20 ms·
Firefox may soon reject Cookie prompts automatically
- retrac 3y agoI still smile sometimes at the pop-ups. I mean, you can try and store a cookie. I'm still gonna automatically delete it in a few minutes. This never needed a legal solution in this form. Browsers should just not accept cookies, unless the user explicitly wants something stored on their device. That might have been better to legislate. Software on a user's device should not store or enable tracking by remote services, without disclaimer.
- PeterisP 3y agoRejection is required to ensure that for functionally required cookies (e.g. session cookies when logged in) you refuse permission to use them for any other purpose, and that you refuse permission to use any of the many non-cookie tracking methods.
- sonium 3y agoAFAIK it’s not actually about cookies but a website tracking you by any technical means. Could be your IP or user agent as well
- eternityforest 3y agoThat would also be terrible to legislate. Browsers for privacy conscious people should offer it as an option, it's a non-issue for everyone else. If the government wants to get involved they can make public service announcements and try to convince people to care.
- anonymous_sorry 3y agoWith a purely client-side solution how do you stop a company using the same identifying token for basic session management and invasive tracking/data gathering?
- ZiiS 3y agoTracking a single session doesn't really worry me and I seriously doubt any law will stop it. What we want to do is prevent them correlating two sessions. With FF in full defensive mode. No canvas, restricted JS, deleted cookies I can at least make it hard for them.
- andrepd 3y agoExactly. Cookie autodelete (remove cookies when all tabs from a domain are closed) + I don't care about cookies (remove the popups).
- DelightOne 3y agoBut.. what if it asks to allow tracking based on your internet provider? Then the provider delivers who you are automatically instead of anything you control.
- circuit10 3y agoAs far as I know the law only applies to tracking cookies, I’m not sure if the browser can distinguish those from normal ones so it has be done via the law. Asking for consent for any kind of cookie whatsoever would be a bit much
- musicale 3y agoTracking probably won't go away if you remove client side cookies - it will just move server side (think a new server-side google analytics) and to more aggressive client fingerprinting. Is that the best outcome?
- taftster 3y agoI mean, I am pretty sure (have seen first hand) that this already happens regardless of whether client cookies are enabled. There's so many other (good?) ways to track users beyond just a cookie.
- JohnFen 3y ago> Browsers should just not accept cookies Most (all?) browsers I've ever seen have a setting that makes them reject all cookies.
- Symbiote 3y agoBrowsers explicitly asked permission to allow a cookie back in the 1990s. I'd guess around 1996-7 that changed to automatically accepting them.
- basisword 3y agoThe irony that I have to click through one of the ultra-shitty agree/learn more cookie popups just to read this article. Maybe if GHacks didn't comply with the legislation in such a user hostile manner, browser developers wouldn't have to waste time on such features.
- marcosdumay 3y agoAn outright dishonest cookie prompt, where "reject" or "manage choices" aren't even shown on the first screen. I imagine the company behind this site is hosted at the US. There are not many places one can still do this.
- sva_ 3y agoMost of the big German news sites require you to either accept ads, or pay for a subscription. It is sadly perfectly legal afaik. Nobody is entitled to your content without agreeing to some terms. Luckily, archive.is works very well. Wish there were more alternatives.
- rcMgD2BwE72F 3y ago>It is sadly perfectly legal afaik. No it isn't.
- solarkraft 3y agoI also read that it's legal, but can't see how it's in the spirit of the law.
- guitarbill 3y agoNon-targeted ads are fine from a privacy perspective/GDPR
- math_dandy 3y agoHow do they make you accept ads? Do they sniff ad blockers or something? And is this “ads or pay” dichotomy related to cookie modals?
- harel 3y agoI hate those cookie prompts so much I get Cookie Rage every time they appear. I rather be tracked from here to infinity than see another cookie prompt in a site i approved yesterday.
- c7DJTLrn 3y agoI'm beyond Cookie Rage. I'm into Cookie Despair, maybe even Cookie Depression.
- frereubu 3y agoYou're almost there. The five stages of cookie despair: Denial, Anger, Bargaining, Depression, Acceptance. (https://en.wikipedia.org/wiki/Five_stages_of_grief https://en.wikipedia.org/wiki/Five_stages_of_grief in case the reference is too niche)
- suralind 3y agothere's a chrome extension which I think is called "I don't care about cookies" :)
- Quarrel 3y agoWhich was bought by Avast, so lots of people switched to the forked open version [1] (thank you GPL). [1] https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies
- 3y ago
- eternityforest 3y agoThere's no auto-accept feature? I still wouldn't use it, or Firefox, because that kind of automated interaction seems unreliable, but I really don't want auto- reject breaking stuff.
- marssaxman 3y agoI never accept or reject cookie banners - I just delete them, using uBlock Origin. This works out fine, basically all the time, so far as my experience goes.
- pmontra 3y agoI also use NoScript. The cookie banner of ghacks didn't show either because I uBlocked it time ago or because it was displayed by a script that didn't run.
- stonogo 3y agoThe law that triggered these banners already mandates that the website may not reduce functionality if the user rejects the cookies. Functionality-tied cookies are already exempted from the acceptance requirement. These banners are the most-user-hostile possible response to the law, so it makes sense to automate getting rid of them.
- eternityforest 3y agoNot everyone actually follows the law though, sometimes they mix in essential cookies and you have to click through a bunch of layers to turn them off without turning off essential ones. I wouldn't be surprised if they find some way to defeat this in a not quite legal way and break stuff for people who use it.
- mminer237 3y agoThat's not true. Directive 2002/58/EC explicitly says that it's fine to condition use of websites upon acceptance of cookies: > Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose. https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML#:~:text=access%20to%20specific%20website%20content%20may%20still%20be%20made%20conditional%20on%20the%20well-informed%20acceptance%20of%20a%20cookie%20or%20similar%20device%2C%20if%20it%20is%20used%20for%20a%20legitimate%20purpose https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX....
- dariosalvi78 3y agoI use stardust cookie cutter: https://www.stardustnetwork.com/ https://www.stardustnetwork.com/
- ximm 3y ago> Certain regulations, like the GDPR, the General Data Protection Regulation, by the European Union, require that sites get consent for placing cookies and data on user devices. Well, that is bullshit. GDPR requires that you have some form of legal basis for storing cookies. Consent is the last ditch effort if you were not able to find any other justification. So by nearly by definition, denying that consent is in the user's interest. I think there is some other EU regulation that requires cookie banners. But don't blame it on the GDPR!
- progval 3y ago> GDPR requires that you have some form of legal basis for storing cookies. Not even that. It requires a legal basis for storing and processing personal data.
- ragebol 3y agoThe cookie dialog must be there in case you want to do cracking cookies. If you don't place the tracking cookies, no need for a dialog IIRC. But most sites didn't get the hint of "just don't track" and still want to track you.
- phendrenad2 3y agoNo they get the hint, but the users who accept tracking are subsidizing the site for everyone else.
- focusedone 3y agohttps://github.com/cavi-au/Consent-O-Matic https://github.com/cavi-au/Consent-O-Matic - this has worked well for me. It'll be nice when similar functionality is built in.
- WhereIsTheTruth 3y agoI'm pretty sure this is against GDPR, it requires explicit choice from the user Users should decide themselves what to filter, so the bad actors with aggressive cookie policy gets automatically filtered out over time I was looking for a recipe last time, I googled what I wanted, clicked the 1st link, bunch of popups for cookie/ad, I immediately hit "previous page" then I checked the next link, I bookmarked the one without fuss
- rektide 3y agoMy choice as a user is that it's all bad, all of it is no good, no one gets any cookies. Firefox as a user-agent is mirroring me-the-user's choice. Admittedly that doesn't hold for every user. Some users might make other choices.
- deleted 3y ago[deleted]
- crote 3y agoIt is not. The GDPR requires websites to obtain explicit consent to misuse your data. The default state is an absence of consent, so such an addon doesn't change anything.
- WhereIsTheTruth 3y agoI will have to read the whole thing again, it's been a while..
- scarface74 3y agoIt’s easy reading. It’s only 99 sections and 11 chapters.
- PaulHoule 3y agoEurope should have just mandated Do-not-Track, what they did was a billion dollar mistake.
- musicale 3y agoLegal requirements are probably the only way to handle server side tracking, data brokers, etc.. Though they might be hard to enforce.
- josefx 3y agoNot honoring "do-not-track" isn't as visible. Sure a site could just do the bare minimum to look like it upholds the law while breaking it, but instead we got tons of user hostile dark pattern filed dialogs that outright screamed "look at us, we are violating the law".
- Deukhoofd 3y agoThe EU is planning to do just that. The new ePrivacy Regulation is currently in trilogue negotiations, and should go into force between later this year and 2025. > the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors. https://digital-strategy.ec.europa.eu/en/policies/eprivacy-regulation https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r...
- scarface74 3y agoYes I’m sure the EU’s answer to an over complicated 99 section 11 chapter law - passing yet another law - will work out really well this time.
- Moldoteck 3y agoUhm, yes it will? At least that's how laws work no? You make a law, spot problems and adapt it. While(true) I'm really happy gdpr exists, it just needs more polishing to be user friendly
- musicale 3y agoGreat, now I just want a preference for [X] NO, I do not want to subscribe to your newsletter
- kytazo 3y agoHonestly those are more like gimmicks from an advanced user standpoint as the I still don't care about cookies extension does the job just fine as far as I'm concerned, and while this may indeed make a good headline or feature I think development may lack emphasis on the core of firefox and what makes it a good browser. There is much more fundamental and core functionality missing which has been requested for years like this for example https://bugzilla.mozilla.org/show_bug.cgi?id=1325692 https://bugzilla.mozilla.org/show_bug.cgi?id=1325692 In general it would be good having such functionality built-in, I guess they're gonna have to maintain it as well. All and all, I'm glad to see any kind of progress on the browser and in any case wish them the very best.
- nine_k 3y agoAdvanced users are already well-served; it's not for them. Also, the mobile version may have limitations on extensions.
- deleted 3y ago[deleted]
- retrocryptid 3y agocool. stack exchange might become useful again.
- kevin_thibedeau 3y agoThere's always tracking via the googleapis.com domain which breaks the site if you try to block it.
- JohnFen 3y agoI block that domain. It does break some sites (and good riddance to them), but for the most part it poses no real problem.
- aziaziazi 3y agoThings may changes “soon” in the legislation > the absence of any option for refusing/rejecting/not consenting cookies at the same level as the one provided for accepting their storage constitutes a breach of the legislation [0] GO Europe GO ! [0] https://www.cnil.fr/en/edpb-adopts-final-report-outcome-cookie-banner-task-force https://www.cnil.fr/en/edpb-adopts-final-report-outcome-cook...
- jonplackett 3y agoHow did they not include this to begin with? It’s so obvious as to be poking you in the eye that this would be necessary. How many cumulative wasted hours have been spent tapping through cookie pop ups? I made a game about it if you feel like wasting even more of your precious life on pop ups. http://termsandconditions.game http://termsandconditions.game
- rlpb 3y agoIt was included. The rule hasn't been changed. The interpretation of the rule in one specific case has been confirmed, without having changed the rule. That means that, as written, this dark pattern was always illegal.
- zeven7 3y ago> How many cumulative wasted hours have been spent tapping through cookie pop ups? Maybe not quite as privacy conscious, but a quick workaround: (1) Open in incognito (2) Click big, easy to find "Accept" button
- pornel 3y agoNote that "cookie" popups are about tracking, not cookies. If you agree in incognito, they might fingerprint your browser and track you outside of incognito too, since you've agreed.
- hutzlibu 3y agoThanks for that. This game should probably be mandatory, for anyone involved with the cookie legislation. If they succed, they may propose a new draft.
- stickfigure 3y agoI want my browser to send a header: X-I-Dont-Give-A-Fuck-About-Cookies: true ...and let the world wide web stop torturing me. I have a nice button that clears cookies and websites can't do anything about it. This whole dance is stupid.
- NelsonMinar 3y agoadd it to the list with DNT: 1
- rwalle 3y ago...which will make it easier to websites to identify and track you.
- olalonde 3y agoI honestly don't mind. The popups have a far more negative impact on my life. If I actually mind, which is very rare, I just open an Incognito window.
- quicklime 3y agoWe used to have a header for this but the tracking companies refused to play ball. DNT: 0
- phendrenad2 3y agoI honestly appreciate this bit of twisted propaganda. It's like you put up a barbed-wire fence with a gate in it, and people objected to the barbed-wire fence, so you put up a 1meter brick wall that people have to climb over. Whenever people complain about the wall, you say "Hey, the fence had a gate in it! But nobody wanted to play ball..."
- Dylan16807 3y agoWho put up the fence and who are the people in this analogy? I'm really confused. It was the tracking advertisers who wouldn't play ball, so are you saying people are unfairly putting barriers in the way of tracking advertisers?
- EGreg 3y agoI don't get it. So everyone will simply opt out of cookies automatically, and no more first-party cookies will be allowed? What about localStorage? I just don't understand how people are supposed to maintain an account with a site, without this stuff. Maybe using WebAuthn? Or what?
- throwawaaarrgh 3y agowhy didn't the law prescribe an API for the cookie updates to begin with? it could have been a first class feature of the browser, and then maybe it would actually be used as intended.
- RoyGBivCap 3y agoReading a lot of really good, insightful comments in this thread I have come to this conclusion: It's just another arms race. Like spam, CAPTCHAs, user engagement, and ads. There is no permanent solution and there cannot be because there are innovative humans (and now their ML tools) on both sides of it. All "good" solutions will be temporary, and laws are only as good as their enforcement.
- snickerbockers 3y agoHonest question: why is cookie management done by the sites instead of the browser? There's something wrong with the way this is all designed if we're relying on the websites, which have an obvious conflict of interest, to manage which cookies are necessary and which are frivolous.
- xmodem 3y agoI mean, you can turn cookies off in your browser settings, but the browser doesn't have a good way to differentiate between a cookie that keeps you logged into something and a cookie that tracks you to show ads.
- saurik 3y agoSure, but the vast majority of websites where I see these cookie prompts aren't even websites I'm logging in to in the first place... often they are websites I am not sure you can even log into at all. I get that if I want some kind of fine-grained cookie handling for websites that are legitimately using cookies for something I need to rely on them, but that initial "do I want this site to get cookies at all?" is almost always "no" and I should not have to rely on them for it.
- xmodem 3y agoYeah, it would be nice if I could quickly and easily toggle cookies (and local storage, etc) on/off per site.
- stanleydrew 3y agoThis is pretty "easy" in Chrome, at least for a definition of "easy" that I'm comfortable with. For more than ten years I've had all cookies turned off by default in Chrome's site settings, and I click two buttons when visiting a site if I want to allow it to store data on my machine. That allowlist is persistent so I don't have to think about it again.
- Vinnl 3y ago
- kazinator 3y agoIt's all so silly. The simplest solution would be to have a standard cookie (and/or API in javascript) that everyone can access which declares your preferences. Instead we have these multiple rounds of complexity.
- deleted 3y ago[deleted]
- unconed 3y agoClicking "reject all" isn't sufficient though. In many cases you need to go into some sub-tab and click "object all" to legitimate interest, or even uncheck a bunch of individual checkboxes that default to on. This is applied for purposes such as "build a personalized profile", "show personalized content" and "show targeted ads" so I have no idea what the cookie dialog is supposed to prevent anymore... clearly the original purpose has been rules lawyered into oblivion by amoral scumbags. But if they don't handle this, they're just going to blindly opt people into a bunch of stuff you'd expect to be opted out of.
- thwarted 3y agoP3P was ahead of its time. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P
- zadler 3y agoThis whole thing is so fucking stupid. The website should ask your browser should ask for permission to store cookies beyond the length of the session as it asks for your location / camera access.
- jrmg 3y agoThis seems similar to the ‘Hush’ extension for Safari: https://oblador.github.io/hush/ https://oblador.github.io/hush/
- muyuu 3y agoBrave does this IIRC since October 2022 it's since recently also blocking "use our app" nagboxes in mobile
- granoIacowboy 3y agoThis. What is slowing Brave's adoption?
- granoIacowboy 3y agoAs muyuu said, Brave has been on this for quite a while. Why is it not a more popular browser with infosec-focused people? I'm certain I'm missing something.
- PaulHoule 3y agoEvery other browser will be forced to catch up or lose market share.
- soraminazuki 3y agoCool feature, but is it necessary to interact with cookie prompts at all? I feel that simply blocking the tracking and the cookie prompts seem like the best solution here.
- benced 3y agoFirefox could send each site a UID, my home address, and my phone number and it would enrage me less than the prompts everywhere.
- rcMgD2BwE72F 3y ago>it would enrage me less than the prompts everywhere. The advertising industry won with their prompts, then.
- dcow 3y agoOkay so what if I actually want cookies? I notice Firefox’s feature will reject cookies. But I am so sick of having to log in to websites every 15 minutes because the site forgot who I am or otherwise running into silly bugs because nobody tested the site with cookies turned off. I honest to god just want to go back to the internet before GDPR and want to tell Firefox to just allow all cookies rather than reject. I care about privacy but I don't think cookie consent is the solution. I think the solution lies in somewhere in the realm of legally limiting the ability to profit off of the sale of collected data or even collect data without my consent. I don’t care if snazzy.app wants to collect product analytics and marketing data when I’m on their site. I consent to that by navigating to snazzy.app. I do care if snazzy.app embeds cambridge-analytica.js, though. And cookie consent banners simply don't address this nuance. What we need is control over where the data goes and if it crosses property/origin boundaries.
- xigoi 3y agoThis is about tracking cookies, not about login cookies.
- imiric 3y agoAll this focus on cookies is entirely missing the point of regulating user tracking online. Adtech is ten steps ahead of this, and can track users whether they accept cookies or not. It's an illusion of choice that muddies the discussion of topics that really matter. There should be more congressional hearings of adtech representatives, with legislators who are technically equipped to grill them on all details of their business, and how it affects the population. Unfortunately, given how most legislators are technically illiterate at best, and financially corrupt at worst, nothing of value for the people has so far resulted from these hearings. I'm hoping that in the coming decades, as younger generations get in government, this will improve. We really need much stronger regulation for Big Tech, just like we have for Big Tobacco, Oil, Pharma, et al. Hopefully this will come sooner than the point when the harms from its long-term effects are fully understood.
- SergeAx 3y agoThis whole thing is not about cookies, it is about extracting value from a website users. If a website has only necessary functional cookies - it is not obliged to get a user's consent. So if you see a cookie consent popup - it is 100% website trying to persuade you into giving away some of you rights. Recently I developed a habit to just close the tab with those annoyances (including the one this thred linked to).
- Reason077 3y agoFirefox developers, you will be my heroes forever if you pull this off! Cookie pop-ups are the scourge of the internet.
- OrangeMusic 3y agoHonestly I've been using the "I don't care about cookies" extension for several years now, and I can't live without it (same with an ad blocker). I've even switched from Chrome to Kiwi Browser on my Android (it's a Chromium flavor that support extensions), just for that purpose.
- Reason077 3y agoThanks for the tip. Apparently, "I don't care about cookies" has been bought out by the spyware vendor Avast, so people don't trust it anymore. There's now a de-bloated open-source fork "I still don't care about cookies" instead.
- jokoon 3y agoUblock can do this with an option
- millerm 3y agoAnd I get a nice big cookie prompt when I open up that site. The web is broken. And it follows the dark pattern approach. I’m not even gonna read it. Blacklisted.
- trizuz 3y ago[dead]
- butz 3y agoIronically the linked article shows content blocking modal without easily available option to reject all cookies. Go Firefox! All this cookie banner nonsense could have been solved years ago by implementing a simple standard of setting your privacy preferences right in the browser.