We see the question in the headline every single day. But how should we answer it? Which cookies should we accept and which not? Does our decision matter, and can we change it? And what are these notorious cookies anyway?
Every website today looks like this: you open it, the cookie window pops up, you start reading, you rather enjoy the prose, and by the time you've decided which cookies you'll allow the site to store, you've forgotten why you came.
GDPR. We've all heard of it, and I'm convinced it must be an abbreviation of some Latin curse; if it isn't, it deserves to be adopted into Latin in the language's next release. While every tiny website is forced by law to obey the infamous regulation to the letter, the pages of the giant companies where we spend hours every day show it to us once and that's that.
But while the social networks and the search giants exploit their monopoly positions in the most flagrant and unceremonious way, the small and likable fish are forced to comply with a requirement that plainly doesn't work.
How did we get here? Is it worth reading the questions every site asks us about cookies? Are there more sensible solutions?
The Cookie Monster
GDPR is the European Union regulation that was meant to take care of protecting our data in general. How well it has managed… let's not go into detail; I'm sure you have your own answer.
Just as I'm sure that every time you open a website and are greeted by the mandatory window about the notorious “cookies,” you read carefully, point by point, the gripping and profound texts of what you are agreeing to.
I'm equally sure that afterwards you go in and check whether the settings you chose have been saved and are being applied exactly according to your preferences.
So what are these notorious cookies, and why are they so tasteless?
Fortune Cookie
Today's online world is a machine for processing personal data. As we have discussed before, this is what the business of the biggest companies, the ones that rule the online (and not only the online) world today, rests on.
GDPR arrived as a formal legal solution so that users would know what data is stored about them and would themselves grant that right to website owners. Except that today it does nothing at all, apart from being a nuisance.
Cookies are small pieces of code saved in your browser for a given site, and their job is to track and store data about your behavior one way or another. So that the next time you land on the same little patch of the global web, the most personalized content possible awaits you. So that, one way or another, the algorithms know your preferences.
And it really is convenient. You visit the online grocery store, and it already knows from your previous orders your address, your favorite brand of socks and the kind of goods to push on you most insistently. Or the news to offer you.
Cookie Cuckoo
Say you open Google for the first time. The consent window appears. In the first decades of the internet, the same role was played by the long bedsheets of words listing users' rights and obligations, which we had to agree to in order to install a piece of software.
The difference is that today you can voluntarily refuse a large part of what you are offered. Where agreeing to the terms used to mean a single click on a document you don't read (much like a contract with a mobile operator), now you have quite a few more options to choose from. And they tell you nothing, except that, as a rule, you as a user can't think of a single reason to read them.
Because online, we're all in a hurry these days!
We don't have time to read even meaningful texts, let alone the long terms of the “contract” under which we visit some website. Say, if we've dropped by Digital Stories.
Cookie Cake
On one side there is Google. The goal of the search engine, like that of any other website, is for you to take responsibility for the fact that certain data of yours will be stored.
But how much time do you spend on Google and how much reading Digital Stories? How much data does one site need to collect about you, and how much the other? And yet the path to both goes through the same steps, the same little screen, opened once, whose contents nobody reads.
So every user's goal is to find the “accept all” button as fast as possible. There are even browser extensions today that do it for us.
Still, you think it matters what you've agreed to?
Of course. So the next step, if you decide that independence and security come first for you, is to add yet another browser extension—one that deletes cookies according to your preferences.
Something for Every Taste
In the end, the decisions really ought to come from you, and what matters is knowing enough about the subject to make your own judgment. Which is something the current cookie system definitely does not achieve.
On the contrary, more often than not it reinforces our indifference to what we click in the annoying cookie window.
Or our paranoia about getting rid of every last one of them.
A few months ago, Google announced that it was adding, for Europe, the option to reject all of its cookies. Then it turned out that this meant you have the right to reject the ones that are not “essential.”
And which ones are essential?
If you're a lawyer with a few spare days and nights for reading, be my guest and check. As a result, the whole exercise turns into a tiresome example of digital marketing.
Gluten-Free
Perhaps the only thing we associate the notorious GDPR with today is precisely cookies. The truth is that, both in concept and in practice, they are a very small part of the “work” of the infamous regulation, which was meant to protect the data of all citizens of the European Union.
The abbreviation comes from the bureaucratically pompous General Data Protection Regulation. The fearsome four letters were adopted in 2016 and came into force two years later. It obviously aimed to win everyone's respect with the enormous threat of sanctions. It provided for fines of up to 20 million dollars or 4% of annual revenue! Truly rather intimidating; there was no way every website owner and every big company wouldn't take measures.
With the benefit of hindsight, however, these penalties turned out to be a gate in an open field. Like smoking indoors—it's supposedly been banned in Bulgaria for more than a decade, but take a stroll through the bars and restaurants of Sofia some evening.
So as not to make unfounded claims: in Bulgaria, the institution responsible for penalties and oversight in this area is the Commission for Personal Data Protection. Its annual report for 2021 shows that it received a total of 840 complaints, most of them related to video surveillance. The fines it imposed number… 38. For a total of 112,150 leva (about $58,000).
A Bitter Aftertaste
As far as cookies go, the next important step came on May 4, 2020. The European Data Protection Board considerably clarified the scope of the regulation with regard to consent. It must be freely given, informed, and a clear indication of the user's choice.
For example, it is not enough for the user to scroll down for consent to be assumed. Windows that cannot be closed until you accept are forbidden.
Broadly speaking, cookies are divided into first-party and third-party ones. The former belong to the site you are visiting, the latter to other organizations. Usually the latter are far more numerous—these are cookies with all sorts of uses, from tracking what you do on the site and reporting it to the owner through Google Analytics to the data needed to pick the best ad for you. First-party cookies, on the other hand, are usually tied to your actions on that particular site: they hold, for instance, the products you've put in your basket and the details you registered with on the page.
Boza for Pennies
The General Regulation governs “the processing, storage and use of personal data of natural persons by a third party—persons, companies or organizations.” All of this involves far more serious work than a little window in the browser. Larger companies must appoint specialists to organize their data storage processes. Already at the design stage of their information systems, they must invest serious effort and money in guaranteeing privacy…
GDPR was proudly proclaimed the biggest data protection initiative of the past 20 years undertaken by any organization or institution whatsoever. It guarantees “the fundamental rights and freedoms of the individual.”
Users must have the right to access the stored data, as well as “the right to be forgotten.” In the event of a data leak, every company is obliged to personally inform the affected users within 72 hours. Does that actually happen?
At the Pastry Shop
And many more pretty fairy tales; let me not remind you how much this helped against the huge data leaks from the biggest companies, or from Bulgarian state institutions.
GDPR, however, keeps scaring people with those sanctions, which can always be turned into a weapon, and that is why all website owners are so diligent about at least offering the choice. Either way, there's not even any need for fine print here; all the print is large, and nobody reads it.
It's no accident that adding the little window is so easy today. A market niche opened up, and plenty of companies offer a ready-made selection of options. Owners of sites built on the most widespread solution, WordPress, have handy plugins that take care of the annoying necessity with a single click. Apps have appeared that automatically check whether your page meets the requirements.
Polly Wants a Cracker
Today there is a separate version of the rules for the UK, which has left the EU, the main difference being that people over 13 can consent to data storage, compared with 16 in the EU.
All of this created plenty of work for lawyers, who have remained the only ones interested in the subject (apart from companies afraid of penalties). Countless interpretations appeared of what exactly personal data is and how it must be handled according to the letter of the regulation.
Still, personal data is any information directly connected to a given person, or information that can be traced back to them. In other words: the fact that someone visited your site is not personal data (we still haven't come up with a decent singular for the word). The IP address they come from, however, can be considered personal data—rather subjectively—if it can be used to trace who the visitor is. As you know, you can't embrace the boundless, and so it is with this slippery subject.
Cookies with Coffee
The fact is that you can delete all cookies for any site at any moment. Just open the inspector of the browser you use, and on one of its subpages you'll find the option. Of course, this will delete all data from that site, and if you are logged in, you'll have to enter your details again.
And so, once we've deleted the cookies, are we safe from anyone knowing what we do online?
It may be no accident that it looks that way. The truth, though, is exactly the opposite—far more important is the data stored far away from us, on the servers of the various website owners. Yes, the well-meaning ones among them will surely follow the rules you agreed to with that notorious consent, but… the truth is that nobody can guarantee that to you anymore.
Cat's Tongues
Lawyers certainly have an interesting perspective, so expect the next digital story, on Friday, to be an interview with a leading expert on our personal information offline and online.
If you ask the European regulators, they'll tell you the processes are monitored meticulously. For instance, one of the big disputes with the monopolists, which even led to Zuckerberg's notorious threat to pull his offspring out of the EU, was over Meta's unwillingness to guarantee that Europeans' data is stored only on servers within the Union.
I don't know about you, but personally this question troubles me very little, because I have deep doubts about the foundations of the whole process.
In my view, at least, the far bigger issue that turns our data into a priceless commodity lies precisely in the consents we give ourselves, entirely voluntarily. In the trust we place in the system, in GDPR, in the regulators, in the harsh penalties laid down for violators. And above all: in the fact that we don't realize how important this data is. In our unwillingness to reflect on the notorious and indisputable truth so often repeated in Digital Stories: when something is free, you are the product. Or, as we say in Bulgaria: it's not the one who eats the banitsa, the traditional cheese pastry, who is to blame, but the one who hands it to him…
