Hacker News Reader

Comment by qeternity | Hacker News Reader

Because it's impossible for browsers to know which cookies are necessary for functionality, and which are for tracking.

That doesn't seem like a big issue. Have browsers refuse all cookies by default, and let the server send headers that say "please allow these cookies, they're actually necessary". Browsers can either trust that list, or present it to the user and let them decide.

> Browsers can either trust that list, or present it to the user and let them decide.

This is literally the current system.

By that I mean that this page would also list a "RequiredForBasicFunctionality=true" syntax:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

Or maybe a "Role=Required", "Role=Advertising" sort of thing.

I don't see any sort of equivalent of that now.

Yeah, I know what you meant. And every site will list all cookies as necessary. So then you need to pass a law that says sites need to be honest about which are necessary and which aren’t…because browsers can’t actually determine this.

And this is what we have today.

Right, the crucial part is legislation. The context is that the original comment said "EU could have requested browser vendors to implement a mechanism to accept or reject cookies".

What we're missing today is:

- An automated way of having browsers know what cookies are used for (What I'm suggesting is quite easy), and

- Legislation to prevent companies fron lying (What the general context is about)

That would be the general fix for the entire situation.

No, we’re only missing this browser stuff you’re talking about. But again if you’re going to legislate this and then trust companies to follow, it’s just easier to have them implement.

You know thats the funny thing - actually this would be pretty close on how one could do it right now. Nobody actually forces sites to show a big cookie banner, they choose to do it. The user could have a small button on the side to open a dialog and to activate more cookies than just the necessary ones if one really wants to (I think).

It's of course not how you describe it on a technical level but from a UX standpoint.

Not really, as the webserver can just label the cookies that are purely functional as such.

Reply on news.ycombinator.com