I feel like we should probably have the concept of an "intent" for any bit of data that we'd like to store in a browser and partition the storage by that: In

I feel like we should probably have the concept of an "intent" for any bit of data that we'd like to store in a browser and partition the storage by that: Intents: - REQUIRED_FOR_SITE_FUNCTIONALITY (translation "Required For Site Functionality") - FIRST_PARTY_ANALYTICS (translation "First Party Analytics") - THIRD_PARTY_ANALYTICS (translation "Third Party Analytics") - FIRST_PARTY_MARKETING (translation "First Party Marketing") - THIRD_PARTY_MARKETING (translation "Third Party Marketing") Let the browsers themselves provide UI for accepting or denying these (maybe the users should be able to choose their own defaults per intent): Message: https://some.site would like to use your browser to store data for these intents: Required For Site Functionality [X] Yes [ ] No First Party Analytics [X] Yes [ ] No Third Party Analytics [ ] Yes [X] No Unspecified [ ] Yes [X] No [ Submit ] Which could then correspond to how everything is stored in the browser: Storage: https://some.site REQUIRED_FOR_SITE_FUNCTIONALITY (accepted) Cookies - ... LocalStorage - ... IndexDB - ... FIRST_PARTY_ANALYTICS (accepted) Cookies - ... LocalStorage - ... THIRD_PARTY_ANALYTICS (rejected) FIRST_PARTY_MARKETING (rejected) THIRD_PARTY_MARKETING (rejected) UNSPECIFIED (rejected automatically after 01.01.2030) And extend the JavaScript API for cookies (and also all other mechanisms for storage, this is an example): document.cookie = "user_id=1234"; // this would go under Unspecified document.cookie = "intent=REQUIRED_FOR_SITE_FUNCTIONALITY; user_id=1234"; // this would go in the proper group document.cookie = "intent=THIRD_PARTY_MARKETING; uid=1234"; // this would throw something like an IntentViolationError And ideally something for checking these intents as well: let canUseRequired = document.intents["REQUIRED_FOR_SITE_FUNCTIONALITY"].accepted; // true let canUseTPAnalytics = document.intents["THIRD_PARTY_ANALYTICS"].accepted; // false Who would define these types? Well, i think that there are two ways: - have some international body decide on these types - allow custom types per site, maybe with different UI for that And then just prosecute those who don't follow the convention and abuse the mechanisms. Of course, that will never be done.