Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Shouldn't web browsers ask us before storing cookies?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#51

Post by simpss »

ChrisSD wrote: post #35
jopsen wrote: post #20

Earlier quoted context omitted.

> I'd like to point out that GDPR compliant sites don't need to ask permission for strictly necessary cookies. That's also my interpretation. If you use cookies for session state, authorization, then it's no problem. The problem is that every website decided that they needed to track users. Or that asking for permission would minimize liability.

Even with tracking you merely need a privacy policy in a place users can find. It's considered implied consent to continue using a site if the site makes a reasonable effort to make you aware that such a policy exists. However, what counts as reasonable hasn't been explicitly defined. The UK government considers it fine to use a header that automatically disappears after awhile (i.e. no need to click "ok"). But other…

no such thing as implied consent in GDPR.

Here are the conditions for consent: https://gdpr-info.eu/art-7-gdpr/

Most sites don't adhere to that at all as there's pretty much no way to "not agree", which means they can not rely on consent as a legal basis for processing PII.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#52

Post by jakemor »

DoubleGlazing wrote: post #25

It would be almost impossible to enforce. Publishers have a point of contact, an address or a hosting company, some sort of physical place where you can find whoever is in charge of the site. In other words, somewhere to send legal documents and summonses should a government wish to pursue legal action. This is only partly true for web browsers. Google, Mozilla and Microsoft have addresses. But what all the browsers…

> More to the point, if a law is passed that says "all browsers must do X,Y and Z". How to you enforce that in a world where open source is so prevalent?

Easier to enforce it on browsers than EVERY SINGLE website that uses cookies for tracking, no?

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#53

Post by TheCoelacanth »

jakemor wrote: post #50
neilobremski wrote: post #16

I agree that "this law is hurting the web" but I don't see how shifting that from the website to the application is going to solve the root issue. Prompts like these are annoying speed bumps that I have a hard time believing are in anyway effective -- paranoid people already deeply evaluate the software and services they use whereas the casual user is likely to just to "yah yah, get this out of my face" click it.

If you tell the website “no don’t track me” it can’t even remember not to track you (because doing so would be tracking you!) so they have to ask every time. If you tell the browser no, it would just block the site from storing any info in the browser. It would ask you once only the first time you visit a site, and you can change it whenever in the toolbar. Problem solved, no?

> If you tell the website “no don’t track me” it can’t even remember not to track you (because doing so would be tracking you!) so they have to ask every time.

That is absolutely not true.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#54

Post by TheCoelacanth »

gingerlime wrote: post #19
Nextgrid wrote: post #13

The GDPR consent prompts are less about technicalities (are you using cookies or local storage) and more about giving the side permission to stalk you no matter what method they use. The real problem here is the lack of enforcement of the regulations. The majority of GDPR consent prompts are obnoxious because they aren't actually compliant - compliant ones are much more pleasant. See this comment I just posted on ano…

I honestly can’t figure out how these popups became so prevalent. They’re so obviously not compliant not just with the fine print of GDPR but with its spirit. Even if you’re completely cynical about being compliant with GDPR I would imagine that not having popups like that at all is more compliant or less likely to get you in trouble than having those flagrantly-non-compliant ones...

It basically the "I don't have to be faster than the bear, I just have to be faster than you" principle in action.

GDPR violations are so ubiquitous that regulators can't possibly go after all of them.

As long as you aren't a particularly juicy target and are doing the same things that everyone else is to pretend to follow GDPR, you probably aren't going to be among the first enforcement targets.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#55

Post by kd5bjo »

simpss wrote: post #51
ChrisSD wrote: post #35

Earlier quoted context omitted.

Even with tracking you merely need a privacy policy in a place users can find. It's considered implied consent to continue using a site if the site makes a reasonable effort to make you aware that such a policy exists. However, what counts as reasonable hasn't been explicitly defined. The UK government considers it fine to use a header that automatically disappears after awhile (i.e. no need to click "ok"). But other…

no such thing as implied consent in GDPR. Here are the conditions for consent: https://gdpr-info.eu/art-7-gdpr/ Most sites don't adhere to that at all as there's pretty much no way to "not agree", which means they can not rely on consent as a legal basis for processing PII.

I feel it's important to note that, although implied consent doesn't mean anything in a GDPR context, consent isn't necessarily required at all. It's only one of 6 different justifications a business can use to show their activities are legitimate: https://gdpr-info.eu/art-6-gdpr/

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#56

Post by kd5bjo »

TheCoelacanth wrote: post #54
gingerlime wrote: post #19

Earlier quoted context omitted.

I honestly can’t figure out how these popups became so prevalent. They’re so obviously not compliant not just with the fine print of GDPR but with its spirit. Even if you’re completely cynical about being compliant with GDPR I would imagine that not having popups like that at all is more compliant or less likely to get you in trouble than having those flagrantly-non-compliant ones...

It basically the "I don't have to be faster than the bear, I just have to be faster than you" principle in action. GDPR violations are so ubiquitous that regulators can't possibly go after all of them. As long as you aren't a particularly juicy target and are doing the same things that everyone else is to pretend to follow GDPR, you probably aren't going to be among the first enforcement targets.

There's also some cargo-cult legal reasoning going on as well, I think: instead of paying a lawyer to read the new law and tell you what you actually need to do, simply do whatever you see everyone else doing and assume it's fine.

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#57

Post by Macha »

kd5bjo wrote: post #55
simpss wrote: post #51

Earlier quoted context omitted.

no such thing as implied consent in GDPR. Here are the conditions for consent: https://gdpr-info.eu/art-7-gdpr/ Most sites don't adhere to that at all as there's pretty much no way to "not agree", which means they can not rely on consent as a legal basis for processing PII.

I feel it's important to note that, although implied consent doesn't mean anything in a GDPR context, consent isn't necessarily required at all. It's only one of 6 different justifications a business can use to show their activities are legitimate: https://gdpr-info.eu/art-6-gdpr/

And they all have their own stipulations. Contract requires that the data is needed to perform your part of the contract, legitimate interests requires documentation proving you do need the data and weighed the risks to users

Re: Ask HN: Shouldn't web browsers ask us before storing cookies?

#60

Post by dynom »

Your suggestion makes a lot of good sense. Cookies aren't the real threat though. Surely cookies are used for both wanted and unwanted tracking. Passive tracking however (fingerprinting of any form) will remain the threat we can't block and we won't know is happening.

If we add a mechanism to allow the OS to handle cookies, bypassing possible untrusty browser vendors. We won't solve much and create a false expectation, while (arguably) break more than we fix.

This doesn't mean we shouldn't, but if a method is found, it should include a significantly more comprehensive form of anonymity.

--2 cents

Post reply on HN