4mo ago

Administrative court: Cookie banner must contain "Reject all" button

www.heise.de

The "Accept all" button is often the standard for cookie banners. An administrative court has ruled that the opposite offer is also necessary.

Lower Saxony's data protection officer Denis Lehmkemper can report a legal victory in his long-standing battle against manipulatively designed cookie banners. The Hanover Administrative Court has confirmed his legal opinion in a judgment of March 19 that has only just been made public: Accordingly, website operators must offer a clearly visible "reject all" button on the first level of the corresponding banner for cookie consent requests if there is also the frequently found "accept all" option. Accordingly, cookie banners must not be specifically designed to encourage users to click on consent and must not prevent them from rejecting the controversial browser files.

Europe @lemmy.dbzer0.com

Blaze @feddit.nl

4mo ago

Administrative court: Cookie banner must contain "Reject all" button

www.heise.de /en/news/Administrative-court-Cookie-banner-must-contain-Reject-all-button-10390520.html

67 comments

We and our 908 partners store and access personal data, like browsing data or unique identifiers, on your device.
Absolutely, we need a Reject All button!
- And it should include this mysterious 'legitimate interest', or whatever it is called - always on by default in 'my choices', even though no one seems to be able to explain what this means. How can I make an informed consent on something that vague?
  On the other hand, not 'Reject All', but 'Reject All except functionally necessary' (which should be precisely regulated by the law), otherwise there will be no cookie to remember our 'reject all' choice, which I am sure the corpos would happily use do discourage us from clicking that.
  
  That shit makes me so mad. What the fuck is legitimate interest if not the cookies which are set anyway to make the site function It’s just purposefully misleading.
  
  I'm sure "functionally necessary" already means we share your data with everyone because we setup a system where the local page state is managed by third parties that we are selling your data to.
  
  Rejecting cookies without asking every time requires a cookie and that is clearly legitimate interest. The problem with legitimate interest is that it's not well defined enough and then you have companies claiming that Adsense personalization is an absolute necessity for their website.
  
  the "functionally necessary" cookies, which are served by the site itself (e.g. not a third party), do not require a banner at all. if you have no third party cookies, you can do entirely without it.
- I have also seen on some websites that you have to pay them through subscription if you want to reject all cookies
  
  Pretty sure that's illegal AF. Report them?
- Literally saw one with 1300+ the other day, thought I was going insane 😳
- Have to individually reject each and every fucking “partner.”
- The irony made me exhale a burst of air from my nose before closing the page, never to return.
  Basically every cookie acceptance agreement popup is just a 404 to me. No webpage has important enough information anymore for me to sign any kind of agreement. It's absurd. If you passed by a shop and wanted to go in and purchase something, but a clerk stopped you at the door and made you sign a fucking agreement that store would die in a month.
  
  After reading one of these pop-ups the first time I saw one, a switch was activated in my brain. Now when I see one, I hit the back button on my mouse before the last scan line of the page has reached the end.
  I don't need the information that bad.
Heh
- Heise Group, you greedy cocks.
  Here's a version of that article that doesn't deliberately ~~break~~ skirt as far as legally possible EU privacy law: https://archive.ph/ZTt3K
  
  Heise is not breaking EU law with this. The law states that there must be an option to reject all cookies, whether it's a paid option or not is up to the site.
The kind of stupid shit societies have to invest money in. Don't get me wrong, it's good news, it's just baffling that money had to be invested in order to get these bastards to do the civil thing.
- 'its baffling in a capitalist society, corporations do everything they can to squeeze the most money out of their users with zero regard for the users wants or needs, and do whatever they can to skirt legal obligations that protect consumer privacy and security'
  Yeah. I'm baffled.
Fuck you pieces of shit.
Go track this:
- I usually just do this:
A disgusting behavior that I've seen in Spain is for websites to direct you to their subscription page if you say you don't want to be tracked, either you pay for the content or you don't get any content. Apparently the Spanish courts have deemed this legal.
- If you use uBlock Origin, add the following rule:
  
  * privacy-center.org * block
  This kills 99 % of the "accept or pay" modals, an you can still access the page normally.
Also, require its html tag to have an attribute "data-legal-reject" or something like that so we can have browsers auto reject all that shit - while keeping necessary ones.
Better yet, attach this at the protocol level. "X-Cookie-Policy: ImportantOnly" or something like that.
- Yeah, there’s no reason why this should be anywhere except the browser level.
Cookie banners need to piss off forever. You may set some functional cookies only if I log in.
- what about color scheme cookies?
  
  You may set some functional cookies only if I log in.
  
  https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
  
  No one cares about that
I recently started to use "I still don't care about cookies". So far so good.
- The issue about that extension is this:
  When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do).
  It will often just accept the cookies as is.
- This and Consent-o-matic
FINALLY! I was wondering how long it'd take for people to act upon the fact that Permission prompts have become THE biggest digital grift. The answer: way too fucking long!
You wonder, why do they not just make it illegal to use cookies at all (other than for legitimate purposes like loggin in).
Who actually wants to accept?
- As much as i would love to see that, youll be burning down a multi-billion, if not trillion, worth market.
  Also, idk if i want the alternative of cookie tracking to be used as much as cookie tracking. Scary stuff
  
  youll be burning down a multi-billion, if not trillion, worth market.
  Oh no
  Also, idk if i want the alternative of cookie tracking to be used as much as cookie tracking. Scary stuff
  Here's an idea, you outlaw that also
  We have been in the wild west of the internet the last 20 years or so, and you wonder when we're finally going to actively police it
As usual, this should have been the responsibility of browsers, not individual websites.
Another layer of annoying on a massively stupid piece of legislation that has made the internet immeasurably worse for everyone.
These preferences should be settable in the browser, transferred during http* connection and honoured by every single website you use.
Any changes that marketeers come up with should be ratified in the same way that changes to internet protocols are, and if the browser doesn't support them yet, they are assumed "do not".
- Ah yes, stupid legislation ruined cars, now I my entire trip is ruined since I have to buckle up my seatbelt at the beginning of a trip.
Just a bunch of idiots that have no idea how shit works.
If they can reject all, but can't stay logged in after trying to navigate the site, who's fault is that?
but I can already here, but you can work around that
Guess what? The workaround is tracking. we're just re-inventing cookies.
While we're at it, can we also talk about things that look like chat notifications, but exist only to draw your attention? Those are misleading as fuck and IMO should be ruled out as well.
Next up: No more
<Allow all button>
allowed" followed by "No banners allowed, setting cookies is only even possible after user account creation"... please?
meanwhile meta stealing terrabytes of copyrighted literature to train their AI on, meanwhile "step in the right direction" video game megacorporations yoinking your product license you bought because its not profitible, meanwhile nintendo shutting down emulators without any base other than having money over passionated indie emulation devs, meanwhile google using google fonts on desktop on literally every website or apps on your phone to bypass this sht anyway.
way too little way too late, these people see these cute upcoming fines as very profitable and non harmful business expenses.
- The law was not in fact written by a moron. Necessary cookies (strictly defined btw) include login credentials.
  
  Just curious what falls into the Necessary category. Would game saves count? Like wordle and such.

67 comments