4 ms·

I hate how web sites can weasel their way around consent by simply declaring their cookies as "necessary" or "mandatory." As the Dude would say: Yeah, well, tha

I hate how web sites can weasel their way around consent by simply declaring their cookies as "necessary" or "mandatory." As the Dude would say: Yeah, well, that's just like, your opinion, man. How about we have an easy-to-use "Reject ALL cookies from this site (and deal with whatever breaks)" option?

rapind 2y ago
You're assuming maliciousness. I run a site that uses cookies (encrypted session cookie) so they can add items to a cart, because not doing so would be a horrible UI. There's also a cookie created by the payment processor, but I only load their script on checkout. There's nothing else though. I don't even use tracking / analytics. There's zero weaseling going on. No dark patterns. I'm just too busy to build a no-cookie version that passes info in the URL or w/e (which also seems less than ideal). Your two options are to use the site or don't use the site. If there was enough pressure from real customers to provide another option then I probably would, but it wouldn't change anything. It's just busy work / checking boxes. IMO this needs to be built into the browsers rather than being yet another tax on builders due to spammers / scammers / advertisers. If we had meta referencing each cookie where you can disclaim exactly how it will be used and whether it's optional / required, then we would have a standard without dark patterns being possible.
- const_cast 2y ago
  Session cookies don't require a banner or any kind of notification.
  - rapind 2y ago
    That's good to know (and reasonable)!
    - troupo 2y ago
      GDPR was adopted 9 years ago. It's insane to me that people still go out of their way to know nothing about it.
      - Orygin 2y ago
        It's much easier to blame the cookie banner on GDPR (which are not entirely related) than read the texts and jurisprudence about it to know how it works. Every website showing a consent screen is either willfully ignorant (rarer these days) or they want your data while saying hypocritical things like «We value your privacy»
      - rapind 2y ago
        Well I don’t live in or operate a business in the EU and none of my customers are in the EU. I did start looking into it out of curiosity, but TBH it wasn’t obvious what I needed to do, if anything. I doubt most Europeans know much about Canada’s data protection laws either, and it would be insane for me to expect them to.
ximm 2y ago
There was the "Do Not Track" header, but I don't think any sites that actually honored it. And it is deprecated now. On Firefox we still have webRequestBlocking, so it is quite simple to block cookies. See for example https://addons.mozilla.org/en-US/firefox/addon/ximatrix/ https://addons.mozilla.org/en-US/firefox/addon/ximatrix/
- troupo 2y ago
  > There was the "Do Not Track" header, but I don't think any sites that actually honored it. And it is deprecated now. Sites used that header to fingerprint and track users.
  - progval 2y ago
    Source?
    - troupo 2y ago
      As it wasn't widely implemented, and few people turned it on, Safari removed it in 12.1 as a potential fingerprinting variable: https://developer.apple.com/documentation/safari-release-notes/safari-12_1-release-notes https://developer.apple.com/documentation/safari-release-not... I think I remember a larger article about this, but can't find it now

rapind 2y ago

You're assuming maliciousness. I run a site that uses cookies (encrypted session cookie) so they can add items to a cart, because not doing so would be a horrible UI. There's also a cookie created by the payment processor, but I only load their script on checkout. There's nothing else though. I don't even use tracking / analytics. There's zero weaseling going on. No dark patterns. I'm just too busy to build a no-cookie version that passes info in the URL or w/e (which also seems less than ideal). Your two options are to use the site or don't use the site. If there was enough pressure from real customers to provide another option then I probably would, but it wouldn't change anything. It's just busy work / checking boxes. IMO this needs to be built into the browsers rather than being yet another tax on builders due to spammers / scammers / advertisers. If we had meta referencing each cookie where you can disclaim exactly how it will be used and whether it's optional / required, then we would have a standard without dark patterns being possible.

const_cast 2y ago
Session cookies don't require a banner or any kind of notification.
- rapind 2y ago
  That's good to know (and reasonable)!
  - troupo 2y ago
    GDPR was adopted 9 years ago. It's insane to me that people still go out of their way to know nothing about it.
    - Orygin 2y ago
      It's much easier to blame the cookie banner on GDPR (which are not entirely related) than read the texts and jurisprudence about it to know how it works. Every website showing a consent screen is either willfully ignorant (rarer these days) or they want your data while saying hypocritical things like «We value your privacy»
    - rapind 2y ago
      Well I don’t live in or operate a business in the EU and none of my customers are in the EU. I did start looking into it out of curiosity, but TBH it wasn’t obvious what I needed to do, if anything. I doubt most Europeans know much about Canada’s data protection laws either, and it would be insane for me to expect them to.

ximm 2y ago

There was the "Do Not Track" header, but I don't think any sites that actually honored it. And it is deprecated now. On Firefox we still have webRequestBlocking, so it is quite simple to block cookies. See for example https://addons.mozilla.org/en-US/firefox/addon/ximatrix/ https://addons.mozilla.org/en-US/firefox/addon/ximatrix/

troupo 2y ago
> There was the "Do Not Track" header, but I don't think any sites that actually honored it. And it is deprecated now. Sites used that header to fingerprint and track users.
- progval 2y ago
  Source?
  - troupo 2y ago
    As it wasn't widely implemented, and few people turned it on, Safari removed it in 12.1 as a potential fingerprinting variable: https://developer.apple.com/documentation/safari-release-notes/safari-12_1-release-notes https://developer.apple.com/documentation/safari-release-not... I think I remember a larger article about this, but can't find it now