7 ms·

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It c

I wish there was a standard browser API for this. If the law is going to force this to be a thing, and it's not going away, web standards should respond. It could even just be a flag in the cookie itself declaring that something isn't strictly necessary.

Cthulhu_ 5y ago
That's the main issue here; the EU mandated consent and gave guidelines on what that consent might look like, but they left implementation down to the industry, which decided to do it themselves (often using dark patterns, for which some companies already got fined) instead of integrating it in browsers. I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? I mean I know that Chrome and Firefox won't block ads by default because it affects their bottom line (Chrome through Google ads, Firefox through Google money), but what about GDPR consent forms and newsletter sign-up popups?
- radicalbyte 5y ago
  Google funded two of the three big browsers. That does a lot to kill innovation.
- danuker 5y ago
  I suppose they're making us suffer so we pressure politicians.
- josefx 5y ago
  I wouldn't be surprised if Googles consent form intentionally broke every GDPR rule. First time I saw it it didn't bombard me with dark patterns, it sent me down a rabbit hole of near infinite options where I couldn't even tell if any of them where relevant for Google search. They don't want to give users a quick and easy way to opt out, especially not while they are still working on replacement APIs that use sleight of hand, confusing technobabble and a decent amount of hand waving to not only avoid GDPR restrictions but make your browser track you for them. This isn't just Google, Mozilla seems to have sold out to Meta and is working on its own tracking API.
  - andylynch 5y ago
    You're not alone. This is why the French fined Google EOR 150M in January* . NOYB have started a second round of complaints this month so expect more. * https://www.cnil.fr/en/cookies-google-fined-150-million-euros https://www.cnil.fr/en/cookies-google-fined-150-million-euro...
  - bodge5000 5y ago
    Facebooks (or I guess Meta, I noticed it on the Occulus website) approach is the worst I've seen, with no clear way to decline. At least google and the others give you the option, they just make you do a load of work for it (and then at the end present you with a blue "accept all" button and a grey "accept selected" button), Facebook literally just gives you an accept all button and, if I recall correctly, a small hyperlink to view their policy in which you have the option to go through all the settings and decline.
- ratww 5y ago
  > I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? There was Do-Not-Track, but the industry decided it shouldn't be respected.
  - MereInterest 5y ago
    I would love for an update to GDPR, stating that any automated form of refusal for consent, including the Do-Not-Track header, must be treated as an explicit refusal and may not result in additional requests.
    - ratww 5y ago
      That's a great idea and would be an amazing next step. Do-Not-Track can already be honoured by website operators. The issue is just that they choose not to do it.
  - MiddleEndian 5y ago
    Do Not Track was always a joke. Without any legal teeth, why would people determined to spy on you stop spying on you because you say "Please"?
    - ratww 5y ago
      GDPR for example gives it teeth. Grandparent post asked for a technical solution to hide cookie banners forever. A websites don't have to show any cookie banner whatsoever if they honor Do-Not-Track. If they don't show a banner but still track, they're breaking the law. The problem of cookie banners is easy to solve. All that's lacking is honesty from adware vendors and website operators.
endless1234 5y ago
Like this? https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track It was very ineffective. Something similar but actually enforced (easier said than done) and utilized would be very nice indeed.
sdoering 5y ago
It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it would make live more easy. But it would be enough if companies would just not use dark patterns. If there is a banner the "Accept all" and the "Deny all" must be both be the same level of "easy-ness" and the same amounts of clicks (and wait time). Only if you want to you would need to dive into the detailed categories. And even there: Most sites abuse "legitimate interest". Everything non essential should by default be inactive. But sadly it isn't. Disclaimer: I am a data analyst/Web analyst. I do this stuff for a living for clients. Still I value these things highly. And would love for it to be implemented correctly.
- pydry 5y ago
  If you program a browser to consent for you that is no different to consenting yourself. Just as writing and running an install script with --accept-tos is valid.
  - pmontra 5y ago
    That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of "surprises". So yes, a browser could come with an "Accept all" setting, probably disabled by default, but which browser vendor is going to go through the trouble of implementing that, proposing an API and above all getting every Privacy Agency of the world to accept that?
    - pydry 5y ago
      Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent. Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could. Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.
chriswarbo 5y ago
> I wish there was a standard browser API for this. There was: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P
- pornel 5y ago
  And Google was caught exploiting a weakness in the P3P implementation to bypass it entirely. Google was also caught exploiting a loophole in Safari when it added 3rd party cookie blocking: https://www.zdnet.com/article/google-pays-17m-to-settle-safari-cookie-privacy-bypass-charge/ https://www.zdnet.com/article/google-pays-17m-to-settle-safa... AdTech companies want to track you, and it's naive to think they will ever honestly and voluntarily use any APIs that blocks it. Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws.
  - chriswarbo 5y ago
    Oh absolutely! I just like to bring up P3P whenever someone inevitably says there should be a standard for 'cookie popups'. AFAIK, P3P actually goes further than all/nothing: it distinguishes between 1st-party/3rd-party, required/optional, which details are involved (IP, email address, etc.), data retention periods, etc. Plus, this was all implemented, in the most popular browser (at the time), a full two decades ago! The context has obviously changed: there used to be no consequences for lying/bypassing (I didn't actually know about the Google case you mention; although it doesn't surprise me!), and most importantly: there were no consequences for not bothering to put it on a site at all. Hence the low adoption, and hence it died away. That's now changed, there's a chance some "non evil" sites might bring it back. > Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws. Yep. That's why machine-readable requests, with default-deny responses from user agents, won't appear any time soon; especially in browsers made/sponsored by adtech giants! The inconvenient, manual-effort is a feature of consent popups (at least, for those who came up with the idea; most sites just jumped on the band-wagon)
  - eternityforest 5y ago
croes 5y ago
You mean like "Do Not Track"? There is a misconception, they don't want it do be convenient, the all purpose is to as annoying as possible and legal, to force you to use the easy allow-all-path. So even if there is an API they won't use it. They don't want to give you a choice, they want that you to allows all access.
- eternityforest 5y ago
  If the API covers allow-all with a fallback to a prompt the'll use it. Even with a deny all feature, they will use it if it's legally mandated, since apparently that's how we handle privacy now
the_other 5y ago
The cookies are just one outward sign of data collection. GDPR isn't about cookies, it's about collecting, storing and transferring data. Done properly, GDPR notices should allow users to opt in to having data about themselves collected by the interested company (and other things like acknowledging the relationships and responsibilities formed by that consent - like requesting deletion and having it honoured). We just happen to use cookies to do much of that collection. We also already had "the cookie law", so it seems "pragmatic" to piggy back the two things, for the sake of "user convenience". GDPR creates responsibilities and guidance on all the database tables, the system designs, the job descriptions and so on which operate around data about people.
moltke 5y ago
There's no valid reason for the third party cookies. There are browsers that get this right (lynx lets you choose to accept and reject cookies (including an "always/never and never bother me about it again option.)

Cthulhu_ 5y ago

That's the main issue here; the EU mandated consent and gave guidelines on what that consent might look like, but they left implementation down to the industry, which decided to do it themselves (often using dark patterns, for which some companies already got fined) instead of integrating it in browsers. I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? I mean I know that Chrome and Firefox won't block ads by default because it affects their bottom line (Chrome through Google ads, Firefox through Google money), but what about GDPR consent forms and newsletter sign-up popups?

radicalbyte 5y ago
Google funded two of the three big browsers. That does a lot to kill innovation.
danuker 5y ago
I suppose they're making us suffer so we pressure politicians.
josefx 5y ago
I wouldn't be surprised if Googles consent form intentionally broke every GDPR rule. First time I saw it it didn't bombard me with dark patterns, it sent me down a rabbit hole of near infinite options where I couldn't even tell if any of them where relevant for Google search. They don't want to give users a quick and easy way to opt out, especially not while they are still working on replacement APIs that use sleight of hand, confusing technobabble and a decent amount of hand waving to not only avoid GDPR restrictions but make your browser track you for them. This isn't just Google, Mozilla seems to have sold out to Meta and is working on its own tracking API.
- andylynch 5y ago
  You're not alone. This is why the French fined Google EOR 150M in January* . NOYB have started a second round of complaints this month so expect more. * https://www.cnil.fr/en/cookies-google-fined-150-million-euros https://www.cnil.fr/en/cookies-google-fined-150-million-euro...
- bodge5000 5y ago
  Facebooks (or I guess Meta, I noticed it on the Occulus website) approach is the worst I've seen, with no clear way to decline. At least google and the others give you the option, they just make you do a load of work for it (and then at the end present you with a blue "accept all" button and a grey "accept selected" button), Facebook literally just gives you an accept all button and, if I recall correctly, a small hyperlink to view their policy in which you have the option to go through all the settings and decline.
ratww 5y ago
> I remember 20 odd years ago now when Firefox came out with a popup blocker standard, built-in. Whatever happened to this "we need to reduce annoyances on the internet" movement? Why aren't the browsers themselves doing more against it? There was Do-Not-Track, but the industry decided it shouldn't be respected.
- MereInterest 5y ago
  I would love for an update to GDPR, stating that any automated form of refusal for consent, including the Do-Not-Track header, must be treated as an explicit refusal and may not result in additional requests.
  - ratww 5y ago
    That's a great idea and would be an amazing next step. Do-Not-Track can already be honoured by website operators. The issue is just that they choose not to do it.
- MiddleEndian 5y ago
  Do Not Track was always a joke. Without any legal teeth, why would people determined to spy on you stop spying on you because you say "Please"?
  - ratww 5y ago
    GDPR for example gives it teeth. Grandparent post asked for a technical solution to hide cookie banners forever. A websites don't have to show any cookie banner whatsoever if they honor Do-Not-Track. If they don't show a banner but still track, they're breaking the law. The problem of cookie banners is easy to solve. All that's lacking is honesty from adware vendors and website operators.

endless1234 5y ago

Like this? https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track It was very ineffective. Something similar but actually enforced (easier said than done) and utilized would be very nice indeed.

sdoering 5y ago

It can't be. At least not if you want to accept cookies. Declining is easy. You can just decline everything (technically) not necessary. The problem is, that consent must be given freely and fully informed. And this is the catch. Automatic acceptance isn't fully informed and with that the consent isn't valid. So it would put the companies in danger and therefore no company could honor this standard. Sadly - as it would make live more easy. But it would be enough if companies would just not use dark patterns. If there is a banner the "Accept all" and the "Deny all" must be both be the same level of "easy-ness" and the same amounts of clicks (and wait time). Only if you want to you would need to dive into the detailed categories. And even there: Most sites abuse "legitimate interest". Everything non essential should by default be inactive. But sadly it isn't. Disclaimer: I am a data analyst/Web analyst. I do this stuff for a living for clients. Still I value these things highly. And would love for it to be implemented correctly.

pydry 5y ago
If you program a browser to consent for you that is no different to consenting yourself. Just as writing and running an install script with --accept-tos is valid.
- pmontra 5y ago
  That's not informed consent but if you decide to accept everything without reading anything, it's your right to do it. You won't be able to complain in case of "surprises". So yes, a browser could come with an "Accept all" setting, probably disabled by default, but which browser vendor is going to go through the trouble of implementing that, proposing an API and above all getting every Privacy Agency of the world to accept that?
  - pydry 5y ago
    Clicking a checkbox that says "accept all tracking/cookies purpose from any website" and having the browser accept for you absolutely is informed consent. A court would look at this and a person who mindlessly clicked "accept all" on every website as equivalent. Browsers could propose an API for this functionality and no doubt some websites would implement it. They havent but they could. Whether there's any point is another question. Websites would probably rather use dark patterns to get us to click accept all, so any API that went beyond accept all and allowed a standardized user policy on data collection would have a limited uptake.

chriswarbo 5y ago

> I wish there was a standard browser API for this. There was: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P

pornel 5y ago
And Google was caught exploiting a weakness in the P3P implementation to bypass it entirely. Google was also caught exploiting a loophole in Safari when it added 3rd party cookie blocking: https://www.zdnet.com/article/google-pays-17m-to-settle-safari-cookie-privacy-bypass-charge/ https://www.zdnet.com/article/google-pays-17m-to-settle-safa... AdTech companies want to track you, and it's naive to think they will ever honestly and voluntarily use any APIs that blocks it. Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws.
- chriswarbo 5y ago
  Oh absolutely! I just like to bring up P3P whenever someone inevitably says there should be a standard for 'cookie popups'. AFAIK, P3P actually goes further than all/nothing: it distinguishes between 1st-party/3rd-party, required/optional, which details are involved (IP, email address, etc.), data retention periods, etc. Plus, this was all implemented, in the most popular browser (at the time), a full two decades ago! The context has obviously changed: there used to be no consequences for lying/bypassing (I didn't actually know about the Google case you mention; although it doesn't surprise me!), and most importantly: there were no consequences for not bothering to put it on a site at all. Hence the low adoption, and hence it died away. That's now changed, there's a chance some "non evil" sites might bring it back. > Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws. Yep. That's why machine-readable requests, with default-deny responses from user agents, won't appear any time soon; especially in browsers made/sponsored by adtech giants! The inconvenient, manual-effort is a feature of consent popups (at least, for those who came up with the idea; most sites just jumped on the band-wagon)
- eternityforest 5y ago

croes 5y ago

You mean like "Do Not Track"? There is a misconception, they don't want it do be convenient, the all purpose is to as annoying as possible and legal, to force you to use the easy allow-all-path. So even if there is an API they won't use it. They don't want to give you a choice, they want that you to allows all access.

eternityforest 5y ago
If the API covers allow-all with a fallback to a prompt the'll use it. Even with a deny all feature, they will use it if it's legally mandated, since apparently that's how we handle privacy now

the_other 5y ago

The cookies are just one outward sign of data collection. GDPR isn't about cookies, it's about collecting, storing and transferring data. Done properly, GDPR notices should allow users to opt in to having data about themselves collected by the interested company (and other things like acknowledging the relationships and responsibilities formed by that consent - like requesting deletion and having it honoured). We just happen to use cookies to do much of that collection. We also already had "the cookie law", so it seems "pragmatic" to piggy back the two things, for the sake of "user convenience". GDPR creates responsibilities and guidance on all the database tables, the system designs, the job descriptions and so on which operate around data about people.

moltke 5y ago

There's no valid reason for the third party cookies. There are browsers that get this right (lynx lets you choose to accept and reject cookies (including an "always/never and never bother me about it again option.)