7 ms·
Consent-O-Matic – automatically fills ubiquitous pop-ups with your preferences
- pcl 2y agoI’ve been using this for a couple years now, and absolutely love it. Thanks, team! I also love that it’s owned by the University of Aarhus, as I am more willing to trust academia with something that has a disturbing level of (client-side) access to my browsing data. I really wish the browser vendors would develop better permission models to guarantee my data can’t be exfiltrated by a malicious plugin (aka a once-good plugin that got bought out by a bad actor). For example, I’d love to see the browser impose a policy of “no outbound network requests except to pre-registered endpoints with pre-defined headers and data payloads”, so that plugins could fetch allow lists but could not exhilarate my browsing history.
- sciolistse 2y agowhile we're wishing for impossible things i'd also love if the consent dialogs were an actual standard. if sites could describe a list of what they needed consent for and the browser supplied the actual dialog, so i could just configure it to always allow all if i wanted to, that would be fantastic.
- paulryanrogers 2y agoOr even better a header to signal the wish to not be tracked. We could call it "Do Not Track", and enforce with laws.
- junto 2y ago[flagged]
- joshuaissac 2y ago> if the consent dialogs were an actual standard. if sites could describe a list of what they needed consent for and the browser supplied the actual dialog There is a standard for this called P3P, which was implemented by Netscape, Firefox, Internet Explorer and Microsoft Edge before eventually dropping support for it. But there was nothing requiring website owners to use it. Various data protection regulations across the world require them to obtain consent for collecting data, but they are not required to recognise consent or non-consent expressed via P3P settings. These standards will only get used if the website owners are forced to use them, either by regulators or by monopolistic/oligopolistic market forces. https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P
- buzer 2y agoAs far as I understand at least some businesses in California are required to honor GPC. https://oag.ca.gov/privacy/ccpa#collapse8b https://oag.ca.gov/privacy/ccpa#collapse8b > Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information.
- jitl 2y agoIt is very hard to prevent exfiltration by code that is allowed to write to the DOM in today’s browsers. There is Content Security Policy (csp) which applies to the whole page and sometimes governs scripts injected by extensions but not the extensions themselves. I would love to see browsers add a chain-of-custody to scripts and DOM nodes, so it is easy to tell which nodes were added/touched by a script, and if a script adds a script tag, that newly loaded script would show up as branches in the custody tree. Then we could say, “no nodes or scripts in this tree may trigger requests to unauthorized domains”. It would be sort of like CSP, but with a runtime-tracked implicit capability/taint for extensions.
- jraph 2y agoAdd some sort of signing process and call this Secure DOM.
- ronsor 2y agoNo, then people will mistakenly think it is 100% secure.
- whereismyacc 2y agoSecurer DOM.
- aristus 2y agoBrowser DOM Security Mechanism.
- xelamonster 2y agoI'd like to see a separation between read and write permissions to the DOM for plugins personally. I would feel much better if I didn't have to give any plugin that might need to modify parts of a limited set of pages the ability to silently manipulate anything and everything I see in the browser. Read-only access could be granted by default, then only when a plugin sees something it wants to act on it could pop up and request my approval before doing so. The current approximation of that by disabling the plugin globally and enabling it on specific pages is so clunky and adds so much extra friction that I don't ever bother with it.
- AgentOrange1234 2y agoThis sounds awesome! Thanks! It is very tiring to click through every single site.
- arduanika 2y agoGives a new meaning to "manufacturing consent"
- Cyberdog 2y agoI've been using the annoyingly-named superagent for a while for the same task, but it often seems to fail to detect some of these annoying boxes. I'll definitely give this alternative a try and see if it works any better. Thank you so very, very much to the EU and whatever other government agencies are responsible for making the web more annoying to use. https://super-agent.com/ https://super-agent.com/
- notpushkin 2y ago> Thank you so very, very much to the EU and whatever other government agencies are responsible for making the web more annoying to use. They didn’t make the web annoying – advertisers did. They were the ones who chose the most annoying way to comply with the laws.
- jitl 2y agoSure, for advertiser thingies. But website features like optionally storing your preferences in localStorage, or assigning device IDs to be able to understand and optimize website performance both require consent pop-ups.
- dzikimarian 2y agoPreferences and other things required for site to work do not require a consent.
- jitl 2y agoSome preferences are not required for the website to work, but do improve the experience. These are classified as "functional cookies", "preference cookies", or "user interface cookies" in ePrivacy Directive and UK GDPR literature, examples like remembering your selected language, and still require consent. See https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-we-comply-with-the-cookie-rules/#:~:text=For%20example%2C%20some,is%20already%20making https://ico.org.uk/for-organisations/direct-marketing-and-pr.... Consent-o-Matic uses this text to describe this category of cookies (for me, it's the first item in extension's config UI): > Preferences and Functionality: Allow sites to remember choices you make (such as your user name, language or the region you are located in) and provide enhanced, more personal features. For instance, these cookies can be used to remember your login details, changes you have made to text size, fonts and other parts of web pages that you can customize. They may also be used to provide services you have asked for such as watching a video or commenting on a blog. The information in these cookies is not used to track your browsing activity on other websites.
- orbisvicis 2y agoI believe ublock origin blocks these via the annoyances filters, but just the popup element without setting the cookie. I haven't really looked into it.
- bugtodiffer 2y agoYes of course without accepting the cookie. THis malicious compliance BS has to end. i won't do the 20 clicks I need to deselect legitimate interest everywhere... I'm just blocking your popup.
- pbmonster 2y agoIt blocks some of them, usually the most basic. I also seem to remember that by not answering those prompts (and hiding them instead), you actually consent until you decline. It absolutely can't block the more advanced, sometimes multi-stage prompts Google, Youtube, and many newspapers use. Consent-o-Matic actually goes through those prompts and declines the maximum possible amount of tracking, while consenting to the necessary options required to make the site work.
- Elinvynia 2y agoThat is false, you only consent by your explicit action - clicking "accept". If you inspect element and remove the consent popup entirely, you have not consented.
- sonium 2y agoI’d like the option to automatically choose the LEAST privacy conserving option, because 1. I don’t care 2. It should work better since it aligns with the goal of the site
- kevmo314 2y agoThe extension allows you to choose what settings you want.
- creshal 2y agoRegarding 2: That's the fun part! Manual consent isn't required for functional cookies, only for marketing garbage that doesn't help you at all.
- bhawks 2y agoWhat if the goal of the site is to monetize views so it is economically viable to produce content? Then GP's point towards 'it should work better' implies it works over the long-term and not a single interaction. I find ads frustrating as well, but it is a powerful monetization strategy and that doesn't have a substitute.
- alkonaut 2y agoThis comes up every time gdpr or ads are discussed. But it’s pretty simple I think: not enforcing privacy regulations forces site owners to break them. The reason is that so long as some sites show tracking ads, the monetization possible by privacy-friendly ads is almost nothing. The long term goal must be that no one cheats, so that ad the revenue from well-behaving advertising can go up. Remember the consent dialogs aren’t ever asking permission to show ads.
- xigoi 2y agoHot take: People who produce content with the goal of getting money should just do something else.
- troupo 2y ago
- seanhunter 2y agoI've been a very happy user of this plugin for some time and it works great for me. I'm always bewildered by how many cookie consent dialogs I see on my work browser which is locked down so doesn't have this plugin.
- beefnugs 2y agoSadly this is the wrong solution: proper solution is to create generic "get to the base information" solutions to get past all dark pattern bullshit. Trusting advertisers, web developers under coercion, annoying paywall based sites has been proven to be a bad choice over and over in history repeating itself hellscape. Firefox's "reader view" was the right idea, that doesn't quite go far enough. We need options like "i just want text, non ad pictures, and original videos". Any higher layers where we allow these brutal dark patterns are too much work to track and fix every little thing they can do with code
- TeMPOraL 2y ago> We need options like "i just want text, non ad pictures, and original videos". That's called an ad blocker. This is touching on the larger battle for control over user experience, that has been going on since the birth of the WWW. Most of the sites want you to see everything other than "text, non ad pictures, and original videos" - the latter is a bait and a vector to expose you to ads, dark patterns, and other marketing shenanigans. They'd serve you their page as a PDF if they could get away with. They almost did get away with Flash. They do get away with this with mobile apps. About the only thing stopping them from replacing websites with some ungodly mix of canvas, WebAssembly, and React-like frameworks, is accessibility[0]. Point I'm making is, it's not a PvE game, it's a PvP one. A beefed up Reader Mode is not a solution - try to build one, and half the industry will cry foul, and proceed to invent workarounds. The Web, as we know it today, is funded by the enemy. -- [0] - specifically, the legal requirements in some scenarios and jurisdictions, which create a sort of back pressure on the industry that keeps the web from full-blown appification.
- alkonaut 2y agoIt should be called Reject-O-matic or you might get the impression that it’s ever used to consent to anything…
- Drakim 2y agoWhile you aren't wrong, somebody might get the dumb idea that "If a tool instantly rejects the consent then the user hasn't truly consciously made a rejection." This is the flimsy excuse made not to respect the Do Not Track header. By making it so that it's a tool for expressing the user's opinion, be it negative or positive, it becomes harder to spin it as being a tool that does not actually embody the user's view.
- MereInterest 2y agoFor the GDPR, that argument would fail immediately. Since the GDPR requires consent to be explicitly granted, and neither conscious rejection nor automatic rejection would constitute an explicit granting of consent, the site would not have a consent to track.
- paulryanrogers 2y agoDNT could be mandated as a prompt instead of ever included by default. Or does the GDPR require explicit consent prompt and selection per domain?
- troupo 2y agoGDPR requires explicit informed consent for data not strictly required for the working of a <website|app|store|organization|anything> A user giving consent to <site|app...> A does not translate into consent for <site|app...>. And yes, the default for such consent questions must be "no"
- paulryanrogers 2y agoPerhaps I was unclear. IMO someone picking "sure fine everyone track me" when setting up browser (DNT preference) first time should count as explicit consent for every site. And similarly choosing DNT for all should legally count as telling site not to track and not to ever prompt.
- fifteen1506 2y agoGlobal Privacy Control should provide a global control that should work better than DNT ever did.
- j-bos 2y agoWould something like this prevent the Disney defense against wrongful death liability? https://news.ycombinator.com/item?id=41242400 https://news.ycombinator.com/item?id=41242400
- dns_snek 2y agoNot in this specific case, they agreed to those terms when signing up for a Disney+ account, this extension only helps with regular consent pop-ups. What would've helped is not signing up to Disney+ and pirating all of their content instead.
- account42 2y agoIs there even a Disney defense here? Lawyers can bring all kinds of arguments, what matters is if they are upheld. Note that in this case Disney didn't even own or operate the restaurant so it's questionable why they even are a defendant here.
- dns_snek 2y agoI love the idea but giving "root access" to an extension that's "not monitored for security" is a non-starter. I wish Mozilla would step in and do something good for a change.
- nottorp 2y agoWould you like an "ecosystem" where you can't publish anything that the gatekeeper doesn't like? I believe there's one over there <looks at Apple>.
- dns_snek 2y agoI don't like "ecosystems" where a gatekeeper decides what we can and can't do with our own devices, browsers, etc. That's different from a software repository guarding users against malicious updates, e.g. due to compromised extension publishing account. The blast radius on extensions with permissions like that is huge, they could steal all of our session cookies and login info, for example. My comment was a bit harsh, and that harshness wasn't aimed at authors of this extension. I'm merely asking Mozilla to be more proactive with extensions that are extremely security sensitive, but also further their own purported mission, like this one.
- Fethbita 2y agoCheck out this feature from Firefox then: https://bugzilla.mozilla.org/show_bug.cgi?id=1783015 https://bugzilla.mozilla.org/show_bug.cgi?id=1783015 Apparently can be turned on with the following: cookiebanners.service.mode = 1 cookiebanners.service.mode.privateBrowsing = 1 cookiebanners.ui.desktop.enabled = true
- mrtksn 2y agoThe tracking pop-ups used to be the scapegoat of UX but these days the experience is broken by "are you a robot" walls, subscribe to my blog walls, paywalls, your ip is from the wrong country walls, login walls and other all kind of wall. These days when I see a link to a news outlet or a blog that intend to consume seriously, I just use archive.is. It removes all the annoyances, it's brilliant.
- account42 2y ago... except when archive.is itself presents you with one of those walls because you are using a browser that is not the latest Chrome.
- k__ 2y agoBrave simply hides these popups. Works pretty well.
- aucisson_masque 2y ago'I still don't care about cookies' works on almsot every website I browse. This extension on the other hand used to work maybe on a third, don't know if it improved but I would suggest the first if you're fed up with the cookie popup.
- Refusing23 2y ago> 'I still don't care about cookies' if i recall this just closes the cookie popup but if you want some functionality you may need to accept some basic cookie like "remember me" for logging in, etc? this is what the extension is great for not sure if you can use both
- Double_a_92 2y agoThe problem is that it needs to be manually adapted to each side that doesn't have a well known cookie banner... So if you mostly visit "exotic" pages it doesn't work.
- account42 2y agoSites do not need to ask for consent for a login cookie or anything else that is strictily required to provide the asked for service.
- Macha 2y agoNote "I don't care about cookies" and "I still don't care about cookies" will accept tracking if that's the easiest route to get rid of the popup, which is a significant difference to the extension in this topic.
- aucisson_masque 2y agoI understand the shortcoming but to be fair, if a website owner wants to track you he can do it even without cookie. I appreciate the gdpr for many reasons but the cookie banner constant spam is not one of them, I believe people just want to get rid of it even if it means agreeing to everything.
- marsh_mellow 2y agoThis is great. Is there any work being done to make something similar part of the browser API?
- troupo 2y agoThere was the Do Not Track header that this great industry of ours immediately used to track users
- dspillett 2y agoI keep considering this and similar tools, but I have a concern that they will miss things and effectively opt-in when I want them to opt-out. For instance: if the code/config for a particular site or family of sites becomes out of date for a while due to said site(s) adding a bunch of “legitimate interest”¹ checkboxes, then I may have just given consent (or passed by the opportunity to object) without knowing. ---- [1] In other words “we see your preference not to be stalked by our partner(s), but fuck you and your preferences we want to let them anyway”.
- netsharc 2y agoI just came to the realization how ducked up things are, that right now every website view involves solving a stupid puzzle of toggles... that the privacy-conscious think might help them protect some of it, but I have a suspicion will do duck-all for said privacy anyway.
- londons_explore 2y agoI like this, but would like it to avoid the loading time of the consent popups. Too often, the consent dialogue takes over a second to load, and when you finally click 'accept' there is a little spinner for what seems like ages before the dialogue goes away and you get to see the content you came to see. Can we simply detect the "<script src=consent.js..." tag, and simply not load it for the most common and annoying types of popup?
- worble 2y agouBlock origin with the "annoyances" list blocks 90% of these I find
- weberer 2y ago1. Open the uBlock Origin dashboard in your browser (click the little gears icon) 2. Navigate to the "Filter Lists" tab 3. Scroll down to the "Cookie notices" section 4. Check the box that says "EasyList/uBO – Cookie Notices"
- MostlyStable 2y agoIn the case that the popup doesn't load/the user never makes a choice, what is the cookie behavior? How about if you hit the "x" button on the cookie popup instead of either "accept all" or "reject all"? My assumption is that, despite what the law says/is meant to do, doing anything than going through the checklist will result in all cookies being enabled.
- londons_explore 2y agoSince you'd probably do this for each of the big consent-popup-providers, you could simply have custom javascript for each which sends off the necessary ajax call to disable cookies in the background (although personally, I don't really care - if I wanted to disable cookies, I would do it client side. I trust the tech more than I trust their accurate following of the law)
- deleted 2y ago[deleted]
- turblety 2y agoI just installed it on Chrome, and it hasn't worked on a single site, but upvoting as I love the idea as horrible as the whole consent banner thing is :( For example bing.com, britishairways.com all show their consent popup. It does try and do that minimize thing, as something flashes to the bottom right. But the model still appears in the same place as always.
- willks 2y agoI've been using this on mobile for a couple of years now, I've noticed it failing in the way you mention quite often in the last 3 months or so. I'm not sure how maintained the rules are, they might need updating. Previously it was working nicely, although probably only on 40% or so of pages. I've also used ublock to block cookie consent popups, which catches more but occasionally has to be disabled as sometimes it will break scrolling or interaction with the page.
- ivann 2y agoI like this proposal to add a "purpose" field to the cookie header. This could allow consent settings at the browser level, preventing all these pop-ups. https://mailarchive.ietf.org/arch/msg/httpbisa/Mp-DjtBk-sfdQ8Bs7Y1vaEz67mw/ https://mailarchive.ietf.org/arch/msg/httpbisa/Mp-DjtBk-sfdQ...
- fanf2 2y agoI am sure it will be as successful as do-not-track.
- franga2000 2y agoThe problem isn't lack of a solution, we've had DNT for years. It's that the people who want to track you generally don't want to make it easy for you to opt out.
- ivann 2y agoYes, this will need legislative backing. We had the GDPR since the DNT. I also just discovered the GPC which seems more interesting: https://globalprivacycontrol.org https://globalprivacycontrol.org
- bradleyy 2y agoActually, GPC support is required in CPRA. CPRA, if you're not familiar, is the California privacy law.
- xnorswap 2y agoAnd they will mark all the advertising cookies as "Legitimate interest", as they've already started to do that with the confirmation prompts. The "legitimate interest" of selling you shit you don't want and selling your interests to third parties.
- ivann 2y agoWould this get past the GDPR? I get the defeatism, there are powerful actors, but it doesn't mean we shouldn't try to improve the situation.
- laborat 2y agoTHANK YOU for letting us know that this exists
- sgc 2y agoWith how aggressive websites are in shoving popups down our throats for every little random thing, we need an in-browser AI bot to get rid of them appropriately. It's leaking too. I got a popup on my keyboard on my phone yesterday, and literally thought "this is too much, I wish I was dead" (I'm doing fine, just an intrusive thought :). Time to dial it back in folks. It is unbearable.
- iwontberude 2y agoTo those of us with ADHD this firehose of notifications and distractions feels like a deliberate attack on our agency. It does make me feel like I want to die, not because I’m depressed or suicidal generally but because I can’t imagine aging gracefully with this escalating source of entropy.
- fuzzy_biscuit 2y agoThis is precisely why I'm sidling up to the idea of an old flip phone. The deluge of "communication" that is force-injected into my eyes every day is an immense waste of my mental energy. I hate this age of attention assault.
- zelphirkalt 2y agoMay I suggest a well configured uBlock Origin and additionally to cut out some websites completely from your life? Doesn't solve the problem in general, but it will hopefully make you feel better. And it will make your browsing faster, because you are not loading all that crap.
- sgc 2y agoI had the thought for much the same reason. It amounts to a denial of service attack on the human psyche. There are places with laws about advertising pollution in public spaces. That needs to extend beyond advertising to a more general set of aggressive attention grabbing features, and to our digital lives, where we spend a huge amount of our time. It's not going to self-regulate. Ironically, the ubiquitous GDPR popups sort of broke a dam that have led to popups of all sorts being forced on us all over the place.
- alok-g 2y agoAsking genuinely as I never experimented myself -- Does the Internet experience in general cripple if one rejects the cookies on all websites? Or there is very little loss of functionality? I often allow 'essential cookies'. Would go to 'reject all' if that works fine.
- gleenn 2y agoI reject-all as often as possible and they just make me log in more.
- 1oooqooq 2y agoGiven that the average person visits a site once. No.
- Double_a_92 2y agoNot really. You might need to login everytime, or on shops you will lose your cart.
- nani8ot 2y agoStoring login tokens and cart information falls under "legitimate interest", which does not need consent. They just aren't allowed to use that information to do anything else with it. I've rejected all optional cookies/tracking for many years and I've never noticed any missing functionality.
- dredmorbius 2y agoFor years my own practice on sites that impose cookie pop-ups has been: - Zap that element (uBo element zapper or custom CSS style rule via Stylus). - Globally deny ALL cookies for that site, via uMatrix. Note that uMatrix (and AFAIU Fireox) already block all third party cookies. This just makes that prejudice global to the site itself. The number of sites for which I require some level of state preservation is parlous few. Hacker News itself is most of them, my Fediverse home the other. (I largely don't use the Internet for commerce. That's always struck me as a bad idea, getting worse. If I cared ... another very small number of exceptions would deal with that.)
- jmorenoamor 2y agoWe should kill cookies once and for all. Put on a scale what we gain and what we loose, and just let it sit.
- account42 2y agoCookies are a tool, this is like saying we should ban knives because they can be used to stab people. Login sessions is one thing that cookies solve well - we'd have to go back to session IDs in URLs with all the problems that causes. ... which also shows that cookies are not the problem because you can track users using an infinite number of different ways. Now stricter enforcement of consent laws as well as regulating in which ways consent can be asked for, that would make sense.
- zelphirkalt 2y agoWith GDPR conform cookie consent popups/banners, managing ones preferences is actually very easy. First time visiting a website just click decline and all is good. Unless of course we are talking about websites, which only pretend to be conforming, but are actually intentionally not. I say intentionally, because it is way more likely, than everyone responsible at a company having lived under a rock for the last ... what? 10 years now? ... and not actually knowing better. Nope, we have widespread shameless blatant violation of the law at our hands.
- cbeach 2y agoOn my pension provider's website I get the cookie consent warning every time I visit (whether I decline or accept). Even more annoyingly, this happens in the iOS app of the provider (which has a webview). EU regulations like this are so poorly thought-out. They should have just banned nefarious tracking cookies outright. The EU never seems to understand the practical consequences of their technical regulation.
- layer8 2y agoHow does this compare to the similar functionality in Ghostery?
- WesolyKubeczek 2y agoA very nice extension, but mobile Safari is a pig and somehow it fails to close the popup on roughly half of the sites I visit. :-(
- more_corn 2y agoShouldn’t this just be called “no”? Or “I do not consent”? Anyone who cares enough to automate this will disable all optional cookies. Also, don’t we all think the law should have simply required websites to respect the browser setting for this instead of requiring it every goddamned time?
- CalRobert 2y agoThe law states all of this should be opt-in. Website operators just ignore it.
- arendtio 2y agoI wonder how many websites declare the Google Tag Manager a technical necessity (as part of the consent layers). In my world, it is a tool to manage different tracking and ad tools, far from being technically necessary to host a website.
- CalRobert 2y agoWorth noting that GDPR says all this crap is opt-in anyway, and everyone is just breaking the law. But the law isn't enforced :-(.
- mrgreenfur 2y agoHopefully this is handled in the upcoming eprivacy regulation that intends to move the opt-in choices from individual websites to the browser: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52017PC0010 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52...
- rlt 2y agoAnd hopefully the EU has learned a valuable lesson. Not holding my breath, though.
- riedel 2y agoThe upcoming e-privacy directive will most certainly solve all problems, except that it remains to be just that: upcoming for years
- xelamonster 2y agoSure, if we're really lucky that'll be implemented before 2030 and maybe a handful of us will still be alive to see the day most of the mainstream web actually gets rid of all their obnoxious dialogs :) It is great to see but I'm also happy if we can have even half a solution like this in the meantime.
- quitit 2y agoThe entire thing has been performative regulation. Did asking honest businesses to restrict how they use cookies protect users from invasive tracking? Nope. Data brokers simply employed other methods or bent the "legitimate interest" exception. Did all websites provide a single button to reject tracking, with equal prominence and proximity to the accept button? Years on this is still rare, despite being the rule. Did data brokers find new ways to obtain the same data? Sure did and more. Was the end result a disproportionate burden on users, including those not even in the EU, while not delivering the intended benefit. Sure is. Do entire websites, particularly those in the USA, simply geo-block all EU countries. Yep. Did European-based services and news websites switch to a "let us track you or pay now" model. Yes. Did data brokers exploit the EU's inability to police the matter by incorporating dark patterns, artificial pauses, and obnoxiously long lists to stymmie user's attempts at refusing tracking? Yep. Did bad actors ignore the regulations. Yep. Was the EU toothless to stop that? Also yes. So what did happen? Instead developers of web browsers incorporated anti-fingerprinting technologies to negate the problem, a part of browser development that continues to be an on-going arms race.
- junto 2y agoI increasingly just reject all cookies and it doesn’t seem to make much difference on the vast majority of websites I’ve simply said no to.