5 ms·
The cookie banner isn't actually specified in gdpr, it was just how everyone else tried to build the solution to the problem at the last minute. I remember thi
by intothemild 18d ago
The cookie banner isn't actually specified in gdpr, it was just how everyone else tried to build the solution to the problem at the last minute.
I remember thinking "ok once this hits an actual web spec, we should see this built into browsers, and sent as headers or something"
Nope
- brainwad 18d agoBrowsers already had a way to consent to cookies, since the invention of cookies themselves. But the EU didn't consider that _real_ consent.
- 9dev 18d agoTreating the browser's "disable cookies" feature as a way to reject consent is not real consent. That cripples many legitimate use cases outright; it's neither accessible nor understandable by normal users; it's a technical defence measure, not a way to consciously reject contractual consent. In contrast, the GDPR demands that you properly ask for consent if you want to process somebody's personal information, inform them why that is necessary, and only process the data if they agree to the processing. There is clearly a difference here, and IMHO the EU is quite correct here.
- intothemild 18d agoCorrect.. the gdpr isn't the anti cookie law. It's the data privacy law. If it wasn't cookies it would be something else.
- DarmokTanagra 18d agoCorrect in principle, completely ineffectual and annoying in practice.
- brainwad 18d agoMost browsers in the 00s had a "always ask" option for cookies. Nobody used it, because it's as annoying as gdpr dialogs now are. But it existed.
- M95D 18d agoI tried to use it, but it didn't remember the "no" answer. Every time I loaded a page, the same confirmation for the same cookie was presented again and again.
- 9dev 18d agoYeah, but that's still way too narrow to capture what the law is about. The GDPR doesn't really care about cookies, or storing data on clients in some way. Instead, it's about end-users giving informed consent to processing their data. Not just by hand-waving away some disclaimer, but actually conscious of the consequences of that action, and why it is necessary to do so. I know this sounds all lofty and Brussels ivory-tower-ish, but I'm absolutely convinced it's the only sensible way to deal with personal information - even if American companies insist on forcing a new normal of lacking privacy on all of us.
- brainwad 18d agoYeah, I was more talking about ePrivacy cookie banners, which really are about storing data on user devices. The whole thing exists because the already implemented technical solution was deemed inadequate.
- gmerc 18d agoIt's a case of industry malicious compliance
- sourcecodeplz 18d agoi was thinking the same thing. it could be like an actual element of your page.