Hacker News Reader

Comment by jacquesm | Hacker News Reader

Excellent news. Now let's see this taken up by the EU courts as well if they are challenged on this. But my guess is that the advertising world would rather do this on a country-by-country basis rather than to risk losing in all of the EU at once.

View on HN

I'd love if this became a EU-wide law. If you send the DNT header, then you can't get cookie consent alerts since you already do not consent being tracked.

Alternative reading: if mechanized expression of consent is now possible, then if you send a different header "Tracking-OK: True" all the cookie consent banners should now disappear.

It could be a great thing. 99%+ of all people would quickly learn to opt in to tracking to get rid of the annoying popups.

Or to apt out.

That's an impossible reading, tracking requires informed consent. Blanket "do whatever" consent can never be informed.

Besides, if you gave users a free choice, as intended by the law, no one would consent to it.

Why sacrifice privacy?

I have exactly zero popups / cookie banners, and I'm in France and a French citizen (and a GPDR supported). My browser and extensions rejects all requests for consent to be tracked automatically.

We can easily get Web browsers to do that for everyone (it takes about one minute to set up manually) so that everyone could have privacy while having a seamless browsing experience. This is easily doable with the current GDPR.

Now, why would you or anyone prefer to consent to tracking instead?

What browser and extensions do you recommend?

uBlock Origin has many "Annoyances" filter lists. They work really well on desktop and on Android. I pretty much forget that cookie banners exist.

https://addons.mozilla.org/en-US/firefox/addon/istilldontcar... works fairly well

That is just an automatic opt-in to tracking, the opposite of what was asked for.

I use consent-o-matic for this purpose: https://github.com/cavi-au/Consent-O-Matic

You can actually configure each toggle yourself.

I've used that in the past. Unfortunately, it had some issues; some sites completely broke when consent-o-matic did its thing (e.g. page remained greyed-out and/or scrolling was broken from the cookie popup). Not their fault really and I respect the effort, but it made it hard to keep it enabled all the time.

Maybe I should try it out again, it has been a while...

https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies works much better, in my experience.

https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies does reject non-technical cookies – as much as it can – but https://github.com/Cookie-AutoDelete/Cookie-AutoDelete will do the rest.

Hmm, that is an interesting combination. I forgot that I had tried that in the past as well. It had its own issues, because it deletes all cookies by default. Is there any way to keep the convenience of staying logged in with that, e.g. a crowd-sourced whitelist for authentication cookies?

Firefox with strict Enhanced Tracking Protection.

uBlock Origin with all available filter lists enabled (except the one for Mobile pages, if you're on dekstop).

https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies to reject all tracking consent requests.

https://addons.mozilla.org/en-US/firefox/addon/multi-account... for subdomains you want to log into but still want to access the main and other domains without being connected. For instance, I have it set always open mail.google.com in the Work container so that I can log into Gmail but still search google.com, navigate google.com/maps (etc) outside the work account.

Then, install https://github.com/Cookie-AutoDelete/Cookie-AutoDelete and set it to delete all data from all domains expect the ones you want to stay logged into (Google for instance… but only inside the Work container mentioned above). Then, all websites data (including cookies) will be auto-deleted a few seconds after your close all tabs from that domain. You have to enable the auto-cleaning and support for containers.

You can tweak a few more things but that should be enough.

I also recommend the awesome https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clea... add-on but only for users who support some media financially. It's fine to workaround paywalls (such a bad system) but good journalists still needs to be paid somehow.

Idem with https://github.com/ajayyy/SponsorBlock

As for mobile, I use the excellent https://f-droid.org/en/packages/org.mozilla.fennec_fdroid/ on Android. You can have the above add-ons there too, but you need to use Collections for that (as explained here: https://www.androidpolice.com/install-add-on-extension-mozil...). But this won't be necessary soon https://blog.mozilla.org/addons/2023/08/10/prepare-your-fire...

By the way, Firefox will soon get rid off all cookies banner without the need for "I still don't care about cookies" add-on: https://alternativeto.net/news/2023/6/firefox-115-beta-relea...

By modifying the site that way you're violating its ToS and can simply be denied service, as you are neither accepting or denying the request (you can't deny it because you haven't read it).

Yeah you can claim otherwise and other people are free to just deny you service. EU still doesn't have access to Threads, right? Twitter is thinking of turning off the EU as well. That attitude is why. Trade is a two way street and constantly harassing the providers is a good way to find yourself without any services to harass anymore.

Consent is not a request where the consumer has to make a decision to accept or deny, in EU consent is an opt-in activity.

So there is a clear default state - doing nothing is the same thing as refusing a request, and refusing to even read any requests is a perfectly legitimate way of doing nothing. There is no legal or moral reason to afford the request any attention or consideration, if you're ignoring it, then you're not opting in, and the site has very clear explicit information that it doesn't have your consent.

The DNT header already has a setting for that: "DNT: 0" (as well as '1', and 'unset')

For one reason or another, the header has been deprecated for years now.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...

I don’t think there’s anything that would disallow asking the user questions. It’s rather that even if the user gives consent through a web UI, the DNT header would still continue to be sent, thus presumably immediately revoking the consent given.

I doubt that a court or regulator would see that as a revocation of consent when the consent was explicitly given by the user. DNT is a global so its continuing to be sent to the site doesn't really provide any evidence that the user means to revoke the consent that they just gave. All it really indicates is that the user doesn't want to turn off DNT globally.

Why is it always "hope in EU courts"? Is the US legal system that impotent(corrupt) that everyone has completely given up on it?

The US (outside of California) only has extremely anaemic data protection law. I don't think there's an established right to not be tracked there at all?

Why does there seem to be zero interest in changing that? All I see is hope the EU would do something on one side and mockery of China and Russia for doing exactly the same.

> and mockery of China and Russia for doing exactly the same.

Lol...

As if China and Russia care anything about privacy. They are complete panopticons. You can't compare them with the EU. Which is a democracy unlike the others.

The only reason China has this policy of storing Chinese users' data in China is so they can spy on them more easily, not because they want to give them more privacy.

The Chinese and Russians can read our news. We are blocked at reading theirs. What exactly is unclear in this situation?

I thought this was about the "our citizens data local" laws?

In regards to Chinese and Russian "news" you're not missing anything as it's just propaganda anyway :)

> We are blocked at reading theirs

Maybe in Eurostan, but not in America.

You just pretending harder. Letting them rape kids and get away with it? That's low. Every time I hear an American invoke child protection I laugh out loud remembering how the FBI executed Epstein and how protected pedophiles were in the Maxwell process.

So no, there's not less censorship in the US than in the EU. You just gave up trying to say anything meaningful.

I'm not pretending anything, jackass. Russian and Chinese state media is not blocked in America. I can read any of it whenever I want.

A few things that go wrong are definitely not the same thing as a complete lack of a free press or democracy.

> mockery of China and Russia for doing exactly the same

The only mentions of China and Russia in this thread is this post of yours. What are you referring to?

To some extent, in most fields, the US has become more a regulatory follower than a leader (the big exception would be finance; the SEC in particular is still hugely influential); it waits on, generally, the EU (or sometimes California) to do stuff, and then sometimes adopts it either de facto or de jure (for practical purposes, US auto emissions rules are dictated by California, and in practice the US gets most of the benefits of the RoHS just from it _existing_, say; California has actually adopted some of the RoHS in law).

Now that the GDPR and CCPA have existed for a while, and the kinks are getting worked out (see, for instance, the article above), that lowers the cost of adoption, and will make GDPR-type rules an easier sell for US states who want to adopt them, or the US as a whole.

Russia and China do not have GDPR-type protections (they do have some data locality rules, though for rather different reasons).

Yes. (I am not American.)

you can go only up so far the country court chain before you either lose or EU courts get involved.

If this goes to the Federal Court (BGH) in Germany they will "ask" the European Court of Justice for their interpretation of the applicable Union law (in this case the GDPR) and other national courts will take this precedent into account.

If LinkedIn does not appeal they will be required to follow the ruling. Even in this case it's not uncommon that national courts will look across the border.

Well, this is an interpretation of the GDPR that already allows "technical means" to reject tracking.

I think it will have to be challenged country by country to make them use this interpretation.

But this 100% sets a precedent for other EU countries.

Reply on news.ycombinator.com