Hacker News Reader

Comment by treve | Hacker News Reader

It's time for a browser-level cookie consent API. The web interfaces are almost always a pain, especially on mobile.

This would also open the door to extensions that just default consent to 'no'. This can't be the default though, to avoid another failure like Do Not Track.

View on HN

A browser setting replacing the popups is part of the new EU ePrivacy Regulation, which is at the moment still being discussed. I hope it gets finalized soon, because there's a number of improvements in there.

https://ec.europa.eu/digital-single-market/en/proposal-epriv...

Thank god, I never understood the EU directives that didn’t consider that by making sure things were implemented at a browser level it would cause an order of magnitude less work for web developers/site owners and ensure a consistent experience for end users.

It boggles my mind why they didn't think of doing this in the first place. I've been annoyed by the stupid cookie law since it became a law, it's ridiculous to have every single website implement it differently when the darn browsers can just implement it.

The cookie law is 18 years old, browsers have changed quite a bit since then, as has legislative understanding of the tech field.

Having read through GDPR, I got the distinct impression that nobody involved in writing it really understood the technologies involved. There's a lot of handwaving about "reasonable measures" whenever they run into ignorance that's absent in the many chapters about inter-government protocols.

GDPR was explicitly designed to be "general". Specifying website behaviour is a bit specific for a regulation that wants to regulate privacy at a whole (in virtual and reallife interactions). Of course that also means that the regulation is quite lacking when it comes to specifics but that wasn't its goal. The goal was to be a fallback-law which regulates everything that is not explicitly regulated otherwise.

What you want is the ePrivacy Directive which "introduced" the cookie banners many years ago and its updated version which is (still) not ready.

What makes that different than the failed do not track header?

The DNT header must be honored by the remote service, similar to robots.txt.

Since the browser itself stores the cookies, it has the absolute authority to stop them.

So is this just going to be a different/easier way to configure per site cookies?

Actual legal backing.

Has anyone been successfully sued/fined/punished under GDPR in a meaningful way? Clearly TC still gets away with this nonsense.

Yes.

https://en.wikipedia.org/wiki/GDPR_fines_and_notices

Google, $50M; Marriott International, £99M; British Airways, £183M; 1&1 €9.5M; etc.

Yep, let's hope that becomes true - the last time I looked into[1] the situation, it seemed that the latest drafts have moved the settings back out of the browser.

I contacted my MEP at the time about this, and please do the same if you can voice your support for simpler, genuinely user-friendly and consent-respecting settings.

[1] - https://news.ycombinator.com/item?id=21914283

It's still there, page 27. They just refer to the browser as software providers, which is probably better, as it now covers internet software that is not technically a browser.

It seems ambiguous to me - my concern/question is whether the definition of 'software settings' could include the content of a web page itself.

That could lead us back to the current situation where consent dialogs are designed by advertising networks, and result in user consent fatigue.

I've been saying this for years. Cookies are already a browser feature. Browsers just need to expose a little more control over it

Firefox used to. But they ripped that out like every other useful feature over the years.

I don't understand why. This is exactly something that browsers should do.

They did? I haven't noticed a change in many years or using it. If anything it's gotten better with the availability of extra functionality through cookie autodelete and built in container tabs.

Me too... nobody listens...

How is this not solved by Brave + uBlock Origin or Disconnect or Privacy Badger?

1. Because websites keep bugging me about consent

2. Because website builders need to write custom things for consent

It’s called “using an extension to manage cookies”. There are dozens of extensions for this.

Encoding the usage of a particular (probably otherwise short-lived) technology in law is generally a pretty bad idea. Sure, have the EU write laws about cookies - the two outcomes are A) this becomes useless when people switch to a different tech stack that doesn’t use cookies B) we’re stuck using 30-year-old technology to try to get things done, at least for regulated industries like banking or government services. Like the IE regulatory situation in Korea but worse.

The gdpr does NOT plainly state cookies. It refers to any form of user tracking from websites!

Quoting recital 30 of gdpr

"NATURAL PERSONS MAY BE ASSOCIATED WITH ONLINE IDENTIFIERS…SUCH AS INTERNET PROTOCOL ADDRESSES, COOKIE IDENTIFIERS OR OTHER IDENTIFIERS…. THIS MAY LEAVE TRACES WHICH, IN PARTICULAR WHEN COMBINED WITH UNIQUE IDENTIFIERS AND OTHER INFORMATION RECEIVED BY THE SERVERS, MAY BE USED TO CREATE PROFILES OF THE NATURAL PERSONS AND IDENTIFY THEM."

https://gdpr-info.eu/recitals/no-30/

When a corporate lawyer hears a law explicitly list technologies like "IP addresses" and "cookies", they're going to (rationally) get scared when you step outside the clear boundaries of that law, and it's their job to place institutional pressure on technical people within the corporation not to do things that make them scared.

> the IE regulatory situation in Korea

I found this from 2013:

https://www.zdnet.com/article/south-koreans-use-internet-exp...

Anyone have an update to that story? I know in Korea they use a ton of apps to order things all the time now. Maybe this law was phased out, or just didn't apply to phones?

Not to take away from your broader point. Laws are just such a terrible development model. Everything's tested live and you can't easily revert anything.

The law is not about cookies, it's about an obligation to inform on and let users opt out of tracking features that go beyond technically necessary features.

The law uses the word "cookies".

Only once, and only as an example:

> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

From: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL....

P3P https://en.wikipedia.org/wiki/P3P is a thing already, if perhaps a bit overengineered. It even works in IE6!

That's server-side (and dead). Cookie consent would primarily be client-side.

Otoh, we already have cookie-consent in browsers. Just don't accept cookies if you don't consent!

P3P also exposes a machine-readable semantics for privacy policies, which could be used by the browser to manage access to not just cookies but other problematic features as well. It's a lot more flexible than "just reject cookies" or the "DNT" header.

The issue is imho that the decision needs to happen server-side (so that a user with an incompatible client isn't slurped up by default), ergo the user-agent must declare the intentions of the user and the server needs to act on it.

P3P could be a hint for the the user-agent, but the user-agent would have to tell the server what level of tracking etc is acceptable to the user.

If the default was 'yes' (i.e. opt-in) then it's not consent.

The solution is just proper enforcement and education. Opt-out by law must be the default while opt-in requires extra actions. Just teach people to always click No and eventually the dialogues will go away.

Do Not Tracked was not backed up by laws. That's the difference.

You don't need an API for it. Browsers can reject cookies at a protocol level (by simply not sending cookie headers), and indeed used to ask users whether they wanted to allow cookies from a certain domain or not.

You can disable all cookies altogether in at least Firefox and Chrome. You can make them only last for the current session.

The problem as always is that, like Javascript, some cookies are still useful (saved login and 2FA status).

Power users, upon request, should be presented with and asked to accept/reject/blacklist/whitelist cookies.

Interestingly the only browser I know of that does this is Lynx, which is text-only and does not support Javascript.

I use Brave + uBlock and get nearly this exact experience. Disconnect and Privacy Badger also work well.

I use uBlock as well, but it doesn't have a convenient interface that allows me to inspect and modify cookie permissions.

What is your workflow when visiting a new site and figuring out what cookies to allow?

Then it's not so much a cookie consent API we're looking for but an "unwanted cookie" consent API. Issue immediately becomes political, which IMO is why previous attempts at such (Do Not Track header) have failed.

With browsers you can of course default to blacklisting all cookies and add exceptions as you go. I did this privately in Firefox until I was sent to work from home during the pandemic, after which figuring out what cookies I needed to enable to get Teams to work proved too much of a hassle.

It has nothing to do with political consent. It's a matter of providing a user with better UX for cookie management, precisely because "blacklist everything from this domain" is too broad.

It is worse than UX issue - it is a billateral UX really for what both designers ans usere can do tying functions together to "subvert the purpose" in combinatorial explosions.

The political is in trying to limit the options to either party like the Computer Fraud Abuse Act charging someone for entering in every possible phone number into a phone directory. The extreme unlimited (il)logical extreme is "If the user is capable of exploiting several 0 day escalation of priveledge attacks to download all of the credit card information and then delete the website that is on the designers for making a shoddy website" being legal. That would be a pure "no politics" UX system with many obvious and inobvious side effects.

It's not just cookies though, it's tracking in general which you should also be able to turn off (but impossible at browser level).

Do Not Track was a failure because no state actor was forcing private companies to comply. Even if it had been an opt-in solution, no company would have respected it.

Interestingly DNT was used by Medium to some extent.

It's sad that I need to ask what "used" means in this context, but did they respect Do Not Track or use it as a tracking point?

They respected it in the sense that they didn't load external embedded content that didn't respect it.

This should've been what was done from the get go. Browsers have given us control over cookies for a very long time now. But hey, it's the EU, there's a reason the EU has a lack of tech companies. I'm sure that when they finally do what you suggest they'll screw it up somehow as well.

You want regulators to design APIs?

What I want is irrelevant. I have as much say about what happens in the EU as I have say in US politics despite being from the EU. The politicians will do something stupid regardless and then years later not understand why things are going poorly. Meanwhile the Germans and French will love it, because it screws those evil evil American companies. So, the regulators might as well design APIs. It's hard to imagine that it would end up any worse than their usual.

I'm pretty grossed out that the internet has been taken over by the government.

Blocking cookies should be done by users via software.

This is only going to make the barrier to entry higher and more expensive.

I have no idea what many small non tech businesses would do? Pay a few thousand every year when standards change?

> This is only going to make the barrier to entry higher and more expensive.

That's the point. We want the barrier to entry in widespread tracking to be high.

For what it's worth, you don't need cookie consent warnings if you use them only for functionality integral to the product you offer your user. For example, if you need to use a cookie to facilitate a logged-in user session, you don't need to warn them.

The only ones paying the high price is the people who use it to collect user information not essential to the service they provide to the user, for god knows what.

Actually, we want to to be so high that nobody (including massive companies) can circumvent user consent.

> Blocking cookies should be done by users via software.

That’s what is done.

The government doesn’t block cookies for you, they set the rules with user data, and the actors (service providers and users) act accordingly.

That’s how things should be.

I don’t want the governments to build or design software, I want them to set the rules and let browser developers and other actors react accordingly. If the reaction isn’t judged well intended or good enough, they are sanctioned accordingly.

Regulators designing, or at least mandating, an API isn't that weird a concept; for instance that's how PSD2 open banking works in some countries.

Frankly, I'd be happy if sites just supported Do Not Track.

They do support it, if including it as a level of granularity for fingerprinting counts as support. :-)

Oh boy this really has come full circle.

I'm an old dude, so I never understood why you would require websites to ask for cookie consent, when you can handle that more safely in your web browser.

That's like putting a sticker on your car saying "Don't come into my car" instead of just locking it. Why do you need regulation when you can just let technology solve it? No idea.

So NO! NO fucking cookie consent API! Just let the browser ask you when a cookie needs to get set... DAMNIT!

In my day, website used to be websites where you could read stuff. Anyone who wasn't able to predict these annoying popups after HTML5 and GDPR, is seriously blind.

(Sorry for the rant ;))

Yeah in your day websites were websites where you could read stuff. But today they’re massive interactive applications. It’s not even remotely the same.

Well, I don't want an article to be interactive.

I so agree with this. I find the level of admiration for this painful law absurd.

I'm stuck in Europe. I was fine without the GDPR. Now, I waste my time clicking "accept" because I don't have time to deal with this crap. Meanwhile, my university has hired what my stepfather would have called a "tweety little person" to police GDPR regulations. God knows what she does (she doesn't). God knows in what single way she has improved a single person's life. But she has a job now, and by God, she'll fight for it.

I care about privacy, but there were options to manage this already - like browser extensions. You could download them if you cared, and if you didn't want to, you didn't have to. Government regulation, demanded by zealots, has added one hundred tiny frustrations per day to millions of ordinary people, caused an expensive pain to thousands of small websites, and created a new, wholly useless compliance industry.

And is Facebook tracking me any less? Ha ha ha. Facebook can afford lawyers.

Wow, finally a like minded person!

The argument I always hear is "Ordinary people don't know about cookies so it's the websites responsibility". As if ordinary people now understand cookies.

It's all a big fiasco, supported by people who think theory works in practice.

> Anyone who wasn't able to predict these annoying popups after HTML5 and GDPR, is seriously blind.

Have you read the GDPR, though? Because in no way does it require "cookie consent", incidentally, neither did the previous "cookie law". The consent forms I've seen so far are all willfull misinterpretation, dark patterns, or both.

95% (if not more) of non-shady uses of cookies do not require consent, and thus don't need a consent popup. If you do implement one on your website it means one of several things:

1) You did not actually read or understand when/why you need consent

2) You did read it/don't understand, but are unable to figure out where all the stuff on your site is actually coming from and are thus unsure about the implications

3) You actually need consent (in case you are hosed anyway, you can't predicate usage on consent, so there's 0 motivation for users to ever consent)

4) Your purposely trying to annoy EU residents in hopes they will lobby against GDPR back in the EU

5) You're blindly copying what other people are doing, because thinking is hard.

Ah, I see you've never talked with a legal team.

1. Is there risk?

2. Does adding a consent screen reduce or remove risk?

3. Is the risk reduction from 2 less than the cost?

Congrats, now every website in the world gets a cookie consent screen even if not technically required.

The problem is probably that it’s a European-style law, being read by U.S. lawyers. Those lawyers interpret every word strictly and worry about what the most negative interpretation might mean, and assign risk accordingly. European lawyers know that the spirit and guidelines are what matter, and say “as long as you can plausibly show that you made a good-faith effort to comply with the stated intention of the law, you’re fine.”

See, I'd be with you with this interpretation, were it not for the fact that a solid >70% of consent screens I've seen blatantly violate the GDPR in a number of ways, so if this process is what happened, legal done fucked up.

Not "subtly getting a minor detail wrong", but "doing something that is explicitly mentioned as not allowed" levels of wrong.

Unfortunately I had to read it for my own website, and have applied it properly. But I'm technical and can actually understand it.

But 99% of businesses owners went to full panic mode and went straight to your point 5. "Our website needs such a popup".

Do you think the general public now understand cookies? Of course they don't.

Seemed all pretty obvious to me.

But it's not cookie consent, it's tracking consent.

Seriously. If there was ever something that needs standardization, it's this horrible cookie law crap.

Reply on news.ycombinator.com