▲ 106 points
back
77 comments
This whole thing is ridiculous. While adding these widgets to blocking filters seems like a workable short-term solution, the entire cookie notice scheme is unworkable in the long run. The problem is, this crap will stack up in the future, and none of it will ever get abolished. On some sites, I get a triple-stacked legalese warning banner, and I have to manually close all three of them.
Since internet law will only get worse, maybe it's time for a "real" technical solution to this. For example, if we had a standardized HTML element attribute to mark these widgets, browser/adblock makers could enable people to opt out of displaying them. It might look something like this:
<div legal-notice="cookies">...</div>
<div legal-notice="DMCA">...</div>
<div legal-notice="terms-of-service">...</div>
navigator.permissions.query({ name : 'skip-notice', topic : 'cookies' })Frankly, the requirement of notice could (and should) be pushed on to user agents – not sites. For one, it would help standardize both the user experience of notices – and leave the UX of website specific notices alone – but also it would improve the current state of things where many (most?) sites in the EU simply don't care or know about the legislation.
The last thing we need is more cruft sent across the wire.
Couldn't agree more with this. The fact that the cookie law is forced on websites is absolutely idiotic. The browsers know what cookies are being set.
That only works if cookies are infrequent enough, like location data, which they aren't. Also there's no way for the browser to know how the cookie is used. I'm all for a technical solution, but I'm not sure it's possible to do "cruft free" without rethinking some things.
And as far as there isn't any "cookie law" on the books, it's about compliance with data protection and privacy regulation. So the EU isn't standing in the way of the industry to do that in another way.
This is what I like about the lynx text browser[0], on navigating to a new host it prompts you to reject or accept cookies: http://i.imgur.com/GEpYVVs.png
The "real" technical solution here is to standardize a modern authentication system separate from cookies and have things like "do not track" actually work. The industry has, seemingly deliberately, failed to do that. So the EU has rightfully argued from "first principle" that privacy and data protection is more important than the status quo in the industry.
> to standardize a modern authentication system separate from cookies
why? Then ads will use that "new" thing as well. Cookies are enough for authentication.
Why block them? It's good that websites have to be more transparent with how they are tracking users.
It is however inconvenient for the websites. They could always stop using privacy-invading ad networks and external services which track users and then they wouldn't have to show any message.
> Why block them?
Because I have better things to do with my time than click to close the message on every single website I visit.
If you actually read them then good luck to you. I think most people either a) don't care or b) install a global blocker to suit their particular privacy requirements.
> Why block them?
Because the web becomes unusable with those "helpful" cookie notices when I actually do block cookies browser-side.
Those "TRUSTe" JavaScript solutions are the worst. They fade the whole page to black, then take whole seconds to load and make the browser sluggish.
> Why block them?
Because as I am already using an AdBlocker that blocks the tracking cookies, this message is irrelevant.
>They could always stop using privacy-invading ad networks and external services which track users and then they wouldn't have to show any message.
"if these companies would just invent and build a new infrastructure to pay the bills, they wouldn't need to present a nag."
These laws are still evolving and changing. Different for every country. We don't have something international we can build standards upon at this point in time.
It seems to me there would also be an active push against any such implementation because it would make current solutions for getting around this type of cruft more effective than it already is.
Although if we were going to go this route I'd like to see it be a server-side rather than included in the markup. The browser could detect that you are visiting a new domain and request relevant information upon connection.
> These laws are still evolving and changing. Different for every country. We don't have something international we can build standards upon at this point in time.
Not every country. This is EU legislation after all; any website hosted in one of the 28 member countries has to abide.
This reminds me there was a push for a 451 error that would represent censorship. Whatever happened to that?
https://boingboing.net/2012/06/13/error-code-451-an-http-err...
It is being used the way it is supposed to: http://i.imgur.com/x2oG6hq.png
Well browsers could send an "allow cookies" header, like the "don't track" header?
The Do Not Track HTTP header would work:
DNT: 1 (Do Not Track; don't show cookie notice)
DNT: 0 (Allow tracking; don't show cookie notice)
No DNT header (Ask before tracking)This stupid cookie notification law was actually the main reason why I had to enable cookies permanently. My browser used to delete all cookies at the end of the session (when I closed the browser) except for a few whitelisted domains.
Then these notices popped up everywhere. So where do the sites store the information that you've already seen the notifications? In the cookies of course! So if you're actually serious about your privacy and delete cookies you will the the notices every time...
The reason that the EU cookie law broke down is that directly after the EU directive was issued, several lawyers from large companies changed their interpretation of an older 1995 directive that dictate how consent is given. The directive says that consent require "specific and informed indication", but lawyers from very large companies decided that the act of continuing using a website was the same thing as giving "specific and informed indication", thus users agreed to whatever policy or agreement that is linked in the banner.
I visited a conference during that time which had a panel where those lawyers was discussing this and even brought up a question if a person really could agree to 20 pagers of policy document from the mere fact of just continuing using the website, and their collective answer was yes (through one agreed that 30 pages would be too much). To my knowledge no legal case has ever tested this, and thus we got this ridiculous cookie notice system where things has gone from bad to worse after the 2002 directive.
Thank god, ehm, the lawyers: otherwise we would not just have annoying banners, every page would start with an blocking dialog. No thanks.
You assume that every page need to have tracking cookies or that a websites would choose to have a blocking dialog if that was required in order to store and accessing information on users’ equipment. Even if we do those assumptions, its not a good result for anyone and there need to be some peace rather than war between the industry and politics, and making the concept of consent meaningless is a very risky move going forward.
Hi HN, I'm the creator of this filter list.
If anyone can spare 5-10 minutes a week to help me and a couple of others maintain this list (testing and merging pull requests, closing issues, etc.), I'd be very appreciative!
You can contact me here or send an email to cookies[at]prebake[dot]eu
If an extension like Prebake (which I realize just a filter list) added a 'DNT: 0' HTTP header (Do Track instead of Do Not Track), then automatically dismissing cookie notices would be a "legitimate" new solution and not be "cheating" (as some might call it). If the user also runs a ad or tracker blocker, well, that's their business and a different problem. ;)
Could you explain what this would entail? You might get more interest if people knew in advance what they would be in for.
This is great not just from a user's perspective, also the fact that it exists helps pointing out the stupidity of the law.
I think they hoped this law would encourage sites that people don't expect to have cookies to not set cookies until necessary.
Like state sponsored news sites for example. I mean, really: why on earth does a site like that need to set cookies? To remember which videos I have watched?
The real problem here is probably Google Analytics.
I think law is fine and there should be only a handful of sites in the Internet that would need such warnings.
Problem is the abuse of technology to track users.
Even assuming that law was necessary (debatable), the idiotic thing was asking millions of websites to do this, instead of automatically in a handful of browsers. Not to mention absurdities like the fact that you need cookies to remember that the user doesn't want cookies, or even worse: https://twitter.com/jgrahamc/status/633551359774691328
Adsense have recently notified publishers that they need to implement a cookie law compliance solution.
I don't know how aggressively they [google] will have to enforce this but the possibility of losing adsense revenue will be a hugely motivating factor.
So the number of sites the need such warnings is about to increase massively.
> I think law is fine
I acknowledge some benefits of this law, but I vehemently oppose it from the perspective of freedom of speech. I know it's an american innovation, but I think other countries should adopt the same principle that code (and algorithms/protocols) should be considered protected speech. I don't like this law because it interferes with http protocol by dictating how the protocol should be used. EU should not curtail the speech of W3C and of any users of their protocol. If you created a popular protocol then other entities shouldn't suddenly and arbitrarily start dictating how users of your protocol should now use it.
EU should either create their own version of http or create their own client for http, which would be relatively cheap as they would only have to fork firefox or chromium and add sandboxing bound to domanins. Some infrastructure is already there with sandboxing in the form of incognito/private window, it only needs to be extended so that each domain is automatically in its own sandbox instead of just websites you open in incognito window.
The law does not require sites to put up giant banners for every page load. As belorn points out, this was caused by the interpretation of nervous lawyers and hasn't ever been tested in court.
Tried this before and it helps only so much. Many sites actually don't work before you accept cookies (they pose it as a requirement and tell you that cookies keep you logged in, even though the cookie law is only applicable to tracking cookies) so you need to see the banner before you can see the page. Examples: fok.nl and tweakers.net.
I've been using a different filter list[1] for more than a year, and it's really useful as I already use self-destructing-cookies[2] to exercise control over which cookies my browser will remember, meaning that pretty much all sites think I've never visited before and therefore try to annoy me with their cookie banner.
[1]: https://github.com/r4vi/block-the-eu-cookie-shit-list
[2]: https://addons.mozilla.org/en-GB/firefox/addon/self-destruct...
> meaning that pretty much all sites think I've never visited before
True, but also not True (unfortunately), because the websites can identify you anyway by your fingerprint: https://panopticlick.eff.org
It's depressing that we need something like this.
It seems uBlock (Safari 9) doesn't recognise this when i add it to the 3th party filters/custom URLs - when i click "parse" i don't get to see a new row with a checkbox. example:
this works: https://raw.githubusercontent.com/r4vi/block-the-eu-cookie-s...
this doesn't work: https://raw.githubusercontent.com/liamja/Prebake/master/obtr...
True, although it's already in the 3rd party list and you can just enable it there.
Well, this is just funny. Or sad, depending on how you look at it.
Personally, I'm annoyed by the cookie messages, but the law is supposed to help people.
Blocking (or auto-accepting) them is basically saying we don't give a shit about this law :-)
Cookies are integral to the operation of every modern website. They offer security in the form of features like csrf protection or maintaining login state between visits. There is sufficient protection for cookies in the form of encryption and a laundry list of further details which have been added over the years.
There are far larger security related concerns on the web. The cookie warnings are on par with if you had to agree with Javascript running on any page you visit in the EU. So, yes, I want to auto-accept.
As a developer I feel like I'm not going to make special considerations that ensure you can use forms on my website without cookies enabled. And I'm not going to find another way to detect and re-instate your login state.
It's a misconception that you need to show this warning if you use cookies. You only need to show it if you use tracking cookies. Which means Google Analytics.
Don't use GA and you don't need to show it. Your login cookies etc and anything "essential to the operation of the website" are all explicitly excluded.
The law is absurd, but it's not braindead.
This law aims to protect users from being tracked across multiple websites. There are exceptions in place and most websites would not need to display any message, unless they are in fact helping track their users.
If they include services like Google analytics they should absolutely display the message.
Yeah, from a technology point of view, they're necessary.
The law is half baked and passed only to appease people who worry about their privacy. And it really doesn't do much...
From my experience, most of the sites that have this warning only have a single button: accept. No way to disallow the cookies that get stored regardless of how you react to that popup. This will just save me a click.
There already existed a plugin for this https://cookiesok.com/, but it misses quite a lot. Hopefully this works better.
This law is so badly designed it is beautiful.
It warns users who don't accept cookies that the website uses cookies, at every connexion. It doesn't warn users who accept them that they're used, putting aside the first connexion.
It should be the other way around. The website should warn the user that a cookie is used when the website just accepted a cookie from the browser. The privacy concern happen at this very moment, when you phone back to the website, not when the website phones you information.