19 ms·

Tangent: I wish the idiom of "placing" cookies would go away. Websites don't "place" cookies. Websites can include cookies in their HTTP responses. Your browser

• dcow 7y ago
  Cookie banners have taken the internet back 20 years. Now every website has a mandatory popup. And you can’t block these new breed because they're part of the site.
  • notechback 7y ago
    They are not mandatory, it's a choice by the site owner to include them. They are only mandatory if you include tracking features that track users across the web (= ads and Google analytics).
    • mfontani 7y ago
      One can include ads and analytics without consent being granted - they're "just" restricted to a method of delivering ads and performing analytics which don't track the user. IANAL, mind you - but that's how we implemented it - you're opting-in to the ads that target you and analytics which track you, or you get the non-tracking/non-targeting ads and analytics.
      • skrtskrt 7y ago
        What are some good non-tracking & non-intrusive ad providers? I've wondered about one day being able to put a few "ethical" ads on a blog site.
        • mfontani 7y ago
          I wouldn't say "ethical", but even Google's pubads can do non-tracking. For pubads, look into "setCookieOptions(1)" and "setRequestNonPersonalizedAds(1)" for a good start on the matter. It _can_ be done.
        • nicbou 7y ago
          Affiliate marketing is the best way to go. You have full control on how you advertise products. For my website [1], I have build close relationships with local experts. They provide services my readers need, and I know they can be trusted. I get a commission from resulting sales. I like that model because advertisers have zero access to or control over the readers' data. Unfortunately, it's simply not applicable to all websites. - [1] https://allaboutberlin.com/ https://allaboutberlin.com/
        • bartread 7y ago
          You don't need to look far. You can simply tell Adsense[1] to serve up non-personalised ads: (adsbygoogle=window.adsbygoogle || []).requestNonPersonalizedAds = true; If you do this you don't even need to check for consent since you're not tracking the user or storing any PII. In my case this is what I call if the user doesn't accept advertising cookies, but there's no reason you can't disable them completely on your site if that's what you'd like. You also have pretty tight control over the categories of ad that Adsense can display, and you can even go as far as to review individual adverts. I've booted a couple of ads that I found to be unethical/distasteful from my site using the review feature in Adsense. The only issue with Adsense is that there are a gazillion ads it might show on your site, so I'd recommend filtering out any categories you don't much like first, and then reviewing ads sorted by popularity/impressions in descending order, otherwise you'll quickly go mad. [1] Obviously not an option if you absolutely don't want to do business with Google.
    • nicbou 7y ago
      > across the web That part is not necessary. They are mandatory if you collect any form of personal data without legitimate interest.
    • cwbrandsma 7y ago
      Which means any website that does anything useful. That doesn't mean ads, but Google Analytics (or another comparable service) is just about everywhere these days.
      • yoz-y 7y ago
        It doesn't have to be a modal popup either. If your default is truly "off" then you could have a banner on top or bottom or somewhere saying something like "please help us make the site better..." or whatever.
      • kohtatsu 7y ago
        Google Analytics being everywhere is a at least an order of magnitude worse than the embedded like button spying.
        • TomMarius 7y ago
          I disagree. Facebook has much more power over advertising to their users (by personalizing the wall).
          • TeMPOraL 7y ago
            Facebook personalizes the Facebook wall. Google personalizes almost every other page you visit and mobile applications/games you use. Not sure how Facebook is more dangerous here.
            • TomMarius 7y ago
              No, it doesn't. I use adblock, as does a lot of other users. The FB wall is organized to my liking without any direct ads needed.
      • ferzul 7y ago
        but that isn't intrinsic to useful services. it is possible to run a profitable bookstore or organise an event without tracking individual users.
    • adrr 7y ago
      Or if you do Ab testing, or any e-commerce feature like a shopping cart. Internet is more than ad supported sites.
      • noisem4ker 7y ago
        Both false. A/B testing is allowed and doesn't need opt-in if the A-or-B preference is only recorded in aggregate form and not tied to the user. Same for the purchasing scenario. In this case, you would be explicitly collecting personal data to fulfill the order.
        • tripzilch 7y ago
          Crazy how people whose job it is to build this crap, don't even know what the actual rules are. It's almost as if they just want to collect all the data on all the users forever without any oversight, by continuously rehashing bad and misunderstood versions of the GDPR and pretending it's hard and complex and vague.
      • Jare 7y ago
        You don't have to assume your user wants to be A/B tracked, or wants to purchase anything. You can allow the user to enable them nicely and non-intrusively without a popup. You can ask the user intrusively when they actually initiate a purchasing action. Most sites choose do popup instead because (they think) it is more effective. So be it, but don't say it's "mandatory" or that "they are forced to".
      • goto11 7y ago
        You don't have to warn the users for using a cookie for a shopping cart. That is considered basic functionality.
    • nsxwolf 7y ago
      It's a choice so many site owners have made that the web is effectively ruined.
    • markdown 7y ago
      I refuse to include them. I am not a citizen of an EU country and I don't give a rats arse what the EU thinks of my website. They aren't the boss of me.
  • GvS 7y ago
    You can easily block them with uBlock.
    • dcow 7y ago
      How can I do this?
      • DangitBobby 7y ago
        Pretty sure GP is talking about the HTML elemenent blocker feature, which is not really a solution since you'd still have to use manually on each new site you visit.
      • noisem4ker 7y ago
        There are blocklists dedicated to cookie request elements. You can install one of those in your uBlock Origin and the banners will disappear. I use and appreciate this one: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
  • jimmaswell 7y ago
    And all for what, some feel-good legislation that accomplishes nothing but making the web less profitable and entrenching big companies that can afford the wasted resources of their legal team navigating it. Nobody has ever been hurt by a tracking cookie in the history of the internet. It reminds me a bit of legislation in other areas that aims to make something so inconvenient people give up on it, like the death by a thousand cuts to American gun owners with state laws making magazine limits smaller and smaller over time, banning this and that cosmetic feature that has no bearing on anyone's safety, etc. What is Europe's vested interest in doing this to the internet though, information control (regulate a few conglomerates instead of having to deal with a bunch of little sites, by stamping out the little sites) and spite towards America's much more prosperous tech sector?
    • matheusmoreira 7y ago
      > making the web less profitable This could actually be a good thing. These days advertisers act as censors: all it takes is a bunch of complaints and a website's revenue stream gets pulled. The webmasters react by deleting the controversial content and avoiding the subject in the future. If this is what a profitable internet looks like it should probably die. > Nobody has ever been hurt by a tracking cookie in the history of the internet. How do you know? > stamping out the little sites Social media is responsible for this. Few people buy domains these days, it's much easier to register a name on some existing site. Most traffic originates from social media these days.
      • vkou 7y ago
        > This could actually be a good thing. These days advertisers act as censors: all it takes is a bunch of complaints and a website's revenue stream gets pulled. The webmasters react by deleting the controversial content and avoiding the subject in the future. If this is what a profitable internet looks like it should probably die. This is how newspapers have operated for nearly a century, and how television operated for over 60 years. What do you expect will replace it? A reversion to the patronage system? I don't think Bloomberg or Murdoch paying for content to be made in the way they want it is going to be an improvement.
  • tjoff 7y ago
    No. In the pursuit of pure greed incompetent designers have taken the internet back 20 years. That people absolutely ruin the user experience of their site deliberately is an active decision they make themselves. Make an effort not to visit those sites. You will be surprised to know that people that make such bad decisions for their site seldom have any valuable content anyway.
  • Reason077 7y ago
    > ”Cookie banners have taken the internet back 20 years.” I agree. The EU cookie laws were well-meaning, but have had the unintended consequence of making the web more annoying, more difficult to use, and more fragmented. The solution? Cookie consent should be a built-in feature of browsers and http, not something that is reimplemented in a slightly different way by every single website. Your browser should pop up a standardised cookie consent request when you browse a new site, and enforce your selection as part of its security policy. If you choose to block all cookies (ie: private browsing mode) then the cookie consent request wouldn’t need to appear at all.
    • akersten 7y ago
      If only the regulators had been happy with (or even aware of?) the existing capabilities of browsers to manage cookie consent, like "Block 3rd party cookies" and "block all cookies" that have been around since the late 90's, we wouldn't even have needed to add anything new to websites or browsers!
      • cnorthwood 7y ago
        The legislators haven't legislated for a particular mechanism, they've just said that any tracking has to be opt in, as opposed to opt out. Do Not Track was a technical solution for this, but when IE made do not track the default, and tracking something you had to opt in to, they panicked and stopped supporting the headers and instead preferring the cookie walls, rather than trusting the browser settings. If websites respected UA settings, and the UA implemented DNT in a way that's compatible with the law (so, DNT: 0 only when you opt in), then we wouldn't be here
        • akersten 7y ago
          Not sure what DNT has to do with it. Do Not Track was circa 2009, we were already "here" at that point. The cookie law was like 2002.
      • kalleboo 7y ago
        EU legislators avoid legislating particular technical solutions, since those tend to not age well (see the uproar on HN when it was reported that the EU legislated to mandate USB-C, when they didn't actually do that, they just mandated that the industry agree on a standard)
  • d4rti 7y ago
    I should be able to set a browser preference that I only ever want functional first party cookies, unless I whitelist the site.
    • deleted 7y ago
      [deleted]
  • HenryBemis 7y ago
    > And you can’t block these I beg to differ. I use AdBlockPlus (ABP) and I can block 99% of these banners, and proceed immediately to the website. One can also use NoScript to block some websites that are full of crap/trackers (like techcrunch).
    • cookiengineer 7y ago
      AdBlock Plus is owned by eyeo GmbH which actively forces media and news agencies to pay fees to allow advertising in their "acceptable ads" program. You can look that up on northdata. I would heavily recommend to switch to uBlock Origin (and maybe uMatrix) instead. Disclosure: worked for eyeo in the past, and quit.
  • Causality1 7y ago
    Indeed. It doesn't make much difference to me if the pop-up I'm clicking out of is talking about cookies or offering me hot redheads in my area.
  • olalonde 7y ago
    What if browsers had an optional "consent to any cookie" setting that sent a `X-Cookie-Consent: Accept` header on every request? This header could be used by websites to decide whether to display the cookie consent popup. Would that be acceptable to EU regulators?
    • TeMPOraL 7y ago
      X-Cookie-Consent: Accept would be explicitly illegal; consent must be specific. However, I believe X-Cookie-Consent: Deny would be sufficient grounds to not bother with showing cookie popups and assuming the user does not consent. But you don't need that anyway; lack of consent is the default state. I propose a better alternative: just stop doing things requiring consent (which are, by definition, unnecessary, and almost always support an unethical business model), and then you won't have to annoy users with consent popups anymore.
      • olalonde 7y ago
        I'd say a better alternative would be to allow people who don't care about cookie tracking to opt out entirely from the consent popups. It wouldn't change anything for you but it would be a big improvement for people like me who don't mind tracking and are just annoyed by the popups. Too bad that it's now illegal...
        • TeMPOraL 7y ago
          It can't be, because we both know how would it end. If you allowed people to auto opt-in, then malicious actors on the web, which currently show you consent popups, would instead use dark patterns to get people who don't want to be tracked to permanently opt-in anyway.
  • tripzilch 7y ago
    > Now every website has a mandatory popup. Stop spreading this disinformation. It's just the filthy websites that track your every move on the site and then give it to third parties. Would you rather they do that by default, extracting your data before you even notice, without even being able to distinguish the bad actor from the good actor? The problem is that people think it's the cookie banner that's annoying, when it's in fact the very website that has been secretly abusing your privacy, except now they tell you. The people think that agreeing to the tracking banner is a fair transaction because the adtech banner is being disingenuous. It's as if the entrance to a museum requires you to dump one empty battery in the ocean. It's a bit of a hassle but it doesn't cost you anything, and you get to see the museum which is what you want. Except in 90% of the cases the museum is clickbait trash. I mean I agree. No website should use cookie banners. None of them. Increasing fines all around for those adtech fuckheads.
  • WhyNotHugo 7y ago
    Hint: You can use ublock origin. Go to its settings page, and check the "annoyances" lists. This hides all this BS. (I do entirely agree with you, the default internet is pretty much like you said, sadly)
  • zelphirkalt 6y ago
    I usually use uBlock Origin's element blocking to remove such popups, even if only for one time, or I use inspector to remove elements. If afterwards nothing is visible of the content, I leave. Seems like someone forgot to put the content on the page. shrugs
• diafygi 7y ago
  Is there a setting in Firefox that allows you to whitelist specific cookies and ignore all others? That combined with Firefox Containers would make for a very powerful combination since you could have different containers that would be your logged-in interface to a specific site, without then having to allow other sites be able to set cookies.
  • abdullahkhalids 7y ago
    I have the > Delete cookies and site data when Firefox is closed setting checked in preferences. There is a Manage Permissions button next to it that allows some more per-website control. Websites can place however many cookies they want. It won't help them track me past a day.
    • monadic2 7y ago
      Firefox also has a "always use private browsing" option that I've been using for about ~6 months with great success—with a password manager the only annoying thing to do is get through sms "2fa" gated auth—mostly banks, health insurance, etc.
      • mark_l_watson 7y ago
        Always private browsing as a default is a very good idea. I set Safari for auto-privacy. The overhead of manually opening a non-private browser when that is what I want is really a very small hassle. Setting up Safari this way and using FireFox only with containers for each major web platform works really well for me and I have been able to talk non tech friends into trying it.
  • jdlshore 7y ago
    The Cookie Autodelete extension does this.
  • arminiusreturns 7y ago
    It's been a while since I went the whitelist approach on cookies, but I think you can do this in the "manage permissions" section of the cookie area in settings. Whitelist a site and set default behavior to block will still allow that whitelisted site... I think so at least, maybe you need wildcards or something...
• vertex-four 7y ago
  The legislation also covers things like sharing that Joe Bloggs living in Summerstone Drive, or the user with email address jennifer1983@gmail.com, is looking for a new car, even without advertising cookies. The GDPR would be necessary even if advertising cookies were not a thing.
  • elric 7y ago
    I agree. The GDPR would be necessary. And it's a useful instrument (if still somewhat underused). The "cookie law" is what drove people to add cookie banners before GDPR was a thing. GDPR admittedly made them worse and more prevalent.
    • vertex-four 7y ago
      I'll also point out that vast swathes of cookies do not require a cookie popup, according to the European Commission's internal guidance; specifically, for their own websites, they believe that "cookies used for the sole purpose of carrying out the transmission of a communication" and "cookies that are strictly necessary in order for the provider of an information society service explicitly required by the user to provide that service" do not require a cookie popup. So, for example, CSRF cookies, login cookies, and so on and so forth do not require a cookie popup. That is - if you're building a website and using the bare minimum cookies you need to make the website function, you don't need a cookie popup. The default here is that you don't need a cookie popup, and when you start tracking users and/or selling their data, you need to comply with ePrivacy and the GDPR.
    • wlll 7y ago
      No, GDPR just forced website owners to air their dirty laundry. You don't need a cookie popup. See Basecamp.com, github.com etc. You only need one if you're asking the user for more data than is necessary to provide the service.
• lidHanteyk 7y ago
  I still liked PHK's suggestion for removing cookies entirely from HTTP/2 [0]. I seem to remember that they advocated for instead having the user agent send a profile ID which is only meaningful to the user agent. That would allow the server to know which requests belong to which profiled user, but allow the user full control over which profile is presented. [0] https://varnish-cache.org/docs/trunk/phk/http20.html#beating-http-1-1 https://varnish-cache.org/docs/trunk/phk/http20.html#beating...
  • throwaway3neu94 7y ago
    Everyone would've emulated cookies using HTML local storage, because it would be a pretty quick fix (just wrap all cookie API's). So you'd gain nothing except push people from a standard to an ad hoc solution. Switching to server side storage would've been a too costly architectural change. What if the server side was stateless before? And even if, web applications would still have needed to support the old model for interop reasons. It's not feasible for everyone to maintain code for both approaches when they are so different. It'd also break many use cases, such as using a (signed) cookie as cache for some really frequently used data. Or more importantly authentication, where an auth service returns a token (in some cases a token that can be checked by a different service without contacting the auth service again). So yeah, that was a non starter.
    • Erlich_Bachman 7y ago
      > What if the server side was stateless before? Then that's a pretty bad design choice to begin with? If some state is required for operation, but the website keeps it only on client? Not least of all reasons, for security?
      • toast0 7y ago
        You can make such state cookies tamperproof with server side signing. Depending on the state in question, leaving it with the client, instead of in server storage, makes for good lifetime management. Of course, if you want the state to be synced between different clients (for a logged in user or something), you'll need to do something else.
• fhrow4484 7y ago
  > The "opt-out" is just another cookie. There's nothing special about them either, they can be used to track return visitors just as well as any other cookie. I'm sure they're not, because that would be against the spirit of the law .. How is a opt out cookie the same as tracking cookie? Isn't there a clear difference for a cookie: is_opt_out: true Compared to a cookie: tracking_id: 374739585483292 Sure the first one can tell server "this is a user that had visited the page in the past". But this is nothing compared to the second one which tells server "this is this specific user"
  • est31 7y ago
    You might think it's just one bit of fingerprinting information, but if 99 of 100 users click "accept" and one user clicks "decline", it's suddenly become 6.6 bits. Now combine that with other fingerprinting data and you have uniquely identified the user. It's the same problem with pages where most users are logged in: the few who aren't are suddenly such a small group that they become identifiable through other means.
    • jcheng 7y ago
      Can you explain how you got 6.6 bits?
      • aDfbrtVt 7y ago
        Because it uniquely describes a user within a group of 100 other people. 2^(-6.6) ~ 1/100
      • user2342234 7y ago
        From Shannon's formula for information content[1]. The Idea is that the less likely an event is the more information it imparts. I = -log2(p) In this case they used p = 1/100 1 - https://en.wikipedia.org/wiki/Information_content https://en.wikipedia.org/wiki/Information_content
      • marksomnian 7y ago
        log2(1/100)
• jahewson 7y ago
  This is what Chrome has announced they are doing with “privacy sandbox” which is going to replace 3rd party cookies in 2 years time.
  • kohtatsu 7y ago
    I'll put money on Google bringing some of their own toys into that sandbox. https://news.ycombinator.com/item?id=22245101 https://news.ycombinator.com/item?id=22245101 https://source.chromium.org/chromium/chromium/src/+/master:components/google/core/common/google_util.cc?q=IsGoogleAssociatedDomainUrl&ss=chromium&originalUrl=https:%2F%2Fcs.chromium.org%2Fchromium%2Fsrc%2Fcomponents%2Fgoogle%2Fcore%2Fcommon%2Fgoogle_util.cc https://source.chromium.org/chromium/chromium/src/+/master:c...
• Guest0918231 7y ago
  I think the following should happen... 1. Do a study and check how many people want to be tracked. Don't trust the data from websites because everyone is currently being tricked into accepting. Go out on the street, talk to someone for 5 minutes about how tracking works, how it can lead to more relevant advertising and a potential increase in revenues for the service they're using, but in return their browsing history, purchases, and communication will be tracked and associated with them. How many want to be tracked? 2. If 80%+ of people do not want to be tracked, then just create a law saying it's not allowed. That's it, we're done. 3. If less than 80% of people don't want to be tracked, then force browsers to prompt users on install to ask if they want to accept tracking. Websites, analytics, advertisers, etc, then need to respect that setting or risk being fined. No need for every website in the world to invent their own cookie/tracking pop-up system, and no need for people to adjust their settings on a per-site basis.
  • Jare 7y ago
    > force browsers to prompt users Given how many people think the EU did a bad job defining cookies, tracking, tracking methods and etc, it would be fun to see what they would think about he definition of a "browser" as something that can be forced to implement a certain feature.
  • stared 7y ago
    > 1. Do a study and check how many people want to be tracked. Ask the same people if they wanted websites to stay free. I bet 80%+ would want to eat a cookie, a have it too. (No anti-pun intended!) (Side note: the proposition of banning things if 80% don't want to use them is dangerous. No wanting something personally is not the same as banning it for everyone.)
    • Guest0918231 7y ago
      Not quite the same, because right now tracking is suppose to be opt-in. Free cookies are not. A fair comparison would be a law saying people need to opt-in for paying for a cookie. You can't charge the customer or hide the information, they need to agree to pay for the cookies, and they need an equally clear option to not pay for them. However, stores bend the rules. They have someone stand at the entrance saying, "Thanks for coming to our store, we have cookies for sale at $0.99. Would you like to come in?" If you say yes, then you're charged for cookies you buy. To get the cookies for free, you need to realize you can say "No" to entering the store, and then through a complex 5 minutes conversation, you can get the person to let you into the store for the free cookies every person is allowed to have according to the law. Most people don't know about the free cookies. Others can't figure out the correct questions to ask to get permission to enter the store for the free cookies. Some people want the free cookies but they don't have 5 minutes to waste talking to the person, so they just decide to pay. At the end of the day though, of course everyone wants the free cookies. I want them. You want them. The law says the store is required to give free cookies. Why introduce all the complex interactions and rules that businesses will not follow, and customers will find annoying? Just give everyone the cookies and be done with it. If you don't want a blanket statement allowing free cookies everywhere, what's the ideal process? 97% of people want free cookies all the time. 2% of people want free cookies "sometimes". 1% of people never want free cookies. Asking people at each store for their preference (similar to a website cookies pop-up) is only beneficial to the 2% "sometimes" crowd. For the other 98%, they're just being annoyed and repetitively giving the same answer to every store. Require the banks to allow a setting on credit cards to toggle free cookies on or off, and have stores respect that setting without needing to ask.
• TheCoelacanth 7y ago
  GDPR is about the collection of people's personal data, regardless of the mechanism you use to do it. There are plenty of ways to collect data about people without using cookies to do it, so GDPR would still be needed no matter what measures browsers took to block tracking cookies.
• ChuckMcM 7y ago
  Except that many modern web modalities only "work" if there is a cookie to tell them the state of your session with respect to the current display. (Think displaying page 7 of 10 pages of results for example) Too many people were using this as a way to get a blanket acceptance of cookies, which not only included specific state to make the web site work, but other tracking cookies. What I see when I read this ruling is that you can't bundle the two. You have to allow the user to say "No, I don't consent to any cookies that provide PII." and then stop using them.
  • toast0 7y ago
    > (Think displaying page 7 of 10 pages of results for example) You don't need cookies for that. But, if you insist that you do, that can easily be a session cookie, not a stored cookie. And there's no need to obtain consent for a cookie like this, if it's not used to identify or track a (EU) person.
• m12k 7y ago
  I wish browsers worked in a way where placing a cookie on my computer came with a permission dialog like sending notifications, or using my location, microphone or camera does. I guess the browser could have some logic around detecting login screens, so it can tell that I just entered a username and password, so the session cookie from that site gets a pass (I think automatic popup blocking works in a similar way). Or move it up a notch, so it blanket blocks cookies anything that doesn't look like a login and shows a permission prompt only for the first time I do a login for a new site (which then gets whitelisted).
  • zozbot234 7y ago
    That's the way things used to work, but these popup dialogs became an annoyance as sites started using 3rd-party cookies pervasively, and the simpler "always accept"/"always deny" model took hold. Perhaps with 3rd-party cookies being increasingly limited by default browser configurations, we'll ultimately turn back to that model.
    • ferzul 7y ago
      really? when? i don't remember. and to this day, cookies in firefox are managed in a hidden box with a giant list of all the sites you've ever accepted. they don't want you to manage these permissions. but for permissions they intent for you to manage, you click the security icon and you can revoke what you don't want. if the only permission you granted is the right to store cookies, it says you haven't granted any permissions, although this is a lie.
      • jefftk 7y ago
        Here are examples from IE3 and Netscape 3: https://twitter.com/uygarr/status/1003784413644316672 https://twitter.com/uygarr/status/1003784413644316672
      • smichel17 7y ago
        I remember at one point -- not sure exactly what year, I'd guess around 2010-2012 -- Firefox had a cookie option "ask me every time". It popped up a dialog each time a site wanted to set a cookie, with options to accept, decline, and whitelist/blacklist the site that was asking. I used it for a week or two, maybe. I stopped because it made the web unbrowseable. If you think one banner per site is bad, imagine at least 5 consecutive popups to start, plus the possibility of more when you took any persistent action our the site loaded a new 3rd party resource. And if you don't choose the whitelist/blacklist option right away, it's the same thing the next time you visit. I stuck with it until it became clear that I was not going to run out of domains to whitelist -- ie, this was a never-ending workload -- and switched to accepting only first-party cookies. I don't think there was an option to decline 3rd party and ask for 1st party; I probably would have used it.
• Nursie 7y ago
  It doesn't requite banners. No tracking-by-default, no need for a banner.
• goto11 7y ago
  The problem is cookies are fine and necessary for legitimate functionality, e.g. if you want a persistent shopping basket. But a user or user agent have no way of knowing what a given cookie is used for. Therefore the legislation requires to warn if cookies are used for non-functional purposes like tracking.
  • elric 7y ago
    You don't need cookies for a persistent shopping basket. If I want a persistent shopping basket, give me the option to create an account and store my shopping basket for later use. Otherwise, just nuke my shopping basket when my session cookie expires. This is a non-issue. Of course it's not visitors who want persistent shopping baskets. It's sellers. And I don't really care about what they want. On ~100% of the websites I visit, I'm the visitor, not the seller. And given that webshops were a thing before persistent shopping baskets were a thing, I'll wager they can do without.
    • goto11 7y ago
      Logging into an account requires some kind of persistent identifier. And it is not just for shopping carts - you also have a login and cookie here on Hacker News.
      • saagarjha 7y ago
        And such a cookie one that is necessary for the site to function, and as such not covered by cookie laws.
        • Kiro 7y ago
          Yes, but elric is arguing that even those kind of cookies are unnecessary. Meaning I would have to log in every time I visited Hacker News.
          • saagarjha 7y ago
            I think they said it was unnecessary until you logged in, which was the thing that the Hacker News cookies were being used for?
• vbezhenar 7y ago
  Soon all cookies will be treated with SameSite=Lax policy, unless website specifies otherwise. That means that by default it won't be possible to track users on other websites. It's still possible to track users with cookies using SameSite=None, but it's expected that most cookies should not use this setting, so browsers theoretically could use an approach similar to allowing notifications or location services: ask user for permission before accepting that cookie. So if that UI will be deployed, may be those popups won't make sense anymore.
• monadic2 7y ago
  What's the meaningful difference to people who don't write their own HTTP agents?
• gpderetta 7y ago
  FWIW, GDPR has very little to do with cookies.
• deleted 7y ago
  [deleted]
• deleted 7y ago
  [deleted]
• deleted 7y ago
  [deleted]
• lilyball 7y ago
  If this was a browser thing and not mandated by law, sites would just intentionally make their sites break if your browser didn't accept cookies and then tell you that you have to accept the cookie to make the site work.
  • saagarjha 7y ago
    …and this is exactly what they used to do, so this isn't even a hypothetical.
  • ukyrgf 7y ago
    The only difference between this and the web ~15 years ago is that they didn't even tell you it was a cookie issue. If you couldn't access the site, then "uhh try using Internet Explorer?"
  • elric 7y ago
    Had this been implemented 15 years ago, people's awareness might have grown and they might have decided to not visit sites that are obviously broken. Many sites only worked properly in IE for ages. Other browsers reaching critical mass forced the issue, and the web became better for it. You're probably right that it won't be happening now..the cat's out of the bag.
• JoshTriplett 7y ago
  > If more browsers were still User Agents in the literal sense, maybe we wouldn't have needed this legislation. Browsers could have informed people about what cookies were, and could have presented the user with the option to never accept tracking cookies from Big Advertising. Unfortunately, cookies are not conveniently labeled as "advertising" or "federated login". That said, yes, it'd be nice if the legislation in question had mandated proper labeling of cookies, and then let the user's browser handle rejecting them.
  • takeda 7y ago
    That sounds good, but an infrastructure needs to be developed first, particularly a way to label which cookie is which and then have a law to enforce it. Ultimately though by default I use extension to destroy cookies as soon as I leave the page, I can place an exclusion for sites that I frequent but when I do that I just allow all cookies. My reasoning is that if I have credentials they can track me using these anyway. Anyway the whole thing is moot though, since advertisers are beyond cookies and use many other ways to track users. Now seems what their primary goal is, is to be able to tie multiple devices of the same user together.
• om2 7y ago
  Safari takes this seriously and now blocks all third party cookies by default.
• quickthrower2 7y ago
  I wonder if we need instead of a "big fat cookie jar" browsers should support authentication natively (i.e. they are aware that this is authentication, not that just there is some cookie called "session") and then we depreciate cookies entirely. Now that the auth headers are known about, they can be treated as such and expired based on user preferences, but by default after 24h. There can be an alert "google.com has logged you in and now knows who you are until you log out". Auth headers are then only sent for a single origin, so no scripts to track you around the web anyway. The cookie workaround for those that need to genuinely use them are 1. session feature mentioned above - tie to that on the server side and 2. stick something in the URL and then keep tracking that via links, like most SPAs do anyway. Want to do analytics? Anonymous-ish pixel or server logs. Local storage is another issue, that should be permission based. (+ any other dodgy web apis). Someone might say, what about a site you don't log into but needs to remember your prefence? A. Easy local storage, and it will ask for permissions AWS style e.g. "enter the name of the site to agree ____" Maybe get rid of UA string?
• dannyw 7y ago
  How can you reconcile this with the unfortunate situation that the world’s most popular browser is made by the world’s biggest tracking (aka spyware and adware with consent) company?
• ezoe 7y ago
  Why don't you just disable the cookie in the browser you are running in the computer you own? If you can't, that means you have no control over the computer and software you own.
• x3blah 7y ago
  "If more browsers were still User Agents in the literal sense, maybe we wouldn't have needed this legislation." s/browsers/popular &/ There are browsers and other clients that are still User-Agents in the literal sense but they are not the popular ones. The popular browsers measure their success by market share, not qualitative measures. That is why Firefox tries to stay more or less in lock step with the leading browser on features. This is not done out of fear of being inferior by some qualitative measure but out of fear of losing market share.
• ornornor 7y ago
  There is a nifty Firefox extension (maybe it exists for chrome too, haven’t checked) called “I don’t care about cookies” It discards most of these popups. Coupled with unlock origin and decentraleyes, I think you’re pretty well covered against tracking without too much hassle. Of course temporary containers is the cherry on top (although amazon seems to have a way to recognize you anyway because it almost always only asks me for my email before logging me in)
• WhyNotHugo 7y ago
  I do think this needs to be rethough from scratch. When a website sends cookies, prompt the user "this website wants to track you, allow it? y/n". The same way microphone/camera access it prompted. So it should be fine to reject this for news sites, a random museum, etc, but okay to accept for, eg: webmail, sites where you log in, etc. We've simplified browsers UI so much, a SINGLE toggle button for this would be lovely!