I don't care about cookies
i-dont-care-about-cookies.eu
i-dont-care-about-cookies.eu
Enjoy tracking that
I don't care about all the other stuff the popups are about either. The popups are pointless, click-through damage and they serve no purpose. The laws that caused them to exist are equally pointless. There is no measurable benefit to any of this privacy theater and no less tracking is occurring since the advent of all of these pointless popups.
Because it's not a browser permission. The browser could offer to send a "no" for you, but the site could just go on and track you anyway. It would be like having a permission dialog where clicking "no" just would ask the program kindly not to run with admin permissions.
Now, you might argue that the browser could start blocking cookies, but that would just break useful functionality (i.e. logins) without preventing the abundance of other methods of user tracking (local storage, tracking pixels, link parameters, fingerprints, ...). If you want to go down that route, the most reasonable response on clicking "no" would be to close the browser, really.
Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for tracking data in the context of the website, since it is the only context in which it can reasonably [0] handle the response. It does change the difficulty or legality of circumvention, yes, but it is a bit less security theater.
At least that's the technical reason. If we're being honest, the discussion never came up, because a) laws are bad for setting technical standards in many ways and b) most site owners prefer to build their own dark patterns to get the user to click accept anyway.
[0] Excluding heuristics, of course, which would just start a game of cat and mouse yet again and would necessarily be flawed.
I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law.
The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request.
The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking.
There's two sides for this. For one, this is the infrastructure that already exists and that is out there in the wild. If you start selling 500V electric appliances, people can of course buy transformers or the state could upgrade its grid, but in reality, changing the existing infrastructure to suddenly support something different is a huge effort. It's far easier and more economical to treat the given infrastructure as fixed and working within its bounds.
On the other hand, it usually adds a lot of needless complexity to break layers. Sometimes it is worth it (ZFS might be a good example), but usually it isn't. Imagine, for example, if Firefox needed to be patched to support SSDs or SD cards because it did some magic and accessed the HDD firmware directly - this would arguably be a bad idea.
> The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request.
Sure it does. The OS<->Browser boundary is basically about what the browser executable itself can do to the OS; the OS has no context on the finer granularity of websites. Going back to the electrical grid: My power company is worried about bringing electricity to my flat connection; turning specific appliances on or off is my part. It would be very strange if the power company would suddenly be in charge on whether my kettle specifically should have power.
> The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking.
I fully agree on that and we need more of that, but that is irrespective of how the user is asked whether he wants to accept cookies/tracking.
And this is not even just at a systems level that I think is problematic - for those working with it, it's also with what it enables and what it doesn't.
I'm not a genius but I can see many ways of solving these cookie/privacy issues and I'm sure the smart folks back at these companies (browser, ads, etc) could too, they just choose not to.
Not just "could", this was already tried: https://en.wikipedia.org/wiki/Do_Not_Track
It's still in Firefox at least, and Mixpanel does respect it (a tracking service akin to Google Analytics), but not a whole lot else.
As for privacy theatre, there are two reasons why these popups are pointless. First, it was too little and too late. If the regulations came in before tracking became pervasive, it could have been effective since people would have had the option to find similar content. Second, far too few people feel entitled and click through without really considering whether it is worth the price.
I have. I found what the cynic in me expected to find: ambiguity enough to pass a convoy of container ships. This, coupled with the certainty that there are effectively no authorities policing these claims in detail (particularly the non-FAANG sites, being far less lucrative lawsuit targets) has only further convinced me of the utter pointlessness of consent popups.
What's needed is a global setting to say no to everything.
Daniel from Croatia, perhaps could you add a checkbox (opt-in) to the extension with the text: «I declare that I don't want to be tracked and don't want to be bothered with questions about privacy.» and a link to a more detailed manifesto, if not already done?
HN would probably love this. Oh, wait...
So maybe there is some hope.
Yes, yes, I know, smaller sites will not give a fuck.
But I bet Google, FB and other ones will. Which is why they fight against this so hard. Just try enabling Do Not Track in Chrome and watch the scary dialogs you need to go through which will make regular people think it's a dangerous thing to do.
Where do the law force companies to use annoying popups? I see the annoying popups as companies doing all they can do try to make users feel it is the laws fault and not the sites fault that a site require to get consent using an annoying popup. In most of the cases the popup do nothing except of annoy the users, is often no difference in what is loaded before or after users are tricked into giving consent.
To follow the law you could only handle data directly relevant to the functionality of the site/app or you could have a place where users could select reject all or see what to allow. Allow all or see more, like for instance google is using, is not following the law
Why don't you advertise "Don't Mind Tracking" header?
You can track without setting cookies and you can set cookies without tracking.
https://ec.europa.eu/digital-single-market/en/proposal-epriv...
https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat...
> disable some cookies
No, f*k "some cookies". I block ALL cookies except for a few sites I need to log into. That means, ironically, the godawful popups can't set a cookie to remember that I don't want cookies, and they keep popping up every time I go back to that site.
The popups are a horrible experience, as are "please sign up for the newsletter" popups. I don't read any newsletters. I use uBlock Origin which gets rid of most popups, Intercom chat boxes, and other annoyances.
I do that in reverse: everybody can set all the cookies they like, but only a few sites are allowed to keep their cookies after I close the tab. I do use I Don't Care About Cookie and this combiantion makes the web much more usable in my opinion.
Legitimate interests" are supposed to be interests integral to the running of your business. Ads are the core of an ad-business. Is this a loop-hole? I don't know.
Yes, the web is more usable. But does anything anyone does actually limit the information? I don't know, maybe I'm too cynical.
If it's any consolation, a pretty significant number appear to do that even if you ARE accepting cookies.
They are still unaware. Do you honestly think anybody even reads what is on the popup? They just click accept or ok to make it go away immediately.
If you were to quickly visit a shop and an employee would follow you around with a camera, make notes, and measure your height and your shoe size while you were waiting in line to pay, would you think that was okay and a normal experience? At least with the GDPR the stalkers have to ask your consent first, although ideally they wouldn't exist at all.
It does seem like the GDPR is being exploited to manipulate how users consent in a way that benefits the website's online ad scheme more than the user's experience.
If I were drafting a GDPR, I would standardise the consent mechanism and not allow for much creativity. Ideally IMO the consent process, e.g., each pop-up, should be so predictable that consent/denial of consent could be automated. Asking users to read terms, and engage in some sort of interactive consent is not practicable. Users will just click "OK" or whatever they need to in order to make the pop-up go away. Website developers know this and it should be no surpise if they are taking advantage of that to sneek in all manner of one-sided terms.
General terms: https://www.st.com/content/st_com/en/common/privacy-portal/c...
Breakdown of cookie use: https://www.st.com/content/st_com/en/common/privacy-portal/p...
Technical opt-out measures: https://www.st.com/content/st_com/en/common/privacy-portal/p...
> It does seem like the GDPR is being exploited to manipulate how users consent in a way that benefits the website's online ad scheme more than the user's experience.
Agreed.
> If I were drafting a GDPR, I would standardise the consent mechanism and not allow for much creativity. Ideally IMO the consent process, e.g., each pop-up, should be so predictable that consent/denial of consent could be automated. Asking users to read terms, and engage in some sort of interactive consent is not practicable. Users will just click "OK" or whatever they need to in order to make the pop-up go away. Website developers know this and it should be no surpise if they are taking advantage of that to sneek in all manner of one-sided terms.
I would agree, except ... these pop-ups are visible and it is easy to verify that certain information is being presented. The failure review such information falls to the end user, even though there are legitimate reasons why they would click to make the pop-up go away (e.g. the time required to review the information). Unfortunately, it is difficult for most people to verify which cookies are being used by a particular site and it is impossible for them to verify how they are being used.
(Of course if their terms are posted somewhere else on their website they might have you there).
I agree this is the wrong way to go about the issue but it does seem to have some positive effects as well.
But even Github has misunderstood it's not about the cookies. They had an article earlier about removing the popup since they managed to do stuff without cookies. The law doesn't care about cookies, it cares about tracking and illegitimate use of personal data. If you send data to third parties or track by other means, consent is still needed.
Because the law obviously didn't help stopping companies from doing shady shit and made the user experience of the web worse?
The cookie stuff, yes, it's annoying for us end users. I get it.
But take how H&M were fined for violating the privacy of their employees. That they had to stop doing that is a Good Thing, right?
GDPR is a highly complex piece of legislation that is very hard to navigate and therefore only established companies with big bucks to spend on lawyers and extra engineering can profit from the ecosystem while everybody else is put at risk.
Complex legislation and regulations is the best way to keep monopolies in place. Same goes for the financial sector, telecoms, etc. It's nearly impossible for new players to emerge.
This complex frameworks are put it place so that big companies that do nasty things can get away with it because they will be able to demonstrate that they have complied with the regulations while emerging players will break their teeth on it.
Instead of regulating _how_ data collection and processing should be done, we should penalise _what_ is done with the data in simple clear terms, and make _people_ (CEOs, etc.) responsible not just giving fines to companies. Basically, reintroduce skin in the game.
If anything, it was the big players getting work to do. Thousands of people on mailing lists with no control of how they got there. Asked and kept insane amounts of not necessary data. Data floating in hundreds of database tables spread over various services and third party vendors and data centers with no control. Cleaning up that was a huge job.
Of course, they are unlikely to come after a startup for an infringement like that, but the point is that they could if they wanted to.
I highly doubt you as a non shady actor will be punished because of your server logs as such.
Start selling or otherwise sharing them with ad companies, directly or indirectly and you deserve and should expect a GDPR fine as soon as they can if you are in a jurisdiction where GDPR applies.
Same if you involuntary leak data because of gross negligence: passwords in cleartext, unnecessary data collected and stored and later leaked etc etc
In many cases I understand authorities will even contact companies first and try to guide them toward a compliant solution first instead of fining tjem right away.
That said I wish there were some clarifications given wrt to server logs and IP addresses; running without is in many cases gross negligence in itself.
Basic logging is first year defense against black arts curriculum.
If you were storing IP addresses to track and market to users, you need consent.
If you’re using them for logging and security purposes, I think that falls under legitimate interest.
My point is: it's really not that easy. It should be easy to get clear guidance on something straightforward like this, and not have to resort to Stack overflow answers.
Where and how was that established? There are obvious operational and security reasons why the operator of a website might reasonably log access information, and there are lawful bases for processing data under the GDPR other than having the subject's explicit consent.
I can see how it’s a though pill to swallow that that was exactly the point.
Clearly we're not going to ask for consent to track someone who is systematically probing our site for vulnerabilities, or someone who is attempting to use us to validate presumably stolen credit card details, or a group who are obviously sharing a password to gain unauthorised access in violation of our terms of service.
Also, the purpose(s) of data processing matter, not just the data itself. It's not as simple as only gathering what you need. You also have to ensure that what you gather is used appropriately, and that you have the means to respond to the various rights that subjects have by law.
Thousands of people on mailing lists with no control of how they got there.
Actually, that was one of the tricky areas when the GDPR came in, and something almost no-one got right despite good intentions. Specifically, the widely accepted best practice for managing a mailing list had long been to use double opt-in, thus verifying that the subscriber really did intend to receive the messages, and to provide a simple, automated unsubscribe facility. However, unless you had kept all the confirmation replies, under the GDPR you might not have met the required standard for evidence of each list subscriber actively opting in to receive your mails.
That led to a wave of messages being sent out to mailing lists asking subscribers to confirm they still wanted to receive the mails. This was particularly ironic because if those subscribers hadn't already intended to consent then those messages were probably themselves in violation of existing law in much of the EU even before the GDPR came in. The difference was that before, no-one was seriously worried that a legitimately operated mailing list with double opt-in was going to be targetted for business-crippling penalties, but with all the ambiguity around the GDPR and the uncertainty around how it was going to be enforced, a lot of people panicked.
[] keep me informed about products
checkbox hidden somewhere in a purchase form, often pre-checked even though that's illegal. Recently I was somehow added to the mailing list of a car dealership after getting my car checked up there, and can't even unsubscribe without creating an account on their website.
I'm sure there are some legitimate mailing lists out there, but there are so many others that are scummy and in flagrant violation of the law. It's hard to shake the feeling that making things harder for mailing lists in general is going to be a net win for consumers.
More recently, it's more about web forms and hosted services and so on, but typically you can't add subscribers on popular mailing list management services without either having the service run that kind of double opt-in check automatically or going through some kind of alternative process that involves explicitly confirming to the service that you have the required consent from somewhere else when adding the addresses directly.
There are loads of legitimate mailing lists, and the software and services running them have worked reasonably for decades, you just apparently haven't come across them. Not that I disagree with you that there are plenty of scummy ones as well, sadly.
The user experience is made shit by the companies doing shady things. If they didn't do shady shit, they wouldn't have to display any banner.
I'd rather be informed, at least I can make a decision that way.
Why shoot the messenger?
The part that is missing is making rejecting as easy as accepting. So far there are a lot of dark patterns, but there are sites that make it very clear and easy, and I appreciate it.
The law could have been much better if it simply asked browser makers to provide a single place to configure your preference, and then forced companies to abide by that setting.
The problem is that Google Analytics isn't _just_ collecting data for you, it's collecting a trove of other data that it's using to track and link users accross other websites.
Just because it's free and somewhat nice looking, doesn't mean it isn't shady shit. Maybe all you care about is counting unique visitors, but by doing that with Google Analytics, you're exposing your visitors to a complex surveillance product that collects data for its own purposes, and it sees much more than what's needed to just count unique visits.
It has a wider lifecycle: "this is YOUR data, and we collect, maintain, process, sell these data to a myriad other sources for a myriad other purposes". GA just feeds these monsters.
Most GA users just don't care about their clients/readers privacy. Or they care 'a little' but they care 'a lot more' in monetizing.
We externalize the costs, or find shady revenue streams. As long as people think "it's free therefore it is good and I like it" we are not progressing.
I would love to have a technical solution for browser-wide consent management, but it wouldn’t solve the issue of granular, informed consent for all the shady things that are possible in adtech.
Also, the law certainly doesn’t prohibit a technical solution, but that really is something that the industry should work out.
Truly open culture does not accept tracking, for example there is no way to count Linux users. And people would not be kin to those who track physical news papers.
Meanwhile I use uMatrix and uBlock Origin.
What happened was entirely predictable to anyone who understands how the market works: there were some volunteers who honored DNT while it was opt-in, but that mostly ended when one of the browsers decided to make sending DNT enabled by default.
The industry wasn't, isn't, and is never going to self-regulate itself out of a significant revenue stream. That's why we ended up with GDPR - a proper solution with legal backing - which almost works. It would be working, if EU member states were more eager to pursue violations and issue fines.
The purpose of the tracking matters, though. Truly open culture also doesn't attempt fraud, DoS attacks, data breaches, and all the other nasty things that some people who are hoping not to get caught and punished do online. Unless you can prevent all such threats, it's unreasonable to expect websites whose operators might be held responsible for the consequences not to monitor how their own systems are being used and who is using them.
The fact that a question can be phrased like this really illuminates how much society has changed in 20 years.
Not so long ago sharing data between sites was definitively shady. Then Google somehow institutionalized it, and now it is completely mainstream.
> I would think counting unique visitors is a legitimate business interest
Yes, that's not it. Identifying people are, and collecting their personal data is.
Setting a cookie is not in itself a GDPR violation. Collecting personally identifiable information is. You can collect unique visitors by setting a cookie but without collecting personally identifiable information, so no consent popup would be required for that:
1. Set a "site last visited: <date>, <serial-of-the-day>" cookie if it is not set.
2. Count hits as appropriate by examining the cookie - without collecting IP addresses.
Since no personally identifiable information is being collected with this scheme, consent is not required.
It helped immensely. I work in the financial sector in an EU country, and most institutions in my country are terrified about the GDPR.
The fact that some people will happily operate on the border or even closely beyond the border of law, applies to any other regulation as well.
Running a website without a popup is easy. Just stop any processing that is not necessary for you to provide the service.
"But I want to track what users are doing!" - Well, then you have to show them a popup about that.
The GDPR holds that data protection is a fundamental right. Consequently, the user's interests generally trump a website owner's interest.
I think most website owners don't care about that, but they do care about earning money to actually run the website.
>The GDPR holds that data protection is a fundamental right.
The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay for it or not. You cannot not show content to users who refuse to share the data. Effectively, everyone else has to subsidize them.
And that's why you have a labyrinth of pop ups - GDPR breaks the normal monetization methods of the web. Suddenly they're surprised that this led to dark patterns.
Again -- the GDPR recognizes the right to data as a a fundamental right, and thus the ability to earn money with a website comes second to user's rights.
Argumenting against this is a bit like Big Tobacco complaining that they're not allowed to sell cigarettes to children.
> The GDPR says that if the user asks to use your service then you have to offer them the service regardless whether they're willing to pay for it or not. You cannot not show content to users who refuse to share the data. Effectively, everyone else has to subsidize them.
Sure you can. All you have to do is offer two models: (a) a model where the user pays for the service, and (b) a model were the user receives the service in exchange for a agreeing to tracking etc.
In the case above, a newspaper offered access to paywalled content for a small monthly subscription fee, and readers would consume it with zero ads, zero tracking.
Alternatively, they offered access with no monetary cost, but instead in exchange for tracking.
The DPA ruled this as fair because readers had a choice, and because the paid model was reasonable for a newspaper subscription (€6/month).
The key here is that starting with alternative (a) makes it a paywalled service, which is clearly legal (think Netflix). Also offering (b) just offers another mode of payment.
You wrote earlier: "GDPR breaks the normal monetization methods of the web." Well, smoking regulation broke (some of the) monetization methods of Big Tobacco.
Arguing against the GDPR here is besides the point. The GDPR is not an end, it is a means. The end is recognition of right to data as a fundamental right.
Re-writing your statement in light of this, the point becomes "Data as a fundamental right breaks the normal monetization methods of the web." Opinions will differ here.
You say normal. Others say pernicious.
And if every alternative charges money, then that means you're shutting out a large portion of people. For example, I can't pay for anything online right now. It doesn't matter whether it costs $5 or just a single cent - I have no way to pay. It'll be sorted eventually, but even then paying for anything online for me will be a 5-10 minute process. Not exactly something I'm willing to do for almost anything. And a lot of people in the world are in a similar position - credit cards aren't as accessible in most of the world compared to the US. If services like paypal don't accept bank transfers from your country, then they don't help either.
https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
This what I have been explained. Any sort data sharing, like introducing Google Analytics in your website and you need a disclaimer.
Because it's clearly not easy to run a service without these types of practices. If you want to get ad revenue then you have to have them.
Even the EU commission's own website has the pop up: https://europa.eu/
And they don't even have to worry about paying the bills for the website.
Also what is your source that the commission isn't paying for their website? I don't mean to say that it's a relevant point, but I'm curious where you got this information. Does the commission not budget for their own hosting?
What problem do you believe is being solved by the popup? The idea that it will get consumers to boycott garbage websites and internet services (read: the vast majority) is wishful thinking. Consumers do not care in the slightest and just want to be cool and fit in and use the same thing as everyone else. Anyone who is tunnel visioned on web privacy (which doesn't and will never exist, due to how webcrap is built) will go to the bottom of the page and click "privacy policy". Websites shouldn't have means of collecting data about you at all in the first place. Banking and shopping should be done with software instead of insecure web scripts. Yes smaller steps can be taken but there is such thing as too small.
EDIT: Oh I think you're saying that the popup is indeed redundant because your website shouldn't have it because if it does your website is crap. I agree, but I don't agree with the law since I still use those websites regarldess of how trash they are and all the popup does is make it more annoying.
Why should the EU decide that it's a bad thing for me and I need to be asked about? I hate the banners much more than the tracking.
What do you mean with personal data anyway? In GDPR this means:
a name and surname;
a home address;
an email address such as name.surname@company.com; (NOT info@company.com!!!!)
an identification card number;
location data (for example the location data function on a mobile phone);
an Internet Protocol (IP) address;
a cookie ID;
the advertising identifier of your phone;
data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.
For the IP address, I never count on the fact that they don't track it. Who does??? Same for location. Why would you think a website wouldn't be able to get your location, unless you take some real measure to prevent it.
Some consent popup isn't going to convince me that they will or will not track it. I don't give a shit, I expect EVERY website to track this.
For the rest, well, if I provide my info to the website, I'm guessing that they can also identify me with it, no? If I don't want the website to know it, I just don't provide it.
Same thing here: I really don't care what their consent message says.
So long story short: If I want to keep some privacy, I will definitely not rely on the "word of the website" that they will handle it any way they say. If I want privacy, I will take care of that myself.
And for the rest of the legal bullshit, I never read it anyway. EULA's etc.... who does?
“If you surf anonymously or if you delete cookies automatically every time you close the browser, websites will ask for that permission again and again, and it will soon become very irritating to click the same I agree buttons every day.”
The extension doesn't claim to delete cookies (and GP doesn't suggest that it does), but it's clearly targeted at people that are using technological means to deal with the problem rather than clicking "pretty please don't track me" and hoping for the best.
There's a big misunderstanding behind these "cookie" consent prompts. They are actually about overall data processing consent regardless of technical means - this includes cookies but also things like browser fingerprinting, IP addresses, etc which will persist despite clearing cookies.
Using an extension that automatically grants consent and merely deletes cookies every time would give you a false sense of security if the automatically granted consent allows them to use your browser's fingerprint or IP address to track you anyway.
Many websites and data processors violate this, but since that’s the case for those sites the only winning move is not to play.
> The information we collect includes unique identifiers, browser type and settings, device type and settings, operating system, mobile network information including carrier name and phone number, and application version number. We also collect information about the interaction of your apps, browsers, and devices with our services, including IP address, crash reports, system activity, and the date, time, and referrer URL of your request. ... We may also collect information about you from trusted partners, including marketing partners who provide us with information about potential customers of our business services, and security partners who provide us with information to protect against abuse. We also receive information from advertisers to provide advertising and research services on their behalf. We use various technologies to collect and store information, including cookies, pixel tags, local storage, such as browser web storage or application data caches, databases, and server logs. ... We use the information we collect to customize our services for you, including providing recommendations, personalized content, and customized search results
Given that I'm getting the cookies whether I want them or not, and deleting them whenever my browser closes, if this extension keeps the banners off my screen it's a huge net positive from my perspective.
EDIT: browser makers are understandably cautious about it, even with a closed ecosystem it's already hard enough for them to avoid half their users getting pushed into installing dubious/malware addons within three hours of browsing, and their resources are limited. So, they default to closed-ness "for the masses", but there's a knob. I don't find this unreasonable.
I think more restrictions should be put on extensions but it's always hard to balance between accesible developers tools to people who know what they're doing and somebdoy writing down the instructions how to circumvent it to lure the user to install a malicious extension in developer mode.
1. Never seen a cookie div.
2. Never been bitten by incorrect / false-positivey / over-zealous rules.
Everything else being equal, more options is good, but I don't see any reason to switch from Easylist Cookies, which I know is well-maintained, benefits from the Easylist umbrella, and has lots of users (since it's offered by default in uBlock Origin).
So here is a proposal:
What if a user could declare her/his consent settings _before_ opening the website? There would no longer be a need for consent dialogues, right?
One way to achieve that would be to take an example from the UTM parameters. A browser/User could just use ?utm_consent=all, ?utm_consent=minimal, and ?utm_consent=deny to indicate the level of consent. Browsers could offer it as a standard setting and automatically amend it to any URL. Websites could just drop the consent dialogue whenever that UTM is set.
Standardize an extension to the Set-Cookie header for a "Purpose" field. This field if unset means the cookie is essential (local laws now still apply so if a website misrepresents a non-essential cookie as essential then that's illegal just the same way as implementing a fake cookie banner or not implementing one (if you need it) is illegal). Now in my browser I can set my cookie preferences to only store and send essential cookies.
For other tracking methods that don't use cookies there's already DNT and all that's needed is for a local law update to clarify what it means and to enforce its use.
These things would actually make sense as opposed to the current situation where the EU makes it sound like cookies are something a website forcibly stores on your computer and uses.
Of course user agent sniffing tends to cause a lot of problems, so this probably isn't a good idea.
We could stop using tracking cookies.
To work with js free sites, you can feed the same information through in a tag for the HTML.
We don't need an exemption for necessary cookies, since the only reason a site would need to set a necessary cookie is to remember the users choice, and the browser can do that better.
If the user logs in, by filling out a username and password field, a single cookie should automatically be saved.
I imagine Firefox is the best browser to get this started in. Anybody has any pointers to how to get the ball moving?
Maybe writing an extension as a proof-of-concept, then finding someone who's a member of W3C to propose it as a standard.
Here's a radical idea for a solution: pressure EU member state data protection agencies to start seriously enforcing GDPR violations. Internet is so good at amplifying messages, so why not amplify that?
GDPR is already a good solution to this problem. The only reason it works so poorly is because it's not being enforced - so most websites feel safe choosing to break the law. If there was an uptick in fines being issued against all players, big and small, the situation would change very quickly.
Come to think of it, a malicious company could probably set up their systems so they get auto-confirmed by the plugin. I'm not sure they'd be valid in that case.
Similar attacks: load the fine print via JS and stick it into an /ads/advertisement.js so adblockers will block the loading of it.
Can the company claim "we showed it to the user, if their software hides it, that's not our problem"?
Is their (or their plugin's, acting as their agent) consent valid because they know about the general framework (tracking cookies)? And would that consent depend on the overlay not including any surprising terms (e.g. "you're also buying a washing machine", "you're also allowing us to mine crypto in your browser" or "we may also use browser finger printing, not just cookies")?
It wouldn’t be so necessary if all those websites asking for my permission to use cookies would actually use a cookie to store that permission / preference so they don’t ask again every damn time. This is really the reason why I use this extension - I didn’t mind so much reviewing the permissions once for each site, but having to do it constantly really became too much after a certain point.
The only downside is that some sites are broken by this extension. Sometimes you end up on a site where the page is disabled and you cannot click on things. Usually turning off the extension and clicking manually the banner fixes the issue.
So here are the three extensions I can’t live without:
- ublock origin
- I don’t care about cookies
- cookie auto delete.
They make the internet usable.
It costs a bit of money, but when asked, an invoice is provided so you can deduct it as a business, or ask your boss to pay.
I don't believe this to be true. My CS1 browser fingerprinting[1] results shows that Internet Explorer and Chromium (Chrome etc.) are trackable with fingerprinting but Firefox (at least for me) is not, neither on desktop or mobile. Of course they might have found something the researchers have not.
I still think it is easy for a malicious site to make both the yes and no button install X malware when you click it. I don’t know if that fear is valid but as a Windows 95 and 98 ptsd person we were trained don’t click and agree to anything.
What's needed is better default protection by the law to stop companies collecting and using data.
It seems more useful to write my own Greasemonkey script, instead. At least when I encounter a site like this, which I couldn't think of.
The new E-Privacy Directive (if it doesn't get watered down) might help with the cookie wall problem.
""" Cookies and local storage serve different purposes. Cookies are primarily for reading server-side, local storage can only be read by the client-side. So the question is, in your app, who needs this data — the client or the server?
If it's your client (your JavaScript), then by all means switch. You're wasting bandwidth by sending all the data in each HTTP header.
If it's your server, local storage isn't so useful because you'd have to forward the data along somehow (with Ajax or hidden form fields or something). This might be okay if the server only needs a small subset of the total data for each request. """
So I guess server-side no-JS applications are going to be caught in this crossfire?
[1] https://stackoverflow.com/questions/3220660/local-storage-vs...
GET /user/#{localStorage.id}
GET /user
Cookie: id=#{Cookie.id}
>So I guess server-side no-JS applications are going to be caught in this crossfire?
No, as nicbou said, the "we use cookies" popup seems to be only required for tracking/advertising cookies.
(Yes, I really dislike how the "privacy" warriors are dragging everyone into their pointless crusades.)
[1]: https://web.archive.org/web/20170831060807/https://addons.mo...