8 ms·

1. Block 3rd party cookies (useless on 99.99% of the sites) 2. Install uBlock Origin (https://www.ublockorigin.com https://www.ublockorigin.com)

by ffpip 6y ago

yladiz 6y ago
Don't forget step 0: 0. Don't illegally put nonessential cookies in the browser without the user's consent.
- dheera 6y ago
  I think it's impossible to enforce this worldwide, and any website can be based in any jurisdiction. The consent popups are also super annoying. It's also hard to define what "essential" means. I'm personally much more in favor of the technological solution: I block all cookies and only explicitly enable them on websites that I need to log in to.
  - yladiz 6y ago
    I would disagree with the idea that it's hard to define what's essential: whatever is essential for the function of a website/app. This means things like session login cookies but not analytics cookies.
    - barell 6y ago
      That is still not clear. Not everyone need to sign in so it could not be essential. It should ask when you want to login if you want to store a cookie or not.
      - yladiz 6y ago
        Yeah, that's why it depends on the function of the website or app. If you need to sign in to access an app, and the session token is saved using a cookie, then it can be considered an essential cookie. But on a marketing website that doesn't have a login component then yes, you're right, logging in isn't required and so it's arguably a nonessential cookie.
      - dheera 6y ago
        I think it goes deeper than this. An app like Yelp could claim that one of their essential features is to show you restaurants physically close to you, so location information is essential. They could claim that being able to recommend food based on your past searches is part of their core functionality, and that requires saving searches in cookies, or saving them on the server side with a fingerprint on your side. You could argue that Yelp is only a yellow pages of restaurants and therefore no cookies are essential. Someone else could argue that they are much more than a yellow pages, that if they were only a yellow pages they would not be profitable and cease to exist, and that their core reason of existence is their recommendation engine. To that person, essential functionality would require more things to be stored. Then there is a regulatory aspect. Some governments may require their companies to install trackers of sorts. Some governments just don't give a damn and let their companies do as they please. GDPR is not a universal law. It's an EU law. Nobody else has to follow it, and there is no way you'll convince every country in especially Asia, Africa, and South America to follow GDPR. A technological solution on the other hand can deal with the entire problem with a single software update, much more effectively than any legal route.
        rlpb 6y ago
        The law isn't as fuzzy as you think. > An app like Yelp could claim that one of their essential features is to show you restaurants physically close to you, so location information is essential. They could claim that but it would not be relevant in law. The GDPR provides an exception for "strictly necessary" cookies only, as follows: "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." If I didn't explicitly request for Yelp to show me restaurants physically close to me, or to recommend food based on my past searches, then neither of these things are "strictly necessary" as defined by the GDPR and they can't store personal information about me regardless of what they claim.
        BlueTemplar 6y ago
        Note that 'share my location' (or not) is already being perfectly fine handled by the browser.
- TheRealPomax 6y ago
  except that -1: there's nothing illegal about not asking for consent when cookies are not related to, in the cookie itself, personally identifiable information. You don't need permission to set cookies, every server with session management relies on them. You do need permission to set cookie that may leak PII. This person should try again, but this time actually look at the content of the cookies to see whether their complaint even makes sense.
  - yladiz 6y ago
    No, it’s not a PII related issue. You need consent to set nonessential cookies, regardless if they contain PII. An example is Segment, which sets cookies but may not be tied to a particular user. Segment, at least using just for analytics, isn’t necessary for the function of a website or app, so even if the cookies don’t have any PII you still need to get consent. You’re right that you don’t need permission to set server session cookies, but that is because that cookie is essential for the function of an authenticated app.
    - TheRealPomax 6y ago
      No, you don't: GDPR makes zero stipulations about that, and only requires consent if you're dealing with cookies that either contain PII, or themselves act as PII for cross-site tracking purposes. Sites are entirely free to set as many cookies as they like for any and all "non-essential" site purposes because anything in place to make a website work can be trivially argued in any court to be essential to running that particular business in the most cost effective manner: page metrics, heat maps, front door proxying, A/B testing, optimization etc. are all part of running a business on the web. Whether you as user consider that essential, or what your opinion is on what qualifies as "cost effective" is entirely irrelevant. Will the site work without an analytics cookie, and an optimizely cookie, and a cloudfront cookie, etc. ? Sure. But if a business decides they need a service that needs cookies set to work properly, as long as no PII is involved, that is not GDPR's concern in the slightest.
      - iamacyborg 6y ago
- ffpip 6y ago
  Yeah. I can see every website following step 0 because yladiz said so. Good way enforcing that with random websites. Take your privacy into your own hands, why leave it to others to implement. Many won't
- jeofken 6y ago
  Let’s remember that the http response asks the user agent to keep the cookie - it is voluntary to do so. Browsers may not have white lists but rather always set cookies, but it is not a given. For this reason, I wish my government would have rejected the ridiculous cookie law, and GDPR as well.

1. Block 3rd party cookies (useless on 99.99% of the sites) 2. Install uBlock Origin (https://www.ublockorigin.com https://www.ublockorigin.com)

by ffpip 6y ago

1. Block 3rd party cookies (useless on 99.99% of the sites) 2. Install uBlock Origin (https://www.ublockorigin.com https://www.ublockorigin.com)

yladiz 6y ago

Don't forget step 0: 0. Don't illegally put nonessential cookies in the browser without the user's consent.

dheera 6y ago
I think it's impossible to enforce this worldwide, and any website can be based in any jurisdiction. The consent popups are also super annoying. It's also hard to define what "essential" means. I'm personally much more in favor of the technological solution: I block all cookies and only explicitly enable them on websites that I need to log in to.
- yladiz 6y ago
  I would disagree with the idea that it's hard to define what's essential: whatever is essential for the function of a website/app. This means things like session login cookies but not analytics cookies.
  - barell 6y ago
    That is still not clear. Not everyone need to sign in so it could not be essential. It should ask when you want to login if you want to store a cookie or not.
    - yladiz 6y ago
      Yeah, that's why it depends on the function of the website or app. If you need to sign in to access an app, and the session token is saved using a cookie, then it can be considered an essential cookie. But on a marketing website that doesn't have a login component then yes, you're right, logging in isn't required and so it's arguably a nonessential cookie.
    - dheera 6y ago
      I think it goes deeper than this. An app like Yelp could claim that one of their essential features is to show you restaurants physically close to you, so location information is essential. They could claim that being able to recommend food based on your past searches is part of their core functionality, and that requires saving searches in cookies, or saving them on the server side with a fingerprint on your side. You could argue that Yelp is only a yellow pages of restaurants and therefore no cookies are essential. Someone else could argue that they are much more than a yellow pages, that if they were only a yellow pages they would not be profitable and cease to exist, and that their core reason of existence is their recommendation engine. To that person, essential functionality would require more things to be stored. Then there is a regulatory aspect. Some governments may require their companies to install trackers of sorts. Some governments just don't give a damn and let their companies do as they please. GDPR is not a universal law. It's an EU law. Nobody else has to follow it, and there is no way you'll convince every country in especially Asia, Africa, and South America to follow GDPR. A technological solution on the other hand can deal with the entire problem with a single software update, much more effectively than any legal route.
      - rlpb 6y ago
        The law isn't as fuzzy as you think. > An app like Yelp could claim that one of their essential features is to show you restaurants physically close to you, so location information is essential. They could claim that but it would not be relevant in law. The GDPR provides an exception for "strictly necessary" cookies only, as follows: "This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." If I didn't explicitly request for Yelp to show me restaurants physically close to me, or to recommend food based on my past searches, then neither of these things are "strictly necessary" as defined by the GDPR and they can't store personal information about me regardless of what they claim.
      - BlueTemplar 6y ago
        Note that 'share my location' (or not) is already being perfectly fine handled by the browser.
TheRealPomax 6y ago
except that -1: there's nothing illegal about not asking for consent when cookies are not related to, in the cookie itself, personally identifiable information. You don't need permission to set cookies, every server with session management relies on them. You do need permission to set cookie that may leak PII. This person should try again, but this time actually look at the content of the cookies to see whether their complaint even makes sense.
- yladiz 6y ago
  No, it’s not a PII related issue. You need consent to set nonessential cookies, regardless if they contain PII. An example is Segment, which sets cookies but may not be tied to a particular user. Segment, at least using just for analytics, isn’t necessary for the function of a website or app, so even if the cookies don’t have any PII you still need to get consent. You’re right that you don’t need permission to set server session cookies, but that is because that cookie is essential for the function of an authenticated app.
  - TheRealPomax 6y ago
    No, you don't: GDPR makes zero stipulations about that, and only requires consent if you're dealing with cookies that either contain PII, or themselves act as PII for cross-site tracking purposes. Sites are entirely free to set as many cookies as they like for any and all "non-essential" site purposes because anything in place to make a website work can be trivially argued in any court to be essential to running that particular business in the most cost effective manner: page metrics, heat maps, front door proxying, A/B testing, optimization etc. are all part of running a business on the web. Whether you as user consider that essential, or what your opinion is on what qualifies as "cost effective" is entirely irrelevant. Will the site work without an analytics cookie, and an optimizely cookie, and a cloudfront cookie, etc. ? Sure. But if a business decides they need a service that needs cookies set to work properly, as long as no PII is involved, that is not GDPR's concern in the slightest.
    - iamacyborg 6y ago
ffpip 6y ago
Yeah. I can see every website following step 0 because yladiz said so. Good way enforcing that with random websites. Take your privacy into your own hands, why leave it to others to implement. Many won't
jeofken 6y ago
Let’s remember that the http response asks the user agent to keep the cookie - it is voluntary to do so. Browsers may not have white lists but rather always set cookies, but it is not a given. For this reason, I wish my government would have rejected the ridiculous cookie law, and GDPR as well.