Email or username:

Password:

Forgot your password?
Security Writer :verified: :donor:'s posts Post Back to profile
Security Writer :verified: :donor:

Requiring website visitors to disable 500 categories of cookies to use your site without being tracked (where your choices actually work) shouldn’t be any more legal than automatically opting them is. Pass it on.

THEN after selection using dark patterns, weasel wording, and button colouring/positioning to get users to accidentally undo those settings, should also illegal.

If you’re using those plug-ins or went to the effort of making your own do this, I’m just not going to use your site - but my browser doesn’t save cookies anyway.

7 May 2023 at 8:23 | Open on infosec.exchange
3 comments
Security Writer :verified: :donor:

Huge accessibility wall here, too. You’re coercing by fatigue those that can’t quickly make the selections many of us can.

“If you just relinquish your privacy and press accept all, you can use our site 10 minutes quicker”

Why 10 minutes? I watched someone with mobility issues try to use some popular sites only to get caught out on the confirmation dialog and it made me want to put a rag in a bottle and march down to the site’s headquarters myself.

Yes, I’m aware of assistive tech that helps with this, but out of the box accessibility is a thing. Do it.

Pass it on.

Huge accessibility wall here, too. You’re coercing by fatigue those that can’t quickly make the selections many of us can.

“If you just relinquish your privacy and press accept all, you can use our site 10 minutes quicker”

Why 10 minutes? I watched someone with mobility issues try to use some popular sites only to get caught out on the confirmation dialog and it made me want to put a rag in a bottle and march down to the site’s headquarters myself.

7 May 2023 at 8:23 | Open on infosec.exchange
Security Writer :verified: :donor:

Thanks for getting in touch about this yesterday. I thought I’d just quickly follow up.

As many of you have pointed out, some of these things are *technically* illegal in some places. Geographic location differences in those laws aside. What you’ll find is that there’s enough grey area for most people to wiggle out of any sort of legal mess they find themselves in.

Much of the reason that these websites and organisations don’t find themselves in hot water is because they pay for an off the shelf cookie compliance plug-in. Most of these are designed to work to the letter of the law, not the spirit of the law, and these *have* been run past legal teams.

Thanks for getting in touch about this yesterday. I thought I’d just quickly follow up.

As many of you have pointed out, some of these things are *technically* illegal in some places. Geographic location differences in those laws aside. What you’ll find is that there’s enough grey area for most people to wiggle out of any sort of legal mess they find themselves in.

8 May 2023 at 6:47 | Open on infosec.exchange
Security Writer :verified: :donor:

There is a huge chasm between what is being done and what needs to be done to protect the public, and also what is being enforced and what isn’t. Naturally this takes resources, and there are a lot of websites.

There is NO reason we cant cooperate and bring browser based privacy preferences, and have some kind of automated website screening. Absolutely none. But I’m not too sure who to even attempt organising this with.

If you know, by all means reach out.

8 May 2023 at 6:47 | Open on infosec.exchange
Go Up