Why no 'Cookies' on some Web sites ?

[RJSV]

Hey there!  I'm not real confident, from security standpoint (plus I find the subject boorish, actually), but here is an amateur's question:
   I tried a couple phone number look-ups, People finder, etc. but noticed; those particular Web sites do not display a 'Cookies notice'.  Just wondering how that fits, into the whole, notification paradigm...?
(Sites such as IEEE articles usually have a Cookies notice up front).
Thanks.

[Mechatrommer]

because they dont care what your previous preferences, biodata, gender or location are... you should be more suspicious on websites that save cookies or data into you HDD, not the other way around.

[ebastler]

That is the optimistic view, Mechatrommer.   I think it is much more likely that those websites just don't care about compliance with the notification requirements, and happily place cookies and grab whatever information they can get without bothering to obtain your agreement.

For giggles I just tried People Finder, which RJHayward had mentioned, and then checked the cookie list in my browser. Before even having completed a search, I now have four cookies from "peoplefinder.com" and seven from "intelius.com".

Not a surprise: For those "people finding" websites, privacy must be the arch-enemy... In the process of "searching", People Finder asked me all kinds of questions about the fictional person I was seraching for, which now doubt they are adding to their database. I know which website to avoid now.

[magic]

It is also the case that the cookie drama is an EU thing so far.
A company in other part of the world with no business activities in the EU may not give rat's ass about it.

Maybe one day benevolent EU will save us from this problem by blocking access to websites lacking cookie banners...
You 'Murricans will be left in the cold, though.

[Mechatrommer]

I think it is much more likely that those websites just don't care about compliance with the notification requirements..

ok, i thought notification is made by the "browser" on my end.. now i know why they have so many notification styles.

[Foxxz]

Its my understanding the cookies notification thing is due to European GDPR law. Some sites may have a presence in Europe (beyond the website itself) and may be subject to their laws. If your site is wholly outside of Europe and you have no interest in doing business with Europeans then you can probably ignore GDPR with little consequence.

[Cerebus]

Its my understanding the cookies notification thing is due to European GDPR law. Some sites may have a presence in Europe (beyond the website itself) and may be subject to their laws. If your site is wholly outside of Europe and you have no interest in doing business with Europeans then you can probably ignore GDPR with little consequence.

No, the cookie requirements (ePrivacy directive 2002) predate GDPR (2016) in the EU; the "cookie law" was rolled into GDPR when GDPR effectively replaced the ePrivacy directive.

It's just that the phrase "fines of up to 4% of global turnover" associated with  GDPR suddenly made a lot of companies take their existing compliance duties under the law seriously. Whereas the relatively small fines that could be levied before GDPR could be passed off as "a cost of doing business" and were perhaps less than the actual costs of compliance, a fine that would wipe out your shareholder's dividend for the year, maybe longer, is something that makes C-suite management sit up and take notice. Thus a lot of people who didn't give a damn that they were previously acting unlawfully suddenly fell into line.

[golden_labels]

Two explanations for opposite scenarios:

• The entity behind it doesn’t care about law. If one steals your wallet, they don’t ask you to waive your privacy rights to keep the ID card. Virtually all of the services of the kind you mentioned are spammers, some even gateways to actual scams. Why would they care about obtaining consent from you?
• The entity behind it is not abusing your privacy and they actually hired a lawyer, who also happened to not be overzealous. The EU Cookie Law is designed to be non-intrusive, require no action from honest companies and require no consent from the user for normal cookie usage. If you are slapped in the face with the “please surrender your rights” nag screen, it means one of three things: the cookies are to be used for things other than just providing the service (usually selling you to other companies, spying on your activities and so on), they hired no lawyers to design their policies, or the lawyers wrote the policies to protect the company to the maximum extent possible, without any care for the agreement being balanced.

There is an overlap with GDPR, but that regulation is also not requiring such actions for just providing service.

[eutectique]

Add Cookie AutoDelete extention to your favourite browser. Whitelist some useful sites, this one included. Forget about cookies forever.

[SiliconWizard]

It is also the case that the cookie drama is an EU thing so far.
A company in other part of the world with no business activities in the EU may not give rat's ass about it.

Yep. And frankly, there are many, many more severe sources of concerns about privacy online and how your personal data is being used than cookies.
Cookies are information stored on *your own device*. I'm a lot more concerned with information about you stored on someone else's device/a server. And a web site can absolutely use cookies while *not* storing any corresponding information on the server itself beyond the duration of the session. Both things are distinct, and the latter is just courtesy.

While a number of sites use cookies for "tracking" you in some way to generate ad revenue - basically monetizing "you" behind your back - cookies may be used for very simple and useful things such as implementing a "session" of some kind, without which some of the experience most users expect from a web site these days is almost impossible to implement. It's unfortunate that there is no distinction between those as far as "notices" go - although some notices allow you to select just the kind of cookies you allow or refuse, not all do, and in any case, whatever the type of cookies, the web site is supposed to display this notice and act accordingly. So how are you supposed to implement sessions without any cookie? Yeah.

[ivaylo]

To play devil’s advocate… It’s not the site’s you see in your browser’s address bar cookies you should be worried about, it’s the “analytics” tools their pages load onto your browser. Those are third parties you never see, agree to send data to, etc. As dumbed down example - you don’t have to ever been on Facebook for Facebook to have a ton of data on you from multiple sites you visit (FB used to be a pretty popular choice of many companies to do their marketing with). If those silly cookie warnings are the only way to at least make the public curious how the internet works, so be it…

[pcprogrammer]

It is just unfortunate that the rules don't set a uniform guideline on what the user experience should be here.

For me a uniform smallish banner with a button to decline and one or more ways to accept what ever cookie you like would make browsing more pleasant then what it has become now.

Because having an always present button to decline and go on would make it much less aggravating then having to switch of the individual sliders on some of these consent forms.

But that is not what the companies want of course because then most likely no one will allow that tracking shit. Only having an easy to go on accept button is much more to their liking