alt Hacker News> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
Replies
And then you open the details mentioned in those cookie banners and see literally 600, 700 entities that get data about you shared by the website.
Malicious compliance is not the law-maker's fault.
A 'cookie banner' I've came across recently (https://www.courthousenews.com/scotus-calls-for-redo-on-wash...) feels so bizarre yet arguably should be the standard.
> Global Privacy Control detected. Advertising cookies are turned OFF.
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
Yeah it’s absolutely how effective the industry psyop against that was
Or alternatively how weak the EU messaging was I guess
The banners were for those other cookies, often for affiliate marketing and needed permission or at least the appearance of state order
I've never seen a consent banner for being fingerprinted even though I'm sure companies are fingering my prints in the background enough that my colon could become a national database.
The EU/banner situation keeps confusing people because there are two different laws in play:
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
Consent banners are generally malicious compliance and designed to annoy.
> the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.