4 ms·

Browser level consent primitives would be a significant improvement on the status quo.

by shadowgovt 11mo ago

recursive 11mo ago
Do Not Track was a spectacular failure. You can still turn cookies off in your user agent though.
- lenerdenator 11mo ago
  It was a spectacular failure because the people who thought of it didn't stick to it.
  - bigfatkitten 11mo ago
    In no small part because the people who thought of it (the browser makers) had a powerful commercial incentive to ditch it, because they are funded by advertising.
    - pseudalopex 11mo ago
      Microsoft enabled Do Not Track by default. Advertisers said they would ignore it for this reason. Most of them never respected it. Apple removed it from Safari years later because it was used for tracking. Mozilla removed it from Firefox years after Safari. Chrome has it even now.
      - shadowgovt 11mo ago
        > Advertisers said they would ignore it for this reason That was the missed opportunity. Had the EU stepped in and said "I'm sorry, the user expressed explicit intent to not be tracked and you're planning to ignore that? How about that's a fine?" it would have survived. But they weren't prepped to take action yet.
        pseudalopex 11mo ago
        Microsoft made the user expressed intent and the user expressed no opinion look the same.
        K0nserv 11mo ago
        That doesn't track (pun not intended). It's a binary state so either side has to be the default, they just changed which side the default fell on. Prior to the change no opinion expressed and expressed intent (in favour of tracking) still looked the same.
        int_19h 11mo ago
        Microsoft made the default be, well, the default preference - what most users would set this setting to if they had to look. That's a good and sensible default. The only reason why the advertisers were so unhappy about it is because what they do is neither good nor sensible by most people's standards.
        hnbad 11mo ago
        I'm sorry but the word is "consent" not "intent" and that's literally how consent works. If I (a complete stranger to you) walk up to you and kiss you on the lips, it doesn't make a difference whether you're wearing a t-shirt informing everyone you don't want strangers to kiss you on the lips or not - I don't have any basis on which I can presume to have obtained your consent so I'd still be violating your rights. This is very much a "tech bros don't understand consent" case: if you do something without consent, you better have a damn good reason other than "but it's good for meeee" (or "good for my bottom line"). "My business model depends on it" also isn't a good justification - there are plenty of business models that depend on things that are unquestionably illegal, we just refer to them as "criminal enterprises" rather than "disruptive startups".
        abigail95 11mo ago
        DNT headers are equivalent to those email signatures that pretend to be a legal document. You're just spamming the server with extra crap that does nothing and means nothing. Actually it's worse, DNT headers are like posting a wall of text on facebook saying you do not consent to them using your images or posts for some purpose. Track doesn't have a consistent definition across contexts, to regulate this you would have to fix it to something - what are your suggestions? DNT and the "deny optional" that foamed its way out of the GDPR aren't quite the same thing, and even if they are, it will take many court cases and years of time to figure that out. If you have a better write on regulation lets hear it.
  - recursive 11mo ago
    I don't think so. It was conceived on the user agent side AFAIK. The publishers decided not to honor it. At that point, there's not much point to keeping it on the UA side.
d-lisp 11mo ago
I second this; I have never been "into" these problematics and as a user I generally just disallow everything I can, which can be a pain (I mean I do want to often don't store anything when I'm browsing the web, which leads to meeting a lot of "cookie banners"). While there are probably browser extensions that can perform the automatic opt-out, it would be nice if browsers provided an API as an unified and centralized way to communicate consentment as a set of privilege access to different browser features and APIs (you could e.g. forbid the use of canvas, or even JS entirely). But that's only a small part of a huge legal frame, and as I said I don't know much about these problematics.

Browser level consent primitives would be a significant improvement on the status quo.

recursive 11mo ago

Do Not Track was a spectacular failure. You can still turn cookies off in your user agent though.

lenerdenator 11mo ago
It was a spectacular failure because the people who thought of it didn't stick to it.
- bigfatkitten 11mo ago
  In no small part because the people who thought of it (the browser makers) had a powerful commercial incentive to ditch it, because they are funded by advertising.
  - pseudalopex 11mo ago
    Microsoft enabled Do Not Track by default. Advertisers said they would ignore it for this reason. Most of them never respected it. Apple removed it from Safari years later because it was used for tracking. Mozilla removed it from Firefox years after Safari. Chrome has it even now.
    - shadowgovt 11mo ago
      > Advertisers said they would ignore it for this reason That was the missed opportunity. Had the EU stepped in and said "I'm sorry, the user expressed explicit intent to not be tracked and you're planning to ignore that? How about that's a fine?" it would have survived. But they weren't prepped to take action yet.
      - pseudalopex 11mo ago
        Microsoft made the user expressed intent and the user expressed no opinion look the same.
        K0nserv 11mo ago
        That doesn't track (pun not intended). It's a binary state so either side has to be the default, they just changed which side the default fell on. Prior to the change no opinion expressed and expressed intent (in favour of tracking) still looked the same.
        int_19h 11mo ago
        Microsoft made the default be, well, the default preference - what most users would set this setting to if they had to look. That's a good and sensible default. The only reason why the advertisers were so unhappy about it is because what they do is neither good nor sensible by most people's standards.
        hnbad 11mo ago
        I'm sorry but the word is "consent" not "intent" and that's literally how consent works. If I (a complete stranger to you) walk up to you and kiss you on the lips, it doesn't make a difference whether you're wearing a t-shirt informing everyone you don't want strangers to kiss you on the lips or not - I don't have any basis on which I can presume to have obtained your consent so I'd still be violating your rights. This is very much a "tech bros don't understand consent" case: if you do something without consent, you better have a damn good reason other than "but it's good for meeee" (or "good for my bottom line"). "My business model depends on it" also isn't a good justification - there are plenty of business models that depend on things that are unquestionably illegal, we just refer to them as "criminal enterprises" rather than "disruptive startups".
      - abigail95 11mo ago
        DNT headers are equivalent to those email signatures that pretend to be a legal document. You're just spamming the server with extra crap that does nothing and means nothing. Actually it's worse, DNT headers are like posting a wall of text on facebook saying you do not consent to them using your images or posts for some purpose. Track doesn't have a consistent definition across contexts, to regulate this you would have to fix it to something - what are your suggestions? DNT and the "deny optional" that foamed its way out of the GDPR aren't quite the same thing, and even if they are, it will take many court cases and years of time to figure that out. If you have a better write on regulation lets hear it.
- recursive 11mo ago
  I don't think so. It was conceived on the user agent side AFAIK. The publishers decided not to honor it. At that point, there's not much point to keeping it on the UA side.

d-lisp 11mo ago

I second this; I have never been "into" these problematics and as a user I generally just disallow everything I can, which can be a pain (I mean I do want to often don't store anything when I'm browsing the web, which leads to meeting a lot of "cookie banners"). While there are probably browser extensions that can perform the automatic opt-out, it would be nice if browsers provided an API as an unified and centralized way to communicate consentment as a set of privilege access to different browser features and APIs (you could e.g. forbid the use of canvas, or even JS entirely). But that's only a small part of a huge legal frame, and as I said I don't know much about these problematics.