Rendered at 16:16:55 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
chrismorgan 24 hours ago [-]
The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/or clicking a button cannot constitute informed consent”; and see what they try next.) From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them out of the way. Just as shrink-wrap licenses and even simple contracts have at times in some jurisdictions essentially been neutered, so that only terms that a reasonable person would expect to be there are enforceable, at which point it becomes obvious that the whole thing needs tearing down in favour of standard licenses/contracts. In the Australian state Victoria, for example, there are standard rent and property sale contracts; for renting you must use that contract <https://www.consumer.vic.gov.au/housing/renting/starting-and...>, and I got the impression that residential sales practically always use the standard contract.
But of course it’s impossible to convince someone of something when their livelihood depends on their not understanding it.
kleiba2 23 hours ago [-]
> it’s well-understood that very few people actually read those things, they just want to get them out of the way.
This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data mining, profiling, and other privacy-related aspects. But in many cases, you could just click "reject" and the banner would also disappear...
To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.
readread 23 hours ago [-]
"Accept all" always makes it go away immediately.
Some variant on "reject" takes more effort like 70% of the time. Which is on purpose, of course. The ones that aren't maliciously-complying have a "necessary only" button that insta-closes it, but tons pretend that you might want to allow some spying but not all of it and make you go through another screen if you don't just "accept all".
> To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.
Then it'd be possible to default it to "nope" (Firefox, and perhaps Safari, might do this) or to allow a "never, anywhere" setting the first time the question is asked, and malware and spyware vendors know that'd mean a much larger proportion of denials.
jackson1442 22 hours ago [-]
"necessary only" also tends to have a malicious compliance aspect where they don't store a cookie recording your preference and show the banner on every single page until you click accept.
remus 22 hours ago [-]
Perhaps I am overly optimistic in thinking this is just incompetence.
smallmancontrov 22 hours ago [-]
Yes, you are. The legislative process around EPD/EPR fully anticipated the malicious compliance and it became a back-and-forth political football long before anything was passed. The legislators were never dumb and the corporations were always greedy+powerful.
whstl 21 hours ago [-]
I had one of the providers recommending us that we leave the "Decline All" button out of Europe, since it's not widely prosecuted, buy recommended that we add it to California, since chances are slimmer.
Naturally in a camera meeting with a "don't tell anyone we said that" appended right before.
The marketing people in the meeting were very angry that California was "doing it to them".
Aerroon 16 hours ago [-]
If they fully anticipated this then surely they could've fully anticipated how annoying and useless cookie banners are?
There is nothing stopping a website from using cookies regardless of the banner. If they are outside EU jurisdiction then there won't be any consequences either.
The legislators were and are dumb. They have wasted an enormous amount of collective time for no benefit. Big corporations continued doing what they were doing and nefarious third parties could still track you.
smallmancontrov 16 hours ago [-]
> surely they could've fully anticipated how annoying and useless cookie banners are
They did. The laws were airtight in this regard. They simply lost -- whether through a last minute "tweak" or undermined enforcement mechanism I do not know, but I do know that the current state of affairs was fully anticipated and headed off at the point where I reviewed the proposal. Your vitriol is bass ackwards -- the lesson is to strengthen the walls between corporations and the legislative process and support enforcement mechanisms, because those were the places where the process failed. Not the intelligence of legislators. Otherwise you will keep losing to the corporations, and you will deserve to.
unscaled 11 hours ago [-]
The law is airtight. Acceptance must be informed and freely given (this includes forcing through dark patterns and annoying banners that force you not to read), and withdrawal should be as simple as acceptance.
GDPR article 7 and its various recital already include that. GDPR wisely doesn't get into technical details like "cookie banners" anywhere, but various national agencies did set guidance and it's usually quite explicit: Rejection must be as simple as acceptance and reject buttons or link must be as prominent as the accept buttons and links.
For example, CNIL, the French data privacy authority, clearly says[1]:
"The CNIL has received complaints about dark patterns on cookie consent banners encouraging data subjects to accept cookies.
As a reminder, with certain exceptions, cookies can only be used with the consent of data subjects. Moreover, rejecting cookies should be just as easy as accepting them."
And gives examples of dark patterns such as different button sizes, multiple accept buttons, hidden reject buttons, etc.
The law and specific guidance is pretty unambiguous. This purely an enforcement problem. The regulatory bodies do not have the resources to go and chase most individual companies, and the non-profit NGOs that go after the violators apparently don't have the budget to make enough impact and scare companies into
compliance.
Sometimes the folks commenting here are exactly those corporations, so there.
inigyou 5 hours ago [-]
We are on news dot rich corporate billionaires dot com, after all.
tikhonj 21 hours ago [-]
Well, maybe it is... but then the PM never prioritizes testing or fixing the problem. They're not intentionally trying to get more people to accept cookies, it's just that there are always more important features to build and fires to fight, and fixing the cookie banner won't move any of the metrics executives are breathing down their necks about, and it won't look good in the perf packet...
But of course, designing the system that pushes people to make this sort of decision was absolutely intentional.
So even when it's incompetence, it's still malicious, just in a way that obscures the explicit decision-making that led to the result.
bshacklett 18 hours ago [-]
I don't see that as malicious. Is my consent record "strictly necessary"? No. Don’t get me wrong. I’m sure they love that, but if sites saved that preference when only necessary was selected, I’m sure a bunch of people would be screaming that they weren’t following the law.
jeremyjh 16 hours ago [-]
The entire banner is malicious. They don't need consent for necessary or functional cookies. They only need consent to track you - at no benefit to you ever.
novafunc 17 hours ago [-]
I don't think anything is actually "necessary" if you want to be strict on definitions.
I think it's absolutely fair and unlikely to be illegal to use a cookie to remember cookie preferences. Unless the cookie value was not yes/no, but something like a precise timestamp that could be used for uniquely identifying.
flotzam 4 hours ago [-]
The malicious compliance aspect is that they're not offering a choice between "tracking" and "no tracking", but bundling "no tracking" + "painfully degraded functionality" (like repeating the question on every page) = "strictly necessary cookies only"
tremon 17 hours ago [-]
Yes, it is strictly necessary to properly honour the user's choice. Not storing a rejection of consent but storing acceptance violates the GDPR because it creates an asymmetry between the effort required to accept vs the effort required to reject user data processing.
Gigachad 16 hours ago [-]
There is no legal requirement to ask for consent for first party functional cookies. The cookie banner is only for invasive 3rd party trackers.
PunchyHamster 21 hours ago [-]
which they can be sued for as that's not compliant way to handle it. Just that nobody bothers
inigyou 5 hours ago [-]
IIRC it was ruled by a court that "reject all" must be as easy to use as "accept all", but nobody actually follows it because enforcement is lacking.
xp84 21 hours ago [-]
It literally does not matter what you pick on these things - most of them don't work anyway. Think about it: Of course they don't. All the third-party javascript is already on the page. Anything you do inside the sandbox with UI provided by, usually, some other third-party, can't just magically force all that other code to behave in a specific way, unless someone has done a great deal of work to integrate the cookie banner code. If the first-party site were that competent at instrumenting every bit of third-party code the marketing department threw at the website department, they wouldn't even need the third-party cookie banner vendor in the first place.
Clicking those "REJECT!" buttons might make you feel empowered, but it's pointless. Just set your browser to delete all the cookies at the end of the session except for whatever sites you want to allow to 'remember' you.
The whole thing has always been a problem to be properly solved by the browser, and it's probably just the fact that Google makes the only browser that matters, that it's been foisted upon every website owner, who mostly just wants basic analytics and to track conversions from the ads they run, and isn't "selling your data."
The browser is your user agent. If it's sending any information up to web servers on every request that isn't okay with you, why are you using it?
inigyou 5 hours ago [-]
Yeah they can, they can also get fined 2% of a year's gross revenue for doing so
zugi 20 hours ago [-]
> Just set your browser to delete all the cookies at the end of the session except for whatever sites you want to allow to 'remember' you
Exactly. I use the "I don't care about cookies" extension, which rejects most cookies automatically without me having to see the popups. But even accepting cookies is fine - I'll be closing my browser soon anyway and they'll be gone.
unscaled 12 hours ago [-]
Despite this being called a "cookie banner", this is not _just_ about cookie. When you click "Accept all" you are giving your consent to any form of tracking and information sharing mentioned in the details. The site you visit may share everything they know about you with any third party they mentioned. They can even use fingerprinting (if you've agreed to it) to keep tracking you after you've deleted the cookies.
badestrand 5 hours ago [-]
And then? What's the practical, concrete, real-life consequence for me? Nothing, not even a bit more relevant ads as these run into my adblocker anyway.
cowboylowrez 4 hours ago [-]
Yeah honestly I just assume sites fingerprint and track to the extent the visitors allow.
tremon 17 hours ago [-]
I'll be closing my browser soon anyway and they'll be gone
Sure, your browser cookie will be gone. But you have already allowed the server-side identifiers of your session to be used for whatever purpose, including reconstituting increasingly larger parts of your identity over multiple disconnected sessions. Please don't make the mistake of thinking that clearing your cookies afterwards is the same as rejecting all server-side processing.
gnatolf 17 hours ago [-]
Well, joke's on me: I use that extension too. And I never close my browser.
donaltroddyn 19 hours ago [-]
I think you're right that many (most?) CMPs are broken, though usually not deliberately. Most try to gate analytics and ad tracking on consent, just often misconfigured. The common exception is companies that deliberately hide Reject All, which is not complaint
My company scanned 209 European regulated sites in June, and roughly 7 in 10 had tracking that wasn't correctly gated by consent. It's rarely indifference, though. DPOs in the EU hold too much weight for that. It's usually a tag added that was never wired into the CMP or something added by a dev or LLM without going through proper review
Full disclosure: I run https://consentmark.com, which measures what tags actually fire under each consent state to create evidence packs companies can show regulators
TeMPOraL 5 hours ago [-]
I don't buy it. 70% of the CMPs being "misconfigured" tells us that even if these panels were broken by design, the companies using them must all conveniently not notice this. Strange, given that even a small risk of large fines or prolonged legal process with public entities would warrant someone paying at least a moment of attention to this. I suspect they are, and the choice of leaving things misconfigured is deliberate.
> something added by a dev or LLM without going through proper review
FWIW, this was a problem long before LLMs were a thing, and it didn't get worse with LLMs. If anything, I'd expect LLMs to get it right by default, because ones ~everyone is using are all trained straight, they won't just silently read between the lines and write code/configs to facilitate one's illegal business model.
ablob 22 hours ago [-]
It's a nag-box that appears every time someone visits a new website.
Of course people are going to click it away as fast as possible.
In the few cases you repeatedly visit a website one might want to reconsider, but by then it's out of mind due to not being shown after giving consent.
It is known that warnings and pop-ups that show up almost all the time yield diminishing returns.
I think it was named "normalization of deviation" by some folks in a blog a while ago, and I believe that name fits.
If you get warned about missing https all the time, or that something might be dangerous (even though it does precisely what you want it to do), it will loose its effect by the time you actually need it.
You can argue this is malicious compliance, but if you want it to go away it would probably be easier to go for banning tracking and personalized ads altogether. Eliminate the reason for this behavior, so to speak.
fnord123 22 hours ago [-]
> To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.
There is one. It's a DNT header. Knucklehead websites ignore it.
That is for Y Combinator. I would characterize HN as less than a fair bit;
> Hacker News Information: If you create a Hacker News account (ID and profile), we do not collect any Personal Information unless you choose to provide your email address and/or information in the "about" field (“HN Information”). Your submissions to, and comments you make on, the Hacker News site are not Personal Information and are not "HN Information" as defined in this Privacy Policy.
xp84 19 hours ago [-]
Because it doesn't mean anything specific and breaks entire business models (merely logging that you landed from an ad click and seeing if you check out counts as 'tracking,' doesn't it?) if interpreted purely literally. So, the only way to treat it is to either ignore it or to just send back an error code and message that says "Sorry, having some tracking is the condition to get this free content. Accept or don't."
Like it or not, the Web is a two-way street, meaning that the server end of the transaction doesn't owe the client end anything in particular unless there's some relationship in place (like a payment). It appears the "just ignore it" matches the intent of most web users, though, since an overwhelming majority of web visitors accept a bunch of spammy ads + free 'content,' and a slim minority pay for ad-free alternatives.
windward 19 hours ago [-]
>breaks entire business models
So do car alarms.
I'm not convinced this is a business model I want to exist. We had an internet before it, and Google, and Facebook. I'm increasingly sad we can't return to it.
xp84 16 hours ago [-]
Let me be clear, I can't stand the social-media industrial complex and the advertising universe. I've seen the bottom that we've raced to, with absolute bullshit popping up everywhere and entire sites full of slop with clickbait "headlines" just rigged to get ad impressions.
And I'd gladly trade today's BS for any version of "The Internet" pre-2007.
But the "Before" Internet wasn't some natural sustainable state.
Before 1997 or so, "the Internet" was being paid for by academic institutions and big companies, and wasn't really all that commercial at all. It was also pretty tiny and blessedly simple. Honestly this version is the most achievable (re-creatable?) today since we can set up indie websites much easier today than we could then. Instead of using your free webspace from your university or employer, 20 of us could share a $5 a month instance, and link to each other's webpages, and add an IRC server to that instance just for fun.
In the 1998-2007 era, the Internet got a lot bigger, but was also still pretty fun and not that enshittified, but that's just because it was being paid for by VC money being burned.
Today we are where we are in terms of business model[1] because Google and Facebook achieved great success with ad-based business models because of the ability to target ads better, and because consumers of The Internet have spoken, loudly, with their closed wallets. They've said "We will only pay for content if it's All The Music and ~$10 a month flat rate, or if it's a big/interesting enough video on-demand service and under $20 a month. We'll never pay for news or text content of any kind." So, the businesses with other types of content do what the public wants them to do: have cost-free content whose access is conditional on being advertised to very annoyingly, or they marginalize themselves with paywalls, subscribed to by only a small minority of users.
[1] i'm setting aside the non-business aspects of our mess, namely the poison that social media, 'engagement' optimization, and ragebait-as-news has wrought on society.
ben_w 7 hours ago [-]
> achieved great success with ad-based business models because of the ability to target ads better
The supposed benefit of the current model is to find and eliminate that wasted half.
Facebook has shown me ads for dick pills and boob surgery, ads I can't read because I don't know the Cyrillic alphabet, and ads for services that only apply to citizens of nations I've never been a citizen of who moved to a country I had in fact moved out of.
The reports I hear from people who buy ad slots are mostly unimpressed with the results; the word on the grapevine is that the "success" cases are not even average customers, but those who are vulnerable to getting scammed.
inigyou 5 hours ago [-]
Megagiantcorp Proctor & Gamble cancelled all internet advertising, with no loss in sales.
dullcrisp 8 hours ago [-]
I don’t know, back in the day you could just buy a newspaper and read it.
Now, if you want to read an article you have to pay $20/month to that news organization in perpetuity. I don’t see how that can be expected to work.
LtWorf 8 hours ago [-]
Their targeted ads suck. I've been a professional developer for quite a while and fb keeps peddling me programming courses for beginners to become a developer.
Or, I liked one single page of an amputee woman (I am myself) and now all I see are amputee women.
They just buy all the competitors, but they aren't good at all.
fnord123 19 hours ago [-]
> "Sorry, having some tracking is the condition to get this free content. Accept or don't."
The law that caused the cookie banners also says companies cannot block access to the site if the cookies are not required for the functioning of the site.
Some German news sites have broken this and have "accept or pay" and I think this leaked to news sites in other countries. Facebook even tried it.
So, sure, if DNT is true, try to make people pay. Fine by me.
rob74 9 hours ago [-]
The most annoying thing about that is not even the "accept or pay" banners. There are more:
- even if you accept the tracking, you might still not be able to read the article, because while the site may be free in principle if you accept ads, that specific article is not.
- and the most annoying thing is that such paywalled articles show up on Google News. Not sure if they're tricking Google into showing them (by showing the full article to search crawlers, but the paywall to actual users), or if this is some understanding between Google and EU news providers, but it's annoying...
TeMPOraL 5 hours ago [-]
> breaks entire business models
Good. No one is entitled to a business model working in perpetuity. Doubly so when it's ethically dubious.
The very thing entrepreneurs are glorified for - their ability to invent and execute on new business models. They'll manage, don't worry about them. Hopefully they'll settle on more honest models this time.
19 hours ago [-]
ryukafalz 23 hours ago [-]
> But in many cases, you could just click "reject" and the banner would also disappear...
Oftentimes the reject flow is substantially more annoying than the accept flow. I click reject myself when it's an option, but I can absolutely understand how people might get conditioned to click accept when clicking reject might result in more popups.
thom 21 hours ago [-]
A lot of UK sites (Reach local news stuff) now explicitly say take cookies or pay, which tbh I always thought was illegal.
xp84 19 hours ago [-]
It's wild to me that anyone thinks that would be a reasonable law (whether or not it is law, I have no clue, I don't live in UK or EU).
If you made a website and you said "To view the private content on my website, you have to either pay me, or sign a name, any name you wish, in my guestbook" what business is it of the government to say "No, this random person refuses to pay or sign the book, but Thom, you have to let them see all your articles anyway."
Note that I used "sign any name" as the metaphor, not "show ID," since it is trivial to not allow any important information exchange if you simply delete the cookies yourself, which is easy to configure a browser to do. The end-user has the choice, if it's so important to them, to configure their browser. Even Chrome can be configured for which sites to allow cookies, which to disallow, and which to clear when the browser closes (the smart choice, since accepting them and throwing them away soon after is the undetectable option that accomplishes your main aim).
thom 18 hours ago [-]
Allowing bad actors to act badly against all but the most sophisticated users is exactly where lawmakers should be stepping in. Sorry you find that controversial.
ApolloFortyNine 15 hours ago [-]
YouTube is a site that pretty much everyone has an account already for (and therefore have already consented), but say you make YouTube 2, you can only make money if people allow personalized ads (they pay 10-20x untargeted ads). 90% less revenue means your business model doesn't work. The government in the area has decided you can't refuse service to customers that cost you money (people who don't consent).
You simply will have to go out of business.
This is also why you see many large companies fighting for more regulation. It's harder for a competitor to emerge if they have to navigate mountains of red tape.
kalleboo 14 hours ago [-]
What if I want to start a restaurant that can only make money if I use expired ingredients, run the fridge at a higher temperature to save on electricity, and don't waste my employee's time by washing their hands? These food safety laws mean my business model doesn't work.
I simply will have to go out of business.
ApolloFortyNine 13 hours ago [-]
This is just a strawman, these aren't equivalent and I'm not going to waste time pretending they are. Might as well just compare ads to nuclear weapons at this point.
kalleboo 13 hours ago [-]
There are enough libertarians out there that believe that the government should not be involved in food safety inspections to establish that regulations like this ARE on a related spectrum. Do you have a right to trust that food you buy is safe or should you get to choose to buy raw milk? Do you have a right to consume online services while retaining privacy? It's a debate society constantly has, and the EU electorate has chosen the side of privacy over a specific business model, just like most developed societies have chosen food safety.
xp84 17 hours ago [-]
We ask more sophistication of drivers to understand the rules of right of way than we would be asking of users to hit Settings -> Privacy and Cookies and read the plain language there.
Sorry that you need the government to "help" people in this way, by forcing other people to give them free things.
kalleboo 13 hours ago [-]
Are you proposing a licensing scheme to use the internet?
xp84 8 minutes ago [-]
No, I'm just saying that it's okay to burden humans with the responsibility to learn a few basic ideas about how to operate their own computers if they want to control their data privacy.
Simple, easy tools are already there, such as the Clear Browsing Data menu item in Chrome, Edge, and Safari. For more complicated intents, the browser settings are no more complicated to navigate than the actual customization UI in the CMPs, anyway.
kalleboo 21 seconds ago [-]
[delayed]
ben_w 7 hours ago [-]
> If you made a website and you said "To view the private content on my website, you have to either pay me, or sign a name, any name you wish, in my guestbook" what business is it of the government to say "No, this random person refuses to pay or sign the book, but Thom, you have to let them see all your articles anyway."
More: "To view the private content on my website, you have to either pay me, or let more businesses connect the dots between this content and the rest of your internet browsing habits, than there were students and teachers combined in your high school."
Yes, it is technically possible to fake this content, or to auto-delete it.
But https://xkcd.com/2501/ applies. "It's easy to forget that the average person probably only knows the privacy settings for Safari and one or two Chromium derivatives."
This is a false analogy. The cookie banner stuff is explicitly about sharing data with third parties. If that were the case in your example, it'd be a different thing, right.
kalleboo 14 hours ago [-]
You're fooling yourself if you think clearing cookies does anything. Everyone is doing browser fingerprinting instead these days.
roelschroeven 21 hours ago [-]
It is illegal, but compliance is not enforced to the degree that it should. Companies get away with a lot of GDPR infractions, unfortunately.
inigyou 5 hours ago [-]
They're in UK, not EU, and it has a different law.
account42 3 hours ago [-]
UK GDPR is simmilar to the EU one and German news websites do the same thing in the EU.
dredmorbius 20 hours ago [-]
The UK is somewhat famously no longer part of the EU (you may have heard of a thing called "Brexit" a few years back).
However the UK does have its own GDPR regulation (see: <https://www.gov.uk/data-protection>), though my understanding is that it may be less strict in requiring equivalence between "accept" and "reject" actions. (I may be wrong on this.)
UK sites accessed from the EU would have to be under EU GDPR compliance.
nickff 22 hours ago [-]
I believe myself to be fairly well-informed, and usually accept the cookies, because I don’t foresee any potential harms, and it helps the people running the website. I am worried about many things like phishing and hacking/data leaks, but the valuable data isn’t cookie-related.
What harm are you worried about?
layer8 22 hours ago [-]
Tracking usually happens across websites, meaning the information is shared with third parties outside the people running the website where you accepted the cookies. Knowing your interests, behavior and preferences makes you prone to manipulation. The selection of information shown to you will be crafted such as it maximizes engagement. For example, showing you information that upsets you, in order to get you to react. Or just information with a slant or spin to influence your opinion. Nobody is immune to being affected by the distribution of what they are being shown.
22 hours ago [-]
tqi 16 hours ago [-]
No one in history has ever had an opinion independent of "influence"
layer8 19 minutes ago [-]
Sure, but influence tailored to the person is much worse than non-personalized influence by the general environment.
inigyou 5 hours ago [-]
For instance, ICE buys this data.
fsflover 22 hours ago [-]
These popups aren't about cookies but really about spying. It seems you have nothing to hide. I understand: I also don't. However, the problem with spying is not about individual secrets but about the society and democracy.
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
tqi 16 hours ago [-]
A right to privacy also includes the freedom to forgo privacy in return for other benefits.
inigyou 5 hours ago [-]
"A right to not be raped also includes the right to be raped in exchange for benefits"
kalleboo 14 hours ago [-]
"Participating in basic society" isn't a "benefit"
whstl 21 hours ago [-]
The banner is not just about cookies, but also about data sharing, so by accepting you increase the amount of your data that can be leaked.
These banners handle both ePrivacy consent for cookies etc, but also GDPR Art. 6(1)(a) for processing purposes (personalised ads, measurement, audience insights, precise geolocation, even device fingerprinting).
montroser 21 hours ago [-]
Well, the whole thing is theater anyway. It does not matter what you choose.
They will fingerprint you with or without cookies. They may or not try to honor your preferences, but their "partners" will not try, and by the time you see that banner, it's all out there.
"Accept" is the close button.
speleding 6 hours ago [-]
Well, you would be surprised how many people think that blocking cookies means "no or fewer ads", even people in IT. No tracking, of course, just means it will show less relevant ads, not fewer of them.
So I'm not onboard with the "just block everything by default" crowd. If you frame the question as "Would you like ads to be more relevant to you" instead of "Do you want to allow tracking" you probably get a very different answer from users.
I would like the cookie banner to be changed to a browser setting, but I also would like the option to allow some sites to show relevant ads to me.
WheatMillington 21 hours ago [-]
Most people reasonably assume that if they click Reject they won't get the page they're looking for.
bwb 5 hours ago [-]
I run two plugins to just invisibly make them go away, I don't care, they are a waste of my time :)
hobo123 21 hours ago [-]
"To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning."
This is exactly what browsers did back the 90s, they asked about every single cookie.
Then browsers got configurable options to simply accept either all cookies, no cookies, or only first party cookies (excluding third party sites unrelated to the domain you visited).
For now well over 20 years I have disabled 3rd party cookies in all browsers I use, and only in a few cases overall did I need to make exemptions.
Gigachad 16 hours ago [-]
Usually when you hit reject it opens some insane modal with 5 million checkboxes. While accept always makes it go away fastest.
chillfox 12 hours ago [-]
The amount of sites that don’t persist rejecting feels very high, or it’s extremely painful when encountering. The cost of clicking reject is extreme if you have to do it on every page load as you navigate a site.
SlightlyLeftPad 19 hours ago [-]
There is also the fact that by rejecting, the cookie that remembers that preference expires after like a day, so you have to click that dumb banner almost every time you visit the site.
gbalduzzi 19 hours ago [-]
And that is malicious, it is not supposed to happen
aetch 21 hours ago [-]
People expect visiting a website to be read only or contained within a sandbox to not read other files on their computer which is correct. Most people just don’t care about tracking and want to get to the content.
unclebucknasty 23 hours ago [-]
>This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept"
There's a mismatch between the velocity at which people visit sites and the time it takes to navigate the cookie particulars of each site.
And, we can dismiss this as people being uninformed or lazy but the reality it is that's actually not so unreasonable. Cookies are in some ways near the bottom of the list where privacy is concerned, given everything else from breaches to search dossiers to device finger-printing to mobile device location-tracking to the ubiquity of cameras in the real world, and on and on.
The idea that we're clawing back privacy in any meaningful sense by blocking a few cookies here and there is kind of quaint.
zelphirkalt 18 hours ago [-]
This happens when countless websites continue to do the illegal thing of making rejection take more effort than accepting, without being sued into oblivion for repeat offenders. Roughly 9 out of 10 websites today will be doing this illegal shit, and we are too timid to tear them down.
dv_dt 22 hours ago [-]
if ever there were a need for a small local ai plugin...
agos 20 hours ago [-]
I suggest looking at "consent-O-matic" which might not be AI but takes care of the issue for you
dv_dt 9 hours ago [-]
I have it, it only seems to operate on maybe 60% of sites
cuu508 22 hours ago [-]
uBlock Origin's "annoyances" filter lists also do the job.
stefan_ 21 hours ago [-]
Because 90% don't even do anything? It turns out it's actually one of those really annoying problems to delay cookies which were supposed to be sent already in the HTTP request response until a user interaction has happened. And on a lot of pages, non technical people embed random 3rd party resources. And these 3rd party resources might claim to use only "technically necessary" cookies, but of course that's nonsense; I'm not visiting the 3rd party.
inigyou 5 hours ago [-]
The law is actually about tracking, not about cookies.
Robotbeat 15 hours ago [-]
If only there was a short little text file that websites could use to keep track of the setting...
tancop 6 hours ago [-]
[dead]
goodrubyist 22 hours ago [-]
Agreeing to terms and contracts without reading or at least skimming them is not responsible adult behavior and should not be used as a model for legislation, no matter how many people do it. I agree that we do have a culture where private law is not taken very seriously, and that's very unfortunate.
People do not have a right (morally speaking, not legally) to access or use a service (or a website) etc without having to read/agree to the terms (applies to analog and digital).
Maxion 21 hours ago [-]
Try to get anything done then, there's so many places these days where you have to approve 300 page legal documents to e.g. record day care times, pick up packages and so forth. There is literally not enough time in the day. The option for me would be to not put my kid in daycare (I lose the spot if I don't put in the daycare times, and the only way to do that is a 3rd party service) and not pick up packages (have to agree to the EULA to get the app that I need to unlock the pickup locker) and dozens of other places.
We really need to stop companies from putting up these insanely complicated legal texts to use basic services when they could all be behind standard contracts.
goodrubyist 17 hours ago [-]
They're usually not that complicated. And most of them say usually almost the same things with some edits thrown here and there. E.g. compare the disclaimer of warranty/liability sections of two different EULAs. E.g. this kind of text in Apple macOS Tahoe EULA is found almost everywhere:
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE APPLE SOFTWARE AND
SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”
The same point applies to most of the text. But yes, some text is specific to the service. E.g. the same doc above says in bold:
"By using the Content Caching Features of the Apple Software, you agree that Apple may download and cache such Apple Eligible Content on your Caching Enabled Mac."
I'd say that's something worth knowing if you use that OS.
swat535 21 hours ago [-]
Terms of services and contracts are written for lawyers and not the average people.
If your terms require people to get a law degree and take a week to parse the 400 page document, then I would argue that it's a tactic to get people to sign up for the service without fully understanding it.
We need legislation that forces companies to communicate the terms in a way that an average person can comprehend.
goodrubyist 17 hours ago [-]
I'm an average person and I read them all the time. It's not usually 400 pages long. More like 3-4 pages. If a person genuinely can't understand, they should not use the service. That's not sarcasm, I, myself, do not like to sign contracts I cannot understand -- but that's rare when you can look up stuff.
Cookie control always should have been a browser control. The legal route always should have been to force it to be built into browsers that provide sane defaults, and make it illegal to circumvent what the browser declares as far as fingerprinting etc.
any sort of elevation prompt, IF I allow them to be popups or an icon in a toolbar, should always be in the same place and not cover the page.
In a way it is - or rather it wouldn’t t change anything if we added more features.
The default is “no”. Without explicit consent you can’t do a lot of things.
You can’t have a default yes, because how can you agree with consent but automatically to everything?
And if it’s a no, are you saying you can’t ask a user for permission to use their data for a specific purpose?
And if you can ask, that’s what we have right now.
Voultapher 5 hours ago [-]
They are asked _once_ during browser setup, same way on iOS users are asked once during setup if they want to allow Apps to track unique IDs (memory is hazy, they did that a couple years ago). And surprise surprise IIRC 96% of users said no.
lukeschlather 21 hours ago [-]
Yeah I think it probably does mean you should be banned from asking in most cases. If you have a legitimate interest you don't need to ask. If you need to ask your interest is not actually legitimate and you know it.
buzer 17 hours ago [-]
Legitimate interest is not currently enough to read or write cookies. You need either consent or it must be "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." (or "sole purpose of carrying out the transmission of a communication over an electronic communications network", but that's harder to apply to cookies)
inigyou 5 hours ago [-]
Which part says legitimate interest doesn't apply to cookies?
buzer 2 hours ago [-]
"legitimate interest" is legal basis in GDPR. ePD (which governs access to cookies) does not have such legal basis, only consent and the two exceptions.
Other processing (like after value is read) can happen under GDPR if the data is personal data.
nickff 22 hours ago [-]
If people really cared, they’d choose browsers that have better control, but that’s obviously not a priority for them. Why do you think this sort of thing should be regulated to suit your preferences when most people don’t seem to agree with you?
preg_match 22 hours ago [-]
Because everyone agrees - cookies banners are annoying and need to go away. Everyone is on the same page about this. The easiest way to make that happen is "move them into the browser".
How often do you get prompted for, say, secure DNS or HTTP? Almost never, because your browser has sane defaults and controls that. So, there you go.
tsukikage 7 hours ago [-]
What is the sane default response to "we and our 242 partners value your privacy"?
I mean, it's even the literal truth: they value your privacy in the sense of having their software do a little internal auction to put a price on it.
ablob 22 hours ago [-]
I think that's a stretch. People can care, but be unwilling to spend the time researching it or accept the trade offs that come with small browsers (which are often unsupported for applications you might want to use).
There are many things someone might care about and at some point you have to prioritize. This topic in particular is practically a cold war where you always have to catch up on how things are, lest you loose it all. The required effort is disproportionate to the result.
P.S.: No true Scotsman spotted
yjftsjthsd-h 18 hours ago [-]
> If people really cared, they’d choose browsers that have better control
What browsers would those be?
ClumsyPilot 22 hours ago [-]
> If people really cared, they’d choose browsers that have better control
If people really cared, they’d chose reputable suppliers that sell non toxic food. If they are eating food with lead, they don’t care.
Don’t force your wordview on people through regulation
whstl 21 hours ago [-]
> Don’t force your wordview on people through regulation
As opposed to enforcing your worldview with a lack of regulation?
Because that's precisely what's happening, with the advertisement industry enforcing their worldview through lack of compliance.
ClumsyPilot 5 hours ago [-]
That was suppose to be a reductio ad absurdum, not a genuine argument
whstl 5 hours ago [-]
Poe's law strikes again! My fault here, sorry for the misunderstanding!
ethin 22 hours ago [-]
IMO any contract, waver, etc., shouldn't be legally enforceable unless the signatory has actually read it. It's always seemed to me to be one hell of a pathway of abuse (in a way) to just be able to bind someone to be legally required to do anything you want, for example, by just relying on them not reading the thing they signed.
dotancohen 22 hours ago [-]
How to know if they actually read it? The signature implies that the contract has been read, understood, and accepted. I see no need for any alternative mechanism.
buzer 17 hours ago [-]
Well, if you presented them with list of 100 partners each with 20 page of privacy policies and they accept it within 10 seconds it should be tricky to argue that user actually read it all.
You could, for example, require that user answers very specific questions regarding 10 randomly selected partners and how exactly they can use the data ("is partner x allowed to build very detailed profile of you and target you with political adverts that are designed to manipulate you?").
ApolloFortyNine 15 hours ago [-]
If you did this people would only use the same half dozen sites and competitors would emerge.
We're borderline already there today when the cost of switching is typing a different url at the top of the screen. You add some mandatory 20 minute wait and you'll never see a new site again.
Google and Facebook would love it though.
inigyou 5 hours ago [-]
Plus sites that don't track you
inigyou 22 hours ago [-]
Well for instance if the other party is pressuring you to sign it then it can't be assumed that you had adequate time to read it and understand it
dotancohen 20 hours ago [-]
Contract law of every civilised land already has a process for considering and accounting for duress.
inigyou 19 hours ago [-]
It only accounts for "sign this or I'll kill you" not for "you have ten seconds to make a decision or the dream vacation goes to the next person"
crote 19 hours ago [-]
Some countries already have provisions for this.
For example, in The Netherlands there is a legally mandated three-day period after signing the contract for purchasing a home during which the buyer can still call off the deal.
The reasoning for this is that it is a seller's market, with demand far outnumbering supply. In practice it is very common these days to end up in a bidding war, and even forego any kind of "sale is void if home inspection turns up issues" clause. Want to think about it for a day or two before signing the biggest contract of your life? Too bad, another buyer is willing to sign today.
With the mandatory three-day waiting period you avoid buyers being locked into a contract they basically immediately regret. It gives them some time to do due diligence, reducing the risk of buying a complete lemon. The seller can ask for a similar clause to be inserted, but it is less common. After all, the only risk to the seller is getting slightly less money for it, and that's already mostly dealt with during the bidding process.
tremon 17 hours ago [-]
Your specific example is not intended to address buyer's remorse, but mortgage financing. After agreeing to a house sale, the buyer has three days to have their bank sign off on it. Yes, it's nice that it slightly alleviates pressure but the primary goal is to streamline house sales by making the financing details part of the finalization instead of the decision-making process.
chrismorgan 16 hours ago [-]
I don't believe you’re correct. Certainly in Australia the cooling-off period is all about buyer’s remorse; “subject to finance” is a completely unrelated condition commonly added to the contract, and even with pre-approval it’s probably seldom resolved within three days.
ethin 18 hours ago [-]
Is that not what the courts are for? I imagine that if a court had to enforce a requirement like this, knowledge would generally be the best kind of proof. If you know what the contract said (or even it's terms in general) that would be enough.
The reason this isn't done is because corporations legal departments love writing 10-100 page contracts that absolutely nobody is going to read.
ymolodtsov 23 hours ago [-]
Websites need cookies.
I don't get why I have to suffer through this for a few puritans who literally lose nothing in the process of this transaction but act as if Stasi is watching them.
estebarb 23 hours ago [-]
Session cookies do not require a banner.
tempestn 23 hours ago [-]
Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.
preg_match 22 hours ago [-]
You don't need cookies for basic aggregated analytics. Now if you want to track and record mouse movement, you do, and that's a privacy concern.
The law really has nothing to do with cookies, it has to do with privacy, tracking, and PII. You can absolutely save preferences and perform analytics. What you can't do is hoard data that is personally identifiable for purposes that are not obvious to the consumer.
evcaldera 8 hours ago [-]
You need cookies if you simply want to run conversion analytics or any kind of performance marketing for media/ecommerce.
TurdF3rguson 14 hours ago [-]
Actually you can't send any cookie that is not essential to the operation of the website without consent and that would include analytics regardless of PII. same for pixel tracking / fingerprinting, it's all a no-no.
inigyou 5 hours ago [-]
There's "legitimate business interest" which I think is a catch-all for things you want to do as long as they don't invade privacy?
tappio 22 hours ago [-]
There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.
tempestn 22 hours ago [-]
My understanding is that any front-end analytics solution will require consent. You're right about explicitly set preferences. I was mixing that up with inferred preferences.
jason_oster 20 hours ago [-]
It depends on what is to be analyzed.
How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
ApolloFortyNine 15 hours ago [-]
How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site, and most people consider this to require consent. Or at least it not being worth the risk to not ask.
Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
tappio 11 hours ago [-]
That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side.
Of course, recognizing users across days requires consent. But is that really necessary?
inigyou 5 hours ago [-]
Or use some JS to put the time-on-page in the next request, right?
Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.
anonreplier 7 hours ago [-]
In the world of zscaler, CGNAT & corporate proxies, IP address is nowhere near enough.
literallywho 13 hours ago [-]
>How long did it take x user to navigate from x screen to y screen is one of the most valuable metrics for any site
Stats like that are only used to implement dark patterns better and justify user hostile decisions since pretty much the time the idea of telemetry was introduced. Otherwise, we'd live in the world of perfect web ui and we're not.
micromacrofoot 17 hours ago [-]
that's not true at all, plausible can be configured to require 0 consent
yjftsjthsd-h 18 hours ago [-]
> Aggregated analytics do,
Good.
> and you can't run a serious website without some kind of analytics.
I don't believe you.
> Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.
IANAL, but I'm given to understand that this is untrue.
tempestn 17 hours ago [-]
You're right about explicitly set preferences.
What do you see as the harm in website owners using aggregated analytics data to improve their sites?
yjftsjthsd-h 17 hours ago [-]
Abstract: It's still spying on users.
Practical: Supposedly-aggregated stats have a history of actually being perfectly possible to analyze back into individually identifiable information. Also, it's conveniently the same tech stack in a way that makes it easier to make an actual slippery slope.
tempestn 15 hours ago [-]
The practical argument I can understand. From the abstract argument though, it sounds like you'd be opposed even if the anonymization could be guaranteed, which I don't understand. Why is it "spying" to try to understand in aggregate how users are using your website? How are you supposed to eg. identify usability problems without this information? And what is the harm to users? (Again, in the abstract case where we leave aside any possibility of individual users being identified.)
micromacrofoot 4 hours ago [-]
because no one has shown an anonymization guarantee yet
micromacrofoot 17 hours ago [-]
if you're talking about cross site cookies, which are the big ones that require consent: no they don't!
inigyou 5 hours ago [-]
Consent has nothing to do with crosssiteness except insofar as that proves it isn't needed for the operation of your own site.
micromacrofoot 4 hours ago [-]
lol sounds like it does then
Ferret7446 16 hours ago [-]
The solution for the problem caused by regulation is more regulation. Sure, we didn't anticipate the negative consequences the first dozen times, but this time there will absolutely not be any unanticipated consequences.
LadyCailin 16 hours ago [-]
So, what, have no regulations whatsoever then? What an absurd suggestion. It’s a cat and mouse game, sure, but that’s like saying “there was a security hole in the software, might as well give up on trying to secure it.”
20 hours ago [-]
otterley 24 hours ago [-]
> From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them out of the way
There’s no way this would fly. “I didn’t read it” can’t possibly be an excuse to avoid being bound by an agreement. Every party to an agreement that flaunted its terms, even though they took advantage of the benefits granted by it, would invoke it as a defense, and it’s irrefutable. The system would completely fall apart if this happened.
There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing.
znnajdla 24 hours ago [-]
> “I didn’t read it” can’t possibly be an excuse to avoid being bound by an agreement
Only engineers have trouble understanding this. It can be a reasonable defense, and it has successfully been used in courts of law many times. The law is not a machine that compiles text like code literally. Imagine someone who coerces a dying or sick person to sign an agreement they couldn’t possibly be in a reasonable state of mind to understand what they were doing -- the law can and does invalidate such “contracts”. That is the same principle behind age of consent laws. The law could theorerically (and does) invalidate “agreements” which no one is reasonably expected to read and understand.
otterley 23 hours ago [-]
I am an attorney, and am aware of certain exceptions. But these are exceptions and not the general rule, which is what I am speaking of.
> The law could theorerically (and does) invalidate “agreements” which no one is reasonably expected to read and understand.
I haven’t heard of a single case where an agreement was voided because “no one could reasonably be expected to understand it.” Unless the language was so impenetrable or vague that the agreement itself could not be discerned. Lawyers tend not to write such agreements.
IsTom 23 hours ago [-]
EULAs are restricted in power in EU and at least to me these cookie banners are similar in spirit.
tempestn 23 hours ago [-]
"I didn't read it," sure. But, "A reasonable person would not read it?"
ChadNauseam 23 hours ago [-]
Why would a reasonable person not read it?
I just visited theguardian.com to see their cookie banner. The banner says this:
> Your Privacy (`x` button to close the tab)
> US residents have certain rights with regard to the sale or sharing of personal information to third parties.
> Guardian News and Media and our partners use information collected through cookies or in other forms to improve experience on our site and pages, analyze how it is used and show personalized advertising.
> You can opt out of the sale of all of your personal information by pressing
> <button>Do not sell or share my personal information</button>
It's 3 sentences, plus a button that says "Do not sell or share my personal information". I actually don't even think this is GDPR compliant, because my layman's understanding says that GDPR consent must be presented as opt-in, rather than opt-out. (I guess they are going for CCPA/CPRA compliance?) But anyway, I would think that a reasonable person could be expected to notice a button that says "Do not sell or share my personal information" and then click it, especially when it's portrayed prominently at the bottom of the page.
preg_match 22 hours ago [-]
> Why would a reasonable person not read it?
Because this is there 1 millionth cookie banner, because every site and their momma has one.
Also, 90% of cookie banners are not this good. They tell you nothing, hide the "reject" button behind multiple screens, etc. At that point the consumer is trained to click accept.
zenalt 6 hours ago [-]
From Europe it's this text:
> Personalised advertising - it's your choice
> Independent, quality original journalism needs your support.
> Please choose an option.
> * Accept personalised advertising and all cookies
> We use cookies and similar technologies to support the Guardian and personalise your experience in other ways. To do this we work with a cross section of [139 partners].
> - or -
> * Reject all and subscribe to Guardian Ad-Lite for €5 per month
> Read the Guardian website without personalised advertising. This does not include ad-free. You will still see non-personalised advertising and we may still use cookies and similar technologies to improve our site.
Followed by:
> Some cookies are necessary to help our website work properly and can’t be switched off. Find out more in our privacy policy and cookie policy, and manage the choices available to you at any time by going to ‘Privacy settings’ at the bottom of any page.
> Cookies and similar technologies collect information from your device and may be used to access personal data about you including page visits and IP addresses. We use this information about you, your devices and your online interactions with us to provide, analyse and improve our services. We use cookies and similar technologies for the following purposes:
> * Store and/or access information on a device
> * Personalised advertising, advertising measurement, audience research and services development
> * Personalised content and content measurement
And finally the buttons:
> ( Accept all ) ( Reject all and subscribe )
> If you already have Guardian Ad-Lite or read the Guardian ad-free, [sign in]
inigyou 5 hours ago [-]
Notice how they show you those three sentences and don't just put a bunch of small print at the bottom of the page. Because if they did, it would be invalid.
troupo 23 hours ago [-]
This is indeed a rather good implementation of ehat GDPR requires: clear unambiguous language, an opt-out available immediately.
This is the definition of informed consent
jkaplowitz 20 hours ago [-]
The GDPR doesn’t allow opt-out consent to count as consent. The only consent it recognizes as valid consent is opt-in.
However, since we are discussing the banner that The Guardian website shows to US viewers, I assume they’re trying to comply with California privacy law, which does allow opt-out regarding the sale of personal information.
troupo 10 hours ago [-]
> The GDPR doesn’t allow opt-out consent to count as consent.
wat
GDPR says that opt-out is the default, and if you are asking for consent, it had to be clear, unambiguous, and with both chouces clearly present.
inigyou 5 hours ago [-]
You're both using different meanings of "opt-out"
Not legal: you have to click a button to be opted out, otherwise you're opted in. (Opt-out as a verb)
Legal: you are opted out by default (opt-out as an adjective describing the default situation)
You've muddled the definitions again. "opt" signifies an action by the user.
If I am "in a group" by default, then I can take an action to "opt out", requesting to be removed from the list.
If I am not initially joined to the group, then I can take an action to "opt in" and be added to the list.
There is no such thing as "opt by default". That is not a user action. It also makes no sense for the same list or group to be both "opt in" and "opt out" because, as adjectives, they imply the default states and they describe the user action taken to change that default.
opt-in: default state is out
opt-out: default state is in
tacitusarc 23 hours ago [-]
But it is complicated, no? Even if you click you agree, if the you thought you were agreeing to one thing but actually agreed to another because they buried the lede, “I didn’t read it” is a reasonable defense.
SiempreViernes 22 hours ago [-]
Why would you claim the false "I didn't read it" ahead of the true "I read it but understood it differently"? The latter allows for adding the fault shifting claim "because the other party wrote it deceptively", while "intentionally didn't read" makes it much harder to blame the other guy.
otterley 23 hours ago [-]
It just won’t fly in court. Full stop. There are perhaps other defenses to be raised, like unconscionable terms, but not that one.
tacitusarc 17 hours ago [-]
I think that means one of three things: the court system is broken, you are wrong, or I failed to be clear and you misunderstood me.
So, to be clear, if a company buries or obscures terms while making it seem like they have presented them, so you agree without reading the actual terms, you cannot defend yourself by explaining that situation?
otterley 16 hours ago [-]
One possibility you failed to enumerate was that you are wrong.
But anyway. What exactly do you mean by “buried or obscured”?
As I said above, if the parties cannot be said to have an agreement because the terms of the agreement itself are inscrutable, then that would probably result in no contract being formed, or the terms at issue interpreted in the light most favorable to the non-drafting party. Like if the terms were presented in so small a font that only someone with a microscope could have read them, or it was written cryptographically or is gibberish.
Basically you have to successfully argue that no reasonable person could have read and understood the agreement. You’re unlikely to prevail if you argue only that you, the individual, did not. (Unless the court also finds you are incapable of entering into any contract because you’re a minor, are non compos mentis, etc.)
tacitusarc 12 hours ago [-]
A more concrete example may be useful to explain what I’m thinking.
A company has you click to agree to their TOS. They link a doc, which is of course quite long. That doc has a footnote which links to another doc. You do not read the secondary doc, and it is the contents of that doc that allows the company to sell you data/prevent you from suing them/harvest your organs/abduct your family/whatever.
My point is that “I did not read the document” should be a valid defense, such that if it is not I believe the law around this is wrong.
I suppose you can claim I am wrong to believe that, but it is accurate for me to state that I _do_ believe it, which is why I didn’t list me being wrong as one of the possibilities. Practically speaking, that is the first possibility I enumerated.
I should note that in my example, imagine neither doc is any more inscrutable than all the TOS we encounter in the wild, instead it is the construction (the fact it is a footnote link) that makes it easy to miss the additional doc.
otterley 11 hours ago [-]
Incorporations by reference are not unusual in contracts. A contract is unlikely to be voided merely because the contract has references and the counterparty didn't read them.
ferngodfather 22 hours ago [-]
It really depends on the term they're trying to rely on. We have the "red hand rule" in England and Wales that means that unusual and onerous terms will not be incorporated unless it can be expressly shown they were fairly brought to the parties attention.
victorbjorklund 23 hours ago [-]
It can and has been in many cases in many legal systems. For example, let’s say you walk into my store to buy a dish washer. I say ”here is an extended warranty that I will give you. Just sign” you sign it instead of reading 15 pages of boilerplate. In the end of the document it says you now owe me 10 billion dollars. Doubt I will be able to enforce it in most legal systems.
otterley 23 hours ago [-]
That’s not an “I didn’t read it” defense. That’s a “term is this contract is unconscionable” defense. They’re not the same thing. I was speaking strictly of the former.
Also, striking an unconscionable term typically does not void the whole contract. Just the term in question.
bryanrasmussen 23 hours ago [-]
As a general rule I believe many online terms of use, eulas and similar online contracts are examples of procedural unconscionability, in that length is often too long that one can be expected to read it in the day to day action of "surfing the web", I believe this is also the opinion of the EU and many of its member states, hence the limitations found on enforcement of such contracts.
Aside from that many of these contract have terms that might be considered substantive unconscionability - for example if terms state that what you post can be used by the company that owns the service for marketing of the company or the service I feel this would not make it through most legal systems that I feel before the attempt are not inherently corrupt.
otterley 23 hours ago [-]
I would personally be shocked if the EU voids click-wrap agreements for unconscionableness based on the process alone. I’m not super familiar with EU law; is that what it truly says? I rather doubt it because I do business in the EU and have been asked to agree to terms as a condition of making purchases online there.
simonra 22 hours ago [-]
Online retailers in the nordics occasionally try to post terms and conditions that contradict consumer protection laws, for instance retailers being on the hook for warrantying product(ion) defects for 5 years after purchases of products that ought to be durable, like electronics. The retailers win out on a substantial amount of the population not contesting it, but if you as a consumer go through the process the findings is basically always in your favor, despite there being agreements to something else. Telecommunications providers also have a long history of having their consumer invoices being voided for being unconscionable despite service agreements, especially in cases with children playing with devices (but otherwise also), going all the way back to the landline age.
otterley 21 hours ago [-]
Right. But those are substantively unconscionable terms, not about the agreement process itself.
bryanrasmussen 20 hours ago [-]
sorry I did not phrase that very well, when I said as a general rule I believe I meant that if put to the test it could be often won on length alone in conjunction with the activity being done, but almost always these contracts are substantively unconsionable and of course people contest that, because most people don't get angry and want to fight for no reason, they do it because it is violating their rights.
As an example I have an email account with site A. I go to site A and log in, they suddenly spring a large new contract for me to read, I cannot get through to do what I came to do, it will take me 5 minutes to read so I click OK because I am on my way to check my email with site A. Procedurally this is not reasonable behavior.
What would be reasonable?
"Hi, we are changing our terms of service, you can see it at this link and agree. If you don't have the time right now you can do it later, but in three days you will lose access to the service unless you agree to terms."
There are however lots of other laws in the EU which may in fact make this behavior substantively unconscionable anyway. I certainly believe there would also be substantive arguments to be made in this case.
SiempreViernes 21 hours ago [-]
The council directive on unfair terms in consumer contracts puts every pre-canned contract in scope, and unfair provisions on a contract are rule non-binding (if the contract can keep existing after the unfair bits are taken out).
Right. But those are substantively unconscionable terms (“unfair provisions”), not about the agreement process itself.
victorbjorklund 6 hours ago [-]
No, it is literally ”I didn’t read the contract”. Let me guess you don’t have a law degree in Swedish law and you are just making statements on every legal system in the whole world?
Just read avtalslagen paragraf 30. It says just that. And it is different from paragraf 36.
otterley 2 hours ago [-]
I read it. The law expressed therein appears to be consistent with typical contract law in the West, including the UK (from which US law is derived) and other European countries. I don't see any major differences. (Also, I'm not sure why you brought up paragraph 30 as that is about fraudulent inducement.)
See also https://svjt.se/svjt/1959/497 "En person borde sålunda bli bunden av ordalagen i det dokument han undertecknat utan att äga att ursäkta sig med att han icke läst igenom dokumentet."
lukeschlather 20 hours ago [-]
All of these cookie forms have the same set of toggles. At a high level all anyone is saying is that we should just declare any kind of tracking cookies unconscionable terms for this kind of dialog box. Caching, shopping carts, explicit log in, these are totally fine and you don't need a dialog. The tracking stuff is not that hard to define and it should just be declared unconscionable.
Y_Y 22 hours ago [-]
That's why billionaires don't buy their own dishwashers
"Disney is trying to have a widower's wrongful death lawsuit dismissed and sent to arbitration because the man had signed up for a Disney+ account several years ago."
Now what happened was that Disney quit fighting over really bad PR. But the court challenge would have liteky succeeded.
Paracompact 23 hours ago [-]
What's bullshit? You mean to say the dishwasher buyer would legally be on the hook for billions?
nekusar 19 hours ago [-]
Its bullshit that a terms of use can "agree" to what amounts to unconscionable terms.
Mozilla with their Thundermail just tried saying in their ToS that if you're mentioned at all in anything legal, you agree to pay their legal fees.
c0_0p_ 24 hours ago [-]
That argument has actually worked in some cases, especially when you need to click away to actually access the document. I assume it's why we see more and more examples where you need to scroll the full body of text in order to "agree".
bluGill 24 hours ago [-]
Of you need a nonstandard contract then you need to provide proof that it was understood. These are not provided in a context where I would expect anyone reading it to have a lawyer to advise so they obviously don't understand it
otterley 24 hours ago [-]
By that same logic, do you believe ignorance of the law is a valid defense to a criminal charge? Laws are also written by lawyers.
bluGill 21 hours ago [-]
No, but I do believe that if the jury doesn't find it was obviously a crime without any being told the law then it wasn't a crime. That is the text of the law isn't important until guilty is decided. (So the jury can decide degree if that is a question for the jury, otherwise the judge needs to know for sentencing but the jury doesn't care)
Avicebron 24 hours ago [-]
> There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing.
The value is derived from the people consuming the product. Placing the "incentive to produce value" above the people who presumably are the source of this value seems...misaligned.
otterley 24 hours ago [-]
If there’s no product or service to be consumed, there’s no value produced either. That’s the point: it’s harmful to eliminate the incentive to produce.
Avicebron 23 hours ago [-]
People will _always_ need things. There are very few things that will eliminate people's need for things and producers will of course adapt to the environment.
What we need is an environment that does not give the producers asymmetric power over consumers and the products will naturally align with that.
inigyou 24 hours ago [-]
What if only the incentive to produce bad things is eliminated
monkpit 23 hours ago [-]
* definition of bad is subjective and may vary depending upon which lobby group has the most cash to throw around
inigyou 23 hours ago [-]
no, I referred to actual bad things
otterley 23 hours ago [-]
The point is still correct. People often disagree on what is good and what is bad. It’s a judgement, not an indisputable fact.
readread 23 hours ago [-]
Oh good, nothing's possible then, we should give up on regulating bad things because hitmen think murder isn't bad when they do it.
otterley 22 hours ago [-]
How did you arrive at that conclusion? Laws are the result of debate between sides and the prevailing opinion. The fact that laws aren’t identical in every jurisdiction worldwide reflects that there isn’t universal agreement on every question.
Also, sarcasm isn’t welcome here. Please read the HN guidelines.
Ah yes, I didn't couch my post in any of the various, rampant HN-friendly versions of shitposting. I'll try to follow your example from here on out. Excellent touch citing the guidelines at me after your role in this thread, A+.
Re-reads this thread, taking notes
Y_Y 22 hours ago [-]
You can hardly expect a greenname to have mastered such a subtle art.
readread 20 hours ago [-]
I abandon accounts when they get way into the hundreds of karma, generally, or a couple times I’ve let it get a ways into the thousands before destroying the password. I prefer not to become attached to it, and find the minor clout of recognition (upvoted comments that probably ought not have been…) kinda gross.
inigyou 6 hours ago [-]
You shouldn't admit to multi-accounting. It's grounds to be shadowbanned.
readread 3 hours ago [-]
Meh. I never have more than one at once, and destroy my access to old ones before creating a new one (often taking weeks or months off from posting in between). I'd be a lot more "dangerous" or "risky" if I were sitting on an old tens-of-thousands-of-karma account, which is what I'd have otherwise.
People routinely create alts just to post sensitive stuff and seem to do fine, and presumably they are keeping multiple accounts active at once.
[EDIT] I mean plus if I gave that many shits about being able to post on HN, I'd probably care a lot more about holding on to my precious karma in the first place, no?
Fraterkes 20 hours ago [-]
Your condescension is also obviously unhelpful here. Do better.
otterley 18 hours ago [-]
What precisely did I say that is condescending?
HN is supposed to have higher than typical standards for participation than most internet fora and is largely self policing. It’s not condescending to tell people when they are misbehaving. Nor is it condescending to explain to people the law and how things work, provided you’re not insulting them in the process. Which I’m not doing.
I find much more concerning people’s certainty of their mistaken understandings and beliefs, combined with the most ludicrous possible interpretation of other’s positions.
inigyou 22 hours ago [-]
so why do anything if it's impossible to tell what's good and what's bad?
otterley 22 hours ago [-]
See my sibling comment.
inigyou 6 hours ago [-]
I did, it didn't explain it.
22 hours ago [-]
bee_rider 22 hours ago [-]
I don’t see how we could possibly prove that the person who clicked “I agree” is still the person using the computer.
Or that any actual human is aware that an agreement was made (since an AI can find a checkbox nowadays or software can be configured to bypass it). One way to add balance could be to require people asking for contracts to actually treat them like real serious legal documents, show up for the signing, and figure out who they are making an agreement with.
otterley 21 hours ago [-]
That doesn’t matter. If you authorize an agent—human or mechanical—to enter into agreements on your behalf (even by mistake), and the agent presents itself as operating on your behalf, the agent’s decisions will be treated as though they were your own.
Prinicipal-agent law predates computers by a very long time.
bee_rider 12 hours ago [-]
What if an IT guy installs one of those “cookie banner be gone” extensions without the user’s permission?
deaton 23 hours ago [-]
But "its specifically engineered to ensure that nobody reads it" is a real argument
otterley 23 hours ago [-]
Where has this ever been adjudicated?
24 hours ago [-]
arjie 21 hours ago [-]
Good grief no. Using websites in the UK and the EU is an exercise in pain. Every single one of them has the doorway effect where you follow a link to them and you’re faced with some Subway sandwich grade range of choices to be made and you’ve forgotten why you were there in the first place.
As it stands I just hit Accept on literally everything and that’s fine for me.
It already pushes the correct "Reject" button for you on a lot of sites (not all; it works based on rule lists)
arjie 21 hours ago [-]
I used this for a bit and then some sites would just not work. I get it. It’s a hard thing to do and I admire it but getting blank result is far more frustrating than clicking accept each time.
bbg2401 20 hours ago [-]
How cookie consent has been deployed by the data sponges is my go-to demonstration of malicious compliance.
goodrubyist 22 hours ago [-]
If someone does not read a contract or a legal agreement, before accepting or signing, it's on them, as long as they were provided an opportunity to do so. Dissolving legal agreements because people didn't bother them to read them is not conducive to a society. This also harms people who would like to be able to form contracts with others and enjoy the benefits that come with that (for instance, you usually get something in return for agreeing to something you wouldn't otherwise). The government should not have such a big role to play here and decide which contracts are not allowed to go through.
TheScaryOne 22 hours ago [-]
>If someone does not read a contract or a legal agreement, before accepting or signing, it's on them
When was the last time you read an entire EULA before installing software?
I'm going to guess the time frame is somewhere around "never."
These are nuisance contracts designed to jade people with legalese while stealing their rights to things like class action and enforcing binding arbitration.
Standard contracts sounds like the way to go.
goodrubyist 17 hours ago [-]
I skim or read all the time, and so should people -- but ultimately they're adults and if they want to agree to them without reading, it's their choice (they shouldn't expect to later say they didn't read - this doesn't work, and that's how the current American legal cases were decided as well, thankfully, see e.g. regarding arbitration). Btw, regarding class action and arbitration, many of us already know that these are present in bold in the terms of many services we use or are going to use without even actually reading them.
Phemist 1 days ago [-]
> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner.
So lawmakers do know how to make legally binding preferences based on device settings? What a crazy innovation.. now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act nonsense...
mike_hock 1 days ago [-]
Don't fall for the "we are just stupid" propaganda, which is used constantly by governments acting in bad faith.
Browsers already had settings for deleting cookies. There was never a reason for banners whose only function was pulling the ladder up from smaller competitors and concentrating power in the hands of an oligopoly that could siphon data directly from the OS.
This coupled with a law mandating ISPs provide a "change IP on demand" feature would have given users a sort of "Tor light" level of privacy. Strong privacy is trivial to achieve for a government that doesn't have a conflicting goal of total surveillance.
morsch 22 hours ago [-]
But I don't want to delete cookies? I want websites to use cookies that are technically necessary e.g. for keeping me logged in. I just don't want them to use it to track my behavior especially inter-website.
bhaak 7 hours ago [-]
The EU law already allowed technically necessary cookies without any banner.
Every time you get a cookie banner with options, the website wants to know more about you than the law permits by default.
toxik 7 hours ago [-]
... or cargo culted a site that did. I think this is far more common. It's almost like you're not a serious web site if you don't have a cookie popup of some kind.
mike_hock 21 hours ago [-]
Interwebsite is solved by partitioning and login cookies are solved by explicit whitelisting.
inigyou 21 hours ago [-]
You think the average user is going to explicitly whitelist? The law requires sites to whitelist their own cookies under penalty of law, instead.
mike_hock 21 hours ago [-]
> You think the average user is going to explicitly whitelist
When prompted by the browser on first login/signup, yes, the same way the password manager works. With stored passwords, keeping the login cookie doesn't even add much value.
inigyou 19 hours ago [-]
What about the other 200 unskippable prompts you get just by opening the website?
Well, there is a skip button. It's labelled "accept all"
IanCal 21 hours ago [-]
It’s not about cookies. It’s about what the site is allowed to do with your data. Cookies are an implementation detail.
It’s baffling we’re having this misunderstanding on this site in 2026 still.
TurdF3rguson 14 hours ago [-]
Is there any other way to get that data? It's clearly about cookies but it's specifically about tracking cookies.
And BYW, browser headers can even be a violation if it's determined that you are using them for tracking users in a way that violates ePrivacy demands.
It's still a cookies thing.
rtpg 17 hours ago [-]
This framing of the banners as cookie banners is a dodge. It's not about cookies.
The cookie banner isn't about the usage of cookies, it's about _the underlying tracking_. You're allowed to "just" use cookies for normal shit! You can make a website where you use cookies to store login state for a user, without a single banner.
The thing is that every company in the world feels the need to add 1000 tracking cookies to anonymous users to track them through conversion funnels (on top of the ad stuff). That's what you have to inform people about
You can use cookies normally without a banner! You can't track without consent! Every cookie banner is actually a "we want to track you" banner. Calling it a cookie banner is playing into the confusion about what those banners actually are meant to communicate
aspbee555 24 hours ago [-]
changing IP is not really enough for privacy, there is many ways to fingerprint your machine/browser and uniquely identify you across networks
No, but it's the obvious starting point. You can then put additional laws on top banning fingerprinting out of band (if you care about window dressing), fund development of anti-fingerprinting technologies, fund Tor, run exit nodes in a transparent and publicly auditable fashion, etc.
It's not hard to make privacy work when you are the government rather than working against a hostile one.
24 hours ago [-]
Jtarii 22 hours ago [-]
Is there any reason to believe that the current laws being passed by the UK, EU are against the will of the people? Everything I have seen makes the "anti-porn" laws or whatever seem extremely popular.
inigyou 24 hours ago [-]
I think it's because every single website breaks if you don't allow cookies at the browser level. Some knowledge of what the specific cookie does was necessary.
croes 21 hours ago [-]
You mean we had the DNT flag in the browser.
AlienRobot 19 hours ago [-]
Exactly. Nobody wants to go to a news website/entertainment website/informational website that relies on ad revenue because they will get bombarded by banners and then by a huge number of ads that were increased because those banners slashed their ad revenue.
So instead everyone stays on Facebook, Instagram, Reddit, and Twitter, which ALSO operate on ads and have far more information on their users than any third-party ad tracker could ever have.
None of this has gotten rid of the privacy problems. It just consolidated them into the worst offenders while jeopardizing the plurality of the web. Now instead of people being tracked by Facebook on a website with a third-party cookie in a like button, they are tracked by Facebook on Facebook in a Facebook page because they never leave Facebook.
tgv 1 days ago [-]
The problem there is that parent's won't know how to do it, or won't care. Many can hardly operate the most user-friendly phone, let alone manage accounts.
The online safety acts and its EU counterparts are somewhat risky, but nobody wants the mention the only proper alternative: a total ban on "social media." Not just for kids, but for everyone. Or a ban on smart phones, that would work too, at least short term. But: money.
alt227 1 days ago [-]
> The problem there is that parent's won't know how to do it, or won't care.
This is unfortunately the reality.
The other day a friend asked me to help her make her phone safer for her kids to use. I started by asking if she set permissions on the apps she downloaded. She looked at me blankly, "What permissions?". I proceeded to show her how you can granularly control what you allow each app to do on your phone and what access it is allowed. Her head blew up, she had no idea any of this existed and after gong through a few menus, she didn't care any more. It was all too complicated and too much to think about for a busy mum.
This is why governments unfortunately are having to try to protect people from themselves. As tech competent people it all seems so simple to us, but we need to remember the majority of the population just click 'Allow All' and blow past all permission and security questions as they have no idea what any of it means.
dijit 1 days ago [-]
"is this device for you, or a child" is one of the first options when setting up an iphone.
I haven't set up an Android in a while, but, I doubt it's massively different.
alt227 24 hours ago [-]
Yeah but most parents devices are for them, they just let their kid use it too.
dijit 23 hours ago [-]
Ah, I guess it's impossible to have a quick enable kids mode then.
We should just give up and give random individuals access to everyone's camera roll.. no other way.
SiempreViernes 21 hours ago [-]
It is probably technically possible, but as almost twenty years hasn't been enough to implement this feature in either of the big mobile systems, it's obviously a huge practical challenge for Apple and Google.
fuzzzerd 14 hours ago [-]
Windows phone had this exact feature. Obviously it didn't survive the duopoly of iOS and Android, but the feature was alive and well for many years before the whole OS was killed.
dijit 20 hours ago [-]
Yeah, obviously.
Greatest minds of our generation couldn’t possibly invent fast profile switching.
Lost technology.
dwedge 22 hours ago [-]
Is there a term for agreeing with someone's stance but disagreeing with the person because they're so insufferable and sarcastic in the way they present the argument?
Latitude7973 5 hours ago [-]
Yes, it is called tone policing.
dwedge 3 hours ago [-]
I was under the impression that tone policing was using to attack the tone because you disagreed with the argument
dijit 22 hours ago [-]
“I don’t want to be seen agreeing with someone who combats obvious bad faith arguments with sarcasm - please think of me as being better than that, even though we would end up in a pissing contest about nuance or a digression away from the main point”.
Bit of a mouthful though.
mcfedr 22 hours ago [-]
it's very simpler, i recently got an android tablet for my child and it would take a lot of effort to miss all the stuff about setting it up for a child
SoftTalker 24 hours ago [-]
Make the default "allow none" or "child-safe" and then if the parent does nothing that's what they get.
Kuyawa 1 days ago [-]
When we buy a new phone, the configuration process should ask if the device will be used by a kid. Easy and simple.
When restoring factory defaults, the same question, just in case the phone is sold, gifted, stolen or whatever.
If you are going to give a phone to a minor you should set that option right from the start.
vidarh 22 hours ago [-]
UK mobile operators already defaulted to blocking adult sites before OSA, and lets the subscriber turn it off, which seems like a reasonable option.
It'd be even better if there was a way for people to selectively turn it off for specific devices without MITM the connections. It wouldn't be that hard to come up with a mechanism for that.
broken-kebab 1 days ago [-]
It's ok if parents won't care. It's a choice too.
SoftTalker 24 hours ago [-]
Yes, you can't make parents care, but make it easy for the ones who do, and you'll also pick up some number of those who care but only if it's not too difficult. There's no reason a parent should have to set permissions separately in 10 differents apps on a child's device.
SoftTalker 24 hours ago [-]
That's why the setting should be on the device, not the browser or individual apps. One setting that you could even get pre-configured when you buy the phone.
alt227 24 hours ago [-]
It still doesnt solve the problem of the millions of parents that just dont care.
GaryBluto 23 hours ago [-]
Why should I care that they don't?
preg_match 22 hours ago [-]
Right, this is the big picture nobody acknowledges. I'm not paying the price for your kid because I don't know them. I couldn't care about them even if I wanted, because their existence doesn't even intersect with my life.
Yes, as a parent, you are required to put in more effort into parenting your kid than random hypothetical people. That's obvious, and has been the case forever.
I understand the concept of community, but community is not me sacrificing my privacy for someone 1000 miles away.
If parents don't want to do X, Y, and Z to lock down their devices then that is their right. And I support their rights, so the conversation is over right then and there IMO.
djaro 19 hours ago [-]
Because we live in a society and trillion dollar companies exploiting children for the crime of having negligent parents is bad.
The aim here is to protect the children. "Just let parents protect them" doesn't work when there's millions of parents that won't care.
SoftTalker 24 hours ago [-]
More parents will care if you make it easier.
conception 1 days ago [-]
That’s not true. Every TV app has a parent setting. That’s really easy to use browser support profiles just like TV apps do bad. UX doesn’t mean that it can’t be set up easily for parents. Windows itself could have profiles for kids that has all this set automatically. It’s not hard. There’s just no will to do it.
alt227 1 days ago [-]
> There’s just no will to do it.
Exactly. The problem is its from the parents side.
monkpit 23 hours ago [-]
Spoken like someone who has never used parental controls. They’re a shitshow.
alt227 8 hours ago [-]
You miss my point. It is that parents dont care. However good the parental controls are, there are millions of parents who just dont and wont ever care.
23 hours ago [-]
throwawayk7h 9 hours ago [-]
It should be by default, rather than relying on the parent proactively.
readread 22 hours ago [-]
I've build some moderately sophisticated server systems up on "bare metal" (as the kids say), know my way around a shell better than most programmers, understand networking better than most programmers, et c., and I still find restricting and monitoring kids' devices to be a huge pain in the ass. The only places it's not extremely shitty are the Switch (which still isn't great) and Apple devices.
Options between "we don't have tech in the house" and "wide-open tech, we have it all" are all some amount of painful, usually for no good reason.
(I remember once investigating how to do some pretty basic stuff for this in Linux, hoping to find something nicer than manually setting some executable permissions and firewall rules and then having to go back and change them all the time, and the closest thing to a guide I found was an old article from Red Hat that basically lead with "LOL, good luck you poor sap, Linux sucks at this" before going on to explain the various bad ways available to sort-of, but not entirely, accomplish it with a lot of work, and significant ongoing time-burden)
mcfedr 22 hours ago [-]
if parents wont make the slightest bit of effort why should the rest of us pay to keep their children safe?
djaro 19 hours ago [-]
Because children shouldn't be the ones paying for the crime of having bad parents. Children should be safe regardless of what the parents do, because they're independent people and not property.
mcfedr 10 hours ago [-]
you can say that about a lot of things, but we do largely trust parents. but all these social media bans seem to stem from parents who claim to be helpless, when really they are lazy and the wider impact of these laws is massive. no technical way exists to do this without taking the privacy of everyone
tgv 21 hours ago [-]
A bit of empathy goes a long way. That child may be your nurse one day, taking care either of you or candy crush.
BiteCode_dev 24 hours ago [-]
A child can still access knives if the parents don't care.
Levitating 21 hours ago [-]
That's exactly what the California's Digital Age Assurance Act does but that wasn't well-received either.
echelon 1 days ago [-]
>>>>>>> now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act nonsense...
THIS
Holy shit. This is such an obvious fix. And it shuts up those surveillance state goons immediately.
My God, why have we tried to summon up the ghost of 1984 when such a simple fix as this will do.
Parents can lock devices into "child mode" that emits "user is child" headers. Websites can then block.
The blast radius is zero.
Good God, we need to fast track this into browsers right now. If we hurry we might be able to point to this as the technical fix.
Once some of the infrastructure exists, OS vendors can hook into it.
Firefox devs - please do this right now. Please spearhead this.
I might have to vibe code an advocacy site for the spec and set up a GitHub / RFC process.
tangotaylor 22 hours ago [-]
> Parents can lock devices into "child mode" that emits "user is child" headers. Websites can then block.
CA tried this with AB 1856. I wasn't a fan of this (neither was EFF) because of the privacy and tracking concerns of blasting the fact that the user is a child to all websites.
It would better for the block to happen at the device level. That is, the browser knows it's on a child's device and has a whitelist of allowed sites.
There is already an RTA (Restriced to Adults) header where the website self-labels that it's for adults only and the browser can block it while protecting the user's privacy. I'd prefer expanding the use of RTA.
Phemist 7 hours ago [-]
It reads like AB1856 needs website operators to prove they didnt serve their content to the wrong age bracket, which requires way heavier methods than simply trusting the emitted "user is child" header (or rather, trusting that the lack of such header is not a false negative)
dageshi 22 hours ago [-]
No offense but if you're proposing a solution that involves whitelists... that solution has already failed.
The web is too big and changes too much and that's before we get to the issue of applying laws to a whitelist based on different juristictions worldwide.
And I have to question, who would administer it? The parents? They won't. Google or Apple? Why do they want to deal with irate parents or culture wars around what is or is not on the list?
There is obvious increasing demand for this from parents, politicians are going to act on it, I think a "this is a child" header is the only one that actually really works. It works for the parents because it's easy to setup. It works for websites because they can cleanly identify a child and filter content if appropriate.
It seems to me that every other solution than a "this is a child" header is either impractical or way worse.
tangotaylor 20 hours ago [-]
> that solution has already failed.
Yes, granted, a globally enforced whitelist probably wouldn't work. I'm referring to bespoke lists that parents control. I know plenty of parents that use this. e.g. here's Apple's feature:
> It works for websites because they can cleanly identify a child and filter content if appropriate.
This still doesn't solve the problem of different jurisdictions and culture wars of what is or isn't appropriate for kids. All this does is move the liability upstream to websites instead of the devices. That is, instead of the browser deciding what's appropriate, now Youtube, Reddit, etc have to decide. And, as we've seen with the OSA in the UK, typically smaller platforms can't handle the enforcement cost so they just shut down entirely.
The larger platforms often use overbroad CYA measures and throw up age verification where they don't need to (Reddit has done this in the EU), or just ban minors (Anthropic and character.ai did this).
As far as blocking explicit content, a self-labeling requirement like RTA accomplishes the same thing as a "this is a child" header but without the liability CYA and without the privacy concerns.
Where the "this is a child" header solution could theoretically win is allowing kids to access websites in a limited child-safe way, e.g. going to Reddit in child mode automatically shuts off certain subreddits. But, as we've seen, it just doesn't work well in practice and usually frustrates parents by overly broad content policing and liability theater. Kids are also at different levels of maturity and I've seen them get frustrated when they're binned into age categories that they feel they don't deserve. e.g. a 12 year old might be plenty mature enough for the 13-16 age category.
But my real objection to the "this is a child header" is the privacy risk and surveillance risk. I don't think it's worth it.
Phemist 6 hours ago [-]
You are confusing a lot of different lines of argument, and in the end I'm not even sure what you are arguing against. I think you are mostly agreeing with the proposed solution by echelon?
You mentioned AB1856 which seems waaaaay broader than emitting an age bracket header based on user settings. It puts the onus on the website operator to not only prevent presenting content to wrong age bracket users, but also to determine the age bracket of the user.
Websites are shutting down wholesale because they cannot reasonably afford the CYA, or dont want to out of principle.
In echelons scheme the parent would be voluntarily setting the age bracket on the childs device right, so if a 12 year old is more mature, then go ahead and set their device to emit the 13-16 age bracket header. If you as a parent dont believe in this, then leave the bracket unset.
For a website operator it would be trivial to block the user from accessing the site if the suggested age bracket is too low (as long as we can agree on a single way of doing things, of course). Larger operators can do more heavy content moderation and present a filtered view to those same age bracketed users.
It is true you are adding more tracking signals, and I am sensitive to the free speech issues, but children are not fully emancipated members of society yet and parents need tools to deal with the difficulties of raising children in a digital society. The alternative now seems to be OSA-like, which is even more intrusive and a risk to privacy and perhaps free society as a whole.
Of course, OSA is really the goal and not the method, and we have to remember it is never about the children. Would children have been protected from e.g. andrew mountbatten if OSA had been around at that time?
dijit 23 hours ago [-]
I agree, and I agree with the enthusiasm on which you bring in.
I've long since considered that the efforts for online child safety should be pointed at educating parents and spearheading some kind of certification of compliance for child safety of software and websites.
[this product is certified to adhere to EU:CSA]
Then you can block everything not certified, and the software that does the blocking would also be certified, the two major prongs you need (endpoints and sites working together: else they're blocked). The rest of the money goes to education for parents about this fact, and the dangers of not doing it, and how to do it.
This is super "easy" (when comparing to the effort it would take for putting backdoors in everything).
Which is why I think that the reason is definitely not child safety, and more about crime control.
This will work... if you think this is their true motivation, and the panopticon itself isn't the true end goal.
alexandre_m 23 hours ago [-]
That works well for controlled devices like phones, tablets, and TVs, but it’s much harder on desktops unless you expect parents to become IT administrators.
Paracompact 22 hours ago [-]
What's wrong with asking the user on account creation and OS install?
alexandre_m 19 hours ago [-]
It'd need to be vertically integrated from OS to user space apps, and restricting what can be installed.
I'm not sure to understand the proposed solution here, but it seems someone could just use a different web browser client who don't inherit these restrictions.
inigyou 24 hours ago [-]
California AB1043, in other words
spiderfarmer 24 hours ago [-]
Make a website about that. I’ll spread it.
grumbelbart2 9 hours ago [-]
I never understood why visited websites and all their first and third party cookies are not isolated by default in browsers.
There are so few sites where I really need cross-site logins to work that an opt-in would be much more preferable.
Have all sites set cookies on whichever third party they want, but don't share those cookies over. Add an explicit "Do you really want foo.com to share data with bar.com?" if you really need to see those facebook comments on your news site.
tomp 22 hours ago [-]
Or you could just stop spying on people.
No cookie banner is required for functionally necessary cookies.
IMTDb 20 hours ago [-]
Apparently the eu official website really needs to track you then. For what’s essentially just static content. I’ll consider dropping cookies banner when their website can work without. Stop the “do as I say not as I do”
They apparently hired incapable people to build that. Very silly to build it in a way that kind runs contrary to what the intentions of the very laws they are making are.
I get similarly upset, when I see Google tracking on official websites of government or public institutions.
TurdF3rguson 14 hours ago [-]
> Apparently the eu official website really needs to track you then.
No, they don't really need to track you, that's why it requires consent to do it.
They are doing exactly what they say.
In other words, they're not saying don't track your visitors. They're saying get consent first.
latexr 7 hours ago [-]
You could try to understand why that’s the case, instead of assuming maliciousness or incompetence.
> Use of the cookie consent kit is mandatory on each page of the DGs and executive agencies-owned websites, regardless of the cookies used.
micromacrofoot 16 hours ago [-]
they use third party cookies, just read their linked info on it and it's fairly clear why they have a banner
if they didn't use third party cookies they wouldn't need it
ThatMedicIsASpy 6 hours ago [-]
Outlawing user tracking/profiling and selling their data would be the biggest change to the internet.
iammrpayments 11 hours ago [-]
It’s not that easy to make a distinction between what is necessary.
21 hours ago [-]
jebronie2 21 hours ago [-]
Wrong.
Etheryte 21 hours ago [-]
Not wrong in the EU, you don't need to ask for consent nor notify about cookies which are required to make the site functional. Tracking and ads don't fall under that though, which is why every site these days does need to ask for your consent.
jebronie2 20 hours ago [-]
No, you need to always ask for consent for cookies if they come from a third party, regardless if they are only required to enable functionality.
You also need to ask for consent each time data leaves the website (for example when loading an image from a third party host). You can't even load a font file from a third party server because the users IP reaches that server without consent.
Cookie banners don't just handle third party tracking cookies, the are needed to record consent for a huge variety of cases. "Banning tracking cookies" does not remove the need for cookie banners.
kodebach 19 hours ago [-]
Well if the cookie comes from a third party it implicitly allows tracking.
Also AFAIK the Google Fonts question (is the IP alone already PII, if Google has no way of tying the IP to a person) has not been decided by the ECJ yet. There've only been decisions by lower level German courts that are still in dispute.
jebronie2 12 hours ago [-]
IP addresses are PII according to german law, that debate has been settled long ago by final court-rulings afaik.
"Well if the cookie comes from a third party it implicitly allows tracking."
Yes, because this makes tracking possible you have to gather consent first, regardless if tracking actually happens. Very bad solution, they could just define how data can be legally used, instead of also overreaching by defining how data can be legally transmitted.
jeremyjh 15 hours ago [-]
Putting assets on a 3rd party server is indeed a great way to track people. They can completely fuck off with all of that as well.
jebronie2 12 hours ago [-]
That's the problem with the regulation: It defines how data can be legally transmitted instead of defining only how data can be legally used, resulting in nasty side-effects like making embedding third-party content illegal even if its not used for tracking.
buzer 16 hours ago [-]
This is actually slightly narrower exception than people (and regulators) think. The exception is:
> strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
One very ignored qualifier here is "information society service". This is defined in Directive 2015/1535 and one of the requirements is that the service is "normally provided for remuneration". That is usually understood to mean that the service needs to be tied to provider's economic activity. This effectively excludes, for example, public authorities websites which are for their own public duties. It does however include e.g. ad supported websites.
And yes, I'm aware that many national implementations actually miss that qualifier. That can save the non-commercial private sector websites, but public authorities do not benefit from Member States failing to transpose Directive correctly.
ApolloFortyNine 15 hours ago [-]
What I hate about EU laws is they tend to word these things like this.
People act shocked when it leads to unintended side effects, but companies legal teams are just telling them they have no idea how a judge will interpret these broad wordings in regards to their business.
People say this fixes "future loopholes" but as you see with the cookie banner, it just leads to every company assuming the worst case scenario.
Going back years of conversation on cookie banners you'll see a constant argument on when they're required or not precisely because it's not defined explicitly.
GJim 7 hours ago [-]
So you think letting the scummy AdTech industry do whatever they want everywhere is the better "strategy"?
tysilva 1 days ago [-]
Wow, finally. This would be a major quality of life update for browsing the web. As others have stated, not all sites merit the same preferences. Hopefully they can adapt a middleground of default settings with the ability to customize site by site.
singron 21 hours ago [-]
As long as it's some automated signal, the User-Agent can use any logic it wants to send it without cooperation. The specifics of how to send the signal don't have to be legislated. E.g. Firefox's Tracking Protection has a global default a site-specific overrides, so it's very likely that they would do the same for this or just combine those features.
ktosobcy 20 hours ago [-]
Comission wanted that, Google lobbied hard to NOT have automatic sigal… go figure…
convolvatron 1 days ago [-]
under what circumstances as user would I want to explicitly agree to have my browsing history sent to tens or hundreds of third party tracking aggregators?
scbrg 24 hours ago [-]
I've seen people argue, with a straight face, that they prefer to get ads that are "relevant to them". Including here on Hacker News.
jsrozner 22 hours ago [-]
"I like being manipulated by people who want to extract maximal value from me"
lucianbr 21 hours ago [-]
Gee I wonder if anyone on HN might have some ulterior reason to write such a statement, without it being true.
GJim 7 hours ago [-]
I'm again reminded that a significant percentage of HN readership are those working in US AdTech, who's very salaries are dependent on abusing peoples privacy. Hardly surprising a hefty part of the HN demographic slants towards opposing privacy laws.
AlienRobot 19 hours ago [-]
I don't trust anyone who is against "relevant ads," because I always think what they want isn't "irrelevant ads," they want "no ads." But no ads isn't an option.
deathanatos 18 hours ago [-]
Yet somehow print/TV worked for decades just fine without spying on their users.
I do not want the gas station, or the airplane I'm on, spying on me to build relevant advertising. That is the end game of "relevant ads": my gas pump already serves me ads, the airplane I'm on serves me ads, my own car now (via a software update that occurred after purchase) serves me ads. Monitors now serve ads. TVs are abusing people's Internet connections, which isn't ads, but it's basically the same problem: if I can abuse the customer without consequence, why shouldn't I?
Just no. The problem is, I as a consumer cannot vote with my wallet: companies can and will go "I could take your money, and earn $X, or I could do that and ads and earn $X + $Y."; there is not reason for them to choose the former, and most markets are so concentrated (e.g., airlines) that there is not ample competition for the market to provide ample "vote with wallet" choices. Further, in the car example, it's just bait and switch: even when I think I can vote with my wallet, the company can just alter the terms of the deal, knowing full well the switching price of a car makes me subservient to them.
crote 18 hours ago [-]
> But no ads isn't an option.
Why? Plenty of websites operate just fine with no or near-zero ads. Just look at the one you are currently on!
And what's with confusing "relevant ads" with "privacy-invading targeted ads"? There's still plenty of ads in print media, on television, and on billboards: none of them are invading my privacy, yet they still manage to be relevant by choosing a medium with a certain target demographic. Websites used to do the same, there's no technical reason we can't return to this.
People want free content online. More than that, they just expect it.
Any future law in regards to this will likely just lead to the companies that already got consent (companies you already have accounts with) becoming even deeper entrenched.
Non targeted ads pay a small percentage of targeted ads.
tysilva 24 hours ago [-]
I don't disagree. The ideal state here is really layers of customation for the defaults. Options like reject all, or strictly necessary would be at the forefront. And then it's really up to the individual how they want to proceed when those options are not available.
broken-kebab 1 days ago [-]
If offered something in return, I guess
alt227 1 days ago [-]
Ask that question to the 99% of people who click 'Allow All' on cookie banners.
fmbb 24 hours ago [-]
Its the biggest button.
They did not read the text to agree.
It was the fastest way to get the banner to go away. Sometimes they force you to confirm multiple times if you click ”none” or ”minimal”.
PaulRobinson 1 days ago [-]
Devil's advocate argument: if they were giving you something in return, and that could be cash, but it might also be "you can have this content for free".
In the UK a few news sites have changed cookie banners to "you can accept and see this stuff for free, or you can sign up for a subscription, which would you prefer?". It's the only time I hit accept (and then clear browser history).
If blanket preferences from browser signals became the norm, a segment might open up where you would configure preferences and a data broker would make sure you get something in return for your data. At minimum it might force paywalled publishers to consider that as a "lite" subscription option.
inigyou 24 hours ago [-]
That's been ruled illegal in the EU, but EU sites still do it. Basically, the consent exception only applies if the user isn't coerced into it. Because coerced consent isn't consent.
troupo 1 days ago [-]
> but it might also be "you can have this content for free".
ads don't require invasve and pervasive tracking
jamiequint 20 hours ago [-]
Effective ads absolutely require knowing more about the user than the context on the page it's a 1-2 orders of magnitude revenue difference for the publisher per-impression.
crote 18 hours ago [-]
The effectiveness of ads is highly doubtful in general - especially when you're looking at impressions rather than clicks. And that's before we consider advertising mostly being mostly a zero-sum game.
Advertisers are willing to pay more for privacy-invading ads because they believe they are more effective. If privacy-invading ads were illegal they'd just go back to context-dependent ads like they have been using for the thousands of years before the internet was invented, and after an adjustment period the revenue will just bounce back to where it was before.
Most advertisers know this already. If privacy-invading ads were so effective, why are all the major brands now using influencers to market their products? Why go through the effort of finding a specific Instagram channel which might be a good fit and convincing the operator to enter a brand deal, when you could also just directly pay Instagram for a highly-targeted ad one swipe away?
troupo 10 hours ago [-]
> Effective ads absolutely require knowing more about the user than the context on the page
That's what the tracking industry keeps telling you with zero evidence it's true.
You seem to have missed the point. No ads dont require those things, but companies could start offering content in return for those things instead of ads.
Alpha3031 24 hours ago [-]
As I understand it, it is the position of several DPAs that denial of access entirely (i.e. "consent or pay") could contravene the "freely given" requirement of GDPR in most cases, though this has thus far not been tested in court.
> but companies could start offering content in return for those things instead of ads.
Again, that is not a requirement. If your argument is that they give us content for free because of ads, ads don't require pervasive and invasive tracking. Or hiding stuff behind paywalls (since ads pay for it).
alt227 8 hours ago [-]
No my arguement is not that they give us free content for ads. It is that in the future it is entirely possible that they offer us free content in return for us allowing pervasive and invasive tracking.
Im pretty sure if a company said something like "Here have free netflix for life, as long as you install this browser plugin that provides us with information about your shopping habits" millions of people would bite their hand off.
inigyou 24 hours ago [-]
Sometimes I do it to reward the website for being less shit than most websites.
micromacrofoot 16 hours ago [-]
many will still ask because they want to track you regardless of existing preferences
tezza 1 days ago [-]
Even well meaning bodies like TFL (Transport for London) have cookie warnings that impede the actual access of the website.
Need to look up a bus time? Full screen cookie consent with accept buttons drawn OFF THE SCREEN.
inigyou 24 hours ago [-]
They obviously aren't well-meaning if they're endlessly tracking everything you do
igregoryca 23 hours ago [-]
Sloppy, non-privacy-preserving "analytics" set up by some communications intern ≠ malice. They can mean well and still do a poor job. True privacy on the internet is notoriously hard.
4thguy 6 hours ago [-]
Sorry, no. Code doesn't magically go from the intern's workstation to live. If the chain of incompetence is that long, then the most generous read is that they don't care
ehnto 15 hours ago [-]
I don't think you can handwave responsibility like that, even if your theoretical were true it's still the responsibility of the org.
Jtarii 22 hours ago [-]
More likely it was designed by some firm that put the cookie banner there because "that is just what you do in current year"
debazel 21 hours ago [-]
One of our sites that don't use any kind of tracking or cookies other then a site preference cookie, got so many complaints that we had to put up a cookie banner that simply says "we do not use any tracking cookies"...
inigyou 6 hours ago [-]
Who complained what?
inigyou 22 hours ago [-]
Yes and my "peanut allergy friendly" cookies say "may contain peanuts" because that's just what you do
albedoa 14 hours ago [-]
Literally the point is that sites are showing the banner by default practice even when they are not tracking. You understand this!
Your kind comes into every one of these threads and says some version of "well if they weren't tracking then they'd have nothing to worry about and no need to show a banner", but that is so obviously not true to anyone who uses the web. You absolutely do not need to defend a law that is not working.
mullingitover 21 hours ago [-]
It's great they're talking about it, but they should just do like California and DO something about it.[1]
> When the law takes effect in January 2027, Californians will see new privacy options in web browsers. When enabled, these controls will automatically inform websites of their privacy preferences, helping to protect personal information from being sold to data brokers and other third parties. This means they will be able to protect their data — like their browsing history, location data, purchase history, and personal interests — across the entire internet with a single step.
3% of people want to be tracked online? I think it's more likely that 3% of people misunderstood the survey question
benrutter 7 hours ago [-]
It probably depends on how people interpret it right? I doubt anyone is saying "I love being tracked" - but some people might choose personalized ads over anonymous ones.
I don't really use youtube natively a lot anymore, but I used to with Google's "personalised ads" turned off. I don't know if you've tried that, but the ads Google serves you if you opt out of personalised adds are sketchy, creepy and mostly not child appropriate (a lot of medical stuff, plus adverts for mail order brides etc). Back then I opted in to personalised ads because being tracked seemed a better option to me than being served inappropriate material without my consent.
Anyway, that's a long rant, but my point is, there's edge-cases and weird contexts in which I can imagine people saying something like "of the options I see as likely to happen, I'd most like to be tracked".
voidUpdate 7 hours ago [-]
Well if the conclusion is "3% of people want to be tracked online", I'd expect the question to be "do you want to be tracked online" or similar, not "do you want to receive personalised ads"?
billynomates 7 hours ago [-]
I dunno, the people I've talked to about it (small sample) have said they don't mind because then they get more relevant ads. It's very hard to reason with that sort of thing!
dspillett 24 hours ago [-]
> automated signals that would communicate your privacy preferences between your device and websites or apps0
Sounds good, as long as it covers the "legitimate interest" bollocks⁰ that is often hidden in inconvenient UI nests as well as the basic preference.
-------
[0] "we see your preference not to be stalked, but we want to anyway, click again for every partner to reconfirm you don't want them following you around"
jeroenhd 7 hours ago [-]
The "legitimate interest" bullshit is already illegal. I don't see why websites would stop doing illegal things because of this change.
rusk 23 hours ago [-]
This was tried before but was presumably scuppered by the market intelligence and surveillance communities
My request to the owner/promoter of the site: provide an email template that we can send to our representatives. I'm willing to send such email, I've the list of the people I want to reach. But what is too complex is to write the appropriate email... Can you help me with this ?
inigyou 5 hours ago [-]
In general, representatives ignore template emails. Their staff throw them in the trash folder before anyone important reads them.
hollowturtle 23 hours ago [-]
I always wondered though why a website in the eu, for the love of their users, won't just drop cookie usage and instrusive third party scripts. Just do analytics on the backend and don't set any cookie, except for tokens in authenticated areas
tempestn 23 hours ago [-]
You can't even save user preferences (like language or other settings) without showing a cookie banner. Edit: I was mistaken. You can't save inferred preferences, but can save explicit user-saved options.
And for a serious website, front end analytics are kind of a necessity to understand how users interact with pages and improve the experience. Note that it certainly doesn't require tracking the behaviour of individual users, just understanding how controls are used in aggregate.
I know it seems like you could work around this with careful design and maybe focus groups and such, but I can tell you we regularly uncover surprising insights from (aggregate) trends in front-end events.
dgellow 23 hours ago [-]
That's not true and is a very common misinformation people repeat online. You can save user preferences in cookies without any consent banner, if the cookie isn't used for tracking.
See here[0], page 6:
> As stated in Article 5(3) ePD: ‘This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.’
As long as you do not share that info with 3rd party, and the user requested it, you can store via cookies pretty much whatever you want without the need for a consent screen
tempestn 22 hours ago [-]
You're right; I haven't looked into this in detail in some time. You can't save inferred preferences, but can save things that the user has explicitly selected to save.
jeroenhd 7 hours ago [-]
They don't want love, they want money. Tracking people is an effective way to make money. You can make some money with non-tracking ads, but these websites want more money than that.
Good websites sharing stuff for the fun of it rarely ever add these obnoxious banners. They probably should if they embed other trackers (like Youtube or Google Fonts) but often just don't. It's only the ones that want to make money off you that bother putting in the obnoxious banners.
bux93 6 hours ago [-]
Even if you only use first-party analytics, you're still tracking users and may still pipe that data to third parties, so you still need a lawful basis for processing PII (of which consent is the least useful one).
Even the use of the word "cookie" is framing by industry to confuse people.
jeremyjh 15 hours ago [-]
They don't love you. They want to track you and make a tiny amount of money off that. Also, they want to hire cheap incompetent staff who don't understand what all the analytics shit they are putting on the website even does.
reddalo 23 hours ago [-]
That's what I'm doing with a service I made. But I don't have any ads, and ad-supported websites can't easily do that.
tappio 22 hours ago [-]
There are privacy respecting ad brokers that dont require user tracking. Its just that people are too lazy or greedy to use those.
valicord 20 hours ago [-]
[flagged]
hollowturtle 18 hours ago [-]
> Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes.
> Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.
> When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
> Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative.
> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner. Unfortunately, the tracking industry is pushing back – and so far, they’ve been successful.
> ...
> You may think that EU privacy law requires cookie banners. But the law is clear: online tracking is prohibited by default.
Don't worry. I'm sure EU legislation will solve nuisances that are solely a creation of EU legislation.
nicbou 8 hours ago [-]
They are the creation of the industry. Consent is not the problem.
duxup 21 hours ago [-]
So much legislation about privacy that involves "oh those bad companies" that ends up putting the onus on the individual to manage it all.
I'm visiting a website, i don't want to make a legal agreement with every website ...
Social media bad for kids? Everyone hand over your ID at the door ...
jeremyjh 15 hours ago [-]
The companies want to track everything you do on the web. EU passes a law that says they have to ask for permission first. They all comply maliciously because they still just want to track you.
Then you blame the government.
duxup 15 hours ago [-]
The mechanism that I have to make a legal agreement with every site was a government choice, and a poor one.
jeremyjh 14 hours ago [-]
No, its the website's choice. They want to track you. The government said they need permission to do that. They could offer a better experience by just not tracking you.
duxup 14 hours ago [-]
The result is entirely predictable. They picked it.
nicbou 8 hours ago [-]
No, the websites picked it. They consciously made cookie banners as annoying as possible so that you would give up and accept.
inigyou 5 hours ago [-]
You're both right. The government could have just made it illegal.
getfluxly 11 hours ago [-]
I am a builder in the same space(tracking analytics) and I agree with killing the cookie banner. It is really annoying and most of the time, sites don't even respect the decision, they just track it nonetheless. Setting up a consent stance once per browser is way better, also I think there should be fines for the websites that don't follow the same.
joelthelion 22 hours ago [-]
At this stage, it's easier to block them with uBlock and move on.
I don't have a lot of confidence for legislative solutions. Although I admire people who keep trying.
minaguib 21 hours ago [-]
FWIW, Legislation IS what brought us here in the first place :)
Biganon 20 hours ago [-]
How fortunate the state with none
pjio 8 hours ago [-]
Maybe I'm naive, but I just click "Accept all" and rely on Firefox's "Total Cookie Protection" to prevent tracking, without having to trust a website.
inigyou 5 hours ago [-]
You also consented to fingerprinting.
aucisson_masque 6 hours ago [-]
It's absolutely not the right time to contact EU representatives. They are in vacation, and the vote goes on september/october.
Put a note in your calendar, write a letter and send it then.
btw, the link say it's around 3% of people who want to be tracked when the reports state it's between 3 and 10%. it's misleading.
alt227 1 days ago [-]
I still don't get why every website has a cookie banner by default. I am data controller for several companies and have lots of exposure to GDPR. All my websites have no cookie banner, as they are not required.
I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? Who knows.
reorder9695 1 days ago [-]
Don't underestimate the argument of "just to be on the safe side". Someone running a business who doesn't know a lot about cookies will often just put a banner on as an easy arse covering mechanism even when not required.
SoftTalker 24 hours ago [-]
Or they had their site developed by an agency and the cookie banner is just part of their standard scaffolding for a new site.
JoshTriplett 23 hours ago [-]
Perhaps someone could publish a clear A/B test on how many views/conversions you lose by having a cookie banner?
NopIdoN 17 hours ago [-]
That doesn't work, because you have to list what cookies you're asking for.
If the banner's not required, it ends up saying stuff like "we'd like permission to share your data with 0 partners". Ever see that?
The fact is most website operators want to use your data for non-essential purposes.
inigyou 23 hours ago [-]
Let businesses who don't know what they're doing be outcompeted by businesses who know what they're doing.
esperent 1 days ago [-]
> I guess that most companies just chuck it up there as a default
50% that, and 50% that way more companies than you expect are harvesting and profiting from your data.
kuerbel 24 hours ago [-]
If you use social media pixels, ad tracking, or performance analytics tools like Google Analytics a cookie banner and consent is required. If not, then not.
alex_suzuki 23 hours ago [-]
Side note: there’s plenty of Analytics tools that don’t require cookies. Plausible (https://plausible.io) is one of them, there are many others.
Not affiliated, just a happy customer.
charcircuit 22 hours ago [-]
If you want to prevent a single user hitting F5 a million times from messing with your analytics you need to track IPs which requires the banner.
preg_match 22 hours ago [-]
I'm not convinced this is a real concern. Bots, maybe, but then again even fancy analytics will be fucked by that because they use hundreds or thousands of high-reputation residential IPs. So, you're optimizing for the wrong thing I think.
TheCoelacanth 21 hours ago [-]
No, you don't need consent for that. It falls under the legitimate interest exception.
You need to disclose it in your privacy policy, you need to delete it after a reasonable retention period and you can't use those logs for other purposes like ad targeting, but you don't need a consent banner to track things that you are legitimately using for security purposes.
charcircuit 12 hours ago [-]
>It falls under the legitimate interest exception.
What makes that a legitimate interest and not advertising?
srdjanr 9 hours ago [-]
> and you can't use those logs for other purposes like ad targeting
This part I guess
tete 24 hours ago [-]
> I guess that most companies just chuck it up there as a default so they dont have to read the law
I think most companies just don't give a fuck about user privacy and therefor have to show one. There are of course exceptions. But I don't know how many of them have been actual (for-profit) companies.
maccard 1 days ago [-]
I’ve made a few sites for work that aren’t our primary focus. The sites used cookies for login and for “required purposes” (storing in progress state). We did all the tracking on the backend, no cookies or client side trackers.
On our go-live form there’s a question “do you use cookies” and it’s yes/no. If you say yes legal block the site from going live without the pre approved cookie banner…
jarofgreen 24 hours ago [-]
> We did all the tracking on the backend
Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.
maccard 24 hours ago [-]
I do but we shouldn’t be talking about cookies in our cookie banner then.
crote 18 hours ago [-]
That's why the usual phrasing is some variation of "Are we allowed to track you? We use cookies for that".
It was never about the cookies themselves. That just happened to be the most common form of tracking in use when the GDPR was originally written. Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
maccard 9 hours ago [-]
You’re conflating GDPR and the ePrivacy Directive. They _should_ work how people imagine they do.
> it was never about the cookies themselves.
The ePrivacy directive was about cookies. GDPR is about user consent and data handling - the cookie banner is from the ePrivacy directive.
> Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
Where in the GDPR or ePrivacy directive does it say cookie less tracking requires a consent prompt?
And on tracking-less cookies not requiring one - that’s my entire point.
JoshTriplett 23 hours ago [-]
Sounds like your legal department is broken. You should fix that.
I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).
maccard 22 hours ago [-]
It was a 30k person company, I worked for a subsidiary and for better or worse that was not within my circle of concern or circle of influence.
HiPhish 1 days ago [-]
> I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies?
That has been my guess as well. If you run npm install half-the-internet you have no idea what's in there, so just slap on that cookie banner for good measure. Of course the real problem is not knowing what's inside your application, but the thought process is "eh, if a blanket cookie banner does the job then that's good enough for me".
unmole 15 hours ago [-]
> Stop the tracking circus.
Kill the cookie banner!
Perhaps the EU Commission could start by stopping the circus on its own website and killing its own cookie banner: https://commission.europa.eu/index_en
sholladay 11 hours ago [-]
The cookie banner is a significant accessibility problem, for blind and low vision users, among others. I would like to see a stronger push to attack it from that angle.
whywhywhywhy 22 hours ago [-]
Would have gone harder without the Corporate Memphis/Alegria art which is the art always used to try and convince you to hand over your tracking rights.
jsrozner 22 hours ago [-]
Cookie banners are just a kind of ad. If you're at the site, the demand you have for the content on the site is probably close to inelastic (especially on services websites). The site exploits its effective monopoly on the content to raise prices to the user (in this case your time, attention, and experience).
There is ZERO cost to abusing the user over, and over, and over again by asking for permission to track them.
We shouldn't have the cookie banners at all because NO company should be able to do anything with tracking data. Just ban the use of user data by companies and most of SillyCon Valley's garbage behaviors are fixed.
Similarly, I should never get "terms of service updates" from digital companies because there should be no changes that they can make. You can provide the obvious service that you're providing; you can't aggregate my data for any purpose other than directly serving me; you can't aggregate my data with that of other users; if you retain my data for any other purpose, the government should take percentages of your revenue. I shouldn't have to wade through the BS that the mercenary corporate lawyers cook up to extract value from me.
PeterStuer 8 hours ago [-]
Can the proposed consent automation kill the 'legitimate interest' abuse is the most important question. Even getting towards a single click refuse all requirement would eliminate the majority of dark patterns endemic today.
ghtbircshotbe 4 hours ago [-]
I click the close button on the cookie banner if there is one. No idea what it does though.
pcollins123 10 hours ago [-]
I once interviewed for a senior product position at Google by a VP across many of their Web Products (including the Blink engine).
He asked me "So, how would you make the Internet better at Google?".
My response, "Setup preferences in Chrome to eliminate all popups including Cookie banners".
I never got a call back for the second interview.
alibarber 9 hours ago [-]
* "This proposal for privacy signals is part of an EU law reform called the Digital Omnibus. Most other parts of this reform are problematic and would weaken people’s rights. We want to make clear that we do not support these other aspects of the proposed reform."
Oh.
samiv 11 hours ago [-]
I find the cookie banner always ironically wrongly labeled. Everyone claims to "respect your privacy" while actually disrespecting the privacy. If they did actually respect the privacy they would not use non functional tracking cookies and there would be no need to display the banner.
The answer is simple. Don't use tracking cookies.
kjgkjhfkjf 17 hours ago [-]
Perhaps it would be simpler to make all non-essential cookies illegal. I cannot imagine why any reasonable person would want to accept non-essential cookies, other than in the course of following a path of least resistance.
jeremyjh 15 hours ago [-]
This is the only way. They'd also have to make all third-party assets illegal as well though and that may break some legit use cases, and make it a lot harder to use CDNs.
himata4113 22 hours ago [-]
Okay, but you can quite literally just delete the cookie banner. Cookie banner forces websites to ask for consent, no cookie banner = no consent = less tracking since they usually hold off on ALL tracking until you interact with the cookie prompt.
I have personally never ever had any problems with the cookie banner since Brave deletes them with 100% accuracy, there's sometimes where a site will refuse to function properly, but it's usually sites I don't care about anyway and if I HAVE to get it working I disable brave shield, turn off all tracking, consent and turn the shields back on.
It is unfortunate that most browsers cannot implement this as it goes against what the companies behind the browsers want. Deleting the cookie prompt would stop people from occasionally just accepting all cookies and opting into tracking after getting tired of it.
pverheggen 22 hours ago [-]
Here's the full text of the bill (Articles 88a and 88b):
As written, this doesn't eliminate cookie banners completely, only if your browser is sending a Do Not Track header or similar. That's unfortunate news if you use fingerprint protection - those send default headers, so you'll still be bombarded with cookie banners. Hopefully existing anti-fingerprinting solutions will offer a "default headers but with Do Not Track" option.
MetaWhirledPeas 22 hours ago [-]
The good news is if you're doing Do Not Track you're probably in a good position to block cookie banners too.
Even if it were automatic, there is no guarantee web sites will respect it.
Is there any reason for allowing this tracking browser side besides a little convenience for the web devs?
richrichardsson 8 hours ago [-]
I'm fed up of Croatia never appearing in lists of EU states. I'd get involved if they were added to this site.
hash872 24 hours ago [-]
Also there's a big difference between the sites that easily allow you to simply reject whatever their premade cookie settings are. And, the sites that only allow you to use them after you've accepted (example, politico.eu). Or, the sites that do have a 'reject' option, but you have to click through multiple screens and then manually reject each individual option.
Sites that easily allow you to simply reject everything are then a short hop, skip and a jump into browser settings where you auto-reject all cookie/tracking nonsense
drnick1 1 days ago [-]
uBlock Origin with all "annoyance" filters enabled. I haven't seen a cookie banner in years.
Another good one to have the "hide Youtube shorts" filter, featured on HN a while back.
tete 24 hours ago [-]
There is Consent-O-Matic.
Also I wanna know when websites don't give a shit about my privacy and therefor have to show a cookie banner. While theoretically not consenting should mean not collecting blocking it altogether and modifying page content might mean "all bets are off". If the website expects you to have made a decision that might wrongly consider it consent.
Consent-O-Matic says "I don't consent".
jsrozner 22 hours ago [-]
Does this still work on new chrome versions?
qilo 21 hours ago [-]
Still works on Chrome 150, but it is the last supported version. Chrome 151 is being released on July 28.
drnick1 21 hours ago [-]
I think so yes, but Firefox is probably still better.
alex1138 23 hours ago [-]
That didn't work for me and so now I've added the specific cookie banner options. it's in the filter lists
imhoguy 24 hours ago [-]
And guess who makes the most of devices and the most popular browser, I already see post install "Get most of the browsing experience by agreeing to these defaults."
1vuio0pswjnm7 20 hours ago [-]
Actual title: "Stop the tracking circus. Kill the cookie banner!"
;dr
The "cookie banner" is an interactive method used by "adtech" companies to try to get user consent, as required by EU law. The forced interaction makes this method annoying
Google and other "adtech" companies are lobbying EU Member States to vote against giving users a means to non-interactively deny consent
Retr0id 23 hours ago [-]
I think this would be a net benefit, but I can see an issue. A lot of news sites today do "accept tracking, or pay us, or you can't access the page". The orgs doing this are reputable-ish so I assume it's considered legal, on some level at least.
So now they'd have a new popup that says "reconfigure your browser to accept tracking, or pay us, or you can't access the page". Which isn't really an improvement.
JoshTriplett 23 hours ago [-]
"accept tracking or pay" has already been ruled against, it just hasn't been universally enforced yet because enforcement takes time.
m000 21 hours ago [-]
This just doesn't make sense. EU regulations are already making progress in improving online privacy: (a) No cookie banner required for functionally necessary cookies, (b) there needs to be an option to refuse tracking cookies in the cookie banner, (c) the dreaded cookie banner appears only the first time you visit a site.
I would say, we are like 80% there. Yes, there are still some dark patterns employed by cookie banners, trying to trick you into accepting tracking. But they are not too hard to make out. And they can be fixed by tuning the regulation a bit: Require the opt-out to be the first choice and the only one with highlighting.
Ad tracking is not going away tomorrow. If we ever are going to get rid of it, we first need legislation to defang it so it stops being a cash-cow. "Tracking prohibited by default" is a great end-goal, but we are not there yet.
Reading between the lines, it appears that there is some new solution proposed to "automatically communicate your privacy preference". That's nice, but when e.g. the Do Not Track header was tried, it just fell flat. So until this new solution is implemented and adopted, I'll take my websites with a cookie banner, thank you.
It is an unfortunate choice that the campaign obsesses over the cookie banner, instead of trying to actually advance the solution that would make it obsolete.
crote 18 hours ago [-]
> Yes, there are still some dark patterns employed by cookie banners, trying to trick you into accepting tracking. But they are not too hard to make out. And they can be fixed by tuning the regulation a bit: Require the opt-out to be the first choice and the only one with highlighting.
The fact that we are still talking about this literally a decade after the GDPR was adopted shows that this isn't working. It has turned into a cat-and-mouse game, and the regulators just don't have the manpower to effectively rules-lawyer every tiny change.
> when e.g. the Do Not Track header was tried, it just fell flat.
... because there was no reason to follow it. There was literally zero consequence for ignoring it.
This new proposal makes the Do-Not-Track v2 header legally binding. User sends the header and you still show a consent popup? You're breaking the law, simple as that. No weaseling yourself out of it, a simple screenshot is enough.
Any regulator could build a fully-automated scanner in half a day: ask the local TLD registrar for a mapping of websites to companies, have some script request the page and do a regex search for "cookie" (or use AI if you are feeling fancy), take a screenshot, pass it to an intern to double-check, then automatically send out a €100 fine. Double it every X weeks they haven't fixed it yet. Want to fight it in court? They have screenshot, you lose, now pay.
24 hours ago [-]
eru 9 hours ago [-]
Has the EU ever ran an honest (or otherwise) cost benefit analysis on the cookie banner rules?
jchook 17 hours ago [-]
The most frustrating thing about the cookie banner is that the solution was always obvious: just use the DNT setting on your browser (Do Not Track). It already existed.
However, powerful interest groups like ad companies that profit from your attention (which hysterically virtually powers the Internet today) were able to stop it from happening.
It was debated way back in 2009 when the GDPR was being developed. Iirc the argument was that browsers accept cookies by default so users do not get a fair consent moment. This is obviously easily fixed by regulation requiring browsers to ask users once.
Seems extremely backwards that we chose to forever darken the entire Web browsing experience just so users can "benefit" from a per-site option to let Google profit from them, with virtually zero payoff for the end user (ad relevance?).
P.S. If ad revenue is an essential pillar of Internet survival and fruition, the clear alternative seems to be sharing a fraction of that revenue with the tracked consumer.
_moof 16 hours ago [-]
And in a truly twisted move, ad tech companies were also using Do Not Track as part of browser fingerprinting.
This industry is a paperclip maximizer, and it needs to be dealt with accordingly.
voxic11 11 hours ago [-]
Do Not Track cannot satisfy the GDPR, it requires that you obtain informed and specific consent so even if a user had the DNT bit set to consenting you would still need to show the banner.
jchook 9 hours ago [-]
Obvious move is to modify GDPR to not be so obtuse.
crusty 17 hours ago [-]
I've wondered for a while what value is assigned if a user ignores or dismisses (when possible) a cookie banner without actively selecting accept or decline. Anyone know?
micromacrofoot 16 hours ago [-]
many of these banners don't actually work, for starters
but the proper functionality would be no cookies that require consent until consent is given
sflicht 14 hours ago [-]
Any US corporation who displays a cookie banner to US based IP addresses should be taxed $1 million per instance of this occurring.
leptons 13 hours ago [-]
Got news for you... California now has its own laws around similar things, and the trolling lawyers are out there sending threatening letters to our clients. I manage a few thousand websites that operate across the US, and things are getting a little crazy with the lawyers lately.
It's just like ADA compliance and trolling lawyers all over again.
lacoolj 21 hours ago [-]
This ones a little tough. Advertising through trackers is a massive portion of how sites get revenue. Going back to the old days would decimate this space, and have widespread effects on the internet (though im not sure it would be noticed by most of us anymore with how dead the internet feels now)
I guess what I'm saying is, there is no good solution here. I don't want every site I visit to require a usage fee just to browse. Imagine if slashdot turned into WSJ with a paywall for every article.
Kagi already does something like this, and cool - if you use it enough, maybe its worth a subscription. I dont find myself googling (searching) much anymore, so paying to do so just becomes something i need to find a way around. Like API token usage for AI, using it is like making a new recipe in the oven every time. You expect it to work but you have to invest the time and money into the attempt before you can find out the results (whereas you dont have to do this on free chatgpt, google search with ai, etc as comparison). Too much investment without guarantee of results. I'm fine without that guarantee as long as im not wasting my time and money upfront.
Anyways, thanks for letting me rant
crote 17 hours ago [-]
> Advertising through trackers is a massive portion of how sites get revenue
Sure, but magazines get a massive portion of their revenue through advertising without trackers. Same with television, or radio, or billboards.
And the ad space isn't exactly very healthy either. Take a large Youtube channel like Linus Tech Tips, for example: AdSense only accounts for 10% of their revenue! Youtube has been drowning people in ads and it still barely pays any money.
I think we should seriously consider the possibility that targeted ads might be less profitable overall. Ad blockers didn't become a thing solely because ads appeared on the web. Ad blockers became popular when ads became obnoxious and privacy-invading. With the current state of the web ad blockers are a hard requirement for a reasonable browsing experience, so the only people seeing ads are the handful of suckers too ignorant to install them.
But if ads aren't as invasive and obnoxious, people would have far fewer reasons to install ad blockers. See for example the Acceptable Ads program of Adblock Plus. If switching to user-respecting ads resulted in a significant portion of people turning off their ad blockers, it could very well result in an increase in ad revenue!
j16sdiz 21 hours ago [-]
I kinda of agree with you - there is no good solutions if we are only changing one or two things at a time .
I am kind of wanting to f around and found out. I missed the old internet were most of the big websites are run by hobbyist. I know some of them may not be able to pay the bill without ad.
May we can figure out something once we leveled the playing field
websap 21 hours ago [-]
Every website that you visit and decide the article is worth reading, means a human spent time working on the content, and people spent time building the website. Reading on the Internet has a cost associated with it, whether its your privacy or your dollars.
hieKVj2ECC 1 days ago [-]
Yes please!
ChadMoran 24 hours ago [-]
What does enforcement of not having these banners look like? Wha tif people just... didn't.
giancarlostoro 16 hours ago [-]
Why they didn't just force browsers to implement it the same way browsers ask if you want to share location data or mic access is beyond me.
troupo 1 days ago [-]
> he EU Commission finally proposed a solution to the cookie banner problem: automated signals that would communicate your privacy preferences between your device and websites or apps.
It wasn't on EU Commission to "finally propose a solution". The soluton has always been there.
Somehow, Google, aka world's largest tracking and advertising company incidentally making the worlds' dominant browser and completely dominating all web standards, couldn't be bothered, and instead was pushing crap like FLoC
cube00 23 hours ago [-]
> Somehow, [...] couldn't be bothered
Google knows if you can set this once it's game over for their adverting business. At least with the cookie banners, there's a possibly you won't refuse every banner.
Especially those banners that only have "Accept" or "More options" with all those checkboxes to clear.
mFixman 8 hours ago [-]
I have been successfully using the Consent-O-Matic extension [1] to auto-decline all cookie and GDPR banners. As much as I'm not comfortable giving potential access to every website to some extension developers, this improved my internet experience almost as much as AdBlock.
Usually government mandating something is concerning cause it seems to favor the government for its existence. However with EU commission its actually interesting combination, its representing multiple individual governments at once which somehow works good for the citizens.
Overall this is a common sense solution. The challenge is that a significant industry makes money by collecting and selling data. It makes it harder for businesses who depend on it, they are going to get creative and will eventually come up with some dark pattern to circumvent it.
ezoe 23 hours ago [-]
It's technically stupid in the first place.
It's YOUR browser, a locally running software on a physical computer YOU own which memorize the cookie key-value pair a remote host told YOU to memorize and YOU return the same value later. It's YOU who allowed the cookie. If YOU don't want to allow the cookie, YOU simply not allow it.
You are technically 100% control on cookie. These JavaScript implemented in-page UI has no guarantee to respect your wish. But you have a power to disable it.
frollogaston 23 hours ago [-]
It's not quite the same thing since the same cookie used for login (doesn't require consent) could be used for tracking (requires consent). But also, basically nobody cares.
troupo 23 hours ago [-]
This has nothing to do with cookies, and everything with pervasive and evasive tracking.
The problem of DNT is that Internet Explorer 11 set it to true as default, and then all companies started ignoring it on purpose.
IshKebab 23 hours ago [-]
DNT tried to do this without any legal backing which was obviously stupid.
whatcd 22 hours ago [-]
Every time a Cookie banner pops up, I want to kill it forever
tete 24 hours ago [-]
No, please don't!
It's great. The current law forces people that don't give a shit about user privacy to have a banner (or any other way of asking for consent first) while giving everyone that cares and everyone not wanting to spy on their visitor a free pass.
inigyou 23 hours ago [-]
People click yes too often because it's the easier way to make it go away. This new thing could actually result in a 0% tracking cookie consent rate, effectively making them illegal.
wazdra 19 hours ago [-]
I'm from France, and when browsing, I often get paywalled when I reject all non-essential cookies. The CNIL (who is in charge of the application of GDPR) ruled that this was compliant with GDPR as long as another website was offering an alternative without cookies[1].
Are there similar rulings in other EU states?
is there an extension that modifies the cookie, changes values randomly? This will pollute their analysis with junk.
the__alchemist 1 days ago [-]
Keep fighting! For now: browser plugins.
pndy 22 hours ago [-]
Extensions; plugins are nearly dead nowadays anyway
hborscht 1 days ago [-]
is there a specific one you would recommend?
tcfhgj 1 days ago [-]
uBlock Origin -> allows blocking dialogs (legally implies refusal of everything not necessary, because you don't agree to something requiring agreement)
Consent-O-Matic -> automated configuration to your preferences using the dialog provided.
I still don't care about cookies -> least privacy friendliest option, because it may opt into undesired tracking (its goal is just to remove the annoyance of the dialogs)
the__alchemist 1 days ago [-]
I use "I still don't care about cookies"; it works well, but I don't have a current comparison to other options.
1 days ago [-]
tgma 23 hours ago [-]
I am old enough to remember Do Not Track and its failure and problems associated with it. What's new here? Why wasn't it adopted in the first place for GDPR?
pmlnr 22 hours ago [-]
Nothing.
People not reading back on history is still very much a thing.
ktosobcy 23 hours ago [-]
Uhm…
> The solution: automatically communicate your privacy preference
Would be lovely and would happen if it weren't for… wait for it… Google and whole effed up ad-busines:
This should just be a browser setting with a per site opt-in when more data collection is needed. Just like you can enable notifications, webcam etc... or set it to always deny.
Why the fuck do people have to keep stating the same preference over and over again. This is a hellscape of bad government AND corporate policy colliding.
haute_cuisine 21 hours ago [-]
You don’t need a cookie notice if you don’t track. We also had “do not track” is safari.
buildwrangler 21 hours ago [-]
Yeah, the "do not track" setting I think was the browser based solution that sadly never took off. Better government policy should have required respecting that setting instead of the cookie banners.
vivzkestrel 13 hours ago [-]
- not from EU here
- for the love of god please do this
- please get rid of every cookie banner on every website on this planet once and for all
- you ll be doing humanity a huge favor
cure_42 17 hours ago [-]
+1
PunchyHamster 21 hours ago [-]
The solution would be for browser to send do not track header and have that header be respected.
But we can't have that, can we ? They will lobby to hell and back for that to not happen
croes 21 hours ago [-]
So DNT back again?
righthand 22 hours ago [-]
The captchas are worse imo (from an usability standpoint) especially the newer Cloudflare infront of everything to check for bots trend.
charcircuit 23 hours ago [-]
Even if you communicated your preferences sites would still want to ask for an exception to them. At least you won't see them ask for consent if you preapprove it.
orangelimetea 14 hours ago [-]
Another idea: Use (or vibe code and share) a browser that doesn't use cookies.
At all.
paulddraper 1 days ago [-]
Doesn't this lead to an all-or-nothing approach?
I don't want randomnewssite to track me. But a favorite online store...I do want help with recommendations.
joeframbach 1 days ago [-]
You would presumably be logged in to your favorite store site, and they would be using your identifying session to make recommendations, not anonymous tracking cookies.
paulddraper 1 days ago [-]
Eh, maybe.
It's easier to click a single button than hunt for how to create/access an account for the brand.
dymk 1 days ago [-]
Then sign in, thats enough signal for them to track you
frollogaston 22 hours ago [-]
Logging in isn't consent for tracking. They can even support login by itself without a tracking banner.
qurren 1 days ago [-]
Just disable cookies on your browser by default, and enable it for the sites that you need to log in to.
Ironically, this has the effect of cookie banners reappearing every time because they cannot place a cookie that says that you have rejected them.
Phemist 1 days ago [-]
Malicious compliance. You do not need a cookie to "store" the fact you have rejected them. They can simply assume you have rejected them from the lack of cookies. They can store a cookie once you (have gone out of your way to) accept them.
frollogaston 22 hours ago [-]
Lack of cookies could mean you never visited the site before.
Phemist 19 hours ago [-]
Safe to assume I reject things on my first visit as well
mzajc 1 days ago [-]
Unless disabling cookies means treating all cookies as session cookies (meaning you can still be followed within a session), this has the fun side effect of breaking pretty much every CAPTCHA firewall like Anubis, Cloudflare Turnstile, and any other that relies on cookies.
Unfortunately this means you have to view a lot of the web through archive.today or web.archive.org - I would know because I have uMatrix configured this way.
frollogaston 22 hours ago [-]
Session cookies for non-whitelisted sites is a nice balance between usability and privacy.
Session cookies for all sites would be fine if passkeys weren't like "We support passkeys. Do you want to use a passkey? Press ok again to use your passkey. Do you consent to using your passkey? Now please authenticate yourself to use the passkey... √ Thank you for using passkeys. Press ok to continue."
qurren 23 hours ago [-]
Honestly I've found that it's often the local businesses that shoot themselves in the foot more by this.
I disable cookies for Amazon because I need to login; if a local business wants me to buy from them directly they need to:
1. Not give me a CAPTCHA or cloudflare shit
2. Give me free shipping and a lower price than Amazon minus 5% cashback that I would get on Amazon
3. No registration needed to check out
and I'll buy from the local website. It's really not a high bar, they need to learn to not shoot themselves in the foot.
As for the news websites -- bleh. If they want me to read it, make it easy to read. As in, I click into it, show me the content. If I get a popup, banner, anything that covers up the content, I bounce. I'll get the news from social media anyway. If they'd rather I get it from their news website, they need to learn to not make me bounce.
I'm not opposed to advertising if they want to get revenue from that, but it should not track me, not cover up content, and not load megabytes of JavaScript to do it.
tcfhgj 1 days ago [-]
you can be tracked without cookies - the cookie dialogs are about tracking and processing of personal data in general.
-> not really sensible
amelius 1 days ago [-]
Just configure your browser to ask for cookies for that store only?
johndhi 23 hours ago [-]
how about:
-if we really don't like targeted advertising, just outlaw it
-then let websites do whatever they want with our cookies so long as they aren't targeted advertising
instead of building websites and writing laws over the span of decades that just seem to want to ban targeted advertising but don't actually do it. FFS.
gitowiec 21 hours ago [-]
I expanded Polish politics names and what I saw made me vomit. Will never send email to those fuckups.
jebronie2 21 hours ago [-]
This initiative is ignorant and idiotic.
The authors don't even understand the purpose of cookie banners.
1. Making tracking impossible/illegal would NOT kill cookie banners, since you need them to record consent for other purposes as well, such as embedding a video from a third party like YouTube.
2. The GDPR explicitly prohibits site-owners from making cookie banners misleading. The law is already there, it is just not very well enforced.
3. "This results in up to 90% of people saying “YES” – even though only around 3% actually want to be tracked online"
This claim is grabbed out of thin air and can be dismissed as such.
4. "The solution: automatically communicate your privacy preference"
This is nonsense because it does not actually solve anything, because you need to record consent for a variety of purposes, not just analytics/tracking.
5. Killing tracking would kill the value of ads (since they are not targeted anymore), resulting in a reduced ability for small businesses to advertise and a hugely increased amount of ad spam everywhere.
Few targeted ads > Many untargeted ads
Unless you want an internet where advertising is no longer possible, this solves nothing apart from stroking a few activists ego.
wrqvrwvq 24 hours ago [-]
or we could glass the continent
logicallee 22 hours ago [-]
All browser providers have been required by international law[1] to send such a cookie popup suppression signal as set by the user, or one substantially like it, since July 18, 2026 and all web sites have been required to obey it or a superseding Internet standard:
This is not a proposal, it is duly ratified international law that applies to "Every Browser Maker making a Browser available anywhere" and "Any site anywhere that receives a valid signal".
The EU Commission had until July 18, 2026 to modify its laws:
>"The site shall not display a banner, modal, interstitial, or other prompt requesting a choice already expressed by the signal. It may optionally provide a “Cookie Settings” or “Privacy Settings” link. This Law overrides all laws requiring such a display. Where any country or supernational entity has a conflicting law, it must rectify the Law within 30 days not to require such notification."
Therefore, insofar as it has not rectified its laws not to require such a notification, the EU Commission is in violation of international law as of 8 days ago.
Under section 7.3, "The State of Utopia may order compliance, require corrective updates, suspend non-compliant distribution, and impose civil penalties. Fines may be levied in any amount for continued non-compliance." so we can fine the EU Commission whatever you guys want ($1 billion? $10 billion? whatever four and a half millennia are worth) and just distribute the collected fines among you all as cash payments.
can we also kill the dark pattern of "accept all" and "choose your preferences" ?
jebronie2 19 hours ago [-]
this is already illegal, which goes to show how useless even more legislation is
openquery 23 hours ago [-]
Finally yes yes yes.
I've wanted the option to select your cookie preferences once and forget in a brower for ever.
I assume the reason this wasn't done initially was corporate pressure (most people would opt-out of everything by default).
1.2 billion exposed users × 8.17 years×365×3 banners/day×4 seconds÷36 is roughly 10-15 billion human hours lost to dealing with damn cookies since GDPR took effect on May 2018.
That's about 17,000 human lives.
mrx8086 9 hours ago [-]
[dead]
afishisafish 8 hours ago [-]
[flagged]
srijanbaniyal 1 days ago [-]
[flagged]
dfaoidsoi 1 days ago [-]
[dead]
m00dy 11 hours ago [-]
[dead]
chmorgan_ 21 hours ago [-]
[dead]
breck 21 hours ago [-]
[dead]
SadErn 23 hours ago [-]
[dead]
CurbStomper 21 hours ago [-]
[dead]
doodlebugging 23 hours ago [-]
No need to kill the cookie banner. Just change the system so that everyone in every organization who supports cookies and other forms of user tracking and engagement will have every detail of their own existence and their family's existence broadcast in real time globally 24/7/365. Anyone who tries to opt out is jailed under 24 hour surveillance for a minimum of one year.
EDIT: It's obvious that people really hate this option. Maybe too many here have their incomes too closely tied to the metrics that cookies are designed to collect. It could also be that it is an unrealistic option for everything except the most extreme societal changes.
If you are old enough and look back far enough you may remember the time before all this bullshit like I do. Once marketing and advertising get involved and gain power in an organization, things tend to go to shit fast.
jsrozner 22 hours ago [-]
Hypocrisy is the name of the game in SillyCon valley. Push YouTube autoplay slop on kids globally, but no ipads for children of the tech elite. Computer-based instruction for public schools, but 2:1 teacher:student ratios in the local private grade schools that cost as much as an Ivy League University. Etcetera.
rpdillon 1 days ago [-]
The insanity around cookie banners is a good target.
> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner.
Fortunately, if you have uBlock Origin, you can enable Easylist cookie notices under annoyances and avoid most of them. Combine with blocking third-party cookies, and the problem pretty much disappears.
The fact that the EU tried to regulate this stuff is a shame, because regulation is not a good remedy. End-users have agency here. The solution is to enable end-users to have control in their browser (which they always did, so it's an issue of education, like so many things).
Shame that Google is trying to kill uBO though. Extremely pleased that Brave continues to support it.
mrkeen 1 days ago [-]
If it's not cookies, it will be something else. IP addresses, tracking pixels, browser fingerprinting.
The Do Not Track header is the only technology needed. The rest is compelling companies to obey it.
cwnyth 1 days ago [-]
Didn't know that about Brave, but it's moot for me since Firefox also supports it and these days I find that Firefox is the better experience, not Chrome or even Chromium.
TechSquidTV 1 days ago [-]
The EU has been on a decade-long crusade to destroy the internet.
PaulRobinson 1 days ago [-]
I think you'll find that's Google and Meta.
Just step back and ask yourself what each side of that debate is trying to achieve and why. What is motivating them? Why are they motivated in that way?
Don't just recite what you "know", think, look, research, figure it out. It might sound good to have a one-liner like this in your back pocket, but do you really believe it after looking at the publicly available information that it is their real intention to conduct a "crusade to destroy the internet"?
tcfhgj 1 days ago [-]
Advertisement has been on a decade-long crusade to destroy the internet.
jebronie2 19 hours ago [-]
Advertising funds large parts of the open internet. Killing ad means killing independent content creators for example.
Over-regulation and censorship like "chat-control", that only benefits big players like Amazon, Meta etc. is what kills the internet.
tcfhgj 2 hours ago [-]
independent of what or who?
jebronie2 2 hours ago [-]
independent of established corporations and institutions
tcfhgj 1 hours ago [-]
well, there's plenty of that out there (including from me) without ads on Codeberg
amelius 24 hours ago [-]
You mean: the planet.
(because it drives consumerism)
yankfatigue 1 days ago [-]
[flagged]
W3cUYxYwmXb5c 1 days ago [-]
This is conflating different things. They are trying to use people's annoyance with the banner THEY caused to build support for another legislation.
Cookies were never a problem. Just get rid of the banner.
This other legislation should pass/fail on its own merit.
But of course it’s impossible to convince someone of something when their livelihood depends on their not understanding it.
This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept" on every single cookie banners that pops up, without ever wasting a second even reading what they're accepting. It's mind boggling to me. Sure, I'm in IT, so surely I'm more aware of data mining, profiling, and other privacy-related aspects. But in many cases, you could just click "reject" and the banner would also disappear...
To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.
Some variant on "reject" takes more effort like 70% of the time. Which is on purpose, of course. The ones that aren't maliciously-complying have a "necessary only" button that insta-closes it, but tons pretend that you might want to allow some spying but not all of it and make you go through another screen if you don't just "accept all".
> To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.
Then it'd be possible to default it to "nope" (Firefox, and perhaps Safari, might do this) or to allow a "never, anywhere" setting the first time the question is asked, and malware and spyware vendors know that'd mean a much larger proportion of denials.
Naturally in a camera meeting with a "don't tell anyone we said that" appended right before.
The marketing people in the meeting were very angry that California was "doing it to them".
There is nothing stopping a website from using cookies regardless of the banner. If they are outside EU jurisdiction then there won't be any consequences either.
The legislators were and are dumb. They have wasted an enormous amount of collective time for no benefit. Big corporations continued doing what they were doing and nefarious third parties could still track you.
They did. The laws were airtight in this regard. They simply lost -- whether through a last minute "tweak" or undermined enforcement mechanism I do not know, but I do know that the current state of affairs was fully anticipated and headed off at the point where I reviewed the proposal. Your vitriol is bass ackwards -- the lesson is to strengthen the walls between corporations and the legislative process and support enforcement mechanisms, because those were the places where the process failed. Not the intelligence of legislators. Otherwise you will keep losing to the corporations, and you will deserve to.
GDPR article 7 and its various recital already include that. GDPR wisely doesn't get into technical details like "cookie banners" anywhere, but various national agencies did set guidance and it's usually quite explicit: Rejection must be as simple as acceptance and reject buttons or link must be as prominent as the accept buttons and links.
For example, CNIL, the French data privacy authority, clearly says[1]:
"The CNIL has received complaints about dark patterns on cookie consent banners encouraging data subjects to accept cookies.
As a reminder, with certain exceptions, cookies can only be used with the consent of data subjects. Moreover, rejecting cookies should be just as easy as accepting them."
And gives examples of dark patterns such as different button sizes, multiple accept buttons, hidden reject buttons, etc.
The law and specific guidance is pretty unambiguous. This purely an enforcement problem. The regulatory bodies do not have the resources to go and chase most individual companies, and the non-profit NGOs that go after the violators apparently don't have the budget to make enough impact and scare companies into compliance.
[1] https://www.cnil.fr/en/dark-patterns-cookie-banners-cnil-iss...
But of course, designing the system that pushes people to make this sort of decision was absolutely intentional.
So even when it's incompetence, it's still malicious, just in a way that obscures the explicit decision-making that led to the result.
I think it's absolutely fair and unlikely to be illegal to use a cookie to remember cookie preferences. Unless the cookie value was not yes/no, but something like a precise timestamp that could be used for uniquely identifying.
Clicking those "REJECT!" buttons might make you feel empowered, but it's pointless. Just set your browser to delete all the cookies at the end of the session except for whatever sites you want to allow to 'remember' you.
The whole thing has always been a problem to be properly solved by the browser, and it's probably just the fact that Google makes the only browser that matters, that it's been foisted upon every website owner, who mostly just wants basic analytics and to track conversions from the ads they run, and isn't "selling your data."
The browser is your user agent. If it's sending any information up to web servers on every request that isn't okay with you, why are you using it?
Exactly. I use the "I don't care about cookies" extension, which rejects most cookies automatically without me having to see the popups. But even accepting cookies is fine - I'll be closing my browser soon anyway and they'll be gone.
Sure, your browser cookie will be gone. But you have already allowed the server-side identifiers of your session to be used for whatever purpose, including reconstituting increasingly larger parts of your identity over multiple disconnected sessions. Please don't make the mistake of thinking that clearing your cookies afterwards is the same as rejecting all server-side processing.
My company scanned 209 European regulated sites in June, and roughly 7 in 10 had tracking that wasn't correctly gated by consent. It's rarely indifference, though. DPOs in the EU hold too much weight for that. It's usually a tag added that was never wired into the CMP or something added by a dev or LLM without going through proper review
Full disclosure: I run https://consentmark.com, which measures what tags actually fire under each consent state to create evidence packs companies can show regulators
> something added by a dev or LLM without going through proper review
FWIW, this was a problem long before LLMs were a thing, and it didn't get worse with LLMs. If anything, I'd expect LLMs to get it right by default, because ones ~everyone is using are all trained straight, they won't just silently read between the lines and write code/configs to facilitate one's illegal business model.
It is known that warnings and pop-ups that show up almost all the time yield diminishing returns. I think it was named "normalization of deviation" by some folks in a blog a while ago, and I believe that name fits. If you get warned about missing https all the time, or that something might be dangerous (even though it does precisely what you want it to do), it will loose its effect by the time you actually need it.
You can argue this is malicious compliance, but if you want it to go away it would probably be easier to go for banning tracking and personalized ads altogether. Eliminate the reason for this behavior, so to speak.
There is one. It's a DNT header. Knucklehead websites ignore it.
> Hacker News Information: If you create a Hacker News account (ID and profile), we do not collect any Personal Information unless you choose to provide your email address and/or information in the "about" field (“HN Information”). Your submissions to, and comments you make on, the Hacker News site are not Personal Information and are not "HN Information" as defined in this Privacy Policy.
Like it or not, the Web is a two-way street, meaning that the server end of the transaction doesn't owe the client end anything in particular unless there's some relationship in place (like a payment). It appears the "just ignore it" matches the intent of most web users, though, since an overwhelming majority of web visitors accept a bunch of spammy ads + free 'content,' and a slim minority pay for ad-free alternatives.
So do car alarms.
I'm not convinced this is a business model I want to exist. We had an internet before it, and Google, and Facebook. I'm increasingly sad we can't return to it.
And I'd gladly trade today's BS for any version of "The Internet" pre-2007.
But the "Before" Internet wasn't some natural sustainable state.
Before 1997 or so, "the Internet" was being paid for by academic institutions and big companies, and wasn't really all that commercial at all. It was also pretty tiny and blessedly simple. Honestly this version is the most achievable (re-creatable?) today since we can set up indie websites much easier today than we could then. Instead of using your free webspace from your university or employer, 20 of us could share a $5 a month instance, and link to each other's webpages, and add an IRC server to that instance just for fun.
In the 1998-2007 era, the Internet got a lot bigger, but was also still pretty fun and not that enshittified, but that's just because it was being paid for by VC money being burned.
Today we are where we are in terms of business model[1] because Google and Facebook achieved great success with ad-based business models because of the ability to target ads better, and because consumers of The Internet have spoken, loudly, with their closed wallets. They've said "We will only pay for content if it's All The Music and ~$10 a month flat rate, or if it's a big/interesting enough video on-demand service and under $20 a month. We'll never pay for news or text content of any kind." So, the businesses with other types of content do what the public wants them to do: have cost-free content whose access is conditional on being advertised to very annoyingly, or they marginalize themselves with paywalls, subscribed to by only a small minority of users.
[1] i'm setting aside the non-business aspects of our mess, namely the poison that social media, 'engagement' optimization, and ragebait-as-news has wrought on society.
There's an old saying in advertising, "Half the money I spend on advertising is wasted, and the trouble is I don’t know which half." - https://quoteinvestigator.com/2022/04/11/advertising/
The supposed benefit of the current model is to find and eliminate that wasted half.
Facebook has shown me ads for dick pills and boob surgery, ads I can't read because I don't know the Cyrillic alphabet, and ads for services that only apply to citizens of nations I've never been a citizen of who moved to a country I had in fact moved out of.
The reports I hear from people who buy ad slots are mostly unimpressed with the results; the word on the grapevine is that the "success" cases are not even average customers, but those who are vulnerable to getting scammed.
Now, if you want to read an article you have to pay $20/month to that news organization in perpetuity. I don’t see how that can be expected to work.
Or, I liked one single page of an amputee woman (I am myself) and now all I see are amputee women.
They just buy all the competitors, but they aren't good at all.
The law that caused the cookie banners also says companies cannot block access to the site if the cookies are not required for the functioning of the site.
Some German news sites have broken this and have "accept or pay" and I think this leaked to news sites in other countries. Facebook even tried it.
So, sure, if DNT is true, try to make people pay. Fine by me.
- even if you accept the tracking, you might still not be able to read the article, because while the site may be free in principle if you accept ads, that specific article is not.
- and the most annoying thing is that such paywalled articles show up on Google News. Not sure if they're tricking Google into showing them (by showing the full article to search crawlers, but the paywall to actual users), or if this is some understanding between Google and EU news providers, but it's annoying...
Good. No one is entitled to a business model working in perpetuity. Doubly so when it's ethically dubious.
The very thing entrepreneurs are glorified for - their ability to invent and execute on new business models. They'll manage, don't worry about them. Hopefully they'll settle on more honest models this time.
Oftentimes the reject flow is substantially more annoying than the accept flow. I click reject myself when it's an option, but I can absolutely understand how people might get conditioned to click accept when clicking reject might result in more popups.
If you made a website and you said "To view the private content on my website, you have to either pay me, or sign a name, any name you wish, in my guestbook" what business is it of the government to say "No, this random person refuses to pay or sign the book, but Thom, you have to let them see all your articles anyway."
Note that I used "sign any name" as the metaphor, not "show ID," since it is trivial to not allow any important information exchange if you simply delete the cookies yourself, which is easy to configure a browser to do. The end-user has the choice, if it's so important to them, to configure their browser. Even Chrome can be configured for which sites to allow cookies, which to disallow, and which to clear when the browser closes (the smart choice, since accepting them and throwing them away soon after is the undetectable option that accomplishes your main aim).
You simply will have to go out of business.
This is also why you see many large companies fighting for more regulation. It's harder for a competitor to emerge if they have to navigate mountains of red tape.
I simply will have to go out of business.
Sorry that you need the government to "help" people in this way, by forcing other people to give them free things.
Simple, easy tools are already there, such as the Clear Browsing Data menu item in Chrome, Edge, and Safari. For more complicated intents, the browser settings are no more complicated to navigate than the actual customization UI in the CMPs, anyway.
More: "To view the private content on my website, you have to either pay me, or let more businesses connect the dots between this content and the rest of your internet browsing habits, than there were students and teachers combined in your high school."
Yes, it is technically possible to fake this content, or to auto-delete it.
But https://xkcd.com/2501/ applies. "It's easy to forget that the average person probably only knows the privacy settings for Safari and one or two Chromium derivatives."
(Real world user familiarity with software is much, much worse; this is an old survey now, but look at the chart near the bottom: https://www.nngroup.com/articles/computer-skill-levels/)
However the UK does have its own GDPR regulation (see: <https://www.gov.uk/data-protection>), though my understanding is that it may be less strict in requiring equivalence between "accept" and "reject" actions. (I may be wrong on this.)
UK sites accessed from the EU would have to be under EU GDPR compliance.
What harm are you worried about?
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
These banners handle both ePrivacy consent for cookies etc, but also GDPR Art. 6(1)(a) for processing purposes (personalised ads, measurement, audience insights, precise geolocation, even device fingerprinting).
They will fingerprint you with or without cookies. They may or not try to honor your preferences, but their "partners" will not try, and by the time you see that banner, it's all out there.
"Accept" is the close button.
So I'm not onboard with the "just block everything by default" crowd. If you frame the question as "Would you like ads to be more relevant to you" instead of "Do you want to allow tracking" you probably get a very different answer from users.
I would like the cookie banner to be changed to a browser setting, but I also would like the option to allow some sites to show relevant ads to me.
This is exactly what browsers did back the 90s, they asked about every single cookie.
Then browsers got configurable options to simply accept either all cookies, no cookies, or only first party cookies (excluding third party sites unrelated to the domain you visited).
For now well over 20 years I have disabled 3rd party cookies in all browsers I use, and only in a few cases overall did I need to make exemptions.
There's a mismatch between the velocity at which people visit sites and the time it takes to navigate the cookie particulars of each site.
And, we can dismiss this as people being uninformed or lazy but the reality it is that's actually not so unreasonable. Cookies are in some ways near the bottom of the list where privacy is concerned, given everything else from breaches to search dossiers to device finger-printing to mobile device location-tracking to the ubiquity of cameras in the real world, and on and on.
The idea that we're clawing back privacy in any meaningful sense by blocking a few cookies here and there is kind of quaint.
People do not have a right (morally speaking, not legally) to access or use a service (or a website) etc without having to read/agree to the terms (applies to analog and digital).
We really need to stop companies from putting up these insanely complicated legal texts to use basic services when they could all be behind standard contracts.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE APPLE SOFTWARE AND SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”
https://www.apple.com/legal/sla/docs/macOSTahoe.pdf
The same point applies to most of the text. But yes, some text is specific to the service. E.g. the same doc above says in bold:
"By using the Content Caching Features of the Apple Software, you agree that Apple may download and cache such Apple Eligible Content on your Caching Enabled Mac."
I'd say that's something worth knowing if you use that OS.
If your terms require people to get a law degree and take a week to parse the 400 page document, then I would argue that it's a tactic to get people to sign up for the service without fully understanding it.
We need legislation that forces companies to communicate the terms in a way that an average person can comprehend.
any sort of elevation prompt, IF I allow them to be popups or an icon in a toolbar, should always be in the same place and not cover the page.
The default is “no”. Without explicit consent you can’t do a lot of things.
You can’t have a default yes, because how can you agree with consent but automatically to everything?
And if it’s a no, are you saying you can’t ask a user for permission to use their data for a specific purpose?
And if you can ask, that’s what we have right now.
Other processing (like after value is read) can happen under GDPR if the data is personal data.
How often do you get prompted for, say, secure DNS or HTTP? Almost never, because your browser has sane defaults and controls that. So, there you go.
I mean, it's even the literal truth: they value your privacy in the sense of having their software do a little internal auction to put a price on it.
P.S.: No true Scotsman spotted
What browsers would those be?
If people really cared, they’d chose reputable suppliers that sell non toxic food. If they are eating food with lead, they don’t care.
Don’t force your wordview on people through regulation
As opposed to enforcing your worldview with a lack of regulation?
Because that's precisely what's happening, with the advertisement industry enforcing their worldview through lack of compliance.
You could, for example, require that user answers very specific questions regarding 10 randomly selected partners and how exactly they can use the data ("is partner x allowed to build very detailed profile of you and target you with political adverts that are designed to manipulate you?").
We're borderline already there today when the cost of switching is typing a different url at the top of the screen. You add some mandatory 20 minute wait and you'll never see a new site again.
Google and Facebook would love it though.
For example, in The Netherlands there is a legally mandated three-day period after signing the contract for purchasing a home during which the buyer can still call off the deal.
The reasoning for this is that it is a seller's market, with demand far outnumbering supply. In practice it is very common these days to end up in a bidding war, and even forego any kind of "sale is void if home inspection turns up issues" clause. Want to think about it for a day or two before signing the biggest contract of your life? Too bad, another buyer is willing to sign today.
With the mandatory three-day waiting period you avoid buyers being locked into a contract they basically immediately regret. It gives them some time to do due diligence, reducing the risk of buying a complete lemon. The seller can ask for a similar clause to be inserted, but it is less common. After all, the only risk to the seller is getting slightly less money for it, and that's already mostly dealt with during the bidding process.
The reason this isn't done is because corporations legal departments love writing 10-100 page contracts that absolutely nobody is going to read.
The law really has nothing to do with cookies, it has to do with privacy, tracking, and PII. You can absolutely save preferences and perform analytics. What you can't do is hoard data that is personally identifiable for purposes that are not obvious to the consumer.
How many requests per second are being served? How many error codes were delivered to clients? How quickly the service responded? Service logs without PII? All perfectly fine to aggregate and analyze without consent.
Acting dense like this isn't productive... And literally this information would be stores as anonymous user 12345, but that still would require consent (probably, or at least arguably).
Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.
Stats like that are only used to implement dark patterns better and justify user hostile decisions since pretty much the time the idea of telemetry was introduced. Otherwise, we'd live in the world of perfect web ui and we're not.
Good.
> and you can't run a serious website without some kind of analytics.
I don't believe you.
> Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.
IANAL, but I'm given to understand that this is untrue.
What do you see as the harm in website owners using aggregated analytics data to improve their sites?
Practical: Supposedly-aggregated stats have a history of actually being perfectly possible to analyze back into individually identifiable information. Also, it's conveniently the same tech stack in a way that makes it easier to make an actual slippery slope.
There’s no way this would fly. “I didn’t read it” can’t possibly be an excuse to avoid being bound by an agreement. Every party to an agreement that flaunted its terms, even though they took advantage of the benefits granted by it, would invoke it as a defense, and it’s irrefutable. The system would completely fall apart if this happened.
There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing.
Only engineers have trouble understanding this. It can be a reasonable defense, and it has successfully been used in courts of law many times. The law is not a machine that compiles text like code literally. Imagine someone who coerces a dying or sick person to sign an agreement they couldn’t possibly be in a reasonable state of mind to understand what they were doing -- the law can and does invalidate such “contracts”. That is the same principle behind age of consent laws. The law could theorerically (and does) invalidate “agreements” which no one is reasonably expected to read and understand.
> The law could theorerically (and does) invalidate “agreements” which no one is reasonably expected to read and understand.
I haven’t heard of a single case where an agreement was voided because “no one could reasonably be expected to understand it.” Unless the language was so impenetrable or vague that the agreement itself could not be discerned. Lawyers tend not to write such agreements.
I just visited theguardian.com to see their cookie banner. The banner says this:
> Your Privacy (`x` button to close the tab)
> US residents have certain rights with regard to the sale or sharing of personal information to third parties.
> Guardian News and Media and our partners use information collected through cookies or in other forms to improve experience on our site and pages, analyze how it is used and show personalized advertising.
> You can opt out of the sale of all of your personal information by pressing
> <button>Do not sell or share my personal information</button>
It's 3 sentences, plus a button that says "Do not sell or share my personal information". I actually don't even think this is GDPR compliant, because my layman's understanding says that GDPR consent must be presented as opt-in, rather than opt-out. (I guess they are going for CCPA/CPRA compliance?) But anyway, I would think that a reasonable person could be expected to notice a button that says "Do not sell or share my personal information" and then click it, especially when it's portrayed prominently at the bottom of the page.
Because this is there 1 millionth cookie banner, because every site and their momma has one.
Also, 90% of cookie banners are not this good. They tell you nothing, hide the "reject" button behind multiple screens, etc. At that point the consumer is trained to click accept.
> Personalised advertising - it's your choice
> Independent, quality original journalism needs your support.
> Please choose an option.
> * Accept personalised advertising and all cookies
> We use cookies and similar technologies to support the Guardian and personalise your experience in other ways. To do this we work with a cross section of [139 partners].
> - or -
> * Reject all and subscribe to Guardian Ad-Lite for €5 per month
> Read the Guardian website without personalised advertising. This does not include ad-free. You will still see non-personalised advertising and we may still use cookies and similar technologies to improve our site.
Followed by:
> Some cookies are necessary to help our website work properly and can’t be switched off. Find out more in our privacy policy and cookie policy, and manage the choices available to you at any time by going to ‘Privacy settings’ at the bottom of any page.
> Cookies and similar technologies collect information from your device and may be used to access personal data about you including page visits and IP addresses. We use this information about you, your devices and your online interactions with us to provide, analyse and improve our services. We use cookies and similar technologies for the following purposes:
> * Store and/or access information on a device
> * Personalised advertising, advertising measurement, audience research and services development
> * Personalised content and content measurement
And finally the buttons:
> ( Accept all ) ( Reject all and subscribe )
> If you already have Guardian Ad-Lite or read the Guardian ad-free, [sign in]
This is the definition of informed consent
However, since we are discussing the banner that The Guardian website shows to US viewers, I assume they’re trying to comply with California privacy law, which does allow opt-out regarding the sale of personal information.
wat
GDPR says that opt-out is the default, and if you are asking for consent, it had to be clear, unambiguous, and with both chouces clearly present.
Not legal: you have to click a button to be opted out, otherwise you're opted in. (Opt-out as a verb)
Legal: you are opted out by default (opt-out as an adjective describing the default situation)
https://en.wiktionary.org/wiki/opt-in
You've muddled the definitions again. "opt" signifies an action by the user.
If I am "in a group" by default, then I can take an action to "opt out", requesting to be removed from the list.
If I am not initially joined to the group, then I can take an action to "opt in" and be added to the list.
There is no such thing as "opt by default". That is not a user action. It also makes no sense for the same list or group to be both "opt in" and "opt out" because, as adjectives, they imply the default states and they describe the user action taken to change that default.
opt-in: default state is out
opt-out: default state is in
But anyway. What exactly do you mean by “buried or obscured”?
As I said above, if the parties cannot be said to have an agreement because the terms of the agreement itself are inscrutable, then that would probably result in no contract being formed, or the terms at issue interpreted in the light most favorable to the non-drafting party. Like if the terms were presented in so small a font that only someone with a microscope could have read them, or it was written cryptographically or is gibberish.
Basically you have to successfully argue that no reasonable person could have read and understood the agreement. You’re unlikely to prevail if you argue only that you, the individual, did not. (Unless the court also finds you are incapable of entering into any contract because you’re a minor, are non compos mentis, etc.)
I suppose you can claim I am wrong to believe that, but it is accurate for me to state that I _do_ believe it, which is why I didn’t list me being wrong as one of the possibilities. Practically speaking, that is the first possibility I enumerated.
I should note that in my example, imagine neither doc is any more inscrutable than all the TOS we encounter in the wild, instead it is the construction (the fact it is a footnote link) that makes it easy to miss the additional doc.
Also, striking an unconscionable term typically does not void the whole contract. Just the term in question.
Aside from that many of these contract have terms that might be considered substantive unconscionability - for example if terms state that what you post can be used by the company that owns the service for marketing of the company or the service I feel this would not make it through most legal systems that I feel before the attempt are not inherently corrupt.
As an example I have an email account with site A. I go to site A and log in, they suddenly spring a large new contract for me to read, I cannot get through to do what I came to do, it will take me 5 minutes to read so I click OK because I am on my way to check my email with site A. Procedurally this is not reasonable behavior.
What would be reasonable?
"Hi, we are changing our terms of service, you can see it at this link and agree. If you don't have the time right now you can do it later, but in three days you will lose access to the service unless you agree to terms."
There are however lots of other laws in the EU which may in fact make this behavior substantively unconscionable anyway. I certainly believe there would also be substantive arguments to be made in this case.
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
Just read avtalslagen paragraf 30. It says just that. And it is different from paragraf 36.
See also https://svjt.se/svjt/1959/497 "En person borde sålunda bli bunden av ordalagen i det dokument han undertecknat utan att äga att ursäkta sig med att han icke läst igenom dokumentet."
https://www.nbcnews.com/news/us-news/disney-says-man-cant-su...
"Disney is trying to have a widower's wrongful death lawsuit dismissed and sent to arbitration because the man had signed up for a Disney+ account several years ago."
Now what happened was that Disney quit fighting over really bad PR. But the court challenge would have liteky succeeded.
Mozilla with their Thundermail just tried saying in their ToS that if you're mentioned at all in anything legal, you agree to pay their legal fees.
The value is derived from the people consuming the product. Placing the "incentive to produce value" above the people who presumably are the source of this value seems...misaligned.
What we need is an environment that does not give the producers asymmetric power over consumers and the products will naturally align with that.
Also, sarcasm isn’t welcome here. Please read the HN guidelines.
Ah yes, I didn't couch my post in any of the various, rampant HN-friendly versions of shitposting. I'll try to follow your example from here on out. Excellent touch citing the guidelines at me after your role in this thread, A+.
Re-reads this thread, taking notes
People routinely create alts just to post sensitive stuff and seem to do fine, and presumably they are keeping multiple accounts active at once.
[EDIT] I mean plus if I gave that many shits about being able to post on HN, I'd probably care a lot more about holding on to my precious karma in the first place, no?
HN is supposed to have higher than typical standards for participation than most internet fora and is largely self policing. It’s not condescending to tell people when they are misbehaving. Nor is it condescending to explain to people the law and how things work, provided you’re not insulting them in the process. Which I’m not doing.
I find much more concerning people’s certainty of their mistaken understandings and beliefs, combined with the most ludicrous possible interpretation of other’s positions.
Or that any actual human is aware that an agreement was made (since an AI can find a checkbox nowadays or software can be configured to bypass it). One way to add balance could be to require people asking for contracts to actually treat them like real serious legal documents, show up for the signing, and figure out who they are making an agreement with.
Prinicipal-agent law predates computers by a very long time.
As it stands I just hit Accept on literally everything and that’s fine for me.
It already pushes the correct "Reject" button for you on a lot of sites (not all; it works based on rule lists)
When was the last time you read an entire EULA before installing software?
I'm going to guess the time frame is somewhere around "never."
These are nuisance contracts designed to jade people with legalese while stealing their rights to things like class action and enforcing binding arbitration.
Standard contracts sounds like the way to go.
So lawmakers do know how to make legally binding preferences based on device settings? What a crazy innovation.. now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act nonsense...
Browsers already had settings for deleting cookies. There was never a reason for banners whose only function was pulling the ladder up from smaller competitors and concentrating power in the hands of an oligopoly that could siphon data directly from the OS.
This coupled with a law mandating ISPs provide a "change IP on demand" feature would have given users a sort of "Tor light" level of privacy. Strong privacy is trivial to achieve for a government that doesn't have a conflicting goal of total surveillance.
Every time you get a cookie banner with options, the website wants to know more about you than the law permits by default.
When prompted by the browser on first login/signup, yes, the same way the password manager works. With stored passwords, keeping the login cookie doesn't even add much value.
Well, there is a skip button. It's labelled "accept all"
It’s baffling we’re having this misunderstanding on this site in 2026 still.
Browser fingerprinting / Panopticlick: <https://ssd.eff.org/module/what-fingerprinting> <https://panopticlick.org/>
On-device identifiers --- Google AdID (GAID), Apple IDFA, etc.: <https://developer.transmitsecurity.com/guides/risk/secure_de...> <https://geraguard.com/blog/how-device-fingerprinting-works-m...> <https://alejandrocordon.com/blog/2025/01/18/unique-identifie...>.
And BYW, browser headers can even be a violation if it's determined that you are using them for tracking users in a way that violates ePrivacy demands.
It's still a cookies thing.
The cookie banner isn't about the usage of cookies, it's about _the underlying tracking_. You're allowed to "just" use cookies for normal shit! You can make a website where you use cookies to store login state for a user, without a single banner.
The thing is that every company in the world feels the need to add 1000 tracking cookies to anonymous users to track them through conversion funnels (on top of the ad stuff). That's what you have to inform people about
You can use cookies normally without a banner! You can't track without consent! Every cookie banner is actually a "we want to track you" banner. Calling it a cookie banner is playing into the confusion about what those banners actually are meant to communicate
https://creepjs.org/checker
It's not hard to make privacy work when you are the government rather than working against a hostile one.
So instead everyone stays on Facebook, Instagram, Reddit, and Twitter, which ALSO operate on ads and have far more information on their users than any third-party ad tracker could ever have.
None of this has gotten rid of the privacy problems. It just consolidated them into the worst offenders while jeopardizing the plurality of the web. Now instead of people being tracked by Facebook on a website with a third-party cookie in a like button, they are tracked by Facebook on Facebook in a Facebook page because they never leave Facebook.
The online safety acts and its EU counterparts are somewhat risky, but nobody wants the mention the only proper alternative: a total ban on "social media." Not just for kids, but for everyone. Or a ban on smart phones, that would work too, at least short term. But: money.
This is unfortunately the reality.
The other day a friend asked me to help her make her phone safer for her kids to use. I started by asking if she set permissions on the apps she downloaded. She looked at me blankly, "What permissions?". I proceeded to show her how you can granularly control what you allow each app to do on your phone and what access it is allowed. Her head blew up, she had no idea any of this existed and after gong through a few menus, she didn't care any more. It was all too complicated and too much to think about for a busy mum.
This is why governments unfortunately are having to try to protect people from themselves. As tech competent people it all seems so simple to us, but we need to remember the majority of the population just click 'Allow All' and blow past all permission and security questions as they have no idea what any of it means.
I haven't set up an Android in a while, but, I doubt it's massively different.
We should just give up and give random individuals access to everyone's camera roll.. no other way.
Greatest minds of our generation couldn’t possibly invent fast profile switching.
Lost technology.
Bit of a mouthful though.
When restoring factory defaults, the same question, just in case the phone is sold, gifted, stolen or whatever.
If you are going to give a phone to a minor you should set that option right from the start.
It'd be even better if there was a way for people to selectively turn it off for specific devices without MITM the connections. It wouldn't be that hard to come up with a mechanism for that.
Yes, as a parent, you are required to put in more effort into parenting your kid than random hypothetical people. That's obvious, and has been the case forever.
I understand the concept of community, but community is not me sacrificing my privacy for someone 1000 miles away.
If parents don't want to do X, Y, and Z to lock down their devices then that is their right. And I support their rights, so the conversation is over right then and there IMO.
The aim here is to protect the children. "Just let parents protect them" doesn't work when there's millions of parents that won't care.
Exactly. The problem is its from the parents side.
Options between "we don't have tech in the house" and "wide-open tech, we have it all" are all some amount of painful, usually for no good reason.
(I remember once investigating how to do some pretty basic stuff for this in Linux, hoping to find something nicer than manually setting some executable permissions and firewall rules and then having to go back and change them all the time, and the closest thing to a guide I found was an old article from Red Hat that basically lead with "LOL, good luck you poor sap, Linux sucks at this" before going on to explain the various bad ways available to sort-of, but not entirely, accomplish it with a lot of work, and significant ongoing time-burden)
THIS
Holy shit. This is such an obvious fix. And it shuts up those surveillance state goons immediately.
My God, why have we tried to summon up the ghost of 1984 when such a simple fix as this will do.
Parents can lock devices into "child mode" that emits "user is child" headers. Websites can then block.
The blast radius is zero.
Good God, we need to fast track this into browsers right now. If we hurry we might be able to point to this as the technical fix.
Once some of the infrastructure exists, OS vendors can hook into it.
Firefox devs - please do this right now. Please spearhead this.
I might have to vibe code an advocacy site for the spec and set up a GitHub / RFC process.
CA tried this with AB 1856. I wasn't a fan of this (neither was EFF) because of the privacy and tracking concerns of blasting the fact that the user is a child to all websites.
https://www.eff.org/deeplinks/2026/05/one-step-forward-two-s...
It would better for the block to happen at the device level. That is, the browser knows it's on a child's device and has a whitelist of allowed sites.
There is already an RTA (Restriced to Adults) header where the website self-labels that it's for adults only and the browser can block it while protecting the user's privacy. I'd prefer expanding the use of RTA.
The web is too big and changes too much and that's before we get to the issue of applying laws to a whitelist based on different juristictions worldwide.
And I have to question, who would administer it? The parents? They won't. Google or Apple? Why do they want to deal with irate parents or culture wars around what is or is not on the list?
There is obvious increasing demand for this from parents, politicians are going to act on it, I think a "this is a child" header is the only one that actually really works. It works for the parents because it's easy to setup. It works for websites because they can cleanly identify a child and filter content if appropriate.
It seems to me that every other solution than a "this is a child" header is either impractical or way worse.
Yes, granted, a globally enforced whitelist probably wouldn't work. I'm referring to bespoke lists that parents control. I know plenty of parents that use this. e.g. here's Apple's feature:
https://support.apple.com/en-us/105121#:~:text=Prevent%20ina...
> It works for websites because they can cleanly identify a child and filter content if appropriate.
This still doesn't solve the problem of different jurisdictions and culture wars of what is or isn't appropriate for kids. All this does is move the liability upstream to websites instead of the devices. That is, instead of the browser deciding what's appropriate, now Youtube, Reddit, etc have to decide. And, as we've seen with the OSA in the UK, typically smaller platforms can't handle the enforcement cost so they just shut down entirely.
https://onlinesafetyact.co.uk/in_memoriam/
The larger platforms often use overbroad CYA measures and throw up age verification where they don't need to (Reddit has done this in the EU), or just ban minors (Anthropic and character.ai did this).
As far as blocking explicit content, a self-labeling requirement like RTA accomplishes the same thing as a "this is a child" header but without the liability CYA and without the privacy concerns.
Where the "this is a child" header solution could theoretically win is allowing kids to access websites in a limited child-safe way, e.g. going to Reddit in child mode automatically shuts off certain subreddits. But, as we've seen, it just doesn't work well in practice and usually frustrates parents by overly broad content policing and liability theater. Kids are also at different levels of maturity and I've seen them get frustrated when they're binned into age categories that they feel they don't deserve. e.g. a 12 year old might be plenty mature enough for the 13-16 age category.
But my real objection to the "this is a child header" is the privacy risk and surveillance risk. I don't think it's worth it.
You mentioned AB1856 which seems waaaaay broader than emitting an age bracket header based on user settings. It puts the onus on the website operator to not only prevent presenting content to wrong age bracket users, but also to determine the age bracket of the user.
Websites are shutting down wholesale because they cannot reasonably afford the CYA, or dont want to out of principle.
In echelons scheme the parent would be voluntarily setting the age bracket on the childs device right, so if a 12 year old is more mature, then go ahead and set their device to emit the 13-16 age bracket header. If you as a parent dont believe in this, then leave the bracket unset.
For a website operator it would be trivial to block the user from accessing the site if the suggested age bracket is too low (as long as we can agree on a single way of doing things, of course). Larger operators can do more heavy content moderation and present a filtered view to those same age bracketed users.
It is true you are adding more tracking signals, and I am sensitive to the free speech issues, but children are not fully emancipated members of society yet and parents need tools to deal with the difficulties of raising children in a digital society. The alternative now seems to be OSA-like, which is even more intrusive and a risk to privacy and perhaps free society as a whole.
Of course, OSA is really the goal and not the method, and we have to remember it is never about the children. Would children have been protected from e.g. andrew mountbatten if OSA had been around at that time?
I've long since considered that the efforts for online child safety should be pointed at educating parents and spearheading some kind of certification of compliance for child safety of software and websites.
[this product is certified to adhere to EU:CSA]
Then you can block everything not certified, and the software that does the blocking would also be certified, the two major prongs you need (endpoints and sites working together: else they're blocked). The rest of the money goes to education for parents about this fact, and the dangers of not doing it, and how to do it.
This is super "easy" (when comparing to the effort it would take for putting backdoors in everything).
Which is why I think that the reason is definitely not child safety, and more about crime control.
Me talking about UK blocking people unless they ID themselves in 2013: https://news.ycombinator.com/item?id=6979295
Me talking about how its disingenuous because we have superior technical solutions to this particular issue last year: https://news.ycombinator.com/item?id=45010902
I'm not sure to understand the proposed solution here, but it seems someone could just use a different web browser client who don't inherit these restrictions.
There are so few sites where I really need cross-site logins to work that an opt-in would be much more preferable.
Have all sites set cookies on whichever third party they want, but don't share those cookies over. Add an explicit "Do you really want foo.com to share data with bar.com?" if you really need to see those facebook comments on your news site.
No cookie banner is required for functionally necessary cookies.
EU official website in it’s cookie banner glory: https://european-union.europa.eu/index_fr
I get similarly upset, when I see Google tracking on official websites of government or public institutions.
No, they don't really need to track you, that's why it requires consent to do it.
They are doing exactly what they say.
In other words, they're not saying don't track your visitors. They're saying get consent first.
https://commission.europa.eu/resources/europa-web-guide/desi...
> Use of the cookie consent kit is mandatory on each page of the DGs and executive agencies-owned websites, regardless of the cookies used.
if they didn't use third party cookies they wouldn't need it
Also AFAIK the Google Fonts question (is the IP alone already PII, if Google has no way of tying the IP to a person) has not been decided by the ECJ yet. There've only been decisions by lower level German courts that are still in dispute.
"Well if the cookie comes from a third party it implicitly allows tracking."
Yes, because this makes tracking possible you have to gather consent first, regardless if tracking actually happens. Very bad solution, they could just define how data can be legally used, instead of also overreaching by defining how data can be legally transmitted.
> strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
One very ignored qualifier here is "information society service". This is defined in Directive 2015/1535 and one of the requirements is that the service is "normally provided for remuneration". That is usually understood to mean that the service needs to be tied to provider's economic activity. This effectively excludes, for example, public authorities websites which are for their own public duties. It does however include e.g. ad supported websites.
And yes, I'm aware that many national implementations actually miss that qualifier. That can save the non-commercial private sector websites, but public authorities do not benefit from Member States failing to transpose Directive correctly.
People act shocked when it leads to unintended side effects, but companies legal teams are just telling them they have no idea how a judge will interpret these broad wordings in regards to their business.
People say this fixes "future loopholes" but as you see with the cookie banner, it just leads to every company assuming the worst case scenario.
Going back years of conversation on cookie banners you'll see a constant argument on when they're required or not precisely because it's not defined explicitly.
I do not want the gas station, or the airplane I'm on, spying on me to build relevant advertising. That is the end game of "relevant ads": my gas pump already serves me ads, the airplane I'm on serves me ads, my own car now (via a software update that occurred after purchase) serves me ads. Monitors now serve ads. TVs are abusing people's Internet connections, which isn't ads, but it's basically the same problem: if I can abuse the customer without consequence, why shouldn't I?
Just no. The problem is, I as a consumer cannot vote with my wallet: companies can and will go "I could take your money, and earn $X, or I could do that and ads and earn $X + $Y."; there is not reason for them to choose the former, and most markets are so concentrated (e.g., airlines) that there is not ample competition for the market to provide ample "vote with wallet" choices. Further, in the car example, it's just bait and switch: even when I think I can vote with my wallet, the company can just alter the terms of the deal, knowing full well the switching price of a car makes me subservient to them.
Why? Plenty of websites operate just fine with no or near-zero ads. Just look at the one you are currently on!
And what's with confusing "relevant ads" with "privacy-invading targeted ads"? There's still plenty of ads in print media, on television, and on billboards: none of them are invading my privacy, yet they still manage to be relevant by choosing a medium with a certain target demographic. Websites used to do the same, there's no technical reason we can't return to this.
Of course it is: https://news.ycombinator.com/item?id=43595269
Any future law in regards to this will likely just lead to the companies that already got consent (companies you already have accounts with) becoming even deeper entrenched.
Non targeted ads pay a small percentage of targeted ads.
They did not read the text to agree.
It was the fastest way to get the banner to go away. Sometimes they force you to confirm multiple times if you click ”none” or ”minimal”.
In the UK a few news sites have changed cookie banners to "you can accept and see this stuff for free, or you can sign up for a subscription, which would you prefer?". It's the only time I hit accept (and then clear browser history).
If blanket preferences from browser signals became the norm, a segment might open up where you would configure preferences and a data broker would make sure you get something in return for your data. At minimum it might force paywalled publishers to consider that as a "lite" subscription option.
ads don't require invasve and pervasive tracking
Advertisers are willing to pay more for privacy-invading ads because they believe they are more effective. If privacy-invading ads were illegal they'd just go back to context-dependent ads like they have been using for the thousands of years before the internet was invented, and after an adjustment period the revenue will just bounce back to where it was before.
Most advertisers know this already. If privacy-invading ads were so effective, why are all the major brands now using influencers to market their products? Why go through the effort of finding a specific Instagram channel which might be a good fit and convincing the operator to enter a brand deal, when you could also just directly pay Instagram for a highly-targeted ad one swipe away?
That's what the tracking industry keeps telling you with zero evidence it's true.
And then there are studies like this one: https://www.sciencedirect.com/science/article/pii/S016781162 which say that targeted ads need to be 100% to 700% more effective to be as profitable as non-targeted ads
(see e.g. https://iapp.org/news/a/cjeu-clarifies-cookie-consent-requir... https://www.edpb.europa.eu/news/edpb-consent-or-pay-models-s... )
Again, that is not a requirement. If your argument is that they give us content for free because of ads, ads don't require pervasive and invasive tracking. Or hiding stuff behind paywalls (since ads pay for it).
Im pretty sure if a company said something like "Here have free netflix for life, as long as you install this browser plugin that provides us with information about your shopping habits" millions of people would bite their hand off.
Need to look up a bus time? Full screen cookie consent with accept buttons drawn OFF THE SCREEN.
Your kind comes into every one of these threads and says some version of "well if they weren't tracking then they'd have nothing to worry about and no need to show a banner", but that is so obviously not true to anyone who uses the web. You absolutely do not need to defend a law that is not working.
> When the law takes effect in January 2027, Californians will see new privacy options in web browsers. When enabled, these controls will automatically inform websites of their privacy preferences, helping to protect personal information from being sold to data brokers and other third parties. This means they will be able to protect their data — like their browsing history, location data, purchase history, and personal interests — across the entire internet with a single step.
[1] https://cppa.ca.gov/announcements/2025/20251008_2.html
Browser-based privacy controls were proposed in the late-90s/early-2000's as P3P, and were killed by corporate interests.
https://www.w3.org/P3P/
3% of people want to be tracked online? I think it's more likely that 3% of people misunderstood the survey question
I don't really use youtube natively a lot anymore, but I used to with Google's "personalised ads" turned off. I don't know if you've tried that, but the ads Google serves you if you opt out of personalised adds are sketchy, creepy and mostly not child appropriate (a lot of medical stuff, plus adverts for mail order brides etc). Back then I opted in to personalised ads because being tracked seemed a better option to me than being served inappropriate material without my consent.
Anyway, that's a long rant, but my point is, there's edge-cases and weird contexts in which I can imagine people saying something like "of the options I see as likely to happen, I'd most like to be tracked".
Sounds good, as long as it covers the "legitimate interest" bollocks⁰ that is often hidden in inconvenient UI nests as well as the basic preference.
-------
[0] "we see your preference not to be stalked, but we want to anyway, click again for every partner to reconfirm you don't want them following you around"
https://en.wikipedia.org/wiki/P3P
And for a serious website, front end analytics are kind of a necessity to understand how users interact with pages and improve the experience. Note that it certainly doesn't require tracking the behaviour of individual users, just understanding how controls are used in aggregate.
I know it seems like you could work around this with careful design and maybe focus groups and such, but I can tell you we regularly uncover surprising insights from (aggregate) trends in front-end events.
See here[0], page 6:
> As stated in Article 5(3) ePD: ‘This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.’
0: https://www.edpb.europa.eu/system/files/documents/2024-10/ed...
As long as you do not share that info with 3rd party, and the user requested it, you can store via cookies pretty much whatever you want without the need for a consent screen
Good websites sharing stuff for the fun of it rarely ever add these obnoxious banners. They probably should if they embed other trackers (like Youtube or Google Fonts) but often just don't. It's only the ones that want to make money off you that bother putting in the obnoxious banners.
Even the use of the word "cookie" is framing by industry to confuse people.
> Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.
> When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
> Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative.
Full guidelines: https://news.ycombinator.com/newsguidelines.html
You're welcome
> ...
> You may think that EU privacy law requires cookie banners. But the law is clear: online tracking is prohibited by default.
That's an excellent idea... lets see how its implemented on https://european-union.europa.eu/index_en
Oh... there's a cookie banner.
I'm visiting a website, i don't want to make a legal agreement with every website ...
Social media bad for kids? Everyone hand over your ID at the door ...
Then you blame the government.
I don't have a lot of confidence for legislative solutions. Although I admire people who keep trying.
Put a note in your calendar, write a letter and send it then.
btw, the link say it's around 3% of people who want to be tracked when the reports state it's between 3 and 10%. it's misleading.
I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? Who knows.
If the banner's not required, it ends up saying stuff like "we'd like permission to share your data with 0 partners". Ever see that?
The fact is most website operators want to use your data for non-essential purposes.
50% that, and 50% that way more companies than you expect are harvesting and profiting from your data.
You need to disclose it in your privacy policy, you need to delete it after a reasonable retention period and you can't use those logs for other purposes like ad targeting, but you don't need a consent banner to track things that you are legitimately using for security purposes.
What makes that a legitimate interest and not advertising?
This part I guess
I think most companies just don't give a fuck about user privacy and therefor have to show one. There are of course exceptions. But I don't know how many of them have been actual (for-profit) companies.
On our go-live form there’s a question “do you use cookies” and it’s yes/no. If you say yes legal block the site from going live without the pre approved cookie banner…
Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.
It was never about the cookies themselves. That just happened to be the most common form of tracking in use when the GDPR was originally written. Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
> it was never about the cookies themselves.
The ePrivacy directive was about cookies. GDPR is about user consent and data handling - the cookie banner is from the ePrivacy directive.
> Cookie-less tracking still requires a consent prompt, tracking-less cookies never required one.
Where in the GDPR or ePrivacy directive does it say cookie less tracking requires a consent prompt?
And on tracking-less cookies not requiring one - that’s my entire point.
I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).
That has been my guess as well. If you run npm install half-the-internet you have no idea what's in there, so just slap on that cookie banner for good measure. Of course the real problem is not knowing what's inside your application, but the thought process is "eh, if a blanket cookie banner does the job then that's good enough for me".
Perhaps the EU Commission could start by stopping the circus on its own website and killing its own cookie banner: https://commission.europa.eu/index_en
There is ZERO cost to abusing the user over, and over, and over again by asking for permission to track them.
We shouldn't have the cookie banners at all because NO company should be able to do anything with tracking data. Just ban the use of user data by companies and most of SillyCon Valley's garbage behaviors are fixed.
Similarly, I should never get "terms of service updates" from digital companies because there should be no changes that they can make. You can provide the obvious service that you're providing; you can't aggregate my data for any purpose other than directly serving me; you can't aggregate my data with that of other users; if you retain my data for any other purpose, the government should take percentages of your revenue. I shouldn't have to wade through the BS that the mercenary corporate lawyers cook up to extract value from me.
He asked me "So, how would you make the Internet better at Google?".
My response, "Setup preferences in Chrome to eliminate all popups including Cookie banners".
I never got a call back for the second interview.
Oh.
The answer is simple. Don't use tracking cookies.
I have personally never ever had any problems with the cookie banner since Brave deletes them with 100% accuracy, there's sometimes where a site will refuse to function properly, but it's usually sites I don't care about anyway and if I HAVE to get it working I disable brave shield, turn off all tracking, consent and turn the shields back on.
It is unfortunate that most browsers cannot implement this as it goes against what the companies behind the browsers want. Deleting the cookie prompt would stop people from occasionally just accepting all cookies and opting into tracking after getting tired of it.
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
As written, this doesn't eliminate cookie banners completely, only if your browser is sending a Do Not Track header or similar. That's unfortunate news if you use fingerprint protection - those send default headers, so you'll still be bombarded with cookie banners. Hopefully existing anti-fingerprinting solutions will offer a "default headers but with Do Not Track" option.
Is there any reason for allowing this tracking browser side besides a little convenience for the web devs?
Sites that easily allow you to simply reject everything are then a short hop, skip and a jump into browser settings where you auto-reject all cookie/tracking nonsense
Another good one to have the "hide Youtube shorts" filter, featured on HN a while back.
Also I wanna know when websites don't give a shit about my privacy and therefor have to show a cookie banner. While theoretically not consenting should mean not collecting blocking it altogether and modifying page content might mean "all bets are off". If the website expects you to have made a decision that might wrongly consider it consent.
Consent-O-Matic says "I don't consent".
;dr
The "cookie banner" is an interactive method used by "adtech" companies to try to get user consent, as required by EU law. The forced interaction makes this method annoying
Google and other "adtech" companies are lobbying EU Member States to vote against giving users a means to non-interactively deny consent
So now they'd have a new popup that says "reconfigure your browser to accept tracking, or pay us, or you can't access the page". Which isn't really an improvement.
I would say, we are like 80% there. Yes, there are still some dark patterns employed by cookie banners, trying to trick you into accepting tracking. But they are not too hard to make out. And they can be fixed by tuning the regulation a bit: Require the opt-out to be the first choice and the only one with highlighting.
Ad tracking is not going away tomorrow. If we ever are going to get rid of it, we first need legislation to defang it so it stops being a cash-cow. "Tracking prohibited by default" is a great end-goal, but we are not there yet.
Reading between the lines, it appears that there is some new solution proposed to "automatically communicate your privacy preference". That's nice, but when e.g. the Do Not Track header was tried, it just fell flat. So until this new solution is implemented and adopted, I'll take my websites with a cookie banner, thank you.
It is an unfortunate choice that the campaign obsesses over the cookie banner, instead of trying to actually advance the solution that would make it obsolete.
The fact that we are still talking about this literally a decade after the GDPR was adopted shows that this isn't working. It has turned into a cat-and-mouse game, and the regulators just don't have the manpower to effectively rules-lawyer every tiny change.
> when e.g. the Do Not Track header was tried, it just fell flat.
... because there was no reason to follow it. There was literally zero consequence for ignoring it.
This new proposal makes the Do-Not-Track v2 header legally binding. User sends the header and you still show a consent popup? You're breaking the law, simple as that. No weaseling yourself out of it, a simple screenshot is enough.
Any regulator could build a fully-automated scanner in half a day: ask the local TLD registrar for a mapping of websites to companies, have some script request the page and do a regex search for "cookie" (or use AI if you are feeling fancy), take a screenshot, pass it to an intern to double-check, then automatically send out a €100 fine. Double it every X weeks they haven't fixed it yet. Want to fight it in court? They have screenshot, you lose, now pay.
However, powerful interest groups like ad companies that profit from your attention (which hysterically virtually powers the Internet today) were able to stop it from happening.
It was debated way back in 2009 when the GDPR was being developed. Iirc the argument was that browsers accept cookies by default so users do not get a fair consent moment. This is obviously easily fixed by regulation requiring browsers to ask users once.
Seems extremely backwards that we chose to forever darken the entire Web browsing experience just so users can "benefit" from a per-site option to let Google profit from them, with virtually zero payoff for the end user (ad relevance?).
P.S. If ad revenue is an essential pillar of Internet survival and fruition, the clear alternative seems to be sharing a fraction of that revenue with the tracked consumer.
This industry is a paperclip maximizer, and it needs to be dealt with accordingly.
but the proper functionality would be no cookies that require consent until consent is given
It's just like ADA compliance and trolling lawyers all over again.
I guess what I'm saying is, there is no good solution here. I don't want every site I visit to require a usage fee just to browse. Imagine if slashdot turned into WSJ with a paywall for every article.
Kagi already does something like this, and cool - if you use it enough, maybe its worth a subscription. I dont find myself googling (searching) much anymore, so paying to do so just becomes something i need to find a way around. Like API token usage for AI, using it is like making a new recipe in the oven every time. You expect it to work but you have to invest the time and money into the attempt before you can find out the results (whereas you dont have to do this on free chatgpt, google search with ai, etc as comparison). Too much investment without guarantee of results. I'm fine without that guarantee as long as im not wasting my time and money upfront.
Anyways, thanks for letting me rant
Sure, but magazines get a massive portion of their revenue through advertising without trackers. Same with television, or radio, or billboards.
And the ad space isn't exactly very healthy either. Take a large Youtube channel like Linus Tech Tips, for example: AdSense only accounts for 10% of their revenue! Youtube has been drowning people in ads and it still barely pays any money.
I think we should seriously consider the possibility that targeted ads might be less profitable overall. Ad blockers didn't become a thing solely because ads appeared on the web. Ad blockers became popular when ads became obnoxious and privacy-invading. With the current state of the web ad blockers are a hard requirement for a reasonable browsing experience, so the only people seeing ads are the handful of suckers too ignorant to install them.
But if ads aren't as invasive and obnoxious, people would have far fewer reasons to install ad blockers. See for example the Acceptable Ads program of Adblock Plus. If switching to user-respecting ads resulted in a significant portion of people turning off their ad blockers, it could very well result in an increase in ad revenue!
I am kind of wanting to f around and found out. I missed the old internet were most of the big websites are run by hobbyist. I know some of them may not be able to pay the bill without ad. May we can figure out something once we leveled the playing field
It wasn't on EU Commission to "finally propose a solution". The soluton has always been there.
Somehow, Google, aka world's largest tracking and advertising company incidentally making the worlds' dominant browser and completely dominating all web standards, couldn't be bothered, and instead was pushing crap like FLoC
Google knows if you can set this once it's game over for their adverting business. At least with the cookie banners, there's a possibly you won't refuse every banner.
Especially those banners that only have "Accept" or "More options" with all those checkboxes to clear.
Does anybody here know of a better solution?
[1] https://addons.mozilla.org/en-GB/firefox/addon/consent-o-mat...
Overall this is a common sense solution. The challenge is that a significant industry makes money by collecting and selling data. It makes it harder for businesses who depend on it, they are going to get creative and will eventually come up with some dark pattern to circumvent it.
It's YOUR browser, a locally running software on a physical computer YOU own which memorize the cookie key-value pair a remote host told YOU to memorize and YOU return the same value later. It's YOU who allowed the cookie. If YOU don't want to allow the cookie, YOU simply not allow it.
You are technically 100% control on cookie. These JavaScript implemented in-page UI has no guarantee to respect your wish. But you have a power to disable it.
E.g. storing your precise geolocation for 12 years: https://x.com/dmitriid/status/1817122117093056541
GDPR is not about cookies; it is about tracking. Whether the tracking is done through cookies or through other means makes absolutely no difference.
You can prevent some tracking via your browser, but definitely not all of it.
In 2024 Mozilla acquired Anonym from former Meta executives and decided to introduce PPA: https://hn.algolia.com/?q=privacy+preserving+attribution
It's great. The current law forces people that don't give a shit about user privacy to have a banner (or any other way of asking for consent first) while giving everyone that cares and everyone not wanting to spy on their visitor a free pass.
1: https://www.cnil.fr/fr/cookie-walls-la-cnil-publie-des-premi... (in french, sorry)
Consent-O-Matic -> automated configuration to your preferences using the dialog provided.
I still don't care about cookies -> least privacy friendliest option, because it may opt into undesired tracking (its goal is just to remove the annoyance of the dialogs)
People not reading back on history is still very much a thing.
> The solution: automatically communicate your privacy preference
Would be lovely and would happen if it weren't for… wait for it… Google and whole effed up ad-busines:
https://ppc.land/eu-council-drops-cookie-signal-after-google...
F*ck google and other BigTech…
Why the fuck do people have to keep stating the same preference over and over again. This is a hellscape of bad government AND corporate policy colliding.
- for the love of god please do this
- please get rid of every cookie banner on every website on this planet once and for all
- you ll be doing humanity a huge favor
But we can't have that, can we ? They will lobby to hell and back for that to not happen
At all.
I don't want randomnewssite to track me. But a favorite online store...I do want help with recommendations.
It's easier to click a single button than hunt for how to create/access an account for the brand.
Ironically, this has the effect of cookie banners reappearing every time because they cannot place a cookie that says that you have rejected them.
Unfortunately this means you have to view a lot of the web through archive.today or web.archive.org - I would know because I have uMatrix configured this way.
Session cookies for all sites would be fine if passkeys weren't like "We support passkeys. Do you want to use a passkey? Press ok again to use your passkey. Do you consent to using your passkey? Now please authenticate yourself to use the passkey... √ Thank you for using passkeys. Press ok to continue."
I disable cookies for Amazon because I need to login; if a local business wants me to buy from them directly they need to:
1. Not give me a CAPTCHA or cloudflare shit
2. Give me free shipping and a lower price than Amazon minus 5% cashback that I would get on Amazon
3. No registration needed to check out
and I'll buy from the local website. It's really not a high bar, they need to learn to not shoot themselves in the foot.
As for the news websites -- bleh. If they want me to read it, make it easy to read. As in, I click into it, show me the content. If I get a popup, banner, anything that covers up the content, I bounce. I'll get the news from social media anyway. If they'd rather I get it from their news website, they need to learn to not make me bounce.
I'm not opposed to advertising if they want to get revenue from that, but it should not track me, not cover up content, and not load megabytes of JavaScript to do it.
-> not really sensible
instead of building websites and writing laws over the span of decades that just seem to want to ban targeted advertising but don't actually do it. FFS.
1. Making tracking impossible/illegal would NOT kill cookie banners, since you need them to record consent for other purposes as well, such as embedding a video from a third party like YouTube.
2. The GDPR explicitly prohibits site-owners from making cookie banners misleading. The law is already there, it is just not very well enforced.
3. "This results in up to 90% of people saying “YES” – even though only around 3% actually want to be tracked online" This claim is grabbed out of thin air and can be dismissed as such.
4. "The solution: automatically communicate your privacy preference" This is nonsense because it does not actually solve anything, because you need to record consent for a variety of purposes, not just analytics/tracking.
5. Killing tracking would kill the value of ads (since they are not targeted anymore), resulting in a reduced ability for small businesses to advertise and a hugely increased amount of ad spam everywhere. Few targeted ads > Many untargeted ads
Unless you want an internet where advertising is no longer possible, this solves nothing apart from stroking a few activists ego.
https://stateofutopia.com/laws/2/law2.html
This is not a proposal, it is duly ratified international law that applies to "Every Browser Maker making a Browser available anywhere" and "Any site anywhere that receives a valid signal".
The EU Commission had until July 18, 2026 to modify its laws:
>"The site shall not display a banner, modal, interstitial, or other prompt requesting a choice already expressed by the signal. It may optionally provide a “Cookie Settings” or “Privacy Settings” link. This Law overrides all laws requiring such a display. Where any country or supernational entity has a conflicting law, it must rectify the Law within 30 days not to require such notification."
Therefore, insofar as it has not rectified its laws not to require such a notification, the EU Commission is in violation of international law as of 8 days ago.
Under section 7.3, "The State of Utopia may order compliance, require corrective updates, suspend non-compliant distribution, and impose civil penalties. Fines may be levied in any amount for continued non-compliance." so we can fine the EU Commission whatever you guys want ($1 billion? $10 billion? whatever four and a half millennia are worth) and just distribute the collected fines among you all as cash payments.
[1] Here is the announcement of the law 38 days ago: https://news.ycombinator.com/item?id=48585778
I've wanted the option to select your cookie preferences once and forget in a brower for ever.
I assume the reason this wasn't done initially was corporate pressure (most people would opt-out of everything by default).
1.2 billion exposed users × 8.17 years×365×3 banners/day×4 seconds÷36 is roughly 10-15 billion human hours lost to dealing with damn cookies since GDPR took effect on May 2018.
That's about 17,000 human lives.
EDIT: It's obvious that people really hate this option. Maybe too many here have their incomes too closely tied to the metrics that cookies are designed to collect. It could also be that it is an unrealistic option for everything except the most extreme societal changes.
If you are old enough and look back far enough you may remember the time before all this bullshit like I do. Once marketing and advertising get involved and gain power in an organization, things tend to go to shit fast.
> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner.
Fortunately, if you have uBlock Origin, you can enable Easylist cookie notices under annoyances and avoid most of them. Combine with blocking third-party cookies, and the problem pretty much disappears.
The fact that the EU tried to regulate this stuff is a shame, because regulation is not a good remedy. End-users have agency here. The solution is to enable end-users to have control in their browser (which they always did, so it's an issue of education, like so many things).
Shame that Google is trying to kill uBO though. Extremely pleased that Brave continues to support it.
The Do Not Track header is the only technology needed. The rest is compelling companies to obey it.
Just step back and ask yourself what each side of that debate is trying to achieve and why. What is motivating them? Why are they motivated in that way?
Don't just recite what you "know", think, look, research, figure it out. It might sound good to have a one-liner like this in your back pocket, but do you really believe it after looking at the publicly available information that it is their real intention to conduct a "crusade to destroy the internet"?
(because it drives consumerism)
Cookies were never a problem. Just get rid of the banner.
This other legislation should pass/fail on its own merit.