12 ms·

Internet's biggest annoyance: Cookie laws should target browsers, not websites

• jasonlotito 1y ago
  If you hand me a book, you can't then complain I have your book.
• varispeed 1y ago
  Most people miss that the Cookie Law was essentially the training phase for GDPR. It conditioned users to reflexively click “Agree” just to make popups disappear. Once that behaviour was normalised, GDPR arrived - now those same clicks legally authorise data collection and trade that used to exist in a grey area. That's why the more logical and simpler ideas were never on the table.
• vmaurin 1y ago
  Same goes for age verification. There was the DNT header, that was a bit to simplistic, but was never implemented https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/... The thing people need to understand here is that the annoyance is not due to lack of technical solutions, or regulations forcing something. It is explicitly wanted by the industry so they can maximize the consent rate. The browser solution is probably the best technical/user friendly one, but ad tech/data gathering industry won't have any consent. As they control most of the web, they will never do that
  • Animats 1y ago
    It was implemented in browsers and ignored by sites. Chrome help says: Turn "Do Not Track" on or off When you browse the web on computers or Android devices, you can send a request to websites not to collect or track your browsing data. It's turned off by default. However, what happens to your data depends on how a website responds to the request. Many websites will still collect and use your browsing data to improve security, provide content, services, ads and recommendations on their websites, and generate reporting statistics. Most websites and web services, including Google's, don't change their behavior when they receive a Do Not Track request. Chrome doesn't provide details of which websites and web services respect Do Not Track requests and how websites interpret them.[1] About the best we have browser side is a mode where all cookies are cleared at browser exit. [1] https://support.google.com/chrome/answer/2790761 https://support.google.com/chrome/answer/2790761
    • Semaphor 1y ago
      > About the best we have browser side is a mode where all cookies are cleared at browser exit. No. The best we have are adblockers and scripts like consent-o-matic. Clearing cookies does mostly clear cookies, tracking goes far beyond that. Clearing cookies has always been a red herring enabling adtech submarines like "I don’t care about cookies".
      • zenmac 1y ago
        Didn't manifest v3 kinda voided all that for chrome based browser? Even brave's time in manifest v2 is timed. For that reason have switched to Firefox.
        • Semaphor 1y ago
          Use an adtech browser, win adtech prices.
    • djoldman 1y ago
      In chrome, saving anything to your device can be blocked completely: chrome://settings/content/siteData Here's an extension to block at a per-site granularity (despite it saying cookies, it blocks it all including local storage): https://chromewebstore.google.com/detail/disable-cookies/lkmjmficaoifggpfapbffkggecbleang https://chromewebstore.google.com/detail/disable-cookies/lkm...
    • pessimizer 1y ago
      That's not an implementation. That's a request to sites that you visit to comply willingly. An implementation would be defensive. It's what you would do if you had the crazy idea that a browser should be a client for the user, and only a client for the user. It should do nothing that a user wouldn't want done. The measure of a client's functionality is indistinguishable from the ability of the user to make it conform to the their desires.
      • TheCoelacanth 1y ago
  • cyanydeez 1y ago
    At this point browsers should become publicly owned. Theres zero benefit in private ownership. Its a utility and nows the time to accept that.
    • LunaSea 1y ago
      Utilities are not public either anymore in most western countries.
    • ants_everywhere 1y ago
      [flagged]
      • GJim 1y ago
        I think you will find there is an entire world beyond the shores of the USA.
        • ants_everywhere 1y ago
          US browsers account for more than 90% of the market share though. The main non-US browsers are Opera (Norwegian company majority owned by a Chinese company) and Samsung browser (South Korean company). Both Opera and Samsung are based on an American controlled open source project (Chromium, controlled by Google). So for the vast majority of people in the world government ownership of their browser would mean American political control. The current administration has expressed both in theory and practice a willingness to directly exert influence over organizations even when they are supposed to be independent of government control. That would be a concern for much of the world even outside the US.
  • p_l 1y ago
    Fun fact - if you handle DNT properly, you don't need to show the consent screen... because you're not doing anything requiring said consent.
    • jeroenhd 1y ago
      I believe Medium's DNT implementation showed a little confirmation button on embedded Youtube players. That's the kind of consent screen you may still need with proper DNT handling. None of those cookie popups, though. That's all malicious compliance.
    • voxic11 1y ago
      I don't think this is true. DNT being absent or set to consenting is not enough to infer the user has given specific and informed consent under the GDPR. > Explicit consent: Under the GDPR and similar laws, consent must be specific, informed, and an unambiguous, affirmative action from the user. Consent cannot be assumed by a user's continued browsing or inaction, which is what DNT would require.
      • p_l 1y ago
        if DNT is absent you could show GDPR-compliant consent screen (ofc, it would still need to be actually compliant, i.e. with "reject all" button front and center)
  • disruptiveink 1y ago
    Correct. Age verification and privacy consents belong on the browser. The issue is that on the browser, things work a bit too well (remember https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P ?), so the big players are incentivized to ignore completely the browser-based mechanisms and say/do nothing whenever they see lawmakers going on a dumb direction (risking fines is a reasonable price to pay in order to kill adoption of an actual browser/OS based control that would cause a dent to their tracking operations) that puts the onus on individual website operators.
• pbiggar 1y ago
  The cookie laws make it so that web sites have to ask permission to track you, surveil you, sell your data, etc. And surprise, almost every website wants to track you, surveil you, and sell you data. The EU should have just banned the unethical behaviour, the middle ground of every single website asking for unethical tracking is a travesty.
• CrlNvl 1y ago
  And it would solve nothing. GDPR already mandates that "Refuse non essential" button should be the same size and prominence than the "Accept all" button, every website around the globe does not care (apart from major players like Google, Apple or Amazon) and national data protection authorities absolutely do not care. We already had one attempt with "Do not track" header, nobody was willing to commit to it because it impaired business. Same would go with OP proposal. Websites are forcing this banner on us because they are greedy morons that would rather drain our data for money than incite us to pay for their work.
• rustc 1y ago
  Or just ban this kind of data collection. Is there any reason anyone would willingly click "Accept" when a website asks to share your data with 500+ partner sites?
  • p_l 1y ago
    Guess what, those banners are still up because it's pretty hard to actually bring the banhammer. At best you have too small team working with huge backlog
  • forgotoldacc 1y ago
    For that matter, companies should be banned from referring to selling off your data to random spam companies as "sharing with partners." Partners comes with an implication of being somewhat equal or at least on trusting terms. The companies selling our data don't trust these companies. They probably don't even know their names. If the data is being sold, it should be legally required to word it in that way. If there's even the slightest possibility of your data being leaked to spammers, it should be worded to reflect that. "Do you consent to us selling your data to any party that wishes to buy your data? Do you consent to the possibility that your data will be used to spam you or steal your identity in the future? Yes/No"
    • darig 1y ago
      [dead]
    • johannes1234321 1y ago
      The word "partner" lost its meaning completely. Each business relation is a "partner" these days. Guess it sounds nicer than "company that pays me to do stuff and bug you about"
      • foofoo12 1y ago
        I always read it as "partner in crime".
      • lesuorac 1y ago
• jacquesm 1y ago
  Of course companies could just - I know, weird idea - stop tracking you. Then you don't need those dumb consent boxes.
  • shadowgovt 1y ago
    The problem with making it a law is tracking is in the eye of the beholder, so site owners are heavily incentivized to err on the side of caution and put up the box just in case.
    • wat10000 1y ago
      God forbid they err on the side of caution and not set any cookies.
      • sojournerc 1y ago
        Right?! I have a website for a music studio. I never worry about any of this shit because it's just a static site with no tracking or analytics. It's just that simple. It's there if someone searches for me and that's enough. Rely on being a good business and organic search, word of mouth, and reputation will bring you business. You don't need to seo the shit out of everything and sell your visitors.
        • wat10000 1y ago
          It’s not like it would be any more work to figure it out with a complex site. You still have to enumerate everything you’re tracking, add the ability to disable it, and make sure the site works without it. All you have to do is turn them all off rather than presenting an alert asking the user. I understand why companies don’t do it that way. Tracking is worth money and they like money. What I don’t understand is why ordinary people make excuses for them.
          • cuu508 1y ago
            At least here on HN, keep in mind some of the commenters may be working in adtech or operators of ad-supported sites. I.e., not ordinary people.
• NegativeK 1y ago
  So why didn't GDPR require Do Not Track to be honored? It was already there, to be expanded on if needed. But I can't imagine copmanies would want that. They benefit from cookie dialogs fatigue, and for some reason people blame GDPR of all things for surveillance tech being annoying in how they ask for permission.
  • shadowgovt 1y ago
    It is entirely possible the lawmakers who put together GDPR were bad at their jobs and didn't consider better technical solutions.
    • kiicia 1y ago
      gdpr does mandate any technical solution technical solutions are chosen by companies to have as much dark patterns as possible to force you to consent companies that want to sell user data are bad guys trying to make gdpr look bad
  • p_l 1y ago
    GDPR does not mandate specific technical solutions. But actually honoring DNT properly would immediately mean no consent banner, but the consent banner is there to fool you into giving up your rights while providing (flimsy) legal cover for the company.
    • johannes1234321 1y ago
      The banner is also there to make you complain about EU bureaucrats, for having the law changed. And it works: Outrage is often on EU cookie banners, not in people selling our data.
    • jeroenhd 1y ago
      While this is true, the EU does have a tendency to step in and start enforcing technical requirements if the industry doesn't respond. USB-C, for instance, has been standardised, because attempts to tell the industry "one plug, you people figure out which one" didn't work. It's still early days for the GDPR (relatively speaking), but I can see the EU enforcing a particular privacy-related mechanism eventually. It also doesn't help that DNT is just a boolean signal, it doesn't give you the control over your data that the GDPR demands.
• jsmailes 1y ago
  I believe this is already starting to be solved via Global Privacy Control (GPC) [1], and has already been implemented in Firefox to replace Do Not Track [2]. All that remains is to see if lawmakers will catch up and make it a legal requirement to follow... [1] https://globalprivacycontrol.org/ https://globalprivacycontrol.org/ [2] https://support.mozilla.org/en-US/kb/global-privacy-control https://support.mozilla.org/en-US/kb/global-privacy-control
  • atlasunshrugged 1y ago
    +1 to this, Firefox has been pushing this for a while but my understanding is really the legal side
  • jeroenhd 1y ago
    DNT already had legal weight in the EU. I don't see what problem is being solved by sending a slightly-renamed version of DNT instead, other than the weird privacy law a few American states have implemented that says "if the browser sends the signal by default it's not a legal signal and you should therefore ignore it" (which will probably be updated to neuter GPC if that ever gets any serious attention, the las were clearly written to give trackers the advantage).
    • deleted 1y ago
      [deleted]
• Klaster_1 1y ago
  >We all do the same thing. We sigh, our eyes glaze over, and we click "Accept All" with the muscle memory of a weary soldier. No. When I see a cookie banner that doesn't have a "Reject all" or at least "Reject non-necessary", I leave the website. When you look into the "Reject..." section, it often contains 1000+ of adtech shit you have to untick individually. Aren't these actually non-compliant with regulations? Makes you think twice about website owners if they choose to sell your data to adtech - seems like law does exactly what it was supposed to do. The problem is adtech which encourages to collect data websites have no business at collecting. If anything, non-compliant sites should be fined into ground and adtech outlawed. If I could, I'd downvote the article.
  • lucumo 1y ago
    Exactly. People like the author are part of the problem. Blindly clicking consent is allowing site owners to bully you into consent. It works, so they keep doing it. If you're going to blindly click anything it should be decline all.
• harel 1y ago
  Amen to that, and to Age verification mentioned by @vmaurin. I get cookie rage sometimes from those banners. Most definitely I suffer from consent fatigue.
• mystraline 1y ago
  The point of the 'annoy with consent banners' was to get people to 'allow (to be tracked) '. Denying would, in many cases, go up to hundreds of yes/no options, with no 'deny all'. Makes getting coerced permission easy, and active denial almost impossible. Of course, by not tracking, they dont need any of this crap. But surveillance capitalism must continue. Sigh.
  • nemomarx 1y ago
    Isn't not having a deny all button against the gdpr already?
    • jeroenhd 1y ago
      It depends. Denying consent should be as easy as giving consent, and consent needs to be informed. Without an "accept all" button/default, you don't need a "deny all" button. The GDPR doesn't really care about implementations like that.
• amiga386 1y ago
  Uh... no. The purpose of the laws (GDPR et al) is to give me control over who does what with my data, data about me. The operator of the website is who the law binds. It's not even about the website - if I phoned or emailed, the same laws would apply. You need my explicit consent to process my data in a number of ways that you'd like to, it makes you money, but I don't want you to. The processors of this data can't make as much money off selling access to data about me, if I have these rights. So they petulantly get in my face as much as possible, via banners on websites, to annoy me and confuse me as to why these banners are even there, and try and trick me into letting them make more money. The banners, which a browser could block or autofill, are just the surface. And they're an attack surface, so even if we agreed a way for the browser to pass on your preferences (we already did this, it's called the Do-Not-Track or DNT header, and it was a complete failure because website-owners just ignored it), website-owners would add a second layer of "ah, I see you said no automatically, but are you REALLY sure you don't want to let me make more money from your data?" NOYB is very good for chasing after such charlatans, and forcing companies to obey data protection laws. Here is some of their guidance, and listing of the dark patterns used by non-compliant companies: https://noyb.eu/sites/default/files/2024-07/noyb_Cookie_Report_2024.pdf https://noyb.eu/sites/default/files/2024-07/noyb_Cookie_Repo...
• moooo99 1y ago
  I disagree that this should be in the scope of a browser. Cookie banner are called cookie banners because they‘re most frequently associated with the opt in for tracking cookies, but this kind of opt in is required for any kind of third party involvement that goes beyond technical necessity. Your browser has no way to tell what third party present on the site is a technical necessity and which one isn‘t. So you‘d have to tell it - making it part of the site providers problem as well. But this time its worse, because responsibilities are mixed between the site operator and the third party.
  • ryukoposting 1y ago
    Legally compel websites to respect the DNT header. Bam, done. This is a simple problem, and should be solved in a simple way.
    • PlotCitizen 1y ago
      This is the best suggestion here with the least friction in my opinion
    • bradleyy 1y ago
      Companies ARE legally compelled to comply with the GPC header.
    • jeroenhd 1y ago
      DNT doesn't solve all problems, though. Not only is DNT being deprecated, it also lacks the proper customisability the law actually prescribes for data processing. There's no value you can give DNT that says "you can do your own on-site tracking and telemetry and I accept sharing my data with Sendgrid for your newsletter, but I do not want third-party trackers". As a practical example: there are news sites that will not play videos if you hit "deny all" because their video host does some viewership analytics. I'm fine with that, but not the 750 other advertisers the news site tries to have me track. Of course, "deny all" should be an option, "accept all or deny all" isn't control. For the longest time we had https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P as a basis to build on, but that officially died the day Edge became Chromium-based.
• gnud 1y ago
  For Knuth's sake: The GDPR is NOT about cookies! The older 'cookie directive' is also NOT about cookies! They're about a third party storing their data on your computer, or storing your personal data on their computers - no matter what technology is used. Nothing in the GDPR stops websites from honoring "Do not track" and then _not asking_ if it's present. They don't have to ask if they don't track you! They don't have to ask for a technically necessary session cookie that appears after you actively log in! Websites ask because they want to track you! A 'law targeting browsers' would not help because people would say no to cookies, and then websites would ask about some other way to track you. Because they want to track you.
• phyzome 1y ago
  For people who have reasonable browsers (i.e. you can install extensions) you can already live in this world. For example: https://addons.mozilla.org/en-US/firefox/addon/consent-o-matic/ https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat...
• PaulHoule 1y ago
  Instead of forcing those cookie banners Europe should have had an Airbus moment and fully funded a privacy first web browser, then Europe would be a player in the web and not looking in from the outside.
  • fgkramer 1y ago
    I feel this would go down pretty bad considering the recent attempts to break E2E encryption on messaging. Also a very tempting vector for hackers and governments to track user’s behaviour
  • 4ndrewl 1y ago
    Except it's not about privacy. It's about consent.
    • PaulHoule 1y ago
      I hate to sound like Andrea Dworkin but I don't think consent is possible between a human individual and a 500-headed corporate hydra. It is much more straightforward to turn off third party cookies entirely or "respect DNT or go to jail"
      • GJim 1y ago
        > I don't think consent is possible between a human individual and a 500-headed corporate hydra. Hard disagree. Legitimate companies will obey the law; be that the GDPR, anti-corruption or anti-pollution laws to pick a few examples.
        • PaulHoule 1y ago
          Out of 500 companies that access your data the majority might obey the law, but 50 of them won't. There's also a basic imbalance of power -- for instance, if you don't fill out the paperwork to get medical care that says (1) everybody who could possibly have a reason to access your data can, and (2) we're going to do that at a cost 1000x more than just leaving all the paperwork out on the curb you don't get medical care. People don't really real all those clickwrap licenses, I mean, Sony makes you scroll to the bottom of a 50 page contract just to play a video game.
• g105b 1y ago
  The author's idea is "A Simple, Radical Idea: Put Consent in the Browser". So when you set up your browser, you get a single choice of whether you want websites to track you and sell your data. Here's an even more radical idea: the browser doesn't even ask you this, and by default it just respects the user's privacy and blocks all third party tracking. Can you imagine an internet where the user is put first?
  • jeroenhd 1y ago
    > Here's an even more radical idea: the browser doesn't even ask you this, and by default it just respects the user's privacy and blocks all third party tracking. DNT is legally void in several US states because it was enabled by default. If we do set up a browser-oriented solution, browsers like Firefox and Brave would default to the most privacy-friendly options practical, of course, but they already mostly do that anyway.
• michaelmauderer 1y ago
  The problem here is not the law, but malicious compliance by websites that don't want to give up tracking. "Spend Five Minutes in a Menu of Legalese" is not the intended alternative to "Accept All". "Decline All" is! And this is starting to be enforced through the courts, so you're increasingly seeing the "Decline All" option right away. As it should be. https://www.techspot.com/news/108043-german-court-takes-stand-against-manipulative-cookie-banners.html https://www.techspot.com/news/108043-german-court-takes-stan... Of course, also respecting a Do-Not-Track header and avoiding the cookie banner entirely while not tracking the user, would be even better.
  • torginus 1y ago
    I wonder why people don't build a collection of scripts into a browser plugin, like Adblock that auto rejects all tracking info to the greatest extent possible?
    • bvvgpc 1y ago
      I would install that in a heartbeat!
      • jraph 1y ago
        Then enable the cookie banner lists in uBlock Origin. Do expect occasional breakages and remember to temporarily disable the blocking to get through.
    • h4kor 1y ago
      These exist. There is "Consent-O-Matic" for example
      • Semaphor 1y ago
        Direct link, works on mobile as well: https://addons.mozilla.org/en-US/firefox/addon/consent-o-matic/ https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat... There’s probably also a version for the adtech browser somewhere.
• kiicia 1y ago
  we had it already, it was "do not track" header, whole ads industry worked very hard so in the end it went nowhere...
• __bax 1y ago
  I said the same years ago
• mihaic 1y ago
  Policing the tools instead of policing what is being done with them is the problem for me. Third party cookies have a valid reason to be used in federated authentication for instance, or a bunch of other valid purposes. Just ban shitty data collection practices. Knives can be used to chop vegetables or stab someone. Don't ban their sale, ban their usage.
  • high_na_euv 1y ago
    Cookie consent is not required for technical cookies like auth.
    • 4ndrewl 1y ago
      I'm surprised at how often this needs to be restated. By-and-large you only need to allow people to opt out of cookies if you're tracking _their_ activity and/or selling details of _their_ activity to your "partners".
      • Macha 1y ago
        Partly it’s because we’ve simplified the discussion to “cookie banners” when it’s about more than cookie tracking or cookie-like tracking (local storage). So it misses all the other ways tracking occurs. The other thing is that it benefits those who wish the law would just go away to have it misunderstood this way.
    • lucumo 1y ago
      Indeed. Nor is GDPR about cookies at all. GDPR is about identifiable user profiles and information. A piece of paper with someone's name falls under the GDPR; a cookie that hides a shown alert doesn't.
    • mihaic 1y ago
      It isn't needed, but third-party cookies were phased out by Chrome specifically to undermine their competitors, all under the veil of doing the right thing, and everyone that was using them for something ok got screwed.
• AJ007 1y ago
  What about by default web browsers are required to have Javascript disabled and uBlock installed and running? They could do a reverse Google, and make it so its impossible to uninstall uBlock. If we are going to go down the path of mandating legal liability on software makers of a neutral communication medium, then the EU should just break the commercial web.
• st0ffregen 1y ago
  https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies
• kgwxd 1y ago
  Why would this need to be law? My browser already does this, because I, the "user" in "user agent", wanted it that way. Some sites don't work, but that's their choice, not mine, as it should be.
• sackfield 1y ago
  Is there any evidence that this law is achieving the goals it was designed to tackle? If not, is there any reason it still exists? Why don't laws have to continually justify themselves as a matter of procedure?
  • GJim 1y ago
    If your asking if the GDPR is effective, yes, it is. The only ones ignoring it completely are either dodgy companies, or the clueless. The companies exercising malicious compliance are now (quite rightly) increasingly seen as dodgy and need to up their game if they want to become respectable. The days of not protecting user data are over.
    • crazygringo 1y ago
      GP asked for evidence.
      • GJim 1y ago
        The evidence is all around you. For example, my insurance company can no longer get away with selling my details to financing companies behind my back. Such shenanigans are no more in the UK and EU thanks to the GDPR.
      • freehorse 1y ago
        You can ask companies for a copy of all your personal data they hold. There is no way this would be possible without GDPR and similar laws. In general, data controllers need to abide to some legal framework and not do anything they want. I am not sure what OP asks. They should make their request more specific, what they want evidence for.
  • moduspol 1y ago
    I wanted to ask something like this, but I think you framed it better. I am convinced these laws have just made my life and the Internet marginally worse, with no measurable positive impact.
• amelius 1y ago
  With all the AI we have, shouldn't browsers be able to click the cookie banners for us? In a way that we want?
  • jraph 1y ago
    uBlock Origin's cookie banner lists do this without AI.
• tbrownaw 1y ago
  > Your browser becomes your personal privacy enforcer, and the law would require it to act on your behalf. Based on your one-time choice, it would be responsible for allowing or declining cookies from every site you visit. If a website tries to use a cookie with an unclear or undeclared purpose? Browsers are something the end-user installs. Inserting the government into that doesn't make sense. This sounds like the idea is for the site to add extra metadata that's not there now, about what each cookie does. Which would still involve mandating site owners to do things. . Also, both private mode and https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... are a thing already, without government meddling.
  • asplake 1y ago
    Except that the provider of the most popular browser is also an advertising agency. A conflict there, surely?
    • tbrownaw 1y ago
      So that would mean that most users must not actually care that much, then?
      • pessimizer 1y ago
        The provider of the "alternative" browser is also completely supported by the same advertising company, and since this arrangement has begun has shown itself completely uninterested in solutions like this. If anything, it tries to make control over cookies, localstorage, or javascript harder, and to demonize people who would dare to care about such a thing.
      • wackget 1y ago
        Let's be honest: most users don't know what they don't know. Even tech-literate people have no real idea of the enormity and scale of tracking which goes on across the web. And the tech giants love it that way.
  • 1y ago
• everdrive 1y ago
  It's also the case that really making cookies painful just pushes more tracking to other places such as browser fingerprinting, which is much, much more difficult to defeat than cookies.
  • jraph 1y ago
    note that the GDPR doesn't make a difference between cookies and browser fingerprinting. It doesn't concern itself with the technical details. Whatever applies to cookies also applies to browser fingerprinting.
    • everdrive 1y ago
      Makes me wish we had something like in the US. But, thanks for letting me know, I wasn't aware!
      • jraph 1y ago
        Crossing my fingers for you mates!
• stared 1y ago
  To solve the root problem, we need to steer away from the ad-based revenue model. We use websites for "free" paying with data. A cynical take on that is "if you are not a customer, you are a product". If there were no adverts, quite a few things would change: * much less incentive to track users * way less distractions * higher quality content (since it is less about clickbaits and shear volume of visitors) Yes, it means paying for stuff. Would love to pay per visit or type spent, provided it is easy.
  • itopaloglu83 1y ago
    Tracking will always be more profitable, because that allows you to know whom to target exactly. It’s the fundamental question of business, who are my customers etc. Tracking should be considered equivalent to putting an electronic tracking into every customer’s pocket when they visit your brick and mortar store. Then the question of privacy becomes more obvious. It is simply not acceptable to track people this deeply and invade their privacy so much.
    • stared 1y ago
      Tracking will be more profitable. But there is a dark difference if it is de facto the main source of revenue, or some scammy addition. In the later case, it can be regulated - the same way as we have safety regulation for food or equipment. In some sense, the analogy is not that far off - the current web is made to be addictive. A lot distractions have well known, negative impact on mental health.
  • arnvald 1y ago
    Unfortunately there's simply no way this is going to happen: * advertising is profitable for advertisers — they buy ad slots because it brings revenue * advertising is profitable for publishers — some of the biggest companies in the world (Google, Meta) make most of their revenue from ads * most people are reluctant to spend money, but they're ok to "spend" their attention and their data There were multiple attempts with micro-payments and nothing has worked so far. Monthly subscription is preferred by customers and companies, but there are only so many outlets that anyone will subscribe to.
• ACCount37 1y ago
  The interface definitely should be implemented at the browser level. If a user sets "allow performance telemetry, deny fingerprinting, ads, tracking" or "decline everything non-vital" once in the browser settings, he should never see a cookie banner ever again - with all of that communicated to the websites by the browser for him, and the websites being obligated to respect the user preferences. The cookie banner vomit should be reserved only for browsers that don't support that. The fact that this obnoxious behavior somehow became the Internet's default is an atrocity.
• bArray 1y ago
  > A pop-up, a slide-in, a full-screen overlay demanding you "Accept All," "Manage Preferences," or navigate a labyrinth of toggles designed by a corporate lawyer. It's the dark patterns and lack of consistency that makes it worse. Some websites even refuse to allow you to reject data collection unless you pay to use their service (i.e. news websites)! As others have echoed, we just need to make this large data collection illegal.
  • GJim 1y ago
    > As others have echoed, we just need to make this large data collection illegal. It *IS* illegal under the GDPR. Article 5(1) requires that personal data shall be (b) collected for specified, explicit and legitimate purposes ... (c) adequate, relevant and limited to what is necessary ... In plain English, you can't go trawling for personal data.
• hirako2000 1y ago
  Exactly that, and how regulations are a sinking costs, at times for absurdly poor impact. the solution is simple, shift the cost of compliance, onto regulators! it would work like this: 1/ Somewhat competent but disconnected from reality politicians vote for adding yet another rule. 2/ Incompetent, disconnected from reality, so called Experts articulate how to implement the rule. 3/ Estimate costs and report back to clouded brains up there. 4/ Clouded brains but budget wise acute, look at the numbers, and say no way I bet we would get regulations that would always be welcomed by industries. We could start by rolling everything back, the "economy", you bet, would finally "recover". Without incentive to make it right, it can't be a surprise you get what you seeded for.
• phkahler 1y ago
  >> Most people do the same thing: sigh, their eyes glaze over, and they click "Accept All" with the muscle memory of a weary soldier. My instinct is to find the other option is either easy or obfuscated a little bit. But the EU regulation requires that it not take more than 2 clicks to do the other thing. I thought cookies were kind of evil back in the 1990's and I still think they need to go away entirely.
• ben_w 1y ago
  My least-favourite is websites with the "Pay or OK" model: "If you don't want more companies tracking you than were people in your high school, teachers and students both, you must pay us! [Pay] [Accept tracking]" *Copy URL, close window, open private browsing session, paste* As an aside, is anyone else getting LLM-writing-style vibes from the linked page, or is that just me?
  • jraph 1y ago
    > My least-favourite is websites with the "Pay or OK" model Which doesn't respect the GDPR. > As an aside, is anyone else getting LLM-writing-style vibes from the linked page, or is that just me? The multiple 3-item lists with the item's first sentence in bold, the logic not perfectly following from one sentence to another, the numerous comparisons/metaphores, the em dashes, and the general, distinctive tone are certainly clues.
  • GrinningFool 1y ago
    The thing is, these sites that give you an option to pay only let you pay to opt out of advertising (and some only partially!). It does nothing to stop tracking you. There are several sites I would not hesitate to pay for, but the most that will net me is generally "content with invasive tracking". Sometimes with no ads and sometimes with "fewer ads". But in either case, still a non-starter because it's still capturing the same data about me and sharing it.
• tefkah 1y ago
  Internet's biggest annoyance: AI slop blogposts
• kayhantolga 1y ago
  I think there’s a small detail missing. Most browsers also track user behavior and use your data. I can’t imagine big tech companies fighting each other in court just to give you the best internet experience. The idea sounds good in theory, but in practice, I don’t think it would change much. What we really need are regulations that truly understand business models and target and punish those that abuse them. For example, right now any company can ask for your consent ten times a day until you give up, and once you click “yes” even once, your data begins an eternal journey. A few months ago, my Samsung TV (which I bought four years ago) suddenly blocked everything and displayed a new agreement on the screen with only two options: Read and Agree. There was no way to use the TV without accepting the agreement.
  • GJim 1y ago
    > Most browsers also track user behavior and use your data Tell me about these browsers that are in breach of the GDPR and use my data without explicit opt-in permission?
    • Nextgrid 1y ago
      Google Chrome? They breach the GDPR on the web, why is it so far-fetched to think they wouldn't do it in local software too? Firefox is no better, with their telemetry being opt-out and I believe even if you opt-out some telemetry is sent to let them know you've opted out.
• sReinwald 1y ago
  This screams of classic techno-optimist "just build one simple solution" mindset. Yes, consent fatigue is real and nobody likes these cookie banners. Which is also the exact reason why I think they are important. Making tracking visible to the user is the point. It creates an actual "cost" for tracking by forcing websites to actively ask the user to consent. The moment you hide it in a one-time set-and-forget browser setting is the moment when informed consent dies, tracking becomes invisible, and accountability disappears. We are also looking at very perverse incentives here: Who controls the biggest browsers? Google's Chromium is basically the engine behind 80% of the browser market right now. Apple and Microsoft aren't exactly neutral parties either. Google is an advertising company, and Apple and Microsoft still have a huge interest in data. The idea that you should trust these parties to implement a "simple" consent system that runs counter to their business model is... optimistic, to put it mildly. You would also have to trust websites to accurately categorize their cookies. If your cookie preferences are a set-and-forget setting in your browser, are you sure that random website you just visited didn't declare Google Analytics as "essential" for their website to work? Are you going to check? The blog post also assumes cookie preferences are universal, but perhaps I'm okay with analytics on a random tech blog but absolutely not on a website about medical issues. The funniest part: The "Do Not Track" signal already exists, and it failed spectacularly. The post even mentions it. DNT was supposed to be exactly this simple, browser-level signal. And websites just ignore it. Sidenote: > Imagine if every time you got into your car, you had to manually approve the engine's use of oil, the tires' use of air, and the radio's use of electricity. It’s absurd, right? You’d set your preferences once, and the car would just work. Yes, absurd. Except that's more or less happening with different features. Every time I start my car, I need to manually disable the speed limit warning because it's annoying, and the lane keep assist because I feel like it is overly aggressive and sometimes genuinely dangerous. Also, the analogy is exceptionally weak. The author compares mechanical necessities (oil, air) with optional data extraction. That's hardly the same thing. Cookies required for basic functionality of websites is usually enabled by default. A more appropriate equivalent would be a popup by the car's dealership asking you to track everywhere you drive, and how fast, and if you looked at some billboards along the way.
• master-lincoln 1y ago
  Why is this on the front page? The author apparently did not do any research or they would have discovered that was tried with the DNT header [0] Also there is no cookie law, just that websites need consent to track you (simplified). [0] https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
  • jeroenhd 1y ago
    There is effectively an EU cookie law, though it's not the GDPR like many people think it is; rather, it's an extension to the ePrivacy Directive[1] : > ‘3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.’; Of course this also applies to flash cookies, local storage, and other browser data stores, not just cookies. The legal requirements for data storage that doesn't violate anyone's privacy are a lot looser, though. [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
    • master-lincoln 1y ago
      This law states storing or accessing stored data needs user consent when the data is not strictly necessary for the website in order to provide the service. It doesn't mention banners or cookies or that every website needs it.
• a2128 1y ago
  > Your browser becomes your personal privacy enforcer, and the law would require it to act on your behalf. Based on your one-time choice, it would be responsible for allowing or declining cookies from every site you visit. If a website tries to use a cookie with an unclear or undeclared purpose? The browser simply blocks it—no questions asked. ChatGPT writing aside, how does the author expect browsers to do this exactly? It's not as if website developers are declaring the purpose of each individual cookie. Browser developers already added a Do Not Track header option and to the surprise of no one, it was a massive failure because websites have every incentive to skirt this stuff. And today the GDPR law extends much more than cookies, it requires explicit consent for processing personal data in general. Your browser has absolutely no bearing on whether a website's backend will save the pages you visited, the text you entered, your IP address, and whether it shares it with 500 partners or not. This problem fundamentally requires cooperation from website developers and that's why we have the law targeting websites as it is today.
• jraph 1y ago
  Browsers have no way to determine what code or cookie is tracking and what isn't, and if websites are not targeted, they don't have any incentive to tell browsers "oh, this is for tracking, and this, no, it's not for tracking". The best we have is heuristics content blockers currently use. But heuristics are not good enough for complying to such laws because there's no guarantee they work in 100% of the cases. It follows that such laws can't target browsers and not websites.
  • skeezyjefferson 1y ago
    Wasnt this a benefit of the semantic web we were pushing for? Standardized tags exactly for stuff like this? Just another example of the mess that web dev is - trying to coerce a markup language into a fully fledged programming language. OP has a nice idea but hes short on technical details, which in this case is where the devil resides.
    • jraph 1y ago
      As much I like the semantic web, you can embed tracking parameters in images and links put in a perfectly semantic HTML structure :-) I think we need strong privacy laws, removing the incentive to track, or both, I don't see a technical way around.
      • skeezyjefferson 1y ago
        is there a standard for those tracking parameters?
        • jraph 1y ago
          There are some usual suspects like the utm_* parameters, but a website could be using whatever it wants. Actually, you don't event need parameters to track, you could just use the IP of the requester and for instance do some IP geolocation.
• bjord 1y ago
  current malicious compliance by websites aside, would this not put the onus on browser devs to, site by site, identify which cookies are actually "necessary"? side note: ublock origin has optional filter lists for blocking these banners
• baggachipz 1y ago
  Since there are a handful (maybe dozens) of companies who implement this popup feature as a service (e.g. CookieYes), a browser plugin to automate the "no to all" could be handy. That is, the plugin would know the provider and navigate the labyrinth of settings to disable all of them.
  • jmbwell 1y ago
    And then a handful of companies can offer a service to let advertisers punch through the plugins. And then another plugin could block that! Thing is you’re probably right. The modern web is made of middlemen inserting themselves into user experiences to divert and extract revenue from the primary stream between consumer and producer. There’s always room for another layer.
  • jraph 1y ago
    uBlock Origin's cookie banner lists do this.
    • baggachipz 1y ago
      Ah, yeah, I suppose just blocking the domains of those cookie services would take care of it.
      • jraph 1y ago
        That's not always enough, sometimes you need some code simulating the "deny all" clicks or tweaking CSS class lists on the body and html elements. Otherwise, you might end up with some unscrollable page because for instance there's a CSS rule that blocks scrolling when the modal is there and restores it when the modal closes and this handling is unfortunately done in JS.
        • baggachipz 1y ago
          Does uBO take care of this?
• kreetx 1y ago
  Can anyone make out who writes nednex.com articles?
• jmbwell 1y ago
  I think targeting web sites was the right move because it was the web sites who were doing all the tracking. Of course now we also have browsers to worry about as well, being products of the same ad companies that were clogging up the web sites in the first place. But if cookie laws pushed data collecting web sites to malicious compliance, surely similar laws would do the same to (also data collecting!) browser providers. I’d prefer to avoid inviting browsers to add another layer of bullshit. And there’s no reason it would make web sites behave differently… if I’m a web site bound to comply with laws, I’m probably going to cover my own ass and keep doing what I’m doing without assuming the browser will handle it. Rendering the browser controls redundant and ineffective. If we want to look for core flaws, look at allowing a handful of giant companies to control the market for personal data — or to traffic in personal data at all. Ad companies have convinced the whole economic system of the Internet that they are inevitable and essential. They are neither. But we won’t fix that either. The solution is to get off the damn internet, but short of doing that, I’ll prefer to keep my options open to disable telemetry on my own terms. Here’s something I would like, though: total sandboxing per web site. Let every domain be alone in its own room of cookies and telemetry. Let it think I only ever visit that site, and optionally always for the first time. I shouldn’t have to blow away all my cookies all the time just to keep Facebook from following me all over the web.
• gabeyaw 1y ago
  While we're talking about cookies, can anyone explain what legitimate interest is? And if it's an exception to consent then why can I reject legitimate interest? It just seems like another hurdle to rejecting all non essential cookies.
  • Macha 1y ago
    Legitimate interest as interpreted by most companies making (IMO non-compliant) cookie dialogs as just a second attempt at consent that they think doesn’t have to obey the top level reject all they’ve finally been penalised into having. Legitimate Interest per the law is intended for use cases like, having a list of people who owe you money, or keeping IP address access metrics long enough to use them for anti bot or paywall measures.
• merryocha 1y ago
  uBlock Origin can block these if you check the "Annoyances" filter in the filter list. I think it's disabled by default because it has a higher risk of breaking sites, but I never have a problem. I haven't seen a cookie banner in a long time!
• OrderlyTiamat 1y ago
  > Imagine if every time you got into your car, you had to manually approve the engine's use of oil, the tires' use of air, and the radio's use of electricity. It’s absurd, right? You’d set your preferences once, and the car would just work. A funny comparison to me. Actually, I have to manually disable some EU regulated features every time I get into my car. The alerts every time I go 1kmph over the speed limit aren't very relevant for me, and the lane keep alert buzzes as soon as I'm slightly over halfway to the left, but lets me drive along fine if I'm even over the line on the right. I'd actually like to use both of these, but only if I could calibrate them to my needs. ... Just like cookie banners.
  • Nextgrid 1y ago
    Search on forums/etc for your particular car brand about which compatible scan tool to get (you want the manufacturer-specific one to be able to change settings, not the generic OBD2 which only lets you read engine & emissions data), get one and then disable the setting. Those are typically controlled via settings so that the same car can be sold in different regions.
• bradleyy 1y ago
  Hey, I'm the lead developer on DataGrail's(1) Consent product (cookie banner). I know a fair bit from having been involved with this for years, and talking to a lot of customers. Happy to answer questions and clear up misconceptions, especially the one about "giving DNT force of law": we already have Global Privacy Control (GPC), and it's already required in (significant parts of) the US, and it's being enforced. I can say we've tried really hard to prevent a lot of the malicious user interface issues, and to respect the GPC and DNT signal (no banner pop). We've tried to balance the company's need to keep compliant (because frankly, many of the complaints here about "legalese" aren't just deceptive UI (dark patterns), but done on the advice of counsel), and still operating (marketing needs analytics/ad tracking). And we're concerned about the user experience for what is admittedly an intrusive tool, but required. (1) I'm not a spokesperson for the company, experiences and opinions are mine.
  • PanoptesYC 1y ago
    A lot of consent banner implementations have a clear accept all and then an intentionally obtuse alternative where you have to manually untick every "partner" you don't want to give data to. Presumably this is more profitable, as a lot of people will just click accept all instead of wasting their time. A lot of people in the thread are speculating that this approach is illegal, but it seems to have widespread use across the web. Why doesn't DataGrail do this? Was it something requested by advertisers/management that your team pushed back on?
    • bradleyy 1y ago
      It's pretty clear from my reading of the (EU) laws that giving prominence to "Accept all" and not having the same level of prominence for "Essential only" is not acceptable. US is a whole different story, but has some bright points: GPC is already required in several states, and spreading. This removes the need for a consent banner to show on screen, which is great. Our primary job is to make our customers compliant, so we try to "push them into the valley of success". That means GPC and DNT "do the right thing" by default, no deceptive design (dark patterns), etc.
• npteljes 1y ago
  By far from the biggest annoyance, to me that would be ads, and the slop that it incentivizes. Although, I too had enough of the cookie popups. Let's just ban (and enforce banning) cookie tracking, and be done with this nonsense.
• tsukikage 1y ago
  > If a website tries to use a cookie with an unclear or undeclared purpose? How is the browser supposed to determine a cookie's purpose?
• ec109685 1y ago
  Yes, same with access restrictions. Parents should be able to limit types of content accessed at the device level and websites and app makers are just provided that. Remove any notion of age blocks that kids just lie about, and let parents determine what is suitable for their kids.
• rtkwe 1y ago
  The browser doesn't know what each of the cookies are for so that's still relying on the sites to properly accept this new setting.
• buellerbueller 1y ago
  HIPAA for all personal data. Period. You want to share it? Get my express consent.
  • Nextgrid 1y ago
    > You want to share it? Get my express consent. That's literally the GDPR? But the problem is that enforcement is severely lacking, so it is more profitable to breach the GDPR than to comply with it.
• stargrazer 1y ago
  Deny All, Accept All, but I never (except in a handful of cases) see the Accept Required. Let us admit that there are cookies required for maintaining state within a web site and account. I default to Deny All, but click on Accept Required when I see it (trusting that it does do what it says it does)
  • nhinck2 1y ago
    Deny all should be equivalent to accept required, to my understanding anyway.
• redwood 1y ago
  It's pretty sad that Europe basically weakened the web experience for everyone. Pure vanity. Pat themselves in the back and tell themselves we're all more privacy oriented now. Great. Except that the noble cause has not been achieved but it has made the web worse.
• GuB-42 1y ago
  It already exists. It is called an ad blocker, or content blocker, whatever you want to call it. And we don't need a law for that, it is already working. We may need a law to protect that freedom, and for most part, it is on that side as we already have rulings saying that ad blocking is not illegal, and enforcement of browser choice, some of them having built-in blockers.
  • dns_snek 1y ago
    You need to understand that GDPR and consent requirements affect far more than just online ads and ad-related tracking. For example a website is legally required to ask for consent if they want to share your purchase history with data brokers. Collection of this data is unaffected by ad blockers. As the name says, it's a General Data Protection Regulation. It covers all types of processing from all types of entities, everything from big tech websites to your local yoga instructor who doesn't have any online presence.
    • GuB-42 1y ago
      My comment was in reaction to the article, which suggests that the browser shall act as a "privacy guardian", which I believe is already the case. It is also kind of ironic that the article suggests a technical solution to a legal problem, arguing that a legal solution doesn't work (consent fatigue, DNT, ...) and then suggests legislating on it. I wasn't implying that ad blockers are a substitute for GDPR, which goes way beyond cookies and things that can be done at the browser level.
  • croes 1y ago
    Of course we need a law otherwise companies just need to circumvent ad blockers and they act legal. And media companies like Axel Springer SE already try to make ad blockers illegal.
• tmvphil 1y ago
  I simply do not care if advertisers form an accurate view of my desires and beliefs.
• negendev 1y ago
  This is the way. The law is broken and was built on misunderstandings and is not enforceable, and also caused a ton of headache for internet browsing (no one really wants to enable cookies just to read a news article?). Enforce it at the browser level (by law) to prevent private information BY DEFAULT unless the user really wants to give their private information, and if they want to, then they can comply. Sorry for all the companies that like to track personal information, but this is how it has to be (not sorry). Maybe it will one day lead to elimination of (most) cookies and lead to cleaner browsing experience.
  • croes 1y ago
    Remember DNT? We already had that in the browser but websites started to ignore in when MS announced that their browser would set it to true by default. Let’s face it, users don’t want to be tracked, websites want to track. The cookie banners are the middle ground and the law already tries to prevent all those dark patterns to enforce „accept all“. I remember the early days when the cookie banner on Tumblr forced the user to deselect every single tracker of the hundreds of trackers they listed.
• JohnFen 1y ago
  As others have said, we already tried this with DNT. Unless websites are legally compelled to honor the signal, the signal is worthless. But here's an interesting wrinkle that may illustrate further complexity: > Essential Only: "Only allow data necessary for websites to function (e.g., keeping me logged in, remembering my shopping cart)." I would never have called either of those examples "necessary for websites to function". They are both just convenience things, not essential things. So there may be a lot of discussion needed about category definitions here.
  • padjo 1y ago
    If your website is a shop then being able to put things in a cart is pretty necessary no?
    • croes 1y ago
      You don’t need cookies for that.
      • padjo 1y ago
        The point is that you need to track the person. The technology used is irrelevant.
        • JohnFen 1y ago
          The point is whether or not "shopping cart" cookies are "essential". I argue that there is nothing about them that qualifies as essential. The contents of your cart can be kept server-side, which means that using cookies to do it is not essential at all. Making them part of the "essential" set in cookie banners is a category error. This is an important point, in my opinion, because if we allow websites to get away with saying nonessential cookies are essential, then the more obnoxious cookies people widely object to will just be counted as "essential" to evade people's preferences. Websites seem strongly predisposed to pulling the wool over user's eyes whenever they think they can get away with it, so this category problem is not without meaning.
• Geee 1y ago
  Also, a lot of people forget that you don't need a cookie popup. apple.com or tesla.com doesn't have one. Plenty of others, but they're quite rare. I absolutely hate unnecessary cookie popups, e.g. when you're already signed in and have accepted privacy policy. Or, when accessing a parcel tracking service or similar. It's always annoying, but there are clear cases when you don't need to track users and it probably just drives them away or makes them angry.
• sebastian_z 1y ago
  California now has a law that requires browsers to have an opt-out setting (effective in 2027) [1]. So far, websites are required to respect opt outs via browser settings or extensions in California, Connecticut, and Colorado [2]. That is also the case for New Jersey [3]. [1] https://legiscan.com/CA/text/AB566/2025 https://legiscan.com/CA/text/AB566/2025. [2] https://portal.ct.gov/ag/press-releases/2025-press-releases/connecticut-california-and-colorado-announce-joint-investigative-privacy-sweep https://portal.ct.gov/ag/press-releases/2025-press-releases/.... [3] https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-....
• rootshelled 1y ago
  I wanted to read the article about cookies but gave up after seeing this many ads.
• ekianjo 1y ago
  I would not trust browsers to keep my preferences though. Firefox keeps resetting stuff I disabled before. Zero trust zone unfortunately.
• t1234s 1y ago
  cookie laws shouldn't exist. all browsers have privacy settings and have had them for many years.
• ambyra 1y ago
  A browser extension or addon that automatically sets the user's preferences and hides the site's popup. Does it exist?
  • coldpie 1y ago
    uBlock Origin settings, enable the Cookie Banner and Annoyances filters.
• sebtron 1y ago
  Daily reminder that no law requires websites to show popups. They could simply stop tracking users. Your website will still work, trust me!
• lifeisstillgood 1y ago
  My 2c: actually it’s the problem of mixing security and identity mgmt with tracking and marketing The main reason I don’t turn off cookies everywhere is so many sites put my login token in a cookie. Hopefully as a random nonce but even so, it’s using cookies for security. We are all so used to it is a massive blind spot. We should move to Fido/webauthn - everywhere. Most all the population has a really impressive Secure Enclave in their pockets
  • Kbelicius 1y ago
    > The main reason I don’t turn off cookies everywhere is so many sites put my login token in a cookie. Hopefully as a random nonce but even so, it’s using cookies for security. AFAIK there is no need for a cookie banner for a login token. It is necessary for the functioning of the website.
    • lifeisstillgood 1y ago
      So my understanding is twofold here 1. The identity token (tracking cookie) is a unique number the 400 websites that have 1x1 pixels on the site dump on my browser. They don’t need to know I might be bob smith, Ford car owner, likes dogs and so on. But they want to so they can know if it’s worth bidding on an ad This is the egregious cookie. It’s mostly being replaced by the facebook cookie because hell there are only a couple of places running ad auctions but … 2. After I do actually verify I am Bob Smith, the session cookie arrives and is hilariously trusted for every request for the next 8 hours. The thing is we don’t do this for stuff we care about - like bank accounts. So presumably the total value of every site that uses session cookies is less than the amount in my checking account. Which says something …
• m00dy 1y ago
  lawmakers are mostly tech ignorant maybe that's why.
• ByteDrifter 1y ago
  Letting the browser handle cookie consent makes it feel like part of a privacy operating system.
• phendrenad2 1y ago
  We'll have to keep clicking cookie buttons as long as there are idiots who think that sites can "just" give up tracking (and go out of business because without targeting, internet ads are virtually worthless).
  • AlexandrB 1y ago
    > and go out of business because without targeting, internet ads are virtually worthless Good riddance to bad rubbish. I'll take an Internet 1/10th (or 1/100th (or 1/1000th)) the size as long as it's not ad-supported.
    • phendrenad2 1y ago
      You know HN is indirectly ad-supported, don't you?
      • deleted 1y ago
        [deleted]
• lunias 1y ago
  GDPR is pretty annoying for sure, a close second being websites that have as many ads as this one.
• wewxjfq 1y ago
  There can't be a blanket consent. You cannot consent to contracts you've never seen. You can't waive your rights away. Browsers could only implement a blanket deny, but that wouldn't stop websites from showing cookie banners, because they want you to click Accept All.
• the_sleaze_ 1y ago
  Cookies are now stickers with writing on them and computers are now cars. Businesses that you drive up to or close to have license to slap a sticker on you whenever they want with whatever they want. So we write a law to say "hey you gotta at least ask before you slap a sticker on, most of the time". We all know why we didn't just make a sticker proof car. As long as the largest ad company in the world is also the defacto king of the internet we will have these issues.
• calibas 1y ago
  I believe that part of why Google is so invested in Chrome is this very thing. They don't want users to have more control over cookies and tracking via the browser. One of the first things people would do if they really had control over their browsers is start blocking Google Ads. Google realized this early on, it's a huge potential threat to their main source of revenue, so they launched Chrome to influence, and eventually dominate, the browser market. Google doesn't want users to have more control when it threatens their bottom line. It's part of why they've been trying to block ad-blockers.
• NoSalt 1y ago
  > "2. It Punishes the Little Guys" Yeah ... I just don't do it. I'm not based in the UK or EU and I don't care if they try to "punish" me.
• charles_f 1y ago
  > Imagine if every time you got into your car, you had to manually approve the engine's use of oil, the tires' use of air, and the radio's use of electricity Metaphor is incorrect. Tracking you is not essential to the function of the website. A more appropriate one would be: > Imagine if everytime you got into your car, you had to approve or reject GM tracking your trip, the number of people in the car, recording your conversations, and sharing all of that with 500 indiscriminate partners including your insurance, law enforcement, supermarkets in the area, and why not your spouse or partner. Or better even > imagine if every time you entered a physical store they asked for your id and made you sign a contract that allows them to track you and sell that information The proposal in that article sets a default tracking preference, it's trying to fix a UX issue with more UX. What it's missing is that there's no EU mandated UX. You don't have to show a banner if your cookies are not used to track random people on your website. The reason why it's bad UX is that it's bad on purpose, skimming the line of legality by deploying as many dark patterns as possible to trick you into consenting to your soul and your children's, in a desperate attempt to make that god awful banner go away and finally access your shot of endorphins. Websites could very well decide to use only non tracking storage by default, and not show you a banner. Or have everything checked off with a single click to make the banner go away. Sending you to a separate page full of checkboxes and legalese is a choice, and a nefarious one, because most people don't want to be tracked. If anything I think the law should be strengthened: make tracking default-off, and allow users to consent to more if they so wish. Not consenting should be a single, obvious click (or no click at all), rather than a sub menu. Your information should not be shared or sold by default, or even better, not sellable at all.
• forgotmypw17 1y ago
  I've come up with an easy solution, which works almost all the time. When a cookie consent dialog interferes with me using the website, I close the tab and move on. I've found a high correlation between cookie consent notices and low-signal content, so this strategy has actually saved me a lot of time I would've spent reading/watching something that doesn't help me.
  • tonymet 1y ago
    How do you book airline tickets? Ir other critical business ? My doctors office has a cookie banner . Should I just stop going ?
    • hahn-kev 1y ago
      Yeah I agree, that sentiment works if you only consume content online. But for real stuff? Good luck
    • forgotmypw17 1y ago
      That's why I said "almost all of the time". But to the flights example, I was just looking for flights starting at Google Flights, which doesn't have cookie banners, and the two sites I went to for booking also did not have cookie banners.
      • SpicyLemonZest 1y ago
        Which booking website are you going to that doesn't have cookie banners? I spot checked multiple EU and US airlines just now (Ryanair, Air France, United, Alaska) and all of them had a cookie banner.
        • forgotmypw17 1y ago
          I started with Google Flights and went to two other sites that it directed me to. Just to reiterate, I'm not religious about this practice. If I need to click a cookie banner to book a plane ticket, so be it. I just treat cookie banners as a strong negative signal.
• tveyben 1y ago
  And this article is full of another failure of the internet - adds…
• 1vuio0pswjnm7 1y ago
  The annoyances are dependant in part on the software (browser) used I do not use a popular browser to make HTTP requests or to read HTML. I never see these annoyances. I don't store cookies except for HN and a few other exceptions. Nor do I run Javascript. The annoyances cited in the OP appear to be targeted at people who use certain web browsers that enable these "features" by default This demonstrates to me that the annoyances are in part contingent on the browser, e.g., browser "features" such as Javascript Perhaps convincing all www users to use the same small set of Silicon Valley-controlled browsers is prudent according to some Silicon Vallley logic. But when these browsers are all provided by commercial entities that profit from "advertising services" and each has "business" interests^1 that run counter to the interests of some www users,^2 then it makes sense for www users to consider alternatives 1. For example, data collection, surveillance and targeted advertising 2. Thereby prompting government regulation For example, it is possible to retreive information from websites, e.g. "check a product price or read an article", using software that does not not serve an internet advertising objective. No cookies or Javascript required
• loeg 1y ago
  The GDPR people want the banner noise to make you feel like cookies are bad. Without that, we would go back to the status quo from ~five years ago when websites just worked and did whatever with cookies, and there weren't stupid banners everywhere.
• Havoc 1y ago
  The whole debacle is a lesson in incentives. You can't have laws that dictate the desired outcome in broad terms and trust companies to implement in good faith. Not when they have a direct financial incentive to implement it as obtusely as possible. It's really unfortunately that in the public's eye the legislative attempt to steer towards a positive outcome is seen as the cause of the pain.
• overpoints 1y ago
  [dead]
• mrinterweb 1y ago
  This seems like a good opportunity for a browser company like Mozilla to offer a GDPR compliant library that is easy to integrate that automatically applies user privacy preferences instead of showing the GDPR prompt. Opensource the library, and promote it. Try to make it an open protocol so other browser can implement this. To be real though I'm sure that many sites would not want this because they rely on GDPR fatigue and users to just accept instead of taking a few seconds to opt-out.
• DocTomoe 1y ago
  But if we target only fifty browsers instead of five million websites, we cut ourselves off that sweet sweet punitive monies. it's much more lucrative for lawyers to have a 5-million-strong pool to sue rather than a 50-strong crew, which has significant money to pay lawyers of their own. Remember how many members of parliaments have a legal background. That's not a coincidence. It is safe to assume laws are deliberately written badly to create more work for their caste.
• secondcoming 1y ago
  The GPC flag is a setting in browsers that attempts to alleviate the cookie popup issue
• peter_d_sherman 1y ago
  >"Imagine if every time you got into your car, you had to manually approve the engine's use of oil, the tires' use of air, and the radio's use of electricity. It’s absurd, right? You’d set your preferences once, and the car would just work." This is an excellent analogy of the problem! >"Yet, that’s exactly what we do online. We are asked the same questions, by every single website, every single day. This approach is broken for three simple reasons: Consent Fatigue is Real: We're so bombarded with these requests that they’ve become meaningless. The banners are an obstacle to be cleared, not a choice to be considered. True consent requires a conscious, informed decision, not an exasperated click to get the pop-up out of the way." Consent Fatigue -- That phrase is going into my 2025 lexicon! I love it! (Well, the phrase itself, not what it stands for! You know, the words, not the meaning -- the symbol, not the referent! :-) ) Now I like the article's ideas and all (good ideas, very thought provoking, etc., etc.) -- but if cookie consent is delegated to people's browsers, then what if a court case comes up where someone is being sued for a cookie they agreed to, they're asked in court if they agreed to the cookie, and they respond with something like the following: "No Your Honor, I personally did not agree to that! The browser agreed to it! The browser is guilty, not me!" :-) (The same problem could occur outside of browsers, with AI's, if they are acting on behalf of someone... or chain of other AI's...) Anyway, great article!
• donperignon 1y ago
  Or simply stop tracking and selling user data… sell real services or native ads
• j45 1y ago
  Interesting idea. Regulating browsers could regulate a free and open internet though as well. Only permitted to use certain browsers that can do certain things.
• rayiner 1y ago
  The EU’s principal contribution to the web in a decade has been these shitty cookie popups.
  • deleted 1y ago
    [deleted]
• freehorse 1y ago
  I understand the point of convenience, and having discussions and changes on implementations is good, but there is a reason that the law targets websites and why the whole discussion is around websites rather than browsers: the websites (their servers) are those who actually collect the personal data. The law does not target browsers because the browsers (their companies or whatever) are not the data controllers in this case, the website owners are. Moreover, consent by law tends to need to be specific: you give consent for the specific purpose to the specific company. Of course there are and should be ways to convey denial of consent by "do not track" style headers, but I am not sure this can solve all the issues. I think blaming the law is bullshit. When a website throws a cookie popup obstructing you from using it, it is because they really want you to click on "accept all". There is no other reason to do this. It is terrible UX and not all websites do this. It is a totally conscious and intentional decision.
• janalsncm 1y ago
  At this point I’m wondering if “Deny All” and “Accept All” do the same thing on a lot of sites and it’s all too much of a mess to catch anyone. Yes, I know that breaking the law is illegal, but laws only matter insofar as they can be enforced and are enforced.
• juliangmp 1y ago
  Oh man I wonder what arguments will be presente- oh thats a banner for selling my data to advertisers I see
• account42 1y ago
  Internet's biggest annoyance: Idiots that still think data protection laws are only about one specific implementation of tracking (cookies) that can easily be blocked in the browser.
• croes 1y ago
  Internet‘s biggest annoyance? Websites with more ads than content, AI generated BS flooding the web, links to important information that don’t work anymore (thanks archive.org to help in that case most of the time).
• wseqyrku 1y ago
  If I dare suggesting a technical solution to a non-technical problem, I think this just shows a mismatch between how we design applications and something called requirements, broadly speaking. If this has become a subject of discourse, I think we should just write cookies off as a component to rely on and try to deal with that instead of fighting over where the annoyance should be placed. It's just bad design.
• dapperdrake 1y ago
  How do we help honest websites that avoid tracking compete better?