UKH

Whenever the "accept cookies" stuff comes up, I always wonder exactly what a legitimate interest is. IMO absolutely no 3rd parties ever have a legitimate interest.

I always reject/object as much as possible. It's a shame that the most restricted choice (i.e. only necessary cookies) isn't the compulsory default position.

https://cookieinformation.com/resources/blog/what-is-legitimate-interest-un...

Tl;dr it's a borderline illegal get out, and you need to continue the game of super kafkio bros until you've objected to them all. Or, better, just annihilate all cookies entirely. Or, middle ground, use Firefox focus, or ghostery, or something. The internet was never meant to be this way and the bellends who write overlays need to learn. Best thing, take your business elsewhere until they change their shitty ways.

Do you know of a (cookie-free, obvs) website which lists companies that have cookies turned off *by default*? Seems like it would be a useful 'carrot'.

I once had a look into one site’s legitimate interest cookies and stopped counting at 152! There was no opt out all button and you had to go through them individually if you wanted to opt out. It was a review site so I guess they rely on selling adverts and selling data. That review site made it very hard to opt out fully.

I wish, but no.

Plenty of resources trying to educate about not just giving up and clicking 'ok', and using container tabs etc. though. That's probably the best we'll get. We can only hope that if significant numbers start to get bored of it and close the tab rather than play silly buggers the problem will have to solve itself.

This is all too common, and, if I've read the rules right, illegal. There's supposed to be an equally prominent no button. It's another of those cases where enforcing the rules we already have would be nice.

A group called 'noyb' are starting to do something about it. https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-coo...

I can’t see many changing their ways unless forced to do, though I’ve come across websites that have them all off to start and you have to select at least the necessary one to proceed. 

I’ve noticed some companies list their reasons for their legitimate interest to include things that most folk would think is reasonable to help persuade you that you might need to be opted in. For example frequently fraud detection, security, etc., and under the same cookie as personalised ad creation!! 

Yep, common tactics. https://termsandconditions.game/

Shop them if they deserve it https://ico.org.uk/make-a-complaint/cookies/

Maybe it’s my browser doing it behind the scene, but the EICA website is defaulted off for every option when I visit it for booking climbing sessions. I have to select the necessary button before I can proceed to view anything.

Ha ha, I’ve forgotten which website it is. I think it was sited in America, and when I saw their cookie set up and, even greyed out, that it wasn’t really a relevant site for UK EV car reviews I was looking for, I just aborted. I was not likely to re visit so didn’t take note of who it was.

As someone whose job it is to manage the acquisition of first party consumer data for a major household name, can I politely suggest that we're not maliciously trying to spy on you or carry out other nefarious activities. 

In fact our strategy is to try to be more contextually relevant to you - you're going to see our online media placements anyway, we'd rather they appear in front of people who are more likely to be interested in them, and also at the appropriate time. 

I can't speak for everyone (just the two global corporations I've worked in this role in) but we are hyper careful in terms of our handling of data - the internal policies we have go above and beyond the legal rules out there. 

So targeted ads then. 

One man's nefarious is another man's 'legitimate interest'

Is that so bad?

If I've been shopping for gaming chairs I'd rather get gaming chair adverts on my Facebook timeline than adverts for dog food or tampons or any other product I will never buy.

And as an advertiser I really don't want to pay money to put my adverts for specialist electronics products in front of normal punters and get a click through rate of 0%.

What's really annoying is a great blanket popup that stops you reading the page. If you google a lot of stuff you are always seeing new pages. You read them once and that's probably it. How many thousand cookies are stored/slowing down your browser? And it's very difficult to delete them without deleting the vital ones.
Too few sites put the banner at the foot of the page where you can ignore it and close the page when you are done.

But as a consumer I don't want to see ads for my favourite shoes in my size on my payday on every website I visit. There need to be a balance. And that's why we have laws concerning it. And that's where a lot of websites take the piss by not having a compliant no button.

Honourable mention to UKC is deserved. They do it right. I mean, sure, some of the flickering epileptogif ads are intolerable, but at least they don't have my personality embedded in them.

I didn’t do very well with the game! I gave away details 12 out of 29 times 😳! At least I was quicker than most players 😬 if it’s any consolation 🥴🙄.

I guess the toggle ones are just random no matter what. Some questions were clever stretching the old brain cells to the limit 🤬. 

I find it annoying to see adds for things I've already bought or researched by web browsing. In those circumstances you're almost certainly too late to get my dosh.

I'd much rather have random adverts and go "ooh I've never seen one of those, maybe I'll have a look".

I appreciate that you handle the data with care; reputable companies will, disreputable won't.

So what do you want to see? Random sh1t? Surely it's about being relevant to people. The alternative is 'untargetted ads' and surely that's a waste of everyone's time and money? You don't want the online equivalent of watching the Tour de France on ITV4 and getting ads for donkey sanctuaries and Stanner stair lifts because it's daytime weekday.

Most banner ads are handled by intermediaries and are badly managed - they feel a bit spammy and are really a bit old school. Some of the stuff we have in our 2-3 year roadmap is quite sophisticated - I started writing a lot about what we have planned but I don't think that helps - its going to happen anyway and you will experience it because with the decline in Cookie use and measures that Apple and Google are taking to secure consumer identity, companies are using many different ways to give the right experience to the right consumer at the right time.

A large number that do have a banner often wording it such that continuing to view their website is deemed consent to cookies though. Got you by default if you don’t notice the banner which often designed not to be prominent to the eye to even notice.

Yeah me too. I'm a consumer as well remember. However that's a very small part of this (and isn't what I'm involved in). 

Yes but companies that buy adverts don't, and they're payng for all that free content on the internet. We save millions in media efficiencies by using our data to target audiences who are more likely to click through or buy, than if we just did it randomly. Over millions of impressions these add up.

The biggest problem is real-time programatic advertising and the bid system - this will be moving to TV as well (it already is in on-demand streaming like 4-OD).

I assumed that consent was given by closing the banner, but you may be right. At least I can read the page without further ado!
There are so few of these sites I do notice!

I'm fine with climbing ads on a climbing site. Or electronics ads on an electronics site. I'm fine with social media advertising nothing but incontinence pants and Viagra because all they know about me is a fake birthday. I'm not fine with cookies being set and ads following me round the internet like a deranged stalker when I've taken the trouble to click on the reject all button, because I failed to complete a 5 minute point and click adventure game properly.

If the door to door sellers of the past started following you round town, all day offering you stuff from the first shop you visited our relevant to a conversation you had at the bus stop regardless of where you were, you'd ask them to f off, then tell them to, and call the police if they didn't. This is that.

My understanding of the law matches yours.

Another common feature of the implementation of those endless lists of nosey third party parkers is that they list both consent and legitimate interest as lawful bases for processing your personal data.  It seems that the 'engines' that a lot of these companies use to drive their ludicrously (and almost certainly illegally) lengthy cookie banners will automatically turn off the consent toggle if you have "do not track" set in your browser preferences but they leave the legitimate interest toggle on.  IMO you can't have both: if you're relying on legitimate interest as your lawful basis then you don't even need to ask for consent, but if you do ask for consent and it's refused then it's game over - you can't then say "well, we're going to do it anyway because we think we can, and if you don't like it you can always exercise your right to object*".  I've read a fair amount of professional advice on the subject and a lot of it cautions against the over-reliance on consent for this very reason: if you choose to operate on the basis of consent and it's declined then you really ought to not do it, full stop, no fallback, no further argument.

Most of these third party cookie 'engines' also fall down completely on the requirement to explain clearly what data is being collected, and what it's being used for.  Which (a) is a further breach of the regulations, and (b) makes it almost impossible for a data subject to know whether or not a particular third party's claim of legitimate interest is justifiable.

The problem is so widespread that it's beyond a single individual's practical capability to find violations and register complaints with a DPA.  I'm glad that a group is taking this on, and deploying automated tools to help with the task.  I am not surprised that some of the major players in the online space, most of whom are generally regarded as behaving dubiously in many other respects, are the amongst those resisting compliance.

* Objecting to processing of your personal data is a rather more complex process than just unticking a checkbox or flicking a toggle to indicate that you do not consent.  It's pretty unclear exactly what the "object" toggles that some cookie engines provide are actually supposed to achieve - and a lack of clarity is in itself a breach of the regulation.

I’ve got to the stage if I’m just random browsing I delete all cookies before and after a session so to be fair I don’t follow through to monitor if consent has been taken by default. I assume clicking any other link and/or a time limit gives deemed consent as I have seen the banner has disappear on subsequent pages and after a period of time just reading the same page. I really don’t know though, sorry.

Yes please.

Maybe you are fine with it but as an advertiser I wouldn't pay for it.  I reckon most advertisers who aren't selling generic consumer goods wouldn't buy search or social media advertising without targeting.  All the interesting ads would disappear from the internet and you'd be left with stuff which makes sense on a TV or newspaper ad.  

Maybe the whole thing would regress and you'd see niche publications come back as advertising money came away from search and social media.  I'm not sure that would be a step forward.  As a really small, really niche company the ability to get really close targeting on Google is awesome.  It's far better value in terms of sales per $ than when we had to buy banner adverts on specialist websites.

If you’re clever enough to know I’ve been searching for a new winter coat you should also be clever enough to know I bought one online and probably won’t want to buy another 5 that you keep showing me! You would literally be better off sending them to someone who hasn’t searched and bought one already!

I’m not so sure, I don’t know if it’s still the same but a few years ago I allowed only functional cookies and couldn’t then look at my logbook or crags etc

Paul might be along to clarify this, but I think that's because they've gone above and beyond to be fair. You have to enable 'preferences' cookies for the logbooks to work iirc. I guess it requires something that they don't feel comfortable calling 'necessary'.

The D Mail link in this UKC thread has to the worst “abuse” I’ve ever seen, and surely is not legal? https://www.ukhillwalking.com/forums/rocktalk/climbing_wall_belay_partner_sued...

If you switch off legitimate interest in the first part purposes/features which includes personalised ads, it does nothing to stop the vendors legitimate consent for the same purposes. You need to click on vendors section and then individually deselect all the legitimate interest toggles - I counted 290 (may be more or less as I speeded through) of them on by default. There is no deselect/object all button. Only option is to save and exit or allow all. Who is going to take time to click 290 or so to deselect?

All the consent buttons were off though, does the legitimate interest bypass/override the consent part?

My understanding is all legitimate interests allows tracking without your consent for what they declare. So if you decline consent for say personal ads but they have actually included that under their claimed legitimate interest and you don’t remove it/object/deselect or whatever way they word it, then yes it does override it.

Edit: See MartinW’s post above https://www.ukhillwalking.com/forums/off_belay/legitimate_interest-740867?v=1#...

The only way to know that is if the retailer that sold you the coat gave that information to Google/Facebook or whoever is doing their ads.   That would probably break a bunch of laws.

It would also be open to gaming by a company trying to stop competitors ads showing to prospects by pretending they'd already bought the product.

I sort of don't really care. 

I mean, I have nothing to hide and I'd rather have adverts about outdoor gear and car parts to ignore rather than adverts about stuff I have no interest in (also, to ignore). 

Interesting question.  I guess much depends on how the cookies are being used - in general cookies should speed up your browser by obviating the need to fetch stuff from the remote website (which has mostly been my use of them). 

If you deleted them I'm fairly sure it'd slow down your overall browsing experience when to tried to revisit those pages.  If you have hundreds of cookies from pages you aren't going to visit again then this might seem like a waste - but the data stored in persistent cookies tends to be so small that I wouldn't expect any great impact on your system.

 It does give a few ideas for my research thesis though, so thanks for bringing up the topic.

0.821 thousands on my browser btw.

Is it me or is it all getting more and more. I can't seem to go on a shopping site now without encountering a pop up that asks me to agree to cookies and even prevents me from seeing the product. I mean they want to sell me stuff but want me to jump through hoops in order to do so???