3 ms·

I fully second the DNT header. Perhaps even some common set of headers, like DNT/FirstPartyOnly/Performance) I like what GDPR did for privacy, but I absolutely

by ajford 5y ago

I fully second the DNT header. Perhaps even some common set of headers, like DNT/FirstPartyOnly/Performance) I like what GDPR did for privacy, but I absolutely hate it's impact on web browsing. Now _every_ damn site has a cookie banner covering the bottom third of the page. Plus many sites have a fixed nav or another damn banner at the top. Mobile browsing has gotten painful.

g_p 5y ago
California seems to be trying to pass (or succeeded in passing?) some new legislation which aims to get sites to honour some new version of DNT. The problem I have is that DNT is "good enough". Websites need to accept the law (opt in is needed, defaults must be to assume a user is opted out unless/until they do so of their own accord, and can't apply coercive pressure or try to force them to agree). DNT fell down when websites said they wouldn't honour it if browser makers made it enabled by default, or made it too easy for too many users to enable it, and it was "voluntary". We now see CCPA privacy statements required to state whether they honour a DNT opt-out... If the next step is to require sites to honour the preference, It just seems to me that adding a new header achieves very little, and using the existing one could achieve more in a shorter time! If we aren't careful, we'll end up with fingerprinting of the new privacy browser headers, based on the granularity of privacy choice information being conveyed in headers due to the various disparate attempts at applying more sticking plasters to the wound. Heck, fingerprinting just DNT and a couple of other proposed privacy headers alongside user agent would probably at least give enough information to distinguish multiple users sharing an IP via NAT... (!)
M2Ys4U 5y ago
Noyb have developed a new spec which would make handling this stuff easier called "Advanced Data Protection Control"[0] [0] https://www.dataprotectioncontrol.org/ https://www.dataprotectioncontrol.org/

by ajford 5y ago

g_p 5y ago

California seems to be trying to pass (or succeeded in passing?) some new legislation which aims to get sites to honour some new version of DNT. The problem I have is that DNT is "good enough". Websites need to accept the law (opt in is needed, defaults must be to assume a user is opted out unless/until they do so of their own accord, and can't apply coercive pressure or try to force them to agree). DNT fell down when websites said they wouldn't honour it if browser makers made it enabled by default, or made it too easy for too many users to enable it, and it was "voluntary". We now see CCPA privacy statements required to state whether they honour a DNT opt-out... If the next step is to require sites to honour the preference, It just seems to me that adding a new header achieves very little, and using the existing one could achieve more in a shorter time! If we aren't careful, we'll end up with fingerprinting of the new privacy browser headers, based on the granularity of privacy choice information being conveyed in headers due to the various disparate attempts at applying more sticking plasters to the wound. Heck, fingerprinting just DNT and a couple of other proposed privacy headers alongside user agent would probably at least give enough information to distinguish multiple users sharing an IP via NAT... (!)

M2Ys4U 5y ago

Noyb have developed a new spec which would make handling this stuff easier called "Advanced Data Protection Control"[0] [0] https://www.dataprotectioncontrol.org/ https://www.dataprotectioncontrol.org/