<story><title>No cookie consent walls, scrolling isn’t consent, says EU data protection body</title><url>https://techcrunch.com/2020/05/06/no-cookie-consent-walls-and-no-scrolling-isnt-consent-says-eu-data-protection-body/</url></story><parent_chain><item><author>cactus2093</author><text>The EU cookie legislation is still mind blowing to me. In terms of widely used protocols with terrible designs it&amp;#x27;s up there with US payment card processing (want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4 years, and hope they don&amp;#x27;t misuse it).&lt;p&gt;Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn&amp;#x27;t they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they&amp;#x27;ve approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting).</text></item></parent_chain><comment><author>Rexxar</author><text>The law itself is perfectly sane. The problem is that everybody try to apply it in the worst possible way.&lt;p&gt;Let&amp;#x27;s imagine a world where a government force car builder to add speed limiter to cars. The car builders all decides to just cut the engine if you go over the limit. Will you say the law is bad or that car makers are trolling everybody ?&lt;p&gt;It&amp;#x27;s the same for this law. But curiously everybody is prompt to say that the law is bad. The reality is that a majority of internet actors are bad and are just trolling us.</text></comment>
<story><title>No cookie consent walls, scrolling isn’t consent, says EU data protection body</title><url>https://techcrunch.com/2020/05/06/no-cookie-consent-walls-and-no-scrolling-isnt-consent-says-eu-data-protection-body/</url></story><parent_chain><item><author>cactus2093</author><text>The EU cookie legislation is still mind blowing to me. In terms of widely used protocols with terrible designs it&amp;#x27;s up there with US payment card processing (want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4 years, and hope they don&amp;#x27;t misuse it).&lt;p&gt;Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn&amp;#x27;t they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they&amp;#x27;ve approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting).</text></item></parent_chain><comment><author>gsich</author><text>&amp;gt;Did no one involved in the cookie legislation think to run the idea by a technical expert before passing it? Why wouldn&amp;#x27;t they have done something like introduce an X-Allow-Tracking header in the http spec, and make the law require that sites respect that header instead of every site making their own cookie popup. Browsers could make that privacy setting as detailed as they want as far as which requests they included it with, and the EU could strongly recommend that everyone use browsers that they&amp;#x27;ve approved as supporting that setting (or even force it in various ways, like require any OEM browser that ships with a device in the EU support that setting).&lt;p&gt;Like with DNT? Nobody cares about that. Defaults matter too and DNT is default off. So it probably adds more entropy if you enable it.&lt;p&gt;Besides that: Technical cookies (or any other storage in your browser) that are required for your site to work do not require consent. Tracking from ads are obviously not included in that definition.</text></comment>