22 ms·
Consent-O-Matic: Automatic cookie management
- deleted 4y ago[deleted]
- pmdr 4y agoCool, next they'll add recaptcha to change/reject cookies. Dark patterns are everywhere and there's seemingly no widespread boycott against them. Open source projects should have banners about them on their homepage, as they've had for other social issues.
- ShadowBanThis01 4y agoMy favorite is the big button that says "Do not sell my information," which takes you to a panel that has "Sale of personal information" turned ON. Even worse, look at this BS: https://i.imgur.com/Q0Hlzk3.png https://i.imgur.com/Q0Hlzk3.png The button that says "Do not sell my information" means YES DO sell my information when it's "on." I complained to them directly and said I'd pursue a complaint with the CA state's attorney, and to my surprise they actually changed it. But you still see this: https://i.imgur.com/fx0pqxA.png https://i.imgur.com/fx0pqxA.png
- dmattia 4y agoThat's the worst, both examples have the toggles being confusing for sure. But hey, kudos to you for talking to them and making something better, even if it's still not perfect!
- layer8 4y agoIronically, ReCaptcha is not GDPR compliant and would require consent before use.
- robert_foss 4y agoConsent-O-Matic is a great project, and near completely solves the cookie banner issue while still giving the user the choice of which types of cookies that are desirable.
- IanCal 4y agoThis is great, I'd kind of like an option when dark patterns are detected to opt in then immediately submit gdpr data requests though.
- Arch-TK 4y agoAnd then automate reporting to the ICO when they ignore the request?
- Nextgrid 4y agoYou'd need to automate the next escalation path when the ICO turns out to be doing what they do best: being useless.
- kerkeslager 4y agoThe predictable result of that will be for the requests to be ignored and the enforcement system will work even more poorly. A solution which might actually improve enforcement would be to have someone filter the requests that come into Consent-O-Matic and forward them to the authorities in a monthly digest. Quality reports from a human who actually put effort into making them will get more traction than automated, low-quality reports. Make it easier to enforce the law, not harder.
- IanCal 4y agoWhy would that make the enforcement system work worse? These would be to the offending organisations.
- recursive 4y agoIt's wild to me there's all this document sniffing song and dance, rather than just creating some standardized request headers. How many CPU cycles are spent setting up and tearing down these pointless banners?
- dataflow 4y agoIt's not for lack of trying. When the DNT header came out, trackers said they would refuse to honor it if it was made opt-out rather than opt-in.
- Sephr 4y agoFortunately consent managers can still enforce restrictions onto non-compliant trackers whenever this signal is detected.
- nostromo 4y agoThat header exists, but the EU decided to go in a different, and much more annoying, direction. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
- whstl 4y agoWebsites are free to use it. It is 100% compliant with the GDPR.
- robryk 4y agoBut they're not required to obey it, so they ignore it, presumably because they expect that more people will agree if they are annoyed with a dialog by each website they visit.
- KyeRussell 4y agoWhich in my case is entirely true.
- loloquwowndueo 4y agoWhat’s the difference with “I don’t care about cookies” extension?
- ImPostingOnHN 4y agoThat one is equivalent to always clicking accept all
- rzzzt 4y agoThe browser can always decide to remove any cookie associated with the site or not store it outright.
- PeterisP 4y agoWell, no, because there are non-cookie mechanisms of tracking to which you'd want to refuse permission, and because for sites where you do want to have some cookies (e.g. to log in to an account) you'd want to refuse permission to use that information for other purposes.
- rzzzt 4y agoYou have no way of proving whether any cookie or non-cookie mechanism is employed for a purpose you did not give permission for. What you can do is eg. not enable the microphone when the website asks for it, not send the GA cookie back with requests to spin the visitor counter, or make the browser pretend that you have a bog-standard screen resolution and font selection. They will not have the information, so only the lack of information can be used. If the cookie that stores your logged-in status is used for other purposes like getting more relevant ads in front of your eyeballs, that sucks. One can only hope that they are separated by functionality, or the candidates for more dubious activities are given out by a third party.
- PeterisP 4y agoThe main limitations on companies are legal, not technical, imposing costs on them that make it not worth to break the law. There are obvious ways of proving whether any cookie or non-cookie mechanism is employed for a purpose you did not give permission for, namely, audits of their systems and testimonies of their employees, which has resulted in quite a few huge fines being assessed and the illegal activity stopped, and will result in more. We simply have to not legitimize this being done as "business as normal" and have to make it clear that they are not permitted to do so - all the really big impact comes from the large megacorps who eventually have to stay above the board legally.
- dmattia 4y agoWhen the Global Privacy Control (gpc) is set, websites should not show a banner and should default to opt-out. If companies followed this (and some do: https://imgur.com/a/kKkiaVm https://imgur.com/a/kKkiaVm), this wouldn't be as necessary. But alas, Consent-O-Matic is a cool tool for the present
- rootusrootus 4y ago> Global Privacy Control Notably, the popular mainstream browsers haven't implemented this and so you need an add-on for it. Irritating.
- dbg3386 4y agoFor both Firefox and Brave, you don't need any add-ons or extensions. For Firefox, you can enable GPC in `about:config`. You'll want to flip `privacy.globalprivacycontrol.functionality.enabled` and `privacy.globalprivacycontrol.enabled` both to `true` For Brave, GPC is enabled by default. You can test your browser by going to https://globalprivacycontrol.org https://globalprivacycontrol.org. It'll tell you at the top of the page if you have GPC turned on.
- rootusrootus 4y agoRight, I didn't say all browsers, just the popular mainstream ones. Safari, Chrome of any kind, including Edge.
- Semaphor 4y agoDepending on your country, FF counts as mainstream on Desktop. Hi from Germany ;)
- alwayslikethis 4y agoI think this is fundamentally the wrong way to deal with it. Cookie persistence should be a client side permission. If user does not want to keep cookies, it is stored for the session and cleared on exiting browser, just like in incognito mode. With these permission dialogs controlled by the website, you are trusting these buttons to do what they say they do.
- Thiez 4y agoThese consent forms are not about cookies. They cover all forms of tracking, whether by cookie, local storage, ip adres, browser fingerprint, or any other technique.
- VWWHFSfQ 4y agoI truly believe that the EU has ruined the internet. There are many ways they could have addressed the privacy issues of tracking cookies. But they decided to mandate the absolute most annoying, user-hostile mechanism possible. And now we can't get rid of it.
- snacktaster 4y agoTheir nanny state is leaking.
- manuelmoreale 4y agoWhat’s “nanny” about at least trying to do something to fight the omnipresent tracking? We can criticize the solution, sure. We can also criticize the end result. But the intention was a good one and it was worth doing imo because at some point something has to be done.
- OkayPhysicist 4y agoThey did not mandate consent banners. Websites are completely free to either A) not collect private information or B) Only track users on an opt-in basis.
- Hamuko 4y ago>But they decided to mandate the absolute most annoying, user-hostile mechanism possible. Which parts of it are user-hostile? The consenting part, or the opt-out part?
- cseleborg 4y agoNo, unscrupulous adtech businesses have ruined the internet. I had a business website that would not track users, and thus needed no cookie banner. If more business owners (especially the large ones) would stay away from shady practices they know full well their own children would object to, I'd say the web would still be a fine place today. Actually, it's a bit more nuanced than that, because merely by using the #1 analytics solution, even without shady practices on your part, you already put your visitors' data at risk. Other example: embeds. I used Vimeo rather than YouTube to embed videos, using their rather honest do-not-track option, but went the extra mile and disabled localStorage for them, to ensure no data whatsoever was left. So almost all business owners need to actively want to protect their users' privacy, but this is a consequence of a few big players' explicit choices. See above. [edit: style]
- ElectricSpoon 4y agoMeanwhile, I'm using noscript like it's still the 90's and get no such prompts. Granted most of the websites are crippled, but you can't have your cookie and eat it too.
- Dalewyn 4y ago>I'm using noscript like it's still the 90's and get no such prompts. NoScript came out in 2005.[1] [1]: https://en.wikipedia.org/wiki/NoScript https://en.wikipedia.org/wiki/NoScript
- taejavu 4y agoHe's saying the result of using noscript is that the web is like it was in the 90's.
- dicknuckle 4y agoProxitok gives the same experience to that dumpster fire of a UI we call TikTok.
- Dalewyn 4y agoThat is not what he said. He said he's "using noscript like it's still the 90's", as in he's using NoScript as if he was still in the 1990s. Problem with that is NoScript did not exist in the 1990s. As an aside, NoScript did not exist, "browser extensions" in general did not exist (not counting toolbars...), and ads, Shockwave Flash, and some JavaScript were already very much a thing in the 1990s.
- deleted 4y ago[deleted]
- taejavu 4y agoI didn't say that's what he said, I said that's what he's saying. There's a difference.
- krono 4y agoCurious to know if this also handles that nasty pattern where all "legitimate interest" opt-out toggles are hidden under the expanded details of each individual third party. The only live example of one variation on it I can remember right now is on msn.com (sort of fits their theme, got to give them that).
- h4x0rr 4y agoThere are a lot of websites doing that, like 30-60% of the websites with cookie popups in my experience. Pretty skummy imo
- Mumps 4y agoExactly my first question about this. A naiive search for "legitimate" in the repo shows 10 files [0] hard-coded into specific rules sets. Which I interpret as: it's only available on those. Which is a real shame. I'm so damn sick of manually deselecting all of the hidden consent toggles :C [0] https://github.com/search?q=repo%3Acavi-au%2FConsent-O-Matic%20legitimate&type=code https://github.com/search?q=repo%3Acavi-au%2FConsent-O-Matic...
- krono 4y agoWhat I usually do is to select a parent HTML element of the list of third parties using the browser's dev console and then use JS to find, loop, and click each of those toggles automatically in one go. The script would look something like this: $0.querySelectorAll('.thirdparty button.optoutToggle').forEach(({click}) => click()) Where $0 is an automatic reference to the selected parent element. The pseudocode/example string passed to querySelectorAll should be a selector (same syntax as selectors in CSS) to get each individual toggle element. Then forEach of those toggles it simulates a mouse click event. That said, whatever is on these websites isn't usually even worth all this effort and it doesn't always work.
- Macha 4y agoOh god, I thought that some of those sites had finally been slapped or scared by others getting slapped by regulators when the legitimate interest buttons under each subheading disappeared and was even feeling good that reject all might actually reject all now. But I checked a few and nope, they've just moved it to per vendor like you said.
- karaterobot 4y agoThere are too many plugins that need access to all my data on all websites. Doesn't matter that it's open source, I'm not going to review every update of every plugin. Why can't I sandbox a plugin to a whitelist of domains?
- maxwindiff 4y agoOn Safari at least, you can configure it to ask whether you want to run an extension on each domain.
- dijit 4y agoWasn't that the whole point of manifest v3? Honestly Manifest v3 was contentious because it essentially nerfed adblockers completely -- and for that reason I really despise it. But it sounds like exactly what you're asking for. What is your alternative though? Surely things like this would need to access basically every website in order to be useful, and more-so on websites you'd never visited before. You can always use something like chrome/firefox profiles which enable different plugins for different uses if that makes you feel safer.
- jabbany 4y agoSeems like a poor excuse for v3. Changing the permissions should be a browser side thing not something that requires an update on the extension side. E.g. You can have extensions always ask for the max permissions needed, as long as the users can go in and un-permit stuff as needed. No need to change any aspect of the existing extension system... > Surely things like this would need to access basically every website in order to be useful, and more-so on websites you'd never visited before. Probably some kind of blacklist instead. E.g. This extension cannot run on these websites. We already have a more basic version of this with the allow running incognito option.
- Semaphor 4y agoJust mentioning that FF will allow V3 manifest (without the blocker nerf, not sure if it already happened).
- 4y ago
- throwaway22032 4y agoI'd rather just set most sites to wipe cookies per page and then just click whatever button they like. Almost all websites have this "necessary cookies" song and dance going on. There are no necessary cookies, I view your page and then close it and we can delete everything. It's total nonsense.
- IgorPartola 4y agoI want to stay logged into some websites long term and not go through the entire 2FA login song and dance every time I want to e.g. check HN. Unfortunately since web browsers don’t have a usable authentication store we are stuck with using cookies for this. All other uses for cookies are basically invalid.
- throwaway22032 4y agoSure, that makes sense. 99% of websites I visit that do the cookie crap I never log in to, though. The banner could easily be kept until that point.
- suyula 4y agoMy solution was to write a bash script that runs something like "delete from moz_cookies where host not in 'ycombinator.com');" in the Firefox cookies.sqlite file. I run that every time I suspend my computers.
- pndy 4y agoThere's Cookie AutoDelete extension for Firefox And Chromium-based browsers - it does that automatically
- djbusby 4y agoIf one only uses cookies for required thing (eg: auth-session) do we even need those cookie warnings? No ads, no third parties.
- deadbunny 4y agoGood thing no companies use tracking methods that don't use cookies.
- the_gipsy 4y agoCookie or LocalStorage or whatever is irrelevant, what matters is tracking a session when it's not necessary to provide the service.
- jeroenhd 4y agoYou don't need a consent dialog for purely functional cookies. You may need to explain what that cookie does in your privacy policy, though. You can even show ads; ads don't require tracking, or even third parties.
- 1vuio0pswjnm7 4y agoI read thousands of websites submitted to HN and I do so without ever processing or sending cookies (except the one to HN itself). I am not convinced cookies are required for recreational web use or generally when using the web to retrieve information. Tasks like e-commerce or webmail are different matters. But 99.9% of the time I'm using the web, it's not for e-commerce, nor am I "logging in" to websites. And for webmail, I control sending the necessary cookies via a localhost-bound TLS proxy, not a "tech" company web browser. I can check webmail from the command line. No graphical browser required. I am a text-only browser user; the browser has no support for cookie or other storage. Yet I read thousands of websites. Cannot speak for others, but it seems 99.9% of the time I do not need cookies. Yet the second I use a popular graphical Javascript-enabled browser from a "tech" company, the cookies come fast and furious. i just block them using a localhost-bound proxy. Others use extensions of whatever. With respect to so-called "UX", i.e., user sanity, IME it certainly makes a difference which client/browser one choose to read the web. The so-called "tech" company employees are hell-bent on every last web user choosing the same handful of advertising-friendly web browsers. To see those cookie banners one needs to use the "correct" browser, with "correct" being determined by people who profit from selling online advertising services. I use the "incorrect" ones and I never see cookie banners.
- Semaphor 4y agoCookies are only the easy to understand part, tracking has far more options available, including the similar other storage mechanisms, but also advanced techniques for fingerprinting. I actually hate that it gets distilled down to cookies in discourse.
- xhruso00 4y agoJust tried it. The toolbar icon has colors. Should be updated to be a template icon. For it needs to be a template icon. I cannot remove it from toolbar as I don't want to allow it on every website.
- FredPret 4y agoI think the EU is trying to regulate something can’t be regulated because incentives don’t align. Want a free internet? That means ads and tracking. Want no ads? That means you paying… and young or poor or anonymous people get excluded
- cuu508 4y agoGDPR does not ban tracking. It requires that user is informed how their personal data will be used, and, where the processing of their personal data is not strictly needed, explicitly consents to it.
- manuelmoreale 4y agoI think this is disingenuous. There are ways to do advertising without invasive and excessive tracking. We just accepted that getting tracked is the default and has to be that way. But there are alternatives. Sure, those alternatives would probably be less effective but also more respectful of user privacy. And I know the change won’t happen. I’m aware of that. I’m just saying that alternatives are out there.
- mrweasel 4y agoYou can still do ads, there are no rules regarding ads (other than there are things you can not advertise, like in the real world). The main issue really is that publishers and ad networks conflate tracking and ads. I'm pretty tired of sites popping up a message saying: "We need to talk about your ad blocker". I don't block ads, I block tracking, remove the tracking and we're good. Context based ads works almost as well as those based on endless amounts of personal information. They are good enough, they worked well for decades. The problem is that they are a lot hard to sell/buy and modern online ad specialist aren't qualified to do it, they can only click around the Google AdWords or Facebook Ads.
- xigoi 4y agoThere are many people posting without any payment or ads… and usually the content is way better.
- alkonaut 4y ago
- pabs3 4y agoThe EU should have mandated that browser vendors be the ones to implement cookie preferences, not every single website.
- layer8 4y agoThe EU can’t forbid web sites from informing you about the purposes for which they may want to store data on your browser. Even if the EU mandated a technical browser protocol, there would still be popups.
- isbvhodnvemrwvn 4y agoIt defeats the point, management of personal data is sole responsibility of companies. Why should browsers take responsibility for that?
- daveidol 4y agoA standardized protocol with a nice browser native UI?
- ohgodplsno 4y agoThat was called Do Not Track headers, and websites decided to both ignore it and use it for additional tracking. The current situation is purely a result of advertising companies fucking you over, not because of Europe.
- Hamuko 4y agoThese companies consider the big green "I consent" button to be the nice UI. Or rather, they want to make sure it's the nicest UI.
- jeroenhd 4y agoThat would be the dream. Websites won't use it, though, and making a specific protocol mandatory by law would be quite bad in a couple of years when greedy data brokers figure out new ways to exploit people and their data. P3P was an early version of this concept: a browser-native privacy control system. No websites used it, it was only ever implemented by Microsoft, and has been removed from the last remaining browsers a while back. I think Apple, Google, Microsoft, and Mozilla coming together to set up a privacy protocol to replace cookie banners would be the right way to handle things. Until usable browser UI exists, there's no way to force the companies currently employing dark patterns to comply.
- oezi 4y agoDoes Consent-O-Magic also keep a record of each such automated action for me as the user?
- clemensnk 4y agoIt keeps a log locally on your computer of how many of a certain type of pop-up it has handled (and how many clicks it has made for you). You can access it through the 'about' tab in the extension.
- shp0ngle 4y agoOne of the funniest things to me is that the EU organs that made this sort of thing ALL HAVE tracking cookies and analytics on their websites and ALL HAVE these annoying banners. To the last one.
- illiarian 4y agoWhat they usually have is a tidy banner saying something like "We use analytics cookies. Reject. Accept". Compare it to the abominations that the greedy tracking leaches from OneTrust, IAB etc. are presenting.
- deleted 4y ago[deleted]
- _the_inflator 4y agoI find the development of personal information management quite intriguing. The hidden wars in a browser. Hiding away information autonomy handling. In lax IT terms, "website handshake" becomes a new meaning. Right now, consent means a contractual agreement. In the near future, with systems becoming more sophisticated and regulated (EU, I look at you), visiting a website in this sense means two lawyers negotiating a contract you simply agree to. From "personal homepage" featuring almost anything from silly stuff to personal disclosures to "Sign here before you can see my content!" in less than 15 years.
- AltruisticGapHN 4y agoNext plot twist : the addon is integrated in the browser. /lelz
- unhammer 4y agoPretty cool, but installing it also means letting an extension have permission to "all data from all sites". Android has this "allow while app is open" method, which I think would be nice here, e.g. if you click the icon of the extension then it gets permissions for that site&tab&session, otherwise it can't run.
- TazeTSchnitzel 4y agoYou'd then have to click the extension once for every site you visit. Is that really much of an improvement?