4 ms·

That cookie banner needs to be standardized and offered by the browser. It should be like a certificate popup. Why is every website forced into doing a shoddy j

by lenkite 11mo ago

That cookie banner needs to be standardized and offered by the browser. It should be like a certificate popup. Why is every website forced into doing a shoddy job ?

what 11mo ago
How would that even work? The browser has no way to know what a cookie is for.
- vilhelm_s 11mo ago
  They are regulating websites anyway, surely they can just invent some standard format to say what function each cookie has. How about requiring that the name of every cookie has to start with one of "Strictly Necessary", "Functional", "Performance", and "Targeting/Advertising"?
- will4274 11mo ago
  It's not the tech that's hard. https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep/0205.html https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep...
DavideNL 11mo ago
Aren’t tracking cookies mostly irrelevant nowadays, because every browser can be uniquely fingerprinted anyway?
- sdoering 11mo ago
  Fingerprinting is actually covered by the regulations and needs to be "consented" to. There are different regulations, but basically they are technology agnostic (a good thing). If you as a compnay want to use data that could theoretically be used as an identifyer for me, you need my consent. For any type of use. Except if it is absolutely necessary to provide the basic service. Or if we have a contractual relationship, but there are also protective rules in place to protect the customer. Different regulations handle storing data (like cookies, but also local/session storage and similar things on the devices of your users. But those are separate from GDPR. GDPR is - as said - only concerned with data that could be theoretically linked to me as an individual. Regardless what this data is. Could be an id in a cookie, could be a fingerprint, could be smoke signals. It could even be the combination of different data points, that taken together allow for an identification. Theoretical example: Imagine I live in a village with 500 people. The company tracks the location and that I am male (so roughtly 50% of the population), that I am between 45 - 50 (say about 10% of the population), have multiple cats (say maybe only three people now in that village, use a Linux based machine - bingo: You found me. And now you have a set of data that falls under the GDPR. Welcome in having to ensure you only use this data in a way that I gave consent to. See: The law doesn't even just look at marketing or tracking data. Or what happens in an app or a browser. It covers all data that is either pointing ti me as an "ID" - like a cookie ID, or at personal identifiable data - like bei combination in my example.
- Tarq0n 11mo ago
  No. The regulation is about processing your personal information, cookies are just an implementation detail.
- Aaargh20318 11mo ago
  The law doesn't even mention cookies. This is a common misunderstanding and causes a lot of annoyance as I've seen websites ask for permission to store cookies even when they don't need explicit permission. The law only concerns itself with tracking. If you don't use a mechanism to uniquely identify people over multiple visits and/or websites, you're fine. You can store simple preferences in a cookie without asking. No need to bother your users with a cookie wall for that.
WA 11mo ago
I assume it's because a business has different ideas about what to collect from their users and users are more or less willing to share some data with some specific businesses. Hence, every business needs their own consent rules. The fact that this is achieved with a cookie banner for 99,9% of all businesses is a side-effect. Could there be a better solution? Probably. But the law and the incentives aligned to cookie banner hell.
- 1718627440 11mo ago
  > Probably. But the law and the incentives aligned to cookie banner hell. Most cookie banners are non-compliant, so I doubt that.
Cthulhu_ 11mo ago
They aren't forced, they choose to. They're forced to get user permission before tracking them across websites and sharing info with 3rd parties, but how they do it is left up to the industry. And the industry chose dark patterns, hoping to annoy the users into complaining to the EU about them.
- fluoridation 11mo ago
  It is the fault of the EU. If you leave a steak on the floor you don't punish the dog for eating it. Site operators just chose to do what was most convenient for them within the boundaries of the law, as would you.
rs186 11mo ago
I mean, websites don't need to use non-functional cookies in the first place. If they use it, they have to declare it. It's a problem created by website owners themselves. GitHub doesn't have a cookie banner: https://github.blog/news-insights/company-news/no-cookie-for-you/ https://github.blog/news-insights/company-news/no-cookie-for... That said, looks like what you asked is happening: https://www.macrumors.com/2025/11/19/europe-gdpr-cookie-changes/ https://www.macrumors.com/2025/11/19/europe-gdpr-cookie-chan...
dgb23 11mo ago
We had a do-not-track header that has been deprecated. Simply enforcing the header legally and having it on by default would suffice and it would be much easier to test, because it's not bespoke from the client side of things.
Aaargh20318 11mo ago
> That cookie banner needs to be standardized and offered by the browser. That's actually part of these changes. It's mentioned in the linked article about halfway down.

by lenkite 11mo ago

That cookie banner needs to be standardized and offered by the browser. It should be like a certificate popup. Why is every website forced into doing a shoddy job ?

what 11mo ago

How would that even work? The browser has no way to know what a cookie is for.

vilhelm_s 11mo ago
They are regulating websites anyway, surely they can just invent some standard format to say what function each cookie has. How about requiring that the name of every cookie has to start with one of "Strictly Necessary", "Functional", "Performance", and "Targeting/Advertising"?
will4274 11mo ago
It's not the tech that's hard. https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep/0205.html https://lists.w3.org/Archives/Public/ietf-http-wg/2024JulSep...

DavideNL 11mo ago

Aren’t tracking cookies mostly irrelevant nowadays, because every browser can be uniquely fingerprinted anyway?

sdoering 11mo ago
Fingerprinting is actually covered by the regulations and needs to be "consented" to. There are different regulations, but basically they are technology agnostic (a good thing). If you as a compnay want to use data that could theoretically be used as an identifyer for me, you need my consent. For any type of use. Except if it is absolutely necessary to provide the basic service. Or if we have a contractual relationship, but there are also protective rules in place to protect the customer. Different regulations handle storing data (like cookies, but also local/session storage and similar things on the devices of your users. But those are separate from GDPR. GDPR is - as said - only concerned with data that could be theoretically linked to me as an individual. Regardless what this data is. Could be an id in a cookie, could be a fingerprint, could be smoke signals. It could even be the combination of different data points, that taken together allow for an identification. Theoretical example: Imagine I live in a village with 500 people. The company tracks the location and that I am male (so roughtly 50% of the population), that I am between 45 - 50 (say about 10% of the population), have multiple cats (say maybe only three people now in that village, use a Linux based machine - bingo: You found me. And now you have a set of data that falls under the GDPR. Welcome in having to ensure you only use this data in a way that I gave consent to. See: The law doesn't even just look at marketing or tracking data. Or what happens in an app or a browser. It covers all data that is either pointing ti me as an "ID" - like a cookie ID, or at personal identifiable data - like bei combination in my example.
Tarq0n 11mo ago
No. The regulation is about processing your personal information, cookies are just an implementation detail.
Aaargh20318 11mo ago
The law doesn't even mention cookies. This is a common misunderstanding and causes a lot of annoyance as I've seen websites ask for permission to store cookies even when they don't need explicit permission. The law only concerns itself with tracking. If you don't use a mechanism to uniquely identify people over multiple visits and/or websites, you're fine. You can store simple preferences in a cookie without asking. No need to bother your users with a cookie wall for that.

WA 11mo ago

I assume it's because a business has different ideas about what to collect from their users and users are more or less willing to share some data with some specific businesses. Hence, every business needs their own consent rules. The fact that this is achieved with a cookie banner for 99,9% of all businesses is a side-effect. Could there be a better solution? Probably. But the law and the incentives aligned to cookie banner hell.

1718627440 11mo ago
> Probably. But the law and the incentives aligned to cookie banner hell. Most cookie banners are non-compliant, so I doubt that.

Cthulhu_ 11mo ago

They aren't forced, they choose to. They're forced to get user permission before tracking them across websites and sharing info with 3rd parties, but how they do it is left up to the industry. And the industry chose dark patterns, hoping to annoy the users into complaining to the EU about them.

fluoridation 11mo ago
It is the fault of the EU. If you leave a steak on the floor you don't punish the dog for eating it. Site operators just chose to do what was most convenient for them within the boundaries of the law, as would you.

rs186 11mo ago

I mean, websites don't need to use non-functional cookies in the first place. If they use it, they have to declare it. It's a problem created by website owners themselves. GitHub doesn't have a cookie banner: https://github.blog/news-insights/company-news/no-cookie-for-you/ https://github.blog/news-insights/company-news/no-cookie-for... That said, looks like what you asked is happening: https://www.macrumors.com/2025/11/19/europe-gdpr-cookie-changes/ https://www.macrumors.com/2025/11/19/europe-gdpr-cookie-chan...

dgb23 11mo ago

We had a do-not-track header that has been deprecated. Simply enforcing the header legally and having it on by default would suffice and it would be much easier to test, because it's not bespoke from the client side of things.

Aaargh20318 11mo ago

> That cookie banner needs to be standardized and offered by the browser. That's actually part of these changes. It's mentioned in the linked article about halfway down.