They show up. I've worked on privacy legislation at the state and local level. Barely anybody calls or writes in support. That means barely anybody would turn up to a contested primary election over it, or donate to a challenger, or organise the foregoing en masse. Contrast that with bread-and-butter or activist issues, where it's immediately clear there is political capital at the very least on the board.
The problem is what I said in other comnents here. This is the fabel of sodom and gomorrah in action. We have no people with any moral compass in charge.
There is no incentive to represent the civically disengaged. Particularly on niche issues like privacy.
> We have no people with any moral compass in charge
No system works if reliant on wishing up on a star that people were better. We have a lot of problems with our republic's design. None of them can address problems people don't care to involve themselves in respect of.
The bar rises. The vote was supposed to be enough. If people call in, well, that's not enough, after all, if you really cared, you'd have written an email, or filled out the correct form in the FTC call for feedback thing, which you knew was happening because you monitor the day to day activities of the FTC, the FDA, and the sixty other agencies that might ask for your opinion on something, without which oh well they'll just do what the lobbyists tell them. Oh, you did fill the form? Well, too bad, our lobbyists tell us that you're a bot. Oh, you're not a bot? Well, if you truly cared, you'd have come to the office of such and such at so and so time. You did? Well, if you truly cared, you'd attend more city council meetings, board of education meetings, representative town halls, senate town halls. You'd have written the senator, the congressperson, the state senator, the state congressperson, the mayor, the governor, the president, the president's dog.
What's becoming clear is that the idea of representative democracy is a good one, but the various implementations throughout history have missed the mark - weirdly, inevitably, all giving way with barely a whimper to highly concentrated forms of power, since the Romans.
We should seek to develop, and teach, solutions that empower each individual to take action. This liberal (as in, liberal democracy) idea that things can only get done if you convince 1000, 10,000, 1,000,000 people to do the exact same specific action, is disempowering, disenfranchising, and leads to concentration of power in the hands of the few who can wield the capital equivalent of 1,000,000 people in the form of lobbying, disinformation campaigns, or whatever other wack shit billionaires and corporations get up to.
Direct action seems to be the way to empower people to actually get things done, and syndicalist trade unionism seems to be a good way to balance between individual engagement in the serious work of organizing society, while leveraging the good ideas of representative democracy to allow representatives to manage some of the more tedious aspects of day to day communication and organization between various groups.
I freely admit this is utopian thinking, but I sure wish our world would try more experimentation in governance and organization rather than all of us just repeatedly smacking ourselves in the faces with the baseball bat of capitalist liberal democracy and hoping maybe one time we'll come away without a bloody nose or worse.
According to whom? Nothing in the Federalist Papers or our country’s founding envisions fire-and-forget politics.
> sure wish our world would try more experimentation in governance
The correct place for this experimentation is small governments. And to my knowledge, this experimentation does happen. It just doesn’t necessarily have the effects its framers imagined. RCV didn’t break the two-party system, for example. And public-sector unions have turned into pests.
You're repeatedly misrepresenting or misunderstanding the issue. The tl'dr is that Bezos' civic engagement weighs more than my civic engagement, more than a million of me even. This is one easy way to take the casual and overly general "you're civically disengaged" victim blaming off the table.
Your elected representatives already know your interests, they were a precondition of winning the election. They don't need tens/hundreds of thousands of citizens writing them a letter every time so they are reminded of those interests. This shouldn't turn into a part time job for all citizens.
You casually handwave away the abusers' role with a simple "ah people aren't better" while in the same sentence blaming the abused for not doing enough?
Large corporations have full time lobbyists. They only have to send one "letter". You don't expect every shareholder and employee to be "engaged" just because a company's interest is in fact their interest. Your opinions will be shaped by whether you're more a shareholder or employee, or a "civically disengaged" single parent with 3 jobs.
> We have a lot of problems with our republic's design
The big one being that money is a superpower so the more one has, the more one can take. Or hang behind the predator pack and feed on the leftovers. After all a billionaire's rising tide will lift a millionaire's boat too. Jumping through mental hoops to justify the current situation by victim blaming isn't a prerequisite of this, it's a choice.
Again, I worked on these issues. Bezos and friends never showed up. Nobody showed up. This wasn’t a battle between David and Goliath, it was an empty field to which some generals showed up, looked around and then left.
> money is a superpower so the more one has, the more one can take
To a limit. The last few years have been a barn full of monied candidates being trounced by insurgents.
And again, in any case, not germane to this issue. Most people who would call in on digital privacy don’t bother because they’re lazy or think it’s useless. When they do, e.g. when the EFF mobilises, it’s a quick battle. (The problem being such mobilisation has tended to be reactionary. In part due to the other overlap between digital privacy advocates who will civically engage and libertarians. So we don’t get positive pressure to pass protections, just occasional negative pressure against legal encroachment.)
Research your state's privacy laws and submit a cool and concise complaint to your regulators, e.g. attorney general, consumer protection bureaus, public utility commissions, et cetera. These offices are understaffed and overworked--there is a good chance they haven't noticed this.
If you want to throw cash at the problem, check if Xfinity is pulling this crap in Illinois. (Or another state with a a BIPA [1].) One could argue that one's radar cross section is biometric [1]. That opens up avenues for financing litigation.
Finally, always, call your electeds. U.S. Congressmen and Senators, yes, but also your state legislators. Put it on their radars. (Most offices will put a staffer on a novel issue if more than a couple people call in about it.) If you want to supercharge this effect, find a local party organisation (e.g. such and such town or county D/R committee or club), go to their meeting and try to get it on the agenda.
[1] https://en.wikipedia.org/wiki/Biometric_Information_Privacy_...
Working on something means you put in effort, not that it's focused properly or that you even understand the real issues. At best you'll solve your problems without caring or understanding if it solves anyone else's.
> Bezos and friends never showed up.
Case in point. Bezos and friends don't need to "show up" anywhere you'd know. Their interests are implicitly considered and they're transmitted on channels you and I don't have access to. I'm talking about the general issue of asymmetric representation. This is where money matters.
> The last few years have been a barn full of monied candidates being trounced by insurgents.
You are conflating winning a popular election with leading for the people. Such statements in 2025 US are ridiculously disconnected. Almost without exception in recent history the wealthy always increased their wealth faster than the poor, and at their expense. Just over a decade ago the poorest 50% had 0.4% of the US wealth. No wealth means no power, not even personal agency, let alone in national policy. Are you telling me that finally the "insurgents" are fixing this and with their help the bottom half will start gaining the wealth and power from the super rich? Because if you aren't saying this, you aren't saying anything. The powerful will keep pushing and getting what they need, and you'll keep blaming "the lazy" that things don't change.
> Most people who would call in on digital privacy don’t bother because they’re lazy or think it’s useless.
Most people are assaulted with many, many more attacks on their rights and wellbeing. Those are more immediate concerns. Over 50% of US population just barely eeks out more that $10k in wealth. When they're drowning in debt, living from (social security) paycheck to paycheck, worried what else they'll lose next, showing up to fight for digital privacy, or almost anything that's not life and death, is the least of their concerns.
You decided to label them "lazy". Ever wondered if your work "on these issues" is tainted by this opinion, and that's why ultimately all you can achieve is only for the people who can afford it? Because you can afford it, and the lazy don't deserve it. The correlation is there.
I’ve worked on other issues that got passed into legislation. In the privacy cases, I was speaking directly to the electeds.
Nobody showed up. They were dead ends unless they could be linked to an issue people care about, e.g. abortion in blue states and Chinese espionage in red ones.
> Most people are assaulted with many, many more attacks on their rights and wellbeing. Those are more immediate concerns
People with strong views on digital privacy tend to be wealthier and better-educated than the average American. Also, the single mother of three working two jobs will show up to town halls and electeds’ field offices when it comes to issues they care about. And it’s impactful.
People do show up and civically engage. Just not on digital privacy.
They definitely understand them far more than you, who has zero experience with them and regularly makes fallacious arguments and outright incorrect claims about them.
> Their interests are implicitly considered and they're transmitted on channels you and I don't have access to.
Where, exactly?
> You are conflating winning a popular election with leading for the people.
No, you failed to actually read their comment correctly. Their comment was a refutation of your claim that "money is a superpower so the more one has, the more one can take". They were not claiming that winning an election meant leading for the people, only pointing out the evidence against your claim.
> Because if you aren't saying this, you aren't saying anything.
What does this even mean?
> you'll keep blaming "the lazy" that things don't change
Fact: active participation from voters is a necessary precondition for a democracy to survive.
> showing up to fight for digital privacy, or almost anything that's not life and death, is the least of their concerns
Yes, that's correct, but those same people don't participate on politics at all, with any of the time that they have. The middle class doesn't participate. I've literally never heard a friend or acquaintance of mine say that they've ever contacted a representative (in federal or state government) about a political issue. This factually is an issue of people being lazy and disengaged, because of the fact that people with lots of disposable time and income don't put in the effort.
> You decided to label them "lazy". Ever wondered if your work "on these issues" is tainted by this opinion
No, it's a trivial implication of the nature of democracies. If you don't get that active participation is necessary for democracies to survive, you fundamentally don't understand how democracies work.
This is also an extremely lazy cop-out (which is thematically consistent) where you're dismissing someone's opinion because they have more experience than you in that field...which is insane.
> that's why ultimately all you can achieve is only for the people who can afford it
And, again, this is factually incorrect as to the root of the problem, because the people who can afford to participate in politics (which at the very least includes the middle-class) do not.
> No wealth means no power, not even personal agency, let alone in national policy.
This is also factually incorrect. The eligibility to vote has zero requirements as to income or wealth. Bezos gets the exact same number of votes as I do, despite having orders of magnitude more wealth. And guess how our representatives get elected?
You should really consider listening to someone who has actual experience in the relevant field rather than spewing fallacies and factual inaccuracies.
https://theonion.com/american-people-hire-high-powered-lobby...
THATS LITERALLY THE JOB.
You are literally arguing that if I got a job at a bank and started stealing the deposits it would be ok because I had no incentive not to.
Actually now that I think about it you are also reinforcing my point. Sodom and Gomorrah. You yourself have such poor moral compass that when another person acts maliciously you give them a pass because of course that's what they would do. Because its also what you would do because you also have no moral compass.
No, it’s not and it never has been. (Civic engagement and persistent watchfulness on liberties is a universal drumbeat across democracies.)
The courts et al are tasked with protecting the minority from the tyranny of the majority, or in this case, the engaged. Making the judiciary coëqual was our founders’ attempt at taming this tendency. But nothing knowledgeable ever written has suggested our republic should run on autopilot.
> when another person acts maliciously you give them a pass
I’m not giving them a pass, I’m saying the system is acting as designed. If people don’t give a shit about privacy but give a LOT of shits about abortion and cost of living, the elected should focus on the latter. This isn’t moral corruption, it’s responding to expressed preference. (Also, Comcast using Wi-fi to aid law enforcement is far from a black-and-white moral issue. It’s a political and legal question with multiple equilibria when it comes to right answers.)
There is being righteous and there is being right. The bulk of advocates for digital privacy enjoy the former and almost take their failure at the latter as further evidence of their righteousness. (It’s a lot easier to wax lyrical about Sodom and Gomorrah than pick up the phone once a month and attend meetings.)
You really are proving my original point though.
>(It’s a lot easier to wax lyrical about Sodom and Gomorrah than pick up the phone once a month and attend meetings.)
Blame that victim!
Non sequitur.
An elected prioritising a hot-button issue bill over one they like but which has no support is listening to their population.
> Blame that victim!
If an accurate description of choices actively made is blame, sure.
This is by design. A lot of people talk about RTO in regards to business real estate but there's also the aspect of keeping people so busy and exhausted that they don't show up when it matters.
This would make sense if people didn’t show up for anything. They do. Including very overworked folks.
The unfortunate truth is the people most interested in privacy overlap significantly with the politically nihilistic and lazy. They’ve never called their elected or shown up to a town hall and, moreover, never will, because of course it’s useless.
I genuinely wonder if people would wind up spending less money if they had to pay for services than if they get exposed to ads that lead them to buy more things. But either way, once ads and "free with ads" are gone, there's much more room for other competitors.
Ads don't require pervasive and invasive tracking for every breath you take
Or can instagram only be free if ads are targeted to detailed profiles of individuals built over decades as they are tracked across the whole internet?
So it's not about the perceived effectiveness of advertisements that you feel as a user, it's about the rather more unique product that they sell to advertisers that really raises their revenue.
Yes. Targeted ads need to be 100% to 700% more efficient than regular ads to be as profitable: https://news.ycombinator.com/item?id=43996623
What happened is website operators started to feel entitled to doing whatever they want with cookies on users’ machines and eventually decided to act like petulant children when the rules changed.
Adding a language select option on a multinational site seems pretty table stakes in my experience. Plenty often the user does not wish to use the same language as their system/browser. Switching your system’s default language just for one site is a huge hassle.
Re crash reporting: I’m talking about tools like Sentry. I have never once worked on a product of any scale that didn’t need to collect diagnostic reports from the field in order to address code level errors that happen as users are using the product. In house or 3rd party it doesn't matter, and client state has always been involved. A product that doesn’t function is broken. It needs to be fixed.
There is no privacy concession in any of these cases. The EPD simply over-regulates cookies.
I mean maybe we should just reimplement all this crap using indexdb. That’s not a cookie, legally.
The EPD fights symptoms not causes and the internet is worse for it.
For crash reporting: pop up a dialog asking if they'd like to submit a report (as software used to do). Don't just submit info from their computer without asking.
If literally any physical product breaks, I don't expect the manufacturer to receive telemetry so they can fix it. If I want them to fix it, I'll bring it back to them. I expect that if I don't go out of my way to tell them something, after I buy the thing, we go our separate ways, and they have no idea about anything I do. If their thing breaks, I also have the option of just not telling them and instead telling everyone else that they're crap. They don't need to spy on me for any reason.
I'm really not seeing the issue with asking consent to do things as they're actually needed. You don't need an "I CONSENT TO EVERYTHING" banner, and most of the stuff you want isn't necessary anyway.
Like I said, privacy conscious users block tools like Sentry. It's a perfect example of "no, you don't actually need to spy on me."
I think this is a way to do it, I had thought also of such a thing before. You can send a "computer payment file" which includes the product ID numbers (and parameters if applicable), the total price that the customer expects to pay, a signature, and encrypted data for use with the bank or credit card company (or some specification of store credit, if you are using that instead).
The existing use of "shopping cart" cookie can still be available as an alternative as well though, in case you do not want to use (or cannot use) the "computer payment file"; then it can provide its UI but you can also use your own if you have your own implementation.
> Adding a language select option on a multinational site seems pretty table stakes in my experience. Plenty often the user does not wish to use the same language as their system/browser. Switching your system’s default language just for one site is a huge hassle.
This is true. However, it would also be helpful to be able to change the settings (including languages, and HTTP request headers) per URL prefix, which would also be another way. This does not mean that the setting cannot also be available as a cookie, which will override the Accept-Language header if both are present in the request.
There is also user authentication; cookies are not really the best way to do that either. I think X.509 client certificates are a better way. However, other methods can still be provided for compatibility for users who do want to use it.
And then, there is more other stuff too, they can also be done in other ways.
Note that all of the above stuff means that many things can work with JavaScripts and cookies disabled (or unavailable), but enabling them will provide a way of working that does not require these other things too.
Pretty sure this exact example is explicitly carved out as a-okay.
I think what we're dealing with here is not websites trying to do basic things. Rather, it's every website and their mom thinking they need elaborate analytics to sell plastic garbage.
Yes, that elaborate analytics you spread to 20 third parties IS a privacy concern. We should be looking at that.
It does matter from the perspective of privacy, because in one case your vistors deal with one party (you) and in the other case another party (Sentry) is also involved.
I do not like using the legal basis of "consent" for processing personal data, and I would much prefer not to need to use consent for placing cookies. As it is, in my personal capacity I can get away without placing cookies at all .
If we had access to other lawful bases for placing cookies, I'd like to think we could work out way towards phasing out any blanket consent. I'm sure "legitimate interests" would be abused and over-relied-on. But it already is, and if we're not arguing with people about whether the "consent" they rely on is legitimate then maybe we'll have more time to worry about whether companies are using other bases appropriately.
More on point, we suffer from a problem that far too many people of all walks of life want nothing to do with politics.
Plato made the most accurate point 2300 years ago: "The penalty for not being involved in politics is you will be ruled by your inferiors."
And, even though you may not be interested in politics, politics is ALWAYS interested in you.
There are 24 states that require ID to view porn sites. The laws are being completely ignored by popular websites that are not based in the US.
I’m not sure the lack of a global hegemony is a “problem”.
https://reason.com/2025/01/24/age-verification-laws-meet-vpn...
> ”Google searches for online tools like VPNs have surged in Florida after Pornhub, one of the world's largest adult websites, blocked access to users in the state," CBS News reported earlier this month. "Since the end of November, Google searches for VPNs have surged in the Florida, according to Google Trends. From the week of Dec. 22 - 28 to Dec. 29 - Jan. 4, searches nearly doubled. Since then, the numbers have gone even higher."
How is the this a problem for ISPs coöperating with law enforcement?
* you get caught up in the moment, hell bent on solving the problem you don’t really think twice
* you don’t want to get that stink on you, you don’t want to be that guy that brings this type of stuff up
* you are mindful of the fact that you are being very well compensated to build it and you don’t want to lose your job
* you know it’s going to fall on deaf ears - maybe they will pay lip service, maybe they won’t but either way nothing will happen
* in the back of your mind you figure someone else is fighting the good fight
On and on, so many different things can go through your mind, who knows which it’ll be on any given day, on any given project
Today it's an automatic subtitle generator for people with hearing difficulties. Tomorrow it'll be an AI training data generator. In a year, the NSA will re-purpose it into a mass surveillance tool.
Kind of crazy that I’m being downvoted for just expressing some basic, reasonable feelings
I did some work in the early 2010s that we expected to be used for computational photography, gaming, and little else. Years later, after I had already left the company, its primary use case became image stabilization for quadcopter drones, something that had not crossed our minds at all when we were building that stuff.
Cue in all the drone footage from the Russian invasion of Ukraine. FUCK. FUCK FUCK.
For example, I don't think there's anyone in the (large!) fixed-odds betting terminal industry that can honestly say their work is a good thing for the end users.
Article 12
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks
- Paris, 1948, Universal Declaration of Human Rights
My gut feeling as that no matter how much additional and specific language we add to any bill of privacy rights, there will always be holes or work-arounds due to interpretation and semantics. This is how lawyers in most robust legal systems make their living, after all. The data that results from robbing us of consent, privacy and agency when engaged with websites, web/mobile apps and software is so insanely valuable that the people interested in collecting and selling it will be happy to keep one step ahead of whatever language we come up with that attempts to mitigate their actions.
We need a different solution, one that returns us to the levels of implied trust I remember from the late 1990's/early 2000's Internet, one that prevents corporate entities from being the dominant drivers behind its growth and development. However, I am not technical enough or imaginative enough to even guess at what that solution might be, so from my perspective, the battle is already lost and we are at their mercy unless we avoid having an online presence as much as possible...a bit like that old classic movie War Games, the only way to win is not to play.
Nobody will ever write a perfect law and you’ll always see cases like dark patterns when people try to unsubscribe from things or try to maintain their privacy, until there is proper enforcement and businesses start getting punished for violating the intent of the law. That is also unlikely.
"except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."
Currently 'the West' happens to be doing its best to quash international law, so I'd expect even that thin veneer to crumble rather soon.
Do yourself a favor and enable the Cookie lists in uBlock Origin.
I'm personally grateful that a law requires my consent before tracking me. That means I should not be tracked without me saying OK without monetary risks.
Could you elaborate on this please? I'm sifting through the options and not sure what I'm looking for (disclaimer: I have never once opened the uBlock Origin settings menu in all the years I've used it).
Tracking a user across domains using a 3rd party aggregator to serve add and do attribution is the evil. And the EPD far overshoots the mark of specifically addressing that evil.
https://en.m.wikipedia.org/wiki/EPrivacy_Directive says
> The Directive provision applicable to cookies is Article 5(3). Recital 25 of the Preamble recognises the importance and usefulness of cookies for the functioning of modern Internet and directly relates Article 5(3) to them but Recital 24 also warns of the danger that such instruments may present to privacy. The change in the law does not affect all types of cookies; those that are deemed to be "strictly necessary for the delivery of a service requested by the user", such as for example, cookies that track the contents of a user's shopping cart on an online shopping service, are exempted.
> Cookie compliance [heading]
> To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:
> Receive users’ consent before you use any cookies except strictly necessary cookies.
(emphasis not mine, but would have added it)
A language preference cookie is not tracking.
The GDPR is different from the ePrivacy Directive. The EPD is responsible for cookie consent. And it has the language addressing preferences cookies.
But I see what you are saying now. That page lists the different purposes, including preference cookies (which include language preferences) and strictly necessary cookies, and I know asking consent is not necessary only for strictly necessary cookies (this page says it, I quoted that part earlier).
If that page is right, you are right and I was wrong. Thanks for persisting.
Well, that would be a shame, and that probably would explain why cd.cz makes me pick English each time I visit. I was assuming they could just save this preference in a cookie, but they obviously wouldn't be able to since I didn't provide consent, since I hide the cookie banners and they don't ask for consent later when needed.
Now, that page is not authoritative and I see it criticized here: https://www.reddit.com/r/gdpr/comments/vniefz/strictly_neces...
I guess it it safe to ask consent in doubt, but I'm not yet convinced the language cookie cannot be considered strictly necessary. How can you correctly provide a requested service to a user if you don't use a language they understand, and how storing the language is not for fulfilling an explicit request from them?
It's easier and safer to just claim that you must prompt for everything, and it serves the goal of obfuscating bad behaviour.
Cookies that are functionally necessary to do what the user is there for, not to track them, are OK, that's the spirit and intent of the law. Even if you think the wording means that, realistically, the EU isn't coming after anyone for a legitimate good-faith use of language cookies without a banner, and they'd clarify if that was how they intended to enforce it.
Nope.
That's exactly why the evil cookie modals are not on the GDPR but only on the sites that want to track you and now need to ask you for your consent before doing so. That's usually exactly where good faith GDPR detractors are wrong, and that's what needs to be repeated again and again in those discussions.
If your are referring to GDPR this is wrong. GDPR does not require consent for strictly necessary cookies.
>Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.
Though language preference does not seem like something that requires a cookie. Just respect the Accept-Language header. There is no need to reinvent the wheel here.
In any event, that’s besides then point. There are non-tracking cookies that get swept up in the EPD’s consent requirements. This causes way more popups than needed to address the real problem of users being tracked and profiled across domains. The result is users being inundated with consent banners on freaking homepages.
If you changed the requirements to “consent is required for marketing cookies” then I’d wager it would vastly reduce the need for these banners. You could show the banner interstitially as soon as a customer entered your funnel and wanted to try to perform spooky attribution.
In my experience the banners are useless because they don’t actually tell me whether the site is tracking me or not (the behavior I presumably want to prevent). They just tell me whether the site uses cookies, which I’m okay with 99% of the time, so I just click yes.
Still not sure where you and nightpool got this.
But the attempted legal solutions suffer from being inside the sandbox, meaning all the “cookie management” software is a pile of hacks that barely work, and rely on browsers, as you’ve noticed, to allow their cookies in the service of…limiting cookies. And of course they also suffer from the politicians who wrote them having no clue how any of this works. I suspect if they did, they’d see how dumb it is to regulate that 10,000,000 websites each implement a ton of logic to self-limit their cookies they set (hard to police, buggy) instead of telling 2-3 companies they have to make their browsers have more conservative defaults with how they keep and send cookies back. (easy to prove it’s working with testing).
The obnoxious cookie banners are not required by "idiotic EU cookie laws".
> a technical solution would be easy: default segmentation of cookies by what site you are actually visiting, plus all non-first-party ones silently expired after 60 minutes or whatever.
1. This was already implemented
2. Tracking isn't limited to cookies only
> except for the fact that the number one ad network is also the only browser vendor that matters.
Oh, so an "easy" solution isn't easy after all. Who would've thought.
> And of course they also suffer from the politicians who wrote them having no clue how any of this works.
But you do? Like how you only speak about cookies when tracking and user data isn't limited to cookies? Or how "stupid EU cookie law" doesn't even talk about cookies (if we're talking about GDPR)?
Usually the people who really have no clue are exactly the people who say that "there's an easy technical solution".
Of course, the alternative is to not use cookies, to not use any web analytics products, or to resolve to argue the semantics of what is necessary before a judge when sued by one of the many lawyers who now advertise (ironically) all over social media with come-ons like "Did you browse FUZZYSWEATERS .COM? Your data may have been improperly used!"
> 1. This was already implemented
Please let me know what browser does what I describe. Close as I can come is configuring a Chromium based browser to just only keep cookies for certain domains, but it's a pain in the butt so I stopped worrying about it a long time ago.
> Oh, so an "easy" solution isn't easy after all. Who would've thought.
But I went on to detail the much "easier" solution where the EU aims its big swinging...list of mandates... at the 2-3 browser vendors rather than involving 10,000,000 small businesses worldwide in the business of trying to guess if they're "GDPR compliant," or could be in breach because they added some snippet of code from a useful web analytics platform that could be said to "track" users.
Do you really think that it is easier and better to regulate millions of people/companies to make them all do a complex thing in good faith AND do it well, than to make those couple of companies sandbox cookie storage in a way that severely kneecaps cross-site tracking?
> 2. Tracking isn't limited to cookies only
Sure, but also I question to what extent anyone is being harmed by "tracking" in the most broad sense of that word. As far as I can tell, the public believes "tracking is a problem" primarily because they resent retargeting ads. That's all. People see a shirt or a chainsaw or an air fryer "following them around" after they browsed for one, and think "that's weird! THEY know!" Despite the fact that most of those things function very simply, do not give a shit who you are, just some ID that your browser saved and is sending back, and which is tied to a list of SKUs you showed interest in.
The more reasonable concern is more around data brokers and the data about a person being sold and aggregated, which mostly gets concerning when it could be used for stalking, targeting political dissidents, etc. The fact that I spent 34 seconds on A product page, then 32 seconds on B, then added B to my cart and then bounced, that is the nature of all of the data being tracked on 90% of websites, they don't traffic in my location data or even want to collect sensitive information. But every website is affected by the GDPR's vague definitions of "tracking." And ironically, I assume partly because all these in-sandbox "CMPs" barely even work, I haven't even observed a decrease in retargeting ads, the #1 thing that people actually observe and are bothered by.
Honestly, I could not parse this rant that is a chain of non-sequiturs
> Please let me know what browser does what I describe.
Segmenting cookies has been a thing in all browsers for half a decade at least. Everyone but Chrome block third-party cookies. Safari clears out a bunch of cookies periodically (and PWA developers hate it for that)
> But I went on to detail the much "easier" solution where the EU aims its big swinging...list of mandates... at the 2-3 browser vendors
Ah yes, because tracking is only limited to cookies and to browsers.
> Sure, but also I question to what extent anyone is being harmed by "tracking" in the most broad sense of that word. As far as I can tell, the public believes "tracking is a problem" primarily because they resent retargeting ads. That's all.
Well, people from countries with quite recent cases of pervasive and invasive surveillance have other problems with invasive and pervasive tracking.
> The more reasonable concern is more around data brokers and the data about a person being sold and aggregated, which mostly gets concerning when it could be used for stalking, targeting political dissidents, etc. The fact that I spent 34 seconds on A product page, then 32 seconds on B, then added B to my cart and then bounced, that is the nature of all of the data being tracked on 90% of websites, they don't traffic in my location data or even want to collect sensitive information.
You have to chose one stance, not multiple at the same time:
- is this not a problem because who cares about a single ID?
- is this a problem because data broker amass and trade vast amounts of sensitive personal data?
> But every website is affected by the GDPR's vague definitions of "tracking."
Ah yes. It's GDPR that causes these poor innocent web sites to use data brokers that keep my precise location data for 12 years: https://x.com/dmitriid/status/1817122117093056541
And GDPR isn't required at all, because all we need to do is make the 2-3 major browser to just not set cookies, because that's all we're concerned about. There are no other ways of tracking people, and that tracking data isn't used by anyone anywhere.
Except, you know, "data brokers and the data about a person being sold and aggregated", but who cares about that.
I don’t know that a reasonable person would compare privacy threats to the threat of death from gun violence.
They exist in totally different altitudes of concern.
It would be enough to have your browser store a cookie without personal information with { cookieconsent: "STFU" } or some variable in local storage. If the website respected that, we would be fine.
Personal identifiers are not needed and foul compromises aren't acceptable.
I want privacy codified in human law. I didn't vote for standards bodies to pave the road to hell by removing every goddamned persistent handle we can find from existence. I didn't vote for the EU to reinvent an internet worse than popup ads by attacking the symptoms not the cause. I would rather have the internet of the 2000s back in a heartbeat than keep putting up with shitty “technical solutions” to corporations having too much power at scale. I don’t care if people break the law: prosecute them when they do and make the punishments enough to deter future law breakers.
There is absolutely something civilized beyond a lawless advertising wild west where the technical solution is to all be masked Zorros.
Why is it that if someone said “we need a legal solution to gun violence” the people that say “no we need a technical solution all people should wear kevlar and carry 9mm pistols” are considered the lunatics but when we ask for a legal solution to rampant non-consensual tracking for the purpose of indoctrinating the consumer class with propaganda we all laugh and say bah the solution must be technical? I don’t get it.