5 ms·

If you think cookie consents are messed up I recommend you to check out the advertising industry's IAB consent framework, which is their attempt to self-regulat

If you think cookie consents are messed up I recommend you to check out the advertising industry's IAB consent framework, which is their attempt to self-regulate in order to avoid or at least deflect external regulation: Its purpose is to enable them to share your personal data between hundreds or thousands of ad networks. We develop an open-source consent manager (https://klaro.kiprotect.com https://klaro.kiprotect.com) and considered implementing the IAB framework, after seeing how it works we decided not to though as we don't want to support privacy-invasive approaches. That said players like Google also use privacy as a strategic tool to force other players out of the ad market. Since Google can easily get first-party cookies into > 95 % of all browsers they won't be impacted by the restriction of third-party cookies. As most users go through their site many times per day they also have enough other signals they can use to track people without relying on cookies (user agent, IP address and a little Bayesian statistics is sufficient if you see enough traffic). They will probably continue to remove tracking capabilities that they don't need anymore from Chrome to slowly suffocate any remaining competitors that still rely on them.

ricardobeat 6y ago
That looks really nice. It is 118KB uncompressed though, that is a lot of code. What is in it besides storing preferences and conditionally executing the scripts?
- ThePhysicist 6y ago
  Well it's open-source, so you can have a look: https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro It uses Preact and a few JS helper libraries and includes translations for more than 10 languages currently. It also includes styles by default (though you can get a version without styles). The compressed size is 37 kB which I think is reasonable, smaller is of course better. We haven't prioritized size for now as it's comparable to a PNG/JPG and usually negligible on most sites, we might look into this in the future though.
  - jsf01 6y ago
    The parsing cost for 100+ kB of JavaScript is not negligible. Sure maybe the transfer over the network is comparable to an image file, but you can’t stop measuring there. And to claim “Lightweight” on the homepage for something that should be tiny when uncompressed is a bit of a stretch—lightweight compared to what?
    - ThePhysicist 6y ago
      Yes I guess we should update the site. When we started it was less than 20 kB (compressed), seems we have almost doubled in size! We added some functionality and additional languages over time, I will check the bundle though to see what takes up so much space, seems high to me as well. We’re developing this pro bono right now and don’t intend to monetize it, hence it does not always get the attention it might deserve.
DangerousPie 6y ago
Oh this looks very nice, might go and add this to one of my sites soon! Two small notes: - The Multilingual examples don't seem to work for me using the latest Firefox. The displayed form is always shown in English. - The folder with example configs doesn't actually seem to contain anything other than an i18n file Also, is there a function I can call in Javascript code to check if I have permission to set a certain type of cookie?
- ThePhysicist 6y ago
  Thanks for the heads up, seems the last release broke some things. Will fix those!
tannhaeuser 6y ago
Is there any way we could move forward towards a healthier (less monopolistic) situation that you see, such as going back to content-based ads? G has been closing alternate ad channels for a long while now, and the few remaining portals such as github.com are being taken over (with most of the HN crowd not realizing what's going on IMO). I can say that my web usage has changed quite drastically with GDPR banners popping up everwhere in EU - basically I don't visit those sites anymore, never go to featured stories on medium.com, etc.
Sephr 6y ago
I'm working on a zero-configuration consent manager: https://transcend.io/consent-manager https://transcend.io/consent-manager (blog post coming soon!) What makes our consent manager stand out is that it records all attempted tracking events and can replay the events later once consented. This helps site owners capture the entire user journey through their site.
- tomaskafka 6y ago
  > that it records all attempted tracking events Locally? While clever, I can't imagine how this would be GDPR-compliant when stored on (no matter whose) server side ...
  - voxic11 6y ago
    Maybe the client encrypts the tracking data it sends, but it only sends the decryption key after the user consents?
  - Sephr 6y ago
    Yes, locally on the browser. No data leaves your browser without your consent.
nerdponx 6y ago
If you think cookie consents are messed up I recommend you to check out the advertising industry's IAB consent framework, which is their attempt to self-regulate in order to avoid or at least deflect external regulation: Its purpose is to enable them to share your personal data between hundreds or thousands of ad networks. I always suspected this and mistrusted those opt-out tools, but I never had any evidence for it. Would you mind elaborating?
- Macha 6y ago
  Ultimately the consent framework is a list of common identifiers for entities (including as of 2.0, what they actually do with the data) and a standard way to send that between all the companies involved. The idea being that your popup will track that you consent to data sharing with e.g. DoubleVerify and 1000 others when you hit agree. Then as well the publisher interpreting this as consent to include DoubleVerify code on the page which may track you, they can send that list onwards to their other partners. e.g. AppNexus is also on the page, and they have a deal with DoubleVerify, AppNexus can read the list of people you've agreed to tracking from that the publisher sent them, see DoubleVerify in that list and assume they can (in the opinion of the IAB) share your data that was shared with them by the publisher or your browser, with DoubleVerify. The presumed transitive consent to 1000s of entities is the bit I assume that the parent poster is objecting to especially when so many of those modals are "default-accept", "we hid the reject button in three child links in the middle of legal text" etc., but I'm not sure why IAB's in particular is worse than others such as the parent poster's.

ricardobeat 6y ago

That looks really nice. It is 118KB uncompressed though, that is a lot of code. What is in it besides storing preferences and conditionally executing the scripts?

ThePhysicist 6y ago
Well it's open-source, so you can have a look: https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro It uses Preact and a few JS helper libraries and includes translations for more than 10 languages currently. It also includes styles by default (though you can get a version without styles). The compressed size is 37 kB which I think is reasonable, smaller is of course better. We haven't prioritized size for now as it's comparable to a PNG/JPG and usually negligible on most sites, we might look into this in the future though.
- jsf01 6y ago
  The parsing cost for 100+ kB of JavaScript is not negligible. Sure maybe the transfer over the network is comparable to an image file, but you can’t stop measuring there. And to claim “Lightweight” on the homepage for something that should be tiny when uncompressed is a bit of a stretch—lightweight compared to what?
  - ThePhysicist 6y ago
    Yes I guess we should update the site. When we started it was less than 20 kB (compressed), seems we have almost doubled in size! We added some functionality and additional languages over time, I will check the bundle though to see what takes up so much space, seems high to me as well. We’re developing this pro bono right now and don’t intend to monetize it, hence it does not always get the attention it might deserve.

DangerousPie 6y ago

Oh this looks very nice, might go and add this to one of my sites soon! Two small notes: - The Multilingual examples don't seem to work for me using the latest Firefox. The displayed form is always shown in English. - The folder with example configs doesn't actually seem to contain anything other than an i18n file Also, is there a function I can call in Javascript code to check if I have permission to set a certain type of cookie?

ThePhysicist 6y ago
Thanks for the heads up, seems the last release broke some things. Will fix those!

tannhaeuser 6y ago

Is there any way we could move forward towards a healthier (less monopolistic) situation that you see, such as going back to content-based ads? G has been closing alternate ad channels for a long while now, and the few remaining portals such as github.com are being taken over (with most of the HN crowd not realizing what's going on IMO). I can say that my web usage has changed quite drastically with GDPR banners popping up everwhere in EU - basically I don't visit those sites anymore, never go to featured stories on medium.com, etc.

Sephr 6y ago

I'm working on a zero-configuration consent manager: https://transcend.io/consent-manager https://transcend.io/consent-manager (blog post coming soon!) What makes our consent manager stand out is that it records all attempted tracking events and can replay the events later once consented. This helps site owners capture the entire user journey through their site.

tomaskafka 6y ago
> that it records all attempted tracking events Locally? While clever, I can't imagine how this would be GDPR-compliant when stored on (no matter whose) server side ...
- voxic11 6y ago
  Maybe the client encrypts the tracking data it sends, but it only sends the decryption key after the user consents?
- Sephr 6y ago
  Yes, locally on the browser. No data leaves your browser without your consent.

nerdponx 6y ago

Macha 6y ago
Ultimately the consent framework is a list of common identifiers for entities (including as of 2.0, what they actually do with the data) and a standard way to send that between all the companies involved. The idea being that your popup will track that you consent to data sharing with e.g. DoubleVerify and 1000 others when you hit agree. Then as well the publisher interpreting this as consent to include DoubleVerify code on the page which may track you, they can send that list onwards to their other partners. e.g. AppNexus is also on the page, and they have a deal with DoubleVerify, AppNexus can read the list of people you've agreed to tracking from that the publisher sent them, see DoubleVerify in that list and assume they can (in the opinion of the IAB) share your data that was shared with them by the publisher or your browser, with DoubleVerify. The presumed transitive consent to 1000s of entities is the bit I assume that the parent poster is objecting to especially when so many of those modals are "default-accept", "we hid the reject button in three child links in the middle of legal text" etc., but I'm not sure why IAB's in particular is worse than others such as the parent poster's.