Comment by Udo | Hacker News Reader

Comment by Udo | Hacker News Reader

This whole thing is ridiculous. While adding these widgets to blocking filters seems like a workable short-term solution, the entire cookie notice scheme is unworkable in the long run. The problem is, this crap will stack up in the future, and none of it will ever get abolished. On some sites, I get a triple-stacked legalese warning banner, and I have to manually close all three of them.

Since internet law will only get worse, maybe it's time for a "real" technical solution to this. For example, if we had a standardized HTML element attribute to mark these widgets, browser/adblock makers could enable people to opt out of displaying them. It might look something like this:

  <div legal-notice="cookies">...</div>
  <div legal-notice="DMCA">...</div>
  <div legal-notice="terms-of-service">...</div>

And ideally, there would be a JavaScript API to query this as well, maybe piggy-backed on the Permissions API:

  navigator.permissions.query({ name : 'skip-notice', topic : 'cookies' })

Frankly, the requirement of notice could (and should) be pushed on to user agents – not sites. For one, it would help standardize both the user experience of notices – and leave the UX of website specific notices alone – but also it would improve the current state of things where many (most?) sites in the EU simply don't care or know about the legislation.

The last thing we need is more cruft sent across the wire.

Couldn't agree more with this. The fact that the cookie law is forced on websites is absolutely idiotic. The browsers know what cookies are being set.

Is it actually enforced? Has anyone been taken to court over it?

Not in court but this is a resolution from the spanish data protection agency: http://www.agpd.es/portalwebAGPD/resoluciones/procedimientos... (in Spanish) From the year 2013, this was the first sanction in Spain (3500€ to a jewelry).

You can search for more sanctions here: http://www.agpd.es/portalwebAGPD/resoluciones/procedimientos... Search for "Articulo 22.2 LSSI" or similar

Google has recently been sending out warnings to AdSense publishers who serve content to the EU that they will receive a violation if they are not serving these cookie notices.

This accounts for the seeming uptick in cookie notices. To my knowledge, Google has not enforced this in the past.

My solution was to use CloudFlare to get geotags and PHP to serve the warning to only to those who live in the EU, but to each his own.

But the browser doesn't know why it's set. The idea of the law is to distinguish between cookies which are used for the operation of the site (e.g. login cookies) and the ones that are not (mostly advertising tracking). You only need to give notice about the latter.

This is what I like about the lynx text browser[0], on navigating to a new host it prompts you to reject or accept cookies: http://i.imgur.com/GEpYVVs.png

[0] http://lynx.invisible-island.net/

You can make Firefox prompt too, unless they removed it in favor of Pocket or video chat.

That only works if cookies are infrequent enough, like location data, which they aren't. Also there's no way for the browser to know how the cookie is used. I'm all for a technical solution, but I'm not sure it's possible to do "cruft free" without rethinking some things.

And as far as there isn't any "cookie law" on the books, it's about compliance with data protection and privacy regulation. So the EU isn't standing in the way of the industry to do that in another way.

The "real" technical solution here is to standardize a modern authentication system separate from cookies and have things like "do not track" actually work. The industry has, seemingly deliberately, failed to do that. So the EU has rightfully argued from "first principle" that privacy and data protection is more important than the status quo in the industry.

> to standardize a modern authentication system separate from cookies

why? Then ads will use that "new" thing as well. Cookies are enough for authentication.

The point would be that you would have to authenticate before being tracked. Today disabling cookies will break login function of a lot of sites. I'm unfortunately short on time, but you should be able to find a discussion about this around HTTP/2.

I've had third-party cookies disabled for years. It's a simple (partial) solution and really should have been the default over 10 years ago.

Why block them? It's good that websites have to be more transparent with how they are tracking users.

It is however inconvenient for the websites. They could always stop using privacy-invading ad networks and external services which track users and then they wouldn't have to show any message.

>They could always stop using privacy-invading ad networks and external services which track users and then they wouldn't have to show any message.

"if these companies would just invent and build a new infrastructure to pay the bills, they wouldn't need to present a nag."

EU citizens are under no obligation to support business models that have a negative effect (be it small or large) on their lives, nor are they obliged to make it technically convenient for companies to conduct their business.

There are many business models which do not come with moral dilemmas and that do not fall under the incidence of this law. Data mining and tracking might be trendy, but it's not a free for all, there need to be rules and the privacy of users must be respected. If some companies are unable to do fulfill these basic and fair requirements, that is strictly their problem.

You seem to be ignoring the fact that this is about users not wanting to see that silly notice, not about websites not wanting to display it.

> Why block them?

Because I have better things to do with my time than click to close the message on every single website I visit.

If you actually read them then good luck to you. I think most people either a) don't care or b) install a global blocker to suit their particular privacy requirements.

> Why block them?

Because the web becomes unusable with those "helpful" cookie notices when I actually do block cookies browser-side.

Those "TRUSTe" JavaScript solutions are the worst. They fade the whole page to black, then take whole seconds to load and make the browser sluggish.

> Why block them?

Because as I am already using an AdBlocker that blocks the tracking cookies, this message is irrelevant.

These laws are still evolving and changing. Different for every country. We don't have something international we can build standards upon at this point in time.

It seems to me there would also be an active push against any such implementation because it would make current solutions for getting around this type of cruft more effective than it already is.

Although if we were going to go this route I'd like to see it be a server-side rather than included in the markup. The browser could detect that you are visiting a new domain and request relevant information upon connection.

> These laws are still evolving and changing. Different for every country. We don't have something international we can build standards upon at this point in time.

Not every country. This is EU legislation after all; any website hosted in one of the 28 member countries has to abide.

The cookie directive is implemented differently in each country, so if you are doing business in multiple countries[0], you are in for a bloody mess.

[0] http://cookiepedia.co.uk/cookie-laws-across-europe

This reminds me there was a push for a 451 error that would represent censorship. Whatever happened to that?

https://boingboing.net/2012/06/13/error-code-451-an-http-err...

It is being used the way it is supposed to: http://i.imgur.com/x2oG6hq.png

Well browsers could send an "allow cookies" header, like the "don't track" header?

The Do Not Track HTTP header would work:

  DNT: 1 (Do Not Track; don't show cookie notice)
  DNT: 0 (Allow tracking; don't show cookie notice)
  No DNT header (Ask before tracking)

Reply on news.ycombinator.com