8 ms·

I just click agree and then flush the cookies regularly which usually is much easier than find the way to deny. The EU should better force them to respect the d

I just click agree and then flush the cookies regularly which usually is much easier than find the way to deny. The EU should better force them to respect the do-not-track header - this would be a way handier. I hope the law gets an upgrade soon requiring everybody to offer an easy "deny all tracking and proceed" button. The only case when I actually don't mind to be tracked (by the first party only, anyway) is when I register and sign-in.

smichel17 6y ago
DNT also needs an equivalent "Do Track" header (dnt: 0?). That way people who want to opt in without clicking boxes can, and lack of the header can't be misconstrued as consent. edit: uallo points out below that this is the specification. I didn't realize because none of the browsers implement it.
- qwerty456127 6y ago
  Although I'm very anti-tracking, I don't think the don-not-track policy should be the default. This is not going to work this way. The whole DNT thing has actually been killed by Microsoft setting it on by default. Let the people who don't care to go and toggle the checkbox in the browser settings be tracked. It also should be possible to set the DNT field on per-domain basis.
  - Pesthuf 6y ago
    It absolutely shouldn't. Advertisers STILL cite that Microsoft incident as the reason they don't support DNT, even though this happened 8 years ago. Just goes to show how dishonest they are. Ironically they don't ignore DNT - they use it as part of their fingerprinting... I think if DNT was per Domain, advertisers would let your browser make a bunch of requests to different domains and check for which you have DNT set, which should give a fairly unique fingerprint...
  - corty 6y ago
    DNT wasn't killed by Microsoft. DNT was killed by advertisers looking for any reason to kill DNT. They just found Microsoft's default as their excuse to ignore DNT.
  - dmitriid 6y ago
    Nothing to do with MS. Moreover, Safari is removing DNT because DNT is now used as an extra parameter in browser fingerprinting ... to better track users.
  - freeone3000 6y ago
    That seems very sour grapes - a major vendor said that it's gonna ship a browser with a setting configured, and everyone chooses to ignore that setting because it's common? That's pathologic thinking.
  - Nursie 6y ago
    Do Not Track was always a joke. As if asking nicely ever worked with the ad industry. The point of the law changes is that it becomes the website's responsibility to act properly, and ensure real opt-in. If DNT was default off and was respected, most people would have never heard of it to switch it on. That's the only reason the ad industry even comment on it - it was designed to do nothing.
    - qwerty456127 6y ago
      > The point of the law changes is that it becomes the website's responsibility to act properly, and ensure real opt-in. Yet they still don't. They just manipulate the user into clicking yes without reading, again. I couldn't even find how to deny "the Oath" no matter how hard I tried.
      - Nursie 6y ago
        The Oath pages are the worst. Blatant violation. Hopefully sometime it will be prosecuted. Until then treat as a big red flag.
- uallo 6y ago
  > dnt: 0 Yes, that is exactly how it was specified: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
- Izkata 6y ago
  > I didn't realize because none of the browsers implement it. It's in Firefox under Preferences -> Privacy and Security -> bottom of Enhanced Tracking Protection. Or just search for "do not track". Privacy Badger has a separate setting (enabled by default) if you have that addon installed, and the header is sent if it's enabled in either place. I know about these because I had a hell of a time at work adding Mixpanel to something. They respect this header. Unfortunately, I think it also means we underestimate the number of Firefox users we have.
  - smichel17 6y ago
    Firefox lets you set 'DNT: 1' if you don't want to be tracked, using the setting you describe, but does not have a setting to send 'DNT: 0', indicating that you are okay being tracked. As a result, there is ambiguity about whether lack of a header means nothing or means "tracking is ok". If browsers let you broadcast your willingness to be tracked, advertisers wouldn't be able to make the (bad faith) argument that it's ok to track just because someone didn't set the header.
asicsp 6y ago
>I just click agree and then flush the cookies regularly Could also use private/incognito windows for new domains. That's what I do.
Nextgrid 6y ago
The problem with clicking agree is that you give them legal basis to track you which goes beyond cookies and involves IP addresses & browser fingerprinting.
- deleted 6y ago
  [deleted]
- Tepix 6y ago
  Next time you return with no cookies they have no way knowing it's you even if you keep the IP address. The way to know if someone gave consent if by looking at the cookie.
  - probably_wrong 6y ago
    But that's exactly the OPs point: with browser fingerprinting, they could know it's you even if you have no cookies, because they could have enough information to identify you anyway. Sure, you deleted your cookies, but since you agreed to be tracked anyway they can do it via other means. Unless you mean that consent must be stored as a cookie because the law says so. If that's the case my comment doesn't apply, but I'm not sure whether that is what you mean.
  - Nextgrid 6y ago
    Even if consent is stored in a cookie, given that you always accept, they can use fingerprinting right after you pressed accept the second time to link all your sessions together even if consent itself is indeed stored as cookies.
  - masklinn 6y ago
    They can fingerprint your browser when you accept, and when you come back after having cleared your cookies and accept again, match the two fingerprints and know you've come back.
andrepd 6y ago
This interface should be all handled by the browser. It was a mistake not to do this. It makes no sense that blocking cookies should be done via inconststent and dubious interfaces implemented by the websites themselves. Much better that the law would specify minimum standards for browser interfaces to make those choices (which btw would be trivially implemented, vs forcing the sites to spend time and money to implement a shitty js pop-up). Plus you are assured that cookies are really blocked. As for server-side fingerprinting, the browser, upon the user's choice, would send the allow/deny information to the website, which is forced by law to honor it (as it is today).
- joekrill 6y ago
  This is a very naive response. Rarely is anything "trivially implemented". And if it's so trivially implemented, why haven't we seen a browser vendor implement something already? Websites have been circumventing attempts to prevent fingerprinting for a long, long time. To act like this is some simple task is hugely misleading.
  - gameswithgo 6y ago
    Old man programmer here. I also think it is trivially implemented. What is hard is having the world agree to and craft such a standard.
    - kergonath 6y ago
      Young person programmer here. There are a couple of privacy-oriented browsers. If it were really trivial, it’d have been implemented already. Just look at the cat and mouse game between Apple and advertisers around Safari, and the new fingerprinting techniques that show up every now and then. Not much is trivial in web browsers. There is zero need for standards, which won’t happen anyway because of the power Google has with Chrome.
      - _jal 6y ago
        I think you didn't understand the proposition. Browser authors cannot unilaterally implement a proposal that has server-side and legislative components.
lowwave 6y ago
Not counting the sites that require login. There is NO web sites that Need cookies to function. Please don't show me that there are cookies that the site need to function.
- chriswarbo 6y ago
  Explicit consent isn't needed if the cookies are required for the site to function. Logins, highscores, shopping carts, etc. can assume implied consent. Only malicious activity like surveillance requires explicit consent (e.g. via a banner).
npteljes 6y ago
>I just click agree and then flush the cookies regularly I have this automated with Firefox + the Temporary Containers addon. Every new tab is a new, disposable container, which gets deleted some time after I close the tab.
Nursie 6y ago
> I hope the law gets an upgrade soon requiring everybody to offer an easy "deny all tracking and proceed" button That's effectively what there should be, right next to the "accept" button, and after a plain, simple piece of text that says "We would like to share your data with advertisers and trackers, because we get paid for that, can we have your permission?" There shouldn't even be any cookie-flushing necessary, the kind of functional cookie that effectively says "do not track" is allowed without notification or consent. That should be enough to stop the harassment. It never is though.
- chriswarbo 6y ago
  All cookies are allowed, with no popups required, if they provide functionality that the user wants (e.g. shopping carts, login sessions, etc.). Remembering that the user has refused to consent to spying is perfectly valid functionality, so no consent is required to store that in a cookie. Explicit consent is only required when the user's personal data will be used for purposes other than implementing the functionality the user wants to use. In other words, spying. If you see a "cookie banner", it's because the site you're visiting wants to act against your interests, and GDPR made that illegal by default. Ask the site to stop acting maliciously, and then they won't need a banner.
  - dorgo 6y ago
    >and GDPR made that illegal by default Why didn't GDPR make it illegal in general then, if it is such a no-brainer?
    - chriswarbo 6y ago
      Why don't you make it illegal? Presumably because you don't have the political clout to do so. I would bet the EU didn't either (e.g. actions by EU member states like the UK seem to be heavily in favour of surveillance-capitalism, so they would presumably veto any outright ban). It would also be an incredibly restrictive thing to do. Consider copyright laws as an analogy: they are "all rights reserved", making it illegal to copy, distribute, perform, etc. a copyrighted work by default. That is very different to an outright ban on copying, distributing, performing, etc. a copyrighted work (it would be illegal to show movies in theaters, or to publish books!). Interestingly, GDPR doesn't allow incentives to be given in exchange for consent. People can incentive publishers to distribute copies of copyrighted books, by providing money (i.e. buying the books). Surveillance networks cannot pay users to give up their personal data. This is a nice asymmetry of GDPR, in the public's favour.
burtonator 6y ago
It's going to be interesting to see how the world changes if it was easy to just disable all types of tracking. Most people, if asked would just block all ads on TV, radio, print, and web. But then prices for products themselves would skyrocket. There wouldn't be any free webapps, etc. For example, Facebook would have to charge money. It might make the world a better place. Might not. If I were forced to be though I suspect it would be a good thing
- anang 6y ago
  Context based advertising doesn’t require cookies or storing/transmitting personal information. Advertising would be just fine. Facebook netted $18 billion in 2019, there’s a long ways to go before they aren’t making money.
- Izkata 6y ago
  > There wouldn't be any free webapps, etc. Sure there would. The pattern would be "pay for more features", the free version being more of a limited demo. This used to be a common pattern among Android apps, even without ads on the free version in the early days.
cameldrv 6y ago
Yeah but they'll save your IP, OS, screen resolution, etc, so they have an extremely good chance of being able to reidentify you.
divbzero 6y ago
I too wish opt-in/opt-out could be browser settings, and communicating user intent to websites using the DNT: 1 request header could be respected as a legally significant signal.
Sir_Substance 6y ago
I use ublock origin to selectively block the consent boxes. I've never yet seen a website which says "our backend has noticed you have not yet consented, you may not continue".

smichel17 6y ago

DNT also needs an equivalent "Do Track" header (dnt: 0?). That way people who want to opt in without clicking boxes can, and lack of the header can't be misconstrued as consent. edit: uallo points out below that this is the specification. I didn't realize because none of the browsers implement it.

qwerty456127 6y ago
Although I'm very anti-tracking, I don't think the don-not-track policy should be the default. This is not going to work this way. The whole DNT thing has actually been killed by Microsoft setting it on by default. Let the people who don't care to go and toggle the checkbox in the browser settings be tracked. It also should be possible to set the DNT field on per-domain basis.
- Pesthuf 6y ago
  It absolutely shouldn't. Advertisers STILL cite that Microsoft incident as the reason they don't support DNT, even though this happened 8 years ago. Just goes to show how dishonest they are. Ironically they don't ignore DNT - they use it as part of their fingerprinting... I think if DNT was per Domain, advertisers would let your browser make a bunch of requests to different domains and check for which you have DNT set, which should give a fairly unique fingerprint...
- corty 6y ago
  DNT wasn't killed by Microsoft. DNT was killed by advertisers looking for any reason to kill DNT. They just found Microsoft's default as their excuse to ignore DNT.
- dmitriid 6y ago
  Nothing to do with MS. Moreover, Safari is removing DNT because DNT is now used as an extra parameter in browser fingerprinting ... to better track users.
- freeone3000 6y ago
  That seems very sour grapes - a major vendor said that it's gonna ship a browser with a setting configured, and everyone chooses to ignore that setting because it's common? That's pathologic thinking.
- Nursie 6y ago
  Do Not Track was always a joke. As if asking nicely ever worked with the ad industry. The point of the law changes is that it becomes the website's responsibility to act properly, and ensure real opt-in. If DNT was default off and was respected, most people would have never heard of it to switch it on. That's the only reason the ad industry even comment on it - it was designed to do nothing.
  - qwerty456127 6y ago
    > The point of the law changes is that it becomes the website's responsibility to act properly, and ensure real opt-in. Yet they still don't. They just manipulate the user into clicking yes without reading, again. I couldn't even find how to deny "the Oath" no matter how hard I tried.
    - Nursie 6y ago
      The Oath pages are the worst. Blatant violation. Hopefully sometime it will be prosecuted. Until then treat as a big red flag.
uallo 6y ago
> dnt: 0 Yes, that is exactly how it was specified: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
Izkata 6y ago
> I didn't realize because none of the browsers implement it. It's in Firefox under Preferences -> Privacy and Security -> bottom of Enhanced Tracking Protection. Or just search for "do not track". Privacy Badger has a separate setting (enabled by default) if you have that addon installed, and the header is sent if it's enabled in either place. I know about these because I had a hell of a time at work adding Mixpanel to something. They respect this header. Unfortunately, I think it also means we underestimate the number of Firefox users we have.
- smichel17 6y ago
  Firefox lets you set 'DNT: 1' if you don't want to be tracked, using the setting you describe, but does not have a setting to send 'DNT: 0', indicating that you are okay being tracked. As a result, there is ambiguity about whether lack of a header means nothing or means "tracking is ok". If browsers let you broadcast your willingness to be tracked, advertisers wouldn't be able to make the (bad faith) argument that it's ok to track just because someone didn't set the header.

asicsp 6y ago

>I just click agree and then flush the cookies regularly Could also use private/incognito windows for new domains. That's what I do.

Nextgrid 6y ago

The problem with clicking agree is that you give them legal basis to track you which goes beyond cookies and involves IP addresses & browser fingerprinting.

deleted 6y ago
[deleted]
Tepix 6y ago
Next time you return with no cookies they have no way knowing it's you even if you keep the IP address. The way to know if someone gave consent if by looking at the cookie.
- probably_wrong 6y ago
  But that's exactly the OPs point: with browser fingerprinting, they could know it's you even if you have no cookies, because they could have enough information to identify you anyway. Sure, you deleted your cookies, but since you agreed to be tracked anyway they can do it via other means. Unless you mean that consent must be stored as a cookie because the law says so. If that's the case my comment doesn't apply, but I'm not sure whether that is what you mean.
- Nextgrid 6y ago
  Even if consent is stored in a cookie, given that you always accept, they can use fingerprinting right after you pressed accept the second time to link all your sessions together even if consent itself is indeed stored as cookies.
- masklinn 6y ago
  They can fingerprint your browser when you accept, and when you come back after having cleared your cookies and accept again, match the two fingerprints and know you've come back.

andrepd 6y ago

This interface should be all handled by the browser. It was a mistake not to do this. It makes no sense that blocking cookies should be done via inconststent and dubious interfaces implemented by the websites themselves. Much better that the law would specify minimum standards for browser interfaces to make those choices (which btw would be trivially implemented, vs forcing the sites to spend time and money to implement a shitty js pop-up). Plus you are assured that cookies are really blocked. As for server-side fingerprinting, the browser, upon the user's choice, would send the allow/deny information to the website, which is forced by law to honor it (as it is today).

joekrill 6y ago
This is a very naive response. Rarely is anything "trivially implemented". And if it's so trivially implemented, why haven't we seen a browser vendor implement something already? Websites have been circumventing attempts to prevent fingerprinting for a long, long time. To act like this is some simple task is hugely misleading.
- gameswithgo 6y ago
  Old man programmer here. I also think it is trivially implemented. What is hard is having the world agree to and craft such a standard.
  - kergonath 6y ago
    Young person programmer here. There are a couple of privacy-oriented browsers. If it were really trivial, it’d have been implemented already. Just look at the cat and mouse game between Apple and advertisers around Safari, and the new fingerprinting techniques that show up every now and then. Not much is trivial in web browsers. There is zero need for standards, which won’t happen anyway because of the power Google has with Chrome.
    - _jal 6y ago
      I think you didn't understand the proposition. Browser authors cannot unilaterally implement a proposal that has server-side and legislative components.

lowwave 6y ago

Not counting the sites that require login. There is NO web sites that Need cookies to function. Please don't show me that there are cookies that the site need to function.

chriswarbo 6y ago
Explicit consent isn't needed if the cookies are required for the site to function. Logins, highscores, shopping carts, etc. can assume implied consent. Only malicious activity like surveillance requires explicit consent (e.g. via a banner).

npteljes 6y ago

>I just click agree and then flush the cookies regularly I have this automated with Firefox + the Temporary Containers addon. Every new tab is a new, disposable container, which gets deleted some time after I close the tab.

Nursie 6y ago

> I hope the law gets an upgrade soon requiring everybody to offer an easy "deny all tracking and proceed" button That's effectively what there should be, right next to the "accept" button, and after a plain, simple piece of text that says "We would like to share your data with advertisers and trackers, because we get paid for that, can we have your permission?" There shouldn't even be any cookie-flushing necessary, the kind of functional cookie that effectively says "do not track" is allowed without notification or consent. That should be enough to stop the harassment. It never is though.

chriswarbo 6y ago
All cookies are allowed, with no popups required, if they provide functionality that the user wants (e.g. shopping carts, login sessions, etc.). Remembering that the user has refused to consent to spying is perfectly valid functionality, so no consent is required to store that in a cookie. Explicit consent is only required when the user's personal data will be used for purposes other than implementing the functionality the user wants to use. In other words, spying. If you see a "cookie banner", it's because the site you're visiting wants to act against your interests, and GDPR made that illegal by default. Ask the site to stop acting maliciously, and then they won't need a banner.
- dorgo 6y ago
  >and GDPR made that illegal by default Why didn't GDPR make it illegal in general then, if it is such a no-brainer?
  - chriswarbo 6y ago
    Why don't you make it illegal? Presumably because you don't have the political clout to do so. I would bet the EU didn't either (e.g. actions by EU member states like the UK seem to be heavily in favour of surveillance-capitalism, so they would presumably veto any outright ban). It would also be an incredibly restrictive thing to do. Consider copyright laws as an analogy: they are "all rights reserved", making it illegal to copy, distribute, perform, etc. a copyrighted work by default. That is very different to an outright ban on copying, distributing, performing, etc. a copyrighted work (it would be illegal to show movies in theaters, or to publish books!). Interestingly, GDPR doesn't allow incentives to be given in exchange for consent. People can incentive publishers to distribute copies of copyrighted books, by providing money (i.e. buying the books). Surveillance networks cannot pay users to give up their personal data. This is a nice asymmetry of GDPR, in the public's favour.

burtonator 6y ago

It's going to be interesting to see how the world changes if it was easy to just disable all types of tracking. Most people, if asked would just block all ads on TV, radio, print, and web. But then prices for products themselves would skyrocket. There wouldn't be any free webapps, etc. For example, Facebook would have to charge money. It might make the world a better place. Might not. If I were forced to be though I suspect it would be a good thing

anang 6y ago
Context based advertising doesn’t require cookies or storing/transmitting personal information. Advertising would be just fine. Facebook netted $18 billion in 2019, there’s a long ways to go before they aren’t making money.
Izkata 6y ago
> There wouldn't be any free webapps, etc. Sure there would. The pattern would be "pay for more features", the free version being more of a limited demo. This used to be a common pattern among Android apps, even without ads on the free version in the early days.

cameldrv 6y ago

Yeah but they'll save your IP, OS, screen resolution, etc, so they have an extremely good chance of being able to reidentify you.

divbzero 6y ago

I too wish opt-in/opt-out could be browser settings, and communicating user intent to websites using the DNT: 1 request header could be respected as a legally significant signal.

Sir_Substance 6y ago

I use ublock origin to selectively block the consent boxes. I've never yet seen a website which says "our backend has noticed you have not yet consented, you may not continue".