People who press on cookie banners anything except “agree” – why do you do that? | Hacker News Reader

People who press on cookie banners anything except “agree” – why do you do that?

93 pointseimrine254 comments

I am from a generation that is familiar with banners showing dancing Flash animations from the internets of the 00s, usually some boobs and butts on the middle of the screen, and I still remember that pressing [x] or [close] could either close the banner or do it even bigger. So if the cookie banner's overlay is not hard enough, I am comfortable to read a text through the overlay, but it seems way more broken because the owners of that dancing nudes at least realized that they are disturbing people, and those in charge of the cookie banners really believe that they protect the interests of the user, so cookie banners are noticeable agressiver - nude banners never had an overlay and almost never made the content unreadable before paying attention to them.

Some websites might require you to go through the jungle of odd choices about which cookies are acceptable and which are not. It's so similar to Italian strike (aka "work-to rule"). Imagine regular people who are forced to chose between the strange and even strangier. What can they choose but "agree to everything" or look at some gray text through a gray overlay?

There are definitely people in the HN crowd who can understand the different options offered by cookie banners. I have an example of this product of thought, maybe not the best, but good enough to demonstrate what the jungle is [1], so if at least one person in the whole world uses this option - share your answers:

1. What will you do on your next visit if your browser forgets the cookie - click again, right?

2. On which websites do you use these custom cookies, maybe you know something about some special websites?

3. Do you know about some instruments like DO-NOT-TRACK but for cookie banners? Adblock or adblock-like extentions IMO miss the point of doing the conscious decision.

4. If you are such an advanced user of cookie-banners then it is natural for you to think they are somewhat useful for you - what are the advantages of this?

[1] https://www.hull.ac.uk/

View on HN

>those in charge of the cookie banners really believe that they protect the interests of the user

No, they're asking for consent to track because the EU demanded it. The easiest way to avoid having a banner on your site is to... just not have an analytics package on your site. They're aggressive because they don't want their data spigot turned off - hence the work-to-rule nonsense. You should not infer any benevolence on the part of the people implementing these banners.

My personal habit is to always click whatever option denies the most amount of tracking, mostly because I can.

well said

Do you know if it is only third-party analytics being called that requires the prompt, or is setting any cookie for the website's use only requiring permission too?

Essential cookies that are necessary for the website to run do not need a permission from the user. For example, if you want to use cookies to save a selection or a language setting, you don't need to ask for permission.

Yep - but to clarify, the cookies must really be NECESSARY - i.e. your site or app would be unusable without the feature they implement.

A cookie that saves, for instance, a preference may not be considered essential but a "Functional Cookie" that adds extra features, because your app is usable without it, and then you do need permission for it.

Well, what does unusable mean? If my app offers a feature and the cookie is necessary for it to work, then it's essential. For example, a cart feature in an ecommerce app. Could you shop without a cart? Sure, still I would consider this cookie essential.

A cart does sound essential, but I guess it's up to a judge to decide. Perhaps you should implement a cookie-less "buy now" option to avoid needing to go before a judge.

Like a session variable?

The UK implementation of ePrivacy makes this quite clear and the regulator uses this as an example [1] in their guidance.

If you are setting the cookie in direct response to a user initiated action, for functionality, that doesn't require consent.

[1] https://ico.org.uk/for-organisations/guide-to-pecr/guidance-...

IANAL, but from my understanding the GDPR itself does not make this distinction. It's okay to store things to implement functionality, like login or shopping baskets. Tracking people is not okay.

Now, there was a different directive preceeding the GDPR that tried to address the rampant abuse of cookies for tracking by regulating cookies directly. The intention of that directive was good, but the implementation really bad. I think this is where this distinction comes from. I don't think I've seen a case where someone who was not doing blatantly shady things with cookies got into trouble with that directive, though.

It doesn't have to be obnoxious either - if you have a preferences page, you could add something like "we'll save these preferences in a cookie on your computer, okay?"

Regular cookies that are required for normal operation (to remember that you are logged in etc), does not require any permissions. But they try to make it seem that way, and they bug you as much as they can to get you to just agree to all cookies. Dark patterns everywhere.

In house analytics and third party analytics are the same for the law. It’s all about user tracking.

> No, they're asking for consent to track because the EU demanded it.

Personally, I think that despite seemingly good intentions, this common practice is counterintuitively harming user-privacy and security, especially on mobile where the banners take up a large chunk of the screen.

Many normal people get something like "banner-blindness": they are so used to seeing banners requesting confirmation when they visit a website that they by default click any random buttons they see to try and hide them right away without reading what is requested.

This practice doesn't really help anybody, IMO, and should probably be handled on the browser-level if people care about it.

On mobile, I often can not even check a box. Rotation sometimes solves the problem. Firefox -noscript always does, if I care that much.

...except for sites that completely stop working when JS is disabled.

Ha! Yes, exactly... it "solves the problem", but not always as desired :^)

I don't understand why they didn't use the Do-Not-Track header. It's perfect: a client sending DNT is explicitly denying consent to any form of tracking before the page is even rendered. The presence of such a header should cause web applications to automatically delete any and all tracking javascript from their pages at the very least.

No idea why it turned into this cookie banner nonsense.

Microsoft pulled an Apple and turned DNT into opt-in. Advertisers were very clear that they would only honor DNT if it people were tracked by default.

The EU then passed a bill that said you can't collect data unless it's for one of six reasons, one of which is "user consent". This basically mandated opt-in, so everyone went super-aggressive on consent banners (which, BTW, are probably illegal).

Consent popups are legal so long as agreeing is not easier than disagreeing. Iow, you cannot make it harder to disagree - which 99.95% of them do.

Also, "consent" has a specific meaning in GDPR, see article 4(11) [0]:

> Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Which is why I suspect almost all "cookie banners" are worthless. They don't give a clear, informed consent, so the site operator is still not allowed to use the data for anything at all.

0: https://gdpr.eu/article-4-definitions/

Seems like a good case for a class action suit. Why hasn't this happened yet?

Because it would have hundreds of millions of people in it.

Revoking consent must also be as easy as consenting. Almost no site does this correctly.

> Advertisers were very clear that they would only honor DNT if it people were tracked by default.

It's ridiculous that Microsoft's response wasn't to just nuke trackers from space with some kind of adware blocker integration in Edge. This is the equivalent of a mugger saying he'll only honour your "do no mug" sign if the sign defaults to "mug me please" and has to be explicitly changed.

Microsoft is part of "them" now though given their direction since Windows 10, so I find that very unlikely.

While you are right that Microsoft loosened their stance with privacy, let's not conflate data collection purposes:

1. telemetry, for diagnostics and health monitoring

2. usage analysis, for program improvement and personalization

3. content analysis, for advertising and marketing purposes

Windows requires kind 1 and encourages kind 2*. Type 3 does not really apply, though, as I don't see Windows sniffing what I write in my text files so that I'm shown relevant ads later.

It's all explained here: https://privacy.microsoft.com/en-us/data-collection-windows

* Also note that the Customer Experience Improvement Program has been with us since Windows 7. Same thing, just not perceived as badly as Windows 10.

Without a law like the GDPR, nothing stops them from using data collected for 1) and 2) for 3). Which they will do once some PM realizes it's worth something.

(There's even 0), data collected for functional purposes like 2FA. Multiple companies have taken data straight from 0 to 3 once they see the possible revenue.)

Ad blocking is not a "nuke trackers from space" button. It's more like piloting a drone fleet to pick out and kill terrorists or insurgents in a not-so-friendly country. It requires lots of work to identify ads and create comprehensive filter rules to block ads, and periodic re-checking to make sure they haven't been broken by the advertising companies.

Note how most ad blocking tech is either community-run FOSS projects or companies with not-so-savory business practices. It's really not the kind of work that browser vendors want to do. In fact, Apple went out of their way to create an extension type purely for delivering ad block lists to Safari all the way back in iOS 9. Ad blocking is that much of a pain that even Apple was willing to farm it out to third parties years before we got proper mobile extension support.

Occasionally, browser vendors get lucky, and there's a tracker type that's "easy enough" to kill. Things like third-party cookies would be one of them - but even then this required a huge amount of testing to avoid breaking apps that relied on them for authentication.

The only reason why ad block even works is because ad companies are incredibly paranoid and don't trust each other. The standard way to do display ads is to embed each other's `<iframe>`s or JS, which gives ad blockers a nice easy target to hit. Platforms like Facebook or Twitter that are trusted to do their own ad delivery and thus don't hotlink subresources are far harder to block. They can change how ads are styled basically every hour if they wanted, which would make any kind of rule-based ad blocking ineffective. If every ad platform did this, ad block as we know it would be dead.

> Personally, I think that despite seemingly good intentions

Why do you think they have good intentions?

Many of these banners employ some pretty slick dark patterns for you to opt-in to their most critical analytics. One of my favorites is when cookie selection is more than one click from the banner, or it causes a page reload.

I've seen a few of those where you reject all and it causes a page reload, hence putting you in a loop where the banner comes back.

I think you're talking about the businesses' motivations and I'm talking about the random EU bureaucrats that imposed the regulations. Despite how skeptical I am of most government interventions, I'd tend to assign benign intentions on the bureaucrats part here as I'd have to guess that they genuinely wanted to do something good. But like any bureaucrats sitting in their ivory towers imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees that even when well-intentioned produce a mish-mash of inconsistent ideas, etc.

> imposing rules on others, the majority of their rules have unintended consequences, can be taken advantage of, are usually designed by committees

It's a valid critique, so here goes: how would you implement it to avoid those?

Make it part of the browser, not the website.

The "make it part of the browser" argument doesn't work in practice because the GDPR covers the intent and purpose of data collection/processing rather than any specific technical way of collecting or processing said data. Blocking cookies at the browser level doesn't prevent the website from using browser fingerprinting or the information you manually provided (your delivery address to make a purchase for example) in a way you didn't agree with.

I’d really like a way for my browser to tell sites my default preferences, just to reduce browser noise.

I’d probably prefer more for the advertising industry to die a fast death, but I doubt that will ever happen.

The rules are actually fairly sensible: the fact that the banners are deliberately confusing is actually illegal. The issue is that national agencies who enforce the rules (because EU rules are implemented via national laws) aren't enforcing the rules properly.

I agree there is a greater chance they're more stupid than a brick than they're malicious but I wouldn't exclude the idea that internet gatekeeper like Facebook and Google are bribing them to create extra barrier for newcomers to have independent websites.

The net result of VATMOSS, GDPR and cookie banners was that a ton of small businesses decided not to bother with a website and moved to being FB only or Amazon only.

It's a modern variant of the "this site is unsafe, continue using" click through that browsers gave for incorrectly configured SSL before the major browser vendors converged on the conclusion that they should make it actively hard to pass through insufficiently-secured SSL configuration because users would just click okay on the spooky dialog.

and should probably be handled on the browser-level if people care about it.

Some of the original Chrome browser team have followed this line of thought:

https://neeva.com/blog/introducing-cookie-cutter-by-neeva-a-...

>No, they're asking for consent to track because the EU demanded it.

Given that you can completely block cookies and other tracking in the browser, why on earth did they bother? I despise bureaucrats writing laws when they don't understand technology.

On other hand there could be an extension that sends tracking history and everything else to everyone. If you really want to share that information.

Because cookies are useful functionality that should be used in our best interests, not to pad some corporation's bottom line via surveillance capitalism. We shouldn't have to block cookies or anything, they're the ones who have to stop creating software that is essentially malware.

I despise engineers writing code when they don't understand laws.

Yes, we can play the tracker-removal cat-and-mouse game, but that involves a lot of time and effort, projected forever. This battle is going to be won by whoever has the most time and money to waste, and, spoiler alert: it's not the adblock vendors. It's Google.

In the specific case of cookies, you need those to authenticate to web services, so you can't just block all of them. Instead you need to delicately allow or deny every cookie based on if it's purpose is holding a login token or tracking a user. In fact, sometimes it's both.

Strictly speaking, if I log into Facebook, that shouldn't be considered consent to track. But right now, that's how it works. You know all those "login with Facebook" buttons all over the web? Those give Facebook third-party tracking capability. There is no browser extension in the world that will allow you to login with Facebook without also telling Facebook what site you were logging into. You need a law to force Facebook to split-brain themselves and silo off that data from their advertising operations.

Yeah, sure. "Just don't use Login with Facebook". Except every third-party login system has this problem - and there are plenty of smaller companies that absolutely do not want to handle user credentials and require that you use a third-party login service. And given that using smaller providers are the easiest way to get your credentials stolen, it is entirely understandable and advisable that they not roll their own authentication.

Furthermore, most users are not at all aware of all the technical stuff I mentioned above - and they shouldn't have to be in order to have privacy.

Having a well-written law is a lot easier: you just tell Facebook, "no, really, if you use your login service to track people we're going to fine you". Corporations react to (sufficiently large) fines a lot more favorably than technical restrictions or circumvention. "Don't be evil" is a way bigger guarantee than "can't be evil".

Preach! What we ultimately need is just a law that says it is illegal for companies to collect or store any data for marketing purposes, tracking, or resale. No opt ins, no exceptions. Unfortunately we can't fully kill targeted or unsolicited advertising at the root because of freedom of speech issues, but we can eliminate all the data it depends on.

why do you dislike targeted advertising?

I really don't mind targeted advertising.

One the ads are more relevant.

Two because the ads are more relevant the advertiser makes far more money on them and therefore doesn't have to show you as many to fund their service.

I think it's less the targeted advertising, and more like I can't take 5 internet steps today without 40 people shouting at me to buy their diapers because my partner googled "diapers" last night.

People see "targeted advertising" as "I was thinking about buying a bike and it shows me ads for bikes", ie. it's showing me what I want to see. That is not targeted advertising. Targeted advertising is showing you what they want you to see when they want you to see it, or showing you the same products in a light that makes you more likely to buy them.

For example, showing you unlikely or imagined bike-related problems, to sell you useless protection gear or insurance after you get your bike. Showing you ads for motorcycles, because although you probably don't want one, someone who already likes bikes is more likely to buy a (more expensive) motorcycle, so that's where they'll direct their spam.

Targeted advertising is about manipulation, using knowledge of the customer to change their behavior. No one is going through those efforts to show you what you already want and save you a quick Google.

you have quite a low view of people's ability to make decisions for themselves if you think being shown ads is manipulation. And I struggle to see how targeted ads are somehow worse than the same sort of 'manipulation' inherent in using an algorithmic feed like HackerNews or Twitter. Both are exposing you to things they want you to see. Yet you don't seem to have such strong opposition to those as you do targeted ads.

> you have quite a low view of people's ability to make decisions for themselves if you think being shown ads is manipulation.

The ENTIRE POINT of an ad is manipulation. Advertisers wouldn't bother if people always ignored ads.

Generally the ads that are targetting me are unrelated to things that I want.

But also, much of ads are scams, and the targetting helps the scammers find susceptible targets

Fortunately, we have replaced the tracker removal cat and mouse game with a consent banner cat and mouse game, projected forever.

Problem solved, am I right? ;)

Well, yes, law enforcement in general is a cat-and-mouse game. That doesn't mean we shouldn't have any laws.

I 100% agree, but I feel like the proliferation of consent banners was predictable and if people didn't want it, the law should have initially accounted for it.

Assuming people would just log less was hopelessly naive (especially given that apache defaults already do enough logging to run afoul of the GDPR).

A lot of GDPR is (intentionally) misrepresented.

Apache logs for example do not run afoul of GDPR unless you:

A) process them. (Correlate them with further identification)

B) sell them.

C) do nothing to secure them.

Regardless. The law does have conditions for these cookie banners. Namely that if you do not present an easy 2 click opt out then you’re in violation. Many people are in violation in what I feel is an attempt at a sort of civil disobedience. “They can’t prosecute us if we all do it” mentality.

I'm not sure a lawyer would agree with your assessment of the Apache logs. If they aren't actively being used to maintain site health, the mere collection of private IPs is enough to make them unnecessary private information.

And that's the default for collection of Apache logs.

I guess it varies depending on the lawyer, mine agrees with my interpretation.

Law depending on the opinion of lawyers is “useful”.

If anyone wants to attempt to prosecute me for storing Apache logs then I’m happy to defend it in court. GDPR isn’t the boogeyman unless you’re selling data. I’m quite certain there are sympathetic judges to that end. Logs are necessary and even in some cases legally mandatory.

I would talk to your lawyer.

With a 20 million euro minimum fine on the table, I don't think I'll feel comfortable on this topic until either the law is clarified or someone sets precedent.

My lawyer's great, but he won't be paying the fine if he's wrong.

$20 million isn't the minimum fine. That's the maximum fine for companies with under $500 million in annual turnover.

You aren't going to get the maximum fine unless you are doing something egregious. Collecting the default Apache logs and not using them for anything malicious isn't going to get you the maximum fine or likely any fine at all.

You would be 100% in the clear on that as long as you apply a reasonable retention policy to your logs. Keeping them forever isn't reasonable. Keeping them for a year almost certainly is.

You would be 99% in the clear if you do nothing. The worst that's likely to happen is that you're forced to adopt a retention policy and delete old logs, and even that is extremely unlikely unless you are Google/Facebook scale or are doing something significantly worse than industry standards.

"Given that you can completely block cookies"

You can also hire oricate security to stop stalkers, and yet stalking is illegal

Because GDPR has nothing to do with cookies.

You can have cookies without consent.

Tracking requires consent even if it doesn't use cookies.

You can block some tracking in the browser, but server-side tracking generally can't be blocked.

GDPR cares about whether you are tracking, not about the means you use to accomplish it.

> My personal habit is to always click whatever option denies the most amount of tracking, mostly because I can.

Likewise, except:

* If for any reason I can't easily deny all the unnecessary stuff (eg. there isn't a way or they have something like the Daily Mail where to disable all the "legitimate interest" you have to click literally hundreds of individual boxes) I don't click anything and leave the site immediately.

* I don't do it because I can. I do it because by clicking OK I would be explicitly consenting to being tracked and I don't want to be tracked. The content is pretty much never worth it. ("It" being falsely telling people I'm fine with being tracked. I'm perfectly aware it will happen anyway.)

Those consent boxes are nowadays used to blanket consent to things like telemarketing. I would never tell anyone to click agree on anything they haven’t thoroughly read, except proprietary software EULAs.

At least in the EU most sites seem to automatically disable nonessential cookies if you don't click Accept. The American equivalents all force you to manually uncheck everything

> At least in the EU most sites seem to automatically disable nonessential cookies if you don't click Accept.

They have been well-advised by their lawyers. Anything else is just a bomb waiting to explode on you.

And if someone wrote a browser extension that hides those popups (or makes them scrollable instead of sticky), the user would not need to do anything to reject cookies.

Exactly. This is an absolute key point I find most people miss in these discussions.

GDPR fundamentally changes the default of whether tracking is allowed to occur or not. If a user browses the web automatically blocking (just deleting/blocking the element, not automatically clicking accept) every consent pop-up, the website is not allowed to track them nor is it allowed to block the user from using the website.

If you had such a browser extension, and if websites were actually conforming to the law, all EU users could browse the web without ever seeing any popup and without ever getting tracked.

This one: https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-a...

Works brilliantly :).

Note that sometimes that may accept cookies (not sure when it does that, but it does say it can do).

> The easiest way to avoid having a banner on your site is to... just not have an analytics package on your site.

What if there's back-end only analytics? Does that require a banner?

If you're storing personal data, you need consent. A banner would be the least intrusive way to do that. (If your backend analytics don't store a cookie and don't store IPs, you may not be storing personal data to begin with.)

No.

You only need consent if there is absolutely no reason for you to have that data. Consent is the emergency hatch, only to be used in exceptional circumstances.

"But what gives?!", I hear you think. As a law professor said (roughly): it was truly amazing to see how an entire industry colluded so swiftly and completely to undermine legislation.

> You only need consent if there is absolutely no reason for you to have that data.

Also no.

There are specific acceptable reasons to have the data. LI is a weak one and does not apply in many situations (there are a lot of balancing factors applied, including a "reasonable person" standard on the data subject). As you say, consent is a very strong one, if received it can virtually always apply. The ones in-between only apply in limited situations genuinely necessary for business (company management of employee data, addresses of customers you need to ship to) or to a small set of companies (hospital management of health data, AML/KYC for banks), and rarely to general web / app analytics.

"I would like that data to serve ads better" (or "to sell to someone who wants to serve ads better") is not "absolutely no reason", but it is also rarely one of the other reasons. And conversely, even if in some case if you have a legitimate business interest i.e. would go bankrupt without it, it is not LI in the sense of GDPR if it cannot meet other factors. The modern adtech ecosystem more or less requires "consent-strength" allowances.

> If you're storing personal data, you need consent.

Could you explain this claim? I'm seeing it more often and I wonder if there's something I'm missing.

GDPR Article 6 gives five other legal bases for processing. From my reading, consent is just another basis you can use if the others don't work.

In the context of backend analytics, it is difficult-to-impossible for any of those others to apply. The point is that FE vs. BE, cookie vs. no cookie isn’t really what matters. What data you collect and why is what matters.

My understanding; ip adresses are considered personal information. You are allowed to store them in your log for security purposes, without consent (legitimate interest). But if you use that log for analytics, you need consent.

Are you sure about this? Parsing the logs stored for legitimate interest and then aggregating from that data for another purpose without storing PII seems to me like fair game.

You can't process personal data "for legitimate interest" per se. This is the biggest lie the adtech industry keeps telling themselves. The LI exception is that you can process personal data to do X with fewer restrictions, if you have a legitimate interest in X. For example, all companies have a legitimate interest in certain employee data e.g. legal names / tax identification. More complex, if you run an insurance company, you have some legitimate interest in a broad swath of your customer's demographic data.

The case for legitimate interest in parsing logs is extremely weak. There are situations where you could claim it but it still must be with a clear purpose. E.g. a Spanish company considering opening a branch in France might collect IPs to make a heatmap of where its French customers are. But they would not be able to use those IPs generally, to the extent e.g. they might be expected to delete the IP and only store aggregated by department.

You also said PII, not PD - note that some PII is sensitive data, which cannot be collected under LI provisions at all.

(This is not legal advice. If you think you can collect personal data with the LI exception, godspeed and I hope you have a good lawyer.)

Keeping in mind, of course, that Apache access logging in its default configuration probably counts as "an analytics package."

If you're running a site, it's just safer to ask than to assume that you know your site is not tracking users.

At this point, I'd be happy with a service that has my browser send a "do not track" header on each request, and also open a proxy connection to a black hat server each time the page decided to make a request to a known tracking domain.

A "black hat server"?

Someone is trying to convey that a plugin should report sites that are detected ignoring DNT to ne'er'do'wells to invite horrible things to happen to them.

It's a newbie, be nice. They don't get how it works yet.

Not a newbie. Let 'em use a MiB or so from my legimate browsing session with legitimate IP to perpetrate click fraud or auction fraud or whatever.

That'll make it harder for fraud detection to work (the traffic is legitimate, organic traffic after all). If enough people do it, tracking firms that ignore DNT will have garbage datasets or worse.

I've worked on systems for detecting this sort of fraud. Systematically injecting malicious traffic into legitimate click streams would defeat most anti-abuse measures that I've seen.

You want to let people commit whatever fraud they want using your computer? Knowingly?

How will you defend yourself in court? "I didn't do it, I just let somebody else use my machine, yes I knew they were up to no good that was the point, but to my defense I was shown an ad"?

The tracking servers are using my computer without authorization. (The "do not track" header specifically told them so.)

So, their complaint is what, exactly? They tried to run unauthorized code on my machine, it noticed, and forwarded the unauthorized logic/connection/nonce/etc to a honeypot?

This isn't an actual service I plan to build. If someone else does, and prevails in court, rest assured I'll be cheering them on.

> hence the work-to-rule nonsense

It's not even work-to-rule. It's illegal if the button to refuse consent is in any way less obvious than the button to grant it, which it nearly always is.

Notably, OneTrust, which provides a lot of the banner solutions which are illegal gets it right on their own website. So they do know the rules, but they knowingly provide a solution that's illegal.

It’s an absolute pity that the legislature didn’t require : deny everything : remember my selection : if the same analytics package exists on other sites, remember my g’d selection

> 4. If you are such an advanced user of cookie-banners then it is natural for you to think they are somewhat useful for you - what are the advantages of this?

They're not useful, they're an unwanted annoyance. Nobody wants to fill out a cookie form, they want to browse the site. Delete the cookie banners and the associated tracking completely.

Figuring out whatever tortuous process any particular cookie banner uses in lieu of what should be an equally prominent "reject all" button (or a completely absent banner and no tracking) does not make me an "advanced user of cookie banners".

> 3. Do you know about some instruments like DO-NOT-TRACK but for cookie banners?

Yes, Do-Not-Track is precisely that instrument. (And occasionally, some of the cookie banners seem to notice the do-not-track and use it to pre-populate all the checkboxes to "no".) If a site receives a Do-Not-Track, it should not show a cookie banner, and should just auto-reject all tracking. (If a site doesn't receive a Do-Not-Track, it should also not show a cookie banner, and should still auto-reject all tracking.)

> Adblock or adblock-like extentions IMO miss the point of doing the conscious decision.

There shouldn't need to be a conscious decision; all of the banners and tracking should be auto-rejected.

Since you mention "delete the cookie banners and associated tracking completely" without specifying methods:

On browsers which support it, I use uMatrix and uBlock Origin, as well as the Stylus CSS manager.

uBlock Origin has an element remover that will permanently remove elements from a website. It's point-and-click, though you may need to hunt a bit to find the full element responsible for annoyances. (There's also a "zapper", which is temporary only.) I'll typically remove cookie and all other nags, as well as social "link litter", recommendations, Taboola chumboxes, and the like, if my normal adblocking hasn't already addressed these.

Under uMatrix, I'll simply globally deny cookies to the site. Since for most sites the only value I receive from cookies is to remove cookie nags ... this has zarro effect on any site functionality. (For a very small number of sites which I rely on authentication --- of which HN is a very large share --- I of course don't do this.)

Where necessary, tracking hosts / domains are blocked via a DNS-based blocklist.

DNT would of course be the proper way to achieve all of this. The advertisers and surveillance industry have chosen to ignore this. Turnabout is fair play.

Another option, and one I rely on increasingly, is to view the site via alternative intervases such as the Internet Archive or Archive.Today, outline.com, 12ft.io, etc.

On my e-ink tablet, I'll frequently save page as PDF or ePub and read that instead.

(The EInkBro "save to ePub" feature is a bit of brilliant genius, as it permits saving multiple pages to a single document or "book", and is an excellent way of organising reading for a day or week. See: https://toot.cat/@dredmorbius/107958709435468728)

TL;DR: Nuke banners, block cookies, using browser extensions, or hit the content from an alternate service.

> Since you mention "delete the cookie banners and associated tracking completely" without specifying methods

For clarity, I was suggesting that site owners eliminate the banners and associated tracking.

That said, I'd certainly second the recommendation for uBlock Origin.

I was suggesting that site owners eliminate the banners and associated tracking.

Filed under: things I'm not holding my breath for.

The more aggressive and dark-UX the banner is, the more likely I am to spend time figuring out how to reject everything or to just close the tab right away.

If it doesn't try to trick me into accepting things, I sometimes actually consider doing that.

Why don't I just accept them all? No idea. Out of spite? Principles? Because I have too much time? Because my mind is too eager to get distracted with the popup? The fact that the only reason to even show these popups is for the website to do non-essential things that aren't actually in my interest? All of the above? Use of tasteless dark UX patterns doesn't even instill trust in me that these choices are actually respected in any way, to put it lightly.

I do the same every time, except the most complex cases. Them I started to treat as paywalls -- just close the page, I wasn't so interested in this information anyway.

I do right-click -> inspect element and then delete the pop-up element in the browser source viewer thing on chrome. Sometimes I have to find where it says “overflow” and set it to “overflow: visible” or something like that.

Remarkable how often that works.

Yup, that's one of the strategies I sometimes employ as well :)

This extension: https://addons.mozilla.org/en-US/firefox/addon/hide-fixed-el... has worked wonders for me for naive stalking popups. Some sites disable scrolling until the popup has sufficiently annoyed the user into clicking "accept all", though.

There's also https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-a..., which is specifically targeting cookie banners.

I do kind of the same in Firefox with ublock origin, making it permanent. "Right click", Block Element". I also added a userContent.css file to my firefox profile, which adds the following style to every page on every website, so I don't have to deal with the overflow shite:

    html, body {
        overflow-y: initial !important;
    }

Firefox has an add-on "nuke anything" where you can just right click on anything on a page and remote it. handles these banners pretty well

If you don’t accept or decline the cookie pop up I’m pretty sure every website treats it as a “yes you can track me”.

Like those websites that have a banner stating “by using this website you agree to let us track you with cookies”

As a consumer: I hate cookie banners. Ads are a menace to society and the banners are a manifestation of a toddler fighting against the rules by being a total nuisance. When there's something I need from a site, I will always go into the "manage" route and save the disabled cookies. I also use duckduckgo's privacy browser and burn my session often.

As a provider: I don't use cookies. Here's my privacy policy: https://max.io/privacy.html

Fully agree!

Thanks for including your own privacy policy. We're starting our own effort and our top line was "we won't make data or the user the product" and were trying to structure something as simple as your policy.

Upvoted, this viewpoint seriously needs to become the norm, thank you for providing it.

why are ads a menace to society?

edit: thanks for the thoughtful response, downvoters!

normalizes expectation of others inserting ideas in ones head instead of critically assessing concepts with available observations and deriving one's own opinion for starters

why can't consumers critically assess ads the way they critically assess things like this post? what makes ads uniquely menacing?

Their sheer volume. Drive into a major city in some country where ads are entirely unregulated. There will be billboards everywhere, impossible to take it all in or critically assess it.

as opposed to the internet, where the content is bounded and manageable? I fail to see how you can square such disdain for ads while taking part in an online forum like hackernews

The voting and moderation system on HN essentially distributes the load of managing & sorting all the information across many people, so that overall the workload is manageable. Most of us wouldn't be browsing HN if it was a free-for-all unmoderated cesspool.

My head has limited capacity. I'm happy to filter out ads. Thankfully, HN doesn't need the filter.

I also think constant lies on TV is a problem. I of course believe somewhat in my own ability to filter through, but at the end of the day, it is reality-distorting when it goes on in large scale and a societal problem!

Most ads have no content that can be subjected to critical assessment. Geico's terrible comedy sketches are not designed to convince you that they have a good product – they're designed to rattle around in your mind and influence you subconsciously. To the extent that they succeed in that, they make people behave less rationally, and are of negative social utility. And if they don't succeed, then they're just a pointless drain on society's money, time, talent, and attention.

I certainly can critically assess Geico's ads - just like you did in your analysis above

So your real issue is that people are spending their time and energy on something you don't like

You can assess their comedic and social value, but you can't assess their argument about car insurance, because there isn't one. They're trying to manipulate how you feel, not convince you of some point. It's like if, rather than making an argument in this comment to convince people of my point, I just said "Lol, imagine being such a corporate beta cuck." Some not-particularly-mature people might be influenced by that statement, perhaps more than by an actual argument, but it would be an inappropriate and underhanded tactic.

Why not use cookies if they are required for functionality? No notice needed for those, too.

As others have said, I usually click "refuse" or accept the very minimum possible, if it doesn't look fishy.

If there's too much work, like I have to uncheck every one of a zillion boxes, or if there's the trustarc or what's-it-called that needs to "work on it" for 10 minutes, I just leave the site.

I do this in the hopes that someone in marketing looks at the stats of people specifically refusing, takes note, and maybe comes up with something less invasive. Or at least realizes there's a market for that.

There is one site on which I don't do this, jeuxvideo.com. It's a French video game review site. They present a choice: "accept tracking" or "pay for a subscription". I only go there once in a blue moon, so a subscription wouldn't make sense for me. Plus, their ads aren't particularly intrusive (with UBlock on, but on MS Edge - which I barely use, since it runs on my gaming PC) so I figure it's fair.

Most sites that present the cookie banned don't usually have a subscription-based alternative.

Funnily enough, "accept tracking or pay subscription" is very much illegal under GDPR. Lack of consent to tracking may not alter functionality of the site.

In other words, service providers are not allowed to discriminate against users based on their tracking preference.

Which is so messed up, since ads based off tracking pay so much more than ads with no tracking, many sites would be forced to provide content while losing money doing so.

The argument 'for' this is that people think it's better that those sites just don't exist at all, which I would hate to see. Forcing companies to lose money will just lead to the big tech companies, that can simply tank the losses, will grow even larger, now with a moat built by the EU to protect them (good luck getting started making 90% less off your no tracking ads).

We respect your privacy! Please click agree to allow us to disrespect it.

I find it worth the trouble to find some way of disagreeing, either via "reject all", or clicking through the various radio-buttons offered and hitting save. It just seems worth the effort.

While I admire the efforts to limit data collection, these privacy/cookie popups are now a plague across the internet, a 'net that had done a brilliant job of getting rid of the first wave of popups in the past that I well remember, along with the relief when they had been banished by sensible browser manufacturers.

Even better than dealing with the privacy banner, I now often just hit "Back" and don't bother reading any articles that are only offered in exchange for collecting my data. It's a good filter, and time saver.

No need to click anything nor be tracked across the web! I Don't Care About Cookies [0] combined with Cookie AutoDelete [1] will hide all cookie consent popups, deny permission/not click if possible, and auto-accept if required to use the site. IDCAC alone will hide all popups, but in cases where you must click accept to browse it will do so invisibly & the cookies will linger. CAD solves this problem by purging everything automatically (except your whitelist) when the tab is closed.

[0] https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a...

[1] https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Ive been using these two in combination for a little while and found it to be a significant improvement to my web experience. I also use the ekill[0] extension to remove annoying flashing elements or banners that wont go away.

[0] https://addons.mozilla.org/en-US/firefox/addon/ekill/

I use the I Don't Care About Cookies and Cookie AutoDelete add-ons too.

I also use Behind The Overlay Revival[0] for annoying overlays. I just have to click the toolbar button - not even aim at the elements I want to remove.

That said, ekill's grudge mode looks interesting.

And I use Unstick![1][2] which can get rid of annoying fixed headers and footers that chew into your vertical space.

[0] https://addons.mozilla.org/en-US/firefox/addon/behind-the-ov...

[1] https://addons.mozilla.org/en-US/firefox/addon/unstickall/

[2] For some reason though, I always have to click it twice to make it work.

The "privacy banners" have become a clear signal to me that the given web site is (at best) too lazy to fix their site or (at worst) deliberately hostile to my privacy. The banner's presence is an easy up-front filter: I just click away and go to a different site. I usually don't care enough about your content to go through and click off a bunch of switches. Switches that you only have to show because you won't fix your web site and remove the tracking yourself.

Imagine if the government passed a law that said restaurants had to warn you upfront that there might be poison in your food and you had to opt-out of it. I think I would just avoid restaurants with that sign altogether.

Businesses want to learn about their users in order to better serve them. however customers although they want to have their problems fixed, rarely tell the business about their problems.

Restaurants have strict rules not to serve bad food. There are however no rule against serving bad solutions.

I just avoid them altogether.

If you go to your uBlock origin plugin settings > filter lists > annoyances > checkmark "fanboy's annoyances", "adguard annoyances", and "uBlock annoyances"

Never see cookie banners again.

> If you go to your uBlock origin plugin settings > filter lists > annoyances > checkmark "fanboy's annoyances", "adguard annoyances", and "uBlock annoyances"

This ^^ hits the spot. No need to accept the dark UI patterns (illegal but everywhere) without the pain of going through the options. Works brilliantly.

> why do you do that?

To reclaim screen space. To provide a data point that I don't want to be tracked. To stop auto-playing videos that distract me.

I'm mostly mad at the dark patterns used. The ones that are accept vs decline are fine and usually I just add them to ublock if I'm going to visit that site again. An example of annoying is stack overflow. There are "essential" cookies that I have to accept. And to get there I have to navigate a few places. Luckily they aren't as aggressive about covering up the content so usually I just ignore it. Unfortunately I haven't successfully added this to unlock. And I have an automatic cookie destroyer. Tell me again why your cookies are essential and I have to accept them? (Yes I know cookies are needed to save settings, but maybe only prompt at the time I would need them, like login. I don't need cookies to just browse SO)

I still remember the day, when the browser would show you a pop-up "Allow somesite.com to set a cookie? Yes - No"...

Something like that (with a "remember this choice" checkbox) would be so much more economical, than making every single website implement it individually. When the browser does it, then websites also can't ignore it, cheat it, or use dark patterns to avoid it.

I use https://addons.mozilla.org/en-GB/firefox/addon/i-dont-care-a... with https://addons.mozilla.org/en-GB/firefox/addon/cookie-autode... to avoid seeing the banner then drop any cookies the site might have set anyway. Firefox ETP is also quite good at avoiding common trackers.

I don't remember this and probably should. Did this have a name? What browsers had this behavior?

Internet Explorer 6 (and prior versions presumably).

Netscape. Well, at least some versions of it.

In the browser settings you could switch the "accept cookies" behavior between "never" - "ask" - "always". I believe it was set to "always" by default? It's been a long time ago, so I'm bit fuzzy on the details.

Found it - it actually was an extra checkbox.

see: https://www.fabrica.cz/fabrica/img/netscape.jpg

The big misconception is that the consent forms are only about cookies. They aren't - they are about data collection and processing in general, no matter the technical means. It could be cookies, but it could be IP addresses, browser fingerprinting, or information you manually entered for a specific purpose (delivery address to receive a package) and don't want to be reused for other purposes such as marketing or tracking. None of that can be communicated at the browser level unless you want to have a gigantic spec that encodes every possible use of personal data imaginable.

You are right about consent forms - but pure cookie banners: "this site uses cookies - OK" do exist as well - or at least did exist for a time, mandated by a law predating the GDPR.

I was born in the early seventies and I don't find it much of a hassle to spend a couple of seconds looking for the deliberately-deemphasized "reject all cookies" or "reject all but essential cookies" that's usually next to the bright, shiny "accept all" button.

I also have told Safari to "prevent cross-site tracking", and have sone adblock-type stuff going on to help with that.

And yes, I will shrug and find the "reject all" button upon returning to a site if my decision hasn't been tracked because that would be stored in a cookie on another site or whatever.

There is no advantage for me. The advantage is that it's a way for sites to cram in six hundred tracking services they've added for whatever reason, and still comply with the letter of anti-tracking laws. It is annoying and every now and then I miss the days when most sites weren't full of immensely sophisticated garbageware trying to build a profile on their viewers so as to serve them advertising they're more likely to click on.

I have found an upside to the cookie banners. They make me evaluate how much I care about the content hidden behind them. Especially when there is not a "deny all" button clearly visible. A significant amount of the time, I just close the browser window and go somewhere else.

I almost always refuse to interact with the cookie banner, and continue using the site in its crippled state or leave. Even StackOverflow, I compensate by zooming out. If I really need the info and the banner is really in the way, I use element zapper. Fuck cookie banners.

I simply refuse to press "I accept" as a matter of principle. If the website doesn't have a relatively easy way to refuse all (anything that takes me more than, say, 3-4 clicks), I'll just close it.

I set Do Not Track (DNT) header on my browser. That is my answer, and any company who asks my consent for tracking cookies anyway is /already/ violating my consent by ignoring my my clear and standard communication.

Anyone who repeatedly askes for consent when boundaries have clearly been established should never be trusted.

So I ask, why would I ever accept?

To get them to stop asking is never the right answer.

> I set Do Not Track (DNT) header on my browser.

I never understood the point of that. Asking companies who want to collect your data to "pretty please don't" when there's no oversight or accountability should they decide to ignore your plea makes DNT a waste of bandwidth. It's worthless. Even the companies who would respect your choice have to track you long enough to remember that you've asked them not to track you.

Don't bother asking them to stop tracking you, don't even give them the choice. Block JS, block 3rd party cookies, block ads and trackers, delete cookies on a regular basis.

It's your assumption that I don't do anything else.

Imagine it like this: DNT is a "No Trespassing" sign.

Do no trespassing signs actually stop anyone from trespassing? No.

In this case, I use it as a tool to judge who clearly rejects my request to not be tracked, not stop them from tracking me.

If they appear to be antagonistically designed, I find myself using ublock origins lightning bolt out of frustrated spite.

This, but with every pop up.

I suspect it's not legally binding when you never clicked agree or deny as well.

I'm from a generation when gopher was still in wide use. I remember those Flash animations from the 00s. I remember being optimistic in my youth about the internet and how it would change the world. Lots of thought leaders were writing about that. The way we live might have changed, but the world view from which we operate from did not. It should have been a red flag for me that the early commercialization of the Internet characterized it as a "land grab".

I've come to the conclusion for myself that I don't like the internet as it is now. The advertising is annoying, but more importantly for me I don't like the idea of being defined by my user behavior, and getting sucked into a machine feedback loop with no real Purpose ... simply something that endlessly extracts value for no other reason than to extract value. So I find myself:

1. Repeatedly using the least amount of cookies every time I read it. When I come across papers posted here from _Nature_, I opt out of cookies. That means I do have to reselect those every time.

2. As a habit, I just do it out of all of the sites that offer this. I think part of this is that I have to pick and choose what I spend time reading

3. Yes, and there are workarounds for all of those. I also use adblock, but they are kinda like the mob and will let advertisers pay them to bypass the adblock. Sites that don't show me the content because they detect an adblock makes me think if I really want to read what is on there; if I do, I don't mind making a conscious choice to support the publication. If I am annoyed by it, I might try the Firefox Reader option. Or I don't read it.

4. It's not an advantage so much as aligning with how I have come to approach life. I've come to realize that much of our civilization is built upon Value Extraction. Whether that is for my limited time here on Earth, my focus and attention, very few businesses are built to give something back, or at least are value-adding (not "value added") -- something that contributes to and expands the capabilities and resources of the whole ecosystem beyond profitability.

> I also use adblock, but they are kinda like the mob and will let advertisers pay them to bypass the adblock.

I agree with most of your observations. Just highlighting this point to say, that is the reason I switched from adblock to ublock. They are similar, but ublock is open source and refuses to accept money to bypass their filters. https://ublockorigin.com/

> I also use adblock, but they are kinda like the mob and will let advertisers pay them to bypass the adblock.

There are blockers that don't though? Not sure why you'd pick one that does with your values. Not judging or anything, I think there's arguments to be made in both directions.

I accept all of them, and my browser is set to clear all cookies and history when I close it. I also use an ad blocker. They may track me while I'm on their site, but not before or after so I don't really care.

The GDPR covers the intent and processing of the data rather than any specific technical means - it's not limited to cookies. Please see my other comment: https://news.ycombinator.com/item?id=30964163

1. Sure. Though in my case this applies to both options, I'm not storing cookies for webpages I don't deliberately want to be remembered by.

2. If present I'll click 'Deny', but I'm not hunting it down. Blocking the prompt with an adblocker is my preferred option.

3. Cookie Autodelete is the only sensible way to manage cookies IMHO. Store cookies for webpages you trust, delete all others. Annoyingly there's no official way to tell webpages you don't care.

4. Cookie banners are entirely pointless since I'm fully in control of which cookies I am sharing.

> Cookie banners are entirely pointless since I'm fully in control of which cookies I am sharing.

I don't think the GDPR mandates cookie banners at all, but somehow I'm still subjected to them. Most of them don't (explicitly) ask to collect my data, they just ask if they can use cookies.