Hacker News Reader

Comment by akersten | Hacker News Reader

If only the regulators had been happy with (or even aware of?) the existing capabilities of browsers to manage cookie consent, like "Block 3rd party cookies" and "block all cookies" that have been around since the late 90's, we wouldn't even have needed to add anything new to websites or browsers!

View on HN

The legislators haven't legislated for a particular mechanism, they've just said that any tracking has to be opt in, as opposed to opt out. Do Not Track was a technical solution for this, but when IE made do not track the default, and tracking something you had to opt in to, they panicked and stopped supporting the headers and instead preferring the cookie walls, rather than trusting the browser settings. If websites respected UA settings, and the UA implemented DNT in a way that's compatible with the law (so, DNT: 0 only when you opt in), then we wouldn't be here

Not sure what DNT has to do with it. Do Not Track was circa 2009, we were already "here" at that point. The cookie law was like 2002.

EU legislators avoid legislating particular technical solutions, since those tend to not age well (see the uproar on HN when it was reported that the EU legislated to mandate USB-C, when they didn't actually do that, they just mandated that the industry agree on a standard)

Czech Republic (EU member) data protection regulator is aware and ruled that if user has cookies enabled in his browser, that's enough and user gave cookie consent. If user doesn't want to have cookies stored, he can block them in the browser.

A simple off/on switch does not provide a sufficient level of control over cookie policy. It's reasonable to want to allow first-party cookies on certain sites, especially where they're needed for site functionality. But block third-party tracking cookies, or even block all cookies on others.

Cookie control/policy in browsers needs to become more sophisticated than what we have today.

Reply on news.ycombinator.com