lucky enough to be protected by GDPR or California law.
Dear Dystopian Cyberpunk Corporations,
Sincerely,
Everyone.