11 ms·
Consent-O-Matic: Automatic handling of GDPR consent forms
- mproud 5y agoI run a site that’s 6 years old and has about 1,000 active users in a week, and 100,000 lifetime users. Maybe that’s considered small? People create images on it, and I store those images. But how many GDPR data requests have I had this entire time? 0. Not a single one.
- zigzag312 5y agoI'm not an author of this extension, just an user. It's not perfect. It still misses many consent forms, but when it works it works wonderfully. Bigger awareness might lead to more contributions to automate away even more consent forms.
- robert_foss 5y agoUnlike other extensions, this one doesn't simply 'Accept All', but rather allows you to set default preferences and uses those.
- gyulai 5y agoI wish people would stop confusing cookie-consent laws and GDPR. They are quite distinct laws and are giving GDPR a bad rap for wholly the wrong reasons.
- dmitriid 5y agoAnd GDPR largely superseded cookie consent IMO. As in: you don't even have to ask consent if the cookies are strictly necessary: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
- deleted 5y ago[deleted]
- megapolitics 5y agoThe consent form situation did not get this bad until GDPR was passed. Prior to GDPR cookie-consent forms were simple "Yes" or "No" buttons without all the insane pages of toggles.
- wiz21c 5y agoDead simple solution: provide a GDPR consent form with "yes, I accept being tracked" or "no I refuse being tracked in any way". Or even better, make the form automatically recognizable by your browser and a setting in the browser so that it says yes or no for you. Have you ever notices that the "yes I agree" button is most of the time MUCH easier to click on than to tell "no I don't" ?
- chriswarbo 5y ago> Have you ever notices that the "yes I agree" button is most of the time MUCH easier to click on than to tell "no I don't"? That's illegal under GDPR. Yet here we are.
- hnbad 5y agoGDPR did mandate defaulting all of those toggles to "decline" though, even though some are trying to get clever and add additional toggles for "legitimate interest" (which isn't how that works legally but AFAIK nobody has been sued over that yet). The follow-up privacy legislation also bans the current dark pattern of making the "accept all" button more prominent and obvious than "decline all" at least requiring both to be equally prominent. The flow of having to go through "manage" or "see options" or other shenanigans as links in order to decline all has always been in violation of the GDPR and could theoretically open you up to the fines as it demonstrates intent.
- JimWestergren 5y agoOr just activate the filter in uBlock Origin: Filter Lists -> Annoyances -> EasyList Cookie
- submeta 5y agoThis is great! Thank you for sharing.
- JohnJamesRambo 5y agoOh my goodness thank you.
- Aissen 5y agoI've used it, but it's not perfect and might occasionally break some websites (e.g can't scroll).
- zigzag312 5y agoI had same issue with other solutions I tried. Consent-O-Matic is the only extension I found so far that doesn't break pages. But it doesn't handle all consents unfortunately.
- jokoon 5y agohttps://news.ycombinator.com/item?id=30625756 https://news.ycombinator.com/item?id=30625756 Because it inserts a overflow: hidden in <html> or <body> Quite annoying!
- mp3geek 5y agoOver the last few months this be much improved, many commits have fixed a few noscroll issues. If you find any let me know. /FanboyNZ
- MereInterest 5y agoTo add to this, blocking the GDPR pop-ups is legally equivalent to declining all but the essential cookies. This is because GDPR establishes a default that users may not be tracked, and explicit, freely given, informed consent is an exception to that general rule. If the pop-up is ignored, blocked, or contains insufficient information, then the exception is not granted, and the site may not track you. Granted, whether or not sites are following the law is another matter altogether.
- Semaphor 5y agoThe last time [0] (no other comments, just for the easy links), the poster also wrote > If you trust prebuilt versions of extensions like this-- > Available on Firefox: https://addons.mozilla.org/en-US/firefox/addon/consent-o-matic/ https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat... > Available on Chrome: https://chrome.google.com/webstore/detail/consent-o-matic/mdjildafknihdffpkfmmpnpoiajfjnjd https://chrome.google.com/webstore/detail/consent-o-matic/md... [0]: https://news.ycombinator.com/item?id=29995791 https://news.ycombinator.com/item?id=29995791
- vanderZwan 5y agoWhat I'd be much more interested in is some form of automated reporting of GDPR violations. EDIT: not to knock on the efforts of this developer though! Just thinking that actually holding websites accountable would be a way out of this internet harassment arms race in the long run.
- frafra 5y agoNOYB is doing something like that, but they send notifications to the website owners before reporting a violation: https://noyb.eu/en/more-cookie-banners-go-second-wave-complaints-underway https://noyb.eu/en/more-cookie-banners-go-second-wave-compla...
- m00dy 5y agoanyone thinking that the detection part is possible through a deep learning model ?
- eternityforest 5y agoI wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.
- Cthulhu_ 5y agoThat's the main issue here; the EU mandated consent and gave guidelines on what that consent might look like, but they left implementation down to the industry, which decided to do it themselves (often using dark patterns, for which some companies already got fined) instead of integrating it in browsers. I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? I mean I know that Chrome and Firefox won't block ads by default because it affects their bottom line (Chrome through Google ads, Firefox through Google money), but what about GDPR consent forms and newsletter sign-up popups?
- radicalbyte 5y agoGoogle funded two of the three big browsers. That does a lot to kill innovation.
- danuker 5y agoI suppose they're making us suffer so we pressure politicians.
- josefx 5y agoI wouldn't be surprised if Googles consent form intentionally broke every GDPR rule. First time I saw it it didn't bombard me with dark patterns, it sent me down a rabbit hole of near infinite options where I couldn't even tell if any of them where relevant for Google search. They don't want to give users a quick and easy way to opt out, especially not while they are still working on replacement APIs that use sleight of hand, confusing technobabble and a decent amount of hand waving to not only avoid GDPR restrictions but make your browser track you for them. This isn't just Google, Mozilla seems to have sold out to Meta and is working on its own tracking API.
- asah 5y agoRelated q: is there anyone choosing to accept all ? (Knowingly)
- sdoering 5y agoAs my hosts-file and ad/script blocker are configured to block tracking and advertising I always click: Accept all. This is by default the quickest way to get to the content. Without compromising privacy by using addons.
- denton-scratch 5y agoHmm. How does one block ads without a plug-in?
- ginko 5y agoWouldn't that still allow advertisers to track you through your IP or other means?
- sdoering 5y agoThe extension in my browser block the outgoing call. If something goes through the host file redirects this to my local host that doesn't answer. So no - advertisers never "see" me.
- sdoering 5y agoNot sure what it should do, but after installing it it just did nothing on a few German news sites I tested it on. It also did nothing on my own site (using klaro.js). I would still have to click and do the same steps that I would have done without the plugin. No idea what should have been the effect.
- xPaw 5y agoHow different is this from "I don't care about cookies" extension?
- oreilles 5y ago"I don't care about cookies" accepts everything and you can't change its behavior. This extension allows you to reject them all by default.
- jokoon 5y agoI just block them using ublock origin, right click -> block element. One problem is that often, those forms insert a "overflow: hidden" into either <body> or <html>, meaning the page cannot scroll anymore. Twitter does this too. It's possible to just remove it with the dev tools, but it's quite annoying. I've asked ublock for a way to fix this, like: ##body,html:matches-css(overflow: hidden):style(overflow:auto !important) But it doesn't really work.
- brodo 5y agoI wish more people would just use self-hosted analysis tools and stop tracking people across sites. I think github does this and they wrote a blog post detailing their reasoning.
- oneeyedpigeon 5y agoUnfortunately, the default for many is Google Analytics. It would be very nice to have a client-side analytics provider with a default position of total anonymity.
- esperent 5y agoIf you're collecting analytics data yourself you still need to comply with GDPR so you still need a cookie banner for anything but extremely basic analytics.
- jtbayly 5y agoOr you can just ignore GDPR if you're outside the EU.
- elevatortrim 5y agoAlternatively, do not track personal data and do not show any forms.
- esperent 5y agoIf you don't want to do business in the EU, sure. Collecting the data of EU citizens and using it for advertising purposes means you're doing business in the EU though. This applies whether it's you doing the collecting or Google's "free" analytics service. Of course if you're a running a small website you'll probably get away with it. For now.
- Rygian 5y agoThat's not linked to consent forms. If you self host everything, but are still using my personal info, you need my consent.
- FreeHugs 5y agoI wish there was an open source project for developers to implement those darn consent forms. Adsense offers an automatic consent modal. But the problem with that one is that it not only displays the consent modal but also injects a smaller widget into the site. It looks like the widget only pops up when the user scrolls down to the bottom of the page. Unfortunately, that also makes it pop up when the page is not longer than the screen. So pages where all content fits on one screen look really shitty. Anybody who has a website with Adsense here? How do you guys deal with this? Anybody here who wrote their own consent modal? I am about to implement my own. Unfortunately that will then not be automatically handled by extensions like the one in this post or ublock. Putting the burden of clicking it away on my users. Even on the 50% that use an ad blocker anyhow :/
- jsmith99 5y agoIf you want it to be handled by ublock you could always self report to a popular ad list like Easy List.
- spiffytech 5y agoI've seen this consent manager recommended: https://github.com/kiprotect/klaro https://github.com/kiprotect/klaro
- elevatortrim 5y agoHow about implementing the website or app as if all users only give consent to essential cookies and show no consent UI at all?
- FreeHugs 5y agoFirst of all, GDPR is not about cookies. It is about personal data. And so far, courts have considered the user's IP to be personal data. Since advertisers need to know if you really show their ads, the ads need to send some signal back from the user to the advertiser. So ads always send the user's IP to a third party: The advertiser or a trusted intermediary. Assuming no consent to that for everybody would mean that the revenue of my website goes to zero. And I would not be able to run it anymore. As the ones paying for the costs are the users who consent.
- yewenjie 5y agoI just use https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ with uBlock Origin and it just works.
- YYYdoIdoit 5y agoMy flabber is gasted. Its mind boggling that anybody would agree to give away their personal data to advertisers in such a blanket fashion.
- esperent 5y agoIf you care about your data being harvested it's not the same though. This one actually declines tracking. I don't care about cookies often accepts all tracking for you.
- xuhu 5y ago"""In most cases, it just blocks or hides cookie related pop-ups. When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do). It doesn't delete cookies."""
- esperent 5y agoWhich basically rewards sites that intentionally make it hard to avoid clicking yes.
- josteink 5y agoI've tried this, and on its own, it works really, really well. It does what I want, and gets me less distraction on websites. All in all great. Where it started not working so well was in conjunction with NoScript (which I've started using recently). Then on some pages, it stalls, showing a notification while waiting for a consent-dialog to show up, before eventually giving up. But because of NoScript the dialog itself is blocked and will never show up. In these cases Consent-O-Matic is actually creating a bigger distraction than it needs to. Would be nice to see that addressed somehow :)
- fefe23 5y agoIf this supported Google and Youtube, I'd install it in a heartbeat. Those are right now the worst offenders. Oh and Twitter.
- marssaxman 5y agoI have never accepted or denied any cookie dialog, anywhere; I just zap them away with uBlock Origin. Adding a blanket rule about ##onetrust-consent-sdk to my filter list went a surprisingly long way toward reducing these annoyances.
- sagischwarz 5y agoI just found out that if you block all cookies for google.com in your browser, they will never ask you for your consent. Very helpful if you clear your cookies regularly. You can also do the same for youtube.com.
- clemensnk 5y agoI'm part of the team working on consent-o-matic at Aarhus University, and it's great to see the project getting some attention here. We've been running the project on a bit of a shoestring budget, but we are currently working on improving detection and adding more CMPs. We are also testing the plugin for Safari on both MacOS and iOS, and hopefully have it released soon. I can attest that it is very nice to have on the phone, and it makes me very happy every time I see my phone autofill a pop-up :-) Since creating rules is one of the more time consuming parts of maintaining the project, we are happy for any help we can get through pull requests to the rule lists.
- FreeHugs 5y agoWhat does it actually do? Does it automatically "accept everything"? Or reject everything? Or just supress the consent forms?
- clemensnk 5y agoYou can configure what categories of tracking you will allow, and then there's custom rules for a wide range of CMPs to apply those preferences automatically. See screenshot from config here: https://imgur.com/a/fHfuZ0O https://imgur.com/a/fHfuZ0O
- nerdjon 5y agoI am very excited to use this, but I can't find the safari version for Mac or iOS even though it says it exists.
- throwaway2016a 5y agoCorrect me if I'm wrong but isn't the cookie law different than GDPR? My understanding is that GDPR concerns how you use PII and contact information and the requirement that you be able to request your data be deleted. So I expected a data removal request form and/or a contact consent form.
- rgthelen 5y agoI use this right now and love it.
- ravenstine 5y agoThe answer isn't to change web standards but to abolish GDPR. If you think GDPR has done good to anyone besides bureaucrats, I've got an EULA for you to agree to.
- iamevn 5y agoThis is backwards. I, the user shouldn't be fixing it, the website operators should be the ones fixing it by not tracking me.