Kill the Cookie Banner
32 points by loige
32 points by loige
In the meantime one can use extension Consent-O-Matic. It lets the user pick their preference and from then on it automatically clicks away the cookie banner according to said preference.
I would also like to add a reminder that when you use the extension and come across cookie pop-ups that don't get handled (happens rather frequently for me, unfortunately), you can open the extension window thing in the browser and report an unsupported site.
This was posted on HN a week ago, and my comment there became at +116 my second-highest-voted comment (my top comment is against stale bots’ very existence on bug trackers). Given how clearly it resonated there, I think it’s fair enough to duplicate it here this time; Lobsters’ responses could be usefully different in character. I do think the whole cookie banner thing has been phenomenally mishandled, enforcement should have come down on malicious pretend-compliers like a tonne of bricks but instead mostly took five years to politely ask people if they could stop a small part of that. (Early cookie banners were almost always obviously non-compliant with at least one of ePD and GDPR, normally both. Nowadays they’re more commonly at least not so obvious about it.)
The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/or clicking a button cannot constitute informed consent”; and see what they try next.) From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them out of the way. Just as shrink-wrap licenses and even simple contracts have at times in some jurisdictions essentially been neutered, so that only terms that a reasonable person would expect to be there are enforceable, at which point it becomes obvious that the whole thing needs tearing down in favour of standard licenses/contracts. In the Australian state Victoria, for example, there are standard rent and property sale contracts; for renting you must use that contract, and I got the impression that residential sales practically always use the standard contract.
But of course it’s impossible to convince someone of something when their livelihood depends on their not understanding it.
I think the “perhaps” parenthesis sentence was a mistake, it needed a bit more nuance than that. Shouldn’t have added it after writing the rest.
(For further personal background: I’m an Australian that now lives in India and has never been to Europe, but who has read GDPR entirely and knows a lot for a software developer about things like ePD and GDPR and relevant Australian and US legislation until a few years ago.)
This is so much needed, but also a bit confusing. The data processing consent form is not the cookie banner. The cookie law is about storing information on the user's device. The big in-your-face forms ("We Care About Your Privacy") are a work-around for the GDPR, not for the cookie law. Some websites try to combine the two consents (cookies + data processing), with results sitting at an unknown legal status.
It’s really quite funny how the first visible parts of GDPR-readiness work in ~2017, cookie banners, were actually nothing to do with GDPR, but rather the ePrivacy Directive amendment from 2009, which everyone had ignored until then.
I have always been frustrated with the cookie banner and happy to see an initiative like this one, although I am not fully convinced this is the right form... It's not really a petition, it's an invite to reach out to each EU country parliamentary person without a clear action.
WDYT? Is it worth pursuing?
I am genuinely curious and hopeful this can work out somehow...
sometimes reaching out to the parliamentarians is more efficient, as petition can fail due to lack of traction (I don't really remember official rules, I was vaguely aware of them during Stop Killing Games campaign)
and if you want to check how authors want web to be - consent-o-matic is nice "emulator" of desired behavior (unlike "I don't care about cookies" which IIRC accepts everything)
This idea is neither new nor complex. Your browser already automatically signals other preferences to websites, for example your preferred language.
I'm not sure this is a great example given that most websites actively (yes, based on experience the people who make the decisions will make a conscious decision) ignore the browser's language preference.
You might be interested to read https://wiki.whatwg.org/wiki/Why_not_conneg, especially "Negotiation by natural language". In my opinion, it's a vicious cycle: users have no incentive to configure Accept-Language because websites don't employ it, and websites don't employ it because no useful information can be gleaned from the unconfigured default value present in most requests
That's an interesting read, I'm not sure how much I agree with it though. I should say that it should be easy and obvious for a user to make an active choice for language on a website, while the Accept-Language header would only be used to set a default.
At the end of the day we need something to use for the default/initial value, unless we are meant to show a dialogue on every first visit where the user has to make a language choice before being allowed to view the site. And Accept-Language is at least better than relying on geo-location (there's a special place in hell for websites that infer language from location and then do not let you override it, or tie currency choice together with language and location).
Edit: I think what I might want more than the current Accept-Language is something more like Prefers-Native-Language where I can set which (prioritized) languages I want but only if they're the native language for a website.
To give an example: I'm Swedish but fluent in English, so if a site's native language is English, I want to read it in English. But for sites where the native language is Swedish (like, say, government websites) I want to read it in Swedish.
The idea of "If the content is originally produced in a language in set X then show that language, otherwise do language A" is perfect and I've wanted it for ages, not only on the web but also in any other digital place. Failing that, at least indicate what the original language was (this is not always obvious, and there is a bilingual news website I occasionally visit that for the longest time didn't indicate which version of the article was the original one -- fortunately they fixed that). But this kind of stuff is too much nuance for the average manager, I guess.