Hacker News Reader

Comment by wkat4242 | Hacker News Reader

> Enact a law that requires a service to respect the do not track signal from a browser (currently entirely voluntary), and not store any tracking cookies, clear gifs or other trackers – and require that a site not “discriminate” against users who elect no tracking – basically – provide all functions to users whether they consent or do not consent.

This is indeed the obvious solution. I don't understand why the EU didn't mandate the do not track flag to be obeyed. I know some browsers already removed it but that was because nobody bothered to obey it. As soon as it can be mandated it will be useful and come back quickly.

Also, there was criticism from the advertising industry that the do not track was on by default but that's how tracking should work in the EU anyway: opt in.

By not doing this the EU keeps getting flak for the many cookie walls.

View on HN

That there is no such mechanism can be explained pretty well with this extreme scenario:

- Browsers would come with the no tracking signal enabled by default (why wouldn't they?) so that tracking would become opt-in.

- Nobody chooses to be tracked.

- The whole industry built on tracking users collapses, namely advertisement

- Web sites who based their business model on advertisement go under

Because of this I bet that the industry is lobbying extremely hard for solutions that are maximally useless and inconvenient for the user. Unless the user "chooses" to be tracked of course.

In that vein, another proposal for stemming the flood of cookie consent banners comes from the German government and outlines a multi vendor strategy with very little technical guidance for centralized consent management systems:

https://www.heise.de/en/news/Consent-management-German-gover...

> - Browsers would come with the no tracking signal enabled by default (why wouldn't they?) so that tracking would become opt-in.

> - Nobody chooses to be tracked.

> - The whole industry built on tracking users collapses, namely advertisement

> - Web sites who based their business model on advertisement go under

This seems like the perfect outcome to me, but I doubt we'll be this lucky

Maybe I'm soft, but I always ad block and yet I don't think millions of people losing their jobs, and the resultant economic depression causing millions of other people to go hungry/homeless is a perfect outcome.

Well those people could go do something constructive for humanity :) You're acting as if there won't be anything to replace it.

it's like when we "found out" leaded gasoline is bad for every living being on the planet. the whole automotive industry and its associates really didn't want to change, but at the end of the day life goes on. maybe one day we'll be able to have an internet that is not financed by mass surveillance enabled psychological abuse.

Well yes but the websites will find suppliers of untracked (context sensitive e.g. car ads on a website about cars) ads, which will become more valuable since they no longer have to compete with tracked ads.

Companies like Google and Meta would lose their huge moat because they're the only ones with the kind of pervasive tracking network that make tracked ads viable. They no longer have a big advantage over smaller ad players. And them losing their huge market position isn't a bad thing IMO.

I don't think ads would disappear, they would just become untracked. Neither would websites. They will find a way.

> I don't understand why the EU didn't mandate the do not track flag to be obeyed.

1. Because the implementation is simply left open?

2. Because it's nearly impossible to verify?

The implementation in technical terms is left open yes, but they could have added a clause that settings like this (and not necessarily specifically this alone) must be respected if set. And in that case no other questions may be asked because the preference is already given. In that case the EU would have done themselves a huge favour because now they get blamed by everyone for the cookiewalls. Even though this was never the intention of the law.

What do you mean verify? If it's set then it's set. It gets automatically injected with every web request. It's not possible to make sure the user manually set the flag or if it was default, no. But in the EU the law says that tracking must be opt-in so this is perfectly good behaviour in line with the law.

How are cookie banners any better in regards to 2? Not sure what you mean by 1.

Point 1 means that e.g. the GDPR doesn't mandate a specific implementation. It describes the outcome, which is quite reasonable.

Point 2: you can't check/verify if parties, especially those outside the jurisdiction of the EU, really honor things like the 'don't track' flag.

It's unfortunate that so many companies decide to implement the requirements in the laziest and sleaziest possible ways.

> I don't understand why the EU didn't mandate the do not track flag to be obeyed.

GDPR is a general regulation. It doesn't concern itself with browsers, or cookies. It's on industry to come up with a solution for specific technologies.

Oh, and for browsers they did. It's called the "Do Not Track" header, and the industry immediately sed it to fingerprint and track users.

> By not doing this the EU keeps getting flak for the many cookie walls.

No. It's the industry winning the PR wall. The EU never mandated the cookie walls. It's the industry's calculated malicious compliance.

Well, in the end the industry might end up with EU strictly regulating every single technical aspect of this, but then the industry will cry about government overreach or something.

> Oh, and for browsers they did. It's called the "Do Not Track" header, and the industry immediately sed it to fingerprint and track users.

They do this anyway. They should have mandated this be honoured (or any other type of tech). If that were the case the browsers would have brought it back in short order.

> The EU never mandated the cookie walls. It's the industry's calculated malicious compliance.

Exactly. And this is their fault for not regulating this properly.

> They should have mandated this be honoured (or any other type of tech)

GDPR mandates honoring user consent.

It's a general data protection regulation. It doesn't talk about specific technologies.

> this is their fault for not regulating this properly.

What "this". Should there be a separate law for browsers? And a separate law for mobile apps? And a separate law for desktop apps? And a separate law for offline businesses? And...

Or should we blame the people and industries who couldn't care less about user privacy?

Reply on news.ycombinator.com