this post was submitted on 19 Mar 2024
109 points (86.1% liked)
Technology
59187 readers
2246 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is a pretty naive take.
If you operate in Europe, you must comply with GDPR. To selectively show a cookie banner, you have to be able to identify the (location of) the user.
It is totally reasonable for a company to operate in Europe but not wish to implement a full identity or location detection system. And so they just show the opt-in prompt to everyone.
And you can't just implement that by using the browser's location API, because European users can totally choose to not share their location with you using that API. But you still need to comply for those users.
The diversion about the DNT header is irrelevant.
Firstly, it is not codified in law that the DNT header is canonical. What if a user forgets to check the box? What should the default be? What kind of UX should be presented to users? This stuff needs to be spelled out in law for DNT to be a valid way to express opt-in.
Secondly, it's not a robust per-site permission. Browsers only let you set it globally.
Thirdly, it's actually bad for privacy. By making your headers different from the majority, you are easier to fingerprint. This is why Safari does not implement it.
I get the spirit of the article.
But the GDPR has pushed the problem of consent to the users, and they haven't done anything to make this easy or convenient. Therefore cookie banners are inevitable. Like, you can't blame companies for acting in their own self interest; that is entirely counter productive.
The EU needs to solve this.
First, go after the data brokerage industry so that it is no longer profitable to sell user data.
Second, regulate how websites can seek permission. Ideally by specifying a consent API and requiring browsers to implement a sane UX.
It will be much more productive to try to solve this with the handful of Browser vendors than trying to regulate each and every consent banner.
Excellent analysis. Especially this part:
Early cookie banners were a bad experience but they were manageable. But now thing have transitioned into content-blocking modals, dark patterns, forced individual consent/rejection for each and every one of the 943 partners they're selling your data to, sites that refuse to serve content if you reject tracking and other ways to frustrate the end user.
I'm done with every piece of shit predatory actor inventing their own way of malicious compliance with the GDPR. You either implement the user-friendly consent API or you get no more tracking at all. Paywall your shit for all I care, at least then you'll have a sustainable business model.