Hacker News Reader

Comment by benrutter | Hacker News Reader

Given browser headers have existed for a long time, does anyone know why there isn't some protocol of your browser saying "give me all the cookies", "give me only essential cookies" or "give me all cookies except trackibgbones" etc? Instead if tedious and manual banners on every website?

I get why companies might not want this (less cookie acceptance) but they didn't want cookies to require consent either and the EU enforced that. How come no move to require support for a protocol like this?

View on HN

See https://en.wikipedia.org/wiki/Do_Not_Track, though this wasn't part of any regulations.

Furthermore, despite Do Not Track being an obvious and strong indication of user intent, website owners want to hassle you anyway on the off chance you fallaciously "consent" from fatigue/accident/coercion/etc. It's like those business bros that just keep pushing after you say no (respecting boundaries is for suckers, amirite), but since it's in the automated digital world think of it as yet another "dark pattern" if you must. Every cookie banner is essentially the site giving a giant middle finger to the user, but the surveillance industry has been adept at getting users to uncritically attribute them to the existence of privacy regulation rather than their own shitty behaviors. Part of which is this continued myopic focus on "cookies" when modern privacy regulation functions independent of the specific tracking mechanisms.

The successor to Do Not Track is the Global Privacy Control, which companies are required to respect in several states, including California and Colorado. Support for GPC is already built into Firefox and Brave, but must be enabled in the privacy settings. Users of other browsers can get the benefits of the GPC opt-out using third party extensions like EFF's Privacy Badger.

See: https://globalprivacycontrol.org/

Keep in mind that these aren't really "cookie banners", they are data processing consent forms. They ask for your consent for way more than just cookies - things like browser fingerprinting, IP address tracking, etc.

Browsers auto-deleting (or rather not storing) cookies doesn't do anything to address the other stuff.

You can't keep companies from spying on you by asking them to "pretty please stop". DNT had the same problem.

The banners aren't even the real problem here, it's the surveillance of users.

We either create strong regulations with teeth and enforcement that make it prohibitively costly for companies to spy on people, or we're left with a technological game of cat and mouse where users have to protect themselves as well as they can by not trusting adversarial companies to play nice and limiting what data they make available in the first place. I'd prefer a mix of both.

Because the banners were not necessary (companies could just, you know, not set all those tracking cookies!)

They were a petulant response to EU legislation, like a little child told to clean his room who goes around stomping their feet, sighting very loudly, slamming drawers, and doing the bare minimum they think will satisfy what they were told to do (ie everything just gets shoved into closet shelves and drawers) etc.

The point of the banners are to annoy the shit out of everyone in hopes that we'll pressure elected officials to pass some legislation they write up that undoes the privacy protections.

"See? See what that legislation your silly elected officials made us do? Isn't it annoying? We told you...but we wrote up some new legislation, you should tell them to pass it."

The nice side benefit is that they're extra annoying to people who have cookies blocked entirely, or dumping cookies after each browser quit, etc.

The point of the banners are to annoy the shit out of everyone in hopes that we'll pressure elected officials to pass some legislation they write up that undoes the privacy protections.

So it's a calculated response, not a tantrum.

Now, what about our beloved leaders? They enact legislation that can't be enforced. I was able to refuse cookies or auto-delete all the cookies when closing a session, so I didn't give a fuck. Now I'm forced to deal with this nonsense. So this law is worse than useless for me, it's actively damaging.

You're not judged on your intentions, but on your results. And the worst thing is they're not going to relent.

This protocol is not needed. The browser can discard third party cookies, I configured it to do so for years (but more recently switched back to an ad-blocker instead, blacklist also works fine in practice). Most things will work just like you expect, a few website sign-in flows will break ... honestly a better outcome than obnoxious cookie banners and popups on every website though.

Cats of the the bag, unfortunately. Can websites detect that setting to avoid popping a redundant cookie banner?

It is unlikely that anyone wants to implement these if it reduces tracking overall, as you said. It needs regulation and I would like it.

You don’t need consent for cookies if the company collects only data it is allowed to. The banners are visible notification that they want to collect more than they need to.

For the most part even that isn't even required. If a server sends your browser a cookie it's under no obligation to pass it back in the next request. I suppose you could argue that's a bit all or nothing and separating out essential vs everything else is potentially useful.

Gonna arguably talk out of my ass here, but as far as I understand the law, it doesn't dictate implementation details. You have to get consent to keep any sort of persistent session state on your users that can be used to track their browsing behavior. It doesn't say you need to do this by offering a popup that itself stores a cookie saying you do or don't want other cookies, but you're largely guaranteed browsers will support displaying a popup banner. You're not guaranteed browsers will send a non-standard header. Doing this is in the scope of browser developers and the IETF, whereas GPDR is in the scope of lawmakers. One of those groups decided to act and the other did not.

There are was a standard called P3P that would allow you to specify this kind of thing. However unsurprisingly for an industry driven by surveillance economics making this kind of thing doesn’t get that much traction unless you do things like GDPR. If think I heard somewhere that there is an amendment on the way to address this kind of thing.

P3P died when Google started intentionally breaking it.

> P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&a... for more info."

https://tech.slashdot.org/story/12/02/20/2127250/microsoft-a...

https://web.archive.org/web/20120220235443/http://blogs.msdn...

Reply on news.ycombinator.com