439

We’ve added a “Necessary cookies only” option to our cookie consent banner across stackoverflow.com, all Stack Exchange sites, stackoverflow.co, stackoverflow.blog, and all other Stack Overflow sites. This new button has been placed to the side of the current “Accept all cookies” button and will reject all but the “Strictly Necessary” cookies. This does not affect users who have already consented. This is only shown to anonymous users and new users who have not consented yet or whose consent has expired. Additionally, as always, users can review and update their cookie preferences by scrolling to the bottom of any webpage and clicking “Cookie Settings.”

We’ve made the choice to name the new button “Necessary cookies only” rather than “Reject all” for clarity that not all cookies are rejected, as the strictly necessary cookies will remain active. We also discussed the color pattern of the buttons and decided to keep the two buttons that will dismiss the window immediately the same color, but “Customize Settings” will remain an alternative color, as it takes you to another screen. You can read more about our usage of cookies in our Cookie Policy.

Here’s what the new banner looks like:
New banner with "Necessary cookies only" button

Old banner:
Old banner without "Necessary cookies only" button

This is part of our continued efforts to provide a better experience for end-users and improve our compliance with privacy legislation worldwide.

Improve this question
46
  • 196
    That's great news! The previous banner had been featured in the press as being deliberately designed to get a user to simply accept all cookies to dismiss the annoying warning - adding another dismiss button to not do so invalidates that logic.
    – Sonic the Anonymous Hedgehog
    Feb 15, 2023 at 20:21
  • 12
    Off the top of my head, I think your only remaining compliance issues are the privacy policy, and the client-side leaking of browser history. This is a very welcome improvement: thank you, and whoever else was involved.
    – wizzwizz4
    Feb 15, 2023 at 21:54
  • 18
    @wizzwizz4 can you clarify what you mean with "client-side leaking of browser history"? Is there a meta post about it that I missed?
    – Cesar M StaffMod
    Feb 15, 2023 at 22:20
  • 20
    @CesarM It's just a catch-all for Google Analytics (illegal in some jurisdictions, allowed in others, last I checked), Gravatar (which I personally trust, but afaik it's not like i.stack.imgur.com where you have a contractual relationship), Google Ads (several posts about this on meta: I'll pick a Mad Scientist one), and the other stuff I've forgotten. There was a "Facebook profile pictures leaks data to Facebook" problem back in the day, but I think that got fixed half a dozen years ago.
    – wizzwizz4
    Feb 16, 2023 at 0:36
  • 8
    @wizzwizz4 Google Analytics has been recategorized as Performance Cookie for almost a year. As far as I know, we have had no programmatic advertisement being served for a while now too, and I don't know of any ads that run fingerprinting.
    – Cesar M StaffMod
    Feb 16, 2023 at 1:25
  • 33
    Why does one button have a verb (accept) while the other does not?
    – Tinfoil Hat
    Feb 16, 2023 at 4:19
  • 14
    @CesarM After that, it was changed back: cookies are less of a problem than sending the data in the first place, especially when dealing with sophisticated actors like Google (with a track record of ignoring the legality of their actions). I just disabled my content blocker and confirmed that Stack Overflow at least still has Google ads, configured in a way that gives Google direct access to browsing history, before the consent popup is answered. Which reminds me: the ajax.googleapis.com jQuery load also leaks a little browsing history.
    – wizzwizz4
    Feb 16, 2023 at 8:35
  • 14
    And just confirmed that the Google ads can still perform additional tracking, by observing one sending a fingerprint to Oracle. I am sympathetic to the use of Google ads, since, you know, money – but there's got to be another way. And even if there's not, that's no reason for the other stuff, like Google Analytics, Google Tag Manager, Google's JS CDN (when you have your own, in-house, one), and the Google equivalent of that "Facebook profile pictures leaks data to Facebook" issue (that I am no longer wholly confident is fixed, now I've confirmed that).
    – wizzwizz4
    Feb 16, 2023 at 8:40
  • 11
    Yeah, the profile pictures thing hasn't been fixed. But that's not the point of this post. The point is: there's one fewer issue, now. Stack Overflow – a pretty popular site for programmers – is now modelling good, (to my eyes) legal, ethical asking-for-consent in its UI, and that's cause for at least a small celebration.
    – wizzwizz4
    Feb 16, 2023 at 8:59
  • 77
    @TinfoilHat Obviously, because "Accept necessary cookies only" was too long to fit. You see, it's critically important to leave plenty of space for the large drawing of the moon in the upper half so users know what the pop-up is about.
    – Cody Gray - on strike
    Feb 16, 2023 at 9:49
  • 6
    It would be interesting to see the analytics of how many users hit "Accept all", "Necessary only", "Customize" or ignore the notification entirely? Can these be published? Pretty please. :)
    – MrWhite
    Feb 16, 2023 at 17:31
  • 20
    @TinfoilHat It reads perfectly fine to me, because by the time you read that you've read the "accept all cookies" one already. It reads as "accept (all cookies | necessary cookies only)" to me. And either way the meaning is perfectly clear, this just feels like pointless grammar nitpicking
    – Radvylf Programs
    Feb 19, 2023 at 20:08
  • 5
    @Ruslan I don't think "most" users have a FHD desktop screen at 166 DPI. Here's how it looks on my FHD desktop screen at the default 96 DPI: screenshot (I'm not suggesting that most will "ignore" the cookie dialog, but some will.)
    – MrWhite
    Feb 20, 2023 at 1:42
  • 9
    The cookies issue should come down to a browser setting - not a prompt one has to click to confirm every time.
    – Mentalist
    Feb 24, 2023 at 19:21
  • 12
    @Mentalist If only there was a thing such as a Do Not Track header...
    – Federico Poloni
    Feb 26, 2023 at 12:21

12 Answers 12

Reset to default
161

As an EU-based user, I would like to know if clicking "Necessary Cookies Only" also disables so-called "Legitimate Interest" cookies.

I do, however, want to say thank you for this change and most especially that you have given equal prominence to the "necessary cookies only" and "accept all" buttons. Several (most) implementations make the "accept all" buttons more prominent, and it's refreshing to see this approach from SE/SO.

Improve this answer
16
  • 57
    The whole "legitimate interest but you can disable them anyway" thing is legally dubious. Stack Overflow's not doing that, which is good.
    – wizzwizz4
    Feb 16, 2023 at 10:33
  • 63
    A "reject all non-necesary\" button with equal prominence is required by law in some countries, so SE here is merely following the law.
    – Federico Poloni
    Feb 17, 2023 at 9:19
  • 21
    @FedericoPoloni it's always good for a corporation to pretend that it's following the law because it cares.
    – user253751
    Feb 17, 2023 at 20:01
  • 38
    @user253751 Companies and organizations are ignoring those laws (and have been from the beginning) so when someone follows the law we should use the opportunity to reward the effort and encourage more from others.
    – StephenG - Help Ukraine
    Feb 17, 2023 at 22:25
  • 1
    It is not possible to turn off 'legitimate interest' reasons for capturing data. The GDPR gives 6 reasons why it is acceptable to capture user data. One of them is 'user consent (opt-in)'. Another is 'legitimate interest', which the regulations define quite clearly. You don't need consent where there is legitimate interest. Any site that has options to disable 'legitimate interest' either doesn't have any understanding of what it means or is trying to loophole their way into collecting your data, somehow.
    – HappyDog
    Feb 26, 2023 at 16:01
  • 1
    @HappyDog um... the fact that you don't need consent for said cookies does not mean that you're not required to provide a way to opt out of such cookies.
    – eis
    Feb 26, 2023 at 20:03
  • 1
    Hmmmm.... you might be right there. EU cookie law and GDPR are different things, and I'm less familiar with the cookie directive, so maybe there is a weird bit of a disconnect there. I mean, you are allowed to capture and process data for legitimate interest reasons without consent. Providing a way to opt-out of something which doesn't require consent doesn't make much logical sense to me. But then, the law doesn't always make logical sense!
    – HappyDog
    Feb 26, 2023 at 22:23
  • @HappyDog if true (not sure) it makes sense to me. I can't send you spam unless you ticked a box saying "yes, please send me spam" but I can send you an email saying "your order was processed" but some jurisdictions might require me to provide a way to disable the "your order was processed" emails too.
    – user253751
    Mar 2, 2023 at 17:27
  • 3
    Just a note that giving equal prominence to those 2 buttons is a legal requirement and several companies were fined in Germany for infringing that (you can't have accept all under one click and only necessary 2-3 clicks away or even super small "only necessary")
    – Tofandel
    Mar 3, 2023 at 10:43
  • @user253751 This is about cookies, not e-mail. Different thing. Legitimate interest includes things like "sending someone a confirmation after placing an order" and you don't need further consent to do that. GDPR covers the rules about collecting and storing data and what you can use it for. My previous comment about 'legitimate interest' in the context of cookies is that it makes no sense to ask whether legitimate interest cookies are needed, because if you have a legitimate interest then it is OK to collect the data. However, as I said, the cookie directive might take a different view.
    – HappyDog
    Mar 4, 2023 at 18:40
  • @HappyDog however the same definitions of consent/opt-in/opt-out should apply to both
    – user253751
    Mar 6, 2023 at 11:30
  • Well, if that's true then my original point stands. You do not need consent, under GDPR, if there is legitimate interest. Therefore any cookie dialog that has options to 'disable legitimate interest' is (a) unnecessary; and (b) actually impossible. However, I am aware cookie legislation is not the same as GDPR and so the definitions may diverge.
    – HappyDog
    Mar 8, 2023 at 21:40
  • @user253751 I believe making an order and providing your email address is generally accepted as consent for sending an "your order was processed" email. What else did you think you were giving your email for?
    – bdsl
    Mar 11, 2023 at 20:09
  • 3
    "thank you for not breaking the law"...
    – njzk2
    Mar 11, 2023 at 22:14
  • @bdsl yes, my point was that if there had been a law saying there had to be a button to turn off those emails, that would've been a quite reasonable law. To my knowledge there is not one.
    – user253751
    Mar 11, 2023 at 23:48
39

I do appreciate the addition of the new button. I think this is a great step forward from a usability and privacy perspective. However, I have some minor nits to pick:

  1. If I click the "Necessary cookies only" button, I am still consenting to you storing cookies on my system, aren't I? Therefore, the existing text (boilerplate legalese) seems weird and incorrect. By using the site, I consent to your privacy policy and TOS no matter which button I click on the cookie consent. A link to the cookie policy is nice, but the text is misleading.

    The minimum required change would be to indicate that clicking either the "Accept all cookies" button or the "Necessary cookies only" button indicates one's agreement that Stack Exchange can store cookies on your device in accordance with the Cookie Policy. (It looks like this copy simply got overlooked when the new button was added.)

    Arguably, though, even the "Customize settings" button ultimately results in agreeing that some cookies will be stored on my device in accordance with the Cookie Policy, so maybe the copy should be even more general. Or, perhaps, the thinking is to leave this explanatory work to the customization page.

  2. Additionally, as an even more minor stylistic nitpick, I would like to see the "Necessary cookies only" button labeled in a way that is consistent with the other buttons. Thus, it should start with a verb. From reading the comments on the question, I see that this is a commonly-held view.

Using an action word or imperative phrase for button labels is widely considered a best practice, so "Necessary cookies only" should be rephrased to use a verb like “accept” or “reject”. (How to phrase button labels?)

Taking these specific points into account, how about modifying the design of the pop-up to be more like the following:

the cookie form with the two 'accept' buttons side-by-side; 'Accept all cookies' and 'Accept only necessary'.

(I've also taken the liberty of changing the title/heading "Your privacy" to "Privacy notice" because I think that is clearer and more accurately reflects the purpose of the notice.)

Or, perhaps, to be a bit more space-economical, a design like the following could be considered:

the cookie form with the two 'accept' buttons stacked vertically; 'Accept all cookies' and 'Accept only necessary cookies'.

Improve this answer
19
  • 3
    @AncientSwordRage I don't think we need to cater to people who don't read the second word of what they're clicking on. It would be pretty much impossible to get informed consent from them. As long as the button locations remain consistent after the first time someone reads it, there shouldn't be an issue.
    – ColleenV
    Feb 17, 2023 at 15:18
  • 28
    I think "Necessary cookies only" looks better.
    – user253751
    Feb 17, 2023 at 20:02
  • 3
    While picking nits - The first mock up with "Accept only necessary" reads clunkily to me and I think "Accept necessary only" would be better. Reasoning: it seems to be "Accept only necessary [cookies]" vs. "Accept all cookies" but the multi-word adjective ('only necessary') feels like too many descriptors on cookies. And "Accept necessary [cookies] only" feels more parallel to "Accept all cookies". At that point we could consider dropping the 'only'! +1 to the smaller height final mockup
    – Dan
    Feb 17, 2023 at 20:09
  • 1
    @Dan in casual prose that keeps close to the rhythms of speech only is often placed where it would be in speech; and in edited and more formal prose only tends to be placed immediately before the word or words it modifies..
    – ColleenV
    Feb 17, 2023 at 20:39
  • 3
    It's not about what looks better, @user253751. That doesn't matter at all. This pop-up is normally only displayed and read once. Therefore, even more than it normally does, function outweighs form. What matters is that the captions are clear, descriptive, and unambiguous.
    – Cody Gray - on strike
    Feb 18, 2023 at 4:59
  • 4
    @CodyGray Which they currently are? How is there any ambiguity in "necessary cookies only", especially if it comes right after another button saying "accept all cookies"
    – Radvylf Programs
    Feb 19, 2023 at 20:09
  • 2
    @RadvylfPrograms Best practices for button labelling in software is to label buttons with what they do and to use action verbs. Parallelism reduces cognitive friction. So “necessary cookies only” is a worse label than “Accept only necessary” just in terms of good ux. “Accept all” and “reject unnecessary” might work as a compromise for the folks that don’t like the repeated verb.
    – ColleenV
    Feb 20, 2023 at 12:44
  • 15
    @ColleenV Best practices are only ever heuristics, no rule's right 100% of the time, and to me this is clearly one of those cases. "Accept only necessary" takes me much more "cognitive friction" to figure out. There's no noun! That's worse! You still need the other button for context!
    – Radvylf Programs
    Feb 20, 2023 at 14:42
  • 1
    @RadvylfPrograms I'm not particularly enamored of that specific phrasing; I just want the button labels to have parallel structures. Faulty parallelism is a huge writing faux pas in English. Regardless, as stated in the post, it's a minor stylistic nitpick. I don't really care what the label is so long as we have the functionality.
    – ColleenV
    Feb 20, 2023 at 15:35
  • 3
    I would go with Accept all cookies and Accept required cookies (It appears that you can't Reject all cookies here?) Also, it is only through your comment on the original question that I now understand the superfluous illustration as a cookie. I guess I've always subconsciously considered it to be a moon.
    – Tinfoil Hat
    Feb 21, 2023 at 4:04
  • 1
    From a compliance perspective, it should be clear when consent is sought and when not. Under European rules, consent is not required for those necessary cookies, thus terms like “consent” or “accept” should be avoided. “Necessary cookies only” isn't a choice, it's supposed to be the default. SE's current phrasing is close to ideal. If I want to criticize this cookie banner, then mostly that it fails to provide the minimum information suggested by regulators. For example, it should mention that consent can be withdrawn at any time.
    – amon
    Feb 21, 2023 at 17:55
  • 1
    @RobGrant If that's what the buttons actually mean, then that would make sense. However, I did not confirm (and cannot easily confirm) that that is what the buttons mean.
    – Cody Gray - on strike
    Feb 22, 2023 at 10:01
  • 15
    "Necessary cookies only" is easier to read and understand quickly. We are primed to expect there to be a single "accept" button and if we're looking to turn down unnecessary cookies the first thing we're looking for a button that doesn't say "accept". Upon seeing two "accept..." buttons, it's extra effort to slow down and compare them, and it tends to make me think momentarily "this site is probably trying to trick me by giving me very similar options". It's not a big slow-down, but the web is getting bad enough already, let's not roll back the small improvments.
    – Weeble
    Feb 22, 2023 at 16:03
  • 4
    @Weeble Agreed - If I saw accept cookies and necessary cookies only I would understand that, and select the second option. If I saw accept cookies and accept necessary cookies (or whatever variants were used, where both began with accept) I would try closing the box (ESC or close button) or, if that were not possible, probably leave the site, as the second option sounds like weasle-words to gain my consent for something I don't want to grant.
    – HappyDog
    Feb 26, 2023 at 16:06
  • 2
    @ColleenV Faulty parallelism is a "huge writing faux pas"... yet you insist on it?
    – user253751
    Mar 2, 2023 at 17:37
31

There is something which has bothered me for a while: the colour of the buttons is not consistent and confusing. While the pop-up has

Enter image description here

where the "customization path" is marked with a silver-grey, the panel has the exact opposite color coding:

Enter image description here

This has made me click "Accept all cookies" a few times since I thought the color coding was consistent. This is misleading and almost like making a "Exit" button green when in the previous menu it was red. In fact, before this update the colours were exactly swapped: "Accept all" was blue on the pop up, but silver when going into "Customize settings" menu, and "Reject all" was silver in the pop up and blue when going into the "Customize settings" menu.

Improve this answer
3
  • 10
    Yes, the highlighting is confusing. I think the colors started as a nudge to push the "accept all" button and then just got convoluted when they added the new button and tried to make the dialog more neutral.
    – ColleenV
    Feb 20, 2023 at 16:11
  • 26
    There simply shouldn't be an "accept all" button on the second page. To quote GDPR Article 7.3.4: “It shall be as easy to withdraw as to give consent.” (You're not the first person to raise this issue.)
    – wizzwizz4
    Feb 20, 2023 at 22:26
  • 4
    @wizzwizz4 That's a good point. It should be confirm or cancel.
    – ColleenV
    Feb 21, 2023 at 14:08
29

Thank you! Finally!

To be honest, I thought this day would never come. You proved me wrong, and this has given me hope for more great things from SE/SO in the future.

Improve this answer
6
  • 5
    Nitpick: use bold for things you want to put emphasis on; don’t abuse the title markup (##).
    – bfontaine
    Feb 17, 2023 at 9:54
  • 51
    this seems like an gratuitous amount of celebrations that SE/SO is following the law
    – user253751
    Feb 17, 2023 at 20:02
  • 5
    ...especially because the enormous 1.5 y delay is a little suspicious. One could wonder whether they did this just to avoid problems with law compliance. But, yes, one should give them the benefit of the doubt and acknowledge the excellent path correction.
    – Quasímodo
    Feb 19, 2023 at 1:25
  • 5
    @user253751 there is no law in the internet, and among hundreds of sites I've seen, SE is the one single site with so many options. All others, all hundreds, have "Accept All Cookies" and that is it. I'm still waiting to see site offering something else. So hammering SE for this is really really, wrong.
    – Shadow Wizard Love Zelda
    Feb 20, 2023 at 12:40
  • 1
    @user253751 I really don't get the corporate cheerleading throughout this post. People seem to forget that SE is a corporation (a Delaware corporation, because of course it is) whose management has no real interest in their users besides how they can monetize them.
    – anahata
    Mar 10, 2023 at 15:55
  • 1
    @anahata it's The Matrix - if we (as a society) stopped brainwashing people into being corporate cheerleaders, profits might decrease...
    – user253751
    Mar 10, 2023 at 15:56
21

This is a great step toward better transparency about the cookies you collect, and I'm glad that it has been implemented. However, as stated in a comment by @wizzwizz4:

There simply shouldn't be an "accept all" button on the second page. To quote GDPR Article 7.3.4: “It shall be as easy to withdraw as to give consent.” (You're not the first person to raise this issue.)

If a user clicks on Customize settings and not Accept all cookies originally, they probably don't want to accept all cookies. Having another button in the Customize settings popup to accept all cookies just seems like a lure for users to accidentally accept all cookies when they don't want to. If they really do want to accept all cookies when they've already clicked on Customize settings, they can turn on all the cookies they want to accept, or click Cancel and then Accept all cookies in the first dialog, but this is unlikely.

I know this was already stated in a comment, but I want to make this a full answer because I feel like this is one of the most important issues with the cookie popup. Additionally, the opposite button colors, as stated previously, seem like they're just set up so users turn off the cookies they don't like and then accidentally turn them on again by pressing Accept all cookies instead of Confirm. The buttons instead should just be Confirm my choices and Cancel.

As stated by @wizzwizz4 (same user who posted the comment) in this answer to We’re adding more user controls for cookie consent,

Yes, this all seems to be in order. I'll just click the pink button aga— Woah, what‽ The pink button, which previously meant “let me choose”, now means “discard my choices”? (Why is that button even there? I already said that I didn't want to do that!) And, worse, I have no way of knowing whether I accidentally clicked this? That's not consent.

It shouldn't be easier to accept all cookies than reject most of them. For users who may be fine with performance cookies, but not targeting cookies, they should be able to turn off targeting cookies and not accidentally turn them on again.

Improve this answer
3
  • 9
    Recently I actually accidentally accepted all cookies on my phone because I misclicked while being in a hurry because of that. I guess it worked as intended, then?.. That button has got to go.
    – Vanity Slug - codidact.com
    Mar 8, 2023 at 12:44
  • That button is relatively reasonable from a UI design point of view. It's normal to have a "select all" option in a UI element that's asking you to enable/disable multiple options. That dialog starts with only the "Strictly Necessary" cookies enabled. There's a button which is "Confirm my choices", which will select only the "Strictly Necessary" cookies when the dialog is first opened. Thus, when that dialog opens, it has buttons which effectively duplicate the "Accept all cookies" and "Necessary cookies only" buttons presented in the initial popup. This is equal treatment for both options.
    – Makyen
    Mar 9, 2023 at 18:49
  • 2
    That general issue aside, it would be better if it was a "select all" button/checkbox/slider and located in a different position (e.g. near the other sliders). It would probably also be better with different colors on the buttons. It would definitely be better if SE positioned the "Confirm my choices" in the bottom right, where most UIs have the "submit" button. However, SE, for some reason, seems to think such buttons should be placed on the left in this and other dialogs (e.g. flagging and closing dialogs).
    – Makyen
    Mar 9, 2023 at 18:53
14

This is a good step. Can I suggest the following:

  • don't ever use unnecessary cookies
  • make the only necessary cookies to do with login
  • show the login cookie info at the point of login, so a generic cookie popup is unnecessary

That to me is the best UX. I want to know if I'm getting cookies, and I don't like them in general, and I don't like popups. I only want cookies for auth purposes, as http-only cookies have some unique advantages over non-cookie options.

Improve this answer
18
  • 6
    But then Stack Overflow wouldn't make money. It's very important to make money, you see. More important than anything else. The best way for a website to make money is by selling its users' private information. Which is why they do that.
    – user253751
    Feb 21, 2023 at 21:42
  • 2
    @user253751 obviously they should make money, or they have to stop. But is this a significant source of revenue for them?
    – Rob Grant
    Feb 22, 2023 at 9:26
  • 4
    This is the only source of revenue for most websites.
    – user253751
    Feb 22, 2023 at 18:18
  • 2
    "Most" websites would appear to be intended for providing information or goods or services to customers, their source of revenue being the money paid for that information or goods or service. Unless you're counting every random page that happens to be internet-accessible as a website, or obfuscating the specific query with a generic answer in order to mislead those reading it, to make a cheap political point..
    – Nij
    Feb 25, 2023 at 8:49
  • 5
    To stop using unnecessary cookies, StackExchange would need to drop behavioural advertising. That's possible and indeed StackExchange was doing it until 2017. meta.stackexchange.com/questions/301524/…
    – Nemo
    Mar 1, 2023 at 14:56
  • @Nemo Economic conditions have changed since 2017.
    – user253751
    Mar 2, 2023 at 20:17
  • 2
    @user253751 In what way?
    – Nemo
    Mar 4, 2023 at 7:25
  • @Nemo a lot of ways? Mainly that interest rates are significantly higher which means money is no longer free for corporations - they have to earn it. This is part of the standard business cycle that typically takes 2-10 years: first, let a million corporations bloom by borrowing endless money with low interest rates, then, all but the best ones are ruthlessly mowed down with a chainsaw when the payments come due.
    – user253751
    Mar 6, 2023 at 11:41
  • 4
    @user253751 I have no idea what that has to do with the problem at hand. Are you assuming that behavioural advertising is more profitable than the alternative, for Stackexchange?
    – Nemo
    Mar 7, 2023 at 16:18
  • 1
    @Nemo yes? For every website. If it wasn't more profitable, nobody would do it.
    – user253751
    Mar 7, 2023 at 16:19
  • 5
    @user253751 That's quite a big assumption to make. Recent investigations of the facts by antitrust authorities show it's far from a safe bet. Websites are using Google's adtech because Google has the power to impose it, not because it's better for anyone other than Google. techdirt.com/2023/01/27/…
    – Nemo
    Mar 7, 2023 at 16:22
  • @Nemo that doesn't make it not more profitable.
    – Rob Grant
    Mar 15, 2023 at 22:32
  • 2
    @RobGrant It may or may not be more profitable for the individual website. That needs to be checked, it cannot be simply assumed. For sure it cannot be more profitable for everyone: given a certain budget for advertising by businesses, if someone gets more someone else will get less. The arms race of ever-more-invasive ads is about the publishers eating each other while the AdTech companies take an ever-larger slice of the pie, it's not about making the pie bigger.
    – Nemo
    Mar 17, 2023 at 7:06
  • @Nemo "It may or may not be more profitable for the individual website." correct. So when you offer something to substantiate that it's not more profitable, and I point out that it doesn't actually do that, I don't see why you're replying with this.
    – Rob Grant
    Apr 27, 2023 at 22:15
  • @RobGrant The burden of proof is the reverse. There is no reason to do the bad thing here, unless proven otherwise. StackExchange has not tried the surveillance-free advertising or a few years now, so it cannot provide a proof that it's less profitable, so it has no reason to use surveillance-based ads.
    – Nemo
    May 4, 2023 at 14:22
8

Will this also fix the issue where I go to an SE site I don't usually visit, answer the popup with "Necessary cookies only", come back a few weeks or months later, and have to answer it again?

I've already given you my answer; you shouldn't keep hounding me with the same question each time I visit.

(The same thing seems to happen with the large dark grey "hey, you're new on this SE site" hero at the top, so I suspect it's just that the cookie lifetime is set way too short for these non-identifying cookies. It should be measured in years, not months or weeks…)

Ideally, of course, I would be able to set my cookie preferences once for the whole of Stack Exchange. I'm hardly likely to want to allow targeting cookies on just meta.stackexchange.com, but not on the others — it would be on all or none. I suspect this would be much easier to implement if all the SE sites were under .stackexchange.com, but imagine the shouting if somebody proposed moving Stack Overflow to stackoverflow.stackexchange.com :)

Improve this answer
5
  • 5
    This is something on your end, SE is aware of this however refuse to fix on their side, so those 1% will just keep getting the popup. (And for some super annoying reason, they marked it as completed despite repeated comments saying nothing was fixed)
    – Shadow Wizard Love Zelda
    Feb 21, 2023 at 15:06
  • 2
    My browser is configured to clean up cookies when last tab is closed. And different website may not share cookies. As the result, whenever I open some random SE site, I would see a large dialog on the screen which makes the website non-usable. And I have to wait a few minutes (Yes, I have a slow network connection, behind the proxy tools, typically) until the JavaScript get downloaded correctly so I can close the dialog. What I can do so far is hide the dialog using ad blocking extension instead of click some random buttons on it.
    – tsh
    Feb 23, 2023 at 15:12
  • @tsh meta.stackexchange.com/tour
    – MT1
    Feb 24, 2023 at 8:31
  • Yeah I have this as well. I use multiple browsers on multiple devices, and every few weeks one of them will pop the popup up again on a site I've definitely visited before on that device-browser-combo. The consent cookie has a validity of a year, but it doesn't hide the popup for that long.
    – CodeCaster
    Mar 9, 2023 at 11:26
  • 1
    It could be saved as an account setting. You can use your account settings to show and hide other elements of the site, so why not manage cookie consent through the user profile?
    – allo
    Mar 16, 2023 at 15:04
7

How does this affect users who never dismissed the cookie popup (but instead either left it there or nuked it with UBO) because it doesn't work without allowing third-party resource loading that already compromises privacy? When I click on "Cookie Settings" I see a pink popup that reads:

We couldn’t save your cookie preferences. Please adjust your browser settings or disable ad blocking. You can access your cookie settings at any time by clicking “Cookie Settings” in the footer.

Is this state (as the law would require) assuming we don't consent to any of the cookies that require obtaining user consent, or is it defaulting to allowing them all?

Improve this answer
3

As noted in a comment above

I seem to be getting the cookie dialog a lot recently even when logged in, in Firefox on IOS. (No repro on my desktop computer, which is a Mac running Brave, i.e. Chrome.) – @tripleee Feb 17 at 6:43

I get prompted several times a day to accept cookies. Recently, just using the back button has made the cookie dialog appear again, just within 2 mins of specifying minimal cookies. (Using Firefox on Widows 10 and Mac). Is this the expected behavior?

(The Windows 10 was installed yesterday and Firefox after that, I haven't installed any extra add blockers or other privacy mgmt tools).

(Sorry to make this an answer, but this won't get any traction if is a comment).

(Hmm, now I see above @JohnY has a similar issue . I will read the whole thread now, sigh)

Another comment : I found this current page (here) from StackOverflow from the righthand side "Featured on Meta" display . I find the The cookie consent dialog keeps popping up to be the more appropriate "Meta Feature" /-;!

Improve this answer
1
  • Hmmm, well seems to have stopped of its own accord. Go figure (-;!
    – shellter
    Mar 26, 2023 at 16:19
3

While I think that this is great news, I have to point something out:

You are only getting back into compliance with the law!

This change should have been done at the latest when the GDPR took effect. How many years has that been already? How long will it take until you implement the next law that is supposed to defend users against data gobbling companies?

Improve this answer
0

The cookie popup always shows me

We couldn’t save your cookie preferences. Please adjust your browser settings or disable ad blocking. You can access your cookie settings at any time by clicking “Cookie Settings” in the footer.

and the next page shows the banner again, because for some reason StackExchange does not store the preference in a cookie on the main domain.

So if it is obviously possible to detect that the preferences cannot be stored, and the GDPR default is that no unneeded cookies can be set without user consent ( which, in this case, cannot be stored), why display the banner at all? Hide the banner and do not set any unnecessary cookies, as you currently do after displaying the error message.

Improve this answer
1
-4

Any plans to respect an HTTP header such as:

GET /questions/386727 HTTP/1.1
IDontCareAboutCookies=AcceptAll

It would really help solve the problem of a popup appearing in the first place.

Improve this answer
3
  • 1
    Does this count as user consent?
    – user253751
    Mar 10, 2023 at 23:56
  • 3
    Or DNT=1 for disallowing cookies.
    – allo
    Mar 16, 2023 at 15:01
  • 1
    This would be the inverse of DNT header in order to never see any popup any more? In fact DNT=0 means "The user prefers to allow tracking on the target site."
    – SandRock
    Mar 16, 2023 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .