It is impossible to go anywhere in a technology space online without hitting a wave of commentary about how stupid GDPR is. It was written by bureaucrats who don’t understand the amazing potential of unrestricted technology. These US-based critiques almost always lean on the oldest trick in cyberlibertarianism: we don’t have time to regulate, we must simply adapt and ride the wave. Nobody has time for government.
Of all GDPR’s consequences, none gets more attention than the cookie banner, which critics present as the inevitable result of government meddling. Blaming GDPR for the cookie banner is like blaming the health inspector for the roaches. The banner is deliberate vandalism, a dark pattern engineered to exhaust you before you can learn anything about the surveillance apparatus humming behind the “OK.” Ironically the banner designed to hide the machine has taught the public more about the machine than a thousand podcasts ever will. Even non-technical people stop at “your data is shared with 996 partners.”
↫ Mat Duggan
There is so much misinformation about the cookie banner, it’s honestly quite hard to believe it’s not deliberately spread. You don’t need a cookie banner for functional cookies, so as long as you don’t share your users’ data with anyone else, you don’t need a cookie banner at all. On top of that, most cookie banners you encounter are actually not compliant with the GDPR at all, because they don’t present a single-click option to block your data from being shared with those 996 partners.
What the cookie banner has done is inform millions – maybe even billions – of people the world over of just how insipid the online advertising and data harvesting industry really is. It put the issue on the map, and by now, everyone, no matter their level of computer literacy, is fully aware of what’s happening to their data every time they see one of these (non-compliant) banners. No else had the guts to do this – except for the European Union.
The wider GPDR has set the baseline for online privacy protections, and while we have a long way to go before we’ve fully solved this issue, the EU at least gave us a good point to jump off from. Smoking and asbestos weren’t banned in a day, either.
Oh man. I had almost forgotten about those popups, thanks to the Consent-O-Matic extension for Firefox.
Works on Firefox Mobile, too. That and uBlock Origin make browsing the web sooooo much more convenient.
Wow that’s awesome – thanks for he tip!!
default uBlock Origin is great – adding the addition lists in the settings is fantastic. Also, the FF made containers extension is also amazing.
Legislation that results in just about every website on the Internet flashing a banner in my face notifying me that they give zero fucks about my privacy is not what I would consider to be good legislation. Esp. since I already knew that beforehand.
Thanks, EU.
Seeing it from a SME’s perspective I have to agree. Yes, cookies and data farming are bad and needed to be contained. But the GDPR is a ridiculous monster that serves no-one except lawyers.
@Thom: It is never about the technical details, but about the question: how much time and resources do you want to spend in court (who is technically illiterate) to defend yourself. You may no need a Cookie banner, but you will want to have one just to be on the safe side and not to get sued.
The GDPR is very simple: you process personal data, you need to disclose what and for what purpose. Also, have a way to get it and delete it.
Of course, if you’re trying to sell it to ad networks, it might make things a bit harder for you.
The GDPR has brought us only sorrow.
Before GDPR, nobody knew what privacy meant, and honestly, they still don’t but they know there’s something wrong about it.
Of all the promises the GDPR made, none came true. As much spam in my physical as well as my electronic mailbox (local policiticians even get into my mailbox more, as they are exempted in the law – they can just grab my address from the government now). Enterprises around the world have spent billions on implementing this good-for-nothing law.
The only people benefiting from GDPR are policitians and lawyers. As almost all politicians are lawyers : lawyers only.
Cookies were never the problem because cookies are under your browser’s control anyway. Perhaps the browser should disclose cookie sessions more clearly, but in any case it’s rather silly to put the onus on millions of websites to get permission to use cookies. Having a service provider ask for permission to use cookies is completely backwards and redundant. These cookie disclosures are completely pointless IMHO and it’s probably true that the legal wording of the GDPR is at fault for this.
So I see no value from the GDPR in terms of cookie warnings. However I do think it covers other important aspects of privacy that aren’t under our control, in particular what’s happening on the service provider’s end. In the US we lack GDPR-like protections which results in private consumer data being bought and sold without the knowledge of consumers.
https://www.cnet.com/tech/tech-industry/google-reportedly-had-deal-with-mastercard-to-track-retail-sales/
https://www.huntress.com/threat-library/data-breach/cambridge-facebook-scandal-data-breach
In the US this is legal and routine. There’s no law against it (such as HIPPA). Data aggregators can and do buy up and use our private data for advertising purposes. It’s bullshit, but without laws to regulate it our explicit consent is neither here nor there. To me this is what makes the GDPR very important for privacy rights.
The legislation doesn’t result in that. Those are underhanded (and illegal, BTW) tactics to get you to accept.
That’s like complaining that liquor stores check if you’re over 18 before letting you buy beer.
You’re right. The behavior those banners are asking for permission to do should just be banned outright. No harvesting and re-selling of data, no hidden trackers across websites, etc etc.
@Drumhellar,
100% d’accord — but again, they don’t have the balls for that. Only “meant well” half-baked solutions, which don’t solve anything but add a lot of bureaucracy. That’s what the EU does best unfortunately. Unfortunately, bad regulation is worse than no regulation in my opinion.
This is not 1990 anymore, and we, the folks at osnews etc., are a very very tiny minority on the web. Yeah, you already knew this 996 partners stuff. Did your aunt knew it as well? Or your son’s teacher? Or the superintendent at your building? How about your grandpa? Your accountant? Your neighbors? That traffic cop? Your grocer? The cute/handsome barista at the coffeeshop? The doctor checking your blood levels? I’m not so sure about that.
The point emphasized here is that, GDPR tells them. Let it be.
And use ublock origin’s cookie notice filters and consent-o-matic on your own computer.
It left the technical details up to the implementers, that was the mistake. Requiring that functionality to be in the browsers themselves, and websites having to use a JS API for consent, marking which cookie does what and the browser itself denying it would have been a lot better.
Alternatively having the browsers by default accept only session cookies would have been fun to watch get passed.
Serafean,
Right! When it comes to cookies, the mechanism we’ve landed on where the remote site is responsible for cookie compliance rather than the local browser is bonkers “Do I have your permission to ask you to tell me XYZ?”
It’s far more logical to enforce this in the user’s browser. They should have pushed for browser based solutions rather than trying to force and fail at getting millions of websites to comply. A browser based solution gets more traction and is more trustworthy at the same time.
I think there is opportunity for innovation here beyond just allow/deny. It would be pretty cool if, when a website asks for identity, I could explicitly choose the identity I want to use.
The banners very much remind me of Windows Vista’s UAC popups. Everybody complained about their existence, but the real issue is that for 20 years Microsoft had been telling software developers how to develop Windows software, and for 20 years developers ignored those guidelines.
And then Vista came along and began enforcing these rules, for all users, all the time. All those UAC prompts were due to software that didn’t behave in a multi-user environment the way Microsoft had been asking developers for 20 years.
Everybody blamed Microsoft, but the issue was almost entirely 3rd party software. 90% of the reason Windows 7 was so much better w/r to those prompts was not because of changes Microsoft made, but because of 3rd party developers finally getting their act together.
The GDPR prompts are the same. They don’t exist because of the regulation, they exist because of godawful websites are trying to harvest your personal info without permission. Only, instead of fixing their spying-ass websites, companies are just harassing you with these prompts to get you used to OKing bad behavior.
The GDPR is not the legislation that requires cookie consent banners. It is the ePrivacy Directive. Storing a cookie on a user’s computer requires their consent.
GDPR does cover what a company does with personal data collected via use of cookies, and consent is one of the legal basis for processing of that personal data.
The perfect example that GDPR is useless is that the EU has always accepted laws that help bypass it: Safe Harbour (2000), Privacy Shield (2016), Data Privacy Framework (2023). I invite everyone to read about the Austrian activist (a great person) Maximillian Schrems.
There isn’t a single US service among the so-called “web giants” (the so-called Over The Top) that is GDPR-compliant: the American FISA is incompatible with privacy and the European GDPR, but the “paper giant” of Brussels has never done anything.
Continuing to sing the praises of the European Union that is leading to the energy crisis and into war, after it destroyed German manufacturing, is a rather sad exercise.
There is no GDPR in America, but we still have consent dialogs. Square that one!
I build websites, and I work in a corporate space – adding these is a checkbox, and the managers basically say, “Does it have cookies – add banner.” The reality of these is so banal.
There is no Federal Law in the US, but we have State Laws. Check out https://www.recordinglaw.com/us-laws/data-privacy-laws/us-cookie-laws-by-state/
Sigh, these comments… Half think it’s stupid they have to ask for permission to use cookies because they didn’t even read the summary to find out you don’t need a banner for functional cookies, the other half are trying to get a mob together to change it to regulating browsers… That latter is the antithesis of OSNews. Regulating the tool rather than the muck ruining the tool is how we get to the place cars are at right now: Given the right skills or contractors, you could make a perfectly safe vehicle. You could (theoretically, but not realistically) follow every single NHSA guideline and make a legal car… except for the certification part, whereby you’ll need to pony up an amount of money strategically chosen to be trivial to corporations and unattainable for individuals. Keep letting them use mediocre regulation to get you to demand stricter regulation so you can sell more of your freedoms. I can’t win legally, and I can’t even find somewhere where people think rather than mob, so once you win maybe I’ll try again to give up on technology once it’s all closed source, certified, and “secure.”
quinn,
I am no fan of the corporate panopticon. I have no interest in defending corporations that don’t respect our privacy or rights. It’s a huge problem and I think the government plays a critical role to protecting consumer rights. Without it you’d end up with the “you have no rights and corporations own your private data” like in the US, which I find horrendous.
That said though, when it comes to these cookie banners, I don’t see how we can summarily dismiss the EU’s role in this.
https://gdpr.eu/cookies/
The EU itself seems to be suggesting the banners are necessary.
I don’t follow your criticism. The browser is naturally in control of cookies, even if the law doesn’t acknowledge it. Enforcing cookie permissions server side is technically not sensible. It shifts control away from the user-side mechanisms and into provider-side mechanisms. This is stupid and ironically places more control and trust at the service provider’s end.
My post earlier wasn’t saying we need browsers to be regulated, but that browsers could be doing a bit more to help users control their online identity. I generally don’t like regulations that micromanage technology. The problem of course is that the dominant browsers are published by corporations who have flagrant conflicts of interest and when left to their vices they act selfishly, A prime example is google blocking adblocker APIs. That’s just the way they are.
For sure, I agree that browsers are the right place to deal with this. It just worries me that (other) people don’t really differentiate between “should” and “should be law.” Makes me want to comment on regimes that have conditioned them to that, but it’s really not new. Always plenty of petitioners to the king to do something about the weather and all that.
On the other front, the first quoted section you sent mentions that “strictly necessary” cookies don’t require a banner, i.e. login and session cookies. It’s crazy to me that we have collectively forgotten that websites don’t actually _need_ cookies, invasive advertising cookies or otherwise. It’s entirely possible to serve a blog with zero cookies, publish articles without requiring a login, etc. We used to do those things, and I miss it. If one absolutely must require a login to interact with a page, that still doesn’t require a banner, because those cookies are strictly necessary to provide that functionality
Damn, I posted a response and wordpress decided to block my submission and present me with a captcha instead deleting my post in the process. I still think the law is problematic and deserves some blame, but it matters not.
Cheers 🙂
It’s a band-aid solution though. The same way cars in the EU must beep when you drive 1 km/h too fast, or the new law where a camera will spy on your ‘attention level’ and again, beep and annoy you.
The EU thinks about the problems the right way, but then completely fails on the execution side because these ideas are written by policy makers, and not people who understand user experience.
The result: everytime I drive I have to turn off the “you drive too fast” warning because it keeps beeping in practice; it’s too strict and doesn’t understand context. Result: I am not paying attention while I seek the off button.
The camera that wants me look straight ahead and beeps if I look left on the intersection to see if the man behind the wheel is at ease, or aggressively looking? All data-points for me to understand the traffic situation that AI never can. Oop! The car beeps! I didn’t look straight ahead like an NPC!
Same with the cookie banner: millions of people just hit “accept” to get rid of this UX nightmare. They are fine with their data being used just to get rid of the 14th cookie warning of the day. Nobody wants to deal with manipulative cookie banner design.
The cookie banner stinks. All EU had to do is enforce browser makers a system that handles it on a browser level:
( ) Accept all functional cookies
( ) Accept all non-functional cookies
( ) Ask me when a site request non-functional cookies
Boom. Done. Just write exact specs and standards WITH EXPERTS and enforce it on browser makers.