New browser signal could make cookie banners obsolete • Hacker News Board

Re: New browser signal could make cookie banners obsolete

#201

Post by sebastian_z » Wed, Jun 16, 2021, 4:13 PM UTC

pornel wrote: post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

The ad industry is not monolithic, though. Some people want to genuinely move on to less privacy-invasive business models; others not. I have been to industry conferences where the advice was "well, if you do not like the Do Not Sell link on your site, maybe it's time to stop selling and start changing your business model."

What is different this time around compared to P3P, DNT, and other earlier mechanisms is that the times have changed. Privacy is a much bigger topic. There is much more reporting now about privacy. Users understand a bit better better (though, we are still far off from real transparency). Lawmakers and regulators are catching up. Many companies embrace privacy. There is a burgeoning privacy tech industry with quite a bit of venture funding.

Also, lessons were learned from earlier efforts. CalOPPA required recipients of DNT signals to only say whether they respect those. The CCPA regulations now require actual compliance. If the CCPA is applicable to your company, you have no choice but to respect it. And that is also true for automated browser signals. There is much stronger enforcement now behind more recent privacy laws. Virginia and Colorado recently enacted privacy laws, and it is likely that other states will do to.

Disclosure: I am an academic researcher working with collaborators of all stripes on Global Privacy Control (GPC) [1, 2]. We are in touch with the good folks at ADPC and support their work. They are doing a fantastic job over there!

[1] https://globalprivacycontrol.org/ [2] https://github.com/privacycg/proposals/issues/10

Re: New browser signal could make cookie banners obsolete

#202

Post by kiallmacinnes » Wed, Jun 16, 2021, 4:56 PM UTC

oftenwrong wrote: post #192

akie wrote: post #109

Earlier quoted context omitted.

Then the EU tracks everything everyone does. Nice.

The site could provide an opaque ID for user. Also, anti-tracking on the part of the EU could be enforced by law.

Ignoring the many obvious privacy issues with this proposal, have you considered how this would result in a legally mandated single point of failure for (nearly..) all web sites?

Re: New browser signal could make cookie banners obsolete

#203

Post by unknown_error » Wed, Jun 16, 2021, 4:59 PM UTC

sebastian_z wrote: post #201

pornel wrote: post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

The ad industry is not monolithic, though. Some people want to genuinely move on to less privacy-invasive business models; others not. I have been to industry conferences where the advice was "well, if you do not like the Do Not Sell link on your site, maybe it's time to stop selling and start changing your business model." What is different this time around compared to P3P, DNT, and other earlier mechanisms is that…

Thing is, how is regulation supposed to ever keep up with the rapid advancements of technology and advertising and the lobbies that come with all that revenue?

Capital and technology need not respect sovereign borders and laws as long as they can keep one step ahead of enforcement and still get enough revenue. The laws and lawmakers are fundamentally slower and weaker and poorer; by the time CCPA et al have an actual deterrent effect (beyond just mandated privacy notices), the industry will have moved on to some more sinister loophole.

It's an arms race that 1700s-style government simply cannot keep up with. It takes months to come up with new algorithmic loopholes, decades to change the law, one industry-friendly administration to undo all the progress.

Offloading privacy to government only works when you have strong states (China, the E.U. maybe). In the US, what's left of the federal government is too crippled to effectively tackle this (and arguably any technological problem) at scale. State-specific laws are subject to the same constraints, and additionally face the problem of enforcement across borders and Commerce Clause issues. If anything this will be an arms race between adtech and adblocking; Congress is the kid in the corner crying, "But I wanna play too!" and pretty much shrugged off by everyone else.

Re: New browser signal could make cookie banners obsolete

#204

Post by freediver » Wed, Jun 16, 2021, 5:01 PM UTC

Placido wrote: post #56

pornel wrote: post #7

Reminder that we've already had a spec for it. In the 90s! And it even has been implemented in the Internet Explorer: https://www.w3.org/P3P/ It did absolutely nothing for privacy. Google has been sending bogus P3P headers that broke IE's implementation and allowed all cookies. Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unle…

Just use Super Agent. You choose your preferences once and that's it. And once iOS 15 is out, it will be available in mobile.

What is Super Agent?

Re: New browser signal could make cookie banners obsolete

#205

Post by freediver » Wed, Jun 16, 2021, 5:03 PM UTC

duckmysick wrote: post #198

quotemstr wrote: post #181

Earlier quoted context omitted.

Who defines what "privacy" means? You? Why? Can you point me to the place where the Universal Declaration of Human Rights talks about cookies and FLoC? The UCHR is not a blank check for banning anything you want in the name of "privacy". There are a lot of angry people in this thread stating what they want, but none have offered an argument for why we should structure society around their whims. Sorry, but "you shoul…

There's nothing in the Universal Declaration of Human Rights about privacy regarding medical records, but various jurisdictions agree that it's worth protecting. > Sorry, but "you shouldn't be able to collect information" isn't an argument. How about "private entities shouldn't be able to collect my information without my explicit consent". > It's a wish. Nobody is under any obligation to indulge the wishes of random…

> How about "private entities shouldn't be able to collect my information without my explicit consent".

If the information is public, no consent is needed.

Privacy is about trusting someone with private information and expecting they will not do anything with it that you would not approve of.

Re: New browser signal could make cookie banners obsolete

#206

Post by akie » Wed, Jun 16, 2021, 5:05 PM UTC

hnarn wrote: post #121

akie wrote: post #106

Earlier quoted context omitted.

You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. It's also significantly easier to convince a lawyer that you don't need these things if you can prove that there are no cookies whatsoever. And even then they'll be suspicious. It's harder than it looks, just embedding a YouTube video for example already sets third-party cookies. Same with embedding a Tw…

> You want to avoid cookies entirely so that you don't need a cookie policy and that you don't need a cookie banner. Wrong. Functional cookies are exempt.

Of course I know that, but did you ever talk to someone who is not in technology but does have a say in determining what "we" need to do to cover "our" asses?

Say, a lawyer with the responsibility that all of our websites implement all of the relevant regulations?

You would think that they are up to date on what regulations you need to follow, but you'd be surprised. Many take a blanket "no risks under any circumstances" approach. These types can only be placated with the "we don't have any cookies at all" argument. And even then only barely.

Re: New browser signal could make cookie banners obsolete

#207

Post by gorgoiler » Wed, Jun 16, 2021, 5:18 PM UTC

This week I told iOS safari to block all cookies.

It’s really not that awful. In fact, it’s kind of fantastic. I use a second browser (Google Chrome) for “signed-in stuff”.

Try it.

(Although the fact that I just posted this from safari reminds me I’m not 100% up to speed on which-browser-for-what-activity discipline.)

Re: New browser signal could make cookie banners obsolete

#208

Post by _boffin_ » Wed, Jun 16, 2021, 5:23 PM UTC

Been thinking of making a chrome/firefox extension that will detect those cookie notifications and automatically nope out of them all for you and submit, but been too lazy to implement.

Re: New browser signal could make cookie banners obsolete

#209

Post by 7952 » Wed, Jun 16, 2021, 5:23 PM UTC

Dayshine wrote: post #83

7952 wrote: post #46

Earlier quoted context omitted.

I have been building some sites where I have explicitly tried to remove or avoid cookies completely. It is really tricky as any third party script or embed can set cookies, which may be retained depending on browser version. We end up using generic cookie prompts just in case to appease corporate compliance even when nothing is usually set on the page. And the http nature of cookies make automating things much more d…

Why avoid cookies entirely? You don't need a cookie banner for cookies essential to the functioning of your site.

These particular sites didn't need essential cookies and discussion about privacy/cookies was taking lots of time for no real benefit.

Also, I believe philosophically in trying to reduce things like analytics and tracking.

Re: New browser signal could make cookie banners obsolete

#210

Post by contriban » Wed, Jun 16, 2021, 5:33 PM UTC

_boffin_ wrote: post #208

Been thinking of making a chrome/firefox extension that will detect those cookie notifications and automatically nope out of them all for you and submit, but been too lazy to implement.

It’s called “I don’t care about cookies” but I think it accepts all of them.