6 ms·

Dear W3C and browsers – Please fix cookie consent

6 points by dmonefs 2y ago

it's 2024 - come on, can we please stop with the stupid cookie consent popups. Could set and forget your preferences in the browser - and have a prefers-cookie-consent type feature or API? I know there are all kind of browser extensions but it's time for a proper fix - unless there is already?

moritzwarhier 2y ago
Maybe we should use a standardized HTTP header informing of the user preference! Something like "Definitely No Tracking "
- dmonefs 2y ago
  100%
slater 2y ago
I remember when there was a browser pref to ask for permission to set cookies. That got removed because you'd visit a site, and got blasted with 500 "Allow bla-282.adserver-whatever.net to set a cookie? Y/N" windows. -- Firefox seems to be working on dealing with the consent stuff: https://support.mozilla.org/en-US/kb/cookie-banner-reduction https://support.mozilla.org/en-US/kb/cookie-banner-reduction HN discussion: https://news.ycombinator.com/item?id=38856515 https://news.ycombinator.com/item?id=38856515
Grimeton 2y ago
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1374-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Have fun.
- dmonefs 2y ago
  I only see Article 7 and 8 re Consent - as long as the consent is freely given, specific, informed, and unambiguous - it should meet the requirement.
  - Grimeton 2y ago
    >I only see Article 7 and 8 re Consent - as long as the consent is freely given, specific, informed, and unambiguous - it should meet the requirement. Just a theory: Could a "****COOKIE CONSENT POPUP*****" be one of the ways to give said consent? Btw: I have seen websites showing you a message that they configured everything to your liking after sending them a "Do Not Track" HTTP-header. So the option is clearly there...
detaro 2y ago
DNT header exists. Websites collectively have decided they don't care, they'd rather annoy users. That + the design of the average cookie banner should tell you all you need to know how likely a technical solution is in the face of businesses explicitly not wanting you to have a comfortable time declining. (Some blame on the member states, they'd IMHO show less tolerance for this kind of thing)
- moritzwarhier 2y ago
  Wholeheartedly agree, but it also seems like kind of an inevitable failure, because users/browsers often had DNT set by default, and who would decide to click the "more tracking" option when they have a choice to set that option persistently and with feature parity. All boils down to economic issues that are not solvable with technology.
solardev 2y ago
Never attribute to incompetence what could be attributed to advertisers. Websites make cookie banners obnoxious on purpose so you'll just try to click through them and accept all the trackers. That is by design, not accident. What you're asking for isn't a browser issue, it's that advertisers and website owners don't want you to see their content without making money off you.
- Doxin 2y ago
  In fact, having a browser-wide cookie consent setting was tried. The "do not track" header. After a while browsers turned it on by default because who in their right mind wants to be tracked. Advertisers then decided that the do not track header was not a valid representation of user intent, so they started to simply ignore the do not track header -- insofar as they hadn't been ignoring it already. The EU then decided that no, you actually do need explicit user permission to track them. Advertisers, as they are known to do, promptly reached for the malicious compliance toolkit and started adding ever more annoying cookie banners and popups. Most of which are not even legal under previously mentioned EU decision. Turns out advertisers have a hard time with the concept of "consent, freely given."

6 points by dmonefs 2y ago

moritzwarhier 2y ago

Maybe we should use a standardized HTTP header informing of the user preference! Something like "Definitely No Tracking "

dmonefs 2y ago
100%

slater 2y ago

I remember when there was a browser pref to ask for permission to set cookies. That got removed because you'd visit a site, and got blasted with 500 "Allow bla-282.adserver-whatever.net to set a cookie? Y/N" windows. -- Firefox seems to be working on dealing with the consent stuff: https://support.mozilla.org/en-US/kb/cookie-banner-reduction https://support.mozilla.org/en-US/kb/cookie-banner-reduction HN discussion: https://news.ycombinator.com/item?id=38856515 https://news.ycombinator.com/item?id=38856515

Grimeton 2y ago

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1374-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Have fun.

dmonefs 2y ago
I only see Article 7 and 8 re Consent - as long as the consent is freely given, specific, informed, and unambiguous - it should meet the requirement.
- Grimeton 2y ago
  >I only see Article 7 and 8 re Consent - as long as the consent is freely given, specific, informed, and unambiguous - it should meet the requirement. Just a theory: Could a "****COOKIE CONSENT POPUP*****" be one of the ways to give said consent? Btw: I have seen websites showing you a message that they configured everything to your liking after sending them a "Do Not Track" HTTP-header. So the option is clearly there...

detaro 2y ago

DNT header exists. Websites collectively have decided they don't care, they'd rather annoy users. That + the design of the average cookie banner should tell you all you need to know how likely a technical solution is in the face of businesses explicitly not wanting you to have a comfortable time declining. (Some blame on the member states, they'd IMHO show less tolerance for this kind of thing)

moritzwarhier 2y ago
Wholeheartedly agree, but it also seems like kind of an inevitable failure, because users/browsers often had DNT set by default, and who would decide to click the "more tracking" option when they have a choice to set that option persistently and with feature parity. All boils down to economic issues that are not solvable with technology.

solardev 2y ago

Never attribute to incompetence what could be attributed to advertisers. Websites make cookie banners obnoxious on purpose so you'll just try to click through them and accept all the trackers. That is by design, not accident. What you're asking for isn't a browser issue, it's that advertisers and website owners don't want you to see their content without making money off you.

Doxin 2y ago
In fact, having a browser-wide cookie consent setting was tried. The "do not track" header. After a while browsers turned it on by default because who in their right mind wants to be tracked. Advertisers then decided that the do not track header was not a valid representation of user intent, so they started to simply ignore the do not track header -- insofar as they hadn't been ignoring it already. The EU then decided that no, you actually do need explicit user permission to track them. Advertisers, as they are known to do, promptly reached for the malicious compliance toolkit and started adding ever more annoying cookie banners and popups. Most of which are not even legal under previously mentioned EU decision. Turns out advertisers have a hard time with the concept of "consent, freely given."