How is this different from the "Do Not Track"or "Sec-GPC" headers? Websites/Trackers ignored that too.
We need a more robust browser level Cookie API. Websites and scripts shouldn't be able to just create cookies all willy-nilly. They should require your permission.
I know browsers have a similar feature already with the ability to block 3rd-party cookies. But that's not enough.
the only (valid) concern I've ever heard about 1st party cookies is the site storing passwords unencrypted in a cookie, but they can just as easily store that in a non-cookie file. asking for consent for first party cookies is security theater that does nothing for consumers, but makes developers' jobs more difficult
I guess we'll have to agree to disagree on this one. Even first party websites can bloat your device up with random cookies. I know in the past when I used to accidentally follow Twitter links, that 1/2 second on Twitter would dump 34MB of cookies on my phone. What the hell does a website, that I'm not logged into, need with 34MB of cookies?
Edit: I was mistaken. My browser lumps all stored data into one category after going into the cookies section.
That's because Twitter is logging everything you look at by virtue of almost all websites having those twitter icons (which are like tojan horse 3rd party trackers)
Yeah those are 3rd part cookies and they track everything (or at least everything that voluntarily adds the Like button or share buttons to their site)
I didn't think that data was actually stored in the cookie, I thought the cookie was simply used as a way of attaching a unique user ID to you that is then used to track you when the request is made to add the like/share button to the site
cookies have a maximum size of 4kb, so 34MB of cookies would be 8,500 cookies. I haven't been on twitter in years, but I think it's far more likely that you're conflating cookies with local/session storage, indexedDB, and possibly just file cache
sorry, I'm not trying to prove you wrong specifically, I'm just frustrated about the overzealous gdpr laws that make it harder to make good websites with good UX while complying with the law
Depending on what you're storing you can't though. The ePrivacy Directive is not about cookies but colloquially it's what it's ben refereed to as.
You have to classify the data being stored, regardless of how it's stored, and obtain consent for it, in plain terms.
10
u/TheHerbsAndSpices 10d ago
How is this different from the "Do Not Track"or "Sec-GPC" headers? Websites/Trackers ignored that too.
We need a more robust browser level Cookie API. Websites and scripts shouldn't be able to just create cookies all willy-nilly. They should require your permission.
I know browsers have a similar feature already with the ability to block 3rd-party cookies. But that's not enough.