7 ms·

I still don't understand why this is a website thing and not an user-agent^W^W webbrowser thing. EU could have requested browser vendors to implement a mechani

I still don't understand why this is a website thing and not an user-agent^W^W webbrowser thing. EU could have requested browser vendors to implement a mechanism to accept or reject cookies. We wouldn't have those oddly designed (and infrequently infested with dark patterns in attempt to sway users towards accepting everything) bars and popups, and it would've been 100% reliable (and even the reject decision would be remembered correctly) instead of hoping that website actually respects the choice instead of having a banner that does absolutely nothing.

HWR_14 5y ago
This sounds an awful lot like the Do Not Track setting in every browser.
- drdaeman 5y ago
  Yes and no. "Do Not Track" setting does not do anything but sending a header to all websites you visit. Plus, it was blamed to have an unfavorable default. The whole popup mess those days is essentially about those facts - there are no easy per-site controls with no default state (with a possible default if user consciously and explicitly configures their system as "accept all everywhere" or "reject all everywhere" - but this can't be out-of-the-box). Cookie prompts are just like that: per-site and without a default (you have to actively make a decision every time - accept or reject). I'm arguing that it would've been better if all those consent prompts would've been unified and a part of browser UI (rather than website UI). Because of two reasons: 1) the UI and UX would be uniform, consistent, and not prone to design whims and dark patterns; and 2) because this way browsers would be able to guarantee that the choice is partially respected by actually not accepting cookies. DNT header would be still needed to tell website to disable server-side tracking (and one has to believe that website respects it - turning this into a legal matter), but the whole design is different. (Just not like that annoying geolocation or camera popup prompts lol. A bar on top of the webpage would've been a sane option, I guess.)
  - PeterisP 5y ago
    Since the law requires it to be opt-in, having Do Not Track be the automated default without any prompts is not problematic but the whole point of the thing.
  - imiric 5y ago
    I don't get what you're arguing for. The default state should be DNT. Actually, using cookies for tracking, or any kind of fingerprinting for that matter, should be opt-in. The only reason it was opt-out is because adtech runs the web, and EU lawmakers are technically illiterate and influenced by the same tech giants they're supposed to regulate. So there are two things here: making a browser setting opt-in, and making it actually enforceable. The DNT header was a step in the right direction that got swallowed by corporate influence.
sofixa 5y ago
Because it isn't only about cookies, it's about tracking in general.
- drdaeman 5y ago
  True. Everyone (myself included) calls this a "cookie popup", but it's about tracking. "Do not track" was a better name, but otherwise a poor implementation. I wondered why not make such tracking (or "cookie") prompts a part of webbrowser UI, standardized and sure to be compliant. With enforcement of what browser can enforce (disabling persistent storage), and leaving the rest (e.g. disabling IP-address based tracking) to the website.
  - sofixa 5y ago
    One potential reason is responsibility - if the browser just doesn't implement the required UI for that, who would be at fault? Would the browser vendor be fined, and for how much? Now it's up to those doing the tracking to tell exactly what they collect and who they share it with, and ask for permission. If they screw it up, they get fined proportionately.
    - muhehe 5y ago
      Make it opt-in and it's solved. Server doesn't receive "yes you can" header because browser didn't implement it? Cool, no tracking. Or if there is tracking, website is at fault.
      - sofixa 5y ago
        But it's not "opt in to tracking", it's "do you accept that we record X, Y, Z for A, B, C and share it with our partners G, F, K?". It's not a yes/no.
        muhehe 5y ago
        Pretty much the same thing. You don't send "I agree with X on A", you aren't supposed to get X on A tracking.
morelisp 5y ago
sofixa's point this isn't really about "cookies" aside, why should the state legislate a mostly-well-behaved actor have to do additional work to deal with bad actors, instead of (at least trying to) addressing the bad actors directly? HN already whines about how hard GDPR is to comply with, can you imagine how bizarro it would be if the EU regulators were chasing after Firefox and not Facebook?
- _moof 5y ago
  > why should the state legislate a mostly-well-behaved actor have to do additional work to deal with bad actors This is pretty much just how regulated industries work. One jerk does something shady or dangerous and then everyone else has to do extra paperwork and inspections in order to prove they aren't doing shady or dangerous things too. It isn't the regulator's fault; it's the jerk's fault.
  - morelisp 5y ago
    Right, which is why all other data processors now bear some responsibility. They done goofed the whole industry, and need to pay for it. But leaving data processors alone and going after browsers would be a big mistake, despite the veneer of some technical appeal.
qeternity 5y ago
Because it's impossible for browsers to know which cookies are necessary for functionality, and which are for tracking.
- gaganyaan 5y ago
  That doesn't seem like a big issue. Have browsers refuse all cookies by default, and let the server send headers that say "please allow these cookies, they're actually necessary". Browsers can either trust that list, or present it to the user and let them decide.
  - qeternity 5y ago
    > Browsers can either trust that list, or present it to the user and let them decide. This is literally the current system.
    - gaganyaan 5y ago
      By that I mean that this page would also list a "RequiredForBasicFunctionality=true" syntax: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se... Or maybe a "Role=Required", "Role=Advertising" sort of thing. I don't see any sort of equivalent of that now.
      - qeternity 5y ago
        Yeah, I know what you meant. And every site will list all cookies as necessary. So then you need to pass a law that says sites need to be honest about which are necessary and which aren’t…because browsers can’t actually determine this. And this is what we have today.
        gaganyaan 5y ago
        Right, the crucial part is legislation. The context is that the original comment said "EU could have requested browser vendors to implement a mechanism to accept or reject cookies". What we're missing today is: - An automated way of having browsers know what cookies are used for (What I'm suggesting is quite easy), and - Legislation to prevent companies fron lying (What the general context is about) That would be the general fix for the entire situation.
watwut 5y ago
That is because cookies dont require any popup and legislation does not requires approval for cookies. It muat specifically be tracking cookie. You can have language cookies and what not cookies without any consent.
- account42 5y ago
  > That is because cookies dont require any popup They used to. I'm still of the opinion that anything beyond a static website should require permission prompts.
dividedbyzero 5y ago
I wouldn't trust Google with something like this. They might just implement it in an almost-correct but useless way in Chrome and use their leverage and lawyers to stall for as long as possible.

HWR_14 5y ago

This sounds an awful lot like the Do Not Track setting in every browser.

drdaeman 5y ago
Yes and no. "Do Not Track" setting does not do anything but sending a header to all websites you visit. Plus, it was blamed to have an unfavorable default. The whole popup mess those days is essentially about those facts - there are no easy per-site controls with no default state (with a possible default if user consciously and explicitly configures their system as "accept all everywhere" or "reject all everywhere" - but this can't be out-of-the-box). Cookie prompts are just like that: per-site and without a default (you have to actively make a decision every time - accept or reject). I'm arguing that it would've been better if all those consent prompts would've been unified and a part of browser UI (rather than website UI). Because of two reasons: 1) the UI and UX would be uniform, consistent, and not prone to design whims and dark patterns; and 2) because this way browsers would be able to guarantee that the choice is partially respected by actually not accepting cookies. DNT header would be still needed to tell website to disable server-side tracking (and one has to believe that website respects it - turning this into a legal matter), but the whole design is different. (Just not like that annoying geolocation or camera popup prompts lol. A bar on top of the webpage would've been a sane option, I guess.)
- PeterisP 5y ago
  Since the law requires it to be opt-in, having Do Not Track be the automated default without any prompts is not problematic but the whole point of the thing.
- imiric 5y ago
  I don't get what you're arguing for. The default state should be DNT. Actually, using cookies for tracking, or any kind of fingerprinting for that matter, should be opt-in. The only reason it was opt-out is because adtech runs the web, and EU lawmakers are technically illiterate and influenced by the same tech giants they're supposed to regulate. So there are two things here: making a browser setting opt-in, and making it actually enforceable. The DNT header was a step in the right direction that got swallowed by corporate influence.

sofixa 5y ago

Because it isn't only about cookies, it's about tracking in general.

drdaeman 5y ago
True. Everyone (myself included) calls this a "cookie popup", but it's about tracking. "Do not track" was a better name, but otherwise a poor implementation. I wondered why not make such tracking (or "cookie") prompts a part of webbrowser UI, standardized and sure to be compliant. With enforcement of what browser can enforce (disabling persistent storage), and leaving the rest (e.g. disabling IP-address based tracking) to the website.
- sofixa 5y ago
  One potential reason is responsibility - if the browser just doesn't implement the required UI for that, who would be at fault? Would the browser vendor be fined, and for how much? Now it's up to those doing the tracking to tell exactly what they collect and who they share it with, and ask for permission. If they screw it up, they get fined proportionately.
  - muhehe 5y ago
    Make it opt-in and it's solved. Server doesn't receive "yes you can" header because browser didn't implement it? Cool, no tracking. Or if there is tracking, website is at fault.
    - sofixa 5y ago
      But it's not "opt in to tracking", it's "do you accept that we record X, Y, Z for A, B, C and share it with our partners G, F, K?". It's not a yes/no.
      - muhehe 5y ago
        Pretty much the same thing. You don't send "I agree with X on A", you aren't supposed to get X on A tracking.

morelisp 5y ago

sofixa's point this isn't really about "cookies" aside, why should the state legislate a mostly-well-behaved actor have to do additional work to deal with bad actors, instead of (at least trying to) addressing the bad actors directly? HN already whines about how hard GDPR is to comply with, can you imagine how bizarro it would be if the EU regulators were chasing after Firefox and not Facebook?

_moof 5y ago
> why should the state legislate a mostly-well-behaved actor have to do additional work to deal with bad actors This is pretty much just how regulated industries work. One jerk does something shady or dangerous and then everyone else has to do extra paperwork and inspections in order to prove they aren't doing shady or dangerous things too. It isn't the regulator's fault; it's the jerk's fault.
- morelisp 5y ago
  Right, which is why all other data processors now bear some responsibility. They done goofed the whole industry, and need to pay for it. But leaving data processors alone and going after browsers would be a big mistake, despite the veneer of some technical appeal.

qeternity 5y ago

Because it's impossible for browsers to know which cookies are necessary for functionality, and which are for tracking.

gaganyaan 5y ago
That doesn't seem like a big issue. Have browsers refuse all cookies by default, and let the server send headers that say "please allow these cookies, they're actually necessary". Browsers can either trust that list, or present it to the user and let them decide.
- qeternity 5y ago
  > Browsers can either trust that list, or present it to the user and let them decide. This is literally the current system.
  - gaganyaan 5y ago
    By that I mean that this page would also list a "RequiredForBasicFunctionality=true" syntax: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se... Or maybe a "Role=Required", "Role=Advertising" sort of thing. I don't see any sort of equivalent of that now.
    - qeternity 5y ago
      Yeah, I know what you meant. And every site will list all cookies as necessary. So then you need to pass a law that says sites need to be honest about which are necessary and which aren’t…because browsers can’t actually determine this. And this is what we have today.
      - gaganyaan 5y ago
        Right, the crucial part is legislation. The context is that the original comment said "EU could have requested browser vendors to implement a mechanism to accept or reject cookies". What we're missing today is: - An automated way of having browsers know what cookies are used for (What I'm suggesting is quite easy), and - Legislation to prevent companies fron lying (What the general context is about) That would be the general fix for the entire situation.

watwut 5y ago

That is because cookies dont require any popup and legislation does not requires approval for cookies. It muat specifically be tracking cookie. You can have language cookies and what not cookies without any consent.

account42 5y ago
> That is because cookies dont require any popup They used to. I'm still of the opinion that anything beyond a static website should require permission prompts.

dividedbyzero 5y ago

I wouldn't trust Google with something like this. They might just implement it in an almost-correct but useless way in Chrome and use their leverage and lawyers to stall for as long as possible.