5 ms·

I never understood why that EU regulation wasn't required at the browser level in the first place.

tusharsoni 6y ago
Because not all cookies are regulated (such as session cookies). It would be hard for browser to tell what the cookie is for.
- BlueTemplar 6y ago
  Still, why isn't there a Web standard for this?
  - zinekeller 6y ago
    Attempts have been done on this, not once (P3P [1]), not twice (DNT [2]), but multiple times (several expired RFCs, GPC [3]). This sounds like the evil bit (RFC 3514 [4]) at this point. 1: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P 2: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track 3: https://arstechnica.com/tech-policy/2020/10/coming-to-a-browser-near-you-a-new-way-to-keep-sites-from-selling-your-data/ https://arstechnica.com/tech-policy/2020/10/coming-to-a-brow... 4: https://tools.ietf.org/html/rfc3514 https://tools.ietf.org/html/rfc3514
    - kevincox 6y ago
      The problem with these standards is that they the operators had little if any incentive to follow them. Pairing one of these standard with laws would be a powerful solution with good UX.
      - Macha 6y ago
        Lawmakers are generally hestitant to prescribe specific technological implementations because technology moves faster than laws. Imagine if radio spectrum regulations hadn't applied to wifi because they'd specifically specified TV/radio.
        kevincox 6y ago
        You can do this somewhat abstractly. By saying "when storing user data it must inform the user agent the purposes of that data using a standard mechanism". Then for http you can bless some RFC and the standard way. But you are right. It isn't ideal.
avianlyric 6y ago
Because that EU regulation deals with people’s right to privacy, and control over their data in the abstract. It not limited to just websites and the internet, browsers and cookies are just one of many places where compliance should be achieved.
gpderetta 6y ago
well, the regulation applies outside of the browser as a start.
Symbiote 6y ago
The regulation applies equally to my handwritten, paper notes I take when interviewing people for a job, to the candidate's CV, and, well, to every source of personal data.
GordonS 6y ago
I really wish it was done in-browser - then we wouldn't have to deal with shitty UIs and dark patterns. The DNT (Do Not Track) header was far too simplistic, and completely unrealistic. I'm imagining having to specify a purpose when creating cookies, such as "session cookie", "advertising", "tracking", and then dealing with consent using a consistent, built-in browser mechanism. Would be really interesting to flesh out this idea and get feedback, in the unlikely case that it hasn't been done before...

Because not all cookies are regulated (such as session cookies). It would be hard for browser to tell what the cookie is for.

BlueTemplar 6y ago
Still, why isn't there a Web standard for this?
- zinekeller 6y ago
  Attempts have been done on this, not once (P3P [1]), not twice (DNT [2]), but multiple times (several expired RFCs, GPC [3]). This sounds like the evil bit (RFC 3514 [4]) at this point. 1: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P 2: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track 3: https://arstechnica.com/tech-policy/2020/10/coming-to-a-browser-near-you-a-new-way-to-keep-sites-from-selling-your-data/ https://arstechnica.com/tech-policy/2020/10/coming-to-a-brow... 4: https://tools.ietf.org/html/rfc3514 https://tools.ietf.org/html/rfc3514
  - kevincox 6y ago
    The problem with these standards is that they the operators had little if any incentive to follow them. Pairing one of these standard with laws would be a powerful solution with good UX.
    - Macha 6y ago
      Lawmakers are generally hestitant to prescribe specific technological implementations because technology moves faster than laws. Imagine if radio spectrum regulations hadn't applied to wifi because they'd specifically specified TV/radio.
      - kevincox 6y ago
        You can do this somewhat abstractly. By saying "when storing user data it must inform the user agent the purposes of that data using a standard mechanism". Then for http you can bless some RFC and the standard way. But you are right. It isn't ideal.

avianlyric 6y ago

Because that EU regulation deals with people’s right to privacy, and control over their data in the abstract. It not limited to just websites and the internet, browsers and cookies are just one of many places where compliance should be achieved.

gpderetta 6y ago

well, the regulation applies outside of the browser as a start.

Symbiote 6y ago

The regulation applies equally to my handwritten, paper notes I take when interviewing people for a job, to the candidate's CV, and, well, to every source of personal data.

GordonS 6y ago

I really wish it was done in-browser - then we wouldn't have to deal with shitty UIs and dark patterns. The DNT (Do Not Track) header was far too simplistic, and completely unrealistic. I'm imagining having to specify a purpose when creating cookies, such as "session cookie", "advertising", "tracking", and then dealing with consent using a consistent, built-in browser mechanism. Would be really interesting to flesh out this idea and get feedback, in the unlikely case that it hasn't been done before...