8 ms·

> I wish there was a standard browser API for this. There was: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P

pornel 5y ago
And Google was caught exploiting a weakness in the P3P implementation to bypass it entirely. Google was also caught exploiting a loophole in Safari when it added 3rd party cookie blocking: https://www.zdnet.com/article/google-pays-17m-to-settle-safari-cookie-privacy-bypass-charge/ https://www.zdnet.com/article/google-pays-17m-to-settle-safa... AdTech companies want to track you, and it's naive to think they will ever honestly and voluntarily use any APIs that blocks it. Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws.
- chriswarbo 5y ago
  Oh absolutely! I just like to bring up P3P whenever someone inevitably says there should be a standard for 'cookie popups'. AFAIK, P3P actually goes further than all/nothing: it distinguishes between 1st-party/3rd-party, required/optional, which details are involved (IP, email address, etc.), data retention periods, etc. Plus, this was all implemented, in the most popular browser (at the time), a full two decades ago! The context has obviously changed: there used to be no consequences for lying/bypassing (I didn't actually know about the Google case you mention; although it doesn't surprise me!), and most importantly: there were no consequences for not bothering to put it on a site at all. Hence the low adoption, and hence it died away. That's now changed, there's a chance some "non evil" sites might bring it back. > Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws. Yep. That's why machine-readable requests, with default-deny responses from user agents, won't appear any time soon; especially in browsers made/sponsored by adtech giants! The inconvenient, manual-effort is a feature of consent popups (at least, for those who came up with the idea; most sites just jumped on the band-wagon)
- eternityforest 5y ago
  They'll use an API if it makes it easier and less noticable to track most people. They should do a study and find out how many people will just set "Enable all cookies from all sites". If the number of people who would use "Deny all nonessential" is less than the number of people who currently deny consent, it's a win for them.
  - pornel 5y ago
    We've had this bet with Do Not Track, and the whole idea died as soon as one browser set it by default.

pornel 5y ago

And Google was caught exploiting a weakness in the P3P implementation to bypass it entirely. Google was also caught exploiting a loophole in Safari when it added 3rd party cookie blocking: https://www.zdnet.com/article/google-pays-17m-to-settle-safari-cookie-privacy-bypass-charge/ https://www.zdnet.com/article/google-pays-17m-to-settle-safa... AdTech companies want to track you, and it's naive to think they will ever honestly and voluntarily use any APIs that blocks it. Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws.

chriswarbo 5y ago
Oh absolutely! I just like to bring up P3P whenever someone inevitably says there should be a standard for 'cookie popups'. AFAIK, P3P actually goes further than all/nothing: it distinguishes between 1st-party/3rd-party, required/optional, which details are involved (IP, email address, etc.), data retention periods, etc. Plus, this was all implemented, in the most popular browser (at the time), a full two decades ago! The context has obviously changed: there used to be no consequences for lying/bypassing (I didn't actually know about the Google case you mention; although it doesn't surprise me!), and most importantly: there were no consequences for not bothering to put it on a site at all. Hence the low adoption, and hence it died away. That's now changed, there's a chance some "non evil" sites might bring it back. > Current deliberately-awful cookie consent prompts are malicious compliance aimed to make law makers look incompetent and make people resent privacy protection laws. Yep. That's why machine-readable requests, with default-deny responses from user agents, won't appear any time soon; especially in browsers made/sponsored by adtech giants! The inconvenient, manual-effort is a feature of consent popups (at least, for those who came up with the idea; most sites just jumped on the band-wagon)
eternityforest 5y ago
They'll use an API if it makes it easier and less noticable to track most people. They should do a study and find out how many people will just set "Enable all cookies from all sites". If the number of people who would use "Deny all nonessential" is less than the number of people who currently deny consent, it's a win for them.
- pornel 5y ago
  We've had this bet with Do Not Track, and the whole idea died as soon as one browser set it by default.