Hacker News Reader

Comment by pmontra | Hacker News Reader

There are signs that it's getting better. I started seeing cookie dialogs with a Reject all button. Sometimes it's a big one, sometimes it's almost white on white, but it's there. Anyway the vast majority of those dialogs is still misleading. The usual We care about your privacy, accept all, settings thing.

View on HN

The malicious actors moved everything to "Legitimate Interest", which needs to be toggled off manually for each provider and very well hidden.

That's still not compliant so this problem should be resolved eventually.

"Better" would mean not seeing cookie dialogs at all.

The EU's ePrivacy Regulation[1] has (or had - it seems to fluctuate) a goal to move cookie consent into the user's browser settings.

There has (perhaps predictably) been significant lobbying against that by entrenched industry players, so we'll see what emerges as a result.

(I have to admit I'm not up-to-date on the latest happenings regarding this regulation)

[1] - https://en.wikipedia.org/wiki/EPrivacy_Regulation

I meant not bothering with it at all. I, and many others, don't care about cookie tracking. These "cookie warnings" waste users' time, and, to a lesser extent, developer time (but at least we get paid to implement pointless stuff.) Every time I see one of those pop ups, it raises my blood pressure.

Sorry, I was unclear: that's what I meant, too.

You would find cookie consent options in your browser settings (for example, near "Privacy Settings"), and you would configure your rules there (with sensible defaults).

You shouldn't see any cookie consent pop-ups while browsing the web, as a result of that -- your browser would communicate your preferences for you.

As I said though: I'm unclear on the status of the ePrivacy Regulation.

Agreed! A working "do not track" option would be ideal for everyone... I doubt that will ever happen.

Even YouTube now has a REJECT ALL button.

Which is quite nice for folks like me, who always clear browsing data upon exit.

If you always clear browsing data on exit, then what difference does having a reject all button make?

In theory, declining data processing consent means they should not be using other kinds of tracking (that you can’t block/clear client-side) either.

This of course relies on sufficient enforcement of the regulation to act as a deterrent which is currently not the case.

Clearing browser data doesn’t help when the trackers are identifying you using fingerprinting, nor when they are associated with sources that remain or are reestablished every time, like a webmail login.

If you have a /etc/hosts file that redirects 10000 tracker domains to 0.0.0.0 then you don’t even need to clear any browsing data. Plus, you don’t see ads anymore without any browser plugins.

Until the service sends your data to the trackers server-side which is very common nowadays (in fact there are even legitimate reasons for doing it).

pi-hole is much better and easier to maintain than a per device hosts file

Sure, if your devices are always only in the same network. Or just run a script that pulls the newest version, cleans it up, and writes it to /etc/hosts. Whatever works best for your usecase.

But do you check your cookies have been wiped and not just blanked in MS Edge?

I have noticed that despite having all the settings to wipe data, not just cookies, cookies are still left.

These are my start page tabs in this order.

edge://settings/clearBrowserData tab all I have to do is click "Choose What to Clear", get the popup window, Time Range - All Time, all options ticked. Once completed but this can hang the browser for upto several minutes once done I switch to the second tab.

edge://settings/siteData tab hit refresh (F5) to see what cookies get left behind and thats when I see sometimes, cookies get left behind, usually youtube.com cookies, they will be blank but loads of youtube cookies.

edge://favorites/ tab, positioned to Favourites bar and have nothing on there because the browser pulls down site icons so you can identify people (browser fingerprinting) from the icon combination that gets pulled down.

edge://application-guard-internals/#status tab can see if its working properly, noticed when its on, youtube video's dont work its always trying to get get data, the stats for nerds show nothing comes downs or minimal 1kb amounts.

edge://policy/ tab because I like to switch these around to create a different fingerprint from the devices that are accessible.

Wasn’t there recently some ruling against the use of dark patterns in cookie banners?

The big players can afford to pay the fine, and the small ones probably won't be taken to court, so it might not have enough impact.

When a fine is issued they will also need to become compliant so it's not just a matter of paying the fine and then carrying on as usual.

However enforcement is indeed severely lacking as this article describes.

The potential fines can get pretty enormous, enough to even make the big players worried - up to 4% of the company's global annual revenue. There's a reason Amazon, Google and Facebook haven't just eaten the fines and are paying a fortune fighting tooth and nail to appeal the fines that they've been issued so far.

This seems to be a very common misconception, but the cookie consent dialogues are not part of GDPR.

https://gdpr.eu/cookies/

Cookie compliance

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

Receive users’ consent before you use any cookies except strictly necessary cookies.

Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.

Document and store consent received from users.

Allow users to access your service even if they refuse to allow the use of certain cookies

Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

Lucky for me it is "strictly necessary" that I track you. /s

Online privacy is an illusion. At the basic level, your IP is getting logged all over the place.

Cookies aren't part of the GDPR, so they must be part of the ePrivacy Directive.

Consent is part of the GDPR, but the way I've seen it operate in practice is widely out of compliance. You're supposed to ask for consent in each specific instance of data collection, not present a blanket approval, and default to "no."

https://gdpr.eu/cookies/

Cookies and the GDPR The General Data Protection Regulation (GDPR) is the most comprehensive data protection legislation that has been passed by any governing body to this point. However, throughout its’ 88 pages, it only mentions cookies directly once, in Recital 30.

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

What these two lines are stating is that cookies, insofar as they are used to identify users, qualify as personal data and are therefore subject to the GDPR. Companies do have a right to process their users’ data as long as they receive consent or if they have a legitimate interest.

They are not required for cookies, but they are required for tracking cookies. If you are only using cookies for e.g. shopping cart or CSRF protection, you don't need a consent dialog, but that is not the case for those websites showing the dialog.

Reply on news.ycombinator.com