It seems that in the last couple of years, it has become standard for web sites to have irritating pop-over notifications that their web site uses cookies “to enhance your user experience” or something like that. As far as I can tell, this is done in compliance with the European Union's GDPR regulations (though that is perhaps not entirely true). I find the notifications to be totally uninformative and irritating, so I am curious whether this practice was an intended consequence of those laws or regulations, or whether it was an unintended consequence of a regulation that was intended to compel a different sort of behavior.

3 Answers 3


Yes, it was intended. It is because the law requires the sites to allow you to decide if you want cookies that are not necessary and allows you to opt in and out of specific cookies.

There just isn't a good way to do those things without making you click stuff.

  • 1
    This, I believe, became a requirement before GDPR. There have been statements from EU officials that the intended effect has not been achieved and that it is, indeed, very irritating. Commented May 22, 2019 at 8:22

Yes, it is intended.

Good would be to have a button together with the message to turn of cookies. This is rare, but for example slashdot.org does this.

Some reasonably good sites let you turn off all cookies with three clicks; it looks very much like they all use the same software for this.

Other sides make it ridiculously difficulat. arstechnica.com used to have links to 50 pages of their advertisers where you could supposedly turn off cookies for each advertiser individually. That's the kind of thing that makes you absolutely hate a website.

And then there is webmd.com . A website providing medical information. A website where I would expect more privacy than from other sites. The contrary happens: They don't allow access to their site unless you agree to their terms. According to the GDPR, such forced consent is not consent. In other words, webmd.com stores information about users residing in the EU without their consent, in absolute violation of GDPR.

  • 2
    A reasonable response would be for the web standards groups to come up with a standard for cookie management and push the notification and acceptance away from the website UI and into a standard implementation in the browser - the website can publish webhook endpoints for user changes and its all controlled in the http request headers and in a standard UI. But no, instead we get a billion different implementations.
    – user4210
    Commented May 21, 2019 at 22:49
  • @Moo, that might be hard to square with the requirement that consent be active, i.e. opt-in, and that silence must not be taken as consent. Commented May 22, 2019 at 0:20
  • @DavidSiegel not at all, the browser simply drops any and all cookie headers until a corresponding consent for that cookie has been lodged or the cookie header is marked as "exempt" by the issuing party (which could trigger legal issues) and the browser can display an icon somewhere which shows that the website is claiming exempt cookies - this is all 100% controllable via a standardised technical implementation, but instead we get a mishmash approach because the solution is legal appeasement rather than technical in basis.
    – user4210
    Commented May 22, 2019 at 0:36

Here’s a cybersecurity perspective. Cookies can have the ability to do a wide range of things. In addition to small arbitrary data, cookies can be used for authentication mechanisms and trackers. This from Wikipedia on tracker cookies:

...tracking cookies, and especially third-party tracking cookies, are commonly used as ways to compile long-term records of individuals' browsing histories – a potential privacy concern that prompted European and U.S. lawmakers to take action in 2011. European law requires that all websites targeting European Union member states gain "informed consent" from users before storing non-essential cookies on their device.

Security things to consider:

  • Line of death and zones of trust. Malware droppers can masquerade as cookie prompts. If you don’t know what legitimate, trusted prompts should look like and WHERE they should be, it’s pretty easy to get owned.
  • Review/change your browsers default cookie action, and clear cookies often.
  • Detect and block trackers with Privacy Badger. You may not have a good web experience blocking all cookies by default. This extension tries to determine the behavior of a tracker, and blocks it.
  • bonus: get a good ad blocker. Ublock Orgin is free and awesome.
  • bonus: make sure your connections are using SSL encryption with HTTPS Everywhere Most legitimate sites use SSL for their core content. Even so, lots of little 3rd party HTTP requests are made for tracking and adds... block them and watch lots of ads disappear, and it will also help warn you before going to bankofarnerica (...ARNERICA, yes, I’ve seen this phishing attempt from typo-squatted http sites).

Follow these tips for safer, faster browsing.

  • I appreciate the detail about the potential abuses of cookies, but it doesn't follow that the most effective way to address the issue is with vapid pop-over notifications. That just trains users to dismiss alerts without paying attention to them.
    – adam.baker
    Commented May 28, 2019 at 15:55
  • Agreed. However, because this mechanism drops files on the subject’s machine, some legal systems require consent. In some countries, browser settings that permit cookies are all that are needed, some may leverage the pop ups, and others may require a notification within the webpage. Your question seemed to be partly fueled by annoyance with the mechanism, so I offered some work arounds.
    – sadtank
    Commented May 28, 2019 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .