They’re still widely used for some (illegal) reason
Comment on They tried
Pigeon@programming.dev 1 year ago
Not allowing users to access a service at all unless they accept cookies is often against GDPR. See: Can we use ‘cookie walls’?.
To quote:
In some circumstances, this approach is inappropriate; for example, where the user or subscriber has no genuine choice but to sign up. This is because the UK GDPR says that consent must be freely given.
If your use of a cookie wall is intended to require, or influence, users to agree to their personal data being used by you or any third parties as a condition of accessing your service, then it is unlikely that user consent is considered valid.
The key is that individuals are provided with a genuine free choice; consent should not be bundled up as a condition of the service unless it is necessary for that service.
newIdentity@sh.itjust.works 1 year ago
Carighan@lemmy.world 1 year ago
Because they rest safe in the knowledge that you rarely if ever get taken to court for it. There are millions of web pages, it needs people to take action to do something about it, and just clicking “Yes all of them” to access the content you were just trying to get to is a far better solution in most situations than hiring a lawyer and investing a few years of legal proceedings, nevermind the money.
relevants@feddit.de 1 year ago
There is an organization called nyob (I think) pushing back against that and going through the courts to have more sites penalized for their violations. The process is slow, but I see more and more pages adopting the required “reject all” so there seems to be some pressure on them.
Sysosmaster@infosec.pub 1 year ago
even worse offenders are the ones with tick boxes for “Legitimate Interest”, since legitimate interest is another grounds for processing (just ads freely given consent is one), the fact you got a “tick” box for it makes it NOT legitimate interest within the confines of the GDPR.
it also doesn’t matter what technology you use whether its cookies / urls / images / local storage / spy satellites. its solely about how you use the data…
_number8_@lemmy.world 1 year ago
why are the EU the only people that bother to actually govern in a modern and helpful way
Steeve@lemmy.ca 1 year ago
But what are they going to do about it?
“Your site can no longer operate in the EU”
“… ok”
Knusper@feddit.de 1 year ago
The EU is an important market for many websites, so yeah, that is usually what happens.
Steeve@lemmy.ca 1 year ago
We’re specifically discussing websites that refuse to load in the EU anyways as per the post
Knusper@feddit.de 1 year ago
I understood the post as those webpages only refusing to load, if the user declines Cookies. So, they do still want to benefit off of those EU users, who click “Accept”.
ecamitor@beehaw.org 1 year ago
They found a way around: accept all cookies or pay 2€/months. And it was decied legal by GDPR authorities
koper@feddit.nl 1 year ago
Some national authorities allow it, most don’t. The final word will be from the CJEU or the EDPB.
Zacryon@feddit.de 1 year ago
The what or what?
HorriblePerson@feddit.nl 1 year ago
The EU supreme court or the EU data protection agency, roughly.
AnUnusualRelic@lemmy.world 1 year ago
Those pages can just fuck off. There are many more pages.
Of course that’s just my opinion.
GreenMario@lemm.ee 1 year ago
Then half the web violates it or there is One Pixel button that closes the damn popup.
purplemonkeymad@programming.dev 1 year ago
IIRC the EU also ruled that burying the rejection options under additional links counts as a violation. Hence why Google now has a Reject button next to the accept button. Most sites still do that.
crunchpaste@lemmy.dbzer0.com 1 year ago
Do you know if there is a EU-wide place to report such behavior?
The biggest privately owned TV channel in my country not only does that, but actually just redirects you to a pdf file if you want to “manage cookies”. And it’s not like I can submit a complaint on a national level, as the ruling party’s website uses google analytics without a cookie notice at all.
purplemonkeymad@programming.dev 1 year ago
I think you report to your nation’s Data Protection Centre, each member has their own that takes the reports. If I was still in the EU I would have put more time into finding out how reports work.
Knusper@feddit.de 1 year ago
Yeah, either of the nation or your nation may have data protection officers for individual states/regions.
Honytawk@lemmy.zip 1 year ago
dataprivacymanager.net/list-of-eu-data-protection…
Here you can find the GDPR authority per EU country.
Pigeon@programming.dev 1 year ago
Yes this would make sense.
Quote from “What methods can we use to obtain consent?”:
For a website, hiding rejection behind a link should class as “unnecessarily disruptive”. If you can provide consent with the press of a single button then rejecting should also be the press of a single button.
sunbeam60@lemmy.one 1 year ago
I mean almost all websites fall foul of that. You often have to bury deep and end up with a palette of complicated choices and acceptances of individual tracking companies. It’s a bloody mess. The EU should just have mandated “do not track” adherence. There’s already a standard; just enforce it.
mojo@lemm.ee 1 year ago
Most sites definitely don’t do this
Pigeon@programming.dev 1 year ago
I encounter something similar to this often.
There’s a lot of cookie banners where “Accept All Cookies” is a single button but in order to reject cookies you have to press a “Manage Cookies” link which will have something similar to a “Reject All Cookies” button in it.
It’s very annoying.
Zacryon@feddit.de 1 year ago
There is also a name for these kind of psychological tricks and pressure. It’s called nudging.
I found a small report on this by the EU Commission’s science and knowledge service. publications.jrc.ec.europa.eu/…/JRC127856_01.pdf
There are surely even better resources.
mojo@lemm.ee 1 year ago
Yeah this is very common, I don’t know why other people on here are gaslighting like it doesn’t happen. It’s this way for major sites like YouTube/Twitter/Twitch/etc too.