8 ms·

That header exists, but the EU decided to go in a different, and much more annoying, direction. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia

That header exists, but the EU decided to go in a different, and much more annoying, direction. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track

whstl 4y ago
Websites are free to use it. It is 100% compliant with the GDPR.
- robryk 4y ago
  But they're not required to obey it, so they ignore it, presumably because they expect that more people will agree if they are annoyed with a dialog by each website they visit.
  - KyeRussell 4y ago
    Which in my case is entirely true.
  - pipo234 4y ago
    How about this: I've configured Firefox with DNT and frequently, when I land on a site that blocks my view with a modal cookie popup, I just push the back button and try another link. While my browsing behaviour might be less typical than just pressing "OK", I'm sure it's a statistic they are keeping an eye on. So while the dark pattern approach has merits to sites that want to track you, they must also be aware this is a balance. And a percentage of users will generally prefer to go to sites that leave them alone. That is: the cookie dialogue never widens the funnel.
    - csunbird 4y ago
      But, this behavior does not protect your privacy at all, because those websites already put tracking information in your cookies claiming that they fall into “Legitimate Interest”. You need to interact with the modal and claw your way into the hidden settings where you can disable “Legitimate Interest” toggles.
      - whstl 4y ago
        You are correct, but just some additional information: Those cookie banners are illegal under GDPR, btw. Real "Legitimate Interest" does not even require consent, and you can't claim that tracking or marketing is "legitimate interest". An example of legitimate interest is keeping your address in the records after a purchase, or storing a receipt for accounting reasons.
  - joking 4y ago
    and they expectation is correct, I click whatever green button that i'm presented and expect that my combination of private browser sessions, different profilers and adblock extensions messes them enough. It sucks, I know, but the quantity of time people has loss with those banners, both on the client side and both on the developer side (even If is paid work that i did, I would have preferred to do anything more valuable) is enormous, and the culprits responsable of this should be taken to the courts, if not presented with a cumputer and sentenced to pass the rest of their lives clicking consent banners. I suppose that is a matter that strikes a chord with me.
- karaterobot 4y ago
  Compliant with GDPR doesn't seem to mean much. The comment I'm leaving now is compliant with GDPR. The question is, does it fulfill a cookie-using website's requirements under GDPR without additional UI? Wikipedia at least says it does not ("DNT is not widely adopted by the industry, with companies citing the lack of legal mandates for its use") https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
  - orangeoxidation 4y ago
    > The question is, does it fulfill a cookie-using website's requirements under GDPR without additional UI It cannot. That's the whole point of the GDPR. It forbids tracking without informed, explicit user consent. Users cannot be informed or agree with the header setting. Sites can, of course, not track users, or not track users who set do not track. They don't want to, that's why they try to annoy and/or mislead anyone into agreeing with their horrible banners. (Using Cookies for site settings or even logins can be done without explicit consent and without banners)
    - alkonaut 4y ago
      The problem is that regulators were influenced by industry then. The proper regulation would have required that the default state be that users are shown no consent banners without explicit action and also not tracked.
      - illiarian 4y ago
        GDPR. Does not. Mandate. Browser. Or website. Cookies. Banners. Or UIs. In it's simplest form it says: if you want to collect more data than is required, you have to ask users for consent. This applies in equal measure to sites, banks, grocery stores, shopping malls, shit processing plants, nuclear reactors etc.
        alkonaut 4y ago
        I'm. Fully. Aware. But there is a need for clarification here for the most often encountered consent case: web sites. Basically the regulation could say: you must have consent to collect data, but you must ALSO observe specific standardized method X of of blanket disallowing all consent in specific contexts. For example, "if do-not-track is used in a web browser, then the user should not be shown a consent dialog but instead provided the service as if they had rejected the consent dialog". I realize that regulators (for good reason!) are very reluctant to specify specific technologies. It's not their home turf, and it's likely to be quickly outdated. But I'm ready to accept that this would be a time when there is a good reason to make an exception to that rule.
- jeroenhd 4y ago
  I was pleasantly suprised to see websites like medium.com disable their embeds and seemingly their tracking scripts when you have DNT enabled. Most websites that use ads or (opt-out) tracking choose to ignore the header because there's no technical or legal reason why they can't.
mqus 4y ago
The problem is rather, that they didn't decide yet (e-privacy directive). The gdpr was meant to be general, it was designed to not have technical details because it applies to everything.
- dmattia 4y ago
  It's noteworthy that in the Sephora case for California the AG explicitly called out the Global Privacy Control (gpc) as something that companies need to honor. From https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement https://oag.ca.gov/news/press-releases/attorney-general-bont...: "“Technologies like the Global Privacy Control are a game changer for consumers looking to exercise their data privacy rights. But these rights are meaningless if businesses hide how they are using their customer's data and ignore requests to opt-out of its sale,” said Attorney General Bonta. “I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law. My office is watching, and we will hold you accountable."
jefftk 4y ago
It didn't help that no one could agree on what constituted 'tracking', and what activities should be skipped on receiving that header. This was supposed to be part of the DNT standardization process, but was too contentious.
- kevviiinn 4y ago
  How about simply "any cookies that aren't required for the service to function" Same cookies that get set by the annoying banner when you click through their BS to the "save my preferences" button
  - YPPH 4y ago
    What if cookies which are required for a service to function are also used for tracking?
    - hackmiester 4y ago
      It looks like you have identified the workaround that a ton of sites are using to track even users who deny non-essential cookies.
      - _v7gu 4y ago
        Doing that is a clear GDPR violation
        rendall 4y ago
        As an American living in Europe who supports the GDPR, I suspect that most of the violations are driven by American companies and these violations are in part ideological. The concept of a government sincerely passing a law that genuinely and competently protects the privacy of its individual citizens seems absurdly unlikely to many of us. Laws are not created for individuals except when a cynical politician wants votes from the gullible. Circumventing such a "stupid", "anti-business" law as the GDPR is almost an American duty.
pabs3 4y ago
And there was P3P before DNT: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P
happymellon 4y ago
Observing the do not track would have fulfilled the EU requirement. You are falling into the trap that Americans normally do that think that the directive have anything to do with cookies or that the cookie banner was requested by the EU. The requirement is simply > You may not collect personal information without consent. If they have an obnoxious advertising and data harvesting cookie banner then that was a design decision to make you opt in.
- janosd 4y ago
  IANAL, but this is not entirely correct. For example, if you have server logs, that's processing personal information, most likely under GDPR Art. 6 lit 1f (legitimate interest). Under Art 13 the user must be informed of this. Because of the information requirement the Do-Not-Track is not enough unless you really, truly do not track any PII (which includes the IP address). Equally, this is incorrect: > You may not collect personal information without consent. There are a whole host of reasons listed in Art. 6 when you do not need consent.
  - happymellon 4y ago
    I was answering in the context of the statement that the EU made this cookie banner mess and that the do not track header died because of the GDPR. I didn't feel that logs would be relevant in this case because you would log that the Do Not Track header was present. As a distilled version of the GDPR I still feel it hits the point.
    - illiarian 4y ago
      > that the EU made this cookie banner mess It didn't. Companies not willing to comply with GDPR did. As they didn't want to comply with Do Not Track header and used it for fingerprinting.
      - happymellon 4y ago
        Exactly this.
alkonaut 4y ago
There should have been a standardized way for a browser to respond in exactly the way that these plugins behave. Basically "allow only functional/minimum cookies, never anything else". Regulators of course should enforce the simple fact that this is also a requirement for anyone who dismisses a consent popup, has a browser setting that suppresses it, or even someone who clicks the biggest most obvious button - since all those actions (or non-actions) must result in "no consent".

That header exists, but the EU decided to go in a different, and much more annoying, direction. https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track

whstl 4y ago

Websites are free to use it. It is 100% compliant with the GDPR.

robryk 4y ago
But they're not required to obey it, so they ignore it, presumably because they expect that more people will agree if they are annoyed with a dialog by each website they visit.
- KyeRussell 4y ago
  Which in my case is entirely true.
- pipo234 4y ago
  How about this: I've configured Firefox with DNT and frequently, when I land on a site that blocks my view with a modal cookie popup, I just push the back button and try another link. While my browsing behaviour might be less typical than just pressing "OK", I'm sure it's a statistic they are keeping an eye on. So while the dark pattern approach has merits to sites that want to track you, they must also be aware this is a balance. And a percentage of users will generally prefer to go to sites that leave them alone. That is: the cookie dialogue never widens the funnel.
  - csunbird 4y ago
    But, this behavior does not protect your privacy at all, because those websites already put tracking information in your cookies claiming that they fall into “Legitimate Interest”. You need to interact with the modal and claw your way into the hidden settings where you can disable “Legitimate Interest” toggles.
    - whstl 4y ago
      You are correct, but just some additional information: Those cookie banners are illegal under GDPR, btw. Real "Legitimate Interest" does not even require consent, and you can't claim that tracking or marketing is "legitimate interest". An example of legitimate interest is keeping your address in the records after a purchase, or storing a receipt for accounting reasons.
- joking 4y ago
  and they expectation is correct, I click whatever green button that i'm presented and expect that my combination of private browser sessions, different profilers and adblock extensions messes them enough. It sucks, I know, but the quantity of time people has loss with those banners, both on the client side and both on the developer side (even If is paid work that i did, I would have preferred to do anything more valuable) is enormous, and the culprits responsable of this should be taken to the courts, if not presented with a cumputer and sentenced to pass the rest of their lives clicking consent banners. I suppose that is a matter that strikes a chord with me.
karaterobot 4y ago
Compliant with GDPR doesn't seem to mean much. The comment I'm leaving now is compliant with GDPR. The question is, does it fulfill a cookie-using website's requirements under GDPR without additional UI? Wikipedia at least says it does not ("DNT is not widely adopted by the industry, with companies citing the lack of legal mandates for its use") https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
- orangeoxidation 4y ago
  > The question is, does it fulfill a cookie-using website's requirements under GDPR without additional UI It cannot. That's the whole point of the GDPR. It forbids tracking without informed, explicit user consent. Users cannot be informed or agree with the header setting. Sites can, of course, not track users, or not track users who set do not track. They don't want to, that's why they try to annoy and/or mislead anyone into agreeing with their horrible banners. (Using Cookies for site settings or even logins can be done without explicit consent and without banners)
  - alkonaut 4y ago
    The problem is that regulators were influenced by industry then. The proper regulation would have required that the default state be that users are shown no consent banners without explicit action and also not tracked.
    - illiarian 4y ago
      GDPR. Does not. Mandate. Browser. Or website. Cookies. Banners. Or UIs. In it's simplest form it says: if you want to collect more data than is required, you have to ask users for consent. This applies in equal measure to sites, banks, grocery stores, shopping malls, shit processing plants, nuclear reactors etc.
      - alkonaut 4y ago
        I'm. Fully. Aware. But there is a need for clarification here for the most often encountered consent case: web sites. Basically the regulation could say: you must have consent to collect data, but you must ALSO observe specific standardized method X of of blanket disallowing all consent in specific contexts. For example, "if do-not-track is used in a web browser, then the user should not be shown a consent dialog but instead provided the service as if they had rejected the consent dialog". I realize that regulators (for good reason!) are very reluctant to specify specific technologies. It's not their home turf, and it's likely to be quickly outdated. But I'm ready to accept that this would be a time when there is a good reason to make an exception to that rule.
jeroenhd 4y ago
I was pleasantly suprised to see websites like medium.com disable their embeds and seemingly their tracking scripts when you have DNT enabled. Most websites that use ads or (opt-out) tracking choose to ignore the header because there's no technical or legal reason why they can't.

mqus 4y ago

The problem is rather, that they didn't decide yet (e-privacy directive). The gdpr was meant to be general, it was designed to not have technical details because it applies to everything.

dmattia 4y ago
It's noteworthy that in the Sephora case for California the AG explicitly called out the Global Privacy Control (gpc) as something that companies need to honor. From https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement https://oag.ca.gov/news/press-releases/attorney-general-bont...: "“Technologies like the Global Privacy Control are a game changer for consumers looking to exercise their data privacy rights. But these rights are meaningless if businesses hide how they are using their customer's data and ignore requests to opt-out of its sale,” said Attorney General Bonta. “I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law. My office is watching, and we will hold you accountable."

jefftk 4y ago

It didn't help that no one could agree on what constituted 'tracking', and what activities should be skipped on receiving that header. This was supposed to be part of the DNT standardization process, but was too contentious.

kevviiinn 4y ago
How about simply "any cookies that aren't required for the service to function" Same cookies that get set by the annoying banner when you click through their BS to the "save my preferences" button
- YPPH 4y ago
  What if cookies which are required for a service to function are also used for tracking?
  - hackmiester 4y ago
    It looks like you have identified the workaround that a ton of sites are using to track even users who deny non-essential cookies.
    - _v7gu 4y ago
      Doing that is a clear GDPR violation
      - rendall 4y ago
        As an American living in Europe who supports the GDPR, I suspect that most of the violations are driven by American companies and these violations are in part ideological. The concept of a government sincerely passing a law that genuinely and competently protects the privacy of its individual citizens seems absurdly unlikely to many of us. Laws are not created for individuals except when a cynical politician wants votes from the gullible. Circumventing such a "stupid", "anti-business" law as the GDPR is almost an American duty.

pabs3 4y ago

And there was P3P before DNT: https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P

happymellon 4y ago

Observing the do not track would have fulfilled the EU requirement. You are falling into the trap that Americans normally do that think that the directive have anything to do with cookies or that the cookie banner was requested by the EU. The requirement is simply > You may not collect personal information without consent. If they have an obnoxious advertising and data harvesting cookie banner then that was a design decision to make you opt in.

janosd 4y ago
IANAL, but this is not entirely correct. For example, if you have server logs, that's processing personal information, most likely under GDPR Art. 6 lit 1f (legitimate interest). Under Art 13 the user must be informed of this. Because of the information requirement the Do-Not-Track is not enough unless you really, truly do not track any PII (which includes the IP address). Equally, this is incorrect: > You may not collect personal information without consent. There are a whole host of reasons listed in Art. 6 when you do not need consent.
- happymellon 4y ago
  I was answering in the context of the statement that the EU made this cookie banner mess and that the do not track header died because of the GDPR. I didn't feel that logs would be relevant in this case because you would log that the Do Not Track header was present. As a distilled version of the GDPR I still feel it hits the point.
  - illiarian 4y ago
    > that the EU made this cookie banner mess It didn't. Companies not willing to comply with GDPR did. As they didn't want to comply with Do Not Track header and used it for fingerprinting.
    - happymellon 4y ago
      Exactly this.

alkonaut 4y ago

There should have been a standardized way for a browser to respond in exactly the way that these plugins behave. Basically "allow only functional/minimum cookies, never anything else". Regulators of course should enforce the simple fact that this is also a requirement for anyone who dismisses a consent popup, has a browser setting that suppresses it, or even someone who clicks the biggest most obvious button - since all those actions (or non-actions) must result in "no consent".