12 ms·

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ https://www.w3.org

by pornel 5y ago

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unless the spec is so bad that most users will agree by accident. The annoying and confusing cookie banners are a feature. Besides making people agree through confusion or attrition, the banners are malicious compliance. Adtech companies putting them up want you to be pissed off at the banners. They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed.

worldsayshi 5y ago
Unless regulators force companies to respect automated protocols.
- sascha_sl 5y ago
  This. You can see the impact of this on the new iOS tracking permissions. Most people want to opt out, but can't. Regulators stepping in would spell the end of large sections of the online advertising industry, so I doubt it'll happen.
  - dividedbyzero 5y ago
    > Most people want to opt out, but can't. Not following this too closely, I thought that's possible now, or at least as soon as the last few holdout apps get updated?
    - Macha 5y ago
      That's the point, by Apple taking control of the interface and preventing dark pattern bullshit, opt in rates are way lower on iOS than on websites.
  - xbar 5y ago
    Regulators in the US do not seem to be completely in the pockets of the online advertisers quite yet, given recent legislation proposals. Regulators in the EU, even less so.
- belorn 5y ago
  The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. The rest of the industry followed. Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.
  - deleted 5y ago
    [deleted]
  - virgilp 5y ago
    I mean, a good first step would be to start fining companies 2% of the revenue. Especially Google. And then maybe automate the GDPR fines, because it's definitely possible to identify that a site puts up a non-compliant banner. No need to add the threat of jail time, _especially_ if it isn't enforced.
    - delfinom 5y ago
      2% of revenue while stalling the GDPR process and taking it to court for 10 years makes it only 0.2% ;)
      - vntok 5y ago
        That would be 2% each year for ten years of infringement though, and very expensive lawyers to pay for at least that duration.
      - virgilp 5y ago
        Even so, it would be 0.2% per EU country, right? Because the legislation is transposed into member states legislation. I doubt that anybody would really want to fight (& risk losing) in even 5 member states per year...
  - galgalesh 5y ago
    > but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. This is not the case. The fines are up to 2% of annual global turnover. This scares companies. Moreover, some of the worst offending cookie banners are slowly being replaced by better ones as more and more organizations (such as noyb) file official complaints and companies get fined.
- pulse7 5y ago
  It is time for the governments to take control back and start regulating BigTech: you can not easily opt-out from any data gathering from Google, Microsoft, Apple, Facebook, ... If you try it and turn it off on mobile phone and desktop you will constantly have issues and be flooded with messages like "turn on location services", etc. Yesterday I learned that my private calendar on my phone was replicated to Google Calendar >>for many years<< without my knowledge, because the default setting was to save new events into Google Calendar and not a local phone calendar... and I was not asked during setup if I would like that (I have turned off all replication / data sharing / etc.)... this is just crazy... they are basiclly STEALING MY DATA and sending it to the cloud where it is processed without my knowledge... I hope they pay BIG MONEY for these GDPR breaches...
  - sam345 5y ago
    How is this possible? Probably forgot you gave consent to Google calendar?
    - pulse7 5y ago
      Be sure that I didn't give any consent...
    - ryukafalz 5y ago
      Recent Android phones sync a ton of stuff automatically - which I suppose you agree to by signing in with a Google account, but that's also typically required. I know this because on the last two Android phones I purchased, a set of old outdated contacts from my Google account were automatically synced to the phone as soon as I logged in, which I was required to do to begin using the device. Believe me, I would have opted out of this had I been prompted to do so during setup.
      - pulse7 5y ago
        Time to go away from GMail account...
    - pulse7 5y ago
- 2T1Qka0rEiPr 5y ago
  I thought this exactly. Kind of like US requiring pension plan options to be provided in a certain consistent layout etc., were this spec to be demanded by e.g. the EU, then it could see a really positive shift
roblabla 5y ago
The thing about this new spec is that it's compatible with the GDPR in a way that could make adopting this a legal requirement, given enough lobbying effort. It'd be a long battle, but I could foresee a future where regulators require adtech to implement this spec to obtain consent. That won't stop them from additionally using cookie banners, out of spite. But I suspect many websites that currently have cookie banners only have them because they believe it to be necessary, and it's hard to push back on it. If such a spec came to be recognized as a way to obtain consent by regulation, it'd make it easy to point its way, and at least end the madness of cookie banners on websites that don't need it.
mffap 5y ago
I would argue that times have changed. Sure, there's still misaligned interests between ad providers and users in terms of privacy. But I think the EU regulators found the right level of financial incentives to change some of the worst habits.
dvfjsdhgfv 5y ago
> They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed. This is a sentiment expressed surprisingly often even here on HN.
- MagnumOpus 5y ago
  A huge proportion of posters either work at adware companies or are big time owners of adware stocks. And as the Sinclair adage goes, it is difficult to get a man to understand something when his salary depends on his not understanding it.
  - dvfjsdhgfv 5y ago
    Well, just like many others I own - both directly and indirectly - some tech stocks, but it doesn't influence my view on privacy at all. Actually, the view that they have to either do unethical things like tracking or perish is one of the greatest fallacies and a sign of lazy thinking.
  - jjk166 5y ago
    This is intellectually lazy. You can't just assume that the large numbers of people who hold a position you disagree with do so only because they have some secret bias. It's a position which is not falsifiable and which absolves oneself of having to think critically about their own position.
    - rchaud 5y ago
      One man's 'intellectually lazy' is another man's 'educated guess'. Or as this community loves to say about others, "“It is difficult to get a man to understand something, when his salary depends on his not understanding it.” There are plenty of people online playing devil's advocate because one day they too could be rich and they don't want the harsh yoke of government regulation holding them back. On HN, part of the audience is in closer proximity to that kind of wealth, and their arguments in favour of that status quo reflect this.
morelisp 5y ago
> Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unless the spec is so bad that most users will agree by accident. Reminder that Internet advertising has a lot of actors with competing interests, and it is not usually the "adtech companies" who don't want users to have an easy-opt out, but publishers and to a lesser extent the advertisers. Many "adtech companies" would love to have clearer legal signals and simpler, industry-wide justification to collect less data. Publishers have been very good at foisting all user frustration off on vague "adtech" (or alternately, adtech companies have been effective at reputation laundering for publishers/advertisers) but they're the ones that want to collect, share, and sell the data to be able to raise their rates.
- Ensorceled 5y ago
  This is fundamentally misunderstanding how internet advertising works: advertises will pay higher CPM for precise targeting and attribution publishers want the best CPM they can get adtech uses as many tricks as possible to get as much information as possible about a user so they can maximize the CPM the advertiser will pay Publishers just end up doing what ever their adtech partners tell them will give them the best CPM.
  - morelisp 5y ago
    Haha, no. You're falling for the trick, or maybe you're just 10 years behind. Publishers (and retailers, and anyone with a dataset) seek out adtech partner companies, to justify high CPMs and to sell their audience data. Adtech companies are market-makers, it's been years since the data they can get independently of supply-side partners was worth shit. The publisher is the one with the cookie warning and consent forms! The publisher is the one who wants you to log in with a stable ID! The publisher is the one with a model of you regardless of your ad or tracker blocker settings! The adtech companies will sell you downstream for sure, but the publishers are the ones deploying as many tricks as possible to gather data. And yeah, adtech companies will advise them about how to effectively gather data. That's a lot less about "tricks" and more about how to build salable taxonomies instead of data lakes full of garbage. To the extent it's about tricks, it's more often the adtech companies having to patiently but firmly explain, no, you can't just hardcode a single consent state for all visitors and send that to us in lieu of a real CMP. (A purely theoretical example, of course...)
Placido 5y ago
Just use Super Agent. You choose your preferences once and that's it. And once iOS 15 is out, it will be available in mobile.
- freediver 5y ago
  What is Super Agent?
denton-scratch 5y ago
"the banners are malicious compliance." I agree. But I don't think it's because adtech want you to think privacy is shit; I think it's because by compelling you to click, they can run Javascript in the context of a user gesture. I want a plugin that automatically says "OK" to cookie banners. My browser already blocks 3rd-party cookies. It only allows session cookies. Cookie banners are like fire-hydrant CAPTCHAs - they masssively increase the friction that web users have to deal with. They also legitimise other kinds of popup window that websites present. I've noticed more and more popups appearing on first visit to a site, inviting me to subscribe to a newsletter or whatever. You often see a cookie banner, followed by a newsletter popup, followed by a Google login popup. Who knows, maybe there's a traffic-lights CAPTCHA. Then finally you're into the site, and it turns out to be Washpo or NYT, and you can't read the article anyway, because it's paywalled. Can we have our open web back please, mister?
- loloquwowndueo 5y ago
  “ I want a plugin that automatically says "OK" to cookie banners.” Try “I don’t care about cookies” :) https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
  - bwindels 5y ago
    Is this extension trustworthy? It is "recommended" and says GPL3 but there is no link to the source code anywhere.
    - tcit 5y ago
      The author doesn't publish the extension sources. https://reddit.com/comments/bru6wd/comment/eohtox3 https://reddit.com/comments/bru6wd/comment/eohtox3
      - grey_earthling 5y ago
        Their argument is that the extension as it's distributed is essentially a zip file containing the source code.
bwindels 5y ago
As I understand it, the idea would be to make respecting these automatic signal mandatory in an update to the GDPR. See https://techcrunch.com/2021/06/14/europe-needs-to-back-browser-level-controls-to-fix-cookie-consent-nightmares-says-privacy-group/ https://techcrunch.com/2021/06/14/europe-needs-to-back-brows... for some more context. Granted though that enforcement of the existing rules seems to be the biggest problem today.
- ComodoHacker 5y ago
  And if a browser or extension abuses these signals (i.e. always sends them without user's explicit and informed consent), who is liable?
  - majewsky 5y ago
    Liable for what? GDPR says you can only collect data if you have informed consent from the user. It does not imply any right on the side of the business to be able to obtain such consent.
deleted 5y ago
[deleted]
quotemstr 5y ago
But privacy laws are pointless and should be repealed. All this noise about cookie privacy, fingerprinting, FLoC, tracking, etc. --- what are the actual harms that make these things bad? Has anyone in the real world ever experienced a concrete harm arising from interest targeting? Doubtful. The EU privacy regime imposes a heavy regulatory burden in exchange for nothing. Information is a non-rivalrous good. Further limiting its dissemination will increase friction all over the internet, impose new transaction costs on previously free interactions, and make the whole network less useful for everyone. And for what? Assuaging the paranoia of a tiny fragile and vocal minority of privacy activists? Sorry, but that's not worth breaking the internet.
- Santosh83 5y ago
  Information is power. The more information about more people with more depth to the graph is amassed by Big Tech and 3-letter agencies, the more soft power is accrued over large groups of people, economies, processes and even nations. And this ability is currently asymmetric. While Big Tech and Big Govt knows nearly everything about everybody, ordinary citizens are denied data and transparency. And even if the data may be hypothetically available, its scale precludes analysis by anyone except highly funded groups. Lack of privacy does translate to enormous soft power. It doesn't have to result in death, although the potential is there for that too. Democracy and individual liberty become meaningless except on paper. I'm not sure that's what we want, in exchange for a few conveniences in the palm of our hands.
  - quotemstr 5y ago
    > The more information about more people with more depth to the graph is amassed by Big Tech and 3-letter agencies, the more soft power is accrued over large groups of people, economies, processes and even nations. Is there any evidence that Big Tech and Big Government are actually controlling people by tagging them in some database (which no human actually inspects) as being interested in hiking gear and cookie recipes? Give me a break. What you've described isn't a concrete harm, but an emotion --- specifically, fear. Lots of fears are baseless. So is this one. We shouldn't organize society around the baseless fears of tiny vocal minorities.
canadianfella 5y ago
“The Internet Explorer”
leokennis 5y ago
This exactly. This is also why I never feel "ashamed" when sites ask me to please disable my ad blocker because when I block ads they'll go out of business. Or why I'll always decline even "user respecting" ads on sites. We're fighting the ad and tracking industry here, the internet equivalent of a gang member with a shiv and a length of pipe. I'm not going to fight nicely. I'll deny you any chance and any method I get.
- 411111111111111 5y ago
  Just a small reminder for people using Firefox and ublock origin: you can remove almost all cookie prompts by enabling the annoyances filters in the addon settings
  - equitablequal 5y ago
    Anyone not using Firefox/Ublock; you can use NoScript to block the banners, and a lot of other adtech (including some paywalls such as Bloomberg) as they are all JS-powered. It's quite surprising to see how many JS plugins are in operation on a typical consumer site, and satisfying to know they were all blocked unless expressly permitted :)
    - Arnavion 5y ago
      Keep in mind, however, that you will end up enabling all the "Please enable Javascript to view our website (even though our website works well enough for your casual visit without it)" banners, that are enabled in the HTML by default and hidden by JS :) For example, one particular maroon-headwear-related Linux distro's bug tracker has a particularly egregious blinking bright red banner, asking you to enable JS for the website to "function correctly", even though reading bugs on said tracker works fine without it.
    - gnyman 5y ago
      And if you don't want to or can't install noscript, you can use my little hack https://noscript.it/ https://noscript.it/ to view a page without javascript. Note that it is a hack/poc and does not always work, especially the x-frame-detection is iffy so if you try it and just see a blank page try the "enable proxy" checkbox. I use it every now and then on iOS to get around some especially obnoxious JS, but if there were more users I would be more motivated to improve it (hint hint:-)
eastendguy 5y ago
"They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed." Once in a while I read/learn something new at HN that changes my perspective on things. This sentence is such an example.
- patates 5y ago
  I agree but I changed "pointless" with "hopeless" for a better effect on my end.
dmitryminkovsky 5y ago
> The annoying and confusing cookie banners are a feature. Not just that, but I’ve never seen a cookie banner that does anything. Cookies get sent down with the page on the initial load. Whenever I’ve opened an inspector to see if cookies get unset by JavaScript in response to my “opting out,” I’ve never seen an effect. The same cookies get sent after I opt out: no change. Has anyone seen a cookie preference banner that actually does something?
- simpss 5y ago
  smaller, local(to me) sites have started to have cookie banners that have an effect. My bank, 1/3 of the bigger news sites here etc... They all started with a single "agree" button, then went to "agree/disagree" with no effect and are finally starting to come around to a functioning disagree button. GDPR also helps here, as it defined what identifies an individual and that made most of the tracking PII even when it's all merged by a random ID that stays with the user. The effect is slow, but it's starting to work. Hopefully the next step will be abandoning cookie banners and only using technically required cookies(don't need conset) and/or non-identifying tracking for aggregate results. This is a massive improvment on UX and actually gives the company more quality data that doesn't identify any single individual. I'm personally pushing for aggregated tracking in my current company. It's an uphill battle, but one that can be won I think.
  - imiric 5y ago
    > non-identifying tracking for aggregate results That sounds similar to FLoC, which is still very much identifying[1]. The solution to user tracking isn't less identifying tracking. It's no user tracking. [1]: https://blog.mozilla.org/en/mozilla/privacy-analysis-of-floc/ https://blog.mozilla.org/en/mozilla/privacy-analysis-of-floc...
- Symbiote 5y ago
  Look at well-funded government or other public websites. https://www.gov.uk/ https://www.gov.uk/, https://www.nhs.uk/ https://www.nhs.uk/, https://europa.eu/ https://europa.eu/, https://home.cern/ https://home.cern/, https://www.bundesregierung.de/ https://www.bundesregierung.de/ (maybe), https://www.dr.dk/ https://www.dr.dk/ (maybe).
nickpp 5y ago
Visit https://gdpr.eu https://gdpr.eu or https://europa.eu/european-union/index_en https://europa.eu/european-union/index_en "The Official website of the European Union". Look down. Both have cookie banner. The emperor is naked. The GDPR law is broken.
eli 5y ago
P3P wasn't great. It's pretty hard to reduce the nuance of how you're proposing to use data down to a handful of fields that will be automatically processed. I remember spending a silly amount of time trying to come up with a P3P policy that was both accurate and also didn't break sign-on for a single app that used multiple domains.
sebastian_z 5y ago
The ad industry is not monolithic, though. Some people want to genuinely move on to less privacy-invasive business models; others not. I have been to industry conferences where the advice was "well, if you do not like the Do Not Sell link on your site, maybe it's time to stop selling and start changing your business model." What is different this time around compared to P3P, DNT, and other earlier mechanisms is that the times have changed. Privacy is a much bigger topic. There is much more reporting now about privacy. Users understand a bit better better (though, we are still far off from real transparency). Lawmakers and regulators are catching up. Many companies embrace privacy. There is a burgeoning privacy tech industry with quite a bit of venture funding. Also, lessons were learned from earlier efforts. CalOPPA required recipients of DNT signals to only say whether they respect those. The CCPA regulations now require actual compliance. If the CCPA is applicable to your company, you have no choice but to respect it. And that is also true for automated browser signals. There is much stronger enforcement now behind more recent privacy laws. Virginia and Colorado recently enacted privacy laws, and it is likely that other states will do to. Disclosure: I am an academic researcher working with collaborators of all stripes on Global Privacy Control (GPC) [1, 2]. We are in touch with the good folks at ADPC and support their work. They are doing a fantastic job over there! [1] https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ [2] https://github.com/privacycg/proposals/issues/10 https://github.com/privacycg/proposals/issues/10
- unknown_error 5y ago
  Thing is, how is regulation supposed to ever keep up with the rapid advancements of technology and advertising and the lobbies that come with all that revenue? Capital and technology need not respect sovereign borders and laws as long as they can keep one step ahead of enforcement and still get enough revenue. The laws and lawmakers are fundamentally slower and weaker and poorer; by the time CCPA et al have an actual deterrent effect (beyond just mandated privacy notices), the industry will have moved on to some more sinister loophole. It's an arms race that 1700s-style government simply cannot keep up with. It takes months to come up with new algorithmic loopholes, decades to change the law, one industry-friendly administration to undo all the progress. Offloading privacy to government only works when you have strong states (China, the E.U. maybe). In the US, what's left of the federal government is too crippled to effectively tackle this (and arguably any technological problem) at scale. State-specific laws are subject to the same constraints, and additionally face the problem of enforcement across borders and Commerce Clause issues. If anything this will be an arms race between adtech and adblocking; Congress is the kid in the corner crying, "But I wanna play too!" and pretty much shrugged off by everyone else.

by pornel 5y ago

worldsayshi 5y ago

Unless regulators force companies to respect automated protocols.

sascha_sl 5y ago
This. You can see the impact of this on the new iOS tracking permissions. Most people want to opt out, but can't. Regulators stepping in would spell the end of large sections of the online advertising industry, so I doubt it'll happen.
- dividedbyzero 5y ago
  > Most people want to opt out, but can't. Not following this too closely, I thought that's possible now, or at least as soon as the last few holdout apps get updated?
  - Macha 5y ago
    That's the point, by Apple taking control of the interface and preventing dark pattern bullshit, opt in rates are way lower on iOS than on websites.
- xbar 5y ago
  Regulators in the US do not seem to be completely in the pockets of the online advertisers quite yet, given recent legislation proposals. Regulators in the EU, even less so.
belorn 5y ago
The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. The rest of the industry followed. Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.
- deleted 5y ago
  [deleted]
- virgilp 5y ago
  I mean, a good first step would be to start fining companies 2% of the revenue. Especially Google. And then maybe automate the GDPR fines, because it's definitely possible to identify that a site puts up a non-compliant banner. No need to add the threat of jail time, _especially_ if it isn't enforced.
  - delfinom 5y ago
    2% of revenue while stalling the GDPR process and taking it to court for 10 years makes it only 0.2% ;)
    - vntok 5y ago
      That would be 2% each year for ten years of infringement though, and very expensive lawyers to pay for at least that duration.
    - virgilp 5y ago
      Even so, it would be 0.2% per EU country, right? Because the legislation is transposed into member states legislation. I doubt that anybody would really want to fight (& risk losing) in even 5 member states per year...
- galgalesh 5y ago
  > but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. This is not the case. The fines are up to 2% of annual global turnover. This scares companies. Moreover, some of the worst offending cookie banners are slowly being replaced by better ones as more and more organizations (such as noyb) file official complaints and companies get fined.
pulse7 5y ago
It is time for the governments to take control back and start regulating BigTech: you can not easily opt-out from any data gathering from Google, Microsoft, Apple, Facebook, ... If you try it and turn it off on mobile phone and desktop you will constantly have issues and be flooded with messages like "turn on location services", etc. Yesterday I learned that my private calendar on my phone was replicated to Google Calendar >>for many years<< without my knowledge, because the default setting was to save new events into Google Calendar and not a local phone calendar... and I was not asked during setup if I would like that (I have turned off all replication / data sharing / etc.)... this is just crazy... they are basiclly STEALING MY DATA and sending it to the cloud where it is processed without my knowledge... I hope they pay BIG MONEY for these GDPR breaches...
- sam345 5y ago
  How is this possible? Probably forgot you gave consent to Google calendar?
  - pulse7 5y ago
    Be sure that I didn't give any consent...
  - ryukafalz 5y ago
    Recent Android phones sync a ton of stuff automatically - which I suppose you agree to by signing in with a Google account, but that's also typically required. I know this because on the last two Android phones I purchased, a set of old outdated contacts from my Google account were automatically synced to the phone as soon as I logged in, which I was required to do to begin using the device. Believe me, I would have opted out of this had I been prompted to do so during setup.
    - pulse7 5y ago
      Time to go away from GMail account...
  - pulse7 5y ago
2T1Qka0rEiPr 5y ago
I thought this exactly. Kind of like US requiring pension plan options to be provided in a certain consistent layout etc., were this spec to be demanded by e.g. the EU, then it could see a really positive shift

roblabla 5y ago

The thing about this new spec is that it's compatible with the GDPR in a way that could make adopting this a legal requirement, given enough lobbying effort. It'd be a long battle, but I could foresee a future where regulators require adtech to implement this spec to obtain consent. That won't stop them from additionally using cookie banners, out of spite. But I suspect many websites that currently have cookie banners only have them because they believe it to be necessary, and it's hard to push back on it. If such a spec came to be recognized as a way to obtain consent by regulation, it'd make it easy to point its way, and at least end the madness of cookie banners on websites that don't need it.

mffap 5y ago

I would argue that times have changed. Sure, there's still misaligned interests between ad providers and users in terms of privacy. But I think the EU regulators found the right level of financial incentives to change some of the worst habits.

dvfjsdhgfv 5y ago

> They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed. This is a sentiment expressed surprisingly often even here on HN.

MagnumOpus 5y ago
A huge proportion of posters either work at adware companies or are big time owners of adware stocks. And as the Sinclair adage goes, it is difficult to get a man to understand something when his salary depends on his not understanding it.
- dvfjsdhgfv 5y ago
  Well, just like many others I own - both directly and indirectly - some tech stocks, but it doesn't influence my view on privacy at all. Actually, the view that they have to either do unethical things like tracking or perish is one of the greatest fallacies and a sign of lazy thinking.
- jjk166 5y ago
  This is intellectually lazy. You can't just assume that the large numbers of people who hold a position you disagree with do so only because they have some secret bias. It's a position which is not falsifiable and which absolves oneself of having to think critically about their own position.
  - rchaud 5y ago
    One man's 'intellectually lazy' is another man's 'educated guess'. Or as this community loves to say about others, "“It is difficult to get a man to understand something, when his salary depends on his not understanding it.” There are plenty of people online playing devil's advocate because one day they too could be rich and they don't want the harsh yoke of government regulation holding them back. On HN, part of the audience is in closer proximity to that kind of wealth, and their arguments in favour of that status quo reflect this.

morelisp 5y ago

> Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unless the spec is so bad that most users will agree by accident. Reminder that Internet advertising has a lot of actors with competing interests, and it is not usually the "adtech companies" who don't want users to have an easy-opt out, but publishers and to a lesser extent the advertisers. Many "adtech companies" would love to have clearer legal signals and simpler, industry-wide justification to collect less data. Publishers have been very good at foisting all user frustration off on vague "adtech" (or alternately, adtech companies have been effective at reputation laundering for publishers/advertisers) but they're the ones that want to collect, share, and sell the data to be able to raise their rates.

Ensorceled 5y ago
This is fundamentally misunderstanding how internet advertising works: advertises will pay higher CPM for precise targeting and attribution publishers want the best CPM they can get adtech uses as many tricks as possible to get as much information as possible about a user so they can maximize the CPM the advertiser will pay Publishers just end up doing what ever their adtech partners tell them will give them the best CPM.
- morelisp 5y ago
  Haha, no. You're falling for the trick, or maybe you're just 10 years behind. Publishers (and retailers, and anyone with a dataset) seek out adtech partner companies, to justify high CPMs and to sell their audience data. Adtech companies are market-makers, it's been years since the data they can get independently of supply-side partners was worth shit. The publisher is the one with the cookie warning and consent forms! The publisher is the one who wants you to log in with a stable ID! The publisher is the one with a model of you regardless of your ad or tracker blocker settings! The adtech companies will sell you downstream for sure, but the publishers are the ones deploying as many tricks as possible to gather data. And yeah, adtech companies will advise them about how to effectively gather data. That's a lot less about "tricks" and more about how to build salable taxonomies instead of data lakes full of garbage. To the extent it's about tricks, it's more often the adtech companies having to patiently but firmly explain, no, you can't just hardcode a single consent state for all visitors and send that to us in lieu of a real CMP. (A purely theoretical example, of course...)

Placido 5y ago

Just use Super Agent. You choose your preferences once and that's it. And once iOS 15 is out, it will be available in mobile.

freediver 5y ago
What is Super Agent?

denton-scratch 5y ago

"the banners are malicious compliance." I agree. But I don't think it's because adtech want you to think privacy is shit; I think it's because by compelling you to click, they can run Javascript in the context of a user gesture. I want a plugin that automatically says "OK" to cookie banners. My browser already blocks 3rd-party cookies. It only allows session cookies. Cookie banners are like fire-hydrant CAPTCHAs - they masssively increase the friction that web users have to deal with. They also legitimise other kinds of popup window that websites present. I've noticed more and more popups appearing on first visit to a site, inviting me to subscribe to a newsletter or whatever. You often see a cookie banner, followed by a newsletter popup, followed by a Google login popup. Who knows, maybe there's a traffic-lights CAPTCHA. Then finally you're into the site, and it turns out to be Washpo or NYT, and you can't read the article anyway, because it's paywalled. Can we have our open web back please, mister?

loloquwowndueo 5y ago
“ I want a plugin that automatically says "OK" to cookie banners.” Try “I don’t care about cookies” :) https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/
- bwindels 5y ago
  Is this extension trustworthy? It is "recommended" and says GPL3 but there is no link to the source code anywhere.
  - tcit 5y ago
    The author doesn't publish the extension sources. https://reddit.com/comments/bru6wd/comment/eohtox3 https://reddit.com/comments/bru6wd/comment/eohtox3
    - grey_earthling 5y ago
      Their argument is that the extension as it's distributed is essentially a zip file containing the source code.

bwindels 5y ago

As I understand it, the idea would be to make respecting these automatic signal mandatory in an update to the GDPR. See https://techcrunch.com/2021/06/14/europe-needs-to-back-browser-level-controls-to-fix-cookie-consent-nightmares-says-privacy-group/ https://techcrunch.com/2021/06/14/europe-needs-to-back-brows... for some more context. Granted though that enforcement of the existing rules seems to be the biggest problem today.

ComodoHacker 5y ago
And if a browser or extension abuses these signals (i.e. always sends them without user's explicit and informed consent), who is liable?
- majewsky 5y ago
  Liable for what? GDPR says you can only collect data if you have informed consent from the user. It does not imply any right on the side of the business to be able to obtain such consent.

deleted 5y ago

[deleted]

quotemstr 5y ago

But privacy laws are pointless and should be repealed. All this noise about cookie privacy, fingerprinting, FLoC, tracking, etc. --- what are the actual harms that make these things bad? Has anyone in the real world ever experienced a concrete harm arising from interest targeting? Doubtful. The EU privacy regime imposes a heavy regulatory burden in exchange for nothing. Information is a non-rivalrous good. Further limiting its dissemination will increase friction all over the internet, impose new transaction costs on previously free interactions, and make the whole network less useful for everyone. And for what? Assuaging the paranoia of a tiny fragile and vocal minority of privacy activists? Sorry, but that's not worth breaking the internet.

Santosh83 5y ago
Information is power. The more information about more people with more depth to the graph is amassed by Big Tech and 3-letter agencies, the more soft power is accrued over large groups of people, economies, processes and even nations. And this ability is currently asymmetric. While Big Tech and Big Govt knows nearly everything about everybody, ordinary citizens are denied data and transparency. And even if the data may be hypothetically available, its scale precludes analysis by anyone except highly funded groups. Lack of privacy does translate to enormous soft power. It doesn't have to result in death, although the potential is there for that too. Democracy and individual liberty become meaningless except on paper. I'm not sure that's what we want, in exchange for a few conveniences in the palm of our hands.
- quotemstr 5y ago
  > The more information about more people with more depth to the graph is amassed by Big Tech and 3-letter agencies, the more soft power is accrued over large groups of people, economies, processes and even nations. Is there any evidence that Big Tech and Big Government are actually controlling people by tagging them in some database (which no human actually inspects) as being interested in hiking gear and cookie recipes? Give me a break. What you've described isn't a concrete harm, but an emotion --- specifically, fear. Lots of fears are baseless. So is this one. We shouldn't organize society around the baseless fears of tiny vocal minorities.

canadianfella 5y ago

“The Internet Explorer”

leokennis 5y ago

This exactly. This is also why I never feel "ashamed" when sites ask me to please disable my ad blocker because when I block ads they'll go out of business. Or why I'll always decline even "user respecting" ads on sites. We're fighting the ad and tracking industry here, the internet equivalent of a gang member with a shiv and a length of pipe. I'm not going to fight nicely. I'll deny you any chance and any method I get.

411111111111111 5y ago
Just a small reminder for people using Firefox and ublock origin: you can remove almost all cookie prompts by enabling the annoyances filters in the addon settings
- equitablequal 5y ago
  Anyone not using Firefox/Ublock; you can use NoScript to block the banners, and a lot of other adtech (including some paywalls such as Bloomberg) as they are all JS-powered. It's quite surprising to see how many JS plugins are in operation on a typical consumer site, and satisfying to know they were all blocked unless expressly permitted :)
  - Arnavion 5y ago
    Keep in mind, however, that you will end up enabling all the "Please enable Javascript to view our website (even though our website works well enough for your casual visit without it)" banners, that are enabled in the HTML by default and hidden by JS :) For example, one particular maroon-headwear-related Linux distro's bug tracker has a particularly egregious blinking bright red banner, asking you to enable JS for the website to "function correctly", even though reading bugs on said tracker works fine without it.
  - gnyman 5y ago
    And if you don't want to or can't install noscript, you can use my little hack https://noscript.it/ https://noscript.it/ to view a page without javascript. Note that it is a hack/poc and does not always work, especially the x-frame-detection is iffy so if you try it and just see a blank page try the "enable proxy" checkbox. I use it every now and then on iOS to get around some especially obnoxious JS, but if there were more users I would be more motivated to improve it (hint hint:-)

eastendguy 5y ago

"They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed." Once in a while I read/learn something new at HN that changes my perspective on things. This sentence is such an example.

patates 5y ago
I agree but I changed "pointless" with "hopeless" for a better effect on my end.

dmitryminkovsky 5y ago

> The annoying and confusing cookie banners are a feature. Not just that, but I’ve never seen a cookie banner that does anything. Cookies get sent down with the page on the initial load. Whenever I’ve opened an inspector to see if cookies get unset by JavaScript in response to my “opting out,” I’ve never seen an effect. The same cookies get sent after I opt out: no change. Has anyone seen a cookie preference banner that actually does something?

simpss 5y ago
smaller, local(to me) sites have started to have cookie banners that have an effect. My bank, 1/3 of the bigger news sites here etc... They all started with a single "agree" button, then went to "agree/disagree" with no effect and are finally starting to come around to a functioning disagree button. GDPR also helps here, as it defined what identifies an individual and that made most of the tracking PII even when it's all merged by a random ID that stays with the user. The effect is slow, but it's starting to work. Hopefully the next step will be abandoning cookie banners and only using technically required cookies(don't need conset) and/or non-identifying tracking for aggregate results. This is a massive improvment on UX and actually gives the company more quality data that doesn't identify any single individual. I'm personally pushing for aggregated tracking in my current company. It's an uphill battle, but one that can be won I think.
- imiric 5y ago
  > non-identifying tracking for aggregate results That sounds similar to FLoC, which is still very much identifying[1]. The solution to user tracking isn't less identifying tracking. It's no user tracking. [1]: https://blog.mozilla.org/en/mozilla/privacy-analysis-of-floc/ https://blog.mozilla.org/en/mozilla/privacy-analysis-of-floc...
Symbiote 5y ago
Look at well-funded government or other public websites. https://www.gov.uk/ https://www.gov.uk/, https://www.nhs.uk/ https://www.nhs.uk/, https://europa.eu/ https://europa.eu/, https://home.cern/ https://home.cern/, https://www.bundesregierung.de/ https://www.bundesregierung.de/ (maybe), https://www.dr.dk/ https://www.dr.dk/ (maybe).

nickpp 5y ago

Visit https://gdpr.eu https://gdpr.eu or https://europa.eu/european-union/index_en https://europa.eu/european-union/index_en "The Official website of the European Union". Look down. Both have cookie banner. The emperor is naked. The GDPR law is broken.

eli 5y ago

P3P wasn't great. It's pretty hard to reduce the nuance of how you're proposing to use data down to a handful of fields that will be automatically processed. I remember spending a silly amount of time trying to come up with a P3P policy that was both accurate and also didn't break sign-on for a single app that used multiple domains.

sebastian_z 5y ago

The ad industry is not monolithic, though. Some people want to genuinely move on to less privacy-invasive business models; others not. I have been to industry conferences where the advice was "well, if you do not like the Do Not Sell link on your site, maybe it's time to stop selling and start changing your business model." What is different this time around compared to P3P, DNT, and other earlier mechanisms is that the times have changed. Privacy is a much bigger topic. There is much more reporting now about privacy. Users understand a bit better better (though, we are still far off from real transparency). Lawmakers and regulators are catching up. Many companies embrace privacy. There is a burgeoning privacy tech industry with quite a bit of venture funding. Also, lessons were learned from earlier efforts. CalOPPA required recipients of DNT signals to only say whether they respect those. The CCPA regulations now require actual compliance. If the CCPA is applicable to your company, you have no choice but to respect it. And that is also true for automated browser signals. There is much stronger enforcement now behind more recent privacy laws. Virginia and Colorado recently enacted privacy laws, and it is likely that other states will do to. Disclosure: I am an academic researcher working with collaborators of all stripes on Global Privacy Control (GPC) [1, 2]. We are in touch with the good folks at ADPC and support their work. They are doing a fantastic job over there! [1] https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ [2] https://github.com/privacycg/proposals/issues/10 https://github.com/privacycg/proposals/issues/10

unknown_error 5y ago
Thing is, how is regulation supposed to ever keep up with the rapid advancements of technology and advertising and the lobbies that come with all that revenue? Capital and technology need not respect sovereign borders and laws as long as they can keep one step ahead of enforcement and still get enough revenue. The laws and lawmakers are fundamentally slower and weaker and poorer; by the time CCPA et al have an actual deterrent effect (beyond just mandated privacy notices), the industry will have moved on to some more sinister loophole. It's an arms race that 1700s-style government simply cannot keep up with. It takes months to come up with new algorithmic loopholes, decades to change the law, one industry-friendly administration to undo all the progress. Offloading privacy to government only works when you have strong states (China, the E.U. maybe). In the US, what's left of the federal government is too crippled to effectively tackle this (and arguably any technological problem) at scale. State-specific laws are subject to the same constraints, and additionally face the problem of enforcement across borders and Commerce Clause issues. If anything this will be an arms race between adtech and adblocking; Congress is the kid in the corner crying, "But I wanna play too!" and pretty much shrugged off by everyone else.