4 ms·

I was and still am totally amazed that people still think it's a good idea to require each individual site owner to comply with that kind of policy instead of l

by ivoras 5y ago

I was and still am totally amazed that people still think it's a good idea to require each individual site owner to comply with that kind of policy instead of letting the browser vendors do the hard work. Which is easier - to modify and monitor billions of different sites, or to create a framework and obligations on the side of browsers to handle it? Something like requiring all browsers to start with cookies disabled, and mandating exactly how those users who do consent to tracking can be tracked (up to minute technical details), would do wonders if the goal is to actually improve privacy instead of just making it easy for Google and Facebook to continue doing what they do, while making life harder for millions of small companies and increasing bureucratic load while doing it.

DelightOne 5y ago
I still haven't figured out how to opt out after initially opting in. Having a standard place in the browser would make this simple.
- dvdkhlng 5y ago
  I think, in case you delete all your cookies, you will get a new cookie popup the next time you visit a web-site. As I usually configure browsers to not keep cookies between browser-restarts, I'm quite used to being asked anew about cookie consent every single time I visit a page :/
jdjgktntnrk 5y ago
Maybe we could send a header to websites letting them know that the user wants to opt out of all non-essential cookies. We could call it DoNotTrack, or something along those lines. I think HN would love the idea.
- sharken 5y ago
  It's unclear if Do Not Track will be useful for cookie consent, certainly it will take a lot of time. Here is an article from 2018 about it. https://www.w3.org/blog/2018/06/do-not-track-and-the-gdpr/ https://www.w3.org/blog/2018/06/do-not-track-and-the-gdpr/ I think the intent of the GDPR is good, but we now have websites that are harder to use than they have to be. In addition to that companies all over Europe have to spend a lot of time to be GDPR compliant. I think it's time to take a good look at GDPR and evaluate if it's doing what is was meant to do.
- frereubu 5y ago
  C'mon. This isn't contributing to the discussion.
- oaiey 5y ago
  Oh the sarcasm ;)
abbe98 5y ago
This could work for cookies but how would it work for other types of tracking. GDPR is not about cookies per se but about tracking.
oaiey 5y ago
I am not so sure about the law situation here, but this consent is not about cookies especially. It is about user tracking. And there are fingerprinting technology beyond cookies (which bypass cookie resets or incognito modes).
outime 5y ago
How are they supposed to collect fines then?
sofixa 5y ago
But "cookie consent" isn't only about cookies, it's about tracking, data collection and data sharing in general. Why do people miss that? Cookies are only one of the ways to track users, and they can be blocked. Your browser can't know everything used to fingerprint and track you on each and every site, and it can't know who that data is shared with. Those are the things that only the website owners know and only they can provide the users with choice.
PaulKeeble 5y ago
There isn't really anything in GDPR that says this can't be automated and dealt with by the browsers, so long as users are given the choice and from their set their defaults. It is a matter of intentional annoyance and non compliance but appearance to try and comply by these websites since we already have things like no track headers.
elric 5y ago
Why would it be a good idea to place the burden on the browser? That's like shooting the messenger. All of these websites whose life seems to depend on being personal-data-thieves should simply go the way of the dinosaur. If you can't make enough money to keep your site afloat without violating people's rights, then your website shouldn't exist. What I'd prefer, and where browsers could actually play an integral part, is an easier system for online (micro)payments. Want to read this article? Pay €0.05 please. No registration required. Want a monthly subscription? That'll be €5/month, please create an account. I loved the web when most websites were either run by universities, or by people who just wanted to share. You know, when things were actually free. Now it seems like everyone and their grandmonther wants to profit off of every little blog by selling my personal data. Which is ridiculous, considering it's an order of magnitude cheaper to host a site than it was in the 90s.
- tzs 5y ago
  > What I'd prefer, and where browsers could actually play an integral part, is an easier system for online (micro)payments. Want to read this article? Pay €0.05 please. No registration required. Want a monthly subscription? That'll be €5/month, please create an account. Micropayments are much harder than most people realize. It's not at all hard to design a system that can handle the actual payment part of micropayments. It's the legal environment around micropayments that is hard. A big problem is taxes. If I'm in jurisdiction X and your site is in jurisdiction Y and I pay you for access to an article, X may consider that a sale in X and want you to pay VAT or sales tax. Even if you don't meet the minimum volume requirement that a X has before taxes kick in, many jurisdictions still require you to register with them and file quarterly reports if you have any sales there. (And minimums are often of the form at least $S in sales or T transactions. In many US states T is 100 or 200, so you could end up owing tax on a few dollars total of microtransactions).
- Izkata 5y ago
  > What I'd prefer, and where browsers could actually play an integral part, is an easier system for online (micro)payments. Want to read this article? Pay €0.05 please. No registration required. Want a monthly subscription? That'll be €5/month, please create an account. HTTP 402 Payment Required It goes back to at least 1999 [0], but as far as I'm aware was never implemented (has been "reserved for future use" until the past few years, where Mozilla now lists it as "experimental technology" [1]). Edit to really fast downvote: I'm not saying this works, but that 1) there is a longstanding mechanism a new feature could be built on, and 2) it's apparently not been worthwhile for over two decades - but it seems it is being looked at now. [0] https://www.w3.org/Protocols/rfc2616/rfc2616.html https://www.w3.org/Protocols/rfc2616/rfc2616.html / https://datatracker.ietf.org/doc/html/rfc2616 https://datatracker.ietf.org/doc/html/rfc2616 [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/402 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/402

by ivoras 5y ago

DelightOne 5y ago

I still haven't figured out how to opt out after initially opting in. Having a standard place in the browser would make this simple.

dvdkhlng 5y ago
I think, in case you delete all your cookies, you will get a new cookie popup the next time you visit a web-site. As I usually configure browsers to not keep cookies between browser-restarts, I'm quite used to being asked anew about cookie consent every single time I visit a page :/

jdjgktntnrk 5y ago

Maybe we could send a header to websites letting them know that the user wants to opt out of all non-essential cookies. We could call it DoNotTrack, or something along those lines. I think HN would love the idea.

sharken 5y ago
It's unclear if Do Not Track will be useful for cookie consent, certainly it will take a lot of time. Here is an article from 2018 about it. https://www.w3.org/blog/2018/06/do-not-track-and-the-gdpr/ https://www.w3.org/blog/2018/06/do-not-track-and-the-gdpr/ I think the intent of the GDPR is good, but we now have websites that are harder to use than they have to be. In addition to that companies all over Europe have to spend a lot of time to be GDPR compliant. I think it's time to take a good look at GDPR and evaluate if it's doing what is was meant to do.
frereubu 5y ago
C'mon. This isn't contributing to the discussion.
oaiey 5y ago
Oh the sarcasm ;)

abbe98 5y ago

This could work for cookies but how would it work for other types of tracking. GDPR is not about cookies per se but about tracking.

oaiey 5y ago

I am not so sure about the law situation here, but this consent is not about cookies especially. It is about user tracking. And there are fingerprinting technology beyond cookies (which bypass cookie resets or incognito modes).

outime 5y ago

How are they supposed to collect fines then?

sofixa 5y ago

But "cookie consent" isn't only about cookies, it's about tracking, data collection and data sharing in general. Why do people miss that? Cookies are only one of the ways to track users, and they can be blocked. Your browser can't know everything used to fingerprint and track you on each and every site, and it can't know who that data is shared with. Those are the things that only the website owners know and only they can provide the users with choice.

PaulKeeble 5y ago

There isn't really anything in GDPR that says this can't be automated and dealt with by the browsers, so long as users are given the choice and from their set their defaults. It is a matter of intentional annoyance and non compliance but appearance to try and comply by these websites since we already have things like no track headers.

elric 5y ago

Why would it be a good idea to place the burden on the browser? That's like shooting the messenger. All of these websites whose life seems to depend on being personal-data-thieves should simply go the way of the dinosaur. If you can't make enough money to keep your site afloat without violating people's rights, then your website shouldn't exist. What I'd prefer, and where browsers could actually play an integral part, is an easier system for online (micro)payments. Want to read this article? Pay €0.05 please. No registration required. Want a monthly subscription? That'll be €5/month, please create an account. I loved the web when most websites were either run by universities, or by people who just wanted to share. You know, when things were actually free. Now it seems like everyone and their grandmonther wants to profit off of every little blog by selling my personal data. Which is ridiculous, considering it's an order of magnitude cheaper to host a site than it was in the 90s.

tzs 5y ago
> What I'd prefer, and where browsers could actually play an integral part, is an easier system for online (micro)payments. Want to read this article? Pay €0.05 please. No registration required. Want a monthly subscription? That'll be €5/month, please create an account. Micropayments are much harder than most people realize. It's not at all hard to design a system that can handle the actual payment part of micropayments. It's the legal environment around micropayments that is hard. A big problem is taxes. If I'm in jurisdiction X and your site is in jurisdiction Y and I pay you for access to an article, X may consider that a sale in X and want you to pay VAT or sales tax. Even if you don't meet the minimum volume requirement that a X has before taxes kick in, many jurisdictions still require you to register with them and file quarterly reports if you have any sales there. (And minimums are often of the form at least $S in sales or T transactions. In many US states T is 100 or 200, so you could end up owing tax on a few dollars total of microtransactions).
Izkata 5y ago
> What I'd prefer, and where browsers could actually play an integral part, is an easier system for online (micro)payments. Want to read this article? Pay €0.05 please. No registration required. Want a monthly subscription? That'll be €5/month, please create an account. HTTP 402 Payment Required It goes back to at least 1999 [0], but as far as I'm aware was never implemented (has been "reserved for future use" until the past few years, where Mozilla now lists it as "experimental technology" [1]). Edit to really fast downvote: I'm not saying this works, but that 1) there is a longstanding mechanism a new feature could be built on, and 2) it's apparently not been worthwhile for over two decades - but it seems it is being looked at now. [0] https://www.w3.org/Protocols/rfc2616/rfc2616.html https://www.w3.org/Protocols/rfc2616/rfc2616.html / https://datatracker.ietf.org/doc/html/rfc2616 https://datatracker.ietf.org/doc/html/rfc2616 [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/402 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/402