15 ms·
It's time for a browser-level cookie consent API. The web interfaces are almost always a pain, especially on mobile. This would also open the door to extension
by treve 6y ago
It's time for a browser-level cookie consent API. The web interfaces are almost always a pain, especially on mobile.
This would also open the door to extensions that just default consent to 'no'. This can't be the default though, to avoid another failure like Do Not Track.
- gjs278 6y agowe already have that. it’s called your cookie settings.
- TheSoftwareGuy 6y agoI've been saying this for years. Cookies are already a browser feature. Browsers just need to expose a little more control over it
- zozbot234 6y agoP3P https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P is a thing already, if perhaps a bit overengineered. It even works in IE6!
- luckylion 6y agoThat's server-side (and dead). Cookie consent would primarily be client-side. Otoh, we already have cookie-consent in browsers. Just don't accept cookies if you don't consent!
- zozbot234 6y agoP3P also exposes a machine-readable semantics for privacy policies, which could be used by the browser to manage access to not just cookies but other problematic features as well. It's a lot more flexible than "just reject cookies" or the "DNT" header.
- luckylion 6y agoThe issue is imho that the decision needs to happen server-side (so that a user with an incompatible client isn't slurped up by default), ergo the user-agent must declare the intentions of the user and the server needs to act on it. P3P could be a hint for the the user-agent, but the user-agent would have to tell the server what level of tracking etc is acceptable to the user.
- im3w1l 6y agoDo Not Tracked was not backed up by laws. That's the difference.
- akvadrako 6y agoIf the default was 'yes' (i.e. opt-in) then it's not consent. The solution is just proper enforcement and education. Opt-out by law must be the default while opt-in requires extra actions. Just teach people to always click No and eventually the dialogues will go away.
- Deukhoofd 6y agoA browser setting replacing the popups is part of the new EU ePrivacy Regulation, which is at the moment still being discussed. I hope it gets finalized soon, because there's a number of improvements in there. https://ec.europa.eu/digital-single-market/en/proposal-eprivacy-regulation https://ec.europa.eu/digital-single-market/en/proposal-epriv...
- kule 6y agoThank god, I never understood the EU directives that didn’t consider that by making sure things were implemented at a browser level it would cause an order of magnitude less work for web developers/site owners and ensure a consistent experience for end users.
- dom96 6y agoIt boggles my mind why they didn't think of doing this in the first place. I've been annoyed by the stupid cookie law since it became a law, it's ridiculous to have every single website implement it differently when the darn browsers can just implement it.
- Deukhoofd 6y agoThe cookie law is 18 years old, browsers have changed quite a bit since then, as has legislative understanding of the tech field.
- Kalium 6y agoHaving read through GDPR, I got the distinct impression that nobody involved in writing it really understood the technologies involved. There's a lot of handwaving about "reasonable measures" whenever they run into ignorance that's absent in the many chapters about inter-government protocols.
- mqus 6y agoGDPR was explicitly designed to be "general". Specifying website behaviour is a bit specific for a regulation that wants to regulate privacy at a whole (in virtual and reallife interactions). Of course that also means that the regulation is quite lacking when it comes to specifics but that wasn't its goal. The goal was to be a fallback-law which regulates everything that is not explicitly regulated otherwise. What you want is the ePrivacy Directive which "introduced" the cookie banners many years ago and its updated version which is (still) not ready.
- kerkeslager 6y agoFrankly, I'd be happy if sites just supported Do Not Track.
- tfehring 6y agoThey do support it, if including it as a level of granularity for fingerprinting counts as support. :-)
- Mirioron 6y agoThis should've been what was done from the get go. Browsers have given us control over cookies for a very long time now. But hey, it's the EU, there's a reason the EU has a lack of tech companies. I'm sure that when they finally do what you suggest they'll screw it up somehow as well.
- dgellow 6y agoYou want regulators to design APIs?
- Mirioron 6y agoWhat I want is irrelevant. I have as much say about what happens in the EU as I have say in US politics despite being from the EU. The politicians will do something stupid regardless and then years later not understand why things are going poorly. Meanwhile the Germans and French will love it, because it screws those evil evil American companies. So, the regulators might as well design APIs. It's hard to imagine that it would end up any worse than their usual.
- lifeAsNerd 6y agoI'm pretty grossed out that the internet has been taken over by the government. Blocking cookies should be done by users via software. This is only going to make the barrier to entry higher and more expensive. I have no idea what many small non tech businesses would do? Pay a few thousand every year when standards change?
- boomlinde 6y ago> This is only going to make the barrier to entry higher and more expensive. That's the point. We want the barrier to entry in widespread tracking to be high. For what it's worth, you don't need cookie consent warnings if you use them only for functionality integral to the product you offer your user. For example, if you need to use a cookie to facilitate a logged-in user session, you don't need to warn them. The only ones paying the high price is the people who use it to collect user information not essential to the service they provide to the user, for god knows what.
- centimeter 6y agoIt’s called “using an extension to manage cookies”. There are dozens of extensions for this. Encoding the usage of a particular (probably otherwise short-lived) technology in law is generally a pretty bad idea. Sure, have the EU write laws about cookies - the two outcomes are A) this becomes useless when people switch to a different tech stack that doesn’t use cookies B) we’re stuck using 30-year-old technology to try to get things done, at least for regulated industries like banking or government services. Like the IE regulatory situation in Korea but worse.
- p410n3 6y agoThe gdpr does NOT plainly state cookies. It refers to any form of user tracking from websites! Quoting recital 30 of gdpr "NATURAL PERSONS MAY BE ASSOCIATED WITH ONLINE IDENTIFIERS…SUCH AS INTERNET PROTOCOL ADDRESSES, COOKIE IDENTIFIERS OR OTHER IDENTIFIERS…. THIS MAY LEAVE TRACES WHICH, IN PARTICULAR WHEN COMBINED WITH UNIQUE IDENTIFIERS AND OTHER INFORMATION RECEIVED BY THE SERVERS, MAY BE USED TO CREATE PROFILES OF THE NATURAL PERSONS AND IDENTIFY THEM." https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/
- centimeter 6y agoWhen a corporate lawyer hears a law explicitly list technologies like "IP addresses" and "cookies", they're going to (rationally) get scared when you step outside the clear boundaries of that law, and it's their job to place institutional pressure on technical people within the corporation not to do things that make them scared.
- brownbat 6y ago> the IE regulatory situation in Korea I found this from 2013: https://www.zdnet.com/article/south-koreans-use-internet-explorer-its-the-law/ https://www.zdnet.com/article/south-koreans-use-internet-exp... Anyone have an update to that story? I know in Korea they use a ton of apps to order things all the time now. Maybe this law was phased out, or just didn't apply to phones? Not to take away from your broader point. Laws are just such a terrible development model. Everything's tested live and you can't easily revert anything.
- artursapek 6y agoSeriously. If there was ever something that needs standardization, it's this horrible cookie law crap.
- koonsolo 6y agoOh boy this really has come full circle. I'm an old dude, so I never understood why you would require websites to ask for cookie consent, when you can handle that more safely in your web browser. That's like putting a sticker on your car saying "Don't come into my car" instead of just locking it. Why do you need regulation when you can just let technology solve it? No idea. So NO! NO fucking cookie consent API! Just let the browser ask you when a cookie needs to get set... DAMNIT! In my day, website used to be websites where you could read stuff. Anyone who wasn't able to predict these annoying popups after HTML5 and GDPR, is seriously blind. (Sorry for the rant ;))
- freehunter 6y agoYeah in your day websites were websites where you could read stuff. But today they’re massive interactive applications. It’s not even remotely the same.
- koonsolo 6y agoWell, I don't want an article to be interactive.
- dash2 6y agoI so agree with this. I find the level of admiration for this painful law absurd. I'm stuck in Europe. I was fine without the GDPR. Now, I waste my time clicking "accept" because I don't have time to deal with this crap. Meanwhile, my university has hired what my stepfather would have called a "tweety little person" to police GDPR regulations. God knows what she does (she doesn't). God knows in what single way she has improved a single person's life. But she has a job now, and by God, she'll fight for it. I care about privacy, but there were options to manage this already - like browser extensions. You could download them if you cared, and if you didn't want to, you didn't have to. Government regulation, demanded by zealots, has added one hundred tiny frustrations per day to millions of ordinary people, caused an expensive pain to thousands of small websites, and created a new, wholly useless compliance industry. And is Facebook tracking me any less? Ha ha ha. Facebook can afford lawyers.
- boomlinde 6y agoYou don't need an API for it. Browsers can reject cookies at a protocol level (by simply not sending cookie headers), and indeed used to ask users whether they wanted to allow cookies from a certain domain or not. You can disable all cookies altogether in at least Firefox and Chrome. You can make them only last for the current session.
- nerdponx 6y agoThe problem as always is that, like Javascript, some cookies are still useful (saved login and 2FA status). Power users, upon request, should be presented with and asked to accept/reject/blacklist/whitelist cookies. Interestingly the only browser I know of that does this is Lynx, which is text-only and does not support Javascript.
- jchook 6y agoI use Brave + uBlock and get nearly this exact experience. Disconnect and Privacy Badger also work well.
- nerdponx 6y agoI use uBlock as well, but it doesn't have a convenient interface that allows me to inspect and modify cookie permissions. What is your workflow when visiting a new site and figuring out what cookies to allow?
- boomlinde 6y agoThen it's not so much a cookie consent API we're looking for but an "unwanted cookie" consent API. Issue immediately becomes political, which IMO is why previous attempts at such (Do Not Track header) have failed. With browsers you can of course default to blacklisting all cookies and add exceptions as you go. I did this privately in Firefox until I was sent to work from home during the pandemic, after which figuring out what cookies I needed to enable to get Teams to work proved too much of a hassle.
- 6y ago
- MiroF 6y agoDo Not Track was a failure because no state actor was forcing private companies to comply. Even if it had been an opt-in solution, no company would have respected it.
- Avamander 6y agoInterestingly DNT was used by Medium to some extent.