74

In the recent Data Brokers episode of Last Week Tonight, John Oliver showed this picture: (jump to relevant part around 18:57)

Oliver with cookie dialog. Two options: accept all cookies, customize settings

which is of the Stack Exchange cookie screen. He said this:

Privacy should be the default setting here and there should be legal fixes to this. Other countries have actually tried; the EU passed a law to force sites to disclose cookies, and allow you to opt out, but I will say companies now often cleverly present those options in the most annoying way possible. With accept all cookies an easy default, but if you want to reject them, forcing you to go through multiple confusing steps for no clear reason.

I included the current screens below, which seem to match his picture and words pretty close. I am posting this as I think it's important to know how Stack Exchange is being portrayed in public; it doesn't seem to be in a good light. I think this could be easily resolved, if Stack Exchange just changed the buttons to:

  • Strictly necessary cookies only
  • Customize settings

easy default

cookie settings: strictly necessary is locked on, other three are toggled off

14
  • 56
    And the SE dialog is rather tame compared to some out there like the ones with artifical delays when you select "customize cookies". Though the dialog hardly matters when SE misclassifies Google Analytics as "Strictly Necessary". Apr 11 at 15:46
  • 13
    A few related discussions: meta.stackexchange.com/q/359358/273494, meta.stackexchange.com/q/362697/273494, meta.stackexchange.com/q/367370/273494 It should not be surprising to SE that their implementation of the cookie consent dialog is negatively perceived. Even if they think the feedback they received on Meta about it was not representative of their larger audience, the dialog is obviously designed to strong-arm people into consenting.
    – ColleenV
    Apr 11 at 16:18
  • 2
    They're the poster child of many things wrong with the internet atm :') Obligatory reminder to submit a complaint with your local GDPR regulator Apr 11 at 17:05
  • 2
    youtu.be/wqn3gR1WTcA?t=1159 is around where it is. That said, he started with SE's "accept all cookies/customise" then switched over to another site which is inexplicably bilingual?
    – Journeyman Geek Mod
    Apr 11 at 17:38
  • 3
    Also a bunch of folks found the actual post Link to cookie policy doesn't work in "Accept all cookies" popup that was blurred out, and figured out its a fairly obvious google hit searching for cookie popup - so its not really specific to SE
    – Journeyman Geek Mod
    Apr 11 at 18:44
  • 21
    Has anyone mentioned the Google Analytics cookie on SE yet? Why is the Google Analytics cookie defined as "strictly necessary" and saved without consent? It has been bountied for a while now. They're working on it, but it's taking a lot longer than the 6-8 weeks we've come to expect. An official "we're working on it and taking roughly this or that approach" would be a good start.
    – Mast
    Apr 11 at 19:37
  • 5
    Somewhat ironically, you made it so that those who want to see the original images you posted have to perform two steps (right click --> open in new tab) instead of one (sounds familiar?) by removing the default link to original image offered by the image uploader, and using some very weird markdown instead, really no idea why. :( Apr 12 at 6:41
  • 8
    A typical website visit in 2022
    – VLAZ
    Apr 12 at 12:28
  • 4
    Also related: Stop tracking users without their consent
    – PM 2Ring
    Apr 12 at 12:42
  • 1
    The default happens to be privacy when JavaScript is blocked from domain cookielaw.org. Though not exactly optimal or intuitive. Apr 12 at 15:27
  • 6
    @This_is_NOT_a_forum Interestingly, the cookie dialog from cookielaw.org is way better than Stack Exchange's... i.stack.imgur.com/r49vX.png
    – ColleenV
    Apr 12 at 15:33
  • 2
    @VLAZ Step 6 is closing the "Please don't go" popup that appears when you weren't even going to leave but it thought you were because you moved your mouse to the edge of the screen or you took too long to click something.
    – BSMP
    Apr 12 at 18:44
  • 2
    "I think it's important to know how Stack Exchange is being portrayed in public; it doesn't seem to be in a good light." Stack Exchange hasn't been portrayed in good light within professional circles for years. I somehow doubt Stack Exchange really cares as long as the money keeps flowing in for their executives and the parent company (which reportedly has a very ugly history). Apr 19 at 22:42
  • 2
    My first question was, who's this John Oliver ... After which I realised that I probably should follow some bits of US news as well. :p Apr 22 at 22:25

5 Answers 5

43
+100

Just a quick addition to point out why a company choosing privacy as the default may be better off in the long run when compared to a company that annoys their users by making it more difficult to reject unnecessary cookies than accept all cookies...

It turns out that DuckDuckGo is making a non-Chromium based browser that includes a feature to manage the cookie consent dialogs:

Tired of dealing with cookie consent pop-ups? Not only does DuckDuckGo for Mac clear them for you on many sites, we also automatically set your preferences to minimize cookies and maximize your privacy.

When online advertising got too annoying, ad-blockers were invented. When advertisers started fingerprinting browsers to get around people blocking cookies and "beacons", technology to make that more difficult was invented. When companies come up with these "consent" dialogs that don't actually solicit true consent, blocking those dialogs and withholding all consent becomes a selling point for browsers.

In this online privacy arms race, which side does the company want to be on?


The point is that "Privacy should be the default setting here..." and Stack Exchange's dialog is a very clear example of how it is not the default.

This is the current (12 April 2022) cookie dialog and it is pretty much identical to the one shown in the video (regardless of the source of that one):

screenshot of the current cookie dialog with two buttons "Accept" and "Customize"

The main problem with this dialog is not the text on it, and not the size, or whether it is GDPR compliant. It is that it doesn't default to the most privacy-protecting state. The dialog clearly defaults to the least privacy-protecting state, and that is why it ended up as an illustration for John Olliver's show. I'm sure most people have no problem with the dialog having a button to enable the wonderful benefits the other "not strictly necessary" cookies provide. It is the absence of a button to dismiss that dialog without providing consent for all those other cookies that is the problem.

Having a dialog that informs you about the cookies a site wants to set is not a bad step, but the ideal situation is that all web sites only use strictly necessary cookies, and they have to convince users to enable those other cookies by providing real value to the user.

The only reason this is difficult is that the cookies many users want to reject only provide a lot of value to the site and to advertisers. If you want to track me and gather valuable data about how I interact with a site and ads that appear on it, you need to compensate me with more than personalized ads I end up blocking because they're annoying (and sometimes creepily targeted).

I don’t object to advertising. I actually enjoy some ads when they’re clever and I used to not block ads on Stack Exchange. The type of advertising that needs to track me across sites and target me based on my browsing history (and other data if they can figure it out) has never been the sort I find valuable.

13
  • 7
    "...you need to compensate me with more than personalized ads..." You are being compensated... with use of the website at no additional cost. I hate that the Internet became this expectation that all websites be free. But to say that everything should be free and ad-free is wanting way too much. Companies have to make money somehow and when the world isn't willing to pay fees to access them, creepier practices develop and we end up with the Internet we have today. Adam Ruins Everything did some episodes on the history of this. (This is just general info, not a stance of the company.)
    – animuson StaffMod
    Apr 12 at 4:05
  • 15
    @animuson This answer does not reject advertising altogether. Is advertisement without tracking insufficient for monetising the content nowadays?
    – Mast
    Apr 12 at 4:59
  • 4
    @Mast I imagine most advertisers would argue yes. Even in a system that is pay per click, an ad slot being used up on an advertisement a user would never click is wasted screen real estate - which could be avoided by knowing a little more about the user. Imagine if when buying a billboard you didn't get to select which billboards your ad appeared on, so your campaign ad for an Alabama candidate ended up on a billboard in Ohio. I'm all in favor of better data privacy laws, and I understand that will likely cause me to have to pay in other ways. But not everyone might get that point.
    – animuson StaffMod
    Apr 12 at 5:17
  • 11
    @animuson I don’t object to ads, but frankly, none of that is my problem. If the company can’t offer me value under terms I’m willing to accept and still make money, that’s the company’s problem. I haven’t seen an ad on Stack Exchange in a very long time. I’ve said this before, but SE has something very rare and wonderful on the Internet: a hundred healthy engaged communities. That the only way the company can think of to make money with that is advertising is a shame.
    – ColleenV
    Apr 12 at 10:24
  • 3
    And just in case anyone is skeptical that solutions other than advertising can work, the COH Homecoming folks have people competing to try to get their donation in before the window closes The Substack/Patreon model of offering a mix free content and paid content seems to be working pretty well for a lot of people. There are plenty of free-to-play games where a few paying customers support a large base of free players. They’re making money without amassing information about me.
    – ColleenV
    Apr 12 at 10:51
  • 11
    @Zombo I can't speak for anyone else, but I was compensated when I contributed whatever I gave to Stack Exchange. I wouldn't have written those answers, done those reviews, edited those posts, etc. if I didn't get any value from it, even though that value isn't very tangible. I enjoy participating on SE, and I'm happy to exchange value for enjoyment. The problem with advertisers tracking me and building a profile of who I am is that the value they're extracting is far higher that what they're offering me in return.
    – ColleenV
    Apr 12 at 12:54
  • 4
    @ColleenV I agree with you that there are other solutions. It's just an important historical perspective to help understand why we as a society ended up here. And other solutions may be just as predatory or undesirable. Free-to-play games, as you mentioned, are also heavily criticized because they often try to exploit addiction for profit.
    – animuson StaffMod
    Apr 12 at 14:47
  • 2
    @animuson I agree that there are good implementations and bad implementations of every sort of monetization strategy. I didn't mean that SE should set up a micro-transaction shop or start offering gambling boxes :) I'd totally pay for aesthetic flair for my profile or something though...
    – ColleenV
    Apr 12 at 14:49
  • 1
    @animuson Ask us to pay, then. Many power users here would love to pay a subscription to support the sites and for nominal "SE Gold" features.
    – pkamb
    Apr 12 at 16:31
  • 15
    Given SO seems to have been winding down their ad biz for the past few years, I don't really see much value in getting sidetracked by discussing it; bad UX is bad UX regardless of rationale.
    – Shog9
    Apr 12 at 18:29
  • "That the only way the company can think of to make money with that is advertising is a shame." @ColleenV You're not suggesting that ads are the only way SE makes money, right? Of course it's not! But a company would be stupid not to extract some measure of ad revenue out of a site this large.
    – Cerbrus
    Apr 13 at 8:30
  • 3
    @Cerbrus I’m suggesting that the only way SE monetizes sites like English Language Learners, Seasoned Advice, et. al. is through advertising/marketing. I am well aware that SE is not solely (or even mostly) supported by ads.
    – ColleenV
    Apr 13 at 11:20
  • @animuson what happened to the content based advertisement? You don't need to know much about me, just about what I'm reading (we are what we consume after all, aren't we?).
    – Braiam
    Apr 15 at 23:31
24

Replying to my own question. "Accept all cookies" is one click, and reject is two clicks:

  1. Customize settings
  2. Confirm my choices

I have a feeling someone might use this information to say something like this:

but it's only one more click!

Some people would disagree with you, like Jeff Atwood:

For most users, the default value is the only value.

I would like to respond to this comment as well:

I don't particularly think this is specifically about SE

Correct, John doesn't specifically mention Stack Exchange. However in regards to the cookie modal, Stack Exchange was the first of only two examples given. Whether that's result of a Google Search completely misses the point. Stack Exchange shouldn't be showing up on a Google Search for bad cookie practices. The fact that it is, means that Stack Exchange is a pristine example of a company doing it the wrong way. So please don't make my case stronger with comments like this.

4
  • 1
    "Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place." is a really high bar, particularly for cookies, which is not reasonable under most circumstances. In order to actually meet that bar, it would be necessary to have a popup displayed upon every page load which allowed the user to to withdraw consent with a single click. If that was actually required of every website, users would almost universally hate it. While what you quote is what that site says, this really needs sourcing to the actual directive or court ruling.
    – Makyen
    Apr 11 at 16:53
  • 3
    Note: prior to writing the above, I did search the 2002 directive and the 2009 amendment for "withdraw". What the directive actually says is "Users or subscribers shall be given the possibility to withdraw their consent for the processing of traffic data at any time.", which is really not the same thing. It's possible that this was clarified in a court ruling, but I haven't searched those.
    – Makyen
    Apr 11 at 16:59
  • 7
    And even putting aside Atwood's quote, it's still not "only one more click". Because a) The modal dialog is very slow to load most of the time. b) I have to spend some mental energy making sure optional cookies are all rejected. c) The "Accept all cookies" is still present on the "Customize settings" dialog, so you have to be careful not to click it. Apr 11 at 18:00
  • 17
    Only a high bar if we take it as a given that allowing optional cookies needs to be both easy and intrusive, @makyen. Which we shouldn't: vast majority of readers here get no value from cookies because they're only reading whatever page pops up on search results; I've personally spent months with that damned popup on top of every page I read because I grew so weary of it forgetting my preferences that I just gave up and learned to ignore a huge chunk of my screen, Idiocracy-style. That's worst case for both SO and the reader, yet SO chooses it by default!
    – Shog9
    Apr 11 at 20:13
18
+300

These are called Dark Patterns, also called deceptive designs. This problem could be eliminated by having an extra option called "Only necessary cookies". Additionally, to prevent Privacy Zuckering, the color of the icons should not be made such that "Accept all cookies" is the most prominent.

Eventually, someone is likely to report this to the EFF's Dark Patterns Tipline if this continues.

But even if they do allow you to opt-out of tracking cookies, there is currently no way to opt-out of their intrusive cross-system browser fingerprinting that functions even if cookies are disabled.

1
16

The first option counting from the top on the main popup should be: "Reject everything."

I stopped browsing sites that don't offer a convenient "reject all" option and am glad to see John Oliver made an episode about the issue (and I'm also happy he chose to feature Stack Exchange).

P.S. Credit goes to the design team for making a good looking cookie dialogue. If it didn't look good, like all the other cookie dialogues out there, it wouldn't have been featured.

6
  • 1
    I watched the episode, the company's name is not mentioned by Oliver. So, saying the British comedian and his team featured SE in an episode is making the company sound more important than it actually is. Apr 13 at 7:16
  • 2
    @Mari-LouAСлаваУкраїні I've watched some of John Oliver's shows and they're usually well researched so I'm not surprised they chose SE.
    – bad_coder
    Apr 13 at 7:23
  • 2
    The researchers selected an image, one that had visual impact and was on display for maybe less than two seconds. Apr 13 at 8:02
  • 2
    @Mari-LouAСлаваУкраїні yup that's how they usually display images in that show.
    – bad_coder
    Apr 13 at 8:04
  • 3
    "I stopped browsing sites that don't offer a convenient "reject all" option" Eh, then how are you here? :D
    – Cerbrus
    Apr 13 at 8:25
  • @Cerbrus because 2 clicks is the threshold of acceptable.
    – bad_coder
    Apr 13 at 8:48
-14

Well, I had a quick watch of the video (and picked up some additional information elsewhere).

I don't particularly think this is specifically about SE - I did a Google search and this was one of the image hits I got for accept all cookies:

Google image search screenshot.

It’s reasonably generic and links back to a meta.SE question. Some folks suspect this was the post that was blurred out in the background. It also has a huge image of the popup, which might have worked well for Mr Oliver's research team. Basically it’s featured because it’s a big, bold, obvious cookie option screen.

Interestingly - the options screen in the video was not from SE:

Enter image description here.

I'd also add, despite SE insiders knowing what site it was, most people are not going to be forensically digging into which site the option was from. If they didn't, they'd read this post.

14
  • More or less John Oliver wasn't calling out Stack Exchange specifically
    – Journeyman Geek Mod
    Apr 11 at 19:46
  • 29
    Sorry, when part of a company's site is featured like this, it's completely irrelevant whether the video was specifically targeting just that company. It means it's so bad that some relatively uninformed people thought it would be a great illustration for people even less informed than they are. That's worse than if someone had a Stack Exchange specific axe to grind.
    – ColleenV
    Apr 11 at 19:52
  • 26
    Strongly agree with @Colleen here: getting picked from among all the much more widely-known sites on the 'Net, any one of which would've made good fodder for such a show by name-recognition alone... Suggests that in the fiercely competitive space for dark cookie patterns, SO/SE manages to stand out purely based on the ... Ah... "Quality" of their work in this area.
    – Shog9
    Apr 11 at 20:18
  • Or in this case, a very large screenshot in a support post. That's hardly calling out
    – Journeyman Geek Mod
    Apr 11 at 20:19
  • 13
    Are you saying it's Meta's fault for complaining so much about the cookie dialog that the screenshot of the problem bubbled up to the top of the search results and totally misrepresented how lovely the actual dialog is? :) When was the last time you experienced that dialog in a not-trying-to-reproduce-a-bug way?
    – ColleenV
    Apr 11 at 20:28
  • 4
    I do absolutely agree with Journeyman. Any other problems with cookies of Stack Exchange aside; the dialog is pretty decent and nowhere near the one that’s shown right after the speaker mentions Stack Exchange. Hey, we’re talking about Stack Overflow, which has got 10M+ visits a day. It’s not that weird that someone mentions it, it’s not a forgotten an unpopular site at all.
    – nicael
    Apr 11 at 21:37
  • 2
    The argument about pic of cookies appearing in the search results therefore symbolizing “bad cookie dialog” is invalid. As Journeyman mentioned, if you check the origin of the pic, it’s this question which explicitly mentions “accept all cookies”. This does only mean SE has got great SEO and nothing more. If that screenshot popped first on a site which would criticize SE for the cookie dialog, then okay - but it’s not what happened
    – nicael
    Apr 11 at 21:42
  • @nicael That is not the origin of the picture given it's a completely different picture...
    – ert
    Apr 12 at 5:40
  • 2
    @ert nah. It's not the origin - it's the actual content of the image. The blurred out question in the background behind the cookie banner is the question linked to in this answer. What JG is saying is that the image is relatively easy to find at the top of search results and, in fact, the question pictured behind the image is the question that the Google Image search result links to. If you look at the avatar that's blurred and the comments below, even with the blurring, they seem to be identical.
    – Catija StaffMod
    Apr 12 at 14:23
  • 13
    While that image is high in the Google search results, you're assuming that's how Oliver's team found it, and also assuming they just went with the first thing they saw. Without hearing from them directly, we don't know how many other search results they skipped to go with this one. Also, when they found this one, they decided it was the perfect example of a terrible accept cookies dialog. Not something to aspire to!
    – LShaver
    Apr 12 at 18:41
  • @Catija Yes, but I mean they didn't just grab a random screenshot - this is their own screenshot displaying how the current site behaves
    – ert
    Apr 12 at 23:04
  • 1
    @ert no - it's not. The cookie banner doesn't appear at that size and in that position and the page content under it is not blurred. They created that image to suit their story. Does the banner fail to give an immediate opt out? Yes, that's true. Does it show up more often for some people than would be appreciated? Sometimes, yes. Does it take over the entire screen and make it impossible to read the site content? Absolutely not. Even on my phone, the majority of the page is visible. I understand that there's concerns but that image in the show is deceptive.
    – Catija StaffMod
    Apr 12 at 23:11
  • 1
    @Catija Sorry, yes, you're right. I figured they'd screencapped just the box and cropped it, I didn't realize they enlarged it and centered it... that's not the best journalism. However, I can't agree that it doesn't make it impossible to read the content. Here's what I see on my work laptop in incognito. Granted, smaller windows do shrink it vertically so perhaps I'm just on the cusp of the worst size
    – ert
    Apr 12 at 23:21
  • 4
    That's quite bold to make this comment while there are outstanding questions like Why is the Google Analytics cookie defined as "strictly necessary" and saved without consent? and Stop tracking users without their consent.
    – mbauman
    Apr 15 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .