Comment on "Do Not Track" is a legally binding order, German Court tells LinkedIn

• paraphrand@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Something like your login session would be an essential cookie.

  source
• ZickZack@fedia.io ⁨1⁩ ⁨year⁩ ago

  There are certain things you are allowed to use cookies for even without asking for permission (i.e. they wouldn't even need to tell you about them). These are effectively the kinds of things that are necessary for your website to work in the first place: For instance if you have a dark and a light mode and you want people to change this even without logging in, another example is language settings (this is why sites like e.g. duckduckgo can have a "settings" tab despite the fact you are not logged into anything).

  The rule-of-thumb is that everything that is directly related to the functionality of your website is fair even without asking (they are "essential").
  Of course the specifics are a little more tricky: For instance you could have a shop in which you can put things into your "shopping basket" without being logged in. This is fine since it's core functionality. However, if you use that same cookie to also inform your recommendation algorithm, you could get into trouble. Another aspect is 3rd party cookies: These, while not theoretically always requiring permissions, in practice do need expressed permission since you, as the website host, cannot guarantee what happens with these cookies (and 3rd party cookies are, in general, an easy way to track users, which isn't core functionality for most websites).

  source

  • klef25@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Thank you for the thorough response. Personally, I would like to reject absolutely everything and then have the website tell me which functionality won’t work without a cookie as I try to use it.

    source

    • Buckshot@programming.dev ⁨1⁩ ⁨year⁩ ago

      It would quickly get very annoying because one of those essential cookies is remembering that you rejected the rest.

      The law doesn’t actually mention cookies at all. Its about tracking users, they need your explicit consent to track you or to share data about you with third parties. Cookies are the primary way of doing this but there are others and they need your consent too.

      source
    • Yawnder@lemmy.zip ⁨1⁩ ⁨year⁩ ago

      So every single page you navigate to, you want to have to decline?

      Without cookies, you can’t persist not wanting cookies.

      source
    • atzanteol@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

      Personally, I would like to reject absolutely everything and then have the website tell me which functionality won’t work without a cookie as I try to use it.

      This is really excessive - the fear of cookies in general is vastly overblown. The only issue is whether cookies are being used for “site functionality” or for “3rd party tracking” purposes. The latter can be achieved through other means as well (a website could simply track your usage if you login and sell that info).

      It’s not the cookies that are the problem, it’s the tracking and the data sharing that are the problem.

      If you’re really that concerned you can browse in “incognito” mode, use the “Tor Browser” or just disable cookies entirely.

      source
• bassomitron@lemmy.world ⁨1⁩ ⁨year⁩ ago

  To be fair, some websites do need certain cookies to function correctly. As a random example, if a user goes to their bank’s website, they’re more than likely not going to know what to enable/disable cookie wise so that the website is still functional for logging into their account. So I can understand lumping those actual essential cookies into one category in those instances. However, I agree that it’s almost certainly being abused.

  source

  • Skasi@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Probably worth noting. Only third party cookies need consent. Essential cookies for things like the users active session that are not shared don’t need a cookie banner.

    source

    • brsrklf@jlai.lu ⁨1⁩ ⁨year⁩ ago

      Yeah. And sites are still more than happy to show those in the popup, just to muddy the waters and make it more complicated than it needs to be. Same with “legitimate interests”.

      source

      • Skasi@lemmy.world ⁨1⁩ ⁨year⁩ ago

        And sites are still more than happy to show those in the popup

        As far as I see it, displaying information regarding strictly necessary cookies that do not require consent is good practice.

        The website linked above states that “While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.”

        source
    • bassomitron@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Good to know, thanks for pointing that out

      source
  • Sir_Kevin@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago

    Meanwhile the “Remember Me” checkbox only works on maybe half of the websites I use.

    source

    • moody@lemmings.world ⁨1⁩ ⁨year⁩ ago

      Image

      source
• atzanteol@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

  Every request your browser makes to a website is like the first time that website has ever seen you. Each image, content request, etc. All from somebody completely new and unknown[1].

  The only way a website can identify you as a user is to ask your browser to store a unique ID (generated by the website) that you can then present with each request. This is a ‘cookie’. It gives you a temporary identifier that can be used to recognize later requests as coming from the same person.

  Without a cookie you couldn’t login to any sites. Even if you’re not logging in the website couldn’t remember what your language preferences were (important in Quebec or other government sites), or timezone, etc. It couldn’t even remember that you wanted to reject all “non-essential” cookies and would prompt you on every page request. Every single request would be from an unknown person visiting the site for the first time.

  [1] Yes, I’ve simplified some with keep-alive etc.

  source

  • 314xel@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Just to add up, the “session” cookie is a special case for the browser which identifies them as such, and handles them as temporary because usually it expires in a few hours. Also, they must have an expiration, and it clears them as soon as you close your browsing session no matter if they expired or not.

    source
• Traister101@lemmy.today ⁨1⁩ ⁨year⁩ ago

  The cookie which stores the “Do Not Track” request is pretty essential don’t you think? Cookies is just what we call a particular websites local device cache. You can store whatever you want in there but they are best used for user settings, what user configurable theme should the site use, maybe you have a login token in there. Essential cookies (cache) the site needs to function properly.

  Cache isn’t scary, it’s the tracking info and other related data they use to sell you ads.

  source
• bjoern_tantau@swg-empire.de ⁨1⁩ ⁨year⁩ ago

  I don’t mind “essential cookies”. Otherwise I would just configure my browser to not accept them at all.

  But what really interests me is what “legitimate interests” are.

  But in the end it’s not about the cookies, it’s about the tracking. The technique is irrelevant.

  source

  • barsoap@lemm.ee ⁨1⁩ ⁨year⁩ ago

    Things like security, fraud prevention, but also direct marketing. In the sense of a shop you already bought something at sending you an email “hey we’ve got a new shipment and you bought these teas before so we think you might like this one”. The last one has to be opt-out, and indeed be direct, they can’t do “hey check out our parter stores and have you heard of Raid Shadow Legends”. Essential in that context would only be processing information strictly necessary to fulfil the contract, which would be more restrictive than IRL (where your tea guy indeed does remember what you like).

    The data you collect has to be necessary for that legitimate interest, and you have to balance it against the consumer’s right to privacy. In a nutshell: If someone would complain, or someone reasonable (legal term :) wouldn’t expect you to use the data in the way you do, better get a lawyer.

    Meta tried to argue that it covers all the tracking and all the advertisement they want to do “because we have a legitimate interest to earn money and the user wants a service and privacy doesn’t matter”, they ran against a brick wall with that one. Legitimate marketing in their case would be to tell you about their other platforms.

    source
• explore_broaden@midwest.social ⁨1⁩ ⁨year⁩ ago

  How about the cookie to store the setting that you don’t want non-essential cookies?

  source
• lolcatnip@reddthat.com ⁨1⁩ ⁨year⁩ ago

  Turn off all cookies and find out.

  source