28

I am currently getting a new cookie banner popup.

The banner now mentions "legitimate interests".

The term however does not occur anywhere in the cookie-policy-page.

The term also does not appear at first glance when clicking on "customize cookies", or "List of Partners (vendors)" in the cookie banner popup.

At first glance, there appears to be no setting for these "legitimate interests".

However, after scrutinizing every element that can be expanded, I found five buttons to "object to legitimate interest, among the four categories in the "Customize cookies" popup. Furthermore, when clicking on the "list of partners (vendors)" link, three of the four vendors also have such an "object to legitimate interest" setting. (update: after re-checking this, today, only two of the four vendors show an "object" button: Xandr and Google, BeeswaxIO does not have such a button, thought it does have a note that it relies on "legitimate interests").

Note that it is highly non-obvious that the link to "list of partners (vendors)" has further configuration options, and it seems impossible to go from the "customize cookies" settings screen to the "list of vendors" setting screen and vice versa, so at first glance it does not seem possible to object to all.

Could we have a statement regarding that?

Is this indeed a new addition to the cookie banner?

Am I right in assuming that, unless I object to each of these individually, they are included by default among the "necessary only" cookies?

What about before I interact with the cookie banner at all? After all, the site is rendered nevertheless. Am I correct in presuming that the default setting for these is to track me in that case?

Cookie consent banner
Cookie consent banner

Customize settings popup
Customize settings popup

legitimate interest setting in "Customize settings popup"
(after expanding subsections and scrolling down)
legitimate interest setting in "Customize settings popup"

clicking on "list of partners" reveals further "object to legitimate interest" settings
Currently, Xandr and Google have such a setting, while BeeswaxIO does not
enter image description here
enter image description here

11
  • Have a read of the privacy policy; legitmate interest is discussed there (which the above (image of) text references as well, though does not link to).
    – Thom A
    Commented May 27 at 20:56
  • 8
    Would this design be considered a dark pattern, as it is more complex to reject the "legitimate interests" than it is to accept them? Something similar was mentioned for cookies in general.
    – A-Tech
    Commented May 28 at 10:33
  • 6
    Btw it seems that clicking "Necessary cookies only" does not object to the "legitimate interests".
    – A-Tech
    Commented May 28 at 10:35
  • So no "right to object" then?
    – Daviid
    Commented May 28 at 13:03
  • 3
    The one thing you can be sure about is that if a company has to write many pages explaining their cookies policy, that company is up to no good. They literally have a highly questionable agenda and they know it. Or otherwise there would be no need for such an intricate cookie dialog. The solution is to avoid such companies and to install anti-tracker plugins.
    – Lundin
    Commented May 28 at 13:24
  • 1
    Weirdly, the scope of the new banner seems to be only SO not SE. I asked on SE Meta about it.
    – A-Tech
    Commented May 28 at 13:29
  • 1
    @A-Tech The amount of trackers seems to vary from site to site. Privacy Badger reports up to 10 on SO but only 3 on meta. I guess it is related to unregistred user traffic since they like to spy on those users too, but unregistred users are less likely to visit meta so less need for spyware there.
    – Lundin
    Commented May 28 at 14:27
  • 1
    Does anyone know if there's an easy way, after clicking "Necessary cookies only", to go back and object to these "legitimate interests" as well? The only way I can think of would involve clearing my cookies, then going through the cookie permissions dialog for each SO/SE/Serverfault/etc domain (plus logging into each one) all over again.
    – AJM
    Commented May 28 at 15:44
  • 1
    well, there's teh cookie button in the footer, but you can't reject the "necessary" cookies other than by not using the site or blocking them with some tool/extension.
    – Kevin B
    Commented May 28 at 15:47
  • 3
    Related over on Super User: What do cookie warnings mean by "Legitimate Interest"?; that phrase appears to be defined by GDPR itself, rather than any privacy policy.
    – zcoop98
    Commented May 28 at 16:50
  • Also just remembered (since I don't see this language in my own cookie pop-up) that the cookie popup verbiage is region-specific (and fetched dynamically for all users), so your popup may show different verbiage (as mine does, accessed in the US).
    – zcoop98
    Commented May 28 at 17:05

1 Answer 1

6

Could we have a statement regarding that?

Unlikely; a similar cookie banner change was discovered 4 month ago. No offical response. The only reaction was the added tag [status-review].

Is this indeed a new addition to the cookie banner?

Yes it was not there on launch. On the same device I have browser/tabs with "legitimate interests" and without (see also my MSE post): both designs So far I could not find the trigger for when it is shown.

Am I right in assuming that, unless I object to each of these individually, they are included by default among the "necessary only" cookies?

Yes, despite being under the catogies "Perfomance" and "Targeting" one must object individually to all 5, necessary cookies only has no effect

What about before I interact with the cookie banner at all? After all, the site is rendered nevertheless. Am I correct in presuming that the default setting for these is to track me in that case?

As you have not objected to them beeing used they should be active but I can not verify it.


FYI poking a bit in the code there seem to be some hidden/unused elemnts in the cookie settings amongst other things another design for "legitimate interests" objections which is similar to this: alternative design

The above is a section with the ID "ot-pc-lst", remove the class hiding it and hide the normal cookie settings content to avoid overlap.

Looking at the cookies the only difference I found is an additional cookie browser tabs with "legitimate interests" that is called "eupubconsent-v2".

1
  • 1
    You can check the "OptanonConsent" cookie in the devtools, it stores all the information about the cookie consent, whether you accept the four groups is stored in a key called "groups" in that cookie's value. I don't have the legitimate interest part on my end so I can't check that. Commented May 29 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .