EU's top court says tracking cookies require actual consent before scarfing down user data

Websites may not present visitors with a pre-checked box that signals consent to the storage of HTTP cookies on their devices, according to a ruling [PDF] handed down on Tuesday by the Court of Justice of the European Union (CJEU). The decision follows from the German Federation of Consumer Organizations' challenge of German …

[Pascal Monett]

That was nice

So, what about all those sites that put up a message about cookies and the only option is "I understand" (or words to that effect) ?

In that situation I am not offered a choice, I can only accept cookies. That is not informed consent either.

[Aqua Marina]

Re: That was nice

You have the ulitmate freedom to click the back button, and go somewhere else. No-one forces you to visit any website.

[Pascal Monett]

Sometimes work forces you to go to a given website. The Internet is not only used for leisure.

[Anonymous Coward]

" The Internet is not only used for leisure."

Click *here* to be paid for watching cat videos...

[JetSetJim]

You forgot the href tags around the "here". Could you supply the link? Asking for a friend....

[chivo243]

Another reason I don't sync my googlily chromish stuff, keep it at work where it's required... not at home where I don't want to be reminded!

[Nick Kew]

If it's $work then you're using a $work persona and giving $work consent. Be sure to separate that from your personal persona if you're unhappy with $work's choices.

[electricmonk]

Re: That was nice

"You have the ulitmate freedom to click the back button, and go somewhere else. No-one forces you to visit any website."

Sorry, not good enough. Website owners may not block "general access" to the website on that basis, though they can prevent access to specific pieces of content where there is a legitimate reason to do so.

Of course that's only enforceable for EU-based sites. I find a lot of the offending sites are from big US publishers who probably consider their European audience too small to be worth bothering about, so they aren't going to spend money reconfiguring their sites just to comply with foreign laws.

[Mike 137]

Re: That was nice

A common ploy is to position a massive static "accept" panel blocking the content unless you tick the box - or turn the style sheet off ;-)

[Tigra 07]

Re: That was nice

Or those websites with two options:

Option 1 - click "Accept"

Option 2 - Untick these 100 individual domains that want to track you

[katrinab]

Re: That was nice

As per the article, if asking someone to untick one box is not acceptable, asking someine to untick 100 boxes definitely isn't/

[paulf]

Re: That was nice

So it seems, but there are still companies that assume consent by default, and require multiple clicks to opt-out (local world news websites in the UK are a good, but only one, example). There are other sites, usually ones that just have an "I Accept" footer banner, as mentioned further up by the OP) where you have to rummage around in the site's "privacy" policy to find out what cookies they place and then visit multiple websites to opt-out of that particular ad-slinger's cookies - usually by identifying yourself and asking them nicely not to track you.

The guidelines are simple: Consent must be clearly and freely given, and must be opt-in. Unfortunately there are many many websites that still think this doesn't apply to them and it'll take the administration of a few mega-fines to shift mindsets....

[A.P. Veening]

Re: That was nice

I'd be happy to see some Giga-fines administered with a raise to Tera-fines for repeat offenders.

[Snowy]

Re: That was nice

I agree if there one button accept them all there should be one button next to it to reject them all.

[Ivan Headache]

Re: That was nice

I have found lately that that is the case.

Some of the sites I visit on a daily basis have the usual Accept button - but in the small print above it there is a blue HERE word.

Clicking that takes me to a accept all/reject all panel.

Thankfully it does remember that I previously checked Reject all yesterday - but why does it ask me every single time to accept when I visit afresh?

But... How does it remember that I clicked Reject all yesterday?

[gnasher729]

Re: That was nice

How are they able to remember I said”rejectvsll” yesterday? By using a cookie for technical purposes which is allowed.

[Anonymous Coward]

Re: That was nice

It was over 200 hundred on the last one I checked!

Why does my local paper have tracking cookies from Greece and Switzerland?

[Loyal Commenter]

Re: That was nice

Why does my local paper have tracking cookies from Greece and Switzerland?

Because they are paid by scammers advertisers in Greece and Switzerland to throw malware laced spam adverts at you.

[Uberior]

Re: That was nice

Then wait 20 minutes whilst it "updates"?

[Tigra 07]

Re: That was nice

And on some websites it fails and you have to do it again. Just to take the piss!

[gnasher729]

Re: That was nice

Arstechnica used to do this, which made me think of them more as “arseholes”. Goodwill can be destroyed so easily. Today, it’s still seven or eight clicks. Which is seven or eight more than legal in Europe.

[Anonymous Coward]

Re: That was nice

Option 2 - Untick these 100 individual domains that want to track you

/ Looking at you, 'Oath'

/On plus side, never see anything from Yahoo now

[Robert D Bank]

Re: That was nice

'kin Oath, have to agree, they're one of the worst. To the extent I don't bother gong there anymore.

[Arthur the cat]

Re: That was nice

A common ploy is to position a massive static "accept" panel blocking the content unless you tick the box - or turn the style sheet off ;-)

uBlock Origin's element zapper is very useful for dealing with those. A lot easier than using the web developer tools to give the interfering item a z-index of -1.

[TheVogon]

Re: That was nice

Not correct. The GDPR applies globally to the information of EU citizens and US based websites most certainly are in scope and liable to fines.

For which most corporations of note would have EU assets or income or failing that company officers could be arrested on visting the EU.

[vtcodger]

Re: That was nice

"Not correct. The GDPR applies globally to the information of EU citizens and US based websites most certainly are in scope and liable to fines."

True. However, considering the difficulty you folks have getting US corporations to pay their taxes, I wouldn't be overly sanguine about your ability to collect fines from them. A more effective approach would probably be to arrest corporate officers whenever they wander onto EU soil, and lock them up for 30 days or so.

[Mike 137]

Re: That was nice

"The GDPR applies globally to the information of EU citizens"

Actually it applies to data subjects in the EU, so US citizens (and other non-EU nationals) while present in Europe are also protected - insofar as anyone is actually protected. The GDPR is emerging as having very small teeth except where mega-corporations or massive data breaches are concerned. As always, de minimis non curat lex and most individuals seem to be minimal as far as this law is concerned. Here in the UK, enforcement is so poorly resourced that it not only takes some 3 months for a case officer to be assigned to a complaint, but (I would hazard) the majority of complaints by single individuals are apparently not pursued.

[Claverhouse]

Re: That was nice

Of course that's only enforceable for EU-based sites. I find a lot of the offending sites are from big US publishers who probably consider their European audience too small to be worth bothering about, so they aren't going to spend money reconfiguring their sites just to comply with foreign laws.

Whilst still ripping off their American * audiences.

,

* And other, Latin Americans, say, are neither under EU protection nor signed up to North American apathy.

[Dan 55]

Re: That was nice

You have the ulitmate freedom to click the back button, and go somewhere else. No-one forces you to visit any website.

By which time they've probably still dumped a bunch of tracking cookies on your browser.

[gnasher729]

Re: That was nice

Actually, if you can’t accessed the website without consent, then the consent is not voluntary and doesn’t count, so all the data collected is collected illegally.

Would be nice to have a few companies operating that way being forced by a court to delete all the collected data permanently.

[A.P. Veening]

Re: That was nice

Don't forget "and paying some hefty fines", preferably to the point already paid management bonuses have to be clawed back just to keep the company barely afloat.

[HapaxOromenon]

Re: That was nice

Wrong. That argument is basically like saying that a loan shark should be able to issue contracts with a "pound of flesh" as security, because people have the freedom to go to other loan provides if they wish. It is a complete non sequitur, and it is expressly countermanded by Article 4(11) of GDPR.

[big_D]

Re: That was nice

Until you click OK, they can't deposit the cookies... But theoretically they should offer the option of continuing without a cookie. They could use a server side session for the visit with no need to deposit a cookie on the machine, for example.

[Charlie Clark]

Re: That was nice

How's this supposed to work with a stateless protocol like http? The cookie is required to map browser requests to the server session.

[big_D]

Re: That was nice

URL re-writing with session ID, for example. Or a hidden session ID field in the POST.

[Charlie Clark]

Re: That was nice

Parameters are particularly susceptible to interception which is why this kind of session handling has been frowned upon for years.

[Tom 7]

Re: That was nice

So are cookies - there is no noticeable security advantage of cookies over query string.

[Orv]

Re: That was nice

Nothing like giving someone a link to an article you read, and having it also give them access to your session. ;)

[Anonymous Coward]

Re: That was nice

@ Charlie Clark "The cookie is required to map browser requests to the server session."

From ec.europa.eu

"...consent is not required for technical storage or access of the following cookies:

* Cookies used for the sole purpose of carrying out the transmission of a communication

* Cookies that are strictly necessary in order for the provider of an information society service explicitly required by the user to provide that service."

So, no change as I understand it. Absolutely necessary cookies, which your site simply cannot function without, can be placed without the consent of the user - though I think you still need the cookie notice.

As this ruling relates to a pre-checked box for targeted advertising cookies, which aren't essential, it falls foul of the rules.

Seems to me this ruling simply confirms the existing rules. IANAL, though...

[Anonymous Coward]

Re: That was nice

I thlught this only applied to persistent cookies anyway?

[A.P. Veening]

Re: That was nice

Until you click OK, they can't deposit the cookies...

But they will anyhow.

[Charlie Clark]

Re: That was nice

The ruling is quite clear: consent must be explicitly given so such messages are invalid. This shouldn't really surprise any once as it has consistently been the position of the courts.

However, GDPR is currently being revised and it wouldn't surprise me if some cookies become legitimate without consent as long as there is a list of them with their purpose and lifespan. It's not as if this hard to do, though I've seen multiple, ahem, "developers" fail to provide a correct list and explantion of a website's cookies. Note, that failure to do this correctly could go beyond GDPR and enter the realms of fraud.

[big_D]

Re: That was nice

I've been to a couple of websites that allow you to view the cookies and disable them (wrong default!), but as there were over 100 tracking cookies on the site, it was a laborious task to go through and turn them all off! I'm guessing they are hoping most people won't look and those that do are too intimidated to take the time to disable them all.

[Doctor Syntax]

Re: That was nice

"GDPR is currently being revised"

Lets hope the revision makes provision for some form of pro-active enforcement. I'm thinking of something along the lines of some combination of sensitivity of data and size of the site's audience requiring an annual audit of practices.

[Charlie Clark]

Re: That was nice

Well, we now have a ruling for the lower courts to follow. A couple of summary judgements should be sufficient to get most people to start to comply

[Nick Kew]

Re: That was nice

I generally find an adblocker can make that box go away without ticking anything.

[Anonymous Coward]

Re: That was nice

Not always and everywhere. To zap a box isn't according the law that everybody should follow. I normally also drive in the spirit of the speed laws. But if they catch me the ticket is very real.

And that's an innocent box you mention. On the net however, some just don't give a toss and just keep doing what they are doing stuff knowingly to make sure that the only important thing, their revenue streams, are continuing. And yes, one could argue making money from activities which are not according the law are... oh dear, criminal. In comes the cookie wall. For example, try to read most Dutch newspaper/ site (here, here, here, and there are many, many more). They are all behind a cookie wall which sports only an "I accept" button. No small lettering, no hidden alternative. Just a solid cookie wall and "my way or the highway" arrogance. Like I said, standard "ignore and you get away with" behaviour... Standard Dutch behaviour...

[John Miles]

Re: the only option is "I understand" (or words to that effect) ?

I find Firefox's reader mode quite often makes it go away, along with a lot of other rubbish without clicking button (though sometimes kills the bits I want), alternatively deleting some nodes from the DOM using dev tools also often makes it go away but that is more effort

[JulieM]

Re: That was nice

Under such circumstances you would be entirely justified in blocking cookies, or even sending them back altered to poison their tracking. (If enough people started doing that, they just might sit up and take notice!)

Firefox used to let you accept or reject cookies on a one-by-one basis.

[Anonymous Coward]

Well that ruling has a timespan of about 30 days in the UK

The post is required, and must contain letters.

[Tom 7]

Re: Well that ruling has a timespan of about 30 days in the UK

Well that ruling has a lifespan of the UK

[Warm Braw]

Re: Well that ruling has a timespan of about 30 days in the UK

The post is required, and must contain letters

Sounds like the Corbyn solution to profitability of a re-nationalised Royal Mail...

[Cederic]

Re: Well that ruling has a timespan of about 30 days in the UK

Section 6 of the European Union (Withdrawal) Act 2018 disagrees with you.

http://www.legislation.gov.uk/ukpga/2018/16/section/6

[Doctor Syntax]

Re: Well that ruling has a timespan of about 30 days in the UK

But what significance has an Act of Parliament compared to the opinion of an A/C who can't even distinguish between a title and the body of a comment?

[Anonymous Coward]

Re: Well that ruling has a timespan of about 30 days in the UK

As things stand, the United Kingdom will cease to be a member state of the European Union on 31st October 2019, after giving notice pursuant to Art 50 of the Treaty on the Functioning of the European Union (TFEU). UK businesses and nationals will lose their EU law rights in all 28 member states; non-UK EU businesses and nationals will lose their EU law rights in the UK; and the UK will cease to have rights or obligations arising out of the EU.

These fundamental legal changes will necessarily affect the relationship between the UK and the European Court of Justice (ECJ): the UK will lose its right to appoint judges to the ECJ or to be a party to cases before it; UK courts will have no power or duty to refer points of EU law to the ECJ for a preliminary ruling; and the EU Commission will have no power to bring proceedings against the UK for non-compliance with its obligations under the EU treaties.

The Withdrawal Bill suggests that the UK courts ‘need not [but may where appropriate] have regard to’ any ruling of the ECJ on a point of EU law, apparently including rulings relating to the period of UK membership but delivered after that date.

[Doctor Syntax]

Re: Well that ruling has a timespan of about 30 days in the UK

The recent DPA is based heavily on GDPR. And if the UK crashes out without a deal once BoJo's backers have cashed in their bets they'll have no objections to him or his successor starting work to get back in.

[Anonymous Coward]

Re: Well that ruling has a timespan of about 30 days in the UK

Not so much heavily based on, it IS the U.K. implementation of the regulation. Leaving the EU would still leave the 2018 act in place and still enforceable.

[Charlie Clark]

Re: Well that ruling has a timespan of about 30 days in the UK

As things stand Parliament has passed a law that the UK will not leave on October 31st without an agreement including the continued observation of GDPR.

[Cederic]

Re: Well that ruling has a timespan of about 30 days in the UK

No, they haven't.

I know at least three ways in which that's the case, but as none of them has been discussed in the media I don't want to publicise them. Two of them would likely result in court challenges, the third appears immune even to that.

Ask me after the event - I promise to be honest about my assessment.

[Charlie Clark]

Re: Well that ruling has a timespan of about 30 days in the UK

Who hasn't done what?

I think the government might be planning to break and subsequently challenge the law in which case, given the Supreme Court's recent judgement, it's likely to find itself subject to an injunction and likely to be held in contempt. And then there are still plans to prorogue for a Queen's speech…

The B-team has already demonstrated it doesn't have the best legal team and Bojo's declaiming that he won't comply won't help him in court either.

Pity the fools who have put their trust in these idiots.

[ArrZarr]

Re: Well that ruling has a timespan of about 30 days in the UK

To my knowledge, the UK parliament can (and have) force the PM to ask for an extension, but that doesn't mean that the EU will grant any extension.

If no extension is granted, it doesn't matter what laws are passed by the commons as they don't have the jurisdiction to force anything on the decision maker(s).

[Anonymous Coward]

Re: Well that ruling has a timespan of about 30 days in the UK

Couple of points on that.

VoNC where no government can be agreed defaults to election and if there is no prime minister there is no one to force to request the extension.

Civil Contingencies Act - Repeal the Benn act on grounds of potential civil unrest due to not leaving the EU.

I'm not saying either of those will happen and there are probably other options available like can he just resign? I don't know but I wouldn't put anything past that sneaky bastard.

[Charlie Clark]

Re: Well that ruling has a timespan of about 30 days in the UK

There won't be a confidence vote until Corbyn agrees that someone else should be caretaker Prime Minister. His minders won't let him pull another December stunt.

Trying to repeal the Benn Act on any grounds would almost certainly be quashed by an injunction. The Supreme Court has asserted the primacy of Parliament and it's difficult to see even the High Court trying go against that judgement.

Bojo could resign but the fixed term act doesn't mean this will lead to a new election. Cf. resignations of Cameron and May. May eroded an already slim majority through bloody-minded attrition but Bojo just threw it away in a fit of entitled pique.

PMQs this afternoon with a decidedly C-team: Raab and Abbot

[Cederic]

Re: Well that ruling has a timespan of about 30 days in the UK

A confidence vote merely triggers an election - there's no legal requirement for Boris to resign, so his Government remains in power until the election.

(Which also means, for the person to whom you replied, that Boris would remain Prime Minister throughout that period, and subject to any applicable laws)

[Richard 12]

Re: Well that ruling has a timespan of about 30 days in the UK

VoNC (or resignation) passes PMship to whomsoever can command confidence. So the new PM goes to the Queen the same day, and the request is sent the EU.

A general election is the backstop if nobody can win a VoC in 14 days. Only question is whether it's Corbyn or not.

Civil Contingencies Act, Government is immediately taken to court, loses case and is held in contempt of Parliament. Boris (and his team) may also be tried for treason, due to obviously premeditated illegal acts in direct contravention of the clear expressed will of Parliament.

Meanwhile, a VoNC has taken place and a new PM has been installed, who sends the request.

In any event another likely possibility is that the Queen dismisses Boris for refusing to comply with the law, and asks Parliament to recommend a new PM, who sends the request. There's been several hints that she's considering this.

The PM doesn't get to ignore the law. No matter how high you are, the law is above you.

[A.P. Veening]

Re: Well that ruling has a timespan of about 30 days in the UK

I am afraid you are overlooking one minor detail about sending a request for another extension: it might get denied (and it seems likely the EU just might do so this time), which only leaves the nucleair option of revoking article 50 (as already mentioned in a comment below).

[Charlie Clark]

Re: Well that ruling has a timespan of about 30 days in the UK

Parliament also has the nuclear button of revoking Article 50.

[codejunky]

Re: Well that ruling has a timespan of about 30 days in the UK

But since parliament cant agree on a positive direction for anything the default is still the legal default of brexit.

[Charlie Clark]

Re: Well that ruling has a timespan of about 30 days in the UK

The Benn act says otherwise.

[codejunky]

Re: Well that ruling has a timespan of about 30 days in the UK

Isnt that the one where remainers are being investigated for collusion with foreign powers?

[Anonymous Coward]

Re: Well that ruling has a timespan of about 30 days in the UK

Have you stopped beating your wife? See anyone can spout some bullshit accusation without evidence. Doesn’t make it true.

[codejunky]

Re: Well that ruling has a timespan of about 30 days in the UK

@AC

"Have you stopped beating your wife? See anyone can spout some bullshit accusation without evidence. Doesn’t make it true."

Oddly this has been a point made constantly by the leave groups as they are attacked over and over with accusations and investigations into perfectly legal activities. Amusing to see the same tactics being used against the attackers.

[Dan 55]

Re: Well that ruling has a timespan of about 30 days in the UK

No, it's the one where they worked out a date with the EU instead of announcing something preposterous to all and sundry then flying over to Brussels only to be told it won't whatever it is won't work because [extremely obvious reason everyone knew for weeks].

[codejunky]

Re: Well that ruling has a timespan of about 30 days in the UK

@Dan 55

"No, it's the one where they worked out a date with the EU"

The deadline was back in march. Then extended to October. So they want to agree another date, is this the one where they put out? At what point do they implement brexit?

"instead of announcing something preposterous to all and sundry then flying over to Brussels only to be told it won't whatever it is won't work"

Yeah I really dont know what his plan is with this. Maybe he is serious maybe its some kind of ploy. Hard to tell with boris, he will do anything for his goal which so far has been gaining power.

[werdsmith]

Re: Well that ruling has a timespan of about 30 days in the UK

If the nation is a democracy with a majority of idiots, then it is an idiot nation.

So be it.

[GrapeBunch]

Re: Well that ruling has a timespan of about 30 days in the UK

"If the nation is a democracy with a majority of idiots, then it is an idiot nation."

That's why the American official News Agency is called Tass.

[stratofish]

Re: Well that ruling has a timespan of about 30 days in the UK

"The Benn act says otherwise."

It really doesn't, it just says we have to ask for an extension if no deal can be decided. If the EU offer an extension, the government still have to then change the law regarding leaving on Oct 31st, which can be stalled and we leave with no deal anyway.

[Richard 12]

Re: Well that ruling has a timespan of about 30 days in the UK

True, but revocation is unlikely to happen until after the next GE

[TheVogon]

Re: Well that ruling has a timespan of about 30 days in the UK

No they haven't. They passed a law saying that the PM must ask for an extension instead of no deal. Which would likely be refused and which Boris will likely just ignore.

The remoaner idiots are just making our renegotiating position weaker. The EU already went from "take it or leave it" to discussing other possible options solely due to the threat of no deal. The mainland European economy is rapidly circling the pan, and the last thing they want is to loose free access to UK markets.

The result of the referendum needs to be implemented ASAP.

[Anonymous Coward]

Re: Well that ruling has a timespan of about 30 days in the UK

What will it take leave supporters to understand. We have no fucking position. We are very much the smaller partner in negotiations.

[Cederic]

Re: Well that ruling has a timespan of about 30 days in the UK

By which measure? Balance of payments, we hold the upper hand. Job losses in the event of 'no deal', we lose 12,000 while the rest of the EU lose around 400,000. Intelligence and security, we spend nearly as much as the rest of the EU put together and have a strategic relationship with the US.

Raw GDP, land mass and number of people, sure, the EU is larger. I think it would be naive to think that this makes them willing to accept the UK leaving without a deal.

[Richard 12]

Re: Well that ruling has a timespan of about 30 days in the UK

No, we do not. At all. Youre either lying or believing a lie.

The EU is risking a maximum of about 5% of exports, the UK is risking 46% of exports (and 54% of imports).

(Ref: Commons Briefing stats in EU/UK trade. Google it.)

Threatening "No Deal" is going to a car dealership, and saying that if they don't sell you the car you'll steal it and torch it.

The dealership has other cars, but you're going to prison.

[Cederic]

Re: Well that ruling has a timespan of about 30 days in the UK

Oh please. "UK exports to the EU were £289 billion" and "UK imports from the EU were £345 billion" (from the very source you cited).

Sounds like a massive trade deficit to me, which means that cessation of trade (which wouldn't happen) would cost the EU £56 billion of exports more than it'll cost the UK.

Which was my point.

I'm not sure of your car analogy point, I'm sorry. Nobody in the UK is threatening to steal and burn one of the EU27.

[Craig 2]

Re: Well that ruling has a timespan of about 30 days in the UK

Sounds like a massive trade deficit to me, which means that cessation of trade (which wouldn't happen) would cost the EU £56 billion of exports more than it'll cost the UK.

I suggest you go and learn the difference between percentages and values.

[Blane Bramble]

Re: Well that ruling has a timespan of about 30 days in the UK

"Threatening "No Deal" is going to a car dealership, and saying that if they don't sell you the car you'll steal it and torch it."

No, threatening "No Deal" is going to a car dealership and saying if you can't agree a price you'll walk away. A relatively strong bargaining position.

Removing "No Deal" from the table is going to a car dealership and telling them you have to leave with a car, no matter what. A very weak bargaining position.

It is clear a lot of people have never tried to negotiate anything in their life.

[A.P. Veening]

Re: Well that ruling has a timespan of about 30 days in the UK

No, threatening "No Deal" is going to a car dealership and saying if you can't agree a price you'll walk away. A relatively strong bargaining position.

That is no problem whatsoever to the dealership, it will sell the same car about an hour later to some other, more reasonable customer. "No Deal" isn't a bargaining position, it is a gambling position without any further back-up.

[GrapeBunch]

Re: Well that ruling has a timespan of about 30 days in the UK

Hey, I have a great title for a song: "There'll Always Be New England". All that's missing is the tune.

Mine's the one with the pond scutum.

[Dan 55]

Re: Well that ruling has a timespan of about 30 days in the UK

It's not that kind of negotiation. The British government has certain red lines (that it's tying itself in knots over). The EU came came up with what was legally possible given those red lines. As much as the UK beats or sets up some last minute game of chicken, it won't get anything different unless it changes those red lines.

Johnson's "take it or leave it" offer is so much like no deal that it might as well be no deal. Whether or not that is the intention, who knows.

[Cavehomme_]

Re: Well that ruling has a timespan of about 30 days in the UK

....a timespan of about 30 days in the UK

Just like most cookies?!

[joeW]

Another sneaky trick

Check out some of the stuff sites are beginning to list under "Necessary" in their Cookie Consent screens.

[Tom 7]

Re: Another sneaky trick

I must confess I've been wondering about writing a cookie eater that just wanders through my cookie tin and basically eats the bits I dont want them to have.

I'm surprised this isn't part of my browser already.

[Jamie Jones]

Re: Another sneaky trick

I do that on my android devices - just a bit of sql that runs periodically.

[Giovani Tapini]

Re: Another sneaky trick

I sometimes eat other people's cookies too :)

[Anonymous Coward]

writing a cookie eater

No need to, just look for self destructing cookies or similar in your extensions option.

(Been using Vanilla Cookie Manager in Vivaldi for years now)

[Dinanziame]

On one hand, yay for privacy!

On the other hand, I'm worried that now, in order to get rid of the annoying popup/splash screen, I'll be forced to first check the box before I can click the button.

[RyokuMas]

Browser dev tools: a couple of quick "inspect element"s, a dash or two of "display: none" and - usually - an "overflow: auto", and boom! it's gone...

[Nick Kew]

The ad blocker makes all that even easier for the lazy among us.

[RyokuMas]

True... but it's useful to know for those sites who run begging-box popups if you use an adblocker...

[Aussie Doc]

Or use a good and quick adblocker

If you use something like uBlock Origin you can simply block any element that may be an issue.

It's so easy to use that some of my 'not so tecchy' customers think it's the best thing since tinned spam.

[Anonymous Coward]

Websites may not present visitors with a pre-checked box

so I should expect this legal ruling to have an effect in real-life as of today. Not. OK, let's say... 5 years down the line?

[Doctor Syntax]

"tGDPR compliance by the digital advertising industry cannot easily be achieved without close cooperation by all involved."

A few court rulings and stiff fines will ensure close cooperation. To quote Chuck Colson "When you have them by the balls their hears and minds will follow".

[Aussie Doc]

I think the odd jail term wouldn't go astray.

You know, just to help keep folks on the straight ad narrow.

[Caver_Dave]

Sliders

What really gets my goat are the sliders (don't know the proper name, but like old fashioned toggle switches).

OK, they often have a red and a green end, but does red really indicate that you don't want the item? (I have seen grey and red, and green and grey!)

And they are usually associated with a negated question, which compounds the issue.

e.g. "Do you want to not disable advertising?" Grey/Green

[Korev]

Re: Sliders

As colour-blind people wouldn't be able to use them arguably they break disability laws.

[Aussie Doc]

Re: Sliders

This colour blind yob uses uBlock Origin with appropriate effect.

[Robert D Bank]

Re: Sliders

Totally agree. Just the way the options are worded sometimes has me scratching my head whether I'm turning something on/off. Very obviously designed that way as it's not difficult to ask a question about a binary 'kin answer. Rips my 'kin tits, and I'll usually just exit the site.

[Alexander Hanff 1]

When will El Reg comply?

So given the clear judgment by the highest court in Europe, can I ask when El Reg will comply with the ruling? Currently your cookie solution isn't even close to compliant...

[IGotOut]

Re: When will El Reg comply?

Oh I don't know, visiting a thousand sites, using broken links and obscure wording, often going round in circles, seems perfectly complaint.

Just remember how long it took the Register to go to https while slagging others off?

[Crisp]

Some people call them Dark UI Patterns

I call it deliberate fraud and dishonesty. Plain and simple.

[codejunky]

Meh

This cookie thing has been great fun so far. Make sites nag with crap options for something most people dont care about. For some sort of privacy? I have an idea, when I go to a website the bugger should just work. I dont want to be nagged and I can leave the site and go elsewhere to someone who doesnt. Unfortunately with GDPR-sucks life has got harder for little benefit as far as I can tell.

[Anonymous Coward]

Re: Meh

Sites have an option. Obey the law and stop violating people’s privacy. You want to show ads? That doesn’t need tracking, just show ads related the the content of the site. The banners are not mandated by GDPR, they don’t even comply with it so how could they be. They are an attempt to circumvent the law.

[The Central Scrutinizer]

My list of "never to be viewed again websites" keeps growing. Any sites that have those boilerplate notices on them go to /dev/null.

[The Nazz]

What have the Germans ever done for us?

Plenty. And more of it please.

[Scroticus Canis]

Re: What have the Germans ever done for us?

On the plus side: some damned good beer, schnapps, Heckler & Koch, a few of great composers, some decent motor cars and resistance to Roman expansion long ago.

On the minus side: Karl Marx, a couple of world wars, sauerkraut, sarin, mustard gas, Rhineland wines and world leaders of industrial pollution until the USA and then China showed how it should be done.

Still ambivalent over their contributions to the UK aristocracy.

[Cederic]

Re: What have the Germans ever done for us?

Without wishing to defend the two World Wars I'd have to add rocketry and the magnificent Panzer V Panther G. Ausf. to the plus side, and indeed, switch sauerkraut from negative to positive.

On the negative side, France.

[Blue Pumpkin]

Re: What have the Germans ever done for us?

Sauerkraut and Rhineland wines are wonderful .. sounds like you just haven’t experienced good ones.

As for aristocracy the choices are limited - Hapsburgs, Bourbons, Glukcksbergs who are all related anyway, so hardly specifically German or a choice.

And then there are Messrs Hilbert, Reinmann, Gödel, Gauss, Krebs and Koch, to name but a few...

[werdsmith]

Re: What have the Germans ever done for us?

The Spitfire wing design is bloody marvellous and German too.

[Norman123]

When are the US citizens going to be protected from cookie monsters?

[Anonymous Coward]

>When are the US citizens going to be protected from cookie monsters?

Speak to your President and good luck with that one.

[James Anderson]

Useless waste of time.

Given that it's almost impossible to have an interactive web site without using cookies.

The whole thing is just a waste of time and effort. Most people just click on the accept button automatically, no one has time to read the "policy" small print, and given that you cannot book a plain ticket, shop online, book a hotel, etc. etc. without using cookies you may as well give up on the internet if you don't like them.

So nothing has changed except forcing people to go through a pointless "accept" dialog, plus, thousands of man-hours eaten up creating said pointless dialog.

[Loyal Commenter]

Re: Useless waste of time.

Given that it's almost impossible to have an interactive web site without using cookies.

There's a world of differnece between a session cookie containing state, and an advertising cookie used for targeting crud at you. The first is perfectly permissible (with no need to ask permission) and teh other requires explicit opt-in consent. The fact that nobody in their right mind would opt in to having targeted adverts chucked at them (in the same way no sane person would opt into having targeted rocks chucked at them) means that advertisers are deliberately trying to find ways to circumvent the rules.

Where possible, I try to prevent any adverts from being served to me at all, for three reasons: it's my bandwidth, I don't want to see them, and I don't trust third party crap being served to my browser to not be as virus-ridden as a crack whore.

[John Brown (no body)]

Re: Useless waste of time.

"advertisers are deliberately trying to find ways to circumvent the rules."

I remember the day I stopped using Tucows.com. It was the day the ad-blocker stopped downloads working because they re-directed all the download links via the ad server. I don't even know if Tucows still exists.

[A.P. Veening]

Re: Useless waste of time.

Given that it's almost impossible to have an interactive web site without using cookies.

Go make some paperclips. That site is interactive and doesn't use any functional cookies (but does use local storage).

[andy 103]

Ill thought out ideas

A login form may use a cookie as said in the article, due to HTTP being stateless.

So we're going to see login forms that have a tick box (unticked) saying "do you actually want to login?"

[A.P. Veening]

Re: Ill thought out ideas

That is a clear example of a technical cookie so it doesn't have that problem. A single cookie about a full opt-out for advertising is also exempt for the same reason.