upvote

points

by louthy13 hours ago |
comments
upvoteby stingraycharles12 hours ago|
next
[-]
And there was an initiative to include tracking preferences in browser HTTP headers, which never made it, as it was quite obvious that this would lead to a lot of people opting out.

Better to just harass them into a habit of dismissing the banner.

reply
upvoteby darkwi11ow12 hours ago|
parent|
next
[-]
Well DNT indeed did not made it, but there is global privacy control header that is nowadays required as explicit opt-out mechanism by CCPA and some other states legislation. I always implement support for GPC in my products.
reply
upvoteby stingraycharles12 hours ago|
parent|
[-]
Never seen this offered to be set by any browsers, though.
reply
upvoteby jsmailes11 hours ago|
parent|
next
[-]
Firefox offers it: https://support.mozilla.org/en-US/kb/global-privacy-control

They don't seem to call it GPC, but their "ask websites not to track" feature now uses it instead of GPC.

reply
upvoteby hiccuphippo8 hours ago|
parent|
next
[-]
I wonder how many websites use that header as part of their fingerprint mechanism.
reply
upvoteby stingraycharles10 hours ago|
parent|
prev|
[-]
Yes ok, and Firefox was also the only browser that offered DNT, which is why it pretty much died.
reply
upvoteby flaburgan9 hours ago|
parent|
next
[-]
It's the complete opposite. What killed DNT is Microsoft adding it to their browser and set it to true by default, pretending they cared about their users. Doing so, it was not the expression of the users anymore and so web developers ignored it, and so it died.
reply
upvoteby FabHK9 hours ago|
parent|
[-]
Sorry, that does seem like a reasonable default. This is the fault of web developers to not respect it, not Microsoft. Nice cope.
reply
upvoteby weberer10 hours ago|
parent|
prev|
[-]
It died because companies had no incentive to respect it. The writers of the GDPR could have easily added a single line saying you had to respect the DNT header, but they chose not to.
reply
upvoteby darkwi11ow11 hours ago|
parent|
prev|
[-]
It's set on by default in "privacy browsers" like Brave or Zen, but off by default in most mainstream ones -- user needs to set it on explicitly via about:config
reply
upvoteby busssard10 hours ago|
parent|
prev|
[-]
There is also https://killthecookiebanner.eu/

if you write to your reps, they might just change that. The Eu is one of the few democracies left. Slow but powered by the people

reply
upvoteby xingped8 hours ago|
parent|
[-]
I dunno man, from an outsider's perspective I used to think that but it seems to slowly be getting worse with trying to shove through internet surveillance and corporate protectionism under the guise of "protect the kids". I guess sadly someone saw how unreasonably effective that can be in the US.
reply
upvoteby johannes12343219 hours ago|
prev|
next
[-]
When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.

The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.

I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.

reply
upvoteby eli7 hours ago|
parent|
next
[-]
Legitimate interest definition is pretty narrowly scoped. Most of the sneakiness relies on nobody checking or enforcing it.
reply
upvoteby buzer6 hours ago|
parent|
prev|
[-]
You are confusing GDPR and ePD. Legitimate interest is GDPR legal basis for processing personal data (it has it's own requirements). ePD triggers when you read/store e.g. browser data and make it available via network. Consent is the primary ePD legal basis and the exception related to that is much narrower (strictly necessary for ISS provider to provide service requested by user).

Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).

reply
upvoteby SilasX4 hours ago|
prev|
[-]
I know it's tempting to put this consent-banner anti-pattern all on toxic ad-driven platforms, because their motives are bad.

The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.

At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!

reply