By setting very high fines for those who don't comply?

That is like saying if we make the punishment for any crime tortorous enough we won't need law enforcement. That only answers "what the punishment will theoretically be" not "How can it be found out when it is being broken? By whom? Will we able to take action against it?".

Oh heaven help us if a trillion dollar enterprise gets a fine !!!!

I think what they mean is, how can you track which companies are not complicit, how do you organize the proof so that you can levy the fine successfully

Already done. It's up to 10% of turnover, not profits. Which the companies would happily go to court over. But how to actually prove in court that company X is tracking users if a leak doesn't occur? Subopenas? They need a court order for that. They need reasonable suspicion to get a court order.

Those issues aren’t unique to this problem. Courts already try to solve them. It’s the same as how you would find banks denying loan based on race. You find banks by complaints or wide search. You do an initial investigation from the outside with no warrant or subpoena. Like send in a white client and black client (or someone with a search history of fishing versus sewing) and see what happens. Then that’s enough to ask for all the secrets. Of course they could delete them, but that should be a big crime.

I’m not saying this is a perfect system. It’s not. But it’s an attempt the problem you describe.

Right now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.

Disqus loads a million external resources

That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?

I guess it's often much simpler and cheaper to not try to hide it.

The CNAME practice is becoming more and more common. See https://blog.apnic.net/2020/08/04/characterizing-cname-cloak... or https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... or https://www.laquadrature.net/2020/10/05/le-deguisement-des-t...

I think proxying or doing it server side only will be implemented later when these people will be forced to hide to save their shitty business model.

CNAME cloacking has gone even further, ad company now ask you to put a A/AAAA record pointing to one of their IPs as CNAME uncloaking was working pretty well.

I think the move will be for ANAME records. ANAME is not a real record (yet), but some providers are supporting them.

It is similar to a CNAME record but instead of storing the domain name you want to map to it pulls the A record and puts that IP as your A record.

Turkey successfully made US tech giants comply to Turkish law by banning purchase of ads from non compliant ones and threatening with accumulating fines and progressive bandwidth throttling.

How about we make them prove they are not tracking users instead?

How about you prove your haven't stolen my Mazda? Because I believe you did stole my Mazda and it should be on you to prove innocence.

People are all equal and should be afforded the benefit of the doubt. On the other hand, there is a massive power difference between a rich corporation and an individual. Inverting the burden of proof is warranted in such cases.

Your accusation would be very troublesome if made against individuals but for corporate lawyers its just another day at the office.

Okay then how do you prove the government hasn't stolen my Mazda? They are even more powerful than corporations.

Inverting the burden of proof is listed as a logical fallacy for a reason. It is never appropriate.

Not only is it appropriate, there are already cases where this is done. Wikipedia documents some:

https://en.wikipedia.org/wiki/Reverse_onus

There are only three countries listed there - Pakistan, Canada and the UK. That is a bit of an indication that it is a major fringe excepetions. The UK's libel laws are so infamous that many nations specifically refuse to enforce them - not a point in favor. Canada has largely scoured out the bits they inherited by thr courts and what is left is dubiously constitutional.

The income accounting in the UK and Pakistan are the closest thing to legitimate and even then self evidently regarded as extreme by their limited adoption.

How could I prove my blog doesn't track you?

Allow experts to audit your blog, including the code running on the servers. Hosts should submit to similar audits.

Never thought I would see the day when people on HN would enthusiastically support making it much more difficult for anyone to publish their stuff on the web. All while, in the same breath, clamoring for the "good old days" of the web when publishing something was as easy as just uploading a folder with your HTML/CSS to your host.

No, thank you, I don't want to go through audits and deal with bureaucracy when I just want to publish my side-project blog on the web. If you want to discourage people from building and publishing their personal projects and making them easily accessible to the public, that's how you do it.

However, I am absolutely ok with EU doing this, given they seem to be hellbent on running their local tech industry into the ground. Truly great founders from EU will either manage to make their companies succeed despite EU or eventually end up creating their companies in the US, and both of those scenarios sound like a win-win to me (from the perspective of the US; from the perspective of the EU, I guess they are doing all of this knowingly, so they get what they wanted, which would count as a win in a way too).

Well, in the good old days people didn't abuse users with unwanted tracking and fingerprinting. Pages used to be just that: files someone uploaded to the internet. People came up with tracking techniques here and there but they weren't so pervasive. Now most pages aren't pages, they're hostile applications purposefully built to extract as much value out of you as they can by any means available whether you want it to or not.

If all you did was publish an HTML+CSS page, your innocence is self-evident. Anyone can look at your page's source and confirm it. If you link to Google's javascripts though, that should put you into a completely different category of suspicion.

>If all you did was publish an HTML+CSS page, your innocence is self-evident. Anyone can look at your page's source and confirm it. If you link to Google's javascripts though, that should put you into a completely different category of suspicion.

Things change. Back in the day, HTML+CSS page was all it took. These days, wanting to know how people discover your page or how many new readers come to your blog is basics. Reliability and performance tracking is something that wasn't really a commonplace thing back then. For all of those things, you kinda do have to use JS.

The question is, do you necessarily need those features? No. Would it be nice to have? Yes. When I publish a side project, I want to make it nice and great, since I am not getting paid to do it, I am doing it out of pure enthusiasm and motivation for creating the best I can. Forcing anyone in this situation to go through audits and deal with bureaucracy just to be able to publish their personal side-project is a certain way of discouraging people from ever doing so. All you end up with is a bunch of people who are willing to jump through all these hoops because they have something monetary to gain from it or those who know how to jump around those hoops really well.

Audits. Sounds much like scientology, only at EU level.

That's presumption of guilt and then we all have a problem.