Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Refusing all cookies, still targeted by ads. How?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 118 posts

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#71

Post by Xen9 »

hosh wrote: post #68

The current techniques pushes as many signals as possible to get a device fingerprint, which is then correlated with activity. It uses the pre-LLM machine learning methods to get such a picture. Sources of these signals are often abuses of protocols used to enhance UX across devices. Examples include: - Fonts installed ( https://gist.github.com/szepeviktor/d28dfcfc889fe61763f3 ) - Power saving telemetry ( https://dev…

https://coveryourtracks.eff.org tells how many "identifying bits" you approximately have.

Aggressive DNS blocking gets much better results. Bromite / similar beowser also helps.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#72

Post by cccbbbaaa »

Shendare wrote: post #44

In addition to the non-cookie fingerprinting mentioned by others that can happen, there is a loophole in the GDPR cookie control legislation that allows "legitimate interest" cookies to continue to be placed and tracked when you click Reject All. You have to edit your cookie preferences for the site (assuming they provide the option) and deselect Legitimate Interest cookies proactively in order to block them. This re…

This is wrong. Cookies are covered by ePrivacy, article 5(3), not GDPR. There are two regimes for cookies: strictly necessary ones, and others, requiring consent. The fact that disabling “legitimate interest” cookies does not break the service should tell you that they are not strictly necessary.

GDPR enters the picture when cookies are used to identify users. And using the “legitimate interest” basis for ad purposes is illegal, and instead will require consent. Adtech is just hoping that users won't notice and lodge a complaint.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#74

Post by cccbbbaaa »

Thorrez wrote: post #69
robin_reala wrote: post #49

Earlier quoted context omitted.

The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment: Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain typ…

That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.

If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#75

Post by tredre3 »

hosh wrote: post #68

The current techniques pushes as many signals as possible to get a device fingerprint, which is then correlated with activity. It uses the pre-LLM machine learning methods to get such a picture. Sources of these signals are often abuses of protocols used to enhance UX across devices. Examples include: - Fonts installed ( https://gist.github.com/szepeviktor/d28dfcfc889fe61763f3 ) - Power saving telemetry ( https://dev…

Do you have a source that DPI is used for ads targeting?

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#77

Post by denverllc »

Aeolos wrote: post #52
leonidasv wrote: post #27

Recently, I discovered that SwiftKey keyboard (I assume) was leaking tracking data from Incognito on Android. I would open an Incognito tab in Chrome, the keyboard would show up in "anonymous" mode, but products I searched for still turned into ads in Facebook/Instagram and AdSense in a couple of minutes. I assume it was SwiftKey since it was the only piece of software that had access to those keywords besides Chrome…

Chrome is tracking you by default. Check out chrome://settings/adPrivacy on the desktop - not sure if you have any control over this on the mobile version.

This page doesn't exist in chrome for me and I can't find it by searching the settings. I wonder if it's a regional thing -- I'm in the US. Are you not in the US by chance?

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#78

Post by jspiral »

adrian_b wrote: post #59
gcoakes wrote: post #22

Earlier quoted context omitted.

My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled. The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlight…

I have also looked there and what makes me unique is that nobody else has the same list of installed fonts, which is not a surprise for me, because I have bought several commercial high-quality typefaces, while most people have only the fonts installed by the operating system and by popular office suites. Besides the fonts, only 3% of the people recorded in their database have their monitors configured for 30-bit col…

or starting a campaign to convince others to adopt your ways!

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#79

Post by hosh »

tredre3 wrote: post #75
hosh wrote: post #68

The current techniques pushes as many signals as possible to get a device fingerprint, which is then correlated with activity. It uses the pre-LLM machine learning methods to get such a picture. Sources of these signals are often abuses of protocols used to enhance UX across devices. Examples include: - Fonts installed ( https://gist.github.com/szepeviktor/d28dfcfc889fe61763f3 ) - Power saving telemetry ( https://dev…

Do you have a source that DPI is used for ads targeting?

I have no idea. But this article goes into some of the other signals. The more signals you have, the more you can uniquely identify a device. It also goes into how GDPR covers this (but you would then depend on the government enforcing compliance to legislation)

https://cheq.ai/blog/what-is-browser-fingerprinting/

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#80

Post by jefftk »

dndn1 wrote: post #53
jefftk wrote: post #42

> maybe the simple answer is that refusing cookies doesn't actually do anything? I agree with all the other comments that are saying this is probably fingerprinting, but you can check whether refusing cookies is doing anything. Two ways: 1. On a page where you refused all cookies but are seeing targeted ads, open developer tools and go into the "Application" tab. Open up Storage > Cookies. Do you see anything listed?…

The truth about cookie behaviour can be found, as it's a browser-driven feature (unlike fingerprinting). But at least some analysis of the cookies will be needed, as I think essential cookies under some definition/interpretation are permitted? Now what exactly that means I'm not sure. But the first thing my cookie banner does when someone declines the banner is.... create a cookie. But I guess we can argue that's ess…

Good point; you shouldn't see exactly zero cookies. But all cookies should be "strictly necessary" for fulfilling an explicit user request.
Post reply on HN