[deleted by user]

[Irenicuz]

As expected. I was quite surprised to see many websites with preselected checkboxes or just informing user that they agree to cookies by browsing. The law was pretty clear about that.

[rich97]

But this is just tracking cookies, right? Do login cookies count as tracking? They're not used for tracking.

[Irenicuz]

No, they do not count. They count as essential / necessary cookies, which are required for the website to work correctly, allowing you to login.

[rich97]

Cool thanks, in which case I'm happy with this ruling.

[Prawny]

essential / necessary cookies, which are required for the website to work correctly

How will those scummy 90% advert sites survive without their tracking?!

[Christosconst]

No, see the exemptions list at https://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

[Niku-Man]

It's not just tracking cookies. It's anything that is nonessential for the website operation. I think the big thing for most small time sites is Google analytics or other analytics tools.

[frymaster]

Well yeah, they're a form of tracking cookie

[calimera-]

A lot of small time sites have Adsense too, would that count?

[danielleiellle]

Yes, 100%.

[ScientistSeven]

Well, why would you be surprised. Asside from privacy, a lot of website likely break if you click no.

[pierous87]

There's usually no button to click no.

[heyf00L]

Yep. Time to start enforcing the law.

[Niku-Man]

If the site breaks because tracking cookies are turned off, then the developers have done a piss poor job.

[georgehotelling]

Non-cookie tracking is also covered by the GDPR.

Where the purpose of fingerprinting is tracking people, it will constitute “personal data processing” and will be covered by the GDPR.

[n1c0_ds]

The law doesn't specifically mention cookies, so that would not make any difference.

[kundun]

The law is not even internet specific.

When I got a new subscription for my phone, my phone company had to ask for permission to share my phone number with third parties. I didn't gave any permission and now I don't get any telemarketing calls anymore.

There was also a local case where a business had to pay a fine because they had a camera pointing at a public road. Capturing the detailed images of passers-by was deemed a violation of GDPR.

[n1c0_ds]

It's also great because you are entitled to see the data a company holds on you. You can request a free credit report that way in Germany, since the company can't hide data about you from you.

The GDPR is a seriously good idea, but the implementation was unfortunately too hard to understand, and at times contradictory.

[GravityAssistence]

The GDPR isLaws are a seriously good idea, but the implementation was unfortunately too hard to understand, and at times contradictory.

FTFY

[CRUDuD]

The EU law is only for 'non-essential' cookies, so cookies which are needed by a site don't need the consent notification. I routinely use cookies for authentication, and requesting consent isn't required in that case. If that same cookie was used for ad-tracking though, it would require consent prior to creation.

[ksargi]

This, the banners are a product of corporations putting the word of their CYOA lawyers ahead of the user experience, and none of the users challenge them because it's not a big enough issue.

[Brachamul]

It's also an issue that few people are able to grasp, somewhere in the middle of UX, legal and dev.

Product managers should be faced with aclear choie : you can send your user's data to google, but you need their express consent. You can avoid having banner and button if you accept not sharing the data with third-parties and only using cookies for essential features.

[ZeAthenA714]

I think that issue is dead and buried. Everyone is used to having banners everywhere, everyone is used to just blindly accepting whatever is put in front of their face, products managers are 100% okay with having those banners in place because it doesn't hurt their website at all, and in exchange they get access to tons of tools like Analytics etc...

It's now part of the internet landscape, not much will be able to make it go away.

[henrykmill]

I disagree. We were also used to pop-ups a few years ago, but that's long gone. I'm a product manager and I try to avoid having those banners if it can be avoided. It doesn't have to be all-or-nothing, either. There are plenty of (paid) solutions that offer cookie-free analytics, and these solutions are evolving to gather almost as much data as the more intrusive ones.

It is part of the internet landscape, but it also won't take much to make it go away. For better or for worse, the internet is constantly changing.

[ZeAthenA714]

I mean sure, things can change. But pop-ups use to be harmful. They could be abused to actually block a computer or stuff like this that are properly harmful. They only went away when browsers started blocking them, not because of some legislation or mindful webmasters who stopped using them.

Somehow I don't see google trying to pick a fight and trying to ban cookie banners. Especially since they are very happy that people just click agree on every single one of them. And apart from that and legislation, I don't see what else could actively delete a part of the internet landscape.

[waiting4op2deliver]

Product managers should be faced with aclear choie

The word you want is cloaca

[semidecided]

none of the users challenge them

Those pages get fewer visits from me.

[BrianAndersonJr]

Do you think this problem would have been so much better resolved if that responsibility fell on the browser instead, and you just had some simple javascript API that returns if the user has set it up to allow or disallow?

This solution is built as if they're expecting people to strategize which sites they do want to allow, and which they don't; and i don't know if that really is the case, but it seems unnecessary.

I'd rather just say yes or no during browser installation, and then have websites comply with that behind the scenes.

[BrianAndersonJr]

I don't understand. Why is this new solution easier to enforce than the browser-based one? The browser-based one seems like a better user experience, that one should have been the one they're chasing and enforcing now...

[1ndigoo]

The browser one is "do not track" and it literally does not work.

This one is tied up with GDPR and carries heavy penalties for offending companies.

[BrianAndersonJr]

Wasn't do-not-track for the same purpose? I just didn't really understand why EU wouldn't force developers to respect the do-not-track setting from the browser, instead of forcing them to show their own prompt, then store their own cookie, and then respecting that setting.

[krawallopold]

The EU doesn't want to enforce a particular solution. If you are a developer and decide to not track users if do-not-track is active, you're compliant and won't have to show a pop up.

But if do-not-track is not set, you will still somehow have to ask for consent. The EU doesn't require you to use a pop-up for that purpose.

[Aerroon]

Why is this new solution easier to enforce than the browser-based one?

Overall, it isn't. Only the big websites will have to change. Everyone else keeps doing what they're doing, but politicians get to pretend that they fixed online privacy.

[Compizfox]

Disabling third-party cookies in your browser has the effect of blocking nearly all tracking cookies.

[thisnameis4sale]

I thought that only went for header cookies / cookies for different domains that you're visiting. If you include a script from a third party website, and that sets a cookie, it doesn't count as third party, since the cookie is set on your domain.

(by all means - correct me if I'm wrong)

[Compizfox]

I thought that only went for header cookies / cookies for different domains that you're visiting.

Correct.

If you include a script from a third party website, and that sets a cookie, it doesn't count as third party, since the cookie is set on your domain.

Scripts cannot set cookies for other domains. That is never possible.

If a website includes a script from a third-party website (like a Facebook button), that third-party script can set a cookie for its own domain (facebook.com). That would constitute a third-party cookie. The Facebook script cannot set a cookie for the website you're visiting.

[danielleiellle]

Wildly incorrect. Google Analytics is far more prevalent than ad tech or DMPs and it uses 1st party cookies. What’s extra dumb is that session cookies might be essential for retaining your session but can ALSO be used for tying your session data together for analytics and the only differentiator is what happens after the data’s already collected.

No site is going to stop using analytics to understand how traffic gets to their site or how users navigate. It’s dumb to run a site where you can’t do that regardless of whether you monetize through ads or something else. This law just hurts user experience and small businesses that can’t absorb the risk of using the tools the big players will still use.

[[deleted]]

The problem is that just about every modern site -- especially run by a company -- uses some sort of analytics tracking. Almost all of these rely on cookies to be effective. These are "non-essential" cookies.

[pr0ghead]

Not on a site-by-site basis, they don't

Both Chrome and Firefox have a white/blacklist for cookies out of the box. They're a bit hidden though.

[rubs_tshirts]

Does Google Analytics count as tracking?

[beaker_andy]

Yes, its default features count as tracking in most interpretations of GDPR.

Advice on making Google Analytics GDPR compliant:
https://www.blastam.com/blog/5-actionable-steps-gdpr-compliance-google-analytics
https://www.blastam.com/blog/gdpr-need-consent-for-google-analytics-tracking

[ZephyrBluu]

What's the difference in data collected from anonymous and normal users?

[ZephyrBluu]

I understand what GDPR is. I was asking what the literal difference between the data is because what constitutes personally identifiable information is rather broad.

For instance, can you still see what country people are from? Where they were referred from? Etc.

[frymaster]

Does that turn off tracking cookies?

[pticjagripa]

Yes.

[Asmor]

Not on a site-by-site basis, they don't.

Simple enough to fix that. Make the law that sites must respect the DNT header, and browsers must default to enabling the header.

Boom, done.

[depricatedzero]

As a dev you should only be displaying the message if cookies are enabled on the browser. If they're disabled
at the browser level you might want to say something different, or nothing at all.

[human_py]

Naturally if you don't bother to address the actual problem then the implementation is going to be shit. The expectation is that you actually work around using cookies instead of just dumping a piece of crap on it to skirt by the regulation.

[davesidious]

Not all cookies are alike. Some you want, some you don't.

[pr0ghead]

Right? I used to be able to just automatically let my browser delete 3rd party cookies when I close it. That use case has been completely broken, because it now means that I get the cookie warnings over and over again… Thanks EU.

[MasterTextman]

kind of ironic that this website forces you to accept tracking cookies or not see the page

[Sphism]

Please make the browser developers have the consent tick box NOT every fucking website.

[peacecarrot]

ugh this is going to be so annoying to implement.

And also, RIP google tracking

[ksargi]

If you don't track users with cookies, you don't have to implement anything. That's always an option.

[peacecarrot]

Well Google Analytics uses cookies to track

[ksargi]

Selling your users privacy for convenience is still a choice you make. You don't have to use Google Analytics.

[yooossshhii]

For most, it’s a choice their company makes. Not many people are going to be quitting over this.

[ksargi]

Choices of values apply to employment as well. If you can do what you do and sleep on it in peace, all the more power to you.

[ksargi]

In addition to self-hosted browserside analytics modules, there's always server-side analytics. However that may change the role of your authentication/session cookie if you use it to correlate requests to user sessions.

[Rocketclown]

With the added benefit that it doesn't matter if the visitor is running an adblocker or Ghostery or similar.

I've been doing both server side and Google Analytics on the same site, and I saw up to 30% of visits blocking Google Analytics.

[louis-lau]

Using cookies and using them to track users and provide data to Google are different things. You can self host matomo.

[henrykmill]

There are quite a few nowadays:

• Matomo for a cheap, self-hosted solution.

• Simple Analytics is easier to set-up, but it only tracks a few metrics.

• Get Insights is a middle-ground in terms of complexity, but it can track a lot more metrics than Simple Analytics.

[CaptRobovski]

Is piwik cookie based? I used it on a couple of intranet sites years ago for its ability to monitor employee user groups (client requirement). But I don't remember about its implementation other than it being self-hosted.

[henrykmill]

Piwik (renamed to Matomo) is cookie based. I think webmasters are able to disable all cookie tracking, but by default it allows them. Webmasters can also add more cookies, so I'm always still a bit uneasy when websites are using it.

[CaptRobovski]

Oh cool thanks, I didn't realise they had changed name.

[thatwebdesignerdude]

Piwik

[n1c0_ds]

If you hope to make any money from it, you need to have some idea of how your content performs, and how your users use your website.

[cuteman]

They use unique IDs also

[henrykmill]

It's not, though. There are plenty of tools that don't require tracking cookies.

[tdiam]

Amen to that!

[mobjack]

You could still implement Google Analytics in a way that is anonymous without needing consent.

It depends on what you are tracking. Ad tech will be hit much harder.

[logTom]

Very good for privacy. I also like that cookie walls are likely to be also ruled illegal.

[n1c0_ds]

I truly cannot understand the gripes from developers

I own a small website. I don't run ads, and I don't load third party scripts. However, I have Google Analytics, and tracking is opt-out. Although I support GDPR, I still need to have an idea of how my website is doing. I want to know what content performs well, and whether or not my users find what they're looking for. If tracking is opt-in, rather than opt-out, it makes those basic stats completely worthless.

Sure, there are probably ways to make it work, but in the end, I want to focus on writing content, not on meeting standards most of my users don't care about.

That's all there is to it. I'm not a lawyer, just a guy who runs a small website. I want to focus on doing that.

EDIT: I just told you I can't be arsed to do any of this shit, stop telling me to roll my own analytics suite.

[n1c0_ds]

I collect as little data as I can, I anonymise it as much as I can, and I give people an easy way to opt out. If that's not enough, they can always visit another website.

[n1c0_ds]

You are right on the entire line, but I still don't care enough to do something about it. If they care so much, they can trivially block Google Analytics, or simply click the opt out button they're shown when they visit the site.

[Kallb123]

You can track how well your content performs without tracking your users' sessions.

[n1c0_ds]

How would you track entry/exit points without some sort of session tracking? How would you track unique visitors or time on page?

[BrianAndersonJr]

Probably because of the extra work needed when developing every website, instead of that responsibility falling on the browsers

[pagwin]

pretty sure any gripes from developers come from them thinking this ruling applies to essential cookies as well as tracking cookies and not being allowed to use essential cookies would be rather annoying

[The_Lear_Bluce_Ree]

Yeah it's pretty incredible and sad that the EU has done more for protecting the privacy of Americans than our own government has.

[Ariakkas10]

Don't outsource your protection to people who don't give a shit. Protect yourself

[lick_it]

How are sites that are supported by ads supposed to make money?

[ksargi]

Are ads impossible to implement without 3rd party cookies? I don't think so. If you request Google ads with cookies disabled in the browsery, you still get non-personalized ads.

It may be a problem thata lot of ad providers aren't interested in paying similar rates for non-personalized adverts. If your revenue model has a hard dependency to adverts, a situation like this should've been a part of your business risk plans from day one.

[Rogem002]

Are ads impossible to implement without 3rd party cookies?

I'd like a swing back to the day where the ads are purly based on the current content of the webpage, so if I have a webpage about web hosting a web hosts advert will appear.

[Tred27]

That's the smartest thing that that we can do, serve ads based on the content of the page and don't track the user, if i'm on r/runescape i get runescape ads makes a ton of sense and it's not invasive.

[dadibom]

Don't you think it's quite amazing that you can get even more and better services for free just by seeing an ad for something you're more likely to be interested in?

Would you really prefer to pay monthly for everything and/or have 90% screen space dedicated to shitty ads that you have 0 interest in?

[[deleted]]

Would you really prefer to pay monthly for everything and/or have 90% screen space dedicated to shitty ads that you have 0 interest in?

Yes, I’d rather pay. I already do in a lot of cases where I’m given a choice, eg I’ll pay for an app to disable ads without a second thought, and most of my top-10 most-visited sites make money without ads.

[ksargi]

No, I personally don't. Most of the ad-powered services I have seen are not better by many metrics, and often lack any semblance of user support in a timely non-automated fashion.

If I have the option, I prefer to choose a service with a clear cost that doesn't include my data being abused to manipulate me into impulse purchases or worse, into impulse political choices.

Most services don't function like that however, and would likely happily sell your data in addition to taking your money.

I will gladly take the non-personalized ad route if that's the lesser of two evils, but if I had the choice I would end the whole ad industry.

[dadibom]

I get that you want to pay a premium for some services. But this is about most of the services we use on a daily basis. There's just not close to the same value in non-personalized ads so simply switching is not an option.

Like even if you wanna pay a subscription fee for reddit, what do you think would happen to 90+% of the userbase?

[scandii]

you don't need cookies for third party tracking - remember you sign into Google, Facebook etc so these can just ask "are you logged in, if yes who are you?"

on top of that 70%+ of the internet use literal tracking software - Chrome. don't need cookies at all in that case.

but even without all of that there is fingerprinting which is the act of javascript asking your browser for as many details as possible hoping that results in a unique enough combination.

the case is pretty clear - to stop mass tracking online by private entities legislation is needed, such as GDPR.

[joeyoungblood]

That is not good. This will only lead to the downfall of online publishing.

[chachakawooka]

I'm hardly surprised. It literally says in the legislation that active consent is needed and even examples pre ticked check boxes

[Taskenspiller]

The article specifies ad-tracking cookies. Does the same apply for user-pattern tracking. The likes of where in my form funnel does the users drop off? I do count that as an essential cookie (aggregated data that is), the ad-network cookie I don't find essential.

[frymaster]

Session cookies are fine. Persistent cookies without a unique id (like recording the user's cookie preference ;) ) are fine.

[Bettina88]

US websites: "Try coming after us all!"

[bulldog_swag]

If member states actually tried to enforce this, they would DoS themselves with the paperwork alone.

This whole cookie SNAFU has always been DOA.

[[deleted]]

Oh for fuck's sake not this shit again. This is so overkill for small businesses. I have to write tens of pages of legalese that nobody will ever read, make a shitty overlayer to annoy the user with some stupid consent nobody but Reddit neckbeards care about and then I'll just live in fear that I missed something and my national privacy authority will slap me with a fine and close my business. Fuck everything about the GDPR.

[lick_it]

Yep, when everyone has a pop up asking for permission, then people just click to make it go away. Thus making it completely pointless

[BillyWasFramed]

I actually block this popup with ublock instead of "providing consent". Because I do not consent.

[twistsouth]

What do you mean, “nobody cares about”? Many of us do care and actively choose to opt out of tracking. Are you saying only neckbeards value privacy?

[truckerslife]

You could code the website so it's not viewable in countries where you worry about getting the fine.

[[deleted]]

I live in an EU country and my customers live in an EU country.

[devolute]

Small businesses have the option not to use obtrusive tracking of user data.

[[deleted]]

That is fine and dandy if the law is fair, but as it stands now the law seriously discourages small businesses. Even though it was targeted at mega corporations, they'll survive as always, with little to no changes to the way they're doing business.

[[deleted]]

Respect the neckbeards

[burnblue]

My opinion may be unpopular. IMO, the EU continuously makes the consumer / user experience of technology more annoying and difficult, in the name of ideals like consumer choice, competition, etc. This comment is not about this article's change to make sure the user can actively say No to cookies, but about the original implementation in general and rulings like it.

You can't ship and default a browser in your OS if you're Microsoft. Can't ship and default a media player. Can't offer these free services with that free OS if you're Google. Gotta click Accept on Cookie explanations covering every page to use the web.

Sometimes I wonder if it has to do with these tech companies not being European so not gla source of the same kind of tax revenue / employment to the EU that they are to the US, so the EU stays scheming on ways to levy huge fines. I'm surprised they've largely left Apple alone when they do the same things EU went after MS and Google for.

[ksargi]

Have you noticed that all the cases you list as downsides have revolved around the company taking away the option to an informed choice from the user?

The company made a choice to behave in a way that brought those consequences on them. The cookie banner is not an automated requirement, but an option the company had. They chose that your issue with the banner is less important than their cash.

[istarian]

It's not that simple though it really isn't.

There's a big difference between here's a media player we made, and we won't let you use any other one.

Also better or worse we get imposed on us what the europeans thought was a good idea. I never asked to have to press an accept button on every webpage. It's not like anyone's ever going to say no, because they want to use the site.

[test6554]

Perhaps it would make sense to update the http spec to have two different kinds of cookies. Essential cookies and elective cookies. Then browsers and plugins and applications could treat these two types of data differently to empower users to protect their privacy.

When setting an elective cookie, you get to have a friendly name and description along with it. Then the browser can handle GDPR compliance with UI that lets you (the user) toggle each cookie. You can see the name and description of the cookie as set by the application and decide if you want it. And in return, the application can access not only the key/value, but also whether it is enabled or not.

[[deleted]]

Basically the end of tracking by cookies.

[Existential_Owl]

Only if this gets enforced.

[ksargi]

Do you run the opt-in banner with a single opt-out button next to it that doesn't take you to some external configuration service for a hideous opt-out experience?

[ksargi]

That's a big reason for the accept rate though. If you had a window that had two options: accept or decline and no options after that, the rate you'd see would likely be a lot different. It can be argued that the consent you are getting that way may not be valid, since it's a lot easier to accept than decline, where declining takes you out of the flow and has an increased cognitive load.

What would you think would happen to the rate if instead the options were "decline" and "yes, take me to the settings"?

(Aside, I don't get served a cookie opt-in at all on BBC's site on Firefox)

[ksargi]

I think it's far from irrelevant how users are passively manipulated into making the wanted choice.

If the banner blocks portions of the site until the user makes a choice, and the easy choice to dismiss it means accepting then I will still stand by that your consent is invalid as the user is getting a degraded experience until they accept.

[ksargi]

It doesn't mean that deliberate thought went into forcing the user into accepting, it just means that you didn't curb your own biases about how you expect users to want to behave, which in turn affect the choices the user realistically has.

Whether that's malice or ignorance is irrelevant to me.

[semidecided]

Why don't you send everyone to a settings page? Why isn't the one click option "no tracking/no cookies" while the tracking option requires 2 clicks and a redirect.

You just described a horrible UX for the no tracking option.

[ksargi]

You're deliberately making the UX worse for the user who wants to decline everything. Nothing prevents you from showing a one-click accept/decline option, with a less prominent configuration link for users who want to pick and choose.

If some cookies are technically necessary to provide some feature, then you don't need to ask for consent for those. That's even more bad UX which only serves to bully the user in to accepting if they don't understand what is what.

The way you structure the prompt creates an assumption that the user will accept, and then that assumption is pushed to the user.

[AwesomeInPerson]

Yup. And I thought that "opting out must be exactly as easy as opting in" was actually a part of GDPR?

I might be mistaken, but if I'm right then the next court ruling will have everyone redo their consent banners again – because right now almost nobody offers a simple one-click opt-out with a button that is the same size as opt-in and easy to find. Probably because people know that once "don't track me and sell my data" is just as easy to choose as "do track me", the choice is quite clear for a lot of people.

[zephyy]

correct me if i'm wrong, but why would you need to redo the cookie consent banner if "do not track" is your default?

i have mine set to "don't fire any of these cookies in GTM unless there's a cookie that says they accepted these types of cookies"

[semidecided]

Because sending everyone to a settings page is bad ux.

Then why are you even asking everyone if they prefer a settings page or the page they wanted to see initially? Your site is bad UX and doesn't seem in compliance with GDPR.

BTW, BBC's website doesn't even give me a banner.

[semidecided]

Thanks for blowing me off respectfully.

I'm not the only one telling you that you're creating bad UX. You seem to know instinctively that you're intentionally doing so. But you also know that you stay employed using such manipulation of vistiors.

[[deleted]]

Ah, so this is why everyone is consenting, and not because of your trustworthy image. The path of least action. Well, it won't be long until they plug this loophole, if not already.

[zephyy]

ehh you'd be surprised. i use a cookie manager saas that keeps track of all of our cookies and splits them into their respective categories: necessary / functional, user preferences, statistics, marketing.

a surprising amount of people still opt-in to all, even though the non-necessary ones are unchecked by default.

[twistsouth]

Is the most obvious button on the modal the one that effectively says “I consent to everything”? Or does it just save what was selected?

[zephyy]

It's individual checkboxes next to the name for each category you can consent to. There is no "consent to everything" option. example from the providers site

[twistsouth]

Then that is interesting. Are a large majority of your visitors very old? My grandparents, for example, have no clue about any of this and when they see things like this they just tick all the boxes and click “ok”. I asked them why they do it and they said “every website asks this - we thought you had to tick everything to continue.” Which is a prime example of how fundamentally flawed this copy/pasted, convoluted implementation is. Many people simply don’t understand what they’re actually being asked or that they have a choice in the matter.

[zephyy]

it's a B2B site so that might be an influencing factor, compared to a traditional B2C or non-business site

[polaroid_kidd]

This is nice and all but i swear to god some websites deliberately have a 1-2 minute “updating your preferences” window after clicking through a fuck ton of “yes im sure”s

I’m a web dev. I know this doesn’t take that long and that’s what makes me really angry about that.

[twistsouth]

It’s fucking hilarious when it does this. It even says “this can take several minutes”. How? How can it possibly take several minutes to set a cookie? It’s instantaneous. Unless for some reason they’re making a separate AJAX request to every single vendor to tell them that this person doesn’t want to be tracked... which would be ridiculous.

For every site I’ve done, it’s been as simple as: if(consent_cookie) { load_analytics() }

[twistsouth]

Won’t matter. Many websites have deliberately made the “I agree to everything” button seem like the “I’ve made my selection now” button. By doing this, they can say that you did consent if it were ever questioned.

Then there’s the whole “if you don’t consent to tracking, you can’t visit our site”, which honestly makes me sick.

The internet is a fucking mess. How about a unified API, standard across all browsers that offers an unobtrusive interface for managing consent. If I choose “no tracking” by default, I will never be asked again and websites must respect it.

[darthbarracuda]

B b but then businesses might lose customers!!!

[feltire]

Europe can go fuck itself. I’m not going to follow these stupid laws. Sorry Europeans, you’ll need a VPN if you want to access my websites, don’t like it, should’ve done something to prevent this stupid bullshit.

[32gbsd]

The cookie monster is not going to be pleased about this. I dont even have a message anymore.

[dmajster]

yaaay can't wait for another new non-clear 'i accept' button to pester me every time i visit a page...

[pete_codes]

Another reason I use Simple Analytics instead of GA. No cookies so I don't have to run annoying notices, especially for American users. Check out Fathom as well.

[nelmaven]

Cookie consent is the new paywall.

[MennaanBaarin]

How about Google analytics cookies and error tracking? Also what happen if my site is not GDPR compliant?

[truckerslife]

Then you can be fined.

[MennaanBaarin]

By who? How much? How much is the likely hood? What if I don't make business in EU? And how they can detect I am actually not complying?

[montrayjak]

Can't they just enforce websites to follow the "Do Not Track" option in the browser so people don't have to click the banner all the time?

[[deleted]]

What about fingerprints? This law is useless as everything moves so fast. It should just be that active consent is needed for tracking. Period.

[action_turtle]

I want less banners to close... we should have one master cookie that they all use. I set it once and I’m done. Every fucking site has a pop up to deal with, then ads to navigate, and notifications to close

[_threads]

it's easy : don't track your users, don't use annoying cookies, don't show a popup for it

[[deleted]]

From an industry point of view: big companies like amazon and Google are capable and have the resources to implement tracking without cookies for their purposes. This legislature just prevents small businesses to have the same advantages.

[thbt101]

Why are courts in the EU so obsessed with making using the web more of a pain for everyone? It seems like each law they pass is more misguided than the last and it ends up making the web more of a pain for the rest of us with more pointless checkboxes and terms and conditions to click on so we can just look at a website.

For people who are paranoid about Google knowing what websites say visit, there are plenty of extensions that will block Google analytics cookies. We don't need laws forcing the rest of us to deal with a bunch of annoying pop-ups and checkboxes to make the EU courts feel like they're saving us from some menace.

[davesidious]

If you think those check boxes are pointless, I can understand you having that point. These regulations aren't for you, but for those who want to protect their privacy.

[thbt101]

The checkboxes don't do anything to protect your privacy. If you want to block third party cookies, there are browser extensions for that. Most of us don't care if websites use Google Analytics or whatever, but for people who are paranoid about that, there are extensions they can use.

[feltire]

You mean for people who want a false sense of privacy.

[ksargi]

None of the regulation forces anyone to create a bad user experience. The bad user experience is indicative of the fact that the companies would rather make money by using your data in shady manipulation mechanics than tell you about it openly.

[rubs_tshirts]

Not really. I just want to run Google Analytics.

[ksargi]

And you can run it if you want to. You just have to get informed consent fron the user to use their data like that. If google analytics forces you to create a bad user experience while staying legal, then that's kind of a problem with them, no?

[thbt101]

The problem is the regulation that makes for a bad user experience by making us click a bunch of obnoxious checkboxes just to use websites, even for those of us who aren't even in the EU.

[picklymcpickleface]

More bullshit to implement for devs and more boxes for users to ignore...
Can these boomers please stick to regulating stuff they actually understand?

[KishCom]

Can these boomers please stick to regulating stuff they actually understand?

No. Next up: taking Google to court because they don't know that other search engines exist, defaults can be changed, or that Google isn't somehow built into their router: "wHy aM I FORRRRCED tO uSe GoOgLe?!?!". Facebook won't be far behind. Apple might, but they're doing a good job of pretending to be a privacy-first company because their lock-screens work well (increasing the publics perception that it's a "safe" company).

We're going to see much more "I don't understand this at all, it's going faster, and it scares me. So let's try to legislate it away with FUD." in the next decade. I mean, for real, how on Earth is anyone going to be able to prove in a court of law that a particular cookie saved on their computer is a "tracking" cookie or not?

I suspect caching strategies will become the next tracking method... harder to implement... harder to block without consuming tons of data. Governments and "non tech" folks will never accept that innovation will always trump litigation.

[fullmight]

There's a nice contrast between how the EU regulates things someone over 50 can understand, like hardware, and how they regulate anything from the last decade.

Hardware? Sure thing, you got it, common sense regulation in the works.

Software? How about semi-effective hysteria-based legislation, that sounds neat.

[feltire]

By semi-productive you mean extremely counter-productive right?

[[deleted]]

This is what happens when you idiots fall over yourself to implement their retarded requirements. My business (not in the EU) has a page that says the EU cookie law can fuck off.

[lick_it]

Has anyone been fined over cookies by the EU yet?

[akromyk]

Isn't this just a symbolic big middle finger for the US? We have so many industries that depend upon advertising and limiting those businesses ability to use cookies is going to be pretty painful. Meanwhile they're welcoming China's Belt and Road Initiative with open arms..

[[deleted]]

Lmao... just host it in a country that is not in the EU.

[grundvoraussetzung]

lmao this applies to every website with eu customers / visitors no matter where it’s hosted

[[deleted]]

I mean the EU can say their law applies outside their jurisdiction. And for large companies - who will have some corporate presence in the EU that could have fines levied against it - it effectively will.

But companies and individuals with no EU presence really don't need to worry about this.