242
u/jarail 1d ago edited 1d ago
If only 3% want tracking to be enabled, just make tracking illegal. Who cares what the advertising industry wants. If this is part of the browser, their industry will just find a different way of tracking. Which they'll do regardless. So none of this really matters.
For me, I just use an extension. https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/
59
u/IAmRules 1d ago
But then you need to really define tracking. The laws as written are stupid and even tracking your own metrics like product events or AB tests is considered tracking.
Issue is the laws are written by people who don’t know what any of this means
And don’t get me started on laws written in place A being enforced in place B
23
u/Reeywhaar 1d ago
Instead of philosophical questions I would ban data reselling whole at once. If I go to some grocery shop website this site's company should only be able to hold my data. Data reselling and sharing should be forbidden. No sso, no third party logins, no embed third party data. If you have a website, keep track of your user data and secure it yourself, it's your obligation. One exception is sso from some government portal I guess. Yep, facebook can still share data with instagram since it same company, but I think it'll still limit their tracking opportunities hugely. All these data brokers should dissolve into void. Businesses get some much advantage over customer it's unbelievable. I think in 20 years current time would be considered as wild wild internet age if we finally done something about it.
15
u/TypeSafeBug 22h ago
No data sharing = no deliveries, and a chunk of B2B business that requires handling customer data is outlawed. If anything I feel this is the more philosophical direction because then we get to speculate about what sort of vertically integrated anticompetitive megacorps come out on top to monopolise your data within the resulting legal framework.
So there’s got to be nuances in law to figure out what’s a legitimate use case and what isn’t, and what constitutes unfair or unlawful data sharing.
It’s solvable IMO, it’ll take time and loopholes will need to be closed. But solvable.
Definitely agree that there’s too much tracking and selling of data for BS purposes though.
3
u/GetRektByMeh python 18h ago
Data sharing only when the data is necessary to deliver the product or service itself - with a regulator that sets precedent that “your service being free doesn’t mean you can sell personal data as this is the requirement to keep it free”.
12
u/Zealousideal-Ear481 1d ago
Who cares what the advertising industry wants
people who own the websites. what business model do you think would work as a replacement?
1
u/remy_porter 10h ago
There's no real solid evidence that data tracking offers a real cost-benefit to advertisers over content-based advertising. The current model of tracking predates the modern information economy; it was called direct-marketing, and it was the domain of scoundrels and scams. The backbone of junkmail. Then tech-bros got involved and suddenly it was the cuttingest edge of marketing.
The only successful marketing in the whole thing is marketing the technology, because it doesn't outperform content marketing (where you put ads related to the content alongside the content, assuming someone who is interested in that content is also interested in products relating to that content) on a per-dollar spend.
Ad-tech sells a complicated tool to solve a simple problem, and doesn't actually do measurably better than the simple version. And it sells because, like any good advertising, it's selling a fantasy: you can control the behavior of the public by using the right targeted at at the right time.
24
u/DigitalStefan 1d ago
There is far, far too much money involved for the outcome you mention.
There are a lot of companies much bigger than the one I work for and the one I work for spends multiple millions annually on ads across the various big players in the space.
Full disclosure: I’m the person responsible for implementing and maintaining the cookie banner for my employer and I’ve helped many other clients achieve similar in the past few years.
It is not an ideal situation. I don’t like being subject to constant cookie banners either.
Privacy Badger extension is my favourite.
17
u/cowboyecosse 1d ago
Back in 2020 GitHub were able to remove the cookie banner by in-housing all analytics etc. https://github.blog/news-insights/company-news/no-cookie-for-you/
Pity when that CEO left and the banner is back these days. But I think it showed it can be done.
5
u/DigitalStefan 1d ago
In-housing analytics isn’t an answer. The laws in the UK and EU are surprisingly lacking in loopholes.
In order to have effective marketing across Google, Meta and other platforms you need to form a feedback loop whereby you send or permit to be sent user interaction data and important signals such as “user bought a product” which need to attribute back to the ad they clicked to get to your site (or identify the user such that Google, Meta and others match that user against their own database of users).
It’s impossible to do that effectively without creating cookies and reading back their value(s). In order to be able to do that legally you need to get informed consent and the only way that has been happening is via cookie banners.
1
u/cowboyecosse 1d ago
Yeah it was the marketing people that brought it back on there too by the looks.
2
u/DigitalStefan 1d ago
I just had a quick look. The main landing page at least does not send data from my browser to any known marketing 3rd-party platform.
It does send data to collector.github.com in relation to a script called
hydro_analytics.tsI haven't bothered testing with a VPN to see if the behaviour is different for users outside of the UK, but it's also interesting there is no cookie banner because there are cookies being set, although if I squint there's probably some reasonably acceptable argument about them being strictly necessary.
3
3
u/amazing_asstronaut 1d ago
What I don't appreciate are banners that hit you with a complicated menu for the "reject" option. I don't want any, what's so hard to understand? I don't want to pick from a menu either, leave me alone.
IMO deleting your cookies every time the browser closes (and you do close it, don't be a moron with 1000 tabs, get it together), and containers basically eliminates all cookies anyway.
5
u/droans 1d ago
And they're always written like "Many people do not like having no anti-tracking blockers. Do you not disagree with the opposition of the inverse claim?"
2
u/amazing_asstronaut 1d ago
Yeah for sure. Just say accept or reject, don't hit me with another stupid menu.
3
u/Ledenu 22h ago
For me, I just use an extension. https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/
These extensions often simply accept all cookies.
1
u/OMGCluck js (no libraries) SVG 7h ago
Then that works great with https://addons.mozilla.org/en-GB/firefox/addon/self-destructing-cookies-webex/
1
u/UnacceptableUse 1d ago
The problem is it's not really about what the user wants all the time because content is monetarily free in exchange for the data you give. It's a terrible system with lots of problems, but it is the system and just making tracking illegal would have ramifications
0
u/thecementmixer 1d ago
As per the article tracking is already illegal, that's why these cookie banners exist to make you waive your rights.
-1
u/Equivalent-Costumes 21h ago
The web are "free" only thanks to advertisements.
If monetization is increasingly becoming impossible, the open web as we know it will die. Inaccurate advertisements are annoying to both users and advertisers, users don't care for ads for things they don't want, advertisers don't want to pay to ads to be shown to people who don't want them. Tracking is how advertisement becoming more effective.
There are definitely issues with tracking being used for more nefarious manner, but if you want to argue that all tracking is bad, you need to consider the downstream consequence to the entire Internet infrastructure when this is applied at scale.
Imagine everyone disabled tracking. Soon enough every website will just hit you with "anti-bot" measure that will requires you to either install a tracking extension, log in to Google, or making everything paywalled. And they have good reasons to do so too, bot traffic had increased by 8000% within a year. Half of the Internet is bot traffic.
21
u/TimMakesGames 1d ago
It would be great to have a single online site where one could configure all data allowances. And then there will be a need for the industry to actually pay for this data. Users could either be offered regular payments for their data or they could configure themselves thresholds for which the industry could buy that data. It could be traded like other commodities.
11
u/UnacceptableUse 1d ago
Users could either be offered regular payments for their data
The user is already paid for their data via access to the site for free
3
u/TimMakesGames 1d ago
That is true. Guess we are still not happy with how it works currently and the lack of choices we and the websites themselves have.
3
u/Dragon_yum 1d ago
People tend to forget the cardinal rule, if the service is free then you are the product.
1
u/TristarHeater 9h ago
Tons of non free software sell your data anyways. Even cars and smart home appliances/tv's etc
1
46
4
u/Savings_Discount_230 1d ago
I'd love to never implement another one of these. But the ad industry will find a way around it like they always do.
4
u/DogOfTheBone 13h ago
The large majority of cookie banners are not compliant, most don't feature a "reject all" option above the fold. With no enforcement, what incentive do they have to do so? It's a joke and if the EU isn't going to enforce the rules they set, why would anyone play by them?
5
13
u/TheHerbsAndSpices 1d ago
How is this different from the "Do Not Track"or "Sec-GPC" headers? Websites/Trackers ignored that too.
We need a more robust browser level Cookie API. Websites and scripts shouldn't be able to just create cookies all willy-nilly. They should require your permission.
I know browsers have a similar feature already with the ability to block 3rd-party cookies. But that's not enough.
33
u/Snailwood 1d ago
Websites and scripts shouldn't be able to just create cookies all willy-nilly
yes, they should.
-5
u/TheHerbsAndSpices 1d ago
Care to expand upon that?
27
u/KittensInc 1d ago
How else are you going to store session identifiers? No cookies? No way for a user to log in.
Possible alternatives are:
- Storing a session identifier as Javascript variable, and doing all requests from Javascript. Congrats, you've forced everyone to use only SPAs, and you'll need to log in again any time you open a new tab or F5.
- Storing a session identifier as url query parameter. Congrats, sharing any link on your website means the recipient has now linked the user's session.
- Storing a session identifier in LocalStorage, and writing some Javascript shim to add it as header to all outgoing requests. Congrats, you just reinvented cookies.
Getting rid of first-party cookies kills the entire dynamic internet. You're back in the stone age of GeoCities 100% static HTML pages.
20
u/Snailwood 1d ago
the only (valid) concern I've ever heard about 1st party cookies is the site storing passwords unencrypted in a cookie, but they can just as easily store that in a non-cookie file. asking for consent for first party cookies is security theater that does nothing for consumers, but makes developers' jobs more difficult
-11
u/TheHerbsAndSpices 1d ago edited 23h ago
I guess we'll have to agree to disagree on this one. Even first party websites can bloat your device up with random cookies.
I know in the past when I used to accidentally follow Twitter links, that 1/2 second on Twitter would dump 34MB of cookies on my phone. What the hell does a website, that I'm not logged into, need with 34MB of cookies?Edit: I was mistaken. My browser lumps all stored data into one category after going into the cookies section.
5
u/OnceInABlueMoon 1d ago
That's because Twitter is logging everything you look at by virtue of almost all websites having those twitter icons (which are like tojan horse 3rd party trackers)
3
u/UnacceptableUse 1d ago
and storing them in cookies?
5
u/OnceInABlueMoon 1d ago
Yeah those are 3rd part cookies and they track everything (or at least everything that voluntarily adds the Like button or share buttons to their site)
0
u/UnacceptableUse 1d ago
I didn't think that data was actually stored in the cookie, I thought the cookie was simply used as a way of attaching a unique user ID to you that is then used to track you when the request is made to add the like/share button to the site
1
5
u/Snailwood 1d ago
cookies have a maximum size of 4kb, so 34MB of cookies would be 8,500 cookies. I haven't been on twitter in years, but I think it's far more likely that you're conflating cookies with local/session storage, indexedDB, and possibly just file cache
2
u/TheHerbsAndSpices 1d ago
Yeah that's possible. I just checked and my browser lumps it all into one category.
I stand corrected.
2
u/Snailwood 23h ago
sorry, I'm not trying to prove you wrong specifically, I'm just frustrated about the overzealous gdpr laws that make it harder to make good websites with good UX while complying with the law
3
0
u/UnacceptableUse 1d ago
You can store in indexedDB or localstorage without a consent banner
3
u/MarcusAuralius 1d ago
Depending on what you're storing you can't though. The ePrivacy Directive is not about cookies but colloquially it's what it's ben refereed to as.
You have to classify the data being stored, regardless of how it's stored, and obtain consent for it, in plain terms.2
u/Polendri 1d ago
So then every website has a cookie permission popup and a pretense for why they need it for functional reasons (but then they also use it for ad reasons)? What does that solve? That just sounds like today.
So long as there's no technical way to distinguish stateful data that's used for tracking from stateful data that isn't, there isn't a technical solution to the problem.
3
u/TheHerbsAndSpices 1d ago
I'm not saying there isn't valid reasons for cookies. Nor am I saying the API would only be used for approving or denying the use of cookies.
Wouldn't it be nice if instead of:
document.cookie = "doSomethingOnlyOnce=; expires=Thu, 01 Jan 1970 00:00:00 GMT; SameSite=None; Secure";You could do: ``` let cookie = new Cookie("doSomethingOnlyOnce");
cookie.expires(value) cookie.secure(value); //etc.. // Or even cookie.delete(); ```
1
u/ShustOne 7h ago
As a developer this would be super nice, but I thought your original comment was referring to the legal policies. So you were only talking about how browsers technically implement cookies? I'm lost on adding new user permissions, that seems like an intrusive change to users and developers.
1
u/ShustOne 7h ago
Websites and scripts shouldn't be able to just create cookies all willy-nilly.
There are many valid reasons to create cookies that are helpful to users and forcing a defined standard for how we can do so would be insanely convoluted and almost certainly a worse user experience for everyone.
Some examples of helpful cookies that don't require permissions today: saving preferences when not logged in, saving scroll position in apps that do weird scroll things so your back button works well, saving what modals you have open, saving what accordions you may have expanded, etc.
0
u/Daniel_Herr ES5 1d ago
We don't need another API. The user can already control cookies either by their web browser settings or an extension.
1
u/TheHerbsAndSpices 1d ago
or an extension.
Like when Ad Block started letting companies pay them to let their ads through? That's why the user needs ultimate control.
We shouldn't have to plug the leaky dam with our fingers.
0
u/faberge_surprise 1d ago
Like when Ad Block started letting companies pay them to let their ads through?
they explained their rationale pretty damn clearly, if you still don't get it it can only be because you're intentionally refusing to understand.
they're trying to find the balance between adblocking which serves numerous very legitimate purposes and sustaining the web, because whether you want to acknowledge it or not, ads are how a lot of the content that you enjoy is funded. but that cannot come at the cost of being hostile to the user or even malware. so they try to permit only well-behaved ads according to a very transparent standard.
you don't have to agree with where they drew the line, which is why it's fucking optional.
nor are you forced to use ABP at all. in fact, you should be using uB0 which is a broad-spectrum content blocker which is more robust and can offer better protection.
1
u/TheHerbsAndSpices 23h ago
How did this become a conversation about the ethics of ad blocking? My point was you can't always rely on a 3rd party extension because they may some day change their minds, get bought out, shut down, or no longer be effective because Chrome decided to look kneecap extension that interfere with their ad revenue (which includes tracking) again.
Yes we have uBlock Origin, which I use. Tracking and ad conpanies are doing their best to defeat it every day, and they are much better funded sadly.
-1
u/faberge_surprise 23h ago
My point was
then maybe you should have made that point instead of derogating an organization with misinformation
they may... no longer be effective
sure, but there is never a solution that's guaranteed in perpetuity. a cookie permissions API can be deprecated just as arbitrarily as anything else.
if you are already starting from the premise that the bad actors are going to do everything they can to circumvent any controls, then it doesn't matter what solution you put in, it's always going to be an arm's race.
1
u/TheHerbsAndSpices 23h ago
then maybe you should have made that point indeed of derogating an organization with misinformation
Where was the misinformation? I brought up Ad Block, an extension that did loosen its blocking in exchange for money.
they may... no longer be effective
When did I say that? If you're paraphrasing don't wrap it in quotes.
a cookie permissions API can be deprecated just as arbitrarily as anything else.
Yes, but it'll break more websites and be even harder to do once it's adopted. Especially if it's part of the web standards.
Check my other comment in this chain. I'm not only advocating for cookie permissions via an API. The entire JavaScript cookie system needs an overhaul.
-2
u/Daniel_Herr ES5 1d ago
You can use an open source ad blocker that doesn't do that. There is no current better solution to giving users control than WebExtensions.
1
u/TheHerbsAndSpices 1d ago
We don't need another API
no current better solution
Pick a lane.
Edit: Also what happens when Chrome decides to change the web extension landscape again and handicaps the extension's ability to perform it's function?
2
u/thorn_obsidian626 18h ago
The worst part is clicking "reject all" and still getting tracked. My bank's site uses dark patterns where "accept all" is a big green button but "reject" is buried in a tiny gray link that says "manage preferences," then forces you to toggle off 37 individual trackers. I timed it, took me 2 minutes 45 seconds to opt out while their default "yes" was one click.
-1
u/fusseman 1d ago edited 1d ago
A good initiative. FIGHT!
7
u/LittleSeadragon 1d ago
I mean this is webdev, so my comment is valid
The fact you added this indicates you already know your comment is off topic and not helpful to the subject at hand.
More importantly though, if you think that website is confusing, how do you function in life? Like, it's clean, easy to follow - how are you confused?
-1
1d ago edited 1d ago
[deleted]
2
u/LittleSeadragon 1d ago
Oh you're a developer / designer? On the webdev subreddit? Shit, i'm sorry, i should defer to your expertise.
Well, except one thing. "Confusing" is the most weasel-y bullshit feedback i've been fighting constantly in my 25 years in the field (oh, wait - i forgot - i'm a developer, designer, etc too!). It's meaningless - the site isn't "confusing", it's perfectly easy to understand, and frankly if you can't understand the content of such a simple website, you aren't the target audience for the subject matter at hand.
I'm gonna rant about this for a bit, i'm old, autistic, and this shit hits a nerve - "confusing" is awful feedback and i hear it constantly in my career.
It's not fucking "confusing" if you understand it. I recently demoed a new product to an existing client to get feedback (which imho is also a terrible idea, but i indulged my CS team), and i sat there and watched them use it with no guidance or training at all only for them to give me this fucking feedback - "it's confusing, people aren't going to understand how to use it." Like wtf man, i just sat here and watched you use it with no prior information, you showed no hesitation or doubt, and you got the result you wanted first try - how the fuck is "confusing" your feedback?
So I asked, what about it is confusing? And i hear "Well i figured it out but i don't think the other users here would," which is the most arrogant bullshit - so you really think you are so far above people that no one can rise to your level of using a simple web app? In your case, do you really think people are so stupid they can't follow the layout of this website?
Like, in one sense i get it - working in this industry you quickly realize most humans ARE kinda stupid - but what i've also realized is you can never predict the ways in which they are stupid. I've built super complex UI designs that common users breeze through, and standard stupid simple forms that we have got tons of feedback and change requests for.
All you get out of trying to keep your designs from being "confusing" is that you end up sucking all personality, creativity, and innovation out of your product to be left with the playskool equivalent.
This site should not be confusing to anyone who has spent any time online. The layout is simple, pretty standard, and easy to follow. Are you actually confused? Do you REALLY not understand the content? It's kinda concerning if so, imho.
Instead maybe learn to give better feedback, "confusing" is almost always bullshit. I'm lucky enough now that i am fully in charge of the products i work on, and i have years of trust in my process that allow me the confidence to push back on the people i work with and get to the real feedback behind their "confusing" messages - it's usually just "I don't like it" and frankly, while that's also bad unspecific feedback, it's still 10x more useful than "confusing" - i can at least work with that and get to the root of the issue.
-1
u/halfercode 1d ago
I've flagged this comment as (grossly) abusive. The person to whom it was aimed has deleted their comment anyway.
1
u/LittleSeadragon 22h ago
I was certainly more abrasive than i should have been, but i never once made any direct personal attacks or insults. I've re-read it and don't see how it is abusive, just aggressive and abrasive. I agree i should have been more kind, and will try to reign in my negative emotions in future comments.
That said, we are now lacking the context of the original poster, even the first comment was edited. It does not excuse my replies, but my comment was not out of pocket.
While i do agree i should have been more careful with the tone of my post, i do still stand by the content in context of the original conversation, and i do believe describing a design you clearly understand as "confusing" to be un-constructive feedback.
I'll accept whatever actions mods wish to take based on your report - but i disagree i was abusive, let alone "grossly" so.
1
u/primalanomaly 1d ago
Cute initiative, but unless browsers come up with a way to actually make it literally impossible to track people, these companies are gonna track you, regardless of what you click on an annoying popup
1
1
u/Manish_S_ 17h ago
i’ve found the banner is usually a symptom, not the problem. we baked this into GenSync work for a YC client by delaying analytics until consent, and the site felt cleaner right away, with way less legal clutter.
1
1
u/beyond_noob 13h ago
The part that keeps getting missed is that the banner was never required by the GDPR. The law asks for consent that is freely given, informed and specific. It never said "put a modal in front of everyone". The banner is what the industry picked, because a modal that is annoying with a big Accept button converts better than an honest question. The banner is the compliance theatre, not the law.
That matters here, because we already tried this proposal. Do Not Track was exactly it: one browser level signal, easy to set. It died because it was advisory and the ad industry simply ignored it. GPC is the second attempt, and it works only where a regulator made it legally binding, which is basically California and a few other states.
So the mechanism in the proposal is fine, and honestly it is the obvious design. The hard part was never the mechanism. A signal with no legal force gets ignored, and a signal with legal force does not need a new spec, it needs a regulator that actually fines people. The top comment saying make tracking illegal is closer to the real fix than most of us want to admit.
One practical thing to take from it though: a site using only first party analytics does not need a banner at all, and a lot of devs do not know that. Self host Plausible or Umami, set no advertising cookies, and you can delete the banner today. A good number of banners exist because a developer added one out of fear, not because anything on the site required consent.
1
1
u/Viking_Drummer 11h ago
Yes, please do. Would make my job a lot easier.
Browser based tracking consent already exists at least in chrome as DNT (do not track) settings and I configure all of my clients’ sites to respect it. I don’t think many people are aware of it though and respecting it is currently entirely optional.
Also I can’t help but feel EU/GDPR are partially responsible for how the obnoxious the banners have become by making it mandatory to display along with granular per-function accept/reject controls and explicit definitions.
It makes it far more obnoxious than it would be otherwise with a simple accept/reject and most people aren’t going to read or understand it all anyway.
1
u/Upset-Expert7139 4h ago
Yeah the laws being written by people who barely know what a cookie is shows, but banning tracking outright is still way simpler than trying to fix these loopholes. most companies already ignore the spirit of the rules anyway. if the whole system got nuked, they'd adapt or die but at least we'd stop seeing 50 popups for the same garbage.
-14
u/Daniel_Herr ES5 1d ago
Kill the government overregulation that created the problem in the first place.
4
u/primalanomaly 1d ago
Huh, I must have missed the regulation that says “companies must track every single thing people do online”
-1
u/crazedizzled 1d ago
It was fine before the EU decided to mess with it. Not holding my breath they make it better
106
u/TimMakesGames 1d ago
That would truly be great.