"We care about your privacy!"

Us and our ONE THOUSAND, FIVE HUNDRED AND EIGHTY FOUR "partners". Hah ha!

Also fuck off!

Also I just switched off JS and read your fucking article anyway. What you and your partners gonna do about that? 🤪

In the real world still, if a person says to you, "This is my partner", that basically means something like, "If you trust me, you can trust them" and/or "this person can speak on my behalf because they know me really well".

But online "partner" apparently now just means "a collection of companies whose names I could not even recount without looking them up in a database or spreadsheet I have somewhere".

I only share my economy with one person and my highest level of trust is with that same person. It's my wife. She is the one person in this world I would give the label "partner".

Apparently I am holding myself back. I need to collect a few more thousand partners.

Here is a fun thing. I work for Vivaldi Browser. Load any of our websites and you see no cookie banner and no mention of partners.

https://vivaldi.com

"But wait" you say, "didn't those terrible Europeans mandate the cookie banner!?"

No, no they did not. We do not need a cookie banner because we are not selling all your shit to every company under the sun.

Also those sites with cookie banners are just doing malicious compliance. This was never about the EU requiring cookie banners!

Vivaldi Browser | Powerful, Personal and Private web browser

It’s a web browser. But fun. It comes with a bunch of clever features built-in. It’s super flexible and does not track you. Get the Vivaldi browser for desktop, mobile, and your car!

Vivaldi Browser

The one wierd trick to not having a cookie banner is… wait for it… Do not sell out your users!

Who knew!?

Apparently the Fediverse actually did know because guess what, whenever I visit an instance I am also not asked to click through a cookie banner. Again, SO WEIRD!

@ruari My sole public-facing website is a GPX file visualiser. When I made it public I added a privacy statement:

"Privacy: I don't set any cookies, or store any data. All processing is done in your browser so I have no access to your routes "

It's easy, unless you come from the position that screwing fractional cents out of every page load is a business model

@ruari If you don't surveil and sell your visitors, then you don't need cookie banners. It's very simple.

The only ones who don't seem to get this very simple fact are the tech bros trained by laissez-faire capitalists to hate the EU for daring to regulate their privacy invasions.

@davidculley @mastodonmigration @ruari they understand it. They don't want you to understand that their business model is built on your private data.
@davidculley @ruari The EU legislated, member states do the regulating and most of them are utterly shit at it
@davidculley @ruari Thanks to being bombarded by bad-faith cookie banners by said tech bros and abusive businesses, a lot of normies also don't get it and believe the lie that "EU requires those annoying cookie banners".
@davidculley Polish government website, gov.pl, doesn't know it either. @ruari

@davidculley @ruari

... and right from the start of the Internet, we digital types put up little websites for what would become our consulting practices - and people came! Paying Clients, with questions the websites would answer.

The very idea of selling my client list, these are people who have written me checks. No.

I don't get many hits on my consulting site. I've never exhibited it here. Those laissez-faire folks - fugg 'em, I'm going to open a training site, to convert these libertarian jackasses to hard-workin' coders who respect their clients. Save the world thereby

@davidculley @ruari @mastodonmigration

Oh, there are internal navigation cookies needed in some web design. Especially if the site sells its own wares, or has a search for its archive. Although I was fine with HTMl 3.0 site maps for most sites 25 years back.

@Chancerubbage @davidculley @ruari @mastodonmigration cookies that are used for internal navigation and sessions don't require a banner though

@jelte @davidculley @ruari @mastodonmigration

Seems to me the banners are on EVERY POSSIBLE SITE however.

Some are honest enough to break down if they are ‘necessary’ or ‘for their partners however. While others use that complexity to confuse more.

And most users don’t care. But can and will click away

@jelte @Chancerubbage @davidculley @ruari @mastodonmigration as long as they aren’t passed through a third party even if privacy preserving, AIUI.
@ruari You don't have to warn about cookies that are set as a result of user interaction, such as logging in or setting preferences, only for cookies that are set automatically on load. Just don't do that, and you don't have to mention it. "Legitimate interest" is a legal loophole that lets them create tracking cookies that can't be disabled. Any actually legitimate cookies would be set from user interaction and would, therefore, be exempt from the GDPR notification.
@StarkRG @ruari That is what bothers me the most about some cookie-banners. Those were the "legitimate interests" are predefined if you want to reject all.
If they are legitimate interests, I can not turn them off. If they are not you (as in they) can not turn them on!
@ruari While I agree on principle, iiuc are there not perfectly valid exceptions to this? If you are a manufacturer, you may need to pass on a person's address to a logistics company for delivery. If you're e-commerce, you may need to pass the address to the manufacturer and logistics firm and whoever else is down that chain. Etc

@txtx @ruari To pass a person's address you don't need cookies. So no cookie banner.

It's also not required to ask for consent, if the data "processing is necessary for the performance of a contract to which the data subject is party" (Art 6 GDPR 1(b)), which would perfectly cover your described usecase. Consent was really meant as a fallback under GDPR, in the sense of "I have no legitimate good reason to process your data, but I want to do it anyway, may I?"

@pixelschubsi GDPR is not a cookie banner law. It's about data privacy and data sharing. So even if a company is not using cookies to pass private information, they still need to follow GDPR just the same. @ruari
@txtx @ruari yes, and all of those are valid exceptions that don't need a cookie banner.

@orange_lux If you forward personal data to a logistics/manufacturing firm, customers need to be informed by law — whether you place that information in a cookie banner or somewhere else. GDPR isn't a cookie banner law. This seems to be a huge and unfortunate misunderstanding.

@ruari

@ruari tell that the companies that don’t sell out users but still use a cookie banner „just to be safe“ 😭

@ruari the bit the companies don't say is that EU requires informed consent to share your data.

Cookie banners are a deliberately poor implementation for collecting consent. And many of them are not compliant because they don't inform.

@craignicol @ruari also I dislike the term cookie banners. What's stopping me from using some different mechanism (e.g. passing a unique ID for every logged in user to 3rd party scripts)? That still needs consent.
@elvith I agree, it's a shame that colloquially GDPR came to be known as the 'cookie law' which it is not at all. @craignicol @ruari
@craignicol @ruari also they don't allow to refuse all as easily as they allow to give consent, which is definitively illegal, also it's impossible to actually be informed about hundreds of companies to which trackers belong (it really is not just about cookies).
@DiogoConstantino With so many cookies, can we have a party? 😉

@DiogoConstantino @craignicol @ruari My only access to the web is via my phone - I have Blockada 5 running on it, plus a number of ad blockers, tracking cookie blockers, and various other blockers and firefox extensions to maintain a minimum footprint.

What is un-nerving is the volume of cookies thrown at you when online - particularly the data collection cookies which Blockada spots and blocks.

Ok, so I can't watch videos on X...is that such a loss? Not really.

@craignicol @ruari uninformed consent sounds very creepy, yet here we are.
@iduction @ruari consent is rarely, if ever, considered by the billionaires running this show. Uninformed is definitely a feature. Just see how loudly they complain when we ask what they're really up to.
@ruari is there a list of privacy things your going out of the box ? Like fingerprinting counter measures ?

@ruari

Probier ich aus. Wirkt auf den ersten Blick angenehm. Allerdings frage ich mich, wieviel besser Vivaldi sein kann als Firefox oder Fennec mit den entsprechenden Ergänzungen und Einstellungen?

@freistern @ruari good question. But I will try it on my Linux machine

@danielpree @ruari

Was ich auf den ersten Blicken so sehe, ist ein zeitgemäßes Layout, recht nutzungsfreundlich.

I now feel very vindicated for making Vivaldi my browser of choice 🙏

@leanderlindahl

Thank you for sharing this. I too tought that EU made mandatory the cookie banners.

I did not know about the selling your data consent part.

Thank you.

@MichelPatrice @leanderlindahl The test whether to ask for consent is not about "selling your data" either.

The ePrivacy Directive of the EU requires every member state to make laws that ratify certain rules. One of those rules (Article 5(3)) is that reading and/or writing data on "terminal equipment", such as cookies on a visitor's computer, requires consent.

The laws must include two exceptions, covering data that is only used to make data transmission possible, and data that is necessary to provide a service that was explicitly requested by the user. This is why you can't disable "functional cookies" or "strictly necessary cookies" in cookie walls.

However, Article 5(3) does not use the word "consent". I'm not going to repeat the exact wording here. The way I read it, is that you should have prior consent before using cookies (or local storage, or other data stored by web APIs) except for the strictly necessary stuff, but even the strictly necessary stuff still needs to be clearly and comprehensively explained to the user. So if you don't need prior consent, you don't need a wall, but you still need a section on your "privacy" page about your cookies.

@stiiin

Thank you very much for the clarification,

@ruari in fact, @monocles doesn't use #tracking #cookies and thus you don't get that…

https://infosec.space/@kkarhan/116219697784792152

Kevin Karhan :verified: (@[email protected])

Attached: 1 image > *"We Care about your Privacy"* No you don't, you fucking assholes! - If you did care about #privacy, you'd not want to force *247 trackers* down my throat, you *lying pieces if shit!* - If you cared about my privacy, you'd not even try to force a single #tracker on me and a would only use a #LoginCookie *at most*! This shite really makes my *blood boil* because it's insulting the intellect of every person! #privacy #StackExchange #InfoSec #OpSec #ComSec #ITsec #tracking #cookies #PopUps #JavaScript #Ensittification #Consent #InformedConsent #IT

Infosec.Space

@ruari weird how they did not see that this would happen. We all did. It was obvious.

The crap that goes on behind the scenes is mad: “789 trusted partners” etc.

They should have somehow actually banned that, not “banned unless consent”. If they had made it something like written consent on a signed paper contract (wow, imagine posted cookie banners), or just some way that forcing the consent was not commercially viable. A simple banner is way too cheap.

Those banners are actually hurting privacy. They put an extra obstacle in the way for anyone who wants to browse the site in a private window.

And how many sites actually wait for consent before setting all of those cookies? Have you ever counted how many third party cookies are being set before you approve one of those forms?

@ruari
Love Vivaldi. Excellent browser. 👍🏼❤️

@ruari Aber wie passt das mit https://www.kuketz-blog.de/vivaldi-datensendeverhalten-desktop-version-browser-check-teil5/ zusammen?

Ihr sendet ja Daten an Google.
Müsst ihr, um beispielsweise Updates durchführen zu können, etc.
ABer das sind ja Daten, die ihr nicht kontrollieren könnt und die Google durchaus verkaufen könnte.

Braucht es dafür keine Zustimmung?

Vivaldi: Datensendeverhalten Desktop-Version – Browser-Check Teil5

Bei Vivaldi siecht die Privatsphäre aufgrund der engen Verbandelung zu Google vor sich hin.

@ruari "but all those beautiful webfonts"
@eingemaischt @ruari Upload them to your site, too. Problem solved. (First look up if you are allowed to, copyright law still applies.)
@daarin @ruari i know.... Therefore marked in quotes.

@ruari so the outcome of the EU rules is, on one hand we have cookie banners and on the other we have "I don't care about cookies" plugins.

So what would the world look right now if we didn't have that ruling? Do the benefits currently really outweigh the costs?

I'm not per se assuming that everyone is malicious and I also don't believe that treating everyone like little children who "need to be protected by more rules" is the right way either.

The market would have created a solution.

@ruari
Why does Vivaldi not license their software under a common FOSS license? They release the source code.
How does Vivaldi pay their developers?

Cloud be an alternative I would consider.

@ruari
I moved over to Vivaldi from Chrome a few weeks ago. Chrome was seriously pissing me off; Vivaldi is a joy to use in comparison.
@ruari I was inspired by DI day to reflect on the tools I use. Vivaldi for me is the next step on this path. Love it so far :)

@ruari also as someone who learned HTML before cookies were supported it's amazing how many people think cookies are needed.

They are needed only if you need to login or have online store or other thing that needs to track the individual browser. For viewing public content you need zero cookies. Anything more than that is just unnecessary tracking.