Hacker News Reader

Comment by ivanjermakov | Hacker News Reader

Will this make annoying cookie banners go away?

We'll probably either be forced to agree to be tracked by Google's systems or forced to sign in to every page.

There's no chance that anything positive will ever happen with the web again, it has gotten worse at every step for more than a decade. Especially when Google has any involvement with it.

All the things that led to getting rid of flash player have been pretty great. CSS is pretty incredible compared to what it used to be. JavaScript is still a train wreck but web assembly holds some promise there. WebGL is also pretty great.

and all that still didn't give you the creative web that flash allowed.

I’m confused at where we jump to the conclusion that we’ll be forced to sign in to Google’s systems or sign in to every page. How specifically does that come about?

Hi. I work in web and was on the analytics team for a major Canadian based retailer.

The death of cookies is absolutely a corporate level driver for the push to authenticate.

Trackers being unable to stash long ttl cookies is being replaced by reliable ways to reidentify people... such as logging in.

But you can still store trackers right? Just not cross reference the tracking cookie with the cookie from other domains.

I can see this if you go from site X to site Y where you're logged in on both X and Y, and you can correlate (say) the email. But if you're logged into Y (the store) but not X some random referrer, how do you attribute the conversion?

You will be kindly asked to log in with Google everywhere, for your convenience and security.

No. Cookie banners cover any use of client size storage. That includes things like shopping carts and personalization (purely first party), analytics ("first party"), and ads (usually "third party").

Part of what's confusing here is that "first party" and "third party" are being used in a technical sense to mean which domain the cookies are set on. If on an example.com page JS from example.net causes a cookie to be set on example.com that's "first party", while if the cookie is set on any other domain that's "third party".

Shopping carts (and other purely-functional, essential purposes) do not require a consent popup.

Shopping carts require cookies if they go beyond what is "strictly necessary to provide a service explicitly requested by the user". This is quite a high bar, and most shopping cart implementations do not meet it. For example, if you put something in your cart on Monday but then don't purchase, it is not strictly necessary that it still be in your cart should you return on Tuesday to complete your purchase, so holding it overnight requires consent. I wrote more about this in https://www.jefftk.com/p/why-so-many-cookie-banners and the relevant guidelines are section 2.3 of https://ec.europa.eu/justice/article-29/documentation/opinio...

Thanks for the explanation - you learn something new every day.

You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”?

Yes, if you only need consent for the cart then matching the notification to the action is nice.

I don't see how this:

>> You should still be able to avoid a banner by having a footnote below the “add to cart” such as “we’ll set a cookie to remember this according to our cookie policy [link]”?

would count as consent under EU standards. I thought consent had to be indicated unambiguously. Clicking an "add to cart" button only unambiguously indicates that the user wants to add the item to their card, not that they are consenting to (or have even noticed) some footnote below the button.

I think you're taking the interpretation quite far in your post. I've seen legal department giving approval for a much less strict interpretation - basically on the level of "is this cookie realistically useful for this specific purpose". It would be useful to get some real cases that answer those questions, because on one extreme, "strictly" you don't need any local browser storage at all - the product page can contain a form to print out for a mail order and you can track your cart on paper.

Realistically speaking, nobody is getting in trouble over this, so feel free to ignore and set your shopping carts to 30 days or a year or whatever.

There are much bigger breaches of the GDPR/ePrivacy out there and entire businesses built upon them and they keep operating in total impunity.

Why would it matter if you take 1 minute or 1 day? Either way, the baseline expectation of functionality is for state to persist from one page request to the next page request, no matter how short or long that interval happens to be, and some kind of local storage (typically a cookie) facilitates that for both cases equally. Is it just to replicate the experience of that for which an online cart is a metaphor: with a physical shopping cart, a store employee will empty it out if it's abandoned overnight unless you explicitly ask them to hold it?

It matters because a browser may be shared between different users and a persistent shopping cart is a leak of private information.

Interesting. I feel like if you decide to share your OS session (and therefore your browser data which goes well beyond that cart: things like the passwords it offered to save!) all hope is already lost when it comes to isolation between users.

I don't think so - those would be first-party cookies.

Most cookies in those popups are third-party cookies, at least for websites with giant lists of third party cookies that require Consent-O-Matic to properly disable. Website relying on first-party cookies are usually rather unobtrusive,

They’re for cookies that are set in the first party context i.e. a third-party script sets a cookie on the first part origin

Safari stopped supporting third-party origins setting cookies on themselves many years ago

I meant that most sites have first-party cookies (whether or not they have third-party cookies) and you'll still need the banner for those.

No. The cookie banners have nothing to do with cookies per se, they are a consent / information popup required if companies want to store and use personal data beyond what's required to serve you with the website content (GDPR) or they want to store non-essential identifiers on your device (ePrivacy directive).

In other words, you are seeing these because marketing departments need BS metrics that measure nothing and are based on some personal data. The internet can happily exist without them as proven by Github[1].

[1] https://github.blog/2020-12-17-no-cookie-for-you/

Nope. Those are permanently part of the internet now, even if the reason for their existence goes away.

Reply on news.ycombinator.com