[dustypotato]

First thing I notice while browsing from EU is that there's only one option regarding cookies. Accept all! Even if I click "Learn more" there's no "accept necessary cookies" or "Reject cookies". First time I encounter something like this.

[nightpool]

This is common on many, many sites like this because they do not have any tracking cookies or anything else that they would need consent for, but they're still required to display a cookie banner "notifying" you that cookies are "in use" as per the terms of the old 2009 ePrivacy Directive. In this case, it appears that projectaria.com sets 1) one cookie for the user's DPR (1 or 2) so that the backend can serve optimized images, 2) one cookie for the user's locale, and 3) one cookie for a CSRF token for form submission.

[capableweb]

> but they're still required to display a cookie banner "notifying" you that cookies are "in use"

Common misconception but this is not true. If you use cookies only for functional purposes (not for tracking for example), you do not need to show any cookie banners. Like if you have a shopping cart and you have a cookie for keeping track of what's in it, it's for functional purposes for the user and hence needs no notice to be used.

The UK's ICO made a handy summary for people who are curious about what the directive actually says: https://ico.org.uk/media/for-organisations/documents/1545/co...

Specifically:

> Exceptions from the requirement to provide information and obtain consent

> Activities likely to fall within the exception: [...] Some cookies help ensure that the content of your page loads quickly [...] Certain cookies providing security that is essential to comply with the security requirements [...]

[nightpool]

> Common misconception but this is not true. If you use cookies only for functional purposes (not for tracking for example), you do not need to show any cookie banners. Like if you have a shopping cart and you have a cookie for keeping track of what's in it, it's for functional purposes for the user and hence needs no notice to be used.

Personally, I would not put a cookie banner of any kind on my website. However, given this text:

    The term 'strictly necessary' means that such storage of or access to information should be essential, rather than reasonably necessary, for this exemption to apply. However, it will also be restricted to what is essential to provide the service requested by the user, rather than what might be essential for any other uses the service provider might wish to make of that data. It will also include what is required to comply with any other legislation the person using the cookie might be subject to, for example, the security requirements of the seventh data protection principle.

    Where the setting of a cookie is deemed 'important' rather than 'strictly necessary', those collecting the information are still obliged to provide information about the device to the potential service recipient and obtain consent.

I think it's clear why a more risk-conscious organization like Meta might take a more conservative reading of "Strictly necessary" that does not apply to e.g. bandwidth optimizations related to a device's DPI

[Angostura]

You'll notice those last three words "and obtain consent".

Either the cookies are strictly necessary - in which case, there is no need to display a banner, or they aren't in which case you have to ask the user for consent.

"List non-necessary cookies, but don't ask for consent" isn't an option.

[IanCal]

They are not necessary.

> One of the ways we use cookies is to show you useful and relevant ads on and off Project Aria.

[sanderjd]

But it's easier and less risky to just always put in the standard language that everyone ignores and mindlessly clicks through anyway. Which is why this was very silly legislation. People helping develop future legislation (in the EU and elsewhere) should be aware of this as a cautionary tale of incentivizing theater with only cost and no benefit.

[croes]

Then why does the banner say?

>We use cookies to personalise and improve content and services, deliver relevant advertisements and increase the safety of our users

[SkyPuncher]

It’s probably the default language for the company. Technical, t he at allows them to have tracking cookies even if they don’t have them now

[IanCal]

They explicitly say

> One of the ways we use cookies is to show you useful and relevant ads on and off Project Aria.

Also no, it doesn't let them do that because that's not how the law works. There must be an opt out.

[bippihippi1]

doesn't ot have to be opt in? you need to give consent. you can't gove consent until they've told you what cookies there are and click a button. if you don't click those can't be added if you're in the eu

[nerdponx]

Right, I'm sure this is boilerplate language provided by a law firm.

[croes]

Deceptive

[guy98238710]

Language is all that matters when it comes to law. It's a blatant violation of GDPR.

[sangnoir]

What if the banner language suggests they might break GDPR, but in reality they are not doing those things? If my SaaS forces you to select a checkbox that states you're agreeing to allow me to set fire to your house (which is illegal) - would the sign up itself be breaking the law? IANAL, but I don't think it would be; I wont be breaking any laws until I commit arson.

[nerdponx]

It's breaking the law because you're essentially being forced to consent to some thing that they legally must give you the option to opt out of. It's not about them doing it, it's about the validity of their request for consent.

If I hire a hitman to murder somebody, but the hitman chickens out, I'm still guilty of having hired a hitman, even if nobody died.

[rglullis]

AFAIK, that is not true. Cookie banners are only required if they are used for tracking purposes.

[coldpie]

I have to admit, for technical folks like ourselves, I don't understand why you care what options the dialog presents. Just use a "Kill Sticky" plugin to nuke the stupid dialog so you can read the page, or even Accept them, and then instruct your browser to do whatever you like with the cookies the site creates (i.e. delete them). It's all in your hands, the popup dialog doesn't do anything you can't do yourself.

[explaininjs]

Learned helplessness. Teach the citizens that the only thing protecting them from the Big Scary Internet is their benevolent government. Meanwhile the politicians collect millions from the mass media companies that lobbied for the god-awful implementation of the law we all ended up with, and as everyone gets worn down into Accepting All always, they simultaneously forget that their User Agent holds all the cards (or in this case, cookies), and it can be instructed to do anything the User wants with them.

[ethbr0]

Did you just take a problem that free market tech created and blame it on the government? ;)

User agent sovereignty would be nice... except the most used browser and 1/2 of smartphones are controlled by Google, the largest ad tracking company on the planet.

We're way past the 90s.

[sanderjd]

This particular problem with annoying cookie dialogs is actually a government-created problem though...

But I do agree with you that "free market tech" created the problem of "tracking cookies are ubiquitous and users don't know how to control them". But then regulators just layered another annoyance on top of that, instead of solving that actual problem.

[explaininjs]

Google, the same company that provides a litany of fine grained cookie retention options in its User Agent’s options page? Except thanks to the government’s antagonistic policies (read: big-media’s lobbying) those are useless as you need to keep on clicking the damn pop ups every time you visit a page “anew”.

Also never forget we already had a perfectly good solution in the form of Do Not Track headers that a benevolent governing body would have simply mandated abiding by. Instead we have this shithole.

[ethbr0]

DNT was ignored from the time it was implemented.

The only way it ever would have been respected if it was required to cryptographically sign an acceptance of cookies, then the server was required to retain that attestation as proof of acceptance, subject to legal liability if they were found in possession of tracking data without a valid attestation.

Absent enforceability, even when the server actively and maliciously decided to ignore it, it was a toothless solution.

[PaulHoule]

The EU just should have said "if you don't respect DNT, go directly to jail and don't pass Go".

[explaininjs]

GDPR doesn’t involve any of your crypto-nerding so I don’t see how this is relevant in any way.

[rglullis]

Is it the time of the day where I make Brave advocacy again?

Brave has shown that we can have an user agent that is aligned with the user, even if the browser engine is made by Google.

[ohgodplsno]

The same Brave that is selling data for AI companies, which may or may not include personal data ?

I'd say it's probably not a good day for Brave advocacy. Neither is any other day.

[rglullis]

That's a very good example of "argument-by-Google". You know what conclusion you want to achieve, so you just go around looking for statements that are either taken out of context or misunderstood and that can be backed by a (shallow) google search.

For the record: go back to the article that you are (wrongly) alluding to [0] and see how much the author has retracted. Also, see the response from Brave's Chief of Search.

I "have" to keep advocating them because all the opposition that is presented is always based on false information, biased and prejudiced and clearly made by people who never used the browser or tried to understand the value proposition.

There are tons of things to criticize about Brave (their "partnerships" with Binance and Solana, their complete lack of interest in making BAT an actual currency for payments online, them completely losing the train of decentralized social media) but none of that ever comes up from the detractors, only this kind of bullshit like the one you bring up.

[0]: https://stackdiary.com/brave-selling-copyrighted-data-for-ai...

[js8]

Aside from what ethbr0 said, which I agree, that you're blaming the victim, I want to address the "learned helplessness" idea.

I heard recently that's actually wrong. We are born helpless, and learning to take control. The helplessness is innate, and we learn to overcome it.

In democracy, the innate helplessness of citizens is overcome by learning to participate in governance - activism, elections, public functions and so on.

The people who say "government does nothing good ever" are the ones who want to keep people in their natural helpless state. It's like telling a student, "you're doing it all wrong and can never be good".

[guy98238710]

You are definitely not born helpless. Babies keep screaming until they get what they want. They also tirelessly try to master mobility. Learned helplessness would mean they wouldn't even try crying or moving.

[js8]

I think you're arguing beside my point, I am referring to psychological concept of "learned helplessness", and how is that wrong. That concept doesn't imply that helpless people fall into a total coma, it just means that they don't attempt certain things.

[guy98238710]

Speaking from experience, babies and toddlers will attempt to do absolutely everything, including flying (which will fail) and using smartphones (where they succeed remarkably).

Learned helplessness can by definition manifest only after you have tried something and failed. Hence you cannot have learned helplessness after being born, because you had no opportunity to try anything yet.

[explaininjs]

Please don’t tell me you’re unironically arguing “learned helplessness” doesn’t exist because you “learned” you’re born “helpless” and the only path to actualizing change as an individual is through the official government sanctioned mechanisms… because if that is your honest argument… wow.

For reference, in my experience, the public works projects that get front page news coverage with tons of anecdotes from locals about how incredibly helpful and long-needed the installation was, are those that were completely unsanctioned.

And the only path to substantial policy change in all of history has always been violent revolution.

[js8]

I am not sure what your argument is. I explicitly list activism as one of the options, so I don't claim you have to always go through official channels.

But especially in democracy, you have a lot of opportunities to use official ways to institute change, like being elected or vote.

I also think there is plenty of positive social change that happens non-violently.

[samstave]

I have to admit, for the non-technical folks like not-ourselves, I don't understand why people dont know about such "simple lifehacks" -->

You're knowledge is sound, but rather than condescedingly relegate people to your 'simple' workaround - the ENTIRE premise of cookies and tracking against ones implicit desire to be private, is assinine.

[master-lincoln]

you should care because often this agreement is not about the technical detail of cookies, but allowing the company you are interacting with to share data about you with 3rd parties.

[coldpie]

If you think which HTML div element you click on to dismiss a sticky banner has any bearing whatsoever on how your data is handled server-side, I've got a trip to the Titanic in an Oceangate submersible to sell you.

[Etheryte]

Legally it does, at least if you're in the EU. The only reason websites are slow on the uptake around this is that the legal gears are slow, however we have seen many considerable fines in this space in the last few years and things are improving.

[bad_username]

It's also in direct violation of GDPR.

[guy98238710]

Or just use private window in the browser and then close it.

[IanCal]

That assumes that the entity ignoring the law is operating within it to the extent of requiring your consent. GDPR goes much wider than explicitly cookies.

[mensetmanusman]

It’s amazing how much worse browsing the web has gotten after all these pop-ups everywhere.

[kaffeeringe]

You mean how much worse surfing the web got after it became visible, how much companies are tracking us? The problem is the tracking, not the banner. If you don't sell your readers data, you don't need a banner.

[WhackyIdeas]

Noticed the same thing as I always select ‘necessary only’ or something like that.

Instead, I just closed the page and clicked on HN comments to see what it was about.

[cutler]

This one is tame compared with a whole industry of "data privacy" popups which hide "Legitimate Interest" opt-outs within Vendor lists containing hundreds of entries. Someone needs to slap some serious lawsuits on these gangsters.

[Dirak]

This is a perfect example of how GDPR can present challenges to innovation. The fact the top comment in this announcement revolves around GDPR compliance and associated fines raises questions about whether companies will be motivated to share research and open source datasets in the future.

[marcinzm]

Isn't that a GDPR violation since they're not allowed to prevent access if you refuse to share data not necessary for the service to function? Since it's from Meta I suspect regulators would enjoy another thing to add to the list for future fine calculations.

[dspillett]

It depends. If everything stored & tracked is genuinely necessary (as defined by the regulations) then consent is not required. If they are just telling you that they are storing & tracking necessary things like session information, then all is good (unless the things they store & track are not, in fact, strictly necessary and non-privacy-affecting).

Of course if they don't need consent, then why are they making a song & dance about it having us click an accept button?

[IanCal]

They explicitly say a use is for ads on and off this site.

[mike_d]

Not at all. You can have a single prompt with a single accept button if you are only using functional cookies on a site.

[capableweb]

In that case, you don't need anything, no notice nor consent required at all, get rid of the entire modal/popup/banner.

[littlestymaar]

> First time I encounter something like this.

Facebook itself use to have this exact banner with no alternative until they were strong-armed to properly comply with GDPR.

[anthonyskipper]

That's a common dark pattern.

[constantly]

It’s not really a dark pattern because they’re not tricking you into accepting or coercing more than is acceptable into doing so, they’re just not allowing you to decline. Which means if not accepting cookies is a dealbreaker for you, no problem, just: move along.

[master-lincoln]

Dark pattern is a term normally used for legal, but immoral user experience. In this case legality is questionable as they redirect you to other external sites to manage your "consent" https://optout.aboutads.info (at least from a European GDPR perspective)

[otikik]

Yep, closed it down immediately. IANAL but that might not be legal in Europe