undefined | Better HN

0 pointschrismorgan3y ago0 comments

The trouble is that popups like this don’t even comply with the relevant legislation. (Which is the ePrivacy Directive after the 2009 amendment, though people largely ignored this part of it until the advent of the GDPR which came into force in 2018. Simplified, ePD says “most cookies must be opt-in”.)

If anything, putting such wildly non-compliant popups should make you more liable to punishment, because it undermines an argument of ignorance.

0 comments

6 comments · 2 top-level

varenc3y ago· 3 in thread

I suspect if you access the site from an EU IP address you’ll see an option besides “Accept All”. The layout [0] even seems to leave room for where this other button might be.

edit: looking at the code I even see references to a “Reject All” button as well as an XHR request to a geolocation endpoint.

edit2: I set a breakpoint in their code and changed by country to "FR" and sure enough, I now see a "Reject All" button! Screenshot: https://dl.dropboxusercontent.com/s/09wcuy4yh3qqoaw/reject_a...

[0]: https://dl.dropboxusercontent.com/s/vw2khgjnyrnqucb/f

dspillett3y ago

I walked away from the site on first visit due to "accept all" being the only option. Nipped back just to check after seeing your post while checking replies to my earlier comment, and wondering if the site is deliberately treating the UK differently. It turns out only-accept-all is the default and if the geolocation lookup fails (apparently that service is blocked by my pihole, it works if on mobile without home VPN) no reject option is present.

A bit of bad design there, not failing safe, if there intention is to be compliant with stricter laws, because a failure in an external dependency makes the site less compliant.

thayne3y ago

so apparently they only care about your privacy if you are a citizen of the EU?

And that just brings up the question again: why show the popup to non-EU viewers if the only option is to accept the cookies. It isn't even effective as a form of protest because those viewers have even less influence over EU regulations than EU citizens.

dspillett3y ago

> so apparently they only care about your privacy if you are a citizen of the EU?

No, they care about being minimally compliant and laws vary.

A number of places have legislation that just says "users much opt in" but the EU has legislation that says "users must opt-in, but cannot be forced to opt-in by there being no opt-out option".

They don't care about your privacy at all, no matter where you are, if any claim otherwise is made it is a lie.

1 more reply

xp843y ago· 1 in thread

If these silly laws were enforced, you'd have to shut down the whole Internet anyway.

hans_castorp3y ago

> If these silly laws were enforced, you'd have to shut down the whole Internet anyway.

No, the tracking across sites will stop. None of those "silly" laws prohibit the use of e.g. session cookies.

j / k navigate · click thread line to collapse

0 comments

6 comments · 2 top-level

varenc3y ago· 3 in thread

I suspect if you access the site from an EU IP address you’ll see an option besides “Accept All”. The layout [0] even seems to leave room for where this other button might be.

edit: looking at the code I even see references to a “Reject All” button as well as an XHR request to a geolocation endpoint.

edit2: I set a breakpoint in their code and changed by country to "FR" and sure enough, I now see a "Reject All" button! Screenshot: https://dl.dropboxusercontent.com/s/09wcuy4yh3qqoaw/reject_a...

[0]: https://dl.dropboxusercontent.com/s/vw2khgjnyrnqucb/f

dspillett3y ago

A bit of bad design there, not failing safe, if there intention is to be compliant with stricter laws, because a failure in an external dependency makes the site less compliant.

thayne3y ago

so apparently they only care about your privacy if you are a citizen of the EU?

dspillett3y ago

> so apparently they only care about your privacy if you are a citizen of the EU?

No, they care about being minimally compliant and laws vary.

A number of places have legislation that just says "users much opt in" but the EU has legislation that says "users must opt-in, but cannot be forced to opt-in by there being no opt-out option".

They don't care about your privacy at all, no matter where you are, if any claim otherwise is made it is a lie.

1 more reply

xp843y ago· 1 in thread

If these silly laws were enforced, you'd have to shut down the whole Internet anyway.

hans_castorp3y ago

> If these silly laws were enforced, you'd have to shut down the whole Internet anyway.

No, the tracking across sites will stop. None of those "silly" laws prohibit the use of e.g. session cookies.

j / k navigate · click thread line to collapse