Periodic reminder that EU did not mandate cookie popups.
Cookie popups are yet another example of malicious complience by an industry that wants to use and abuse data about us all.
@borup How, exactly, did you expect websites to ask for consent, then? Such a silly assertion to make.

@hrbrmstr @borup opt in

Longer answer: people seem to forget that you don't need user consent to set basic cookies needed for the basic operation of a website, because you're providing a service the user has requested (ie., render the content on this website please). You only need a cookie pop-up thing if your default is to set unrelated / marketing cookies. If you don't do that, then you don't need a consent banner and you can have an opt in somewhere for people who want to be tracked for some fucking reason. That's why websites that aren't designed by utter bastards don't have those daft pop-ups even if you access them in europe.

In other words the burden should only be on people who make shit websites that gobble up data for marketing. But as the op said, because of malicious compliance by piece of shit companies and marketers, it's shifted to being the user's problem. The regulations should be tightened to prevent this kind of bullshit behavior imo, not relaxed or removed as you seem to be (?) implying.

@dumpsterqueer @hrbrmstr @borup afaik there were a few rulings already where judge said "lol this is not how it's intended"

@dumpsterqueer @hrbrmstr @borup i think the only valid criticism of GDPR is that it's not tight enough tbh. they could've mandated sites respect a

X-GDPR-Cookie-Consent: { reject-nonessential | ask | allow }

header in all HTTP requests, or at least mandate that the UI for the preference be provided by the browser and websites got to acquire the answer either as a header or thru a JS function

I don't get why they skipped something so obvious

@cadadr @dumpsterqueer @hrbrmstr @borup

I'm guessing that the bad actors forced a "compromise"

@hrbrmstr @borup GitHub figured it out, Sentry figured it out. It can be done. And clearly some companies just care about the UX of their EU users more than others, because even though they all adhere to the same law, some cookie banners are more annoying than others.
@hrbrmstr @borup There's valid criticism of the GDPR, like how for example companies legitimately didn't know how to interpret it when it first came out, which led to wildly different interpretations and lots of "overly cautious" implementations (especially in germany and austria) But it doesn't matter anymore today. The differences you see today in implementation come from mentality and priorities of website owners rather than the written law.

@untitaker @borup GDPR was created to collect fines.

The EU doesn't actually care about data privacy/human safety. Ref: ProtectEU

And, all cookie notices are annoying & fairly useless at this point.

@hrbrmstr @borup "The EU doesn't care about human safety" is an asinine statement. I wish you best of luck discussing policy with anybody while having that kind of mentality.

@untitaker @borup I'll make sure to pass that on to the Council of Economic Advisers who I have talked policy with and a few other groups I do talk policy with.

Have fun living in your fantasy world, especially when ProtectEU goes into full swing.

@hrbrmstr @borup I also don't think the GDPR would be able to survive the current political climate as-is. But that's completely irrelevant to this conversation. The fact is that the GDPR can definitely be implemented without cookie notices.
@hrbrmstr @untitaker @borup Oh sure, that obscure council is the final authority on the purpose of data protection law. > 80% of the rules in the GDPR already existed before it, so that is demonstrable nonsense.
@hrbrmstr @untitaker @borup To add to this, the Council of Economic Advisors is a US executive body thing, their opinions on the motives for EU legislation are just that, opinions. And in this case it is perfectly in line with the US ignoring the historic realities behind the GDPR (including its provenance in the US Nixon administration) and merely going for the political expedient theory that it all is just a non-tariff barrier against US companies. You are just confusing US myopia for facts.

@untitaker @hrbrmstr @borup
I have never seen one overly cautious cookie implementation. I have seen thousands that followed the Epstein model of consent.

First by simply stating that they were in violation, then claiming "you consent", then it was a question with accept as the only possible answer.

@leeloo @hrbrmstr @borup Overly cautious as in, unnecessary cover-your-ass maneuvers for the website owner. The user experience usually suffers from it.
@untitaker @hrbrmstr @borup
Nope, haven't seen that either. Any such CYA language has always been accompanied by several dark patterns if not straight up violations.
@hrbrmstr @borup
They could just have the webserver look at the DNT header.

@hrbrmstr @borup They could put a link or button saying something like "Personalize my ads"somewhere that doesn't block your view of the page and doesn't force you to interact with it before reading the page you've already loaded, and default to just the narrowly-allowed types of tracking (like remembering that you rejected the more invasive types).

It could be a sidebar, part of the header or footer, a banner in the middle of the article...

Heck, even one of those annoying scroll-down subscription prompts, or an interstitial when following links (as long as it remembered your decision) would be less annoying.

There are lots of options less malicious than what the industry decided to go with, because they picked something that effectively turns what should be an opt-in choice into an opt-out one.

@hrbrmstr @borup You do not need consent for stuff you don't do. Stop the bloody surveillance.

@hrbrmstr @borup Honour the DoNotTrack setting, which already is a standard?

Does the user have it set? No cookies, no popup. It's that easy.