Ask HN: What is the least obnoxious way to ask for cookie permissions?

The question always is whether there's a negative consequence outweighing the "positive" incentive of trying to increase favorable consent decisions by using dark patterns.

I had the pleasure to learn a lot about this while working in the higher levels of some german company with a somewhat questionable track record.

Here's what you can do (only applies to Germany, but might be similar elsewhere):

Complain to the data protection authority of your local state in writing. These complaints will be followed up by the authority and if enough of them accumulate, the company will have a bad time and the aforementioned incentive equation will be bent towards the end that favors user privacy.

Don't write angry emails. Nobody cares and you waste time.

> Also probably illegal.

Pretty clearly so. It seems weird to me that so many companies put up a cookie banner in order to avoid breaking the law, and then break the law in order to make it less effective. I suppose the win here is that if the (fairly toothless) regulators notice you can say "oh we thought this was enough" and then tweak it. But in that case why not just have no banner at all, and wait until they notice in the first place?

Just as daft as the extra-US sites that choose to show no content to EU geolocated origins instead of complying with the law. Which is... also illegal under the letter of the law, so why not just ignore the law. Presumably you're probably out of the jurisdiction anyway if you're bothering to do this.

The cookie for saving the preference is technically required. Hence, it doesn't need consent.

It's not PII so you can just use a cookie.

I think you don't need a cookie for that. You can use localStorage which is local to the user's device.

This is completely false. You need permission for any data you store on a user device or retrieve from a user device if that is not strictly needed for the execution of the service the user requested. Nowhere in the law is the word "cookie" even used, so your suggestion that "1st party cookie" is different from "3rd party cookie" is wrong. And similarly, this whole thing also applies to all alternative tracking methods, so you cannot avoid it by using localStorage for example.

A 1st party tracking solution is in no way considered needed to deliver the service the user requested. Only things like remembering my shopping basked are necessary to deliver the services of a webshop. And you cannot use that cookie for other purposes (like counting visitors).

Thank you. I have done so many implementations of GDPR. The cookie consent pop-ups everywhere are only needed because of how aggressive these third parties collect information (and that they _are_ third parties).

Just don't collect PII beyond was is absolutely essential for your application, and don't share it with third parties. Bam you don't have to get consent. Knowing what classifies as PII is still a hard problem because its full of so many conditionals. Email is not PII unless you have some part of their name for example and it counts if your company receives an email from that person that includes their name in the From field.

All the cookie banners out there are designed to make people weary of them into just accepting the previous practices. It's malicious compliance.

If you're doing 1st-party tracking, and you are collecting personal data for that purpose (which is almost by definition going to be true), and the user hasn't explicitly asked for that tracking to take place (for instance by creating an account and logging in, or by putting items in a shopping basket and expecting them to be retained) then yes you will need to ask for consent to do that tracking.

The test isn't whether collecting that data is required to do your business - it is whether collecting that data is required to do what the user is asking you to do. So if (for example) you are tracking your users to see where they click in your web site in order to improve your web site, then that is only required for your business - your user has no interest in that, didn't ask for it, and therefore must be asked for consent for you to do it.

Exactly. Is it your business to track people?

There’s 90% chance that no, it’s not your business. There’s also a lot of chances that your website is about a product. In which case, it doesn’t make sense to know how many people come and read. People only need the information to know "will I buy that or not?" or, even more frequently "I’ve bought that but I don’t understand something".

Tracking is counterproductive in most scenarios. (but very few understand that)

Your opinion is comprehensible from a user's standpoint.

Once you have worked a while in business or marketing, you will see that it's not that easy unfortunately.

There's a lot of pressure to provide certain numbers or at least to collect them "just to be sure". Typically this requirement comes without any willingness to invest money, because "you can just install Google Analytics for free".

I don't want to justify this at all, because I believe in the long run these numbers aren't worth what people claim they are worth at all. I just wanted to explain that not everyone is "bad" or "anti-social" for complying with "leadership" decisions and installing a CMP and Google Analytics.

If the DNT header is absent by default, websites were happy to assume that it was okay to track users.

If the DNT header were set to "no" by default, websites would be happy to track users.

If the DNT header were set to "yes" by default, websites screamed bloody murder and pretended that it didn't represent user choice.

Let’s say I want to know the conversion rate of my payment page. I need to know how many unique visitors viewed a page, and how many of them went on to complete a payment. I’m pretty sure this is not possible without a unique identifier. And if you are using (ip address, user agent) as a proxy for such an identifier, is that any better or legal than using a cookie in the first place?

You need to make sure you're happy with how you're using peoples data and that it falls within the legitimate interest justification (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...) IP addresses can be considered personal data.

edit - make sure you've actively made this decision and documented the assessment.

You're describing a session cookie. Changing the technique slightly doesn't allow you to bypass the law.

Per the GDPR, you are not allowed to condition access to the website on acceptance of tracking.

Ruled illegal already for other websites:

https://noyb.eu/de/pay-or-okay-tech-news-site-heisede-illega...

That's only because Schrems hasn't got round to suing them yet.