5 ms·

Europe's cookie nightmare is crumbling. EC wants preference at browser level

59 points by nopakos 11mo ago

Klaster_1 11mo ago
Related: https://news.ycombinator.com/item?id=45667866 https://news.ycombinator.com/item?id=45667866 Personally, I find this a move in the wrong direction where hostile behavior by websites is normalized and hidden. Cookie banners show web site true colors. When someone asks me to share data with a thousand of "partners", I leave.
- moritzwarhier 11mo ago
  I think I agree, at least until it's clear how exactly this should be implemented. Fingerprints can be shared with third parties without cookies, and while I know that the so-called "cookie law" is not really just about cookies, this is where the deception begins. For some reason, I think it's easier to force websites to list everyone they share data with, than to force them to comply with an invisible preference that says "don't share data". It even sounds as if this could be a trojan horse to dismantle parts of the GDPR altogether (see the DNT references in this thread...), and I happen to think that by and large, GDPR is good.
- thinkingtoilet 11mo ago
  I agree. I think it's one of those things that people complain about because other people complain about. You have to click a button. Wow. What an ordeal. The title of this thread used the term "nightmare". I would be thankful that my life is so wonderful that clicking a button is considered a "nightmare". It's transparent and if you don't like it, don't go to that site.
  - dylan604 11mo ago
    It's a nightmare because it is everywhere you turn, not because of the difficulty in dismissing the banner (although not all banners are made equally). But I'm pretty sure you're smart enough to realize you're intentionally making a strawman argument. It's the purpose of the argument I'm not sure.
    - thinkingtoilet 11mo ago
      It's on websites, not everywhere I turn. And it's very very very simple to deal with. At least it is for me.
      - dylan604 11mo ago
        ugh. of course I didn't mean at your local 7-11 or grocery market and quite clearly meant everywhere you turn online. pedantry is so boring
- plqbfbv 11mo ago
  > Personally, I find this a move in the wrong direction where hostile behavior by websites is normalized and hidden. Cookie banners show web site true colors. When someone asks me to share data with a thousand of "partners", I leave. I kind of agree, but at the same time basically all websites are using some kind of tracking to know what kind of users visit, and I'm tired of clicking "allow all" just to read an article. Many websites don't even work if you refuse non-essential trackers, because their tag manager is configured incorrectly, or because by law if there's even a single textbox where users can put their email or name, they need to have the consent to show that and allow input on it. Having a browser default of "nope" with the option to whitelist a broken website would save a ton of time for people and machines the same, and also reduce website latency a lot. There's a nice website that "tracks" this cost: https://cookiecost.eu/ https://cookiecost.eu/
  - pancsta 11mo ago
    > all websites are using some kind of tracking to know what kind of users visit Server side analytics exists, its the ad optimization and feeding data brokers which is the reason. You can disable cookies for google analytics (storage none).
pjc50 11mo ago
This was the correct decision and could have been made a decade ago. An .. institutional deficiency was trying to make the GDPR as completely general as possible rather than doing a technology mandate. But this had two consequences: bad actors could circumvent it, and good actors just trying to comply ended up horribly confused (e.g. is logging an IP address in an Apache log "personal data"?). DNT header. Legally binding. Out of the way of the end user. Unambiguous for enforcement purposes. Probably the end of targeted advertising, but that was always the logical conclusion of GDPR.
- chuckadams 11mo ago
  Cookie consent banners and such come from the ePrivacy Directive, not the GDPR. The banners themselves were never mandated, but lacking any other standardized opt-in signal, that's what everyone converged on anyway.
  - kevin_thibedeau 11mo ago
    To be clear, the other option was to respect privacy by default and comply with the GDPR without any banner.
    - chuckadams 11mo ago
      A lot of sites put up the banner even when they're not serving anything but "essential cookies", just as a CYA mechanism mandated by legal. And to some degree, I can see legal's point: the site might be just fine now, but you just know somewhere in the sausage-making process, someone's eventually going to toss in a dependency that brings in a tracker without clearing it first, and boom, exposure. Having a clear non-interactive signal that's legally recognized should go a long way toward clearing out those annoying banners.
- graemep 11mo ago
  I agree cookie banners were the wrong solution, and sometimes made things worse (it make a cookie whitelist extensions I used to use unusable because you have to allow the cookie that stores your cookie preferences). However, this bit concerns me: > This key change is part of a new Digital Package of proposals to simplify the EU’s digital rules, and will initially see cookie prompts change to be a simplified yes or no single-click prompt ahead of the “technological solutions” eventually coming to browsers. Websites will be required to respect cookie choices for at least six months, and the EU also wants website owners to not use cookie banners for “harmless uses” like counting website visits, to lessen the amount of pop-ups. That implies there will be "harmless tracking" allowed, and it removes choices. The latter might restrict dark patterns, but it might also encourage "allow all cookies or you cannot read the site at all" approaches.
avmich 11mo ago
> This is not a real choice made by citizens This is something which courts should consider more about other things, such as EULA and Terms and Conditions. Same reasons.
- MangoToupe 11mo ago
  Are EULAs even enforceable?
  - deafpolygon 11mo ago
    they are generally thought to be, but require litigation- which is a problem for the general population! corporations have enough money to tie you up in court with lawyers.
    - schnable 11mo ago
      People always say this, but are there any real examples of corporations extracting damages from EULA violations?
    - tialaramex 11mo ago
      It was a lot more plausible when it is likely the judge has never clicked past an EULA. Today unless you've dug up some archaic fossil the judge is perfectly familiar with this nonsense so you're in a position where the person who decides what the law is knows EULAs are bullshit nobody reads. I'd expect a situation like Somerset v Stewart. Mansfield clearly didn't want to rule you can't have slavery because that's going to be extremely disruptive to powerful people - so he suggests they settle and then the case goes away and he isn't called to say anything. But Stewart refuses to settle, apparently nobody could convince him that it's in his best interest - so, OK says Mansfield: fiat justitia, ruat cælum (Justice be done though the heavens fall). Somerset walks free. Are corporations relying on EULAs smart enough to take the L? I guess we'd see.
  - Tuna-Fish 11mo ago
    In the EU, it's complicated. There is a very clear law that forbids any additional contract terms post the point of sale, so that if you go to a store, purchase a box with software in it and then go home to install it, when it pops up a dialog for you to "agree" on, you can just ignore it, nothing in that is enforceable at all. And no, small print text on the box that says you have to agree to terms in the software does not change anything. But that's not how software is sold anymore. EULAs in general are not unenforceable, so long as they are presented before the sale. This is precisely why Steam (for example) now gives you the EULA before it lets you buy anything.
thrance 11mo ago
In the meantime, if you're browsing the web with uBlock Origin, you should definitely enable cookie list filters in Dashboard > Filter lists > Cookie Notices. Haven't seen a banner in ages.
- lol768 11mo ago
  This occasionally causes breakage though; because many cookie notices open up modal dialogs and disable scrolling.
- cpburns2009 11mo ago
  I've noticed more and more websites breaking from that. The page won't scroll and you can't interact with anything.
  - dylan604 11mo ago
    There have been times where I've been known to open up the dev tools to find the offending overflow:hidden rule. "I'll show you" mentality takes over some times.
- Mistletoe 11mo ago
  Thank you I didn’t know this.
zzzeek 11mo ago
yes. everyone install Cookie Auto Delete. the problem is a plugin like that would take out entire industries because it would basically end anonymous tracking cookies.
- deafpolygon 11mo ago
  They no longer track you by (only) cookies- the GPDR made sure of that. Fingerprinting is the current standard and there’s no easy way to block that.
  - tcfhgj 11mo ago
    The GDPR surely didn't have an influence on that. The GDPR is technologically agnostic about tracking. You don't accept, then no tracking either way.
  - disgruntledphd2 11mo ago
    > They no longer track you by (only) cookies- the GPDR made sure of that. Fingerprinting is the current standard and there’s no easy way to block that. Without consent, this is illegal, so if this is happening someone's gonna get sued and fined.
    - dylan604 11mo ago
      Don't hold your breath for that to happen though. Maybe in your grandkid's lifetime, but doubtful in yours.
      - disgruntledphd2 11mo ago
        > Don't hold your breath for that to happen though. Maybe in your grandkid's lifetime, but doubtful in yours. This is already happening. Now, could enforcement be better? Of course, but it's trending in the right direction.
  - troupo 11mo ago
    > the GPDR made sure of that wat. fingerprinting and cookiless tracking was a thing before GDPR. And GDPR literally talks about all forms of tracking, not just cookies. One would think you'd read at least something before having an opinion.
retube 11mo ago
LOL the EC mandarins have finally had enough of the endless nagging!
- nerdsniper 11mo ago
  What are "EC mandarins"? Google doesn't give me anything useful.
- croes 11mo ago
  The nagging which was done by the data collectors to blame the EC
elric 11mo ago
Much like the current cookie banner shitshow, a "centrally configured" setting which "websites must respect" will accomplish nothing. There is no consent, informed or otherwise. Advertisers and their ilk are still hoovering up all the data they can, with or without cookies or consent. Locking up a few people who don't respect their users' privacy would be a much more effective way of achieving actual results. AFAIK no big adtech or data brokers have been punished in any way.
- jack_tripper 11mo ago
  >Locking up a few people who don't respect their users' privacy would be a much more effective way of achieving actual results. AFAIK no big adtech or data brokers have been punished in any way. I'm a big fan of personal accountability in the corporate world.
- general1465 11mo ago
  Only thing that actually worked against advertisers is ad blocker. Everything else made them laugh.
- nicbou 11mo ago
  Me telling you that I don't want to be tracked, no matter what your argument is, is as informed as it gets. You just don't like the answer so you feel entitled to ask again.
- Thorrez 11mo ago
  You can't lock people up if they're not doing anything illegal. The first step is to write a law making what they're doing illegal. Then if they keep doing it, you'll be able to lock them up.
  - troupo 11mo ago
    Companies shipped illegal cookie banners that forced you to click every individual provider to opt-out. No one went to jail: https://noyb.eu/en/where-did-all-reject-buttons-come https://noyb.eu/en/where-did-all-reject-buttons-come
sunshine-o 11mo ago
> says the EU. “This will drastically simplify users’ online experience.” They are proudly removing the annoyance they mandated 7 tears ago. Do we have to congratulate them?
- troupo 11mo ago
  None of that annoyance was mandated by the EU. Curious how no one blames the industry which just needs to store your precise geolocation data for 12 years: https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541
a4n 11mo ago
[dead]
mimsee 11mo ago
IMO there isn't a cookie nightmare but rather a tracking nightmare. I'm not fully up-to-date on if there is a separate EU directive on cookies on the internet specifically, but the GDPR is the _General_ Data Protection Regulation. Meaning that if I go and collect your info on pen and paper, I must then ask your permission on how I process and share that data, especially if sharing that data is not necessary to complete the main transaction but is somehow done auxiliary to the main purpose. (e.g. I buy a pillow online, my info is used to target ads for me.) GDPR itself doesn't require consent for functional cookies. For example, Apple.com does not have a cookie consent box _at all_. On tracking specifically, I feel there are at least two levels. One that happens in-browser by third party companies. These are your classic advertisements. The other is more first-party backend-heavy. These would be your local grocery store using your purchase history linked to your membership card and using that data to create analytics and targeted ads etc. So creating a browser setting would likely not toggle all tracking away, just the ones that are "annoying" while browsing.
- layer8 11mo ago
  There is no legislation on cookies. The legislation is on tracking, or more generally, personal data collection. It doesn’t matter if websites use cookies or other means for those purposes.
troupo 11mo ago
"Europe's cookie nightmare" has nothing to do with Europe and everything to do with companies assuming that they have god-given right to all your data in perpetuity. Things like "precise location information stored for 12 years": https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541 Europe literally said: we're not going to force specific tech decisions on you. All we ask is to let people opt-in if they want to be tracked. What we got is "we care about your privacy, we're sending all your data to 15000 partners" from the industry. To people crying "but this should've been mandated as a browser setting": Which world's largest advertising company has dominating browser marketshare and subsumes all web standards committees? What exactly prevented that company to come up with a browser setting that isn't "we sell your data by default and use dark patterns to trick you to agree" https://x.com/dmitriid/status/1664682689591377923 https://x.com/dmitriid/status/1664682689591377923? Our industry is shit, and we blame governments for regulations that ... assume that industries shouldn't be shit. There's literally no need for EU to regulate browser settings. And yet here we are.
- deleted 11mo ago
  [deleted]
kotaKat 11mo ago
So… Do Not Track 2.0? https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track
- lostmsu 11mo ago
  It's still 1.x, but this time legally enforced (hopefully).
aswegs8 11mo ago
EU! EU! EU!
Devasta 11mo ago
Just ban individually targeted advertising and be done with it.
- IlikeKitties 11mo ago
  When the Digital Services/Markets Act was written this was actually considered. But there's also companies that surveil your browsing data and sell that for other purposes not just advertisement. Market Research and such. I'd have been for a blanket ban though. Sadly, this is mostly a matter of not enforcing the GDPR enough. Things such as "data minimization" and the erosion of "technically necessary" already should protect us. Instead the Business Community chose malicious compliance on a vast scale and the data protection agencies did nothing.
  - IAmBroom 11mo ago
    > But there's also companies that surveil your browsing data and sell that for other purposes not just advertisement. Market Research and such. Market research is only "not just advertisement" by an artificial distinction. Walmart isn't preparing data for a non-profit research group's benefit.
BoppreH 11mo ago
I like the cookie law as a sort of 4D chess move. Step 1: force websites to add an opt-out flow for privacy-minded users. Step 2: websites don't complain too much because they can implement it in obnoxious and dark-pattern-laden ways, so that few users actually opt-out. Step 3: now that websites have proven there's no technical barrier and the flows are already implemented, slowly retire unnecessary user tracking and data sharing. I'd be surprised if this was planned ahead of time, but it's not a bad strategy.
alkonaut 11mo ago
Users will overwhelmingly use browsers in vanilla config. The question here will be how browser vendors show this option. If - say - a company that gives away a browser for free but makes money from ads designed this, then they'll hide the option deep in some obscure menu, never remind people it exists, and reset it on every update. So the devil is in the details. The best option I think isn't a secret setting in a browser, but a standardized consent dialog. Basically the sites communicate to the browser a standardized data format for consent. Then the browser shows that query in a popup that looks the same for every site. That means 1) the sites no longer have a chance to do dark patterns 2) it's less confusing for end users since the UX is always the same 3) it allows users to check a "Automatically reject for all sites". The site should not know whether the user has auto-rejected this, or manually rejected it. There should be no option to automatically consent for all sites (Can't have that). So the only ergonomic choice is to set it to auto reject. Having this "use this choice (reject) for all sites" is the really important part here. Because it means that ALL users of ALL browsers will quickly see this choice, so in short order a huge chunk of users will have made this permanent rejection choice.
- troupo 11mo ago
  > The question here will be how browser vendors show this option. We know exactly how. Here's Google presenting "more private web". If you click "yes, I'm in", all the tracking options will be turned on: https://x.com/dmitriid/status/1664682689591377923 https://x.com/dmitriid/status/1664682689591377923 And of course HN (and the industry at large, and journalists) will blame it on "clueless bureaucrats writing regulations"
- layer8 11mo ago
  Since tracking is not legal without informed consent, either browsers will be mandated to default to no tracking, or to display a choice on first use. Silently defaulting to tracking certainly won’t be an option, given the whole GDPR and e-Privacy framework.
- Yizahi 11mo ago
  Dialog is already standardized in the current GDPR. There is literally an item there which states that Reject consent option should be the same and equally easily accessible as Accept consent option. So basically all dark pattern sites are already criminals. The problem is zero enforcement of the GDPR.
stickfigure 11mo ago
Here's my proposal: * Let websites do whatever they want with cookies/local storage. * Let browsers delete them as often as they want. * Make other kinds of fingerprinting illegal.
- dylan604 11mo ago
  > * Make other kinds of fingerprinting illegal. Speeding is illegal. Controlled substances are illegal. Murder is illegal. Embezzlement is illegal. Driving in a school zone while using a mobile device is illegal. Has the legality stopped any of it?
  - monerozcash 11mo ago
    >Has the legality stopped any of it? I'd suggest that illegality has in fact stopped most of it. We'd surely have many times as many murders if it was legal to murder people.
  - IAmBroom 11mo ago
    False dichotomy. Correct question: Has legality hindered any of it? (Yes.)
    - dylan604 11mo ago
      Hindered, but not eliminated. It is not a panacea. As long as people are willing to flaunt laws, laws are not the ultimate solution. The main reason here is that your laws are regional. Someone operating outside the jurisdiction of said law feels not obligation to obey said law, nor feel fear of punishment of said law.
      - array_key_first 11mo ago
        I don't recall anyone saying, ever, anywhere, that laws are a panacea. I don't think that means though that we should stop doing laws. No... I like laws. They're nice, for the most part.
- 11mo ago
damnitbuilds 11mo ago
We need clear, direct punishments based on %revenue for websites not taking "NO!" for an answer. Don't fucking rush, you useless bureaucrats. "A mix of European legislation has resulted in cookie notices that use dark patterns to nudge people into accepting online tracking. And regulators aren’t taking strong action" Wired, 20/5/2020: https://www.wired.com/story/gdpr-cookie-consent-eprivacy/ https://www.wired.com/story/gdpr-cookie-consent-eprivacy/
Yizahi 11mo ago
It wasn't a "Europe's" nightmare, it was website's nightmare. There is literally no legitimate reason to collect and store PII in excess of allowed by GDPR. No data harvesting - no cookie banners absolutely legally.
lofaszvanitt 11mo ago
Thank you. My fucking idea implemented. YEA! https://news.ycombinator.com/item?id=33262369 https://news.ycombinator.com/item?id=33262369
dang 11mo ago
Related ongoing thread: Europe is scaling back GDPR and relaxing AI laws - https://news.ycombinator.com/item?id=45980117 https://news.ycombinator.com/item?id=45980117 - Nov 2025 (60 comments)
deleted 11mo ago
[deleted]

59 points by nopakos 11mo ago

Related: https://news.ycombinator.com/item?id=45667866 https://news.ycombinator.com/item?id=45667866 Personally, I find this a move in the wrong direction where hostile behavior by websites is normalized and hidden. Cookie banners show web site true colors. When someone asks me to share data with a thousand of "partners", I leave.

moritzwarhier 11mo ago
I think I agree, at least until it's clear how exactly this should be implemented. Fingerprints can be shared with third parties without cookies, and while I know that the so-called "cookie law" is not really just about cookies, this is where the deception begins. For some reason, I think it's easier to force websites to list everyone they share data with, than to force them to comply with an invisible preference that says "don't share data". It even sounds as if this could be a trojan horse to dismantle parts of the GDPR altogether (see the DNT references in this thread...), and I happen to think that by and large, GDPR is good.
thinkingtoilet 11mo ago
I agree. I think it's one of those things that people complain about because other people complain about. You have to click a button. Wow. What an ordeal. The title of this thread used the term "nightmare". I would be thankful that my life is so wonderful that clicking a button is considered a "nightmare". It's transparent and if you don't like it, don't go to that site.
- dylan604 11mo ago
  It's a nightmare because it is everywhere you turn, not because of the difficulty in dismissing the banner (although not all banners are made equally). But I'm pretty sure you're smart enough to realize you're intentionally making a strawman argument. It's the purpose of the argument I'm not sure.
  - thinkingtoilet 11mo ago
    It's on websites, not everywhere I turn. And it's very very very simple to deal with. At least it is for me.
    - dylan604 11mo ago
      ugh. of course I didn't mean at your local 7-11 or grocery market and quite clearly meant everywhere you turn online. pedantry is so boring
plqbfbv 11mo ago
> Personally, I find this a move in the wrong direction where hostile behavior by websites is normalized and hidden. Cookie banners show web site true colors. When someone asks me to share data with a thousand of "partners", I leave. I kind of agree, but at the same time basically all websites are using some kind of tracking to know what kind of users visit, and I'm tired of clicking "allow all" just to read an article. Many websites don't even work if you refuse non-essential trackers, because their tag manager is configured incorrectly, or because by law if there's even a single textbox where users can put their email or name, they need to have the consent to show that and allow input on it. Having a browser default of "nope" with the option to whitelist a broken website would save a ton of time for people and machines the same, and also reduce website latency a lot. There's a nice website that "tracks" this cost: https://cookiecost.eu/ https://cookiecost.eu/
- pancsta 11mo ago
  > all websites are using some kind of tracking to know what kind of users visit Server side analytics exists, its the ad optimization and feeding data brokers which is the reason. You can disable cookies for google analytics (storage none).

pjc50 11mo ago

This was the correct decision and could have been made a decade ago. An .. institutional deficiency was trying to make the GDPR as completely general as possible rather than doing a technology mandate. But this had two consequences: bad actors could circumvent it, and good actors just trying to comply ended up horribly confused (e.g. is logging an IP address in an Apache log "personal data"?). DNT header. Legally binding. Out of the way of the end user. Unambiguous for enforcement purposes. Probably the end of targeted advertising, but that was always the logical conclusion of GDPR.

chuckadams 11mo ago
Cookie consent banners and such come from the ePrivacy Directive, not the GDPR. The banners themselves were never mandated, but lacking any other standardized opt-in signal, that's what everyone converged on anyway.
- kevin_thibedeau 11mo ago
  To be clear, the other option was to respect privacy by default and comply with the GDPR without any banner.
  - chuckadams 11mo ago
    A lot of sites put up the banner even when they're not serving anything but "essential cookies", just as a CYA mechanism mandated by legal. And to some degree, I can see legal's point: the site might be just fine now, but you just know somewhere in the sausage-making process, someone's eventually going to toss in a dependency that brings in a tracker without clearing it first, and boom, exposure. Having a clear non-interactive signal that's legally recognized should go a long way toward clearing out those annoying banners.
graemep 11mo ago
I agree cookie banners were the wrong solution, and sometimes made things worse (it make a cookie whitelist extensions I used to use unusable because you have to allow the cookie that stores your cookie preferences). However, this bit concerns me: > This key change is part of a new Digital Package of proposals to simplify the EU’s digital rules, and will initially see cookie prompts change to be a simplified yes or no single-click prompt ahead of the “technological solutions” eventually coming to browsers. Websites will be required to respect cookie choices for at least six months, and the EU also wants website owners to not use cookie banners for “harmless uses” like counting website visits, to lessen the amount of pop-ups. That implies there will be "harmless tracking" allowed, and it removes choices. The latter might restrict dark patterns, but it might also encourage "allow all cookies or you cannot read the site at all" approaches.

avmich 11mo ago

> This is not a real choice made by citizens This is something which courts should consider more about other things, such as EULA and Terms and Conditions. Same reasons.

MangoToupe 11mo ago
Are EULAs even enforceable?
- deafpolygon 11mo ago
  they are generally thought to be, but require litigation- which is a problem for the general population! corporations have enough money to tie you up in court with lawyers.
  - schnable 11mo ago
    People always say this, but are there any real examples of corporations extracting damages from EULA violations?
  - tialaramex 11mo ago
    It was a lot more plausible when it is likely the judge has never clicked past an EULA. Today unless you've dug up some archaic fossil the judge is perfectly familiar with this nonsense so you're in a position where the person who decides what the law is knows EULAs are bullshit nobody reads. I'd expect a situation like Somerset v Stewart. Mansfield clearly didn't want to rule you can't have slavery because that's going to be extremely disruptive to powerful people - so he suggests they settle and then the case goes away and he isn't called to say anything. But Stewart refuses to settle, apparently nobody could convince him that it's in his best interest - so, OK says Mansfield: fiat justitia, ruat cælum (Justice be done though the heavens fall). Somerset walks free. Are corporations relying on EULAs smart enough to take the L? I guess we'd see.
- Tuna-Fish 11mo ago
  In the EU, it's complicated. There is a very clear law that forbids any additional contract terms post the point of sale, so that if you go to a store, purchase a box with software in it and then go home to install it, when it pops up a dialog for you to "agree" on, you can just ignore it, nothing in that is enforceable at all. And no, small print text on the box that says you have to agree to terms in the software does not change anything. But that's not how software is sold anymore. EULAs in general are not unenforceable, so long as they are presented before the sale. This is precisely why Steam (for example) now gives you the EULA before it lets you buy anything.

thrance 11mo ago

In the meantime, if you're browsing the web with uBlock Origin, you should definitely enable cookie list filters in Dashboard > Filter lists > Cookie Notices. Haven't seen a banner in ages.

lol768 11mo ago
This occasionally causes breakage though; because many cookie notices open up modal dialogs and disable scrolling.
cpburns2009 11mo ago
I've noticed more and more websites breaking from that. The page won't scroll and you can't interact with anything.
- dylan604 11mo ago
  There have been times where I've been known to open up the dev tools to find the offending overflow:hidden rule. "I'll show you" mentality takes over some times.
Mistletoe 11mo ago
Thank you I didn’t know this.

zzzeek 11mo ago

yes. everyone install Cookie Auto Delete. the problem is a plugin like that would take out entire industries because it would basically end anonymous tracking cookies.

deafpolygon 11mo ago
They no longer track you by (only) cookies- the GPDR made sure of that. Fingerprinting is the current standard and there’s no easy way to block that.
- tcfhgj 11mo ago
  The GDPR surely didn't have an influence on that. The GDPR is technologically agnostic about tracking. You don't accept, then no tracking either way.
- disgruntledphd2 11mo ago
  > They no longer track you by (only) cookies- the GPDR made sure of that. Fingerprinting is the current standard and there’s no easy way to block that. Without consent, this is illegal, so if this is happening someone's gonna get sued and fined.
  - dylan604 11mo ago
    Don't hold your breath for that to happen though. Maybe in your grandkid's lifetime, but doubtful in yours.
    - disgruntledphd2 11mo ago
      > Don't hold your breath for that to happen though. Maybe in your grandkid's lifetime, but doubtful in yours. This is already happening. Now, could enforcement be better? Of course, but it's trending in the right direction.
- troupo 11mo ago
  > the GPDR made sure of that wat. fingerprinting and cookiless tracking was a thing before GDPR. And GDPR literally talks about all forms of tracking, not just cookies. One would think you'd read at least something before having an opinion.

retube 11mo ago

LOL the EC mandarins have finally had enough of the endless nagging!

nerdsniper 11mo ago
What are "EC mandarins"? Google doesn't give me anything useful.
croes 11mo ago
The nagging which was done by the data collectors to blame the EC

elric 11mo ago

Much like the current cookie banner shitshow, a "centrally configured" setting which "websites must respect" will accomplish nothing. There is no consent, informed or otherwise. Advertisers and their ilk are still hoovering up all the data they can, with or without cookies or consent. Locking up a few people who don't respect their users' privacy would be a much more effective way of achieving actual results. AFAIK no big adtech or data brokers have been punished in any way.

jack_tripper 11mo ago
>Locking up a few people who don't respect their users' privacy would be a much more effective way of achieving actual results. AFAIK no big adtech or data brokers have been punished in any way. I'm a big fan of personal accountability in the corporate world.
general1465 11mo ago
Only thing that actually worked against advertisers is ad blocker. Everything else made them laugh.
nicbou 11mo ago
Me telling you that I don't want to be tracked, no matter what your argument is, is as informed as it gets. You just don't like the answer so you feel entitled to ask again.
Thorrez 11mo ago
You can't lock people up if they're not doing anything illegal. The first step is to write a law making what they're doing illegal. Then if they keep doing it, you'll be able to lock them up.
- troupo 11mo ago
  Companies shipped illegal cookie banners that forced you to click every individual provider to opt-out. No one went to jail: https://noyb.eu/en/where-did-all-reject-buttons-come https://noyb.eu/en/where-did-all-reject-buttons-come

sunshine-o 11mo ago

> says the EU. “This will drastically simplify users’ online experience.” They are proudly removing the annoyance they mandated 7 tears ago. Do we have to congratulate them?

troupo 11mo ago
None of that annoyance was mandated by the EU. Curious how no one blames the industry which just needs to store your precise geolocation data for 12 years: https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541

a4n 11mo ago

[dead]

mimsee 11mo ago

IMO there isn't a cookie nightmare but rather a tracking nightmare. I'm not fully up-to-date on if there is a separate EU directive on cookies on the internet specifically, but the GDPR is the _General_ Data Protection Regulation. Meaning that if I go and collect your info on pen and paper, I must then ask your permission on how I process and share that data, especially if sharing that data is not necessary to complete the main transaction but is somehow done auxiliary to the main purpose. (e.g. I buy a pillow online, my info is used to target ads for me.) GDPR itself doesn't require consent for functional cookies. For example, Apple.com does not have a cookie consent box _at all_. On tracking specifically, I feel there are at least two levels. One that happens in-browser by third party companies. These are your classic advertisements. The other is more first-party backend-heavy. These would be your local grocery store using your purchase history linked to your membership card and using that data to create analytics and targeted ads etc. So creating a browser setting would likely not toggle all tracking away, just the ones that are "annoying" while browsing.

layer8 11mo ago
There is no legislation on cookies. The legislation is on tracking, or more generally, personal data collection. It doesn’t matter if websites use cookies or other means for those purposes.

troupo 11mo ago

"Europe's cookie nightmare" has nothing to do with Europe and everything to do with companies assuming that they have god-given right to all your data in perpetuity. Things like "precise location information stored for 12 years": https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541 Europe literally said: we're not going to force specific tech decisions on you. All we ask is to let people opt-in if they want to be tracked. What we got is "we care about your privacy, we're sending all your data to 15000 partners" from the industry. To people crying "but this should've been mandated as a browser setting": Which world's largest advertising company has dominating browser marketshare and subsumes all web standards committees? What exactly prevented that company to come up with a browser setting that isn't "we sell your data by default and use dark patterns to trick you to agree" https://x.com/dmitriid/status/1664682689591377923 https://x.com/dmitriid/status/1664682689591377923? Our industry is shit, and we blame governments for regulations that ... assume that industries shouldn't be shit. There's literally no need for EU to regulate browser settings. And yet here we are.

deleted 11mo ago
[deleted]

kotaKat 11mo ago

So… Do Not Track 2.0? https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track

lostmsu 11mo ago
It's still 1.x, but this time legally enforced (hopefully).

aswegs8 11mo ago

EU! EU! EU!

Devasta 11mo ago

Just ban individually targeted advertising and be done with it.

IlikeKitties 11mo ago
When the Digital Services/Markets Act was written this was actually considered. But there's also companies that surveil your browsing data and sell that for other purposes not just advertisement. Market Research and such. I'd have been for a blanket ban though. Sadly, this is mostly a matter of not enforcing the GDPR enough. Things such as "data minimization" and the erosion of "technically necessary" already should protect us. Instead the Business Community chose malicious compliance on a vast scale and the data protection agencies did nothing.
- IAmBroom 11mo ago
  > But there's also companies that surveil your browsing data and sell that for other purposes not just advertisement. Market Research and such. Market research is only "not just advertisement" by an artificial distinction. Walmart isn't preparing data for a non-profit research group's benefit.

BoppreH 11mo ago

I like the cookie law as a sort of 4D chess move. Step 1: force websites to add an opt-out flow for privacy-minded users. Step 2: websites don't complain too much because they can implement it in obnoxious and dark-pattern-laden ways, so that few users actually opt-out. Step 3: now that websites have proven there's no technical barrier and the flows are already implemented, slowly retire unnecessary user tracking and data sharing. I'd be surprised if this was planned ahead of time, but it's not a bad strategy.

alkonaut 11mo ago

Users will overwhelmingly use browsers in vanilla config. The question here will be how browser vendors show this option. If - say - a company that gives away a browser for free but makes money from ads designed this, then they'll hide the option deep in some obscure menu, never remind people it exists, and reset it on every update. So the devil is in the details. The best option I think isn't a secret setting in a browser, but a standardized consent dialog. Basically the sites communicate to the browser a standardized data format for consent. Then the browser shows that query in a popup that looks the same for every site. That means 1) the sites no longer have a chance to do dark patterns 2) it's less confusing for end users since the UX is always the same 3) it allows users to check a "Automatically reject for all sites". The site should not know whether the user has auto-rejected this, or manually rejected it. There should be no option to automatically consent for all sites (Can't have that). So the only ergonomic choice is to set it to auto reject. Having this "use this choice (reject) for all sites" is the really important part here. Because it means that ALL users of ALL browsers will quickly see this choice, so in short order a huge chunk of users will have made this permanent rejection choice.

troupo 11mo ago
> The question here will be how browser vendors show this option. We know exactly how. Here's Google presenting "more private web". If you click "yes, I'm in", all the tracking options will be turned on: https://x.com/dmitriid/status/1664682689591377923 https://x.com/dmitriid/status/1664682689591377923 And of course HN (and the industry at large, and journalists) will blame it on "clueless bureaucrats writing regulations"
layer8 11mo ago
Since tracking is not legal without informed consent, either browsers will be mandated to default to no tracking, or to display a choice on first use. Silently defaulting to tracking certainly won’t be an option, given the whole GDPR and e-Privacy framework.
Yizahi 11mo ago
Dialog is already standardized in the current GDPR. There is literally an item there which states that Reject consent option should be the same and equally easily accessible as Accept consent option. So basically all dark pattern sites are already criminals. The problem is zero enforcement of the GDPR.

stickfigure 11mo ago

Here's my proposal: * Let websites do whatever they want with cookies/local storage. * Let browsers delete them as often as they want. * Make other kinds of fingerprinting illegal.

dylan604 11mo ago
> * Make other kinds of fingerprinting illegal. Speeding is illegal. Controlled substances are illegal. Murder is illegal. Embezzlement is illegal. Driving in a school zone while using a mobile device is illegal. Has the legality stopped any of it?
- monerozcash 11mo ago
  >Has the legality stopped any of it? I'd suggest that illegality has in fact stopped most of it. We'd surely have many times as many murders if it was legal to murder people.
- IAmBroom 11mo ago
  False dichotomy. Correct question: Has legality hindered any of it? (Yes.)
  - dylan604 11mo ago
    Hindered, but not eliminated. It is not a panacea. As long as people are willing to flaunt laws, laws are not the ultimate solution. The main reason here is that your laws are regional. Someone operating outside the jurisdiction of said law feels not obligation to obey said law, nor feel fear of punishment of said law.
    - array_key_first 11mo ago
      I don't recall anyone saying, ever, anywhere, that laws are a panacea. I don't think that means though that we should stop doing laws. No... I like laws. They're nice, for the most part.
11mo ago

damnitbuilds 11mo ago

We need clear, direct punishments based on %revenue for websites not taking "NO!" for an answer. Don't fucking rush, you useless bureaucrats. "A mix of European legislation has resulted in cookie notices that use dark patterns to nudge people into accepting online tracking. And regulators aren’t taking strong action" Wired, 20/5/2020: https://www.wired.com/story/gdpr-cookie-consent-eprivacy/ https://www.wired.com/story/gdpr-cookie-consent-eprivacy/

Yizahi 11mo ago

It wasn't a "Europe's" nightmare, it was website's nightmare. There is literally no legitimate reason to collect and store PII in excess of allowed by GDPR. No data harvesting - no cookie banners absolutely legally.

lofaszvanitt 11mo ago

Thank you. My fucking idea implemented. YEA! https://news.ycombinator.com/item?id=33262369 https://news.ycombinator.com/item?id=33262369

dang 11mo ago

Related ongoing thread: Europe is scaling back GDPR and relaxing AI laws - https://news.ycombinator.com/item?id=45980117 https://news.ycombinator.com/item?id=45980117 - Nov 2025 (60 comments)

deleted 11mo ago

[deleted]