Europe twists YouTube's arm to get better cookie consent popups
(2022/04/21)
- Reference: 1650568908
- News link: https://www.theregister.co.uk/2022/04/21/google_youtube_europe_cookies/
- Source link:
Alphabet's Google on Thursday said it has rolled out a new cookie consent banner for YouTube visitors in France and will soon deploy the popup for its online properties throughout Europe.
The reformulated cookie consent banner – more of screen-seizing overlay page than a slender banner – follows from discussions between the US goliath and European data protection authorities, particularly France's Commission Nationale de l’Informatique et des Libertés (CNIL), which has been grumbling about cookie compliance for [1]at least the past seven years.
Cookies, or [2]HTTP Cookies , are files used to store key-value data sets in a web user's browser for session management, personalization, and tracking.
[3]
It's the tracking aspect of cookies – particularly third-party cookies placed by entities other than the website being visited – that has made them problematic and has led lawmakers in the EU and elsewhere to regulate their usage. In Europe, the General Data Protection Regulation (GDPR) and the ePrivacy Directive impose [4]consent requirements on websites using cookies.
The web's seven deadly sins: 'Dark patterns' that trick you into buying stuff [5]READ MORE
Efforts to comply with these laws – whether motivated by disingenuous efforts to steer users to accept all cookies or genuine design incompetence – have led to cookie consent popups that annoyed users and spurred the development of technology to avoid the intrusive notices, such as browser extensions that block them.
"Overall, consent notices have become ubiquitous but most provide too few or too many options, leaving people with the impression that their choices are not meaningful and fueling the habit to click any interaction element that causes the notice to go away instead of actively engaging with it and making an informed choice," wrote researchers in [6]a 2019 paper , "(Un)informed Consent: Studying GDPR Consent Notices in the Field."
[7]
[8]
Third-party cookies have become increasingly unwelcome in the web browsers made by Google's more privacy-conscious rivals over the past several years. Google, maker of the widely used Chrome browser, eventually responded by announcing plans to stop supporting third-party cookies next year, as it works to implement successor technology via its aspirationally named Privacy Sandbox project.
But third-party cookies still exist and have to be dealt with, so European data protection authorities expect Google to present visitors to its websites with the ability to choose how they would like their cookies served, or if they want them at all.
[9]
In a [10]blog post , Sammit Adhya, Google product manager for privacy, safety, and security, said the Chocolate Factory has completed both a redesign of its cookie menu and associated infrastructure changes.
Google's new EU cookie consent notice ... Click to enlarge
"Soon, anyone visiting Search and YouTube in Europe while signed out or in Incognito Mode will see a new cookie consent choice," said Adhya. "This update, which began rolling out earlier this month on YouTube, will provide you with equal 'Reject all' and 'Accept all' buttons on the first screen in your preferred language."
While this falls short of the non-compulsory and thus [11]widely ignored [12]"Do Not Track" mechanism implemented in browsers to let web users declare a global preference in advance, Google's inclusion of a "Reject all" button that isn't undermined by a "dark pattern" design counts for something. It shows at least that privacy advocacy
Still, Google has failed to go as far as GitHub, which in late 2020 stopped presenting any cookie notification banner because it [16]abandoned non-essential cookies . That's not to say GitHub gave up collecting first-party data from its users, only that Microsoft's code-hosting biz no longer implements the sort of third-party trackers it would be obligated to disclose. ®
Get our [17]Tech Resources
[1] https://www.theregister.com/2015/07/02/cnil_tells_20_french_websites_stop_tracking_users/
[2] https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2018/08/21/boffins_say_cookie_consent_banners_up_16_postgdpr/
[5] https://www.theregister.com/2019/06/26/marketing_manipulation_dark_patterns/
[6] https://arxiv.org/abs/1909.02638
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://blog.google/around-the-globe/google-europe/new-cookie-choices-in-europe/
[11] https://support.google.com/chrome/answer/2790761
[12] https://www.theregister.com/2015/11/09/fcc_wont_track_do_not_track/
[13] https://www.beuc.eu/publications/beuc-x-2022-013_dark_patters_paper.pdf
[14] https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en
[15] https://www.theregister.com/2021/03/17/dark_patterns_ban/
[16] https://www.theregister.com/2020/12/17/github_will_no_longer_present/
[17] https://whitepapers.theregister.com/
The reformulated cookie consent banner – more of screen-seizing overlay page than a slender banner – follows from discussions between the US goliath and European data protection authorities, particularly France's Commission Nationale de l’Informatique et des Libertés (CNIL), which has been grumbling about cookie compliance for [1]at least the past seven years.
Cookies, or [2]HTTP Cookies , are files used to store key-value data sets in a web user's browser for session management, personalization, and tracking.
[3]
It's the tracking aspect of cookies – particularly third-party cookies placed by entities other than the website being visited – that has made them problematic and has led lawmakers in the EU and elsewhere to regulate their usage. In Europe, the General Data Protection Regulation (GDPR) and the ePrivacy Directive impose [4]consent requirements on websites using cookies.
The web's seven deadly sins: 'Dark patterns' that trick you into buying stuff [5]READ MORE
Efforts to comply with these laws – whether motivated by disingenuous efforts to steer users to accept all cookies or genuine design incompetence – have led to cookie consent popups that annoyed users and spurred the development of technology to avoid the intrusive notices, such as browser extensions that block them.
"Overall, consent notices have become ubiquitous but most provide too few or too many options, leaving people with the impression that their choices are not meaningful and fueling the habit to click any interaction element that causes the notice to go away instead of actively engaging with it and making an informed choice," wrote researchers in [6]a 2019 paper , "(Un)informed Consent: Studying GDPR Consent Notices in the Field."
[7]
[8]
Third-party cookies have become increasingly unwelcome in the web browsers made by Google's more privacy-conscious rivals over the past several years. Google, maker of the widely used Chrome browser, eventually responded by announcing plans to stop supporting third-party cookies next year, as it works to implement successor technology via its aspirationally named Privacy Sandbox project.
But third-party cookies still exist and have to be dealt with, so European data protection authorities expect Google to present visitors to its websites with the ability to choose how they would like their cookies served, or if they want them at all.
[9]
In a [10]blog post , Sammit Adhya, Google product manager for privacy, safety, and security, said the Chocolate Factory has completed both a redesign of its cookie menu and associated infrastructure changes.
Google's new EU cookie consent notice ... Click to enlarge
"Soon, anyone visiting Search and YouTube in Europe while signed out or in Incognito Mode will see a new cookie consent choice," said Adhya. "This update, which began rolling out earlier this month on YouTube, will provide you with equal 'Reject all' and 'Accept all' buttons on the first screen in your preferred language."
While this falls short of the non-compulsory and thus [11]widely ignored [12]"Do Not Track" mechanism implemented in browsers to let web users declare a global preference in advance, Google's inclusion of a "Reject all" button that isn't undermined by a "dark pattern" design counts for something. It shows at least that privacy advocacy
[13]PDF
and [14]regulations banning [15]manipulative interfaces have made an impression.Still, Google has failed to go as far as GitHub, which in late 2020 stopped presenting any cookie notification banner because it [16]abandoned non-essential cookies . That's not to say GitHub gave up collecting first-party data from its users, only that Microsoft's code-hosting biz no longer implements the sort of third-party trackers it would be obligated to disclose. ®
Get our [17]Tech Resources
[1] https://www.theregister.com/2015/07/02/cnil_tells_20_french_websites_stop_tracking_users/
[2] https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2018/08/21/boffins_say_cookie_consent_banners_up_16_postgdpr/
[5] https://www.theregister.com/2019/06/26/marketing_manipulation_dark_patterns/
[6] https://arxiv.org/abs/1909.02638
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YmHUF1@L9ZRfD4p3BrMloAAAARg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://blog.google/around-the-globe/google-europe/new-cookie-choices-in-europe/
[11] https://support.google.com/chrome/answer/2790761
[12] https://www.theregister.com/2015/11/09/fcc_wont_track_do_not_track/
[13] https://www.beuc.eu/publications/beuc-x-2022-013_dark_patters_paper.pdf
[14] https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en
[15] https://www.theregister.com/2021/03/17/dark_patterns_ban/
[16] https://www.theregister.com/2020/12/17/github_will_no_longer_present/
[17] https://whitepapers.theregister.com/
Re: Cookie banners
Alumoi
May I introduce you to my little friend Cookie AutoDelete?
Dark mode Google search page....and that eye straining WHITE consent op-out form. Deliberate?
Anonymous Coward
Google seems to be trying every which way it can to 'nudge' users to opt-in/consent. The latest seems to be to display the search page in black for dark mode users, and for those attempting to opt out, switch to an eye-straining glaringly bright white background showing the consent options.
Regulators need to look at the whole thing in context, can't help feel that Google is using a deliberate eye straining colour switching technique on the opt-out page as the new way to nudge users to consent to Google's terms.
The game of cat and mouse continues.
Re: Dark mode Google search page....and that eye straining WHITE consent op-out form. Deliberate?
heyrick
At least now the "bugger off" option is one tap, not five. So I guess that's progress.
Cookie banners
-> cookie consent banner – more of screen-seizing overlay page than a slender banner
I've seen a few on these on web sites. Probably written by lawyers, who are paid to write and read things, they are just a waste of time for consumers.
What is the solution to cookies? Automatically deleting them every hour unless it's a session cookie would do more than all the banners in the world. Also make deleting them easier. Mandate a 'delete cookies' button on the main tool bar rather than being hidden several settings deep.