Hacker News Reader

Comment by bzb6 | Hacker News Reader

This cookie insanity has to stop. Instead of adding popups everywhere, users should’ve been trained to use the options of their browsers, which have existed for decades.

View on HN

I did set DNT but I'm still getting tracked.

I do not want to disable all cookies, I'm perfectly happy to use credential cookies or a shopping cart, I do not want to disable everything indiscriminately.

Also I shouldn't have to out out.

> I do not want to disable all cookies, I'm perfectly happy to use credential cookies or a shopping cart

The cookie banner that you have to refuse/accept only concerns cookies that are not necessary for the proper functioning of the site. So login cookies or shopping cart are unaffected by the consent, and if your site has nothing else than this, it does not need to ask for consent.

Many sites, upon clicking reject, do not actually disable anything and simply suggest you disable cookies in your browser (sometimes with instructions).

Which is probably not legal.

Probably not. That's why we need legal enforcement, and not "users learn how to use the cookie options of their browsers" as these sites and the top level comment on this thread suggest.

>Also I shouldn't have to opt out

Actually, the law says the tracking cookies have to be opt in, which is why the pop ups are so aggressive and undismissable in the first place.

Pop-ups being aggressive/undismissable is in breach of the GDPR, so given enough enforcement the problem will self-resolve. These fines are a great first step I'd say (though long overdue).

of course. I'm complaining about the practical implementations and the suggestion to just disable cookies.

We're at the stage now where they can reasonably reliably track you without cookies. I think we need to focus more on restricting what companies can do with data than focusing on asking users permission for things. Popup-hell doesn't help anyone in my opinion.

GDPR deals with identifiers that can tie data to a single individual. Cookie IDs are just one way of doing that, true.

That's why GDPR is so powerful and a well thought out regulation. Replace the technology completely, but GDPR still applies as user-unique identifiers are still used. ex, cookie with fingerprint.js, nothing really changes. You still need to ask for consent for user-level tracking.

AFAIK, this is exactly what GDPR is doing.

GDPR works well in this direction but it still adds in the informed consent which caused alot of the popups and the original cookie law was the EU as well. Basically, the EU while making the internet better is also making it worse. But it's a process and I think GDPR is a move in the right direction.

Companies would still have to be mandated to respect said options, as when the voluntary DNT was added, companies went "lalala can't hear you"

Then they should’ve been fined for not respecting dnt

DNT was a browser initiative and had no legal teeth

Then what is the reason that `robots.txt` is so widely followed even without a legal requirement to do so?

You can't just scrape websites and ignore robots.txt, you will get into infinite loops. That doesn't mean people don't do it anyway, but "first pass" scraping it is more efficient to respect robots.txt, and then you can come in with a human to figure out if anything behind robots.txt is surreptitiously possible to scrape. On the other hand, Google etc. do not care enough, they just respect robots.txt because they don't need to index your site if you don't want them to, it hurts you more than it hurts them.

DNT has no mutual benefit, the benefit is only to the end-user asking not to be tracked. The benefit is also not immediate, it's somewhere down the road. Ignoring robots.txt can immediately cause problems for both the client and server.

There is an incentive to not abuse their own server time serving robots, essentially creating the status quo.

Meanwhile, advertisers value users' data like gold. Unlike server time, most advertisers are okay to collect their own data for advertising purposes, and this causes them to have an unwritten agreement to collect data. Unless there is a stronger stick to force them otherwise, it is in their best interests to collect data and you need to have active intervention to prevent it.

Server operators are more capable of blocking badly behaving bots than users are of blocking adtech companies. Consequently you follow the limits in robots.txt or you risk getting blocked.

On the other hand, if you follow the limits in DNT, you get nothing, and the consequences of not doing so are ... nothing, so companies did not follow that. (See also P3P for another previous attempt)

If any browser vendor just pushed a trivial standard like

    X-Consent: no-cookies

    X-Consent: cookies-ok

Sites would have gobbled that header up overnight, and the other browsers would have received substantial pressure to follow.

But it's a missed beat by now, nobody is paying to have hundreds of thousands of web sites updated for such a thing even if it did exist.

Sucks none of the major browser vendors are based in Europe or this might have happened. Meanwhile, I'm no lawyer, it's not clear whether the header would pass the legal test, but I'm sure a sufficiently motivated party might have a good shot at arguing that it did

Not quite sure if this is sarcasm ?

The do not track header is about 10 years old, ans was promptly ignored by all websites

     DNT: 1
     DNT: 0

DNT is too simple, there should be new better standard integrated in web browsers. The never ending popups with absolutely 0 constancy across sites is atrocious, moreover if I rejected a cookie for a domain on site A I will be prompted on site B if I want to reject it again.

For every domain that wants to create cookies, I should be prompted by the browser (like I allow camera access) if I authorize it to do so, we can even imagine that each domain would have cookies purpose information ('mydomain.com/cookies_policy') in JSON that the browser is able to present to the user (describing each cookie of the domain). Then the browser would be responsible to never create cookies that I rejected.

The main advantage would be that in incognito mode I would not have to repeat myself 10 times a day.

If you want to see an example of a more granular policy that the browsers (well, Internet Explorer, but it was the majority browser at the time) implemented also being ignored, see P3P: https://en.wikipedia.org/wiki/P3P

Ultimately the only cookie an users will willingly accept is the sessionid/rememberme. And the "remember me" checkbox is consent enough under the GDPR.

Behing all the legalese and marketing-speach, all the other purposes boils down to :

    - We are too lazy to setup a matomo, so we are giving google your browsing pattern. 

    - FB is forcing us, so we can pay ever so slightly less for ads

    - Google is offering to tell us your sex and age

    - If we dont track you, we will show you a viagra ad.

    - Through 4 intermediaries, we can pay this totaly-objective-blog which sent you here.

I'd love to hear from someone with a complex cookie consent pop-up, but i'd bet there is about 80% "accept all" (because the users have been trained to do it) 19% "reject all", and no-one is mixed.

So the do-not-track would have been accurate enough.

I asked this elsewhere in the thread as well, but what about tracking done through the session cookie?

e.g: Tying together two browsing sessions by one user on two different devices.

Main difference is that Do Not Track was an industry incentive, not a legal requirement like the GDPR is. They could have made it legally binding, but they chose not to.

Hrm fair point. I'm not sure DNT could have been repurposed to imply consent under much newer regulations, but you're generally right, this mechanism predated the EU regs and somehow was passed up.

"Somehow" is because there was nobody enforcing it, so nobody had any incentive to honor the request. Legislative approach is the only way to have an actual effect.

DNT was also intended to be an explicit opt out. However Internet Explorer enabled by default for three years, giving the industry an excuse to question its validity and ignore it. Privacy centric Microsoft or intentional sabotage?

As it stood, DNT was used as an additional 1.5 bytes of identifying information: Yes/No/Not Set. To be then promptly ignored.

The good thing is we only have to look at the abject failure of do-not-track to see that this approach categorically doesn’t work.

Ah, the RFC 3514 approach..

cough DNT cough

On the contrary, companies should be trained not to use dark patterns to trick people and not to abuse cookies by tying together tracking and spying with visiting a web site.

DNT was made for this. In-browser, voluntary. How well did it work?

Better than cookies popups, at least it didn't create huge annoying thing.

The cookie banners being annoying is because these companies want it to be annoying so you don't pay attention and just click accept without actually learning what they do with your data.

So they are not only annoying but also worthless. Got it.

I agree: any company which does not respect DNT should be heavily fined at a minimum, with executives in jail. This would ensure fast adoption.

Browser's UI for cookies is severely lacking though. It's been at least a decade since a browser asked me to store a cookie.

Reply on news.ycombinator.com