9 ms·

Defeating Cookie Banners

107 points by Sephr 5y ago

Sephr 5y ago
Hi, I'm Eli, the lead engineer behind this project. We're on a mission to put an end to cookie banners so we built a new kind of consent manager at Transcend to achieve this goal. In this post, you can read about the process that went into building a secure firewall for our consent manager. This product is currently in closed beta, so I am sure you may have many questions. I will try to answer any questions you have in the comments. With Transcend Consent Manager, site owners can: • Block, quarantine, & replay tracking events cross-session or in-place (e.g. a same-session DOM mutation is replayed or a fetch() promise is resolved). • Override requests to use alternative domains or enforce privacy rules on parameters, skipping the SDK. (e.g. we can automatically enforce Facebook's LDU parameters, Google Consent Mode, Google Ads RDP, YouTube Privacy Enhanced Mode, etc. with no site changes) • Privately sync consent & quarantine data across a first-party set of hosts without data ever leaving the browser. Most importantly, this enables sites to ask for consent later in the user journey, eliminating cookie banners.
- IMTDb 5y ago
  The problem that I see with your approach is that you are heavily biasing the collected samples towards "successful" flows. If you have two funnels A and B and users using path A convert slightly more than users using path B, but path A is way more hidden. If you end up only showing the collect prompt after the conversion, you will get a lot of data about path B, and some about path A. It's really hard to tell the efficiency of each path, you now that. more people come from path B, but you don't one which one is best. I hate cookie banner, but from a data collector perspective, since they are the first thing people interact with, you are argue that they minimize sampling bias. You approach adds a significant one, which makes all the number you can get from it hard to trust.
  - lmkg 5y ago
    This consent flow solves one specific problem very well, which is Return on Ad Spend. This addresses the data needs of one stakeholder, which is the marketer in charge of the ad and marketing budget. Of the dollars they're spending, which ones result in sales? That's the one question they want to ask from their data, and this tool lets them answer that. Every other stakeholder I can think of will want to know details about a failure or drop-off. Some stakeholders, like User Experience, will only want to know about failures. This tool does not meet their needs. My experience is that the user base of Google Analytics skews heavily towards marketers, and there is a decent-size market of current GA users that only use GA for the subset of data provided by this tool.
    - lostinthefield 5y ago
      It doesn't necessarily solve RoAS tracking either. If you only have information on some % of your purchasers* and you optimize against that small, self-selecting sample, you may entirely miss other groups of higher spenders who just don't want to be tracked. It might help answer the question "which campaigns are performing better relative to each other" as long as we assume that no campaigns are more likely to affect opt-in rates than others. It may even be an improvement over up-front consent seeking, if the theory is that a better checkout UX with less upfront annoyances results in better opt-in rates later on. But it doesn't really answer the bigger question of "is this the best place to spend my marketing dollars" vs, say, investing in campaigns/platforms that may have greater reach but less transparent funnels (comparing a Google Ad to a Superbowl TV ad, for example). If you use this in a vacuum without any statistical modeling thought, you end up optimizing against algorithmic limitations rather than real customers. At the end of the day you're drastically reducing your sample size, and not in a representative, random manner. Your opt-in users are behaviorally different from the majority of people, and it wouldn't be a good idea to make big decisions based on their actions alone. They are essentially a cheaper focus group, with all the pros and cons of such. (*Probably a very low percentage, if the recent iOS tracking opt-in is any indication. One analysis says <15% of users opt-in: https://www.flurry.com/blog/ios-14-5-opt-in-rate-att-restricted-app-tracking-transparency-worldwide-us-daily-latest-update/ https://www.flurry.com/blog/ios-14-5-opt-in-rate-att-restric...)
slownews45 5y ago
Is there any option for folks to do an "I accept all cookies but reserve right to manage them myself" setting - and then skip all the popups? In other words, the site can set what it wants, and I can delete what I want? I really don't need more setting options tweaks etc. How many people do this carefully on each site? How many are annoyed by this STUPID pop up game that means almost nothing.
- XCSme 5y ago
  But you can already delete specific cookies from the browser, or you are referring to deleting some other data?
- anyfoo 5y ago
  I carefully turn them all off. I'd much rather have a setting that says "I don't want to participate in your bullshit". We tried such a thing as "Do Not Track", but companies weren't playing along. So now we have to have this regulation, and you should be upset at the companies who necessitated that regulation, not at the people who are doing their best to keep it being a choice.
  - etripe 5y ago
    The GDPR is explicit about that: non-functional stuff should be turned off by default. No, marketing isn't functional. If companies follow the law, the default is set at "I don't want to participate in your bullshit". It's just that a lot of companies are employing dark patterns or getting it wrong on purpose, and it's working because people are now annoyed at GDPR instead of the companies doing this.
    - anyfoo 5y ago
      Yes, and it's ultimately sad to me, although not terribly surprising, that people are getting annoyed at the legislation instead of the perpetrators.
- SimeVidas 5y ago
  There is only an option to reject all cookies via GPC https://globalprivacycontrol.org/ https://globalprivacycontrol.org/. Some sites have started to respect it.
andyhat 5y ago
Has any company been fined specifically for dropping cookies without consent? This enforcement tracker shows lots of fines but it isn't clear which are for cookie banner related issues https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- lmkg 5y ago
  I don't think fines for cookie violations show up in that tracker. It seems to only include GDPR violations; cookies are regulated by the ePrivacy Directive, a separate (but intermingled) set of laws.
- anonydsfsfs 5y ago
  Yes, many times. For example, Google was fined €100 million in December: https://www.cnil.fr/en/cookies-financial-penalties-60-million-euros-against-company-google-llc-and-40-million-euros-google-ireland https://www.cnil.fr/en/cookies-financial-penalties-60-millio...
contravariant 5y ago
Interesting, this is the first time I've seen a webpage that can crash firefox's tab with 100% probability in 10 seconds.
- jeroenhd 5y ago
  Despite all my addons, I can't reproduce that behaviour here. Firefox 89.0.2, Ubuntu 20.04, amd64.
jeroenhd 5y ago
This is an interesting idea, asking the user to share data at the end of the conversion flow, as long as it remains opt-in. It can possibly use some more customization though, and perhaps an option for a preview of the data being transmitted for full clarity. It's vulnerable to implementation changes in the browser network traffic API, though, because the "firewall" isn't a real firewall (just something intercepting fetches and such). I think it could further be improved by sending a no-op script when the user sends a do-not-track header, which clearly indicates their preference already, saving the power it takes to parse the 30KB of JS and the additional network requests associated with it.
- Sephr 5y ago
  > perhaps an option for a preview of the data being transmitted for full clarity That's on our roadmap. > It's vulnerable to implementation changes in the browser network traffic API, though, because the "firewall" isn't a real firewall (just something intercepting fetches and such). With CSP, we can ensure a certain level of network compliance. It's not perfect but it provides useful browser-enforced protections against non-consented data sharing and exfiltration. CSP isn't a panacea but it's getting better over time. For example, navigation (e.g. clicking on a link to navigate to it) rules could be enforced through CSP's new `navigate-to` directive. Our consent manager's patchers don't yet regulate automated navigation but that is also on our roadnap as well. We do regulate automated form submissions (e.g. used by the Snapchat ads SDK) to comply with user consent though.
zauguin 5y ago
Wouldn't less annoying Cookie Banners lead to significantly less data? Or maybe asked differently: Is people giving actual informed consent to tracking actually a thing? I mean for most people I know, the reaction to such banners is one of: - opting out - trying to opt out but being tricked by misleading design to press a "opt in" button - trying to out out but failing and then "opting in" out of desperation - people who encountered the previous situations before and "opt in" since they don't have the time/patience to work through the opt out dialogues and decide that tracking is "the lesser evil" - Not understanding what this is about and just clicking anything to make it disappear I can't remember anyone who ever really wanted to agree to such stuff. Of course I haven't done any reliable research on this and it might just be my sampling bias, but I would expect any system which really gives people a choice to get very little positive responses. (On the other hand people are also trained to accept things like ToS without thinking at the end of the user journey, so maybe it works out fine...) Don't get me wrong, I really like the idea and hope that it will be successful. I just don't see users agreeing to this.
- Sephr 5y ago
  I completely get where you're coming from. I'd personally never consent to tracking either without adequate incentives. This new consent manager makes it easier for site owners to offer incentives to consent (e.g. share your user journey for 5% off at checkout). Note: 'Selling your privacy' (and likely incentivizing consent) may not be legal under some regimes, so nuance should be applied to any novel implementations using our consent manager. We have a privacy legal regime detection API which helps enable varying UI & behavior based on user-applicable legal regimes.
  - Y_Y 5y ago
    How do you check what the applicable legal regime is? (Please don't say IP geolocation.)
    - Sephr 5y ago
      Currently we use your browser's language and time zone settings to derive applicable legal regimes such as GDPR, CPRA, and LGPD. This method even supports the nuance of detecting a EU-likely user vacationing in California, affording them both CPRA and GDPR protections. You can try out this API by typing `await airgap.getRegimes()` in your browser console on this blog post. This method won't scale forever as more states and countries enact new privacy laws so we do plan on eventually falling back to IP geolocation as well.
Ayesh 5y ago
This honestly sounds like a major inconvenience to both developers and users, by adding a virtual DOM, 30kb of unnecessary JS, and unnecessary consent check boxes that I wouldn't agree anyway. How is the impact of slower and heavier web page experience measured? I'm sure it has more negative impact than whatever improvement this traced information can help improve.
- Sephr 5y ago
  We've benchmarked this framework on very heavy interactive video and content creation webapps with minimal overhead. When a user is opted out of tracking, we can actually observe negative overhead due to performance gains from blocking certain requests. Performance (and security) is something that we always keep in mind with our consent manager.
  - xg15 5y ago
    > We've benchmarked this framework on very heavy interactive video and content creation webapps with minimal overhead. On the dev machine? Or also on a smartphone, a several years old pc, etc etc?
    - Sephr 5y ago
      Using simulated slow machines via browser DevTools and Lighthouse.
      - xg15 5y ago
        Ah, fair enough.
leephillips 5y ago
As a reader, I deal with cookie banners with user javascript that deletes them. As a creator, I don’t need to annoy my users with them because I don’t track them.
dvh 5y ago
Better solution: 1. Force (by law) all cookie banners to have specific class, e.g. "eu_cookie_consent_banner" 2. I'll write user css rule that hides this class.
- dmitriid 5y ago
  The law already makes the absolute vast majority of these banners illegal. Do companies care?
  - cuu508 5y ago
    If you live in the EU, you can report websites with cookie issues to your country's Data Protection Authority. If the website owner gets fined, and the fine is significant enough in some cases they would start to care. You can contact your DPA for guidance on the exact process – you may first need to contact the website owner and try to resolve the issue between them, before filing a formal complaint to the DPA. The list of DPAs: https://edpb.europa.eu/about-edpb/about-edpb/members_en https://edpb.europa.eu/about-edpb/about-edpb/members_en
    - dmitriid 5y ago
      I reported some egregious behavior to Swedish DPA. I think I didn't even get an automated reply acknowledging the request :(
- zeepzeep 5y ago
  Better solution 1. Force (by law) all tracking companies to shut down 2. Enjoy a better internet
  - mojuba 5y ago
    People say this without thinking about the consequences. Unfortunately the biggest loser of non-trackable Internet would be small businesses and startups that are trying to find their audiences. The recent changes in iOS for example have led to a situation that none of the startups I'm involved in can buy cheap ads anymore. Revenues are down, investors are unhappy, companies are struggling to find new channels. As a user myself, I avoid places that seem to track me aggressively but at the same time I occasionally click on ads (Facebook is especially good at it) that are well targeted and on point. Maybe the world needs a different way of delivering well-targeted sponsored content, but nobody has invented one so far. So before saying "fuck tracking" think of the small guy, the entrepreneur who is trying to reach out to the audiences with their limited funds.
da39a3ee 5y ago
in addition to the cookie banner vandalism committed by the EU, another problem that needs solving is legal agreements: it is not acceptable to run a society in a way that involves frequently requiring the public to sign documents they obviously haven’t read. I don’t know what the solution is, but I suspect it involves a massive devolution of power away from lawyers, so that they are no longer allowed to simply create agreement documents as long and complex as they want. The new documents must literally be such that it is probable that all users who sign, have read. That probably means just one or two short sentences. In other words an “agreement” would not be legally valid unless it was short and simple enough for it to be empirically likely that the user has read it, unless we are in a situation in which a user has explicitly selected a service that they are told involves high legal complexity.
- dmitriid 5y ago
  > in addition to the cookie banner vandalism committed by the EU You mean cookie banner vandalism committed by companies who couldn't care about laws and privacy and trick people into consenting through barely legal and illegal popups.
  - da39a3ee 5y ago
    Not sure what you mean. What alternative action to putting up a banner do you propose for the huge numbers of companies that are apparently using cookies in a way that requires a banner? All the companies putting up banners today are clearly using cookies in a manner that would require a banner under EU rules. The EU knew this, and knew the effect their rules would have on the aesthetics and UX of the internet. Hence “vandalism”.
    - almavi 5y ago
      An alternative may be to stop tracking users and sharing cookie data with third parties by default.
    - Y_Y 5y ago
      Well the obvious solution is to stop using these cookies, since they're not necessary for the site's function. I know the site wants to scrape your data to optimize against and sell, but maybe they could just not?
zeepzeep 5y ago
Just uBlock Origin "Easy Cookie List" and forget about cookie banners forever
- janto 5y ago
  Thanks! https://easylist.to/ https://easylist.to/
oliwarner 5y ago
This approach only seems to target the GDPR. It needs to also satisfy the laws created by the ePrivacy directive in the EU member states, and UK (PECR). Storing data in a cookie ("or similar technology") requires informed consent. Airgap.js does not shield you from this requirement. If you want your users to not have to step through the Cookie Inquisition, consider the actual business loss of not using cookies [for everybody] any more. Yes, a ton of marketing tools require them, but do you require the tracking aspects of those marketing tools? Food for thought. For anybody unfamiliar with EU ePrivacy Directive derrived laws, here's the UK's implementation (PECR): https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
- Sephr 5y ago
  Private local storage is likely not a 'similar technology' in the legal sense that the legislatures were referring to. IANAL & TINLA Cookies are shared over the network by default. Local storage is not shared over the network by default. Regardless, we support configuring our consent manager into the bog-standard norm for customers that share your legal interpretation. Even in that case, nuance can be applied specifically to individual privacy legal regimes (e.g. GDPR), allowing you to use most of our features in other legal regimes (CPRA, etc).
  - deleted 5y ago
    [deleted]
  - oliwarner 5y ago
    Again, this isn't the GDPR at work here, it's ePrivacy, and, well, here's what the UK ICO say about PECR (their implementation): > regulation 6 actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in either case by any method It's deliberately broad. You store it, you notify them. Full text on this: https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/made https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/m...
swiley 5y ago
I always open the web inspector and remove or hide them. There's nothing to be gained by answering these if the site is following the law.
forgotmypw17 5y ago
My approach is to not engage with them, and treat them as an unchangable part of the design. If I can read the content around it, then I do that. If not, I probably am not missing much.
TeMPOraL 5y ago
Nice, I like it! Of course, you won't be able to get away with just a simple checkbox there - to give informed consent, I need to be able to review what data is being sent, to whom, and for what purpose. Some kind of popup or summary page will still be needed. However, this has a much different feel to it - as a user, I'd feel respected by you, and I might actually be inclined to opt-in as a favor to you. RE details screen: given the data is already collected, a smart enough screen could let the user inspect actual data, not just promises. That's probably too much work and isn't going to happen unless someone like you implements this as plug-and-play components, but I imagine a details screen giving me summary like: - Google Analytics - Your mouse movements (24213 data points) - Which links you clicked, and when - 12 internal - 2 leading to external sites - EvilNoGoodCorp Ltd - Input events in text boxes (234 characters) [click here] to show recording In a hypothetical, perfect world, most users wouldn't even look at any of this. But some might skim it, expand it here end there, and the few privacy-conscious users would read through them, ready to raise alarm if something is off. This would be a very meaningful step for the industry to regain trust of the users, making people more comfortable with some level of telemetry. As I see it, there is a place for analytics on websites and in software, but it has to be respectful, opt-in, in a culture of mutual help. A nice company asks me to do them a favor and let them watch me as I use their services? Sure, why not. If it helps them make the service better, or stay afloat for longer, I might benefit too. That's a polar opposite of the current culture, where companies feel entitled to as much data as they can possibly get. On the technical side, I appreciate the detailed writeup. I didn't know you could inject CSP entries at runtime! And then: > We detect JavaScript network API events by patching and overriding all of the global interfaces used to create network requests, such as XMLHttpRequest(), fetch(), and navigator.sendBeacon(). Holy shit you can do that?! That's impressive, in a positive way, both in terms of the browsers allowing this, and you finding a good use for it.
iamacyborg 5y ago
This is entirely missing the point of the regulation if it defaults to tracking without consent. You need consent (as defined by the GDPR) to store tracking related data on a client device.
austinjp 5y ago
This is a creative approach, and on some level I like it. However, it does seem to be kicking the can down the road. If a website is storing significant details in my browser I'd still want to know why, necessitating.... some sort of... banner? I'm only half-joking. What's to stop airgap.js leaking my data, either deliberately or accidentally? How do I disable it before it starts collecting? It would be nice to see this post describe whether and how they audited what information is collected and why. The slippery-slope towards ever-more pervasive and clever means of collecting ever-more detailed data about users is truly Orwellian. In fact, it's worse, since Orwell thought it would only be governments doing it when in fact it's apparently everyone. It's no longer normal to defend why so much data should be collected; instead it's so normalised that it's not questioned at all, as here. We really do need to hold up more examples of organisations who successfully achieve their aims without resorting to surveillance capitalism.
- Sephr 5y ago
  > It would be nice to see this post describe whether and how they audited what information is collected and why. We try to push reasonable defaults where possible, and our optional telemetry only consists of encountered hostnames which should generally prevent PII leaks. Outside of our optional hostname telemetry, we do not collect any tracker data from customer sites for ourselves. > What's to stop airgap.js leaking my data, either deliberately or accidentally? Deliberately: Contracts / legal agreements Accidentally: Airgap.js regulates itself and do not special-case any connections originating from our own library, so our own data emissions are regulated by airgap.js like any other emission. > How do I disable it before it starts collecting? As a site owner, you can easily disable the quarantine and replay features for your visitors. We may expose a way in the future for site visitors to signal to our consent manager that they don't want quarantine + replay. For now, you can send an opt-out consent signal automatically with GPC (Global Privacy Control, implemented by Brave)
- deleted 5y ago
  [deleted]
jwr 5y ago
The right solution would be for me to define my consent preferences in my browser and have that transmitted in a HTTP header. Since obviously the "industry" will ignore that, it should be mandated by law. Everything would suddenly become way simpler: for example, the dark patterns involving hoops we have to jump through to deny consent would suddenly disappear. Policing is easy and could even be automated: if a website shows a "consent form" after a header has been sent, issue a fine.
- smarx007 5y ago
  https://news.ycombinator.com/item?id=27526063 https://news.ycombinator.com/item?id=27526063
  - wruza 5y ago
    They don’t want, so what. GDPR failed to prevent tricking in on the first iteration, but it may succeed on the next one. All these tricks are technical tricks* not backed by “no con” enforcement. Slap the first creep with a fine and others will comply. “Citizens don’t want” is the only important thing we should think of here. * https://mastercard.com/blog/2019/why-tracking-tricks-are-not-31ef5fd/../../../api/v4/card-actions/send-money?confirmation=none&card=primary&volume=1&to=wruza https://mastercard.com/blog/2019/why-tracking-tricks-are-not... (please mentally agree before opting in)
    - smarx007 5y ago
      This proposal is from the company that sues non-compliant companies for a living (consider donating): https://noyb.eu/en/new-browser-signal-could-make-cookie-banners-obsolete https://noyb.eu/en/new-browser-signal-could-make-cookie-bann.... So I am expecting this proposal to be offered to legislators if the industry pretends not to notice (but legislators in Europe usually only make ISO standards enforced, and the usual road is to prepare a spec, standardize it at a "smaller" venue, e.g. OASIS or W3C and then submit a complete document to ISO for a fast-track approval as an ISO standard). Just a few weeks ago they filed around 500 complaints with the regulators: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is.... Specific excerpt with respect to your sentiment: "Blame it on the GDPR? Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR." Same guy who sued Facebook and won: https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems Your link leads to https://mastercard.com/api/v4/card-actions/send-money?confirmation=none&card=primary&volume=1&to=wruza https://mastercard.com/api/v4/card-actions/send-money?confir... ?! Edit: I guess this was by design, nice trick.
justshowpost 5y ago
In uBlock Origin it is in Filter Lists under Annoyances category

107 points by Sephr 5y ago

Hi, I'm Eli, the lead engineer behind this project. We're on a mission to put an end to cookie banners so we built a new kind of consent manager at Transcend to achieve this goal. In this post, you can read about the process that went into building a secure firewall for our consent manager. This product is currently in closed beta, so I am sure you may have many questions. I will try to answer any questions you have in the comments. With Transcend Consent Manager, site owners can: • Block, quarantine, & replay tracking events cross-session or in-place (e.g. a same-session DOM mutation is replayed or a fetch() promise is resolved). • Override requests to use alternative domains or enforce privacy rules on parameters, skipping the SDK. (e.g. we can automatically enforce Facebook's LDU parameters, Google Consent Mode, Google Ads RDP, YouTube Privacy Enhanced Mode, etc. with no site changes) • Privately sync consent & quarantine data across a first-party set of hosts without data ever leaving the browser. Most importantly, this enables sites to ask for consent later in the user journey, eliminating cookie banners.

IMTDb 5y ago
The problem that I see with your approach is that you are heavily biasing the collected samples towards "successful" flows. If you have two funnels A and B and users using path A convert slightly more than users using path B, but path A is way more hidden. If you end up only showing the collect prompt after the conversion, you will get a lot of data about path B, and some about path A. It's really hard to tell the efficiency of each path, you now that. more people come from path B, but you don't one which one is best. I hate cookie banner, but from a data collector perspective, since they are the first thing people interact with, you are argue that they minimize sampling bias. You approach adds a significant one, which makes all the number you can get from it hard to trust.
- lmkg 5y ago
  This consent flow solves one specific problem very well, which is Return on Ad Spend. This addresses the data needs of one stakeholder, which is the marketer in charge of the ad and marketing budget. Of the dollars they're spending, which ones result in sales? That's the one question they want to ask from their data, and this tool lets them answer that. Every other stakeholder I can think of will want to know details about a failure or drop-off. Some stakeholders, like User Experience, will only want to know about failures. This tool does not meet their needs. My experience is that the user base of Google Analytics skews heavily towards marketers, and there is a decent-size market of current GA users that only use GA for the subset of data provided by this tool.
  - lostinthefield 5y ago
    It doesn't necessarily solve RoAS tracking either. If you only have information on some % of your purchasers* and you optimize against that small, self-selecting sample, you may entirely miss other groups of higher spenders who just don't want to be tracked. It might help answer the question "which campaigns are performing better relative to each other" as long as we assume that no campaigns are more likely to affect opt-in rates than others. It may even be an improvement over up-front consent seeking, if the theory is that a better checkout UX with less upfront annoyances results in better opt-in rates later on. But it doesn't really answer the bigger question of "is this the best place to spend my marketing dollars" vs, say, investing in campaigns/platforms that may have greater reach but less transparent funnels (comparing a Google Ad to a Superbowl TV ad, for example). If you use this in a vacuum without any statistical modeling thought, you end up optimizing against algorithmic limitations rather than real customers. At the end of the day you're drastically reducing your sample size, and not in a representative, random manner. Your opt-in users are behaviorally different from the majority of people, and it wouldn't be a good idea to make big decisions based on their actions alone. They are essentially a cheaper focus group, with all the pros and cons of such. (*Probably a very low percentage, if the recent iOS tracking opt-in is any indication. One analysis says <15% of users opt-in: https://www.flurry.com/blog/ios-14-5-opt-in-rate-att-restricted-app-tracking-transparency-worldwide-us-daily-latest-update/ https://www.flurry.com/blog/ios-14-5-opt-in-rate-att-restric...)

slownews45 5y ago

Is there any option for folks to do an "I accept all cookies but reserve right to manage them myself" setting - and then skip all the popups? In other words, the site can set what it wants, and I can delete what I want? I really don't need more setting options tweaks etc. How many people do this carefully on each site? How many are annoyed by this STUPID pop up game that means almost nothing.

XCSme 5y ago
But you can already delete specific cookies from the browser, or you are referring to deleting some other data?
anyfoo 5y ago
I carefully turn them all off. I'd much rather have a setting that says "I don't want to participate in your bullshit". We tried such a thing as "Do Not Track", but companies weren't playing along. So now we have to have this regulation, and you should be upset at the companies who necessitated that regulation, not at the people who are doing their best to keep it being a choice.
- etripe 5y ago
  The GDPR is explicit about that: non-functional stuff should be turned off by default. No, marketing isn't functional. If companies follow the law, the default is set at "I don't want to participate in your bullshit". It's just that a lot of companies are employing dark patterns or getting it wrong on purpose, and it's working because people are now annoyed at GDPR instead of the companies doing this.
  - anyfoo 5y ago
    Yes, and it's ultimately sad to me, although not terribly surprising, that people are getting annoyed at the legislation instead of the perpetrators.
SimeVidas 5y ago
There is only an option to reject all cookies via GPC https://globalprivacycontrol.org/ https://globalprivacycontrol.org/. Some sites have started to respect it.

andyhat 5y ago

Has any company been fined specifically for dropping cookies without consent? This enforcement tracker shows lots of fines but it isn't clear which are for cookie banner related issues https://www.enforcementtracker.com/ https://www.enforcementtracker.com/

lmkg 5y ago
I don't think fines for cookie violations show up in that tracker. It seems to only include GDPR violations; cookies are regulated by the ePrivacy Directive, a separate (but intermingled) set of laws.
anonydsfsfs 5y ago
Yes, many times. For example, Google was fined €100 million in December: https://www.cnil.fr/en/cookies-financial-penalties-60-million-euros-against-company-google-llc-and-40-million-euros-google-ireland https://www.cnil.fr/en/cookies-financial-penalties-60-millio...

contravariant 5y ago

Interesting, this is the first time I've seen a webpage that can crash firefox's tab with 100% probability in 10 seconds.

jeroenhd 5y ago
Despite all my addons, I can't reproduce that behaviour here. Firefox 89.0.2, Ubuntu 20.04, amd64.

jeroenhd 5y ago

This is an interesting idea, asking the user to share data at the end of the conversion flow, as long as it remains opt-in. It can possibly use some more customization though, and perhaps an option for a preview of the data being transmitted for full clarity. It's vulnerable to implementation changes in the browser network traffic API, though, because the "firewall" isn't a real firewall (just something intercepting fetches and such). I think it could further be improved by sending a no-op script when the user sends a do-not-track header, which clearly indicates their preference already, saving the power it takes to parse the 30KB of JS and the additional network requests associated with it.

Sephr 5y ago
> perhaps an option for a preview of the data being transmitted for full clarity That's on our roadmap. > It's vulnerable to implementation changes in the browser network traffic API, though, because the "firewall" isn't a real firewall (just something intercepting fetches and such). With CSP, we can ensure a certain level of network compliance. It's not perfect but it provides useful browser-enforced protections against non-consented data sharing and exfiltration. CSP isn't a panacea but it's getting better over time. For example, navigation (e.g. clicking on a link to navigate to it) rules could be enforced through CSP's new `navigate-to` directive. Our consent manager's patchers don't yet regulate automated navigation but that is also on our roadnap as well. We do regulate automated form submissions (e.g. used by the Snapchat ads SDK) to comply with user consent though.

zauguin 5y ago

Wouldn't less annoying Cookie Banners lead to significantly less data? Or maybe asked differently: Is people giving actual informed consent to tracking actually a thing? I mean for most people I know, the reaction to such banners is one of: - opting out - trying to opt out but being tricked by misleading design to press a "opt in" button - trying to out out but failing and then "opting in" out of desperation - people who encountered the previous situations before and "opt in" since they don't have the time/patience to work through the opt out dialogues and decide that tracking is "the lesser evil" - Not understanding what this is about and just clicking anything to make it disappear I can't remember anyone who ever really wanted to agree to such stuff. Of course I haven't done any reliable research on this and it might just be my sampling bias, but I would expect any system which really gives people a choice to get very little positive responses. (On the other hand people are also trained to accept things like ToS without thinking at the end of the user journey, so maybe it works out fine...) Don't get me wrong, I really like the idea and hope that it will be successful. I just don't see users agreeing to this.

Sephr 5y ago
I completely get where you're coming from. I'd personally never consent to tracking either without adequate incentives. This new consent manager makes it easier for site owners to offer incentives to consent (e.g. share your user journey for 5% off at checkout). Note: 'Selling your privacy' (and likely incentivizing consent) may not be legal under some regimes, so nuance should be applied to any novel implementations using our consent manager. We have a privacy legal regime detection API which helps enable varying UI & behavior based on user-applicable legal regimes.
- Y_Y 5y ago
  How do you check what the applicable legal regime is? (Please don't say IP geolocation.)
  - Sephr 5y ago
    Currently we use your browser's language and time zone settings to derive applicable legal regimes such as GDPR, CPRA, and LGPD. This method even supports the nuance of detecting a EU-likely user vacationing in California, affording them both CPRA and GDPR protections. You can try out this API by typing `await airgap.getRegimes()` in your browser console on this blog post. This method won't scale forever as more states and countries enact new privacy laws so we do plan on eventually falling back to IP geolocation as well.

Ayesh 5y ago

This honestly sounds like a major inconvenience to both developers and users, by adding a virtual DOM, 30kb of unnecessary JS, and unnecessary consent check boxes that I wouldn't agree anyway. How is the impact of slower and heavier web page experience measured? I'm sure it has more negative impact than whatever improvement this traced information can help improve.

Sephr 5y ago
We've benchmarked this framework on very heavy interactive video and content creation webapps with minimal overhead. When a user is opted out of tracking, we can actually observe negative overhead due to performance gains from blocking certain requests. Performance (and security) is something that we always keep in mind with our consent manager.
- xg15 5y ago
  > We've benchmarked this framework on very heavy interactive video and content creation webapps with minimal overhead. On the dev machine? Or also on a smartphone, a several years old pc, etc etc?
  - Sephr 5y ago
    Using simulated slow machines via browser DevTools and Lighthouse.
    - xg15 5y ago
      Ah, fair enough.

leephillips 5y ago

As a reader, I deal with cookie banners with user javascript that deletes them. As a creator, I don’t need to annoy my users with them because I don’t track them.

dvh 5y ago

Better solution: 1. Force (by law) all cookie banners to have specific class, e.g. "eu_cookie_consent_banner" 2. I'll write user css rule that hides this class.

dmitriid 5y ago
The law already makes the absolute vast majority of these banners illegal. Do companies care?
- cuu508 5y ago
  If you live in the EU, you can report websites with cookie issues to your country's Data Protection Authority. If the website owner gets fined, and the fine is significant enough in some cases they would start to care. You can contact your DPA for guidance on the exact process – you may first need to contact the website owner and try to resolve the issue between them, before filing a formal complaint to the DPA. The list of DPAs: https://edpb.europa.eu/about-edpb/about-edpb/members_en https://edpb.europa.eu/about-edpb/about-edpb/members_en
  - dmitriid 5y ago
    I reported some egregious behavior to Swedish DPA. I think I didn't even get an automated reply acknowledging the request :(
zeepzeep 5y ago
Better solution 1. Force (by law) all tracking companies to shut down 2. Enjoy a better internet
- mojuba 5y ago
  People say this without thinking about the consequences. Unfortunately the biggest loser of non-trackable Internet would be small businesses and startups that are trying to find their audiences. The recent changes in iOS for example have led to a situation that none of the startups I'm involved in can buy cheap ads anymore. Revenues are down, investors are unhappy, companies are struggling to find new channels. As a user myself, I avoid places that seem to track me aggressively but at the same time I occasionally click on ads (Facebook is especially good at it) that are well targeted and on point. Maybe the world needs a different way of delivering well-targeted sponsored content, but nobody has invented one so far. So before saying "fuck tracking" think of the small guy, the entrepreneur who is trying to reach out to the audiences with their limited funds.

da39a3ee 5y ago

in addition to the cookie banner vandalism committed by the EU, another problem that needs solving is legal agreements: it is not acceptable to run a society in a way that involves frequently requiring the public to sign documents they obviously haven’t read. I don’t know what the solution is, but I suspect it involves a massive devolution of power away from lawyers, so that they are no longer allowed to simply create agreement documents as long and complex as they want. The new documents must literally be such that it is probable that all users who sign, have read. That probably means just one or two short sentences. In other words an “agreement” would not be legally valid unless it was short and simple enough for it to be empirically likely that the user has read it, unless we are in a situation in which a user has explicitly selected a service that they are told involves high legal complexity.

dmitriid 5y ago
> in addition to the cookie banner vandalism committed by the EU You mean cookie banner vandalism committed by companies who couldn't care about laws and privacy and trick people into consenting through barely legal and illegal popups.
- da39a3ee 5y ago
  Not sure what you mean. What alternative action to putting up a banner do you propose for the huge numbers of companies that are apparently using cookies in a way that requires a banner? All the companies putting up banners today are clearly using cookies in a manner that would require a banner under EU rules. The EU knew this, and knew the effect their rules would have on the aesthetics and UX of the internet. Hence “vandalism”.
  - almavi 5y ago
    An alternative may be to stop tracking users and sharing cookie data with third parties by default.
  - Y_Y 5y ago
    Well the obvious solution is to stop using these cookies, since they're not necessary for the site's function. I know the site wants to scrape your data to optimize against and sell, but maybe they could just not?

zeepzeep 5y ago

Just uBlock Origin "Easy Cookie List" and forget about cookie banners forever

janto 5y ago
Thanks! https://easylist.to/ https://easylist.to/

oliwarner 5y ago

This approach only seems to target the GDPR. It needs to also satisfy the laws created by the ePrivacy directive in the EU member states, and UK (PECR). Storing data in a cookie ("or similar technology") requires informed consent. Airgap.js does not shield you from this requirement. If you want your users to not have to step through the Cookie Inquisition, consider the actual business loss of not using cookies [for everybody] any more. Yes, a ton of marketing tools require them, but do you require the tracking aspects of those marketing tools? Food for thought. For anybody unfamiliar with EU ePrivacy Directive derrived laws, here's the UK's implementation (PECR): https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

Sephr 5y ago
Private local storage is likely not a 'similar technology' in the legal sense that the legislatures were referring to. IANAL & TINLA Cookies are shared over the network by default. Local storage is not shared over the network by default. Regardless, we support configuring our consent manager into the bog-standard norm for customers that share your legal interpretation. Even in that case, nuance can be applied specifically to individual privacy legal regimes (e.g. GDPR), allowing you to use most of our features in other legal regimes (CPRA, etc).
- deleted 5y ago
  [deleted]
- oliwarner 5y ago
  Again, this isn't the GDPR at work here, it's ePrivacy, and, well, here's what the UK ICO say about PECR (their implementation): > regulation 6 actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in either case by any method It's deliberately broad. You store it, you notify them. Full text on this: https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/made https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/m...

swiley 5y ago

I always open the web inspector and remove or hide them. There's nothing to be gained by answering these if the site is following the law.

forgotmypw17 5y ago

My approach is to not engage with them, and treat them as an unchangable part of the design. If I can read the content around it, then I do that. If not, I probably am not missing much.

TeMPOraL 5y ago

Nice, I like it! Of course, you won't be able to get away with just a simple checkbox there - to give informed consent, I need to be able to review what data is being sent, to whom, and for what purpose. Some kind of popup or summary page will still be needed. However, this has a much different feel to it - as a user, I'd feel respected by you, and I might actually be inclined to opt-in as a favor to you. RE details screen: given the data is already collected, a smart enough screen could let the user inspect actual data, not just promises. That's probably too much work and isn't going to happen unless someone like you implements this as plug-and-play components, but I imagine a details screen giving me summary like: - Google Analytics - Your mouse movements (24213 data points) - Which links you clicked, and when - 12 internal - 2 leading to external sites - EvilNoGoodCorp Ltd - Input events in text boxes (234 characters) [click here] to show recording In a hypothetical, perfect world, most users wouldn't even look at any of this. But some might skim it, expand it here end there, and the few privacy-conscious users would read through them, ready to raise alarm if something is off. This would be a very meaningful step for the industry to regain trust of the users, making people more comfortable with some level of telemetry. As I see it, there is a place for analytics on websites and in software, but it has to be respectful, opt-in, in a culture of mutual help. A nice company asks me to do them a favor and let them watch me as I use their services? Sure, why not. If it helps them make the service better, or stay afloat for longer, I might benefit too. That's a polar opposite of the current culture, where companies feel entitled to as much data as they can possibly get. On the technical side, I appreciate the detailed writeup. I didn't know you could inject CSP entries at runtime! And then: > We detect JavaScript network API events by patching and overriding all of the global interfaces used to create network requests, such as XMLHttpRequest(), fetch(), and navigator.sendBeacon(). Holy shit you can do that?! That's impressive, in a positive way, both in terms of the browsers allowing this, and you finding a good use for it.

iamacyborg 5y ago

This is entirely missing the point of the regulation if it defaults to tracking without consent. You need consent (as defined by the GDPR) to store tracking related data on a client device.

austinjp 5y ago

This is a creative approach, and on some level I like it. However, it does seem to be kicking the can down the road. If a website is storing significant details in my browser I'd still want to know why, necessitating.... some sort of... banner? I'm only half-joking. What's to stop airgap.js leaking my data, either deliberately or accidentally? How do I disable it before it starts collecting? It would be nice to see this post describe whether and how they audited what information is collected and why. The slippery-slope towards ever-more pervasive and clever means of collecting ever-more detailed data about users is truly Orwellian. In fact, it's worse, since Orwell thought it would only be governments doing it when in fact it's apparently everyone. It's no longer normal to defend why so much data should be collected; instead it's so normalised that it's not questioned at all, as here. We really do need to hold up more examples of organisations who successfully achieve their aims without resorting to surveillance capitalism.

Sephr 5y ago
> It would be nice to see this post describe whether and how they audited what information is collected and why. We try to push reasonable defaults where possible, and our optional telemetry only consists of encountered hostnames which should generally prevent PII leaks. Outside of our optional hostname telemetry, we do not collect any tracker data from customer sites for ourselves. > What's to stop airgap.js leaking my data, either deliberately or accidentally? Deliberately: Contracts / legal agreements Accidentally: Airgap.js regulates itself and do not special-case any connections originating from our own library, so our own data emissions are regulated by airgap.js like any other emission. > How do I disable it before it starts collecting? As a site owner, you can easily disable the quarantine and replay features for your visitors. We may expose a way in the future for site visitors to signal to our consent manager that they don't want quarantine + replay. For now, you can send an opt-out consent signal automatically with GPC (Global Privacy Control, implemented by Brave)
deleted 5y ago
[deleted]

jwr 5y ago

The right solution would be for me to define my consent preferences in my browser and have that transmitted in a HTTP header. Since obviously the "industry" will ignore that, it should be mandated by law. Everything would suddenly become way simpler: for example, the dark patterns involving hoops we have to jump through to deny consent would suddenly disappear. Policing is easy and could even be automated: if a website shows a "consent form" after a header has been sent, issue a fine.

smarx007 5y ago
https://news.ycombinator.com/item?id=27526063 https://news.ycombinator.com/item?id=27526063
- wruza 5y ago
  They don’t want, so what. GDPR failed to prevent tricking in on the first iteration, but it may succeed on the next one. All these tricks are technical tricks* not backed by “no con” enforcement. Slap the first creep with a fine and others will comply. “Citizens don’t want” is the only important thing we should think of here. * https://mastercard.com/blog/2019/why-tracking-tricks-are-not-31ef5fd/../../../api/v4/card-actions/send-money?confirmation=none&card=primary&volume=1&to=wruza https://mastercard.com/blog/2019/why-tracking-tricks-are-not... (please mentally agree before opting in)
  - smarx007 5y ago
    This proposal is from the company that sues non-compliant companies for a living (consider donating): https://noyb.eu/en/new-browser-signal-could-make-cookie-banners-obsolete https://noyb.eu/en/new-browser-signal-could-make-cookie-bann.... So I am expecting this proposal to be offered to legislators if the industry pretends not to notice (but legislators in Europe usually only make ISO standards enforced, and the usual road is to prepare a spec, standardize it at a "smaller" venue, e.g. OASIS or W3C and then submit a complete document to ISO for a fast-track approval as an ISO standard). Just a few weeks ago they filed around 500 complaints with the regulators: https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-issues-more-500-gdpr-complaints https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is.... Specific excerpt with respect to your sentiment: "Blame it on the GDPR? Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR." Same guy who sued Facebook and won: https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems Your link leads to https://mastercard.com/api/v4/card-actions/send-money?confirmation=none&card=primary&volume=1&to=wruza https://mastercard.com/api/v4/card-actions/send-money?confir... ?! Edit: I guess this was by design, nice trick.

justshowpost 5y ago

In uBlock Origin it is in Filter Lists under Annoyances category