🎯

Not enough people understand how techbros choose horrible user interfaces and design/moderation decisions to turn people against even the most basic and essential customer safety regulations.

I believe the current age-gating outrage is astroturfed too.

@marix You‘re correct on a wholly different level.

GDPR doesn’t mandate cookie notices.

Actually, the GDPR isn’t relevant regarding cookies at all. But Regulation 2002/58/EC as lex specialis to the GDPR is.

@codinghorror Are we sure that Jeff Atwood isn't an early LLM experiment? The straight-up overconfidence as he spouts completely incorrect and ignorant shit feels an awful lot like ChatGPT and its coterie of concussed digital parrots.

Oh, wait. The "voice" of these is modelled after what techbrodudes think sounds smart. I may have put the teleological cart before the horse.

I'm running a website for a science consortium and we don't track, we don't sell anything, and we don't have to worry about visitor data storage and protection, and we do not need any cookie clicked on the site. Very simple, very relaxing.

It also prevents the need for a data protection responsible person, because no data is being collected.

Indeed.

Now, how to make Jeff Atwood and those who listen to him take heed?
Regrettably, I don't know...
🙁

@aral

As for some of the points raised in the linked thread…

GDPR article 21 paragraph 5.

In any sane world, that would cover DNT and GPC. So *any* web site which explicitly asks for consent when the relevant request has either of those request headers set to indicate to not track is *already* in non-compliance.

Of course, like you point out, there would likely be nothing stopping a site from offering visitors the *option* to be tracked anyway.

this is why #GitHub was able to remove the banner back in 2020 - the good old days.

github.blog/news-insights/comp…

Funny enough, 5 years later the banner is back on $GitHub Blog, I guess being owned by $MSFT changes things...

No cookie for you - The GitHub Blog

The developer community remains the heart of GitHub, and we’re committed to respecting the privacy of developers using our product.

^{Nat Friedman (The GitHub Blog)}

True, load Vivaldi.com or our forums or indeed any site we run. No cookie banners. We have been asked before how we manage to do this but it ain't rocket science.

Also look at all the Mastodon sites, no banners, unlike X, Threads, etc. How? We all know how. 😉

exactly. The EU needs to mandate that

1. Every browser needs to, by default, be set to allow "strictly necessary cookies" only.
2. Every site that wants to serve EU users must honour this setting.
3. Impose massive fines on sites that don't do this or that choose to interpret "strictly necessary only" in "creative" ways.

So that anybody who does not want other cookies has to do exactly nothing to achieve that.

Even simpler: Look at the DNT http header.

Only fall back to cookie notices when the browser doesn't send it.

It was interesting how quickly Mozilla deprecated the DNT header after an EU court ruled that yes, it is a valid answer.

Really the main problem of this enforcement is that it came too late, when (almost) everyone was already dependent on collecting private data. That made it easy for the industry to collectively decide that intrusive popups would be the simplest way to comply.

What were people going to do, take their business to the competition? Doesn't matter, they do it too.

If regulation had come earlier, then the first ones to use popups would have been seen as obnoxious assholes and lost visitors.

all correct.

My own criticism of that EU law is that they didn't bother to check if there were ever any reason to let yourself be voluntarily tracked - there isn't. The whole thing should've been a law that makes it illegal.

"Yes, you can naively argue that every website should encrypt all their traffic all the time, but to me that's a "boil the sea' solution."

Talk about takes that didn't age well

@codinghorror

Well said @aral 👏👏👏