Europe's Cookie Nightmare is Crumbling (theverge.com)
- Reference: 0180143587
- News link: https://it.slashdot.org/story/25/11/19/189236/europes-cookie-nightmare-is-crumbling
- Source link: https://www.theverge.com/news/823788/europe-cookie-prompt-browser-changes-proposal
> Instead of having to click accept or reject on a cookie pop-up for every website you visit in Europe, the EU is preparing to enforce rules that will allow users to set their preferences for cookies at the browser level. "People can set their privacy preferences centrally -- for example via the browser -- and websites must respect them," says the EU. "This will drastically simplify users' online experience."
>
> This key change is part of a new Digital Package of proposals to simplify the EU's digital rules, and will initially see cookie prompts change to be a simplified yes or no single-click prompt ahead of the "technological solutions" eventually coming to browsers. Websites will be required to respect cookie choices for at least six months, and the EU also wants website owners to not use cookie banners for "harmless uses" like counting website visits, to lessen the amount of pop-ups.
[1] https://www.theverge.com/news/823788/europe-cookie-prompt-browser-changes-proposal
The EU is too busy making rules for everyone else. (Score:2, Insightful)
The EU’s escalating war on internet freedom and American tech companies is not about “protecting consumers” or “preserving democracy.” It is a textbook case of centralized power reasserting control over the greatest engine of voluntary exchange and uncoerced speech in human history: the open internet.
The EU’s flagship weapons: the Digital Services Act (DSA), Digital Markets Act (DMA), GDPR, and the emerging AI Act, function as modern mercantilism dressed in progressive
Re: (Score:2)
Not sure why you're being downvoted.
Your take on EU's DSA/DMA/KYC and what else is not wrong, but it started in the US with the PATRIOT Act(or even earlier?). The US drives the surveillance in pair with EU. The US does "full take" of internet traffic. Both parties suck.
Re: (Score:2)
> The EU’s escalating war on internet freedom and American tech companies is not about “protecting consumers” or “preserving democracy.” It is a textbook case of centralized power reasserting control over the greatest engine of voluntary exchange and uncoerced speech in human history: the open internet.
> The EU’s flagship weapons: the Digital Services Act (DSA), Digital Markets Act (DMA), GDPR, and the emerging AI Act, function as modern mercantilism dressed in progressive rhetoric. They impose sweeping prior restraints on speech (“illegal content” and “disinformation” defined by unelected bureaucrats), mandate interoperability and data-sharing that expropriate private intellectual property, and levy punitive fines (up to 6-20% of global turnover) that only entrenched European champions like Deutsche Telekom or Orange can hope to influence through lobbying. Smaller innovators and American platforms that refuse to build EU-specific censorship infrastructures are simply gated out.
> Brussels resents that the internet’s infrastructure, protocols, and dominant platforms emerged from American libertarian soil; rooted in end-to-end principles, permissionless innovation, and First Amendment culture, rather than from continental traditions of étatisme and "licensed speech". When Meta, Google, or X push back against demands to pre-screen political content or surrender encryption keys, EU regulators do not negotiate as equals; they threaten existential penalties, knowing most companies will kneel to protect European revenue.
> The EU is hostile because a truly free internet is inherently anti-hierarchical and anti-border. It routes around sovereigns the way markets route around central planners. To Brussels, that is an existential threat that must be regulated, fragmented, and ultimately re-sovereignized under the banner of “European digital sovereignty” :a euphemism for cartelizing information under state-supervised oligopolies. Internet freedom and American tech dominance are merely the most visible casualties.
Quality post and should not have been modded down, simply because it is an unpopular view.
Re: (Score:1)
Easier to downmod than to debate. Slashdot is becoming a left-wing echo chamber and, because of this, has been fading for years. Any day now I expect to see it bought and replaced with a bunch of flashing banner ads.
Re: (Score:2)
It's not just Slashdot. It's Reddit any where else with user moderation. The left wing of the world dominates these sites and silences any belief that does not correspond to their own.
Re: (Score:1)
Yep. 100%. Reddit might even be worse. Wherever their are mods, there are censorious communists wanting to abuse them to prevent any real discussion.
Fck the EU (Score:2)
They screwed it up the first time, now they are doing it again. There are already http headers for do not track and it is a standard. Just force websites to respect that under threat of enormous penalties, that is all that is needed!
Re: (Score:2)
> There are already http headers for do not track and it is a standard. Just force websites to respect that under threat of enormous penalties, that is all that is needed!
Of course, they can make that as annoying as heck too. In fact, during the past few weeks I've visited multiple websites that have apparently decided it's a good idea for them to tell me (via a raised notification I have to manually dismiss) that they are honoring my browser's enabled "do not track" setting.
Re: (Score:2)
Forget cookie consent, now they will just force sites to verify your identity and record your explicit consent to be tracked, while also tying this to your national identification number and keeping these records for 7 years.
This Was Already Possible (Score:3)
> Instead of having to click accept or reject on a cookie pop-up for every website you visit in Europe, the EU is preparing to enforce rules that will allow users to set their preferences for cookies at the browser level
This was already largely possible thanks to add-ons, which actually prevent the browser from ever sending cookies to that domain unless I explicitly authorize it. That's vastly preferable to the EU method of specifying which cookies I want to send and then hoping that the web site abides by that preference instead of just collecting everything due to a "bug that affected a small number of users".
The problem with the EU approach to cookie management is that every fucking web site throws up a banner that they collect cookies and then asks for your cookie preference. And the answer to that question is saved... in a cookie! So when you block all cookies to that domain using an add-on, you get that banner on every...fucking...page. This is an objectively worse experience than I had before and I don't even live in the fucking EU!
It is completely avoidable (Score:1)
> cookie consent policies have been an annoying and unavoidable part of browsing the web
Just don't track your users can send the data to a gazillion other parties. (Or let shady companies like Google or Facebook do the tracking if your visitors for you.)
Welcome back Do Not Track header (Score:3)
People can set their privacy preferences centrally -- for example via the browser
DNT was proposed in 2009, implemented by most browser within a couple iterations. Microsoft famously poisoned-pilled their implementation to kill it by making it the default, which gave advertisers an excuse to claim people didn't really mean to set it, and ignore it.
It always needed the force of law to work.
Note that I am fully confident that the fine professionals in the EC will find some way to make this stupidly intrusive and annoying as well as cost a crazy amount of money to implement. I believe in them.
Re: (Score:2)
I think Microsoft gets too much blame for this. The assumption that most users won't want to be tracked is not that far off and they asked them and just included a user friendly default. The advertisers just looked for a reason to ignore it and that was the first one in reach. If it wasn't for Microsoft, they would have found some other reason why they ignore DNT.
Re: Welcome back Do Not Track header (Score:2)
The problem with DNT is that it's too generic and that it's just a voluntary convention, not enforced in any way.
Because it's called Do Not TRACK, it allows companies to wiggle out of any rules. Is performance measurement tracking? Is screen capturing for session replays tracking? Is it? Is it?? Well, you say yes, we say no. We'll see you in the court of law in 10 years.
Easy get out of jail card. Too easy. Even if it was respected at all (it's not).
Re: (Score:2)
> Microsoft famously poisoned-pilled their implementation to kill it by making it the default, which gave advertisers an excuse to claim people didn't really mean to set it, and ignore it.
This is bullshit.
First, do you realize what a ridiculous kind of "standard" DNT is? Advertisers promise to honor it, as long as users promise not to use it. This is a real life Catch 22, and nobody should defend it.
The issue is worse though: the DNT "standard" wasn't ever intended to stop tracking. It was intended to sabotage other proposals submitted to the W3C who would have had an impact on Google's bottom line. From this point of view it succeeded brilliantly.
At the time tracking was considered an impo
Websites "must" respect them (Score:2)
I hope by "must" it means that browsers are going to enforce it.
Why do the websites have the authority in the first place to tell your browser what cookies to store? This is 100% on browsers to restrict what websites can do with cookies. Websites should be able to do anything they are allowed to do. Malicious websites are not going to respect any legal rules.
Re: (Score:2)
> Why do the websites have the authority in the first place to tell your browser what cookies to store? This is 100% on browsers to restrict what websites can do with cookies.
Firefox has offered this ability for, like, 20 years. And, 20 years later, it is still the only significant browser to do so.
Safari does block third-party cookies by default - which is certainly a good thing, but still not quite there.
Re: (Score:2)
A good browser will claim to go ahead and store the cookie, but not actually store anything.
Don't even bother with the whole permissions thing at all.
And how will that happen? (Score:2)
> "People can set their privacy preferences centrally -- for example via the browser -- and websites must respect them
And how exactly will that happen? Will preferences be set at the browser level for doubleclick, google, etc? Do we expect joe sixpack to understand how to do this?
I'm not sure this is any better.
Re: (Score:2)
"Joe Sixpack" might be a nuclear engineer, brain surgeon, or astronaut - i.e. much smarter than you or your typical code monkey - who just doesn't care about the details of the OS, and just wants a simple solution to his annoyance.
Insulting them and thinking because you know how cookies work and they don't makes them an object of derision is why IT and computer people are held in such low esteem.
Grow up, script kiddie.
No Cookies Needed for Most Website Usage (Score:1)
Unless you need an exception to a web page's stateless protocol, no cookie is needed. Tracking you is likely not what the W3C had had in mind, when they created XHTML, XML, HTML. all from SGML. You have been falsely been taught to believe that tracking is necessary to load the simplest of webpages. Basically, unless it's something that you need to log in for, no cookie is likely needed. BTW, tracking is not advertising; to refuse to be tracked--does not mean that you are blocking ads.
Only cookie nightmare is NO cookie! (Score:2)
Me love cookie!!! Om nom nom nom...
Website must respect them...right. (Score:2)
I am sure all of those non-EU website will respect the hell out the cookie policy. I imagine most major international companies' sites will. But outside of that, good luck with enforcement.
Re: (Score:2)
Look at which sites have cookie banners for EU users. They obviously care. The idea that the EU would not be relevant is simple and mostly wrong, because you would need to stop all business in the EU, what many sites can't do and won't want to do.
Malicious compliance (Score:2)
Whenever a government tries to force companies to do something they don't like, companies respond by doing it in the most cumbersome and awful way possible, hoping that the public will get so angry that they force a change in policy
Completely wrong framing (Score:3)
The law never demanded cookie banners.
The law demanded you not to store personal data, except you need it to provide the service for the user.
This means your login cookie does not need consent, neither does storing the e-mail address at newsletter signup need a banner (because the sign up button agrees to the use of the address if it is only used for the newsletter).
Why are there the banners? Because they tricked you! The users clicks the banner, in the best case for the site owner with "accept all" and then the site owner argues "The user WANTED to be tracked".
The peak of this is the pay-or-okay pattern in which a website provides a pay option (often more an alibi option to be able to use pay-or-okay without relying on making money with the pay option) and full "consent" as alternative to paying. While the usual banner must provide opt-out options, the pay-or-okay banner doesn't have to. If you click "Agree to tracking to read for free" they claim you had the choice to get the same content without agreeing, as they are allowed to charge for the content.
Is the nightmare crumbling? No, the privacy is. The proposed changes will weaken the privacy law and allow to use data under certain circumstances without user consent. So you may indeed see fewer banners, but that only means that they are now allowed again to sell your data without asking.
Finally, will you see fewer banners? That's unlikely, because the tracking ad model is so technically and legally complicated and involving literally thousands of companies, as your visit decides which companies will show you ads without the site owner knowing before which ones will be chosen, that it would be a large legal risk for site owners not to keep using the banners they are using now.
The possible outcome: You see the same banners, but have fewer opt-out options and certain companies claim they have "legitimate interest" and similar reasons to get your data even if you never receive any benefit for it.
And there is already a technical opt-out, which is *ignored* by the tracking companies: [1]https://en.wikipedia.org/wiki/... [wikipedia.org]
Do you really think they will follow the new one? If it is legally binding, the new "consent" banner will read "Please instruct your browser to allow tracking", or they will try to have banners "Your browser disallows tracking, but as we provide valuable service you want to agree to *our* tracking nevertheless, don't you? Please click 'ignore my browser options and agree to all' to continue".
The only option to end tracking is to make it illegal to use the data. Let's say advertisers are forbidden to personalize ads. Every user needs to get the same ads (which are allowed to be tailored to the content shown). Then companies would stop paying for data and so would advertisers stop demanding site owners to collect data and they could remove the cookie banners, because cookies (and other tracking) would no longer be necessary for the advertisers to pay in full.
[1] https://en.wikipedia.org/wiki/Do_Not_Track
Re: (Score:2)
Alternative to end forced consent: Enforce the *informed* part of "informed consent". For each tracking service the user agrees to, the "save my choices" button needs to be delayed by another 10 minutes the user will need to actually read the privacy policy (and most privacy policies and their legalese would need more time) to be able to give *informed* consent. With the usual 200-1000 tracking companies that want consent, the cookie banner would be infeasible.
Simple setting is all we need (Score:3)
1. Disable all 3rd party cookies. Permanently.
2. Always allow strictly necessary cookies only.
That's it. That's the only setting we need.
Just get an extension (Score:2)
f.ex. "I don't care bout cookies", like everybody else did after the 100th click.
People seem to have forgotten.... (Score:2)
The original idea of the legislation was that tracking should be forbidden.. Then some smart corporate lawyers said "but what if people want to be tracked?" - OK then but they have to give explicit consent... Fast forward and we have "consent or pay to opt out" and "by looking at this page you consent to us spying on you for whatever purpose we want and exploiting the resulting data in any way we please" - ok the second one is made up...
Finally⦠(Score:4, Insightful)
It took 18 years of pointless clicking for bureaucrats to finally notice that they chose the worst implementation possible of cookie control.
Re: (Score:2)
It was never even about cookies to begin with, it was about preventing tracking without consent. So they just incentivized big tech to switch to a different tracking technology and didn't address the real problem. Go figure.
Re: (Score:2)
Track me without my consent! I don't give a fuck!
Re:Finally (Score:1)
> Track me without my consent! I don't give a fuck!
...
Mom's basement
...
Mom's basement
...
Mom's basement
...
Re: (Score:2)
Nope. Sitting in bed at home. Been here all day. I will here all day tomorrow too. Thursday will be more of the same, except when I go to a doctor appointment. Real exciting stuff.
Re: (Score:2)
> Track me without my consent! I don't give a fuck!
I don't consider myself to be an important enough person for any corporation to care what I do online or IRL. I don't use any ad blockers or block any cookies, in the hopes that they'll harvest enough data to start serving me ads for things I want to buy. (They don't.)
Re: (Score:2)
Same here. You want to track me? Have at it.
What are you going to learn? Well, today:
I sat home all day.
On-line, I looked at the same ten or so news websites I look at every day.
I spent about 90 minutes trying to defeat Karne in Baulder's Gate Dark Alliance, still with no success.
I read a few random Wikipedia articles
I searched for and read a few webpages on how to defeat Karne, not finding anything useful.
I sent a few messages to my wife, asking her to make some chicken noodle soup for lunch, telling her t
Re: (Score:2)
In fact, the intention was not to stop tracking. The EU’s “cookie law” (formally the ePrivacy Directive of 2002, amended in 2009) was originally aimed at preventing unwanted software and data being stored on users’ computers—especially malware from driveby downloads. However, the EU law was drafted so poorly that it inadvertently covered cookies as well. Only later, at the national level, were (tracking) cookies explicitly brought under its scope.
Must say I haven't seen cookie
Re: (Score:3)
Isn't it nice having politicians insert themselves on technical issues for the users? I know that I really love it.
Re: (Score:2)
> It took 18 years of pointless clicking for bureaucrats to finally notice that they chose the worst implementation possible of cookie control.
Getting policy right is hard. Sometimes you need to prepare a mindset change or test out an approach, though certainly there are things that fail miserably due to unintended consequences. See this like developing software, but instead it is policy.
What will be interesting is how long before the W3C comes up with a solution that can work across browsers and websites, and then how long before it gets adopted by browsers and websites.
Re: (Score:2, Insightful)
Wrong. The EU's cookie policy is only annoying because advertising companies are deliberately making it annoying.
The GDPR does not mandate cookie notices. Cookie notices are malicious compliance by the surveillance-driven adtech industry.
If you are not tracking people, you don't need a cookie notice. Period.
If you are only using first-party cookies for functional reasons, you don't need a cookie notice. Period.
If you are using third-party cookies to track people and share their data with others, th
Re: (Score:2)
Well written! Why on earth didn't you post it under your own username? Oh wait...