We tried that once before. Advertisers joined the board investigating making the "Do Not Track" header have legal weight, as an apparent sign of good faith, and then murdered it with endless bureaucracy that went nowhere.
We're trying to again with the Global Privacy Control headers [0], and I fully expect the same thing to happen again.
That's why a solution needs to be imposed on the industry. They won't agree to anything in good faith.
Tracking was imposed on end-users, not the tools/legislation that have had to emerge because of that.
somehow this particular industry can get away with standards and regulations that for any other industry would be the wildest dream of deregulatory heist
the "innovation" shtick has worn thin, its time to clean up the mess
That was exactly what they were used for.
And then DNT was used to fingerprint users :(
Apple did that with their tracking preventer and something like 96% of people left it that way.
Off would be rare, and those people would be the ones who wanted to be tracked anyways.
Yes. I should only have to say once (or better still not at all) that I don't want to be tracked, and then it would automatically apply to everything.
> regulators would have to work with the tech industry to make that happen
"work with the tech industry" sounds a bit too much like the regulators think they get what they want, but the tech industry really get what they want.
Regulators need to be able to impose a solution on an unwilling tech industry, who'll never agree to it unless forced.
> And meanwhile companies will keep inventing workarounds like FLoC to track users without cookies.
Any such workarounds need to be explicitly make illegal.
So it's sensible to allow a per-website configuration. Arguably, it would be better that this is included in the browser (like DoNotTrack was) with a configurable default (refuse all/always ask/accept all... and "always ask" ticked out of the box) and a widget showing if the website is in accept all/refuse all and allowing to change it... a bit like the uBlock extension
All browsers already have a setting whether to accept third-party cookies. It's just a matter of changing its default value.
You'd have to block requests to third parties. This is hard because it breaks most websites - all those that rely on cdns. You can wade through this with a script blocker like ublock origin and a whitelist but you don't really know what's happening unless you investigate each domain and script.
Even then you'd still be exposed to fingerprint tracking served through the original domain passing on to a third party at the back end.
Tracking isn't fixable with technological solutions alone.
It's been the default in Safari since day one.
It is necessary but insufficient, because otherwise tracking Safari users would never have been possible. Despite that WebKit has had to consistently devote engineering effort into making these privacy invasions impossible.
WebKit, and I think Firefox now?, had to do further work to isolate same domain cookies to specific contexts.
At the same time there is Chrome, aggressively pushing new features that often happen to add new tracking mechanisms.
Google and Facebook depend on invading user privacy, that is their primary source of income. If there is any way they can track you, they will use it.
The only solution is legal, coupled with actual enforcement.
No it doesn't. Such cookie popups are illegal under GDPR. What credit should EU legislation take?
EU has been too slow in hitting these sites with fines though.
https://ec.europa.eu/info/law/law-topic/data-protection_en
> This site uses cookies to offer you a better browsing experience. Find out more on how we use cookies.
> Accept all cookies
> Accept only essential cookies
https://www.europarl.europa.eu
> Dear visitor, We use analytics cookies to offer you a better browsing experience. You have the choice to refuse or accept them.
> I refuse analytics cookies
> I accept analytics cookies
https://www.echr.coe.int has a small, non-intrusive banner about at the bottom (good), but their cookie policy does say they “generate anonymous analytics such as the number of documents downloaded.” Hopefully that’s not per user — if so that’s pretty much best-practice.
But clearly there’s a lot of variation even among EU institutions in how they approach cookie prompts.
Cookie popups such as these wouldn’t be a problem if we had a handful of websites. But they’re not helpful on the modern web with tens or even hundreds of sites visited by nontechnical or simply busy / task-focused users every day.
Please have a look at the comment chain to get context about why I brought this up. The point is that the EU’s guidance around cookie popups is part of the problem today (I know they had good intentions though).
Consent != Informed Consent. The medical community is very well aware of this, it’s time tech realised it as well.
Yes. Yes, they should. No idea why you think that some EU institutions doing something incorrectly absolves everyone else.
Implicitly, I think signal11 is making this argument:
Prior assumption: You cannot read primary legislation and understand it correctly, unless you're a lawyer specialising in that area of law.
Instead, you should copy people who've probably received competent legal advice.
Observation: A great many websites, including those of EU government bodies, use cookie consent modals.
Conclusion: Cookie consent modals must be legal.
There is in fact case law which interprets the legislation and says explicit consent is required[1] but of course it doesn’t mandate modals.
However it does note[2] that
> That decision is unaffected by whether or not the *information stored or accessed on the user’s equipment is personal data*. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.
This sets a fairly high bar for getting consent for any identifier-laden cookie. So I can understand why people choose to use modals as a risk-reduction approach, and why it has become accepted practice. If you do end up in court, it’s reasonable to expect courts to consider established practice is while formulating their judgement.
However, I do fundamentally disagree with the notion that explicit consent at the time of first visit is a good model for ordinary internet users. It was a good first effort but regulators need to do better, and strengthen ways for users to effectively pre-set their consent preferences in advance, think ‘Do Not Track’ but with teeth.
[1] https://curia.europa.eu/juris/liste.jsf?num=C-673/17
[2] https://curia.europa.eu/jcms/upload/docs/application/pdf/201...
It's mostly the fault of companies trying everything possible to trick people into agreeing even if they don't want to and shifting blaimn away.
Also GDPR is not technology specific, so it doesn't matter if the company tracks you using cookies or fingerprinting. (Through there are local predcessors of GDPR which are technology specific.)
Paying 200M fines is nothing if it discourages competitors from innovating and creating the next Facebook, after all.
It's a bit like what happened with VATMOSS. It was meant to hit Amazon and force them to pay VAT in each customer's country and not just in Luxembourg - and it ended up complicating the life of small e-commerces so much that they all moved to sell on Amazon instead of running their own e-commerce.
After years of experiencing cookie popup hell, I’d say that a better way forward would be allowing users to configure their browsers to automatically communicate cookie preferences and consent, but regulators would have to work with the tech industry to make that happen.
And meanwhile companies will keep inventing workarounds like FLoC to track users without cookies.