Hacker News Reader

Comment by pteraspidomorph | Hacker News Reader

As an european who rejects ad trackers on every website, I can confirm that a good 95% of them are correctly implemented and will let you keep browsing. Some of them (usually americans with a poor understanding of why they even implemented that) will kick you out or ask you again on every page load until you accept.

We need a standard for managing these controls on the browser side, which major browsers can then implement. It wouldn't surprise me if people were already working on something like that. If I reject ads from google doubleclick specifically, they should be pre-rejected for every subsequent website that asks the same question. Likewise for the various cookie purposes.

(I do understand the unfortunate potential for fingerprinting here...)

View on HN

> As an european who rejects ad trackers on every website, I can confirm that a good 95% of them are correctly implemented and will let you keep browsing.

Really? Any chance you could share some examples, because my strong impression is that a clear 95% of those I see are not compliant.

How does that work anyway? If you decline to allow the site to store a cookie on your machine, how does the site know that you already rejected the popup to avoid showing it to you on your next action?

They store that information on a cookie! Some websites try to break their own permission manager on purpose (or at least I can only imagine it's on purpose) by burying the cookie that stores the permission manager's settings within the list of cookies you have to accept or reject, so if you "reject all" you will be asked again and again. Non malicious implementations either include the permission manager among the essential cookies or list it at the very top so you can choose to keep it.

If the permissions were managed by the browser then cookies could be managed directly on the client side without server side interference, and preferences could be communicated to the website via headers (like DNT but GDPR requires a lot more granularity, and is also legally enforceable in the EU).

There's a browser extension which clicks away the consent dialogues for you:

https://www.i-dont-care-about-cookies.eu/

It lets you specify a global setting to what extent you want to be tracked, and communicates that to sites that support the extension's "standard".

But there is no reason for most websites to be compliant when they know that by default they will get what they want (blanket permission)...

> We need a standard for managing these controls on the browser side, which major browsers can then implement.

Like the "Do Not Track" header field?

https://en.wikipedia.org/wiki/Do_Not_Track

Perhaps it will work if introduced as a GDPR header field.

That is a good point. If my browser is sending a do not track header, why is your server even asking me how much tracking I want?

Clearly they are asking because they hope that you click "Yes". Once you click "Yes" they give you a cookie and stop bugging you. It's a nasty trick of the tracking industry.

GDPR does not forbid websites to ask or even deteriorate your experience (afaik). Perhaps that should change.

GDPR does forbid providing a lesser experience for people who do not consent to tracking. (Obviously aside from the direct consequences of not having tracking, like getting different adverts.)

Then the question is: does (needlessly) asking for permission result in a lesser experience?

I like the way you're thinking there. But sadly I suspect not.

i don't think its a problem that people don't let you use the site if you don't opt-in. thats a design choice, not a fault or problem or bad implementation. just a show of that they would really really like to track you. if you don't want to be tracked, then it's a clear indicator to avoid such site in the future.

I wholeheartedly agree on your point though, that if i reject 'A' on one site, it could be assumed by the browser i'd like to reject 'A' on the next site. Perhaps the same kind of block could occur like they do with faulty ssl settings, just stating that you blocked 'A' on some site ,and this site is using the same, with a button to proceed if you accept that fact.

That's not how GDPR is designed. In Europe, the business model to 'sell' Web content for the permission to track has now become illegal. Web site owners will need to change their business model, or they will be fined.

Note that you can still 'sell' Web content for forcing your customers to see advertisments. You just aren't allowed anymore to track that on a person-by-person basis.

> i don't think its a problem that people don't let you use the site if you don't opt-in. thats a design choice

It's illegal. End of.

I find that some vendors will have a section for "information storage and access" and list both the cookie used to remember your gdpr setting and cookies from doubleclick in there.

Or the opt out page just leads to instructions to disable cookies in your browser.

Every single website seems to have a slightly different layout for the permission manager thing, even when the software for multiple websites is (in name) the same software developed by the same company. Why? Tricking the user into accepting something they wouldn't want to seems to be a major reason. It drives me nuts. If there was a single permission manager whose layout is controlled by the Firefox devs this wouldn't be a problem.

Both of those are illegal, and may get the site fined.

Reply on news.ycombinator.com