Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New browser signal could make cookie banners obsolete

dataprotectioncontrol.org

Post reply on HN
Print view View original

101–110 of 269 posts

Re: New browser signal could make cookie banners obsolete

#101

Post by mgkimsal »

in the 90s, we had a 'big cookie' scare. and laws were threatened (or passed?). And... MUCH of this came down to ... managing cookies (or other browser state) was (and is) largely so damn hidden behind layers of configs, menus and options.

We have a home button. We have forward and back. We have 'bookmark' buttons, which many people understand. A big 'COOKIE' button, on the main browser UI, that clearly show cookie info, with a big "GET RID OF ALL COOKIES" trashcan button right there.... that would have prevented 90+% of the scare and legislation efforts from the start.

I looked for "clear my cookies" - in 2021, it's still click '3 dots' or something else, then click something, then click something, then confirm. https://its.uiowa.edu/support/article/719

"But there's so much nuance - I want to keep some, and not others, etc".

We didn't have this many choices in 1998. My point is giving a big honking "get rid of it all" back then would have changed the trajectory of the entire discussion. It still might.

I've lived through 2 decades of having to deal with support people trying to help users "clear your cache" or "reset your cookies". "Private mode" does help to a degree, assuming you're dealing with somewhat tech-savvy folks.

Re: New browser signal could make cookie banners obsolete

#102

Post by samjmck »

quotemstr wrote: post #99
jakub_g wrote: post #66

Earlier quoted context omitted.

At least in France, there's CNIL (Commission Nationale de l'Informatique et des Libertés) that started going after the top non-compliant websites and sending love letters like "you have N days to become compliant". [1] https://www.cnil.fr/en/home

And then Europeans complain when the rest of the world geoblocks them.

No one's complaining about not being able to access shitty websites that can't be arsed to make clear which companies are tracking you.

Re: New browser signal could make cookie banners obsolete

#103

Post by leokennis »

pornel wrote: post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

This exactly. This is also why I never feel "ashamed" when sites ask me to please disable my ad blocker because when I block ads they'll go out of business. Or why I'll always decline even "user respecting" ads on sites.

We're fighting the ad and tracking industry here, the internet equivalent of a gang member with a shiv and a length of pipe. I'm not going to fight nicely. I'll deny you any chance and any method I get.

Re: New browser signal could make cookie banners obsolete

#104

Post by galgalesh »

belorn wrote: post #22
worldsayshi wrote: post #14

Earlier quoted context omitted.

Unless regulators force companies to respect automated protocols.

The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. The rest of the industry followed. Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.

> but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive.

This is not the case. The fines are up to 2% of annual global turnover. This scares companies.

Moreover, some of the worst offending cookie banners are slowly being replaced by better ones as more and more organizations (such as noyb) file official complaints and companies get fined.

Re: New browser signal could make cookie banners obsolete

#105

Post by eastendguy »

pornel wrote: post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

"They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed."

Once in a while I read/learn something new at HN that changes my perspective on things. This sentence is such an example.

Re: New browser signal could make cookie banners obsolete

#106

Post by akie »

Dayshine wrote: post #83
7952 wrote: post #46

Earlier quoted context omitted.

I have been building some sites where I have explicitly tried to remove or avoid cookies completely. It is really tricky as any third party script or embed can set cookies, which may be retained depending on browser version. We end up using generic cookie prompts just in case to appease corporate compliance even when nothing is usually set on the page. And the http nature of cookies make automating things much more d…

Why avoid cookies entirely? You don't need a cookie banner for cookies essential to the functioning of your site.

You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner.

It's also significantly easier to convince a lawyer that you don't need these things if you can prove that there are no cookies whatsoever. And even then they'll be suspicious.

It's harder than it looks, just embedding a YouTube video for example already sets third-party cookies. Same with embedding a Twitter feed or Google Analytics. There are solutions for all of these things, but the standard/easy way of doing these things means your user gets a third-party cookie, which means you need the banner.

Re: New browser signal could make cookie banners obsolete

#107

Post by delfinom »

virgilp wrote: post #55
belorn wrote: post #22

Earlier quoted context omitted.

The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. The rest of the industry followed. Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.

I mean, a good first step would be to start fining companies 2% of the revenue. Especially Google. And then maybe automate the GDPR fines, because it's definitely possible to identify that a site puts up a non-compliant banner. No need to add the threat of jail time, _especially_ if it isn't enforced.

2% of revenue while stalling the GDPR process and taking it to court for 10 years makes it only 0.2% ;)

Re: New browser signal could make cookie banners obsolete

#108

Post by quotemstr »

Santosh83 wrote: post #100
quotemstr wrote: post #92

Earlier quoted context omitted.

But privacy laws are pointless and should be repealed. All this noise about cookie privacy, fingerprinting, FLoC, tracking, etc. --- what are the actual harms that make these things bad? Has anyone in the real world ever experienced a concrete harm arising from interest targeting? Doubtful. The EU privacy regime imposes a heavy regulatory burden in exchange for nothing. Information is a non-rivalrous good. Further li…

Information is power. The more information about more people with more depth to the graph is amassed by Big Tech and 3-letter agencies, the more soft power is accrued over large groups of people, economies, processes and even nations. And this ability is currently asymmetric. While Big Tech and Big Govt knows nearly everything about everybody, ordinary citizens are denied data and transparency. And even if the data m…

> The more information about more people with more depth to the graph is amassed by Big Tech and 3-letter agencies, the more soft power is accrued over large groups of people, economies, processes and even nations.

Is there any evidence that Big Tech and Big Government are actually controlling people by tagging them in some database (which no human actually inspects) as being interested in hiking gear and cookie recipes? Give me a break.

What you've described isn't a concrete harm, but an emotion --- specifically, fear. Lots of fears are baseless. So is this one. We shouldn't organize society around the baseless fears of tiny vocal minorities.

Re: New browser signal could make cookie banners obsolete

#109

Post by akie »

oftenwrong wrote: post #82
hnarn wrote: post #24

The most frustrating thing about these cookie banners (more like cookie lightboxes) is that almost none of them are compliant with the rules. Unfortunately I don't have time to find the source right now, but I'm pretty sure I've read official EU guidance docs clearly stating that many "dark patterns" are simply illegal. For example making the "Accept all cookies" button require less effort than only accepting necessa…

Instead of permitting sites to request consent of the user directly, they should be required to request consent via an official EU site. It could work like an authorisation redirect flow. This would standardise the consent UI, and prevent sites from implementing dark patterns.

Then the EU tracks everything everyone does. Nice.

Re: New browser signal could make cookie banners obsolete

#110

Post by dmitryminkovsky »

pornel wrote: post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

> The annoying and confusing cookie banners are a feature.

Not just that, but I’ve never seen a cookie banner that does anything. Cookies get sent down with the page on the initial load. Whenever I’ve opened an inspector to see if cookies get unset by JavaScript in response to my “opting out,” I’ve never seen an effect. The same cookies get sent after I opt out: no change. Has anyone seen a cookie preference banner that actually does something?

Post reply on HN