But it's in their "legitimate interest"

Yea - where did that ridiculous “legitimate interest” shite come from? Is it an attempt to make you feel bad for clicking “bugger off”?

I personally tend to allow site to store information, select functional and reject anything else (Unless forced to click more than a few, anything with legitimate interest options gets the reject all button clicked then the site closed).

I am wasting years of my life with this crap

Browser makers really need to offer an option "save cookies for this site, but scrap them when the tab is closed" along with a list of the cookies with any potentially useful ones (e.g. login token, basket contents) being filtered to the top of the list to be manually excluded.

Firefox lets you delete all cookies when the browser closes. That suits me, not least because I tend to leave tabs open.

Bob on. EVERY DAY. Delete all your cookies EVERY DAY.

It's not a magic fix but it makes it harder for them.

Every day. All of them.

Cookie AutoDelete. Available for FF and Chrom*. Nuff said.

Honestly, I bet that they feel allowed to reinstate those cookies as soon as you connect again if you've not explicitly rejected them. They're good at browser fingerprinting, and in addition to home IP addresses being very static nowadays, it's easy enough for them.

Apart from the last part about manual exclusion you just described private browsing mode.

You want "save cookies for this site, but scrap them when the tab is closed". Install [1]cookie autodelete which does just that.

[1] https://addons.mozilla.org/en-GB/firefox/addon/cookie-autodelete/

I see quite afew sites that don't have a reject all button, have a few basic on off buttons and then hidden away in the 'our partners' section, dozens of legitimate interest buttons.

I just reject the entire site as it is obvious they have less interest in doing business with me than taking and selling/sharing my data.

These sites have a standard format that somebodyhas sold them, so now the moment that box appears, I go elsewhere.

I am wasting years of my life with this crap

Countless years of human effort are lost to this crap. I accept all cookies. My only browser extension is "I don't care about cookies" which at least stops some of the crap. As I've said before I wish there was a browser setting I could set to take me back to those happy and productive days when I didn't need to choose cookies to accept or agree to privacy policies before being able to do anything productive.

I also use the "I Don't Care About Cookies" add-on to ignore/auto accept cookie requests, but I use it in conjunction with the "Cookie AutoDelete" one. So, while I may accept all cookies, they are purged after I quit the site. Maybe they still keep some identifying data on their side or some persistent stuff on mine, but, with the help of NoScript and uBlock Origin I feel I have my back pretty well covered. Am I missing something?

"People trust us to respect their right to privacy and keep them safe...."

They what?!

I rather think that most people either A) don't realise how much G invades their privacy or B) regard them as a necessary evil to get stuff done on the great wide interwibble.

Or C) Avoid them like a syphalitic sex toy...

D) Regard them as evil.

Yes I do use Google search. Yes I do have an Android phone. That is as far as I'm willing to go.

I still don't consider Google a 'necessary' evil, just evil.

But not as evil as Zuck. I will not use his companies' products ever.

hrhr Iron. Search and Android. That's like 90% of your digital intent, fingerprint and private details.

A Google spokesperson lied would be both more accurate and save copious data transfers.

When countries start issuing the multi-billion fines that Facebook deserve for their advertising practices, then we'll talk. There is no rule that they won't break, no invasion of privacy they won't make, if someone has paid them to force an advert on you. They'll show you adverts for things that are forbidden by their own rules - and in some cases, international law - from companies that you have blocked. They'll even cancel your decision to block a company, literally unflagging a setting and acting like you never set it.

I don't think fines are the right solution. Mainly because they can just become cost of sales and probably expensed.

A simpler solution should be to just adopt the same tech utilised to monitor other home invaders. So fit all C-level execs involved in privacy invasion with ankle tags. Then for every type of data slurped, publish that under each execs corporate bio page. Add say, 10yrs in jail for any attempt to avoid publication of their 'private' information.

It may just be a way to administer a clue-bat, although may require building a few more prisons.

Then how do you pay for the sites?

Obviously all TV should have a menu where I have to select seeing adverts, and it's only fair that the default must be no ads, but there must also be no licence fee.

Rofl

Why don't they just ask nicely* instead of imposing ludicrous, unlawful fake penalties that will never be paid and are completely unenforceable?

[*If the ICO asks nicely, you still have to comply.]

Oh yes, because it's just political grandstanding.

I agree that wrist-slaps are deserved by companies who make it too hard to opt out, but this is silly.

"...ludicrous, unlawful fake penalties..."

Unlawful? Who says?

It's the French imposing this fine for activities conducted on French soil so unless the US and France have a secret treaty which says that US companies only answer to US law when ever they conduct business in France then the fines are lawful.

As for ludicrous, well if Google wants to play on French turf then they must accept French rules, and if they don't they either pay up or leave.

I have no idea if you are a US citizen but a world exists outside the US with their own laws and sovereignty.

Oh, you can be sure that Google and Facebook are paying these fines. It's not much for them, and that is fine, considering the issue is not so important. But they are paying.

We French have a saying: «nul n'est censé ignorer la loi».

That particularly applies to company who literally spend millions paying lawyers.

The CNIL even conveniently published a how-to describing the rules, with pictures, that many websites with much less income than Google managed to understand :

https://www.cnil.fr/fr/cookies-et-traceurs-comment-mettre-mon-site-web-en-conformite

So arguing that Google is still too new at the World Wide Web thingy, had no idea they could search the internet to find that information and needed somebody to come hold their hand to guide them, that's unlikely to work.

Can I piont out that is takes two clicks here to reject, but one to accept as well.

The flow here is much, much better though: the reject click locations are not intentionally spaced to make it more difficult. Unlike Google, which somehow is not able to display 3 buttons on a single screen, and forces to scroll down to reach them all.

There are quite a number of sites with a boilerplate list of dozens of trackers and scum, with an easy to use button to disallow cookies except the many marked as "Legitimate interest" that need to be selected one by one by one.

It's horseshit anyway as this boilerplate rubbish always lists the same sites over and over. Forget one, and I'm pretty sure they'll accept that as given consent over and above the many times you've said get lost.

But, yes. Accept all needs a corresponding Reject all.

All websites (including this one) should have a one-click policy to allow or reject cookies. Period.

Anything else is a weaselish tactic to try to get personal data from users.

This site is one of the rare ones that, when you ask to check which cookies are enabled, only list essential cookies as on - the rest are unchecked.

So El Reg is a step above many others in this regard.

Editor should be half spanked then ^^

Bring back the..... Moderatrix!

My experience is that a large number of German and Scandinavian sites have either a “reject all” or “only necessary “ button. UK and Iberian sites you often have to switch off by category, and with US sites you consider if it really is that interesting.

Similarly, I often find settings mostly off in the first group and everything on in the latter.

CookieAutoDelete is my friend.

I wonder if it would be technically possible for a browser extension similar to Ublock origin to be developed that can automatically reject none essential cookies for you, rather than have to manually wade through loads of options?

Necessary cookies (logged in etc) - you don't need to tell anyone but can if you want.

All others: opt in.

Not an opt out, no matter how few clicks implment it.

Brilliant idea, mate!

I can't wait for page after page of opt-in before being allowed to even glance at the site.

I would say that 90% of the cookie opt-in procedures make it much easier to opt-in than opt out. There should be three options on the dialog:

1. Opt-out - (May provide a warning that things might not work properly)

2. Opt-in Fully (Should indicate what you are getting yourself into)

3. Opt-in to cookies used for distinct reasons - this should provide a method of selecting cookies used for website operation, marketing cookies, performance measurement cookies, ...

Anything other than this is an attempt to get consent for marketing cookies.

that only FB and Google are fined.

Because, every single french newspaper site is exactly like FB and Google, as far as cookies go. Plus thousands of other french sites, of course.

But probably it's better seen, politically, to fine FB and Google, rather than Le Parision, Media Part, Le Monde etc ...

That's the danger of using fines as an alternative to tax for multi-nationals. It becomes very political which companies get asked for money, and the reprisal sanctions tend to hit a lot of bystanders

A site has to store the fact that you've said 'no' to cookies, which it does by ... storing a cookie.

Sites should have a standard query string which specifies the user's choice without using cookie storage. This would avoid those of us who delete cookies on browser exit having to go through the preference rigmarole _every single time_.

Bloody good on ‘em for actually doing something about this glaringly abusive behaviour.

Why it has taken so long (when did the cookie law come in???) is anyone’s guess but still a good move

Let them eat cake.