Hacker News Reader

Comment by drdaeman | Hacker News Reader

I still don't understand why this is a website thing and not an user-agent^W^W webbrowser thing.

EU could have requested browser vendors to implement a mechanism to accept or reject cookies. We wouldn't have those oddly designed (and infrequently infested with dark patterns in attempt to sway users towards accepting everything) bars and popups, and it would've been 100% reliable (and even the reject decision would be remembered correctly) instead of hoping that website actually respects the choice instead of having a banner that does absolutely nothing.

View on HN

Because it's impossible for browsers to know which cookies are necessary for functionality, and which are for tracking.

That doesn't seem like a big issue. Have browsers refuse all cookies by default, and let the server send headers that say "please allow these cookies, they're actually necessary". Browsers can either trust that list, or present it to the user and let them decide.

> Browsers can either trust that list, or present it to the user and let them decide.

This is literally the current system.

By that I mean that this page would also list a "RequiredForBasicFunctionality=true" syntax:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

Or maybe a "Role=Required", "Role=Advertising" sort of thing.

I don't see any sort of equivalent of that now.

Yeah, I know what you meant. And every site will list all cookies as necessary. So then you need to pass a law that says sites need to be honest about which are necessary and which aren’t…because browsers can’t actually determine this.

And this is what we have today.

Right, the crucial part is legislation. The context is that the original comment said "EU could have requested browser vendors to implement a mechanism to accept or reject cookies".

What we're missing today is:

- An automated way of having browsers know what cookies are used for (What I'm suggesting is quite easy), and

- Legislation to prevent companies fron lying (What the general context is about)

That would be the general fix for the entire situation.

No, we’re only missing this browser stuff you’re talking about. But again if you’re going to legislate this and then trust companies to follow, it’s just easier to have them implement.

You know thats the funny thing - actually this would be pretty close on how one could do it right now. Nobody actually forces sites to show a big cookie banner, they choose to do it. The user could have a small button on the side to open a dialog and to activate more cookies than just the necessary ones if one really wants to (I think).

It's of course not how you describe it on a technical level but from a UX standpoint.

Not really, as the webserver can just label the cookies that are purely functional as such.

Because it isn't only about cookies, it's about tracking in general.

True. Everyone (myself included) calls this a "cookie popup", but it's about tracking. "Do not track" was a better name, but otherwise a poor implementation.

I wondered why not make such tracking (or "cookie") prompts a part of webbrowser UI, standardized and sure to be compliant. With enforcement of what browser can enforce (disabling persistent storage), and leaving the rest (e.g. disabling IP-address based tracking) to the website.

One potential reason is responsibility - if the browser just doesn't implement the required UI for that, who would be at fault? Would the browser vendor be fined, and for how much?

Now it's up to those doing the tracking to tell exactly what they collect and who they share it with, and ask for permission. If they screw it up, they get fined proportionately.

Make it opt-in and it's solved. Server doesn't receive "yes you can" header because browser didn't implement it? Cool, no tracking. Or if there is tracking, website is at fault.

But it's not "opt in to tracking", it's "do you accept that we record X, Y, Z for A, B, C and share it with our partners G, F, K?". It's not a yes/no.

Pretty much the same thing. You don't send "I agree with X on A", you aren't supposed to get X on A tracking.

Only the same thing if you do not agree. You cannot consent to any tracking, the EU wants it to be explicit what you consent to ( data collected and who is it shared with).

The legislation doesn’t want to require specific technical implementations. They want to specify the legal requirements as independent as possible from whatever underlying technical mechanisms are used. That makes it more future-proof and at the same time also simpler than having to come up with a technical standard.

That is because cookies dont require any popup and legislation does not requires approval for cookies.

It muat specifically be tracking cookie. You can have language cookies and what not cookies without any consent.

> That is because cookies dont require any popup

They used to. I'm still of the opinion that anything beyond a static website should require permission prompts.

This sounds an awful lot like the Do Not Track setting in every browser.

Yes and no.

"Do Not Track" setting does not do anything but sending a header to all websites you visit. Plus, it was blamed to have an unfavorable default.

The whole popup mess those days is essentially about those facts - there are no easy per-site controls with no default state (with a possible default if user consciously and explicitly configures their system as "accept all everywhere" or "reject all everywhere" - but this can't be out-of-the-box). Cookie prompts are just like that: per-site and without a default (you have to actively make a decision every time - accept or reject).

I'm arguing that it would've been better if all those consent prompts would've been unified and a part of browser UI (rather than website UI). Because of two reasons: 1) the UI and UX would be uniform, consistent, and not prone to design whims and dark patterns; and 2) because this way browsers would be able to guarantee that the choice is partially respected by actually not accepting cookies. DNT header would be still needed to tell website to disable server-side tracking (and one has to believe that website respects it - turning this into a legal matter), but the whole design is different.

(Just not like that annoying geolocation or camera popup prompts lol. A bar on top of the webpage would've been a sane option, I guess.)

Since the law requires it to be opt-in, having Do Not Track be the automated default without any prompts is not problematic but the whole point of the thing.

I don't get what you're arguing for.

The default state should be DNT. Actually, using cookies for tracking, or any kind of fingerprinting for that matter, should be opt-in. The only reason it was opt-out is because adtech runs the web, and EU lawmakers are technically illiterate and influenced by the same tech giants they're supposed to regulate.

So there are two things here: making a browser setting opt-in, and making it actually enforceable. The DNT header was a step in the right direction that got swallowed by corporate influence.

I wouldn't trust Google with something like this. They might just implement it in an almost-correct but useless way in Chrome and use their leverage and lawyers to stall for as long as possible.

sofixa's point this isn't really about "cookies" aside, why should the state legislate a mostly-well-behaved actor have to do additional work to deal with bad actors, instead of (at least trying to) addressing the bad actors directly?

HN already whines about how hard GDPR is to comply with, can you imagine how bizarro it would be if the EU regulators were chasing after Firefox and not Facebook?

> why should the state legislate a mostly-well-behaved actor have to do additional work to deal with bad actors

This is pretty much just how regulated industries work. One jerk does something shady or dangerous and then everyone else has to do extra paperwork and inspections in order to prove they aren't doing shady or dangerous things too. It isn't the regulator's fault; it's the jerk's fault.

Right, which is why all other data processors now bear some responsibility. They done goofed the whole industry, and need to pay for it.

But leaving data processors alone and going after browsers would be a big mistake, despite the veneer of some technical appeal.

Reply on news.ycombinator.com