John Oliver calling out Stack Exchange cookie dialog

Question

In the recent Data Brokers episode of Last Week Tonight, John Oliver showed this picture: ^{(jump to relevant part around 18:57)}

which is of the Stack Exchange cookie screen. He said this:

Privacy should be the default setting here and there should be legal fixes to this. Other countries have actually tried; the EU passed a law to force sites to disclose cookies, and allow you to opt out, but I will say companies now often cleverly present those options in the most annoying way possible. With accept all cookies an easy default, but if you want to reject them, forcing you to go through multiple confusing steps for no clear reason.

I included the current screens below, which seem to match his picture and words pretty close. I am posting this as I think it's important to know how Stack Exchange is being portrayed in public; it doesn't seem to be in a good light. I think this could be easily resolved, if Stack Exchange just changed the buttons to:

• Strictly necessary cookies only
• Customize settings

Answer 1

Just a quick addition to point out why a company choosing privacy as the default may be better off in the long run when compared to a company that annoys their users by making it more difficult to reject unnecessary cookies than accept all cookies...

It turns out that DuckDuckGo is making a non-Chromium based browser that includes a feature to manage the cookie consent dialogs:

Tired of dealing with cookie consent pop-ups? Not only does DuckDuckGo for Mac clear them for you on many sites, we also automatically set your preferences to minimize cookies and maximize your privacy.

When online advertising got too annoying, ad-blockers were invented. When advertisers started fingerprinting browsers to get around people blocking cookies and "beacons", technology to make that more difficult was invented. When companies come up with these "consent" dialogs that don't actually solicit true consent, blocking those dialogs and withholding all consent becomes a selling point for browsers.

In this online privacy arms race, which side does the company want to be on?

---

The point is that "Privacy should be the default setting here..." and Stack Exchange's dialog is a very clear example of how it is not the default.

This is the current (12 April 2022) cookie dialog and it is pretty much identical to the one shown in the video (regardless of the source of that one):

The main problem with this dialog is not the text on it, and not the size, or whether it is GDPR compliant. It is that it doesn't default to the most privacy-protecting state. The dialog clearly defaults to the least privacy-protecting state, and that is why it ended up as an illustration for John Olliver's show. I'm sure most people have no problem with the dialog having a button to enable the wonderful benefits the other "not strictly necessary" cookies provide. It is the absence of a button to dismiss that dialog without providing consent for all those other cookies that is the problem.

Having a dialog that informs you about the cookies a site wants to set is not a bad step, but the ideal situation is that all web sites only use strictly necessary cookies, and they have to convince users to enable those other cookies by providing real value to the user.

The only reason this is difficult is that the cookies many users want to reject only provide a lot of value to the site and to advertisers. If you want to track me and gather valuable data about how I interact with a site and ads that appear on it, you need to compensate me with more than personalized ads I end up blocking because they're annoying (and sometimes creepily targeted).

I don’t object to advertising. I actually enjoy some ads when they’re clever and I used to not block ads on Stack Exchange. The type of advertising that needs to track me across sites and target me based on my browsing history (and other data if they can figure it out) has never been the sort I find valuable.

Answer 2

Replying to my own question. "Accept all cookies" is one click, and reject is two clicks:

1. Customize settings
2. Confirm my choices

I have a feeling someone might use this information to say something like this:

but it's only one more click!

Some people would disagree with you, like Jeff Atwood:

For most users, the default value is the only value.

I would like to respond to this comment as well:

I don't particularly think this is specifically about SE

Correct, John doesn't specifically mention Stack Exchange. However in regards to the cookie modal, Stack Exchange was the first of only two examples given. Whether that's result of a Google Search completely misses the point. Stack Exchange shouldn't be showing up on a Google Search for bad cookie practices. The fact that it is, means that Stack Exchange is a pristine example of a company doing it the wrong way. So please don't make my case stronger with comments like this.

Answer 3

These are called Dark Patterns, also called deceptive designs. This problem could be eliminated by having an extra option called "Only necessary cookies". Additionally, to prevent Privacy Zuckering, the color of the icons should not be made such that "Accept all cookies" is the most prominent.

Eventually, someone is likely to report this to the EFF's Dark Patterns Tipline if this continues.

But even if they do allow you to opt-out of tracking cookies, there is currently no way to opt-out of their intrusive cross-system browser fingerprinting that functions even if cookies are disabled.

Answer 4

The first option counting from the top on the main popup should be: "Reject everything."

I stopped browsing sites that don't offer a convenient "reject all" option and am glad to see John Oliver made an episode about the issue (and I'm also happy he chose to feature Stack Exchange).

P.S. Credit goes to the design team for making a good looking cookie dialogue. If it didn't look good, like all the other cookie dialogues out there, it wouldn't have been featured.

Answer 5

I just noticed that there is now a one-click option to choose "only necessary cookies."

In my opinion, this is a great improvement.

As noted in comments, this change was announced here: We've added a "Necessary cookies only" option to the cookie consent popup

Answer 6

Well, I had a quick watch of the video (and picked up some additional information elsewhere).

I don't particularly think this is specifically about SE - I did a Google search and this was one of the image hits I got for accept all cookies:

.

It’s reasonably generic and links back to a meta.SE question. Some folks suspect this was the post that was blurred out in the background. It also has a huge image of the popup, which might have worked well for Mr Oliver's research team. Basically it’s featured because it’s a big, bold, obvious cookie option screen.

Interestingly - the options screen in the video was not from SE:

.

I'd also add, despite SE insiders knowing what site it was, most people are not going to be forensically digging into which site the option was from. If they didn't, they'd read this post.