Live data from Hacker News

New browser signal could make cookie banners obsolete

dataprotectioncontrol.org

141–150 of 269 posts

Re: New browser signal could make cookie banners obsolete

#141
post #128

Earlier quoted context omitted.

You should check out uMatrix to get even more fine grained control over sites. I usually allow images on every page, that's it. Some need CSS, some need iframes, and a small subset of websites I visit are actual webapps that need javascript.

I love uMatrix but development on it has stopped so it won't receive bug fixes and it will probably stop working someday. I don't think I would recommend new users start using it. https://github.com/gorhill/uMatrix https://news.ycombinator.com/item?id=24532973

Yes true, but it's still working mostly and I don't have a real alternative.

I want to switch to uBlock's Advanced mode which seems to do similar things, but I haven't yet.

Re: New browser signal could make cookie banners obsolete

#142
post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

"They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed." Once in a while I read/learn something new at HN that changes my perspective on things. This sentence is such an example.

I agree but I changed "pointless" with "hopeless" for a better effect on my end.

Re: New browser signal could make cookie banners obsolete

#143
post #22

Earlier quoted context omitted.

Unless regulators force companies to respect automated protocols.

The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. The rest of the industry followed. Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.

An standardised protocol approach might make enforcement easier. It would make it a lot more clear cut whether someone was infringing or not.

Re: New browser signal could make cookie banners obsolete

#144
post #46

Earlier quoted context omitted.

I have been building some sites where I have explicitly tried to remove or avoid cookies completely. It is really tricky as any third party script or embed can set cookies, which may be retained depending on browser version. We end up using generic cookie prompts just in case to appease corporate compliance even when nothing is usually set on the page. And the http nature of cookies make automating things much more d…

Why avoid cookies entirely? You don't need a cookie banner for cookies essential to the functioning of your site.

Still, the boss said: "add a banner anyway." Better safe than sorry, and everyone expects it by now.

Re: New browser signal could make cookie banners obsolete

#145
post #60
post #25

Earlier quoted context omitted.

It is time for the governments to take control back and start regulating BigTech: you can not easily opt-out from any data gathering from Google, Microsoft, Apple, Facebook, ... If you try it and turn it off on mobile phone and desktop you will constantly have issues and be flooded with messages like "turn on location services", etc. Yesterday I learned that my private calendar on my phone was replicated to Google Ca…

How is this possible? Probably forgot you gave consent to Google calendar?

I checked again exactly why this happened: Samsung Calendars app (which is a default calendar app on Samsung phones) has set a default calendar for my new events to my Google Calendar account. And if you just enter the event title and set the time (what one would usually do) - and leave all other settings untouched - then by default it will be added to your Google account which will then be synced to the cloud... You can change these settings (see [1]), but the default is wrong!

[1] https://eu.community.samsung.com/t5/galaxy-s9-series/default...

Re: New browser signal could make cookie banners obsolete

#146
post #60

Earlier quoted context omitted.

How is this possible? Probably forgot you gave consent to Google calendar?

Recent Android phones sync a ton of stuff automatically - which I suppose you agree to by signing in with a Google account, but that's also typically required. I know this because on the last two Android phones I purchased, a set of old outdated contacts from my Google account were automatically synced to the phone as soon as I logged in, which I was required to do to begin using the device. Believe me, I would have…

Time to go away from GMail account...

Re: New browser signal could make cookie banners obsolete

#147
post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

> Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unless the spec is so bad that most users will agree by accident. Reminder that Internet advertising has a lot of actors with competing interests, and it is not usually the "adtech companies" who don't want users to have an easy-opt out, but publishers and to a lesser extent the a…

This is fundamentally misunderstanding how internet advertising works:

advertises will pay higher CPM for precise targeting and attribution

publishers want the best CPM they can get

adtech uses as many tricks as possible to get as much information as possible about a user so they can maximize the CPM the advertiser will pay

Publishers just end up doing what ever their adtech partners tell them will give them the best CPM.

Re: New browser signal could make cookie banners obsolete

#148
post #121
post #106

Earlier quoted context omitted.

You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. It's also significantly easier to convince a lawyer that you don't need these things if you can prove that there are no cookies whatsoever. And even then they'll be suspicious. It's harder than it looks, just embedding a YouTube video for example already sets third-party cookies. Same with embedding a Tw…

> You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. Wrong. Functional cookies are exempt.

The statement isn't "Wrong.", it's just overly strict.

Re: New browser signal could make cookie banners obsolete

#149
post #22

Earlier quoted context omitted.

The GDPR already explicitly forbids 95% of the cookie banners out there, but large companies decided to ignore it and simply face the fines if they in some hypothetical future will arrive. The rest of the industry followed. Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.

An standardised protocol approach might make enforcement easier. It would make it a lot more clear cut whether someone was infringing or not.

Automated enforcement is already easy if there was willingness to do it. The majority of non-compliant cookie banners use a handful of libraries and/or third-party services such as TrustArc so detecting these with a web scraper is be trivial.

Re: New browser signal could make cookie banners obsolete

#150
post #5
post #3

I don't see how this will be adopted without backing by legal threats. Even if this gets implemented on a voluntary basis, you need a fallback for browsers that don't support it. And if you need to have a version of the prompt with a user experience that isn't controlled by the browser, you might just as well use it to keep pushing the same dark patterns to everyone. Am I missing something?

I agree. Why would anyone who wants to track users implement this standard and abandon their dark patterns?

It would have to be enforced by legislation (As opposed to the dark patterns with cookie banners). If any company doesn't implement this fully compliant with the spec, fine them every year with 2-25% of the yearly revenue.
Post reply on HN