4 ms·

Queston: why has the whole cookie notification/gdpr thing not been solved on a protocol level? In the end it's not the website that stores the cookie but the br

Queston: why has the whole cookie notification/gdpr thing not been solved on a protocol level? In the end it's not the website that stores the cookie but the browser. Shouldn't the browsers be forced to prompt the user everytime a cookie is written to disk/send back to the server? Then the UI could be unified and some header "Cookie-Explanation" or domain.tld/.well-known/cookies.txt could be provided for the browser to parse and present the user with more detailed explanation for each cookie provided by the site. Unexplained cookies could be presented as a warning/error forcing the websites to deliver good explanations matching the cookie duration/content. The user could fine tune settings per cookie and can be notified if a site adds new cookies not seen before. Same for local storage.

detaro 6y ago
But that would lead to users telling their browsers to reject cookies instead of being tricked into accepting unnecessary ones, and that's bad for advertisers. Can't have that. /s (see also: DNT header)
Nextgrid 6y ago
The consent prompt this article is about is for the GDPR, and that covers more than cookies. The GDPR covers cookie-less tracking methods like browser fingerprinting (or how your search history or personal details you entered are stored/processed/analyzed). This is also why the advice of just accepting everything and then clearing cookies regularly seems wrong and dangerous to me, as you've given them consent to track you regardless of cookies and they have plenty of tools to track someone with reasonable certainty without cookies even across different devices.
- laszlokorte 6y ago
  I see what you are saying but still I think there should be a machine readable format that browsers can parse and display in a unified way. For cookies it should work as I described. For advanced fingerprinting techniques that need to be disclosed that could be done via an additional plain text which is just rendered by the browser, still in a unified way. Then future browsers could detect/block even some advanced fingerprinting but check for an explanation (eg in /.well-known/privacy.txt) and present the user with a choice. I just do not get way the website itself has a say in how to display the constent prompt at all (it needs to be accessible, should be readble and dismissable without javascript, actually I would want to be able to read it before visiting the website). Currently I can not even get a list of all websites of which I accepted any agreement with not to mention re-reading any of those consent texts.
gdyuytgh 6y ago
That's because the protocols, standards and the browser are made by an adtech company. You may propose an anticookie feature, but it will be ignored. You may even implement it yourself, and you will be stonewalled by the maintainers of said browser. I don't think cookies are a fixable thing. The US administration actually wants an extensive global surveillance system and it lets the big4 implement it. In some sense, the big4 is the public extension of the US intelligence that operates within the "national security" framework and thus it can ignore laws and regulations.

detaro 6y ago

But that would lead to users telling their browsers to reject cookies instead of being tricked into accepting unnecessary ones, and that's bad for advertisers. Can't have that. /s (see also: DNT header)

Nextgrid 6y ago

The consent prompt this article is about is for the GDPR, and that covers more than cookies. The GDPR covers cookie-less tracking methods like browser fingerprinting (or how your search history or personal details you entered are stored/processed/analyzed). This is also why the advice of just accepting everything and then clearing cookies regularly seems wrong and dangerous to me, as you've given them consent to track you regardless of cookies and they have plenty of tools to track someone with reasonable certainty without cookies even across different devices.

laszlokorte 6y ago
I see what you are saying but still I think there should be a machine readable format that browsers can parse and display in a unified way. For cookies it should work as I described. For advanced fingerprinting techniques that need to be disclosed that could be done via an additional plain text which is just rendered by the browser, still in a unified way. Then future browsers could detect/block even some advanced fingerprinting but check for an explanation (eg in /.well-known/privacy.txt) and present the user with a choice. I just do not get way the website itself has a say in how to display the constent prompt at all (it needs to be accessible, should be readble and dismissable without javascript, actually I would want to be able to read it before visiting the website). Currently I can not even get a list of all websites of which I accepted any agreement with not to mention re-reading any of those consent texts.

gdyuytgh 6y ago

That's because the protocols, standards and the browser are made by an adtech company. You may propose an anticookie feature, but it will be ignored. You may even implement it yourself, and you will be stonewalled by the maintainers of said browser. I don't think cookies are a fixable thing. The US administration actually wants an extensive global surveillance system and it lets the big4 implement it. In some sense, the big4 is the public extension of the US intelligence that operates within the "national security" framework and thus it can ignore laws and regulations.