That reasoning isn't wrong, though it seems ridiculous when looked at with techie-brain. But if there is a standard expectation of what serious company websites are like, it makes business sense to look like that too. It's like dressing up appropriately to cultural expectations. You can deviate somewhat but you have to strategically spend your weirdness points.

You could have a 'no cookies' badge that links to your cookie policy - 'we use no tracking cookies and so are compliant with EU law ... then list any cookies/local-storage used and explain what they're for.

No one is tanking UX to stick it to the EU. It would be better for them to simply not piss off their users. They are covering their ass.

The obvious conclusion is that when you try to regulate something like this you arent going to get the behavior you want.

Many years ago, I used to make informational websites for small, local businesses and they all wanted the cookie banner "just to be safe", even after explaining they didn't need it.

In my experience, most people come in two camps: 1) they just click to make it go away because they click everything and would agree to sell their own mother to organ scrappers just to get past the annoyance, and 2) they understand what it's asking and are immediately suspicious.

I built an ecommerce site long ago, and even though the UI was fairly modern for the time, they insisted we use antiquated styling on the billing forms of the checkout page to help exude trust. As a developer it bugged me because I knew it was just styling, but they probably weren't wrong.

I have had the same discussion multiple times at multiple companies. Luckily most of them were fine with dismissing the popup with a timer.

> and he said "yeah, but it makes the site seem less legitimate.

He may be right, sadly. I’ve seen the lack of a cookie banner used to suggest that a site was doing something shady or not complying with the law.

Most people don’t have knowledge about the finer details of cookie laws. They’ve been trained to believe that legitimate sites who comply with the laws will implement the cookie banner, and not seeing it feels suspiciously unprofessional.

I'd say just remove it. Don't ask people who don't actually understand the cost of having it there because you will get the wrong answers. Sometimes people just have to do the right thing, take some heat and then everyone can move on. If it has severe consequences then that's probably a good reason to leave anyway.

Back in the day, this is how we introduced AWS at a large company. We just did it. And once done, they couldn't deny that it cost a fraction of what we were paying our supplier and that things took minutes to set up rather than weeks. And that they worked a lot better.

Yes, there was shouting in meeting rooms. And yes, people said "you can't do this". Turns out they were wrong. A few years later I mentioned this to Werner Vogels. During a meeting. Where my CEO and CTO were present. And where everyone was feeling very good about us being one of AWS' biggest customers in our region.

So when someone says "you can't do that", sometimes you should make them prove it.

(At the time AWS was a good idea. Today dependence on a US service provider is a harder sell in Europe. The _first_ question you get today is if we can host it ourselves if we need to or if we can use a local service provider.)

Reminds me of the early days of the CANSPAM act.

One of the best indicators that something was not spam was the unsubscribe button.

> but it makes the site seem less legitimate

I have yet to head that cookie prompts are a sign of legitimacy. What business has customers that would think that way?

>it's an example of malicious compliance

So how would you do ePrivacy Directive compliance/risk avoidance in a non-obnoxious way?

Good point. The page should have 200MB of assets so that it loads slowly, making it look like there's serious engineering going on.

CFO should be fired immediately.

Not web devs per se, I’d be hard pressed to find a serious web dev who wanted to “forcefully sodomize users”. Thats a management thing

Actually the purpose was not to invade our privacy as much, which we do and there is active lobbying (for example by Google) against any better solution: https://noyb.eu/en/eu-member-states-and-google-suddenly-want...

Classic over-regulation producing unintended side effects

Nah fuck the companies and their horse shit.

99% percent of them intentionally turn the "decline" choice into a 5 - 10 step game of dark patterns even though the EU policy says it should be equally easy to decline. They know its bullshit but they also know the chance that someone will drag them through court is low.

I’ve long believed that making companies liable for paying damages if PII is leaked in a data breach would be the best way to stop excessive tracking. If you force them to have to manage user data like they’re handling radioactive waste then the expense and overhead involved is a natural drag on the business logic that drives the bottomless appetite for data collection. They’ll collect it if they actually need it, and they’ll take great pains to secure it.

1. It's also a piece of cake to just not display the cookie banner for non-EU IPs

2. If you are a purely US entity with no actual business presence in the EU, you only need to comply with US laws and nothing else. If the EU doesn't like a purely-foreign website, it's on them to set up a national firewall and block it.

Case in point 1: It's not on you to comply with China's laws, it's on them to block it if they want to

Case in point 2: China's local businesses with no EU presence do not follow GDPR and do not display cookie banners even if accessed from the EU

Do not track has been used by ad companies to track users, it’s one of the datapoints that can be used to identify your fingerprint

Policy should never assume good faith actors. There wouldn't need to be policy if an assumption of good faith was a valid substrate for the policy. The policy is bad because its authors built it in a vacuum, without any thought or care put towards how its compliance would actually instatiate. This is a consistent problem with EU regulators. The 'tax' the policy levies on invasive cookie use (which I agree is broken and horrific) is forwarded to the user, via this terrible, omnipresent popup. The policy has made the problem worse, by further densensitizing humanity at large to this terrible practice. Shameful behavior by EU regulators and they should absolutely be pilloried for the present state.

> Policy making assumed good faith actors

Let's not paint the policymakers naïve when they're in fact incompetent.

The biggest positive outcome of the whole GDPR affair is that people finally believe me when I say that yes, they are selling your data to thousands of 3rd parties, and no, I'm not making these numbers up or exagerrating at all.

I’m certain it’s often just the California “literally everything is known to cause cancer” problem.

It’s simplest just to put the bullshit everywhere and the dipshit bureaucrats will leave everyone alone.

I have always seen the cookie banner as a sort of punishment to the public for daring to have demanded better treatment.

“Oh you want consent involved in this interaction? Then we’ll annoy you about it constantly instead of respecting the intent of the regulation.”

"Every time you visit the websites managed by the European Commission, you will be prompted to accept or refuse cookies." https://european-union.europa.eu/cookies_en

>The only mistake EU policymakers made was underestimating how willing companies were to deface their websites.

Yes and that is a MASSIVE mistake for a policymaker to commit. They should absolutely be pilloried for their incredible lack of foresight and understanding of how internet companies handle compliance. The policy has set back humanity by further desensitizing internet users around the world to the terrible, endemic use of cookies by most websites.

That shows the same fundamental misunderstanding of the modern web that led to the ignorance of EU regulations.

The policy is both, good, but also flawed. For example, you cannot persist settings, because one policy says that website settings should be ephemeral unless user agrees to persist them.

It is not an EU law. Nowhere in GDPR are cookie banners mandated.

Actually big tech is to blame: https://killthecookiebanner.eu/