5 ms·

As someone who has helped build one of those cookie banners, I will admit that using cookies to store the state of what you consented to is somewhat ironic, or

As someone who has helped build one of those cookie banners, I will admit that using cookies to store the state of what you consented to is somewhat ironic, or at least meta. It's got some really interesting parts though: serving those banners, geolocated (show the right thing for the legal regime you're in) at actual "web scale lol". And while folks hate them, we respect the GPC signal, and then won't show you the banner, just opt you out of everything.

bradleyy 2y ago
It may not have been clear: I work for a SAAS company that sells a "cookie banner", or more properly, consent management; it's quite a bit more complex than just managing cookies. Actually, if you're managing cookies, you've already lost.
lapcat 2y ago
> using cookies to store the state of what you consented to is somewhat ironic, or at least meta. It's a nightmare for anyone who uses private windows.
- bradleyy 2y ago
  The alternative would be something like "making you log in to save cookie preferences". There are legitimate reasons to do this, but most would oppose it. Would you provide some market feedback? Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? Note: this is actually a problem I'm thinking about, and really do want to find a workable solution.
  - lapcat 2y ago
    > Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? The fundamental problem is that 99% of sites with cookie banners don't need cookie banners, because they don't need cookies at all. They say (lie) that it's to "improve your experience", but it's really just for tracking purposes. If a site has a login, then of course they need some kind of storage, and they can present the cookie consent in the login form. Otherwise, though, it's an imposition with no benefit to the site visitor. When you say "we respect the GPC signal", do you mean the Sec-GPC header? That would be a bit of improvement if all sites had to respect the header, but at this point it's still experimental and not widely used or respected.
    - bradleyy 2y ago
      WRT GPC, yes. We treat GPC as a "essential only" choice, and don't show you a banner. We treat DNT (Do Not Track) the same way, but its legal standing seems a lot less clear, especially due to the hijinks Microsoft did. And GPC is not experimental: if you don't respect it, you're in violation of California's CCPA/CPRA law [1]. It's likely that other states will fall in line here as well. [1] https://oag.ca.gov/privacy/ccpa/gpc https://oag.ca.gov/privacy/ccpa/gpc
      - lapcat 2y ago
        It's experimental according to https://developer.mozilla.org/docs/Web/HTTP/Reference/Headers/Sec-GPC https://developer.mozilla.org/docs/Web/HTTP/Reference/Header... and according to your own link, its availability is very limited. In any case, it's not widely respected in my testing, regardless of California law.
        bradleyy 1y ago
        I think we have different use cases: I'm trying to help people get compliant && do the right thing. From my perspective "anything that can trigger an uncomfortable conversation with an auditor" is not experimental. And I can tell you from the analytics that a significant portion of the web browsers out there are using it.
    - saagarjha 2y ago
      You don’t need a banner for login cookies.

bradleyy 2y ago

It may not have been clear: I work for a SAAS company that sells a "cookie banner", or more properly, consent management; it's quite a bit more complex than just managing cookies. Actually, if you're managing cookies, you've already lost.

lapcat 2y ago

> using cookies to store the state of what you consented to is somewhat ironic, or at least meta. It's a nightmare for anyone who uses private windows.

bradleyy 2y ago
The alternative would be something like "making you log in to save cookie preferences". There are legitimate reasons to do this, but most would oppose it. Would you provide some market feedback? Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? Note: this is actually a problem I'm thinking about, and really do want to find a workable solution.
- lapcat 2y ago
  > Would you rather log in to preserve your settings? Can you think of any other way to (semi-)anonymously identify you and preserve your settings across different sessions? The fundamental problem is that 99% of sites with cookie banners don't need cookie banners, because they don't need cookies at all. They say (lie) that it's to "improve your experience", but it's really just for tracking purposes. If a site has a login, then of course they need some kind of storage, and they can present the cookie consent in the login form. Otherwise, though, it's an imposition with no benefit to the site visitor. When you say "we respect the GPC signal", do you mean the Sec-GPC header? That would be a bit of improvement if all sites had to respect the header, but at this point it's still experimental and not widely used or respected.
  - bradleyy 2y ago
    WRT GPC, yes. We treat GPC as a "essential only" choice, and don't show you a banner. We treat DNT (Do Not Track) the same way, but its legal standing seems a lot less clear, especially due to the hijinks Microsoft did. And GPC is not experimental: if you don't respect it, you're in violation of California's CCPA/CPRA law [1]. It's likely that other states will fall in line here as well. [1] https://oag.ca.gov/privacy/ccpa/gpc https://oag.ca.gov/privacy/ccpa/gpc
    - lapcat 2y ago
      It's experimental according to https://developer.mozilla.org/docs/Web/HTTP/Reference/Headers/Sec-GPC https://developer.mozilla.org/docs/Web/HTTP/Reference/Header... and according to your own link, its availability is very limited. In any case, it's not widely respected in my testing, regardless of California law.
      - bradleyy 1y ago
        I think we have different use cases: I'm trying to help people get compliant && do the right thing. From my perspective "anything that can trigger an uncomfortable conversation with an auditor" is not experimental. And I can tell you from the analytics that a significant portion of the web browsers out there are using it.
  - saagarjha 2y ago
    You don’t need a banner for login cookies.