14 ms·

Brave browser to start blocking annoying cookie consent banners

410 points by redbell 4y ago

alkonaut 4y ago
Blocking means rejection of all consent, right? That’s great then. But I’m assuming the worst offenders who aren’t compliant with their banners also aren’t compliant in what they do when their pop up is blocked.
cplli 4y ago
An article on a site that has a cookie banner the size of my mobile screen :)
- dustedcodes 4y ago
  Which they acknowledged and even used as an example of an annoying cookie banner in their own article. That's quite funny... actually... because if they think of their own banner as this annoying then they could have made it a lot nicer and more subtle.. :)
  - redbell 4y ago
    "making fun of yourself" is a well-known psychological trick to attract fans and boost credibility.
  - jefftk 4y ago
    It's traditional and professional for the journalistic and business sides of a publication to operate independently. It's not perfect, and it's gotten weaker over time, but this article is an example of it operating correctly. Without this division we wouldn't have an article without annoying banners, we would have the business side killing the article for promoting an ad blocking browser ("don't you realize how we're funded!")
groffee 4y ago
Wouldn't that be illegal though? Purely from a Devils Advocate perspective those banners are legally required, so pro-actively blocking them seems like a bad idea.
- dustedcodes 4y ago
  I think the cookie consent was great in intention, but naively executed/enforced by the EU. I believe there must be a strong push back on those banners from browser vendors to force the EU to reconsider the current law and modify it. IMHO it would be much better if they'd revise the current law to require browser vendors to have a global cookie setting (accept functional, marketing, etc.) and then websites having to obey to a user's preference based on their browser setting.
  - secondcoming 4y ago
    There used be the option of using a global cookie but website no used it. It was then deprecated. See the field 'IsServiceSpecific' in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...
  - hnbad 4y ago
    There's nothing in any of the relevant EU laws forcing websites to have consent banners. They could simply handle consent like mobile apps are supposed to handle permissions (i.e. prompt once for a single purpose when it becomes relevant for a user interaction). But they want to shovel a ton of trackers and tracking ads and analytics and other garbage into every page load, so they need to obtain consent before those can be loaded and then they try to be clever (read: illegal) and trick you into giving them a blank check by making it harder to opt out and continue than to opt in to everything and give up. There's also nothing in the law saying the cookie banner has to be a modal dialog. The same sites happily went for actual "banners" rather than popups when the first EU cookie law was passed and only required notice rather than consent. They only went for modal popups because this forces users to make a choice before they can access the content. Ironically, if a data protection agency were particularly spicy that day, it could be argued that putting a site behind a modal consent popup rather than defaulting to opt-out and merely informing the user about other options violates the GDPR's requirement not to make the use of a website conditional to unrelated data processing because the popup is intended as a form of light coersion.
vincvinc 4y ago
Is there a (firefox) extension that auto-rejects everything on your behalf? I have only seen auto-accept ones so far.
- K0nserv 4y ago
  Websites aren’t allowed to start collecting data until the user has made an active choice. Thus, removing the DOM elements should be enough, on compliant websites. There should be no need to reject
  - cutler 4y ago
    Good luck with that one in practice.
    - K0nserv 4y ago
      Indeed, hence "on compliant websites". I wish the EU's enforcement wasn't so lacklustre. Would be interesting if they hired 2-3 reverse engineers and had them go down Alexa top 10k and verify that consent banners are implemented correctly, handing out fines if not. One can dream I guess. Fundamentally, the problem with the GDPR isn't that the law is problematic, it's the lack of enforcement, this is the true cause of the consent banner proliferation.
      - Macha 4y ago
        Side note: The alexa top sites list is defunct since May: https://www.alexa.com/topsites/ https://www.alexa.com/topsites/
      - philipwhiuk 4y ago
        EU's enforcement is based on the country the site is hosted in's regulator. Which is a faff because it means the Irish regulator actively looking at what sites are hosted in the Ireland, rather than an EU regulator looking at all EU accessible sites. Which is non trivial to search for. (Also the Irish regulator struggles with regulatory capture).
AraceliHarker 4y ago
Although Brave claims to be a privacy-preserving browser, like this article, I wonder about Brave's policy because some trackers are actually whitelisted and Brave News recommends sites that contain a lot of trackers and advertisements.
- NayamAmarshe 4y ago
  > Brave News recommends sites that contain a lot of trackers and advertisements. From the website: "By using Brave’s new private CDN to deliver RSS feeds to the browser anonymously, there is no data trail available for third parties to collect or track. This makes Brave News a unique news reading experience when compared to other apps and platforms that track users’ reading activities. Nobody can track the content that Brave users are reading, including Brave itself." As for 'recommending', I don't think they're recommending anything, they're just providing you with an RSS feed that's more private than any other alternative. Sure the news websites have ads and trackers but Brave will block those too + The feature is disabled by default anyway. > because some trackers are actually whitelisted I think this is a bit misleading to say. Developers from Brave have already cleared that they do not block everything as they want the web to be functional for all users, people who want to block everything can use the 'Agressively block all trackers and ads' mode. More here: https://news.ycombinator.com/item?id=19132192 https://news.ycombinator.com/item?id=19132192
  - deleted 4y ago
    [deleted]
jstx1 4y ago
Why don't have this in the browser options for any browser - always show banners, always hide them, auto reject, auto accept, white/black list based on rules etc - let your users pick the behaviour they want.
- nabaraz 4y ago
  Probably because most of the people would choose 'Reject all' if given the option. The gameplay here is to hide cookie options in submenus that are different on every webpages so users get annoyed and choose 'Accept all'.
  - Maxburn 4y ago
    I hate these dark patterns so much. I’m all in on the automation to get rid of it.
  - _v7gu 4y ago
    That’s why the relevant legislation usually requires the “Reject all” option to be as accessible as the “Accept all” option. You can complain to tour data protection authority to get these dark patterns removed
    - junofan 4y ago
      I’d prefer better rules. As-is, sounds like a scheme to grow some sort of data protection bureaucracy.
      - Nextgrid 4y ago
        Better rules, such as? I believe the rules we currently have are enough to protect privacy and deal with these kinds of dark patterns. The problem is the non-enforcement of these rules, so much that entire businesses now specialize in producing "consent management platforms" that help break the rules.
  - Moru 4y ago
    Why do so much work to get people to select the wrong thing? That is as illegal in the EU as not getting consent for your cookies. Might as well just skip the cookie consent and just use your tracking cookies.
ungamedplayer 4y ago
Finally
- Maxburn 4y ago
  It’s annoying it took this long. On iOS there’s super agent to do the same.
DitheringIdiot 4y ago
> These notifications are incredibly annoying but have become necessary to do business online to comply with data protection regulations like GDPR. Alternatively, you can just not track the behaviour of every person who lands on your website. Use contextual ads instead of personalised ads.
- TEP_Kim_Il_Sung 4y ago
  Personalized ads never seemed workable, nor sensible to me, especially when showing me products I had just bought. It makes more sense if they are about tracking and influencing behaviour, as is done in Chy-nah.
- rrwo 4y ago
  > Alternatively, you can just not track the behaviour of every person who lands on your website. Tracking behaviour is useful to ensure the site is working, that people are able to use the site and make purchases, or even to know what parts of the site people are using. There is nothing wrong with that, so long as the logs are not shared and not kept for longer than necessary. Tracking people's use of the site to build a profile of them and share with third parties, without consent, is where the privacy problem comes from.
  - SahAssar 4y ago
    "Tracking" that is necessary to ensure the service is functioning does not require consent. That is for example why logging IPs for things like rate-limiting or DDoS protection does not require consent, but that data cannot be used for anything else. If you do not track users but just track usage that should not require consent. So if you track for example purchases per hour (but not which users made a purchase) you can see if it becomes irregular. You can also track usage of certain site functions without tying that data to a specific user or session. So the actually necessary tracking does not require consent, but since companies got used to tracking everything and tying it to users/sessions before these laws it seems like they try to continue on that path instead of adapting.
    - 4y ago
deleted 4y ago
[deleted]
qwery 4y ago
Not sure how successful this will be, but it's always good to see someone kicking up a fuss about it. Apparently they're trying to block than just the visible parts ("where possible") so that's good. But you wouldn't know it from the headline, or even the prompt in the browser (screenshot in article) -- "block the banners" to me sounds like "hide the banners". The issue is that websites/businesses are doing things to users that the users do not want and do not ask for. We need legislation to target the unwanted behaviour more directly. Asking nicely isn't going to fix anything. Any 'cookie consent' style system will just be abused, worked around and cheated as the current one has. If you give an inch, they will take a mile. Every time.
BiteCode_dev 4y ago
Everytime I read about this, it makes me think about this game: https://termsandconditions.game/ https://termsandconditions.game/ (SSL warning) These shenanigans are not required, they are very much designed on purpose. Indeed, corporations can follow the "Do Not Track" header. There is nothing in the EU law that requires a banner, only informed consent. So if I have DNT=1 set in my browser, pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that". Solved. I'm informed. I made my choice. But that's not what it's about. Because the vast majority of people would not consent. Who are you kidding? This tracking is not benefiting us. It's like when politician says it's "for the children" or "to fight terrorists". Everybody knows there are full of it. So the banner is just the most annoying way that is legally allowed to try to get people to force-accept tracking. In fact, some banner are crafted to make rejection the hardest path for this very reason. Those corps chose to make the web terrible a little bit more every day: tracking, auto play, scroll hijacking, dark patters, cookie banners... We should thank the UE a 1000 times to reveal who are the bad players.
- deleted 4y ago
  [deleted]
- adhesive_wombat 4y ago
  > In fact, some banner are crafted to make rejection the hardest path for this very reason. Something that's also illegal. National regulators don't seem to care though, which is a shame as a couple of fines and operators would mysteriously, simultaneously and suddenly realise there _was_ a way to make rejection at least as easy as acceptance all along.
  - shaky-carrousel 4y ago
    Luckily for us, in this age of centralized internet, you only need to hit with fines a couple of cookie dialog providers and you are set.
    - adhesive_wombat 4y ago
bawolff 4y ago
Ugh i hate these banners. The web browser should control the consent. Like how it worked in IE5 before everyone realized asking was super annoying and just assumed yes. It makes no sense for a web site to collect state to know if its allowed to collect state.
- rrwo 4y ago
  There is a misunderstanding about GDPR and cookie consent that many people have. Using cookies to track state on a website, that is only used for that website, is fine. You don't need to ask for consent. That is how a site tracks things like whether you are logged in.
  - adrr 4y ago
    What a web RUM system or a JavaScript error logger that track groups by seasons? Or let’s say you’re testing a new feature with an AB test platform and the cookies are used to store bucket information?
  - bawolff 4y ago
    The term "tracking state" also includes all the invasive ad targeting stuff as well. Its all state.
  - jefftk 4y ago
    That's not correct: the ePrivacy directive doesn't distinguish between first and third party cookies but instead about whether the cookies are "strictly necessary for the delivery of a service requested by the user".
    - hnbad 4y ago
      Yes. And login state or preferences are perfectly valid "functional uses" that don't require consent (but need to be spelled out in the privacy policy by most interpretations of the law). The difference between first and third party cookies/embeds is only relevant when the third party may be collecting data (e.g. keeping access logs). This covers things like Google Fonts, Google Maps and social media embeds all of which should be opt-in and have fallback options (like an external link to the otherwise embedded post or map).
vbernat 4y ago
Firefox also plans to have builtin support for auto-rejecting cookies when there is a consent banner. See https://bugzilla.mozilla.org/show_bug.cgi?id=1783015 https://bugzilla.mozilla.org/show_bug.cgi?id=1783015. From my understanding, this should be similar to Consent-O-Matic. It will be available on both desktop and mobile versions. This is enabled recently by default in Nightly (but I don't use Nightly).
- Danieltchi 4y ago
  I want to use your comment to outline a broader criticism of what Brave is about nowadays. In this case, it should be obvious that even Firefox is more innovative than Brave - Firefox plans to auto-reject based on intelligent patterns. This should, if done right, take care of almost all cookie prompts, especially if they also add a filterlist. Brave has been in the business of blocking ads for a long time. Surprisingly it took them years to come up with cookie banner blocking, even though all they do is include a list maintained for free by easylist maintainers. This could have been implemented already 2 years ago without much effort. What's going on at Brave? Is everyone busy with crypto-stuff? Brave should work on detecting cookie-banners, even if they are not blocked by some list. The Brave Browser looks like they abandoned many important things because they are focusing on crypto - the UI is very basic, the customization is not better than Chrome, and due to the addition of many optional features, some users have reported the browser slowing down significantly. Maybe they should offer different installers for different audiences. People have asked about new-tab page customization for a long time. People have asked to have the uBO-functionality ported to the built-in Brave Shields, including cosmetic filtering, and granular control. People have asked for Brave to not activate the new-tab background sponsored images by default, which is in conflict with their user-first ideology. The VPN ad for guardianapp on iOS is too prominent and shows that they try to push it to increase revenue. If Brendan Eich is worried about ROI, he should start putting contextual ads on his search engine, instead of focusing on in-browser ads.
  - rat9988 4y ago
    I'm not sure why you think firefox solution is better (it seems worse) nor why you think highly of firefox in this case, or at least higher than brave.
cutler 4y ago
Stopped reading this after being presented with a list of over 100 pre-selected "Legitimate Interest" no-ops. Including "Receive and use automatically-sent device characteristics for identification. Your device might be distinguished from other devices based on information it automatically sends, such as IP address or browser type."
- Tor3 4y ago
  I've counted up to 150 'legitimate interest' settings I've had to manually turn off one by one before I got to the end of the list. Obviously that's not something people are supposed to be able to actually do, even if I've done it a few times just for the heck of it (usually I just leave the site right away, unless it has a 'reject all' or similar - and many don't).
vijaybritto 4y ago
The banners should be part of a broader permissions management system in the browser. Any calls to the cookies constructor should be checked for permission
akrymski 4y ago
I actually wish websites rendered the same way they do on archive.is by default.
deleted 4y ago
[deleted]
pluc 4y ago
Reclaim the web from marketers and advertisers: block all ads, all JS and all cookies and operate on a whitelist alone. Fuck those people. If I need to have a PiHole, 3 ad blockers and block everything to enjoy the web I fucking will.
- Bakary 4y ago
  It's an uncomfortable topic because so many people here work for adtech and spend their lifetime essentially manipulating others for massive gain
  - chatterhead 4y ago
  - YeBanKo 4y ago
    Ads are necessary for business. Surely there are some companies with 0 marketing spend, but rather exceptional. You can say Tesla is one, but arguably their marketing expenses is Musk’s social influence, SEC and other potential regulatory fines that may eventually catch up with their self-driving campaign. Otherwise, investing marketing money into your brand means that you have something too loose. Relatively easy to set to set up a website or a white-labeled brand, but when you put few millions into marketing it signals that you attached to that brand. When competition is tight and cost of acquisition can eat your margin, you want to want to be laser focused on ad efficiently. Getting cost of acquisition, life time value and ROI of different cohorts is very very difficult. You need a good tracking for that. But then there are two outcomes, improve the product or invest further into invasive tracking to “engineer” customers into buying your product. When industry leans towards the latter, individual companies have to as well to stay competitive.
    - Bakary 4y ago
      I understand this reality, but that is what I am referring to as manipulating people for gain. That is literally what is happening. That it helps businesses doesn't change that.
joemaller1 4y ago
Too many cookie notices are only to accommodate Google Analytics.
jtbayly 4y ago
Now this is something I'd consider a new feature that is worth switching browsers over. I remember back in the day, when (Opera?) added tabs to the browser. Made such a big difference in daily use when I tried it out. This feels similar. Make the web usable again! Edit: Actually, this is even more like when browsers added pop-up blockers, now that I think about it.
- fifilura 4y ago
  As a matter of fact, Opera has been blocking cookie dialogs for a long time already. Possibly only Opera for Android though. https://www.zdnet.com/article/opera-for-android-adds-support-for-blocking-eu-cookie-popups/ https://www.zdnet.com/article/opera-for-android-adds-support... It is a difficult problem though as there is no standard for cookie dialogs, everyone has their own implementation. And if you don't do it properly you may only block the visuals and be stuck with an invisible element that covers the screen and makes it non-clickable.
leephillips 4y ago
“These notifications are incredibly annoying but have become necessary to do business online to comply with data protection regulations like GDPR.” Incorrect. bleepingcomputer.com is required to show the banner because they want to spy on us, and the GDPR demands that they ask permission to do so. If they were more ethical, they could “do business” without having to annoy us with the banner.
exabrial 4y ago
Thank goodness.
wirthjason 4y ago
Why is it that Google Analytics is often listed in “strictly necessary cookies”? I’ve never known that to be a requirement for handling cookie based seasons or logins.
- Nextgrid 4y ago
  Because product managers and/or marketing people consider their salary "strictly necessary".
- mdaniel 4y ago
  Back in the old days, before FF started inserting GA shims, having `onclick="ga_track(); doTheThing();"` was fairly common. So, if disabling GA broke the site, then from their PoV it was necessary IOW, I'd bet it was damn near a lie
rvz 4y ago
Yet another reason to use Brave Browser.
sh4un 4y ago
kgwxd 4y ago
It shouldn’t be required for users to have to wait for Brave to implement this.
- smoldesu 4y ago
  They don't need to, the feature has been in Firefox Nightly for a few weeks now: https://bugzilla.mozilla.org/show_bug.cgi?id=1783015 https://bugzilla.mozilla.org/show_bug.cgi?id=1783015
  - kgwxd 4y ago
    Why did Firefox implement it? I was talking about extensions. uBlock Origin could (does?) already do it and, IMO, this domain is much better left to a third-party with no financial incentive to track people or to make exceptions for "fair" trackers.
herf 4y ago
If you wanted to make app stores stronger and the Web much worse, these consent banners would be a fantastic way to do it. "User agents" should be able to express our intentions clearly and without nag screens every time.
specialist 4y ago
At some point, web browsers will become content scrappers, only showing the interesting bits. Fully standards compliant WYSIWYG forfeits control to the server (service). Scrapping restores agency to the user (client).
- democra 4y ago
  At that point there will be very little content for the browser to scrape, because most content will be behind a paywall or a subscription.
coffeeblack 4y ago
Is that what the web has become?
- deleted 4y ago
  [deleted]
gnicholas 4y ago
Brave is also soon to offer vertical tabs. This is currently available on the Nightly and Dev channels, as I posted yesterday here. [1] 1: https://news.ycombinator.com/item?id=33135489 https://news.ycombinator.com/item?id=33135489
theptip 4y ago
I find it ironic that the site reporting this is practically unreadable on Safari due to all the ad banner noise. I took this opportunity to try Brave on iOS and it clears out most of the noise. If it gets rid of the consent banners too that would make the internet much less frustrating to peruse.
- mlinksva 4y ago
  And the article doesn't strike me as adding anything of substance over https://brave.com/privacy-updates/21-blocking-cookie-notices/ https://brave.com/privacy-updates/21-blocking-cookie-notices... (which at least it links to).
butz 4y ago
Why blocking outright might be not the right solution, it would be much easier if there was some standard for cookie banners, where once user chooses default parameters for all websites (all, none, or something in between), and later can adjust them per website basis if need be. There is already some consensus for mandatory, (extra) functionality, analytics and marketing categories, although many websites just dump everything in "mandatory". Although, lately I'm seeing more and more "reject all" buttons right next to "accept all" on websites. Might be a first good step.
- vorpalhex 4y ago
  There is already a standard called Do Not Track. Businesses ignore it.
  - notfed 4y ago
    Is "Do-Track" an option?
    - vorpalhex 4y ago
      Yes, you can send DNT with a 0 value. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
  - dmitriid 4y ago
    "Businesses" use Do Not Track for fingerprinting and tracking. Safari ended up removing it because of that.
1vuio0pswjnm7 4y ago
"In some cases, however, these banners can serve as trackers themselves, as they engage in a privacy-breaching data exchange before the user even has a chance to opt out." See, e.g., https://arxiv.org/abs/2102.08779v1 https://arxiv.org/abs/2102.08779v1 Blocking the banners, which generally require Javascript to function, is enough to stop consent, but keeping Javascript enabled still enables and/or strengthens the ability to track. No doubt JS is on by default in Brave. Can it be disabled globally for all websites or only on a site-by-site basis. The project was co-founded by the creator of Javascript. There will be people who make statements such "Disabling Javascript breaks every website." What they will not admit is that it breaks various tactics, including but not limited to cookie banners, used in tracking. And it breaks online advertising as a "business model". "Tech" companies have vested interests in Javascript remaining enabled. Dark patterns are used to ensure it stays on. This is unfortunate for all the legitimate uses of JS and the websites who only use JS responsibly. https://heydonworks.com/ https://heydonworks.com/ The above website "breaks" if Javascript is enabled. It demonstrates that so-called "modern" browsers running Javascript allow website developers to play games with website visitors. They can try to make visitors enable or disable Javascript by causing them to believe something will not "work". Meanwhile, I use a 1.3MB static binary text-only browser that does not run Javascript, store cookies, process CSS or auto-load resources. Yet I can generally read every website submitted to HN. To me, the websites "work" if I can read the content. If I do not like something that the browser does, I can edit the source and re-compile in a matter of minutes. For some reason(s), this is not done with "modern" browsers. They are used "as is". Perhaps "extensions" are a way to appease those users who might be inspired to modify the source code of "modern" browsers to remove undesired default behaviour or add functionality. The "tech" company browser vendor can change the rules of "extensions" at any time. As Google is about to do with Chrome.
- 1vuio0pswjnm7 4y ago
  https://remysharp.com/2020/11/30/please-disable-javascript-to-view-this-site https://remysharp.com/2020/11/30/please-disable-javascript-t...
LeoPanthera 4y ago
I use AdGuard (with Safari, but it's available for other browsers too) and the "Annoyances" filter already does a pretty good job of removing these.
bogomipz 4y ago
I'm increasingly encountering the following hostile sequence: 1. A CAPTCHA 2. A cookie consent ad 3. An immediate content blocking pop up asking me to subscribe to their newsletter(generally before I've had time to read a single sentence. It's amazing how miserable browsing the web has become. It's also amazing how many companies see this experience as acceptable. I just close the page when I get the email newsletter request. I realize the CAPTCHA is not going away but I feel like I'm regularly seeing it just to browse ordinary content. Is there any way browsers could limit these annoying mailing list subscription prompts as well? I feel like this has quickly become a scourge on par with the cookie consent ads.
Roverlord 4y ago
The only cookie I want to allow is one that stores that I already rejected all their other cookies.
kuba-orlik 4y ago
"These notifications are incredibly annoying but have become necessary to do business online to comply with data protection regulations like GDPR." No, they are not necessary. Website owners can choose to use privacy-friendly tools for analytics and then a cookie modal is not necessary

410 points by redbell 4y ago

Blocking means rejection of all consent, right? That’s great then. But I’m assuming the worst offenders who aren’t compliant with their banners also aren’t compliant in what they do when their pop up is blocked.

cplli 4y ago

An article on a site that has a cookie banner the size of my mobile screen :)

dustedcodes 4y ago
Which they acknowledged and even used as an example of an annoying cookie banner in their own article. That's quite funny... actually... because if they think of their own banner as this annoying then they could have made it a lot nicer and more subtle.. :)
- redbell 4y ago
  "making fun of yourself" is a well-known psychological trick to attract fans and boost credibility.
- jefftk 4y ago
  It's traditional and professional for the journalistic and business sides of a publication to operate independently. It's not perfect, and it's gotten weaker over time, but this article is an example of it operating correctly. Without this division we wouldn't have an article without annoying banners, we would have the business side killing the article for promoting an ad blocking browser ("don't you realize how we're funded!")

groffee 4y ago

Wouldn't that be illegal though? Purely from a Devils Advocate perspective those banners are legally required, so pro-actively blocking them seems like a bad idea.

dustedcodes 4y ago
I think the cookie consent was great in intention, but naively executed/enforced by the EU. I believe there must be a strong push back on those banners from browser vendors to force the EU to reconsider the current law and modify it. IMHO it would be much better if they'd revise the current law to require browser vendors to have a global cookie setting (accept functional, marketing, etc.) and then websites having to obey to a user's preference based on their browser setting.
- secondcoming 4y ago
  There used be the option of using a global cookie but website no used it. It was then deprecated. See the field 'IsServiceSpecific' in [0] [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20Consent%20string%20and%20vendor%20list%20formats%20v2.md https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...
- hnbad 4y ago
  There's nothing in any of the relevant EU laws forcing websites to have consent banners. They could simply handle consent like mobile apps are supposed to handle permissions (i.e. prompt once for a single purpose when it becomes relevant for a user interaction). But they want to shovel a ton of trackers and tracking ads and analytics and other garbage into every page load, so they need to obtain consent before those can be loaded and then they try to be clever (read: illegal) and trick you into giving them a blank check by making it harder to opt out and continue than to opt in to everything and give up. There's also nothing in the law saying the cookie banner has to be a modal dialog. The same sites happily went for actual "banners" rather than popups when the first EU cookie law was passed and only required notice rather than consent. They only went for modal popups because this forces users to make a choice before they can access the content. Ironically, if a data protection agency were particularly spicy that day, it could be argued that putting a site behind a modal consent popup rather than defaulting to opt-out and merely informing the user about other options violates the GDPR's requirement not to make the use of a website conditional to unrelated data processing because the popup is intended as a form of light coersion.

vincvinc 4y ago

Is there a (firefox) extension that auto-rejects everything on your behalf? I have only seen auto-accept ones so far.

K0nserv 4y ago
Websites aren’t allowed to start collecting data until the user has made an active choice. Thus, removing the DOM elements should be enough, on compliant websites. There should be no need to reject
- cutler 4y ago
  Good luck with that one in practice.
  - K0nserv 4y ago
    Indeed, hence "on compliant websites". I wish the EU's enforcement wasn't so lacklustre. Would be interesting if they hired 2-3 reverse engineers and had them go down Alexa top 10k and verify that consent banners are implemented correctly, handing out fines if not. One can dream I guess. Fundamentally, the problem with the GDPR isn't that the law is problematic, it's the lack of enforcement, this is the true cause of the consent banner proliferation.
    - Macha 4y ago
      Side note: The alexa top sites list is defunct since May: https://www.alexa.com/topsites/ https://www.alexa.com/topsites/
    - philipwhiuk 4y ago
      EU's enforcement is based on the country the site is hosted in's regulator. Which is a faff because it means the Irish regulator actively looking at what sites are hosted in the Ireland, rather than an EU regulator looking at all EU accessible sites. Which is non trivial to search for. (Also the Irish regulator struggles with regulatory capture).

AraceliHarker 4y ago

Although Brave claims to be a privacy-preserving browser, like this article, I wonder about Brave's policy because some trackers are actually whitelisted and Brave News recommends sites that contain a lot of trackers and advertisements.

NayamAmarshe 4y ago
> Brave News recommends sites that contain a lot of trackers and advertisements. From the website: "By using Brave’s new private CDN to deliver RSS feeds to the browser anonymously, there is no data trail available for third parties to collect or track. This makes Brave News a unique news reading experience when compared to other apps and platforms that track users’ reading activities. Nobody can track the content that Brave users are reading, including Brave itself." As for 'recommending', I don't think they're recommending anything, they're just providing you with an RSS feed that's more private than any other alternative. Sure the news websites have ads and trackers but Brave will block those too + The feature is disabled by default anyway. > because some trackers are actually whitelisted I think this is a bit misleading to say. Developers from Brave have already cleared that they do not block everything as they want the web to be functional for all users, people who want to block everything can use the 'Agressively block all trackers and ads' mode. More here: https://news.ycombinator.com/item?id=19132192 https://news.ycombinator.com/item?id=19132192
- deleted 4y ago
  [deleted]

jstx1 4y ago

Why don't have this in the browser options for any browser - always show banners, always hide them, auto reject, auto accept, white/black list based on rules etc - let your users pick the behaviour they want.

nabaraz 4y ago
Probably because most of the people would choose 'Reject all' if given the option. The gameplay here is to hide cookie options in submenus that are different on every webpages so users get annoyed and choose 'Accept all'.
- Maxburn 4y ago
  I hate these dark patterns so much. I’m all in on the automation to get rid of it.
- _v7gu 4y ago
  That’s why the relevant legislation usually requires the “Reject all” option to be as accessible as the “Accept all” option. You can complain to tour data protection authority to get these dark patterns removed
  - junofan 4y ago
    I’d prefer better rules. As-is, sounds like a scheme to grow some sort of data protection bureaucracy.
    - Nextgrid 4y ago
      Better rules, such as? I believe the rules we currently have are enough to protect privacy and deal with these kinds of dark patterns. The problem is the non-enforcement of these rules, so much that entire businesses now specialize in producing "consent management platforms" that help break the rules.
- Moru 4y ago
  Why do so much work to get people to select the wrong thing? That is as illegal in the EU as not getting consent for your cookies. Might as well just skip the cookie consent and just use your tracking cookies.

ungamedplayer 4y ago

Finally

Maxburn 4y ago
It’s annoying it took this long. On iOS there’s super agent to do the same.

DitheringIdiot 4y ago

> These notifications are incredibly annoying but have become necessary to do business online to comply with data protection regulations like GDPR. Alternatively, you can just not track the behaviour of every person who lands on your website. Use contextual ads instead of personalised ads.

TEP_Kim_Il_Sung 4y ago
Personalized ads never seemed workable, nor sensible to me, especially when showing me products I had just bought. It makes more sense if they are about tracking and influencing behaviour, as is done in Chy-nah.
rrwo 4y ago
> Alternatively, you can just not track the behaviour of every person who lands on your website. Tracking behaviour is useful to ensure the site is working, that people are able to use the site and make purchases, or even to know what parts of the site people are using. There is nothing wrong with that, so long as the logs are not shared and not kept for longer than necessary. Tracking people's use of the site to build a profile of them and share with third parties, without consent, is where the privacy problem comes from.
- SahAssar 4y ago
  "Tracking" that is necessary to ensure the service is functioning does not require consent. That is for example why logging IPs for things like rate-limiting or DDoS protection does not require consent, but that data cannot be used for anything else. If you do not track users but just track usage that should not require consent. So if you track for example purchases per hour (but not which users made a purchase) you can see if it becomes irregular. You can also track usage of certain site functions without tying that data to a specific user or session. So the actually necessary tracking does not require consent, but since companies got used to tracking everything and tying it to users/sessions before these laws it seems like they try to continue on that path instead of adapting.
  - 4y ago

deleted 4y ago

[deleted]

qwery 4y ago

Not sure how successful this will be, but it's always good to see someone kicking up a fuss about it. Apparently they're trying to block than just the visible parts ("where possible") so that's good. But you wouldn't know it from the headline, or even the prompt in the browser (screenshot in article) -- "block the banners" to me sounds like "hide the banners". The issue is that websites/businesses are doing things to users that the users do not want and do not ask for. We need legislation to target the unwanted behaviour more directly. Asking nicely isn't going to fix anything. Any 'cookie consent' style system will just be abused, worked around and cheated as the current one has. If you give an inch, they will take a mile. Every time.

BiteCode_dev 4y ago

Everytime I read about this, it makes me think about this game: https://termsandconditions.game/ https://termsandconditions.game/ (SSL warning) These shenanigans are not required, they are very much designed on purpose. Indeed, corporations can follow the "Do Not Track" header. There is nothing in the EU law that requires a banner, only informed consent. So if I have DNT=1 set in my browser, pop a quick non modal notification saying "we wants to track you but but we won't because you said not to. Click here if you want to change that". Solved. I'm informed. I made my choice. But that's not what it's about. Because the vast majority of people would not consent. Who are you kidding? This tracking is not benefiting us. It's like when politician says it's "for the children" or "to fight terrorists". Everybody knows there are full of it. So the banner is just the most annoying way that is legally allowed to try to get people to force-accept tracking. In fact, some banner are crafted to make rejection the hardest path for this very reason. Those corps chose to make the web terrible a little bit more every day: tracking, auto play, scroll hijacking, dark patters, cookie banners... We should thank the UE a 1000 times to reveal who are the bad players.

deleted 4y ago
[deleted]
adhesive_wombat 4y ago
> In fact, some banner are crafted to make rejection the hardest path for this very reason. Something that's also illegal. National regulators don't seem to care though, which is a shame as a couple of fines and operators would mysteriously, simultaneously and suddenly realise there _was_ a way to make rejection at least as easy as acceptance all along.
- shaky-carrousel 4y ago
  Luckily for us, in this age of centralized internet, you only need to hit with fines a couple of cookie dialog providers and you are set.
  - adhesive_wombat 4y ago

bawolff 4y ago

Ugh i hate these banners. The web browser should control the consent. Like how it worked in IE5 before everyone realized asking was super annoying and just assumed yes. It makes no sense for a web site to collect state to know if its allowed to collect state.

rrwo 4y ago
There is a misunderstanding about GDPR and cookie consent that many people have. Using cookies to track state on a website, that is only used for that website, is fine. You don't need to ask for consent. That is how a site tracks things like whether you are logged in.
- adrr 4y ago
  What a web RUM system or a JavaScript error logger that track groups by seasons? Or let’s say you’re testing a new feature with an AB test platform and the cookies are used to store bucket information?
- bawolff 4y ago
  The term "tracking state" also includes all the invasive ad targeting stuff as well. Its all state.
- jefftk 4y ago
  That's not correct: the ePrivacy directive doesn't distinguish between first and third party cookies but instead about whether the cookies are "strictly necessary for the delivery of a service requested by the user".
  - hnbad 4y ago
    Yes. And login state or preferences are perfectly valid "functional uses" that don't require consent (but need to be spelled out in the privacy policy by most interpretations of the law). The difference between first and third party cookies/embeds is only relevant when the third party may be collecting data (e.g. keeping access logs). This covers things like Google Fonts, Google Maps and social media embeds all of which should be opt-in and have fallback options (like an external link to the otherwise embedded post or map).

vbernat 4y ago

Firefox also plans to have builtin support for auto-rejecting cookies when there is a consent banner. See https://bugzilla.mozilla.org/show_bug.cgi?id=1783015 https://bugzilla.mozilla.org/show_bug.cgi?id=1783015. From my understanding, this should be similar to Consent-O-Matic. It will be available on both desktop and mobile versions. This is enabled recently by default in Nightly (but I don't use Nightly).

Danieltchi 4y ago
I want to use your comment to outline a broader criticism of what Brave is about nowadays. In this case, it should be obvious that even Firefox is more innovative than Brave - Firefox plans to auto-reject based on intelligent patterns. This should, if done right, take care of almost all cookie prompts, especially if they also add a filterlist. Brave has been in the business of blocking ads for a long time. Surprisingly it took them years to come up with cookie banner blocking, even though all they do is include a list maintained for free by easylist maintainers. This could have been implemented already 2 years ago without much effort. What's going on at Brave? Is everyone busy with crypto-stuff? Brave should work on detecting cookie-banners, even if they are not blocked by some list. The Brave Browser looks like they abandoned many important things because they are focusing on crypto - the UI is very basic, the customization is not better than Chrome, and due to the addition of many optional features, some users have reported the browser slowing down significantly. Maybe they should offer different installers for different audiences. People have asked about new-tab page customization for a long time. People have asked to have the uBO-functionality ported to the built-in Brave Shields, including cosmetic filtering, and granular control. People have asked for Brave to not activate the new-tab background sponsored images by default, which is in conflict with their user-first ideology. The VPN ad for guardianapp on iOS is too prominent and shows that they try to push it to increase revenue. If Brendan Eich is worried about ROI, he should start putting contextual ads on his search engine, instead of focusing on in-browser ads.
- rat9988 4y ago
  I'm not sure why you think firefox solution is better (it seems worse) nor why you think highly of firefox in this case, or at least higher than brave.

cutler 4y ago

Stopped reading this after being presented with a list of over 100 pre-selected "Legitimate Interest" no-ops. Including "Receive and use automatically-sent device characteristics for identification. Your device might be distinguished from other devices based on information it automatically sends, such as IP address or browser type."

Tor3 4y ago
I've counted up to 150 'legitimate interest' settings I've had to manually turn off one by one before I got to the end of the list. Obviously that's not something people are supposed to be able to actually do, even if I've done it a few times just for the heck of it (usually I just leave the site right away, unless it has a 'reject all' or similar - and many don't).

vijaybritto 4y ago

The banners should be part of a broader permissions management system in the browser. Any calls to the cookies constructor should be checked for permission

akrymski 4y ago

I actually wish websites rendered the same way they do on archive.is by default.

deleted 4y ago

[deleted]

pluc 4y ago

Reclaim the web from marketers and advertisers: block all ads, all JS and all cookies and operate on a whitelist alone. Fuck those people. If I need to have a PiHole, 3 ad blockers and block everything to enjoy the web I fucking will.

Bakary 4y ago
It's an uncomfortable topic because so many people here work for adtech and spend their lifetime essentially manipulating others for massive gain
- chatterhead 4y ago
- YeBanKo 4y ago
  Ads are necessary for business. Surely there are some companies with 0 marketing spend, but rather exceptional. You can say Tesla is one, but arguably their marketing expenses is Musk’s social influence, SEC and other potential regulatory fines that may eventually catch up with their self-driving campaign. Otherwise, investing marketing money into your brand means that you have something too loose. Relatively easy to set to set up a website or a white-labeled brand, but when you put few millions into marketing it signals that you attached to that brand. When competition is tight and cost of acquisition can eat your margin, you want to want to be laser focused on ad efficiently. Getting cost of acquisition, life time value and ROI of different cohorts is very very difficult. You need a good tracking for that. But then there are two outcomes, improve the product or invest further into invasive tracking to “engineer” customers into buying your product. When industry leans towards the latter, individual companies have to as well to stay competitive.
  - Bakary 4y ago
    I understand this reality, but that is what I am referring to as manipulating people for gain. That is literally what is happening. That it helps businesses doesn't change that.

joemaller1 4y ago

Too many cookie notices are only to accommodate Google Analytics.

jtbayly 4y ago

Now this is something I'd consider a new feature that is worth switching browsers over. I remember back in the day, when (Opera?) added tabs to the browser. Made such a big difference in daily use when I tried it out. This feels similar. Make the web usable again! Edit: Actually, this is even more like when browsers added pop-up blockers, now that I think about it.

fifilura 4y ago
As a matter of fact, Opera has been blocking cookie dialogs for a long time already. Possibly only Opera for Android though. https://www.zdnet.com/article/opera-for-android-adds-support-for-blocking-eu-cookie-popups/ https://www.zdnet.com/article/opera-for-android-adds-support... It is a difficult problem though as there is no standard for cookie dialogs, everyone has their own implementation. And if you don't do it properly you may only block the visuals and be stuck with an invisible element that covers the screen and makes it non-clickable.

leephillips 4y ago

“These notifications are incredibly annoying but have become necessary to do business online to comply with data protection regulations like GDPR.” Incorrect. bleepingcomputer.com is required to show the banner because they want to spy on us, and the GDPR demands that they ask permission to do so. If they were more ethical, they could “do business” without having to annoy us with the banner.

exabrial 4y ago

Thank goodness.

wirthjason 4y ago

Why is it that Google Analytics is often listed in “strictly necessary cookies”? I’ve never known that to be a requirement for handling cookie based seasons or logins.

Nextgrid 4y ago
Because product managers and/or marketing people consider their salary "strictly necessary".
mdaniel 4y ago
Back in the old days, before FF started inserting GA shims, having `onclick="ga_track(); doTheThing();"` was fairly common. So, if disabling GA broke the site, then from their PoV it was necessary IOW, I'd bet it was damn near a lie

rvz 4y ago

Yet another reason to use Brave Browser.

sh4un 4y ago

kgwxd 4y ago

It shouldn’t be required for users to have to wait for Brave to implement this.

smoldesu 4y ago
They don't need to, the feature has been in Firefox Nightly for a few weeks now: https://bugzilla.mozilla.org/show_bug.cgi?id=1783015 https://bugzilla.mozilla.org/show_bug.cgi?id=1783015
- kgwxd 4y ago
  Why did Firefox implement it? I was talking about extensions. uBlock Origin could (does?) already do it and, IMO, this domain is much better left to a third-party with no financial incentive to track people or to make exceptions for "fair" trackers.

herf 4y ago

If you wanted to make app stores stronger and the Web much worse, these consent banners would be a fantastic way to do it. "User agents" should be able to express our intentions clearly and without nag screens every time.

specialist 4y ago

At some point, web browsers will become content scrappers, only showing the interesting bits. Fully standards compliant WYSIWYG forfeits control to the server (service). Scrapping restores agency to the user (client).

democra 4y ago
At that point there will be very little content for the browser to scrape, because most content will be behind a paywall or a subscription.

coffeeblack 4y ago

Is that what the web has become?

deleted 4y ago
[deleted]

gnicholas 4y ago

Brave is also soon to offer vertical tabs. This is currently available on the Nightly and Dev channels, as I posted yesterday here. [1] 1: https://news.ycombinator.com/item?id=33135489 https://news.ycombinator.com/item?id=33135489

theptip 4y ago

I find it ironic that the site reporting this is practically unreadable on Safari due to all the ad banner noise. I took this opportunity to try Brave on iOS and it clears out most of the noise. If it gets rid of the consent banners too that would make the internet much less frustrating to peruse.

mlinksva 4y ago
And the article doesn't strike me as adding anything of substance over https://brave.com/privacy-updates/21-blocking-cookie-notices/ https://brave.com/privacy-updates/21-blocking-cookie-notices... (which at least it links to).

butz 4y ago

Why blocking outright might be not the right solution, it would be much easier if there was some standard for cookie banners, where once user chooses default parameters for all websites (all, none, or something in between), and later can adjust them per website basis if need be. There is already some consensus for mandatory, (extra) functionality, analytics and marketing categories, although many websites just dump everything in "mandatory". Although, lately I'm seeing more and more "reject all" buttons right next to "accept all" on websites. Might be a first good step.

vorpalhex 4y ago
There is already a standard called Do Not Track. Businesses ignore it.
- notfed 4y ago
  Is "Do-Track" an option?
  - vorpalhex 4y ago
    Yes, you can send DNT with a 0 value. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
- dmitriid 4y ago
  "Businesses" use Do Not Track for fingerprinting and tracking. Safari ended up removing it because of that.

1vuio0pswjnm7 4y ago

"In some cases, however, these banners can serve as trackers themselves, as they engage in a privacy-breaching data exchange before the user even has a chance to opt out." See, e.g., https://arxiv.org/abs/2102.08779v1 https://arxiv.org/abs/2102.08779v1 Blocking the banners, which generally require Javascript to function, is enough to stop consent, but keeping Javascript enabled still enables and/or strengthens the ability to track. No doubt JS is on by default in Brave. Can it be disabled globally for all websites or only on a site-by-site basis. The project was co-founded by the creator of Javascript. There will be people who make statements such "Disabling Javascript breaks every website." What they will not admit is that it breaks various tactics, including but not limited to cookie banners, used in tracking. And it breaks online advertising as a "business model". "Tech" companies have vested interests in Javascript remaining enabled. Dark patterns are used to ensure it stays on. This is unfortunate for all the legitimate uses of JS and the websites who only use JS responsibly. https://heydonworks.com/ https://heydonworks.com/ The above website "breaks" if Javascript is enabled. It demonstrates that so-called "modern" browsers running Javascript allow website developers to play games with website visitors. They can try to make visitors enable or disable Javascript by causing them to believe something will not "work". Meanwhile, I use a 1.3MB static binary text-only browser that does not run Javascript, store cookies, process CSS or auto-load resources. Yet I can generally read every website submitted to HN. To me, the websites "work" if I can read the content. If I do not like something that the browser does, I can edit the source and re-compile in a matter of minutes. For some reason(s), this is not done with "modern" browsers. They are used "as is". Perhaps "extensions" are a way to appease those users who might be inspired to modify the source code of "modern" browsers to remove undesired default behaviour or add functionality. The "tech" company browser vendor can change the rules of "extensions" at any time. As Google is about to do with Chrome.

1vuio0pswjnm7 4y ago
https://remysharp.com/2020/11/30/please-disable-javascript-to-view-this-site https://remysharp.com/2020/11/30/please-disable-javascript-t...

LeoPanthera 4y ago

I use AdGuard (with Safari, but it's available for other browsers too) and the "Annoyances" filter already does a pretty good job of removing these.

bogomipz 4y ago

I'm increasingly encountering the following hostile sequence: 1. A CAPTCHA 2. A cookie consent ad 3. An immediate content blocking pop up asking me to subscribe to their newsletter(generally before I've had time to read a single sentence. It's amazing how miserable browsing the web has become. It's also amazing how many companies see this experience as acceptable. I just close the page when I get the email newsletter request. I realize the CAPTCHA is not going away but I feel like I'm regularly seeing it just to browse ordinary content. Is there any way browsers could limit these annoying mailing list subscription prompts as well? I feel like this has quickly become a scourge on par with the cookie consent ads.

Roverlord 4y ago

The only cookie I want to allow is one that stores that I already rejected all their other cookies.

kuba-orlik 4y ago

"These notifications are incredibly annoying but have become necessary to do business online to comply with data protection regulations like GDPR." No, they are not necessary. Website owners can choose to use privacy-friendly tools for analytics and then a cookie modal is not necessary