15 ms·
> One change that’s likely to please almost everyone is a reduction in Europe’s ubiquitous cookie banners and pop-ups. Under the new proposal, some “non-risk” c
by schnitzelstoat 11mo ago
> One change that’s likely to please almost everyone is a reduction in Europe’s ubiquitous cookie banners and pop-ups. Under the new proposal, some “non-risk” cookies won’t trigger pop-ups at all, and users would be able to control others from central browser controls that apply to websites broadly.
Finally!
- aurareturn 11mo agoSo they finally admit that it was a mistake. Even EU government websites had annoying giant cookie banners. Yet, some how the vast majority of HN comments defend the cookie banners saying if you don't do anything "bad" then you don't need the banners.
- m00dy 11mo agoworst implementation ever. I bet it is the reason that most people are now taking anti depressants.
- basisword 11mo agoIt worked to highlight the insane amount of tracking every fucking website does. Unfortunately it didn’t stop it. A browser setting letting me reject everything by default will be a better implementation. But this implementation only failed because almost every website owner wants to track your every move and share those moves with about 50 different other trackers and doesn’t want to be better.
- GardenLetter27 11mo agoYou can just set your browser not to send whichever cookies you don't want to. Cookies are a client-side technology. Why does the government need to be involved?
- webstrand 11mo agoNot all cookies are bad for the user, for instance the one that keeps you logged in or stores the session id. Those kind were never banned in the first place. Blocking cookies locally doesn't allow you to easily discriminate between tracking and functional cookies. And even if the browser had a UI for accepting or rejecting each cookie, they're not named such that a normal user could figure out which are important for not breaking the website, and which are just for tracking purposes. By passing a law that says "website providers must disambiguate" this situation can be improved.
- layer8 11mo agoThe website wouldn’t inform you about which cookies are doing what. You wouldn’t have a basis to decide on which cookies you want because they are useful versus which you don’t because they track you. You also wouldn’t be informed when functional cookies suddenly turn into tracking cookies a week later. The whole point of the consent popups is to inform the user about what is going on. Without legislation, you wouldn’t get that information.
- stavros 11mo agoBecause it's not like the browser has two thousand cookies per website, it only has one and then they share your data with the two thousand partners server-side. The government absolutely needs to be involved.
- immibis 11mo agoActually it often is a separate cookie per tracker because that's convenient for the trackers. But the only reason they don't put in the effort to do it the way you said is that browsers don't have the feature to block individual cookies. If they did, they would.
- 1718627440 11mo agoSome browsers like Midori do the sensible thing and ask you for every cookie, whether you actually want to have it. Cookie dialogs are then entirely redundant. You can click accept all in the website, and reject all in the browser.
- immibis 11mo agoWhich is presumably the reason nobody uses Midori
- 1718627440 11mo agoI liked it. The reason I don't use it is because it doesn't support modern JS heavy websites.
- AnthonyMouse 11mo agoTo begin with that isn't true, because the worst offenders are third party cookies, since they can track the user between websites, but then you can block them independently of the first party cookies. Then you have the problem that if they are using a single cookie, you now can't block it because you need it to be set so it stops showing you the damn cookie banner every time, but meanwhile there is no good way for the user or the government to be able to tell what they're doing with the data on the back end anyway. So now you have to let them set the cookie and hope they're not breaking a law where it's hard to detect violations, instead of blocking the cookie on every site where it has no apparent utility to you. But the real question is, why does this have anything to do with cookies to begin with? If you want to ban data sharing or whatever then who cares whether it involves cookies or not? If they set a cookie and sell your data that's bad but if they're fingerprinting your browser and do it then it's all good? Sometimes laws are dumb simply because the people drafting them were bad at it.
- rebolek 11mo agoOf course, let ME decide if I want to keep fdfhfiudva=dsaafndsafndsoai and remove cindijcasndiuv=fwíáqfewjfoi. I know best what those cookies do!
- eitau_1 11mo agoIf there's no regulation, nothing stops a website from telling hundreds of third-party entities about your visit. No amount of fiddling with browser settings and extensions will prevent a keen website operator from contributing to tracking you (at least on ip/household level) by colluding with data brokers via the back-end.
- troupo 11mo agoBecause it's not about cookies. Ad trackers shouldn't store my precise geolocation for 12 years for example: https://x.com/dmitriid/status/1817122117093056541 https://x.com/dmitriid/status/1817122117093056541
- fmbb 11mo ago50 is not even close. Those banners often list up to 3000 ”partners”.
- graemep 11mo agoThe cookie law made this worse. I used to use an extension that let me whitelist which sites could set cookies (which was pretty much those I wanted to login to). I had to stop using it because I had to allow the cookie preference cookies on too many sites.
- immibis 11mo agoThere could be an extension to block the banners, too. I think uBO has a feature to block certain CSS classes?
- graemep 11mo agoThe only thing that works well for me is using an extension that automatically gives permissions and another that auto deletes cookies when i close the tab. The problem with Ublock etc. is that just blocking breaks quite a lot of sites.
- whstl 11mo agouBlock blocks most of those for me lately.
- pessimizer 11mo agoYou can fix that. I use an extension called "I don't care about cookies" that clicks "yes" to all cookies on all websites, and I use another extension* that doesn't allow any cookies to be set unless I whitelist the site, and I can do this finely even e.g. to the point where I accept a cookie from one page to get to the next page, then drop it, and drop the entire site from even that whitelist when I leave the page, setting this all with a couple of clicks. * Sadly the second is unmaintained, and lets localStorage stuff through. There are other extensions that have to be called in (I still need to hide referers and other things anyway.) https://addons.mozilla.org/en-US/firefox/addon/forget_me_not/ https://addons.mozilla.org/en-US/firefox/addon/forget_me_not.... I have the simultaneous desire to take the extension over or fork it, and the desire not to get more involved with the sinking ship which is Firefox. Especially with the way they treat extension developers. https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... does a similar thing.
- youngtaff 11mo agoCookie banners are made obtrusive by the people running CMPs as they want to make it as hard as possible to stop collecting the data
- Mountain_Skies 11mo agoFunny thing is that I often will go out of my way to find the least permissive settings if the banner is obnoxious or has a dark pattern.
- LogicFailsMe 11mo agoevery accusation is a confession you see...
- legitster 11mo ago> Yet, some how the vast majority of HN comments defend the cookie banners saying if you don't do anything "bad" then you don't need the banners. There are a LOT of shades of gray when it comes to website tracking and HN commenters refuse to deal with nuance. Imagine running a store, and then I ask you how many customers you had yesterday and what they are looking at. "I don't watch the visitors - it's unnecessary and invasive". When in fact, having a general idea what your customers are looking for or doing in your store is pretty essential for running your business. Obviously, this is different than taking the customer's picture and trading it with the store across the street. When it comes to websites and cookie use, the GDPR treated both behaviors identically.
- pseudalopex 11mo ago> Imagine running a store, and then I ask you how many customers you had yesterday and what they are looking at. Server logs can provide this information.
- legitster 11mo agoNot for the amount of stuff on the web now that is client-side rendered.
- pseudalopex 11mo agoClient side rendering means in practice clicking a product retrieves JSON and images instead of HTML and images. This can be logged.
- crazygringo 11mo agoOnly in very simple ways. Realistically, you want to know things like, how many users who looked at something made a purchase in the next 3 days? Is that going up or down after a recent change we made? Many necessary business analytics require tracking and aggregating the behavior of individual users. You can't do that with server logs.
- 11mo ago
- croes 11mo ago> if you don't do anything "bad" then you don't need the banners. Because that’s how it is. For instance why does a site need to share my data with over 1000 "partners“? And the EU uses the same tracking and website frameworks as others so they got banners automatically. It wasn’t a mistake but website providers maliciously complied with the banners to shift the blame. Seems you fell for it.
- jonesjohnson 11mo agothe issue was never the law. the issue were the 100s of tracking cookies and that websites would use dark patterns or simply not offer a "no to all" button at all (which is against the law, btw.) Most websites do. not. need. cookies. It's all about tracking and surveillance to show you different prices on airbnb and booking.com to maximise their profits. https://noyb.eu/en/project/cookie-banners https://noyb.eu/en/project/cookie-banners (edit: link)
- rpastuszak 11mo agoI'm not sure why this is being downvoted?
- zdragnar 11mo agoThe premise is that the intent of the law was good, so everyone should naturally change their behavior to obey the spirit of the law. That isn't how people work. The law was poorly written and even more poorly enforced. Attempts at "compliance" made the web browsing experience worse.
- norman784 11mo agoThe implementors of the banners did it in the most annoying way, so most users will just accept all instead of rejecting all (because the button to reject all was hidden or not there at all), check steam store for example their banner is non intrusive and you can clearly reject or accept all in one click.
- nemomarx 11mo agopeople intentionally made the banners annoying or tried to make the reject button smaller / more awkward so that they could keep tracking. Definitely a failure of enforcement, but let's not pretend that was good faith compliance from operators either
- masfuerte 11mo agoI'd settle for companies obeying the letter of the law. They don't do that either.
- amelius 11mo agoCan we get the do-not-track header instead? https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track Because that made more sense than the cookie banner ever did. Edit: it looks like there is a legal alternative now: Global Privacy Control.
- stavros 11mo agoInstead of what? Instead of the central browser controls?
- weberer 11mo ago>Instead of what? Instead of a different cookie pop-up on every single site you visit >Instead of the central browser controls? This is the central browser control. The header is how the browser communicates it to the websites.
- stavros 11mo agoThis very article is about how we're getting a central browser control, and your comment was "can we finally get a central browser control instead?".
- phendrenad2 11mo agoWell, it's a minor details hidden in the middle of the article, I also missed it.
- dang 11mo agoRelated ongoing thread: Europe's cookie nightmare is crumbling. EC wants preference at browser level - https://news.ycombinator.com/item?id=45979527 https://news.ycombinator.com/item?id=45979527 - Nov 2025 (80 comments)
- wkat4242 11mo agoThe cookie thing sounds good at first but then it shows that they rant to reduce cookiewalls by making more things ok without asking :(
- nightpool 11mo agoYes. I don't think you should have to show a popup to track the user's language preferences, whether they want a header toggled on or off, or other such harmless preferences. Yet, the EU ePrivacy directive (separately from the GDPR) really does require popups to inform users of these "cookies".
- deleted 11mo ago[deleted]
- wkat4242 11mo agoNo it doesn't. A website's own preferences fall under the 'necessary for site functionality" exception. Besides how many sites actually have this as the only reason for cookies? Every time I get a new cookie banner I check it and there's always lots of data shared with "trusted partners". Even sites of companies that purely make money off their own products and services and shouldn't need to sell data. Businesses are just addicted to it. The only provision I like is that they may only ask once every 6 months. However personally I wish that they'd make it a requirement to honour the do not track flag and never ask anything in that case. The common argument that browsers turn it on by default doesn't matter in the EU because tracking should be opt-in here anyway so this is expected behaviour. The browsers would quickly bring the flag back if it actually serves a purpose. I'll keep blocking all ads and tracking anyway.
- shaky-carrousel 11mo agoThat's the real news. There's no U turn, no weakening of GDPR. This article is propaganda.
- hdgvhicv 11mo agoThose “cookie banners” are nonsense aimed at getting this outcome. This is a loss for European citizens and small businesses and a win for the trillion dollar ecosystem of data abuse.
- immibis 11mo agoThere's the confusion about whether ePD (which is all cookies even functional ones) was superseded by GDPR or whether it wasn't and both rules apply. Personally I think common sense is that GDPR replaced ePD or at least its cookie banner rule, but I'm also not a company with billions of euros to sue.
- nonethewiser 11mo agoHow can you comply with the current requirements without cookie banners? Why would EU governments use cookie banners if they are just nonsense meant to degrade approval of GDPR?
- BadBadJellyBean 11mo agoBy not putting a billion trackers on your site and also by not using dark patterns. The idea was a simple yes or no. It became: "yes or click through these 1000 trackers" or "yes or pay". The problem is that it became normal to just collect and hoard data about everyone.
- tantalor 11mo ago> billion trackers ... dark patterns Straw man argument. The rule equally applies to sites with just one tracker and no dark patterns.
- nonethewiser 11mo agoAgain, then why does the EU do this? Clearly its not simply about erroding confidence in GDPR if the EU is literally doing it themselves. Besides, you seem to be confusing something. GDPR requires explicit explanation of each cookie, including these 1000s of trackers. It in no way bans these. This is just GDPR working as intended - some people want to have 1000s of trackers and GDPR makes them explain each one with a permission. Maybe it would be nice to not have so many trackers. Maybe the EU should ban trackers. Maybe consumers should care about granular cookie permissions and stop using websites that have 1000s of them because its annoying as fuck. But some companies do prefer to have these trackers and it is required by GDPR to confront the user with the details and a control.
- croes 11mo agoNon-risk cookies never required a banner.
- port11 11mo agoTruly non-risk cookies were already exempt from the cookie banner. In fact, the obnoxious consent-forcing cookie banners are themselves in violation of the law. It's ironic that instead of enforcement we dumb it all down for the data grabbers. And most of them non-European to boot, so clearly this is amazing for the EU tech ecosystem.
- theoldgreybeard 11mo agojokes on them i never followed the law anyway
- goobatrooba 11mo agoThe funny part is that many banners are already now not required. But there has been much propaganda by adtech around it, to rule people up against tracking protections and promote their own "solutions". That's the reason you see the same 3-5 cookie banners all around the web. Already today websites that use purely technical cookies would not actually not need any banners at all.
- buzzert 11mo agoWhy do European government websites do the same thing then? They’re also spreading propaganda?
- IshKebab 11mo agoI will believe this when I see it.
- sensanaty 11mo agoI'm convinced there's a psyop on this site when it comes to GDPR, and I'm only half-joking. If people would bother to read those intrusive banners, they'd notice that their info is being harvested and shared with hundreds, even thousands of "partners". In what universe is this something we should be okay with? Why exactly does some random ecommerce site need to harvest my data and share it with a bajillion "partners" of theirs? Why are we okay with that? I hate that the psychotic data harvesting assholes behind all these dark patterns emerged victorious by just straight up lying to people and deluding them into thinking GDPR was the issue, and not them and their shitty dark pattern banners