5 ms·

Cookie control always should have been a browser control. The legal route always should have been to force it to be built into browsers that provide sane defaul

by basch 2mo ago

Cookie control always should have been a browser control. The legal route always should have been to force it to be built into browsers that provide sane defaults, and make it illegal to circumvent what the browser declares as far as fingerprinting etc. any sort of elevation prompt, IF I allow them to be popups or an icon in a toolbar, should always be in the same place and not cover the page.

MassiveQuasar 2mo ago
Just enforce the GPC header... https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-GPC https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
- quantumwannabe 2mo ago
  Or the "Do Not Track" header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
nickff 2mo ago
If people really cared, they’d choose browsers that have better control, but that’s obviously not a priority for them. Why do you think this sort of thing should be regulated to suit your preferences when most people don’t seem to agree with you?
- ablob 2mo ago
  I think that's a stretch. People can care, but be unwilling to spend the time researching it or accept the trade offs that come with small browsers (which are often unsupported for applications you might want to use). There are many things someone might care about and at some point you have to prioritize. This topic in particular is practically a cold war where you always have to catch up on how things are, lest you loose it all. The required effort is disproportionate to the result. P.S.: No true Scotsman spotted
- ClumsyPilot 2mo ago
  > If people really cared, they’d choose browsers that have better control If people really cared, they’d chose reputable suppliers that sell non toxic food. If they are eating food with lead, they don’t care. Don’t force your wordview on people through regulation
  - whstl 2mo ago
    > Don’t force your wordview on people through regulation As opposed to enforcing your worldview with a lack of regulation? Because that's precisely what's happening, with the advertisement industry enforcing their worldview through lack of compliance.
    - ClumsyPilot 2mo ago
      That was suppose to be a reductio ad absurdum, not a genuine argument
      - whstl 2mo ago
        Poe's law strikes again! My fault here, sorry for the misunderstanding!
- preg_match 2mo ago
  Because everyone agrees - cookies banners are annoying and need to go away. Everyone is on the same page about this. The easiest way to make that happen is "move them into the browser". How often do you get prompted for, say, secure DNS or HTTP? Almost never, because your browser has sane defaults and controls that. So, there you go.
  - tsukikage 2mo ago
    What is the sane default response to "we and our 242 partners value your privacy"? I mean, it's even the literal truth: they value your privacy in the sense of having their software do a little internal auction to put a price on it.
- yjftsjthsd-h 2mo ago
  > If people really cared, they’d choose browsers that have better control What browsers would those be?
IanCal 2mo ago
In a way it is - or rather it wouldn’t t change anything if we added more features. The default is “no”. Without explicit consent you can’t do a lot of things. You can’t have a default yes, because how can you agree with consent but automatically to everything? And if it’s a no, are you saying you can’t ask a user for permission to use their data for a specific purpose? And if you can ask, that’s what we have right now.
- lukeschlather 2mo ago
  Yeah I think it probably does mean you should be banned from asking in most cases. If you have a legitimate interest you don't need to ask. If you need to ask your interest is not actually legitimate and you know it.
  - buzer 2mo ago
    Legitimate interest is not currently enough to read or write cookies. You need either consent or it must be "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." (or "sole purpose of carrying out the transmission of a communication over an electronic communications network", but that's harder to apply to cookies)
    - inigyou 2mo ago
      Which part says legitimate interest doesn't apply to cookies?
      - buzer 2mo ago
        "legitimate interest" is legal basis in GDPR. ePD (which governs access to cookies) does not have such legal basis, only consent and the two exceptions. Other processing (like after value is read) can happen under GDPR if the data is personal data.
        2mo ago

by basch 2mo ago

MassiveQuasar 2mo ago

Just enforce the GPC header... https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-GPC https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

quantumwannabe 2mo ago
Or the "Do Not Track" header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

nickff 2mo ago

If people really cared, they’d choose browsers that have better control, but that’s obviously not a priority for them. Why do you think this sort of thing should be regulated to suit your preferences when most people don’t seem to agree with you?

ablob 2mo ago
I think that's a stretch. People can care, but be unwilling to spend the time researching it or accept the trade offs that come with small browsers (which are often unsupported for applications you might want to use). There are many things someone might care about and at some point you have to prioritize. This topic in particular is practically a cold war where you always have to catch up on how things are, lest you loose it all. The required effort is disproportionate to the result. P.S.: No true Scotsman spotted
ClumsyPilot 2mo ago
> If people really cared, they’d choose browsers that have better control If people really cared, they’d chose reputable suppliers that sell non toxic food. If they are eating food with lead, they don’t care. Don’t force your wordview on people through regulation
- whstl 2mo ago
  > Don’t force your wordview on people through regulation As opposed to enforcing your worldview with a lack of regulation? Because that's precisely what's happening, with the advertisement industry enforcing their worldview through lack of compliance.
  - ClumsyPilot 2mo ago
    That was suppose to be a reductio ad absurdum, not a genuine argument
    - whstl 2mo ago
      Poe's law strikes again! My fault here, sorry for the misunderstanding!
preg_match 2mo ago
Because everyone agrees - cookies banners are annoying and need to go away. Everyone is on the same page about this. The easiest way to make that happen is "move them into the browser". How often do you get prompted for, say, secure DNS or HTTP? Almost never, because your browser has sane defaults and controls that. So, there you go.
- tsukikage 2mo ago
  What is the sane default response to "we and our 242 partners value your privacy"? I mean, it's even the literal truth: they value your privacy in the sense of having their software do a little internal auction to put a price on it.
yjftsjthsd-h 2mo ago
> If people really cared, they’d choose browsers that have better control What browsers would those be?

IanCal 2mo ago

In a way it is - or rather it wouldn’t t change anything if we added more features. The default is “no”. Without explicit consent you can’t do a lot of things. You can’t have a default yes, because how can you agree with consent but automatically to everything? And if it’s a no, are you saying you can’t ask a user for permission to use their data for a specific purpose? And if you can ask, that’s what we have right now.

lukeschlather 2mo ago
Yeah I think it probably does mean you should be banned from asking in most cases. If you have a legitimate interest you don't need to ask. If you need to ask your interest is not actually legitimate and you know it.
- buzer 2mo ago
  Legitimate interest is not currently enough to read or write cookies. You need either consent or it must be "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." (or "sole purpose of carrying out the transmission of a communication over an electronic communications network", but that's harder to apply to cookies)
  - inigyou 2mo ago
    Which part says legitimate interest doesn't apply to cookies?
    - buzer 2mo ago
      "legitimate interest" is legal basis in GDPR. ePD (which governs access to cookies) does not have such legal basis, only consent and the two exceptions. Other processing (like after value is read) can happen under GDPR if the data is personal data.
      - 2mo ago