12

Sometime over the last month, the cookie consent on the SE network now defaults to having all cookies enabled when you press the "Customize settings" cookie popup, forcing users to opt-out instead of opt-in:

Cookie setting popup on meta.stackexchange.com, showing all cookie options default-enabled

While this new forced opt-out behavior may be desired, as recent as two months ago, every cookie except the strictly necessary cookies were explicitly opt-in.

SE's behavior is inconsistent with ever other site presenting cookie consent forms I have recently come across. The most recent I encountered was Bricklink which when you press customize, brings up a similar menu with opt-in options for all cookies, mimicking the old behavior.

Cookie behavior starting from a clean browser state

SE's change to opt-out behavior when you press "Customize settings" makes dismissing the form slightly more difficult, especially if you have configured your browser to clear cookies on launch and want to disable all non-necessary cookies but most do so several times a day. Additionally, as mentioned in other answers to the above linked question, the consent form remains obtrusive, especially on mobile and small format screens.

Does this UI change have functional significance? Starting from a clean browser state, loading onto the site sets the prov cookie. Either accepting all cookies or opting out of cookies leads to the creation of OptanonAlertBoxClosed and OptanonConsent which appear to be identical, besides timestamp changes, between the two cases.

Possible privacy implications

If this UI change implies that all four of these types of cookies are active until opt-out occurs, then there are different privacy implications than the original UI, which suggests that only the strictly necessary cookies are in use until you dismiss the consent dialog with additional cookies opt-in'd to. From the cookies I can access, it is inconclusive if the UI change belies a implementation change.

10
  • @Draft85 good point; I was under the impression from this UI that this means that these cookies are set until you go to customize and opt-out of them, because they are already enabled. However, I'm digging around in developer tools, and it seems like cookies are not set until you dismiss the dialog, regardless of what you set. The bug would have been cookies being set until opt-out occurred. I will update if necessary.
    – meson800
    Apr 14, 2021 at 2:21
  • I was unable to figure out just with the cookies set after both consent page options if this UI change shows an implementation change. If this UI change has no underlying implementation change (e.g. despite the appearance of the dialog when you press cusstomize, SE only uses strictly necessary cookies until you dismiss the dialog), then this is not a bug.
    – meson800
    Apr 14, 2021 at 2:32
  • 2
    Damned if I know. Seems like an unannounced policy change, or a bug. I certainly would like clarification either way. As much as I hate to join discussions of company politics, it would be best for all the membership to know what's going on. Creeping towards a breach in EU regs.
    – W.O.
    Apr 14, 2021 at 2:55
  • 3
    FYI, we have been discussing this behavior on SO for a while (see the comment thread). It seems like for some reason some users get the checkboxes prechecked, while they must be unchecked (GDPR requires it, and even if you are not from a EU country, the config of affected users still says all groups but one [strictly necessary] should be switched off). Apr 14, 2021 at 2:56
  • 5
    The whole cookie thing is one huge mess. Apr 14, 2021 at 6:27
  • It's a bug because: if I don't select "accept all" and choose "manage my cookies" it's a good guess that I do not want all cookies enabled. Also there's already a second "accept all" in the customization window. To the polite/right thing and default to "only necessary" cookies enabled like a majority of other sites.
    – Zim
    Apr 21, 2021 at 19:33
  • @ARogueAnt. - here's the thing, it is very likely to literally be a bug as affected users confirm that the configuration object sent by the third-party API used for cookie settings states that all the cookies except necessary should be switched off by default. Apr 21, 2021 at 19:44
  • @OlegValter Oh, I had no idea it was a third party issue, bug then.
    – W.O.
    Apr 21, 2021 at 21:04
  • @ARogueAnt. - yeah, last time I checked, upon clicking "Customize settings", a thrid-party script was loaded (which lead to a mess with a lot of people who care about privacy or cannot circumvent restrictions not being able to open the settings) and then proceed to save 2 cookies via document.cookie (which most likely lead to a lot of folks on macOS/iOS to have the preferences expire in a day or a week). The whole cookie banner is, frankly, a huge mess and could be avoided if SE chose to spend dev time to DYI the whole thing. Apr 21, 2021 at 21:15
  • How hard is it to add a damn button that says "use only necessary"? Huh? Does SO take us for idiots? It's a shame. SO keeps taking multiple steps back each time. And those users here supporting "huh ackthcually you need nessary cookies" ok cool, hear me out. Add a button "Use only necessary" Oct 28, 2022 at 5:22

0

You must log in to answer this question.

Browse other questions tagged .