Tracking by default is not an acceptable solution, so I would say respecting the Do-Not-Track header must be mandatory and enforced by laws and percentage of global revenue fines.
Browser-level permissions are about what the browser is sharing with the website, which is a different thing. For one, the browser sharing information with the website isn’t a blanket permission legally for the website to do anything with that information it likes.
Don’t track me means don’t track me, period.
Asking if you could track me etc. regardless is against the spirit of it and simply user hostile.
Users often want some level of tracking, like not having to log in to services they use across sites each time.
Digital stalking under the disguise of essential functions or calling it just tracking doesn’t do any good.
Some websites even purposely break their functionality when 3rd party cookies are disabled.
So, no, do-not-track is an order, do not stalk me, period.
That's functional, and doesn't need additional consent. The consent for that is given by pressing the login button.
You can login and buy things. But how do you choose whether the shop can kleep track of what you have bought to suggest rebuying or for you to keep a shoopping list. Requestion those is more than login.
> track of what you have bought to suggest rebuying
You know what you sold, no need to track user behaviour.
The level of tracking is insane and would never happen in real life, and companies would be fined to oblivion had they tried, if not forced to close by an angry mob of people.
We really need to crack down on stalking-but-automated.
Which is why this is also illegal in the same jurisdiction.
If I buy baby food at Price Chopper, they might send me an email offering me discounts on diapers, but at least I (probably!) won't also get shown such ads literally everywhere I go on the web.
So many things are like that now. Like Roku sticks and TVs are subsidized by selling user data. You want to make a Roku competitor that doesn’t spy? Your product will struggle to get on shelves and to stay there, in part because the price for your product will be higher even if you get just as good a price on your components as they do, because you’d have to price them at-cost to match Roku’s pricing. Meanwhile 99% of people looking at the products don’t realize that one’s cheaper than the other because it’s going to spy on them and sell the data.
And this, plus the fact that it's so abstract and opaque what the negative consequences of that spying are, is a huge part of the problem with all of it.
We need better regulations on this, but sadly, even before the recent fascist takeover, the regulators have been largely asleep at the wheel for decades.
But hey, when the regulators are lawyers who have no idea what cookies and browser are, we get consent forms on every domain visit.
That websites track you and then sell that data has nothing to do with how long your browser stores cookies. Cookies are just one of many, many ways that websites do tracking.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
Yes US sites will be doing that
> when the regulators are lawyers who have no idea what cookies and browser are, we get consent forms on every domain visit.
In this case the regulators have considered the problem and implemented the law independent of the used technology. The software developers/companies were the clueless/malicious ones here.
It's like saying having a secure OS/browser would deprive malware authors of revenue, and thus vulnerabilities should be preserved unless the user explicitly opts into patching them.
This combined with governments ignoring it, and actively enforcing GPC... it's questionable whether compliance is necessary (I still suggest treating it the same as a GPC signal).
But future work and effort should be put towards the GPC signal.
An approach like this seems ideal to me, the problem is that it's only natively supported in Firefox. Our instructions for Chrome and Edge are basically "install Privacy Badger."
And Safari is the WORST, which as an Apple customer it pains me to say. Not only does the browser not support it, there are ZERO Safari browser extensions, NONE, on ANY platform (mac/iphone/ipad), that you can install that will send a simple GPC signal with the HTTP headers. There is a paid Safari extension on iOS called ChangeTheHeaders that you can configure to send a GPC signal, but come on, you can't ask normal people to buy an app and manually enter a specific HTTP header. (ChangeTheHeaders is made by Jeff Johnson, the same dev as StopTheMadness. I asked him whether he'd consider adding user-friendly GPC signals to that (or any other) plugin and he said it would just be "duplicating functionality" :-/ )
California's "Opt Me Out Act" (AB 566) requires that by January 1, 2027, internet browsers must provide a built-in, easy-to-use setting that allows users to send an opt-out preference signal, such as Global Privacy Control.