I had a discussion with my CFO about removing the cookie banner from our website (because we don't set any tracking cookies, and cookies for things like login are exempted) and he said "yeah, but it makes the site seem less legitimate.
It's like those warnings in cigarettes packages saying they will kill you. I know cigarettes are bad, but the warnings also make me believe there's at least "some" control in how bad they are. Now if I buy one without the warnings, I will worry those in particular are extra-shady and likely to kill me even faster.
Companies could stop selling and storing your data. They could only use cookies when absolutely essential. They could use lots of kinds of UX.
This is the equivalent of businesses who put a big visible "20% the state says we have to give our employees healthcare" fee on their bill to throw a hissy fit and hope customers get angry at the government for protecting them instead of the business for exploiting them.
As many have said before:
it's basically malicious compliance. They're supposed to be super annoying ... Instead of complying, they choose this obnoxious practice so they could continue ... monitoring every action a visitor does.
You don't need a cookie banner to be allowed to create Cookies. You only need them if you're using them for something like tracking. [1]
Regulators didn't enforce cookie banners. Cookie banners are a form of malicious compliance. When you complain about them, you are doing the lobbying work of ad companies for free. The correct solution is to just not spy on people, and the problem is that the EU didn't go far enough and just ban the behavior altogether. [2]
Cookie pops are malicious compliance to regulations that legitimately protect consumers. You’ve cherry picked one bad side effect to throw out all the ways the EU is way ahead of anyone else in protecting consumers [3]
When I see these dialogs listing they have 1289723 gazillion vendors they share data with, I know that whoever is in charge of analytics, privacy or both at the company is incompetent.
The obvious conclusion is that when you try to regulate something like this you arent going to get the behavior you want.
It's trivial to make a site that doesn't need a cookie banner: don't set any cookies. Modern web devs have probably forgotten, but this is actually the default behavior. Cookies don't get set unless you do something to make it happen.
And cookies that you actually need for functionality don't need a banner either. If you're setting a session cookie for logged in users so they stay logged in when navigating between pages, you don't need one.
Why, then, does practically every site in existence now have one? Because they set unnecessary cookies. Because they choose to set unnecessary cookies in order to track you for purposes that are not necessary to the actual functionality of the site.
Every single cookie banner you see is a big sign that says, "We value our ability to track you for marketing purposes more than we value your time."
Apparently they're willing to say that. I still see it as a win. No tracking and no banners would be ideal, but at least the regulation forces them to be honest and up front about what they're doing. I'd rather have tracking and cookie banners announcing it than tracking with zero indication of tracking.
Most small business owner's I've spoken to are keenly aware they are only one bad lawsuit away of closing down. Almost no one care's about the cookie banner. Most just mindlessly click to allow cookies and go on with their life. There's almost no cost to having it.
E.g. "we don't set any tracking cookies, so we're already compliant with the law even without banner, so there's nothing to decline or agree to".
He may be right, sadly. I’ve seen the lack of a cookie banner used to suggest that a site was doing something shady or not complying with the law.
Most people don’t have knowledge about the finer details of cookie laws. They’ve been trained to believe that legitimate sites who comply with the laws will implement the cookie banner, and not seeing it feels suspiciously unprofessional.
Back in the day, this is how we introduced AWS at a large company. We just did it. And once done, they couldn't deny that it cost a fraction of what we were paying our supplier and that things took minutes to set up rather than weeks. And that they worked a lot better.
Yes, there was shouting in meeting rooms. And yes, people said "you can't do this". Turns out they were wrong. A few years later I mentioned this to Werner Vogels. During a meeting. Where my CEO and CTO were present. And where everyone was feeling very good about us being one of AWS' biggest customers in our region.
So when someone says "you can't do that", sometimes you should make them prove it.
(At the time AWS was a good idea. Today dependence on a US service provider is a harder sell in Europe. The _first_ question you get today is if we can host it ourselves if we need to or if we can use a local service provider.)
One of the best indicators that something was not spam was the unsubscribe button.
I have yet to head that cookie prompts are a sign of legitimacy. What business has customers that would think that way?
Although if you've ever worked retail, you'll know that plenty of customers are idiots.
Whatever "Surely no one is that stupid!" assumptions you make will be proven wrong no matter what you do.
So how would you do ePrivacy Directive compliance/risk avoidance in a non-obnoxious way?
Completely eliminates the need for a cookie permission bar.
What's more, if the 'cookie' is entirely local (i.e. it's never sent back to your own server, e.g. you're using the local storage API and the javascript on your page never puts that information into a request), like how this would normally be implemented nowadays, then these requirements don't apply at all (because a cookie according to the law is just something your server gives to the user's device and then the device gives back later).
If you want to remember dark mode with a cookie, then you can just gate that setting behind a “allow functional cookies” toggle.
Getting consent for functional cookies doesn’t have to be done with an intrusive cookie bar on landing. You can request consent as it becomes needed. There’s other ways of complying that aren’t dark patterns.
You are correct that people keep stating such things. But it is incorrect.
That example would be an essential cookie, also known as a strictly necessary cookie.
A shame this FUD is still being spread.
At least for GDPR...
The only ways to actually track without a consent pop-up are:
(1) stay off the device entirely and process server-transmitted data under legitimate interests with a privacy notice, or
(2) confine any device storage to what's strictly necessary for the service the user requested
in fact. you probably don’t need to track users.
I used to have long conversations with frontend developers that "no, when I log on I don't want to be forced through a look-at-the-new-feature-we-made" sequences. And then they went ahead and did it anyway. And usually whatever flag they tried to set to make sure you only saw it once would malfunction, so next time you'd get to click through it all over again.
(If you want to tell users about new features, show a unread flag on a notification icon and make it a one-click affair to make it go away. Don't get in users' face with stuff they don't want)
If every webdev who would say no can be trivially replaced by webdevs who won't say no, then yes, it is webdevs.
I'm going to risk months of unemployment and explain to my family why this is more important than eating when I get home. The internet is serious business, they'll understand."
-- the hypothetical webdev in that scenario, I guess?
Mate, it's just a cookie on a site.
It is an important fight for our future with our tech overlords. But sure - some will be happy owning nothing.
This is really one of those "First They Came" moments.
Unfortunately convenience trumps all. So for many "its just a cookie".
Thank god I am just a minion who now can go home worry free. Yay!
Be it the EU for regulating disclosure and consent requirements, users for being "lazy" and usually just accepting all, or the webdev for not staking their livelihood on denying the banner - I'm sure they'll all get blamed before someone sees the ones actually demanding it be done can be the problem.
Because the industry really respected DNT[0]?
Regulations are needed when the kids cannot play nice in the school yard.
GDPR is actually not that bad if you read it rather than subscribing to much of the malicious compliance we see.
99% percent of them intentionally turn the "decline" choice into a 5 - 10 step game of dark patterns even though the EU policy says it should be equally easy to decline. They know its bullshit but they also know the chance that someone will drag them through court is low.
It would be your payment information, which is orthogonal to most of the tracking data.
The black market demand for leaked advertising-related tracking data is basically nil, except maybe in cases where it’s related to something else exploitable or usable for blackmail like if someone frequents cryptocurrency exchanges or porn sites. Nobody cares to pay for black market data about you shopping for towels on Amazon or things like that.
Check out: https://killthecookiebanner.eu/
It feels similar to how CA environmental regs become the national standard simply because the market is so large it’s not worth splitting on it. So they just slap a cancer warning on everything
2. If you are a purely US entity with no actual business presence in the EU, you only need to comply with US laws and nothing else. If the EU doesn't like a purely-foreign website, it's on them to set up a national firewall and block it.
Case in point 1: It's not on you to comply with China's laws, it's on them to block it if they want to
Case in point 2: China's local businesses with no EU presence do not follow GDPR and do not display cookie banners even if accessed from the EU
1. When is the last time you saw China enforcing its laws outside their borders? Why would EU be any different?
2. China has laws that are directly contradictory to GDPR laws; you may be required to retain data regardless of consent; if your website is based in China you have to follow local laws first before you follow contradictory foreign laws that have no jurisdiction over you.
It’s only broken to the extent that it collided with a messed up world where websites track even when they don’t need to and then send that to 2000 partners for more profit extraction on top of what the website does commercially.
Something is deeply fucked up there and it’s not the EU part. They just make a good scapegoat because the banner is what users see
Let's not paint the policymakers naïve when they're in fact incompetent.
Bold thing to say.
t. European
Are you sure?
No harvest data to 936 partners? No need for a banner!
Just like websites also give zero fcks about accept-language header... sure do geoip lookup, so much easier... not
“Oh you want consent involved in this interaction? Then we’ll annoy you about it constantly instead of respecting the intent of the regulation.”
It’s simplest just to put the bullshit everywhere and the dipshit bureaucrats will leave everyone alone.
The only mistake EU policymakers made was underestimating how willing companies were to deface their websites.
Yes and that is a MASSIVE mistake for a policymaker to commit. They should absolutely be pilloried for their incredible lack of foresight and understanding of how internet companies handle compliance. The policy has set back humanity by further desensitizing internet users around the world to the terrible, endemic use of cookies by most websites.
Copy pasting an older comment because it’s really coming up all the time…
https://news.ycombinator.com/item?id=49060456
===
That's not true and is a very common misinformation people repeat online. You can save user preferences in cookies without any consent banner, if the cookie isn't used for tracking. See here[0], page 6: > As stated in Article 5(3) ePD: ‘This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.’ 0: https://www.edpb.europa.eu/system/files/documents/2024-10/ed... As long as you do not share that info with 3rd party, and the user requested it, you can store via cookies pretty much whatever you want without the need for a consent screen
Let's check what "Opinion 04/2012 on Cookie Consent Exemption" [0] says under section 3.6:
"""
3.6 UI customization cookies
User interface customization cookies are used to store a user’s preference regarding a service across web pages and not linked to other persistent identifiers such as a username. They are only set if the user has explicitly requested the service to remember a certain piece of information, for example, by clicking on a button or ticking a box.
...
These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted under CRITERION B. The addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration, negating the requirement to apply an exemption in this case.
"""
See that you need to provide provide "information in a prominent location (e.g. “uses cookies” written next to the flag)" to be able to store user preferences in persistent cookies. You don't need consent banner for that (which I didn't say you need), but you need to clearly inform the user. The act of setting a preference together with clear information about persistence counts as a valid consent.
[0] https://ec.europa.eu/justice/article-29/documentation/opinio...
There’s a perfectly valid and simple way to comply with the EU policies, including GDPR, and not impose annoying popups on your users: just don’t set cookies (if you need to have a login, you can ask for permissions at login time) and don’t collect personal data. That a lot of sites elect not to do that is an indication of how they treat the user, not of the brokenness of EU law.
Actually big tech is to blame: https://killthecookiebanner.eu/
- https://www.edps.europa.eu/data-protection/our-work/subjects...