5 ms·

> The consent popups you see aren't just about cookies though. I don't care about all the other stuff the popups are about either. The popups are pointless, c

> The consent popups you see aren't just about cookies though. I don't care about all the other stuff the popups are about either. The popups are pointless, click-through damage and they serve no purpose. The laws that caused them to exist are equally pointless. There is no measurable benefit to any of this privacy theater and no less tracking is occurring since the advent of all of these pointless popups.

artursapek 6y ago
Its failure to make any real difference, together with the total lack of standard around implementation (why isn’t it treated like every other native browser permission dialog?) make it truly despicable.
- Sebb767 6y ago
  > why isn’t it treated like every other native browser permission dialog? Because it's not a browser permission. The browser could offer to send a "no" for you, but the site could just go on and track you anyway. It would be like having a permission dialog where clicking "no" just would ask the program kindly not to run with admin permissions. Now, you might argue that the browser could start blocking cookies, but that would just break useful functionality (i.e. logins) without preventing the abundance of other methods of user tracking (local storage, tracking pixels, link parameters, fingerprints, ...). If you want to go down that route, the most reasonable response on clicking "no" would be to close the browser, really.
  - sharkjacobs 6y ago
    idgi, is it harder for a malicious website to ask you if you accept cross site tracking cookies and then ignore your refusal than it is for them to ignore the same instruction from your browser?
    - Sebb767 6y ago
      No, this is about boundaries, abstractions and context really. When a browser sets a bound, the website usually has no way to override that, as the browser is above it permission-wise. Similarly, if the OS sets a boundary, the browser looses out, since it's below the OS. Fittingly, when you deny crossing such a boundary, you'd expect it to be denied. Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater. At least that's the technical reason. If we're being honest, the discussion never came up, because a) laws are bad for setting technical standards in many ways and b) most site owners prefer to build their own dark patterns to get the user to click accept anyway. [0] Excluding heuristics, of course, which would just start a game of cat and mouse yet again and would necessarily be flawed.
      - imiric 6y ago
        That doesn't change the fact that the current implementation is user hostile. There's no reason that privacy laws couldn't enforce a user setting at the browser level that websites could access in a standard way. Similar to the "Do Not Track" header, but actually enforceable. That would be the user friendly approach, but would require a technical committee of browser vendors, advertisers and tech giants to be part of the design process. Unfortunately the reason this doesn't happen is because the technical team would be working against their own financial interests, so there's no incentive to stop exploiting the user. Which is why the modern web is hostile to the user, and likely won't change unless the business models drastically change.
      - hnedeotes 6y ago
        > Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater. I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law. The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request. The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking.
  - Izkata 6y ago
    > The browser could offer to send a "no" for you, but the site could just go on and track you anyway. Not just "could", this was already tried: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track It's still in Firefox at least, and Mixpanel does respect it (a tracking service akin to Google Analytics), but not a whole lot else.
    - artursapek 6y ago
      Exactly
- anonytrary 6y ago
  It just goes to show you that government still has a lot of catching up to do when implementing technological law. This is even more apparent when you witness the countless hearings between congress and tech CEOs, which only confirm how much of a joke it is. I have not yet met a single person in tech who thinks all of this "congress drilling Zuck" isn't ultimately just a joke meant for theatre. I mean even Keith Gill took congress for a ride in the GameStop hearing. It's all a joke at this point. These people aren't equipped to deal with these issues.
II2II 6y ago
Have you tried going through these new popups? If they are trustworthy then the current ones allow you to disable some cookies and give you an idea of who is doing the tracking. Even though there are far better ways to manage cookies with browser settings and extensions: the options are sometimes quite limited (e.g. Chrome on Android) and many people would simply be unaware of cookies without these popups. Those people use browsers with little understanding of what's happening under the hood and have no interest in exploring technology so disclosure is one of the few ways to inform them. As for privacy theatre, there are two reasons why these popups are pointless. First, it was too little and too late. If the regulations came in before tracking became pervasive, it could have been effective since people would have had the option to find similar content. Second, far too few people feel entitled and click through without really considering whether it is worth the price.
- topspin 6y ago
  > Have you tried I have. I found what the cynic in me expected to find: ambiguity enough to pass a convoy of container ships. This, coupled with the certainty that there are effectively no authorities policing these claims in detail (particularly the non-FAANG sites, being far less lucrative lawsuit targets) has only further convinced me of the utter pointlessness of consent popups.
- yuriko_boyko 6y ago
  The list of cookies is so long that one might read 5 articles before reading the entire thing written in small print. Good luck if English is your second language.
  - Daho0n 6y ago
    Then don't and refuse the cookies and tracking.
    - eptcyka 6y ago
      How is that a solution?
- 6y ago
diffeomorphism 6y ago
Which is why the GDPR specifically forbids pointless clickthrough. The companies doing the theater should be fined.

artursapek 6y ago

Its failure to make any real difference, together with the total lack of standard around implementation (why isn’t it treated like every other native browser permission dialog?) make it truly despicable.

Sebb767 6y ago
> why isn’t it treated like every other native browser permission dialog? Because it's not a browser permission. The browser could offer to send a "no" for you, but the site could just go on and track you anyway. It would be like having a permission dialog where clicking "no" just would ask the program kindly not to run with admin permissions. Now, you might argue that the browser could start blocking cookies, but that would just break useful functionality (i.e. logins) without preventing the abundance of other methods of user tracking (local storage, tracking pixels, link parameters, fingerprints, ...). If you want to go down that route, the most reasonable response on clicking "no" would be to close the browser, really.
- sharkjacobs 6y ago
  idgi, is it harder for a malicious website to ask you if you accept cross site tracking cookies and then ignore your refusal than it is for them to ignore the same instruction from your browser?
  - Sebb767 6y ago
    No, this is about boundaries, abstractions and context really. When a browser sets a bound, the website usually has no way to override that, as the browser is above it permission-wise. Similarly, if the OS sets a boundary, the browser looses out, since it's below the OS. Fittingly, when you deny crossing such a boundary, you'd expect it to be denied. Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater. At least that's the technical reason. If we're being honest, the discussion never came up, because a) laws are bad for setting technical standards in many ways and b) most site owners prefer to build their own dark patterns to get the user to click accept anyway. [0] Excluding heuristics, of course, which would just start a game of cat and mouse yet again and would necessarily be flawed.
    - imiric 6y ago
      That doesn't change the fact that the current implementation is user hostile. There's no reason that privacy laws couldn't enforce a user setting at the browser level that websites could access in a standard way. Similar to the "Do Not Track" header, but actually enforceable. That would be the user friendly approach, but would require a technical committee of browser vendors, advertisers and tech giants to be part of the design process. Unfortunately the reason this doesn't happen is because the technical team would be working against their own financial interests, so there's no incentive to stop exploiting the user. Which is why the modern web is hostile to the user, and likely won't change unless the business models drastically change.
    - hnedeotes 6y ago
      > Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater. I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law. The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request. The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking.
- Izkata 6y ago
  > The browser could offer to send a "no" for you, but the site could just go on and track you anyway. Not just "could", this was already tried: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track It's still in Firefox at least, and Mixpanel does respect it (a tracking service akin to Google Analytics), but not a whole lot else.
  - artursapek 6y ago
    Exactly
anonytrary 6y ago
It just goes to show you that government still has a lot of catching up to do when implementing technological law. This is even more apparent when you witness the countless hearings between congress and tech CEOs, which only confirm how much of a joke it is. I have not yet met a single person in tech who thinks all of this "congress drilling Zuck" isn't ultimately just a joke meant for theatre. I mean even Keith Gill took congress for a ride in the GameStop hearing. It's all a joke at this point. These people aren't equipped to deal with these issues.

II2II 6y ago

Have you tried going through these new popups? If they are trustworthy then the current ones allow you to disable some cookies and give you an idea of who is doing the tracking. Even though there are far better ways to manage cookies with browser settings and extensions: the options are sometimes quite limited (e.g. Chrome on Android) and many people would simply be unaware of cookies without these popups. Those people use browsers with little understanding of what's happening under the hood and have no interest in exploring technology so disclosure is one of the few ways to inform them. As for privacy theatre, there are two reasons why these popups are pointless. First, it was too little and too late. If the regulations came in before tracking became pervasive, it could have been effective since people would have had the option to find similar content. Second, far too few people feel entitled and click through without really considering whether it is worth the price.

topspin 6y ago
> Have you tried I have. I found what the cynic in me expected to find: ambiguity enough to pass a convoy of container ships. This, coupled with the certainty that there are effectively no authorities policing these claims in detail (particularly the non-FAANG sites, being far less lucrative lawsuit targets) has only further convinced me of the utter pointlessness of consent popups.
yuriko_boyko 6y ago
The list of cookies is so long that one might read 5 articles before reading the entire thing written in small print. Good luck if English is your second language.
- Daho0n 6y ago
  Then don't and refuse the cookies and tracking.
  - eptcyka 6y ago
    How is that a solution?
6y ago

diffeomorphism 6y ago

Which is why the GDPR specifically forbids pointless clickthrough. The companies doing the theater should be fined.