Pretty much any machine generated variations can also be defeated automatically by a machine. If defeating your filters takes a lot of work, and only helps until a few days later you update your filters in a few minutes, nobody is gonna bother.

Which whould break CSS minifiers, but that's the point.

##div[aria-label="Timeline: Trending now"]

Even better: draw everything in a canvas.

https://medium.com/@jacob.tan.en/floating-elements-on-web-pa...

So I would say the filter works pretty well, I didn't get a single popup of any sort ever since.

Yes, I sometimes get some real content removed. If something looks strange, I temporarly deactivate uBlock. Last time it was a GDPR checkbox at a store checkout.

It’s amazing how much of a difference this makes. I was starting to find the web so hostile. Every page an annoying battle with cookie pop ups.

I am so genuinely happy

Practically I assume most of the sites are breaking the law, because that's how I expect webdev's to think and because most of the cookie banners aren't nearly up to spec to satisfy the law so I assume they aren't being that careful.

Further reading: https://www.dataprotection.ie/en/news-media/publications/rep...

What I wonder is, if you're not going to bother being properly compliant, why bother adding a GDPR banner at all?

You don’t need to be compliant, just more compliant than the worst.

The lawmakers do understand that, you are allowed to use sessions and cookies for essential tasks like tracking login state, and no popup is necessary in this case.

I wouldn't be shocked if you are correct and many devs are indeed completely ignoring the legal requirements here, but that may be in part due to developers not understanding the legal requirements or believing incorrectly (as you seem to) that the requirements are not technically feasible.

A simple, GDPR compliant solution would be a tickbox for "remember me across visits" next to the login form. If ticked you get a persistent cookie, if unticked just a temporary session that goes away when the browser is closed. No popup is needed.

If login Cookies are allowed, and your login site already has your profile hence your Ads preference. Why do they still need to use cookies banners?

..while their ads preference dialogue has pre-checked options which is clear violation of GDPR...

GDPR only applies to non-essential tracking & advertising cookies. Login cookies are always allowed, and you don’t need a banner to state that you use those.

If the site's using a common framework, convenient and essential uses will be combined in a "session id" cookie which needs re-developing, or just slap a cookie warning on it.

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

Law is fuzzy by nature, but it seems pretty clear that a shopping cart cookie is exempted from needing consent. Functionality of services that are expressly requested by users do not need consent, and in this case we have users that want to put items inside a cart in order to buy it. If that creates a profile on the server, and that profile is combined with other information, and then used outside the scope of the customer relationship, then we are moving into the area where consent is needed.

We can draw a parallel to data collected offline. A person go to a store and talk to a sales representative about buying a product and having it shipped home. At what point do the sales person need to ask for GDPR consent? The answer is likely the point where the sales person saves a profile of that customer on the computer, and the profile is intended to be used outside the context of that purchase.

Indeed, there should be an enforced UI, but that’s not how the EU tends to regulate on privacy, and without EU regulation none of the companies currently trying to entirely ignore the GDPR will use it. They have put out guidance that some current attempts at pretending to comply are illegal, and I expect to see fines regarding that in the next couple of years - the difficulty is creating a solid case that isn’t going to undermine the GDPR through case law. I wonder, though, if there were a dirt simple API for consent in the browser, whether independent developers who would honestly like to comply would use it.

https://forums.lanik.us/

The publisher is trying to adhere to a law (for better or for worse) by giving the user visibility into technologies and data usage.

A plugin hiding that by default can lead to all sorts of nastiness.

* Pause your blokcer

* Reload the site and accept/deny cookies

* Resume your blokcer

Right click on ad / pop up -> Block Element ( a rule is automatically generated ) -> Create. Voila ! You might have to do it 2-3 times for the same element as it might have several layers. But then you're done and you haven't been forced into clicking "ok"

( With uBlock Origin )

The solution? Cookie consent should be a built-in feature of browsers and http, not something that is reimplemented in a slightly different way by every single website.

Your browser should pop up a standardised cookie consent request when you browse a new site, and enforce your selection as part of its security policy. If you choose to block all cookies (ie: private browsing mode) then the cookie consent request wouldn’t need to appear at all.

It goes to show what the real world incentives really are. The only way to get this fixed is to more specifically regulate user tracking and online advertising by tracking. There will be people who decry this, but the advertising industry has brought this on itself.

The whole world shouldn't have to deal with the burden of one bad decision from EU. There should be a way to petition this. Imagine if this had happened due to a decision by some country like China.

I think it should be "Oops, this hasn't worked as planned and has been abused, let's try Y instead now"

Some of the most ardent proponents of GDPR have been quoted as saying that implementing its requirements is so easy that they themselves could do it and that people simply should stop complaining.

Further than this, the corporations that are tracking us actively would like you tell you they don't care about DNT, and they've no obligation to respect any DNT user[2]: "The DAA does not require companies to honor DNT signals fixed by the browser manufacturers and set by them in browsers. Specifically, it is not a DAA Principle or in any way a requirement under the DAA Program to honor a DNT signal that is automatically set in IE10 or any other browser." This is point blank saying that DNT may as well be used as another way for you to be tracked, from one of the biggest places for advertising online. This is an international discussion; it's not just companies in the US[3] that feel this way either.

[1] https://lists.w3.org/Archives/Public/public-tracking/2018Oct... [2] https://digitaladvertisingalliance.org/press-release/digital... [3] https://youradchoices.com/participating

Didn't we have that from day 1? A browser is free to disable cookies.

The EU laws are more concerned about the intent of the cookies. Are they functional cookies or tracking cookies designed to reduce user privacy.

The people working on any given law (regulation) tend to be well-informed, and so are the parliamentarians that take lead roles on an issue.

Part of the problem here is that websites are less-well informed on the law: session cookies, for example, do not require a warning IIRC. But many websites using only those needlessly ask for permission.

One mistake in thinking by lawmakers was to assume that websites would chose to forgo third-party and long-lasting cookies in cases where they are of marginal utility. This obviously didn’t happen, partly because everyone started using cookie warnings and they therefore became normalized.

It should be noted that unlike the previous iteration, the current warnings ask for consent and tend to include a not-too-difficult-to-reach option to deny it.

I believe many people (and parliamentarians) that are passionate about privacy issues would also argue that the current situation is still better than quietly using your data. If you value privacy high enough, it rather quickly outweighs any annoyance, even if the latter is far more prominent in daily life.

Like most of the laws sponsored by these lawmakers they are technically useless and act as little more than a hook to allow various governments to arbitrarily penalise companies they don't like.

Literally no one voted for an MEP hoping for regulation of cookies on their browsing.

The commissioners vary widely in competence both generally as well as in relation to their portfolio. There are legitimate superstars such as competition commissioner Margrethe Vestager. People disagree about some of the targets of her investigations. But even her worst critics are apt to lament her ability to get thinks done rather than doubt her skills.

Then, there are commissioners decidedly lacking in competence, at least in regard to their portfolio. Günther Oettinger is a prime example here, and he was bound to head the digitization portfolio but was thankfully booted from the commission by von der Leyen taking up the German spot. These are usually long-time politicians who for some reason or other make an awkward fit for any national position, but are still too powerful within their national parties to be ignored altogether.

Then, there are actually corrupt lowlights. There are far fewer of these than people assume. Look for a Maltese flag to improve your chances if you’re looking for them.

Of course all of them have staff, which does the actual heavy lifting of writing bills (among other things). I hesitate to judge their skills on any absolute scale. But, purely subjectively, I’d say these teams are at least as good as any delegation from Germany, which are generally regarded as top-notch, but in my experience often carry along some bad apples they can’t get rid off because of tenure or whatnot.

I don’t know the people who worked on GDPR. You can expect them to have the internet skills of any 30- or 40-year old high performer, with a degree in law or the humanities more often than STEM. So they are unlikely to have programming experience, but do probably know what cookies are.

I’m somewhat struggling to come up with examples of technical knowledge that may have been missing here. In fact, I could probably summarize everything I know about cookies in less than five minutes. And while I probably lack some details, I doubt it would include anything of relevance to this legislation.

The GDPR requires consent for tracking technologies for non-essential purposes. It can be cookies, but is not limited to them. Local storage or browser fingerprinting fits the bill as well.

Moving the cookie consent management into the browser won't fulfill the intent of the law - sure, cookies are now disabled by the browser, but what about fingerprinting or server logs? A compliant site will still need to ask for consent for those.

When it comes to user experience, the regulation explicitly sets rules around how you ask for consent. Consent should be freely given so that users are not forced to opt-in (you can't force them to accept, so cookie popups where opting out is not possible or "by using this site you agree to our use of cookies" notices are not compliant). Tracking should also be opt-in, so pre-ticked checkboxes or where the flow to accept is easier than the one to decline (one click to accept, several clicks to decline) is not compliant either.

Finally, functional cookies such as for shopping carts or logged-in user sessions are explicitly allowed without requiring consent nor disclosure.

The problem here is not the design of the law but the lack of enforcement of it. All those obnoxious sites where you'd want to ad-block the consent popup are not compliant by default and should be fined. If the law was enforced we'd quickly see changes around this and consent popups would become unobtrusive.

Quote:

> This puts browsers in the direct path of legislation in any given country’s demands. Features in browsers should be based only on user needs. Only when a law absolutely targets browsers should they do anything regarding legislation.

[Edit] remove the code block

https://www.i-dont-care-about-cookies.eu/abp/

Also on that same page you can enable some of the 'Annoyances' filters. Just be aware that some of them block social media buttons (FB/Twitter like/follow embeds), which you may not want.

Of course, practically speaking it doesn't just "happen" to block ads; that's a major motivation for its development, and so we usually just refer to it as an ad blocker.

To answer your question directly: if you want ads and no cookie popups, disable the ad lists and enable the cookie popup list.

Yes, at that point you may as well just install the other addon, but the uBlock method preserves a key advantage: the ability to combine multiple cookie popup block lists. This is useful in case several people are making lists that cover different corners of the internet.

I think that if I'm visiting a website and using its bandwidth, the website ought to get paid. If the ads are too egregious, then using the website isn't "worth the cost" and I go to a different website.

I do however pay for Scroll[1], and I use Firefox's Enhanced Tracking Protection. Due to the latter, many websites think I'm using an adblocker and complain, which really irks me.

---

1: https://scroll.com/

Only when you make a purchase based on an ad are you supporting anyone. At that point you should just buy the better product and support the website by sending them money instead of buying a shitty product that has advertising priced in.

Example website for which blocking the cookie popup does not work with uBlock Origin: https://tweakers.net/

I tested on Ubuntu and macOS with the latest Firefox (clean profile) and Chromium and i get the cookie popup/wall, even with ALL default uBO filter lists enabled, and also with the IDCAC list enabled in uBO. Screenshot: https://imgur.com/jcr4EuP

However i just tested with https://www.browserling.com/ which uses Windows 7/Internet Explorer 11 and here i do not see the 'cookie popup/wall' but instead i see a blue 'cookie banner' (which is easier to block with uBO.)

Ghostery doesn't have as many bells and whistles, but it does greatly minimize the main annoyances out there, and it doesn't slow anything down noticeably.

It might all be a moot point by this time, since Youtube has changed how they load in such a way that it stutters no matter what because it is so busy downloading absolutely every item on a page all at one time instead of prioritizing the video stream like it did about a decade ago (back when you could pause a video and it would download fully even while not yet playing, thus avoiding the bottlenecks altogether...).

Ironically that puts me back to pausing everything first just to give all the useless off-screen crap enough bandwidth to load without ruining the video experience.

No matter how much faster technology gets, they find a way to make it more and more sluggish every time.

Not recommended over uBO.

https://en.wikipedia.org/wiki/Ghostery#Criticism

Since Youtube chokes anyway nowadays (I did manage to stave it off for a few years), I might as well go back to uBO.

(Disclaimer: I worked there at the time)

If uBO is really responsible for this, you should probably check the box "Ignore generic cosmetic filters" in "Filter lists" pane. For instance, this is the default in Firefox for Android, I consider it's best for less powerful devices.

But now it'll be hard to tell, because Youtube has changed the way it downloads stuff in the background without prioritizing the stream. uBO definitely blocked a whole lot more noise than Ghostery does.

To argue that this leglislation would've had a good effect in some hypothetical alternative world where businesses had different incentives is beside the point!

(Side note, if it were not for govt investment in the dentralized, open internet, we'd probably all be using some ungodly-advanced version or America Online. So I'm certainly not advocating govt has no place in tech!)

Websites don't have to put a cookie banner for every kind of cookie. They have to show it whenever they collect identifying data about you. If they choose not to collect info on their visitors, then they don't have to put a banner.

- Customer: We must still implement that cookie popup before launch!

- Me: No. You don't have to. If we just disable SomePerformanceMetrics and GoogleAnalytics, we're done: we don't need a pupop.

- Me: who is using the performance metrics ATM? And who is acting on GA? How do you use them? Would this (shows three really neat Log-analyzers as alternative) suffice?

- Customer: We don't use them yet. But we might want to in future. And we then we might need all that data. So we want to start collecting it now.

Point is: you don't need Google Analytics, you don't need any of those 20+ tracking cookies if you actually look at it. But there's a lot a FOMO, combined with "but this is how we have always done it, so shut up".

There are some rare cases where GA, new-relic, tagmanager etc are really nessecary and none of the privacy-friendly (ie no-cookie-popup required) alternatives cut it. But those are rare. I daresay that a vast majority of tracking cookies is just there because the developers/business is too lazy to take a serious look at the problem.

Which is why I truly welcome more legislation that turns "collecting vast amounts of data" from "free" into a real and looming liability.

And yeah, doesn't work for all sorts of things, but as a site operator I would be careful in giving away that information out of self interest already ...

https://developers.google.com/analytics/devguides/collection...

You mean... no opt-in popup is required for logfiles? Isn't it also PII? IP + browser + timestamp + referrer? It's almost enough to identify unique visitors.

GDPR could have added a law against misrepresenting the profiling under the umbrella of a "cookie consent", but that would just be Whac-A-Mole legislation. Companies would just wrap the consent banner under some under pretense.

A govt legislation that would actually work in practice would be to ban the practice of collecting and selling personal data. No consent, no popup, just a law making it illegal. That would have the desired practical effect and no annoying banners would ever be written. It would also be much harder politically to get accepted and people would complain that EU are draconian for not allowing consenting adults to go into an agreement where they trade personal data for service.

Personally however I would prefer if EU did just that. Ban it. Make databases of personal data toxic to have and the liability if anything leaks be high enough that in practice a company like a news papers will do something else in order to earn profits.

The reality is even worse. The site operators would have to say "we want to give your data to google and others so they can create a profile of everything you do online."

If an individual site would track how one navigates their site and see click paths that might be tolerable to some degree. (Till they use that to increase dark patterns like booking.com's "only 2 rooms left and 5 people looking at this") But giving it away, into central databanks is baaaad

Liability doesn't work with a lack of enforcement.

Doesn't the 2009 ePrivacy directive exclude "strictly necessary" cookies [1], not "non-tracking" cookies? Like GDPR, I think no website wants to be the first to test what falls under "strictly necessary", under the EU directive and every country's specific implementation.

They really should have listed specific exemptions on the directive. Here's hoping that the new ePrivacy regulation will have them and/or just repeals the cookie popup.

[1] https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies

Cherry picking an outlier, then attributing one side of the relationship as completely as fault and sarcastically implying it's generally representative isn't an honest depiction of reality.

I've seen lip service to this clear misrepresentation of reality my whole life. I don't let it slide anymore. We can do better.

What corporations don't have is any obligation to cede to the public demand or be held accountable for their actions. There's no democratic control, no way they can be fired by the voter nor do they have any responsibility of transparency.

Voting systems, red light cameras, municipal water, nearly every aspect is controlled by private corporations shirking responsibility oftentimes for decades. Polluting a town's water supply and walking away pretending they didn't - there's even many well known movies about things like this with academy awards. Often the criminals get away with it having hid under the legal fiction of the corporation.

If a secretive unaccountable private corporation determining the outcome of an election and claiming the audit trail is a trade secret doesn't ruffle your libertarian feathers then there's something seriously wrong.

What you claimed is yet another silly thing I've been hearing my whole life. It's totally wrong. Any inspection would immediately reveal this

How well has that whole accountability thing worked out for the police department and the American military? The justice system?

There's no democratic control, no way they can be fired by the voter nor do they have any responsibility of transparency.

Nor can judges with lifetime appointments.

Voting systems,

Where conservative states consistently disenfranchise minority voters by closing polling places, passing voter id laws but then make it harder for minorities to get an ID and they count gun registrations as valid Id but not college IDs...

Polluting a town's water supply and walking away pretending they didn't

See the government run water supply in Flint Michigan.

Still, why corporations are internally so much better by nature than governments, in that world-view, I don't see.

The oil wars were done for the oil companies

There isn't this mysterious firewall between government and business. They're different departments of the same thing.

Nor is there any mutual exclusivity. The absolute dictatorship of Pinochets Chile is also where the most radical forms of Milton Friedman's free market capitalism was tried.

They're two interacting institutions of power that can exist in many forms. Free business doesn't guarantee free societies.

There is no silver bullet

Humans can be real bastards and governments aren't magical solutions just as corporations aren't magically evil.

The question is about who can be held more accountable, who can be more feasibly removed from power and what kind of institution can be more promptly remedied.

We as moral actors could potentially change the laws of governance probably far easier than we could form a corporation to defeat ExxonMobil in the marketplace. Both should be easier, but that's another discussion.

Both governance and private capital are imperfect and both deserve criticism. Being a fan of either is a mistake.

https://www.ewg.org/agmag/2018/05/thank-you-subsidizing-smok...

How many decades did it take the government to rule that it was discrimination not to allow gay people to adopt kids? Get pregnant by in vitro insemination? If you aren’t in the affected group it’s easy to tell those who are to be patient.

Mine is there's endless propaganda depicting corporate America as bright shiny perfect perfection and government as slow clunky incompetence and I'm really really tired of the bullshit.

It's not academic, it's not scholarly, it's mindless partisan cheerleading, some kind of religious orthodoxy, a blind adherence to something that's obviously nonsense.

It's just endless streams of nonstop crap from places line heritage, hoover, heartland, aei, cato, they're overflowing bullshit factories. Enough of that nonsense already.

Governments do incorporated things and corporations do governance - they are different structures of cultural institutions that interact with each other all the time.

Given a choice between trusting Big Tech and Big Government. I trust Big Tech a lot more.

Non anecdotally, who were the first to recognize the rights of LGBTQ? The government or Big Tech?

When do you want to start this? Maybe 20th century instead? The October Revolution in 1917, Poland 1932, Denmark 1933?

Oh you're talking LGBT protected class discrimination for employment! Pennsylvania, 1975, Wisconsin 1982?

Maybe you're talking about Bostock v. Clayton County(2020) which got to the SCOTUS because a private corporation, in 2019, fired an employee for being gay. That's how it got there, a private company not respecting LGBT rights.

So maybe you mean the courts? When was the first case in lgbt's people's favour? One, Inc. v. Olesen 1958. Nineteen fifty eight.

So yeah, probably government. Feel free to move the goalposts around if you want. I'm pretty confident on this on wherever you decide to place them

This is less true than you might realize. Consider that if a friend of yours is on Facebook, they might upload photos of you and tag your name, allowing Facebook to build a profile of you regardless of whether you use Facebook or not.

Consider that credit rating agencies buy your loan history in order to rate you as a customer, regardless of whether you check your credit history with them or not. Consider that Google buys your credit card purchase history to build a profile of you.

Consider that Google takes pictures of your house regardless of whether you search for it on Maps. Consider that GM and Ford collect and sell your location data from your vehicle. Note that vehicles that don't do this are getting more difficult to obtain because the price of vehicles is becoming increasingly subsidized by surveillance.

Technology is ubiquitous. Not all technology is a product sold to consumers, and you don't always have a say in how it's used. GDPR covers all of the above situations. Its effect on websites is peanuts.

> A corporation doesn’t have the power of the state to threaten to take away property or liberty.

Automated systems are currently part of the decision-making process in hiring, firing, choosing to loan, choosing to rent, policing, and determining prison sentences. A corporation that offers "fraud detection" services has a surprising amount of power over your liberty and property.

Why isn't there a law to prevent this while there's a law that accomplishes nothing except guarrantied annoyances? Is not the government that makes laws?

Government is responsible for both its own misconduct and companies'.

Corporations on the other hand are effectively vestigial 21st century monarchies, with all the cost and benefits that comes with that.

I've ran a few small ones and believe in private industry. I'm not anti corporation, but let's call a spade a spade here. Believing in bullshit never helps you in a competitive marketplace, don't do it.

It’s not libertarianism. It’s seeing the history of biased enforcement when it comes to the “War on Drugs” among other things but even with tech, we see the government would love to get access to data and in the case of the current administration “shut down Twitter”.

If the government had more control over the tech industry, who do you think they would go after?

They could easily raid the ICANN and IANA offices in playa vista and shut down global DNS in about an hour if they wanted. It's just a single floor, you could probably do it with 2 police officers.

The chains that bind them from doing so are those of public accountability.

A diligent public strangles the powers of a revanchist government.

Again I agree with you there are regrettable policies that should be addressed. Governance offers us that mechanism. That's why it's preferable as an institution in deciding public policy.

I'd rather have our imperfect government with their awful War on Drugs running the show than say Beyer, who marketed heroin to kids for mild ailments, or Purdue pharma which peddled opioids, you know, as late as last year, or the huxster Elizabeth Holmes or the price gouging Martin Shkreli or RJ Reynolds or any other profit seeking unaccountable entity.

Replacing the FDA with say a board of Shkreli, Holmes and Purdue? Yeah, I'm sure that'd go just great.

I doubt people in the inner city or the people who “fit the description” wouldn’t feel the same way about the “War on Drugs”.

The system as it stands is designed for people to "be as greedy as they can possibly get away with."

Then there's this theory that is everyone is exclusively a conniving bastard trying to double cross everyone and snatch profits by stomping on everyone else, the world will be a functional happy place.

Building a society by incentivizing what basically every religious text says leads to crime is a big mistake.

You have been watching what's going on with the police haven’t you?

Functional cookies like shopping carts, logged-in user sessions, etc do not require disclosure nor consent.

Furthermore consent is only valid if it's opt-in (and not opt-out, so pre-ticked checkboxes are not compliant) and if it's just as easy to decline as to accept (so if it takes more clicks to say no than yes then they're in breach already).

Don't blame the EU for this, blame the website operators and their broken business models.

I believe the problem here is wrong advice leftover from the previous "cookie law" (which I agree is completely stupid) being repeated endlessly (either honestly or maliciously from the adtech/spyware industry to try and make the GDPR look more annoying to the users). I sometimes even see this wrong "advice" here on HN on GDPR-related threads.

Seriously, I wonder if adding those cookie banner impacted tracking in any significant manner, because it definitely significantly impacted the usability of the web.

The only world in which your statement makes sense in one where user tracking is assumed to be acceptable and something that must be done. Neither of those things are true.

As others have noted, a ton of sites seem to have just thrown the necessary JS on their site without actually seeing if they needed to, or if they did, if they could make minor changes that would remove the need.

From a usability/user experience perspective, now users have these popups displaying on some number of sites that they visit, often developed with the assumption that they will be accepted by the user.

Based upon some of the experiences I've had, I would say a number of teams neglect to properly test their sites as a user that has not accepted/dismissed the pop-up/overlay.

Through enough repetition the act of opening a new website and immediately clicking away the cookie popup becomes so automatic that people don't bother to read the disclosure, think about whether XYZ site should be tracking them, whether they want to consent or not, etc.

I myself am guilty of just clicking the damn thing without really thinking, and then I realize in horror that I opted-in by accident.

Replace it with a single "session token" value that you are allowed to set. Can only be created in response to a form post. No cross domain.

Make all the other web API stuff an smartphone-style opt in. "This app requires the following permissions: "Store private data in your browser. Only do this for site you trust as this can be used to track you." etc.

Maybe all the above can be made into an extension as a stop gap.

I'd imagine a flood of junk data would increase the cost of tracking.

Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors.

Browsers have provided this functionality for 10+ years. Why the law didn't target the user/browser level instead of the website level is beyond me.

I guess there's complication zero-knowledge proofs that could solve this problem, but they're too slow right now.

There was a standard for that, too. https://en.wikipedia.org/wiki/P3P. There's no reason why something similar can't be implemented now.

If anything maybe we should encourage having a "master preference" set in the browser, something like DNT (but not so easily ignorable) that just tells all websites on the user's behalf to only allow the absolute minimum number of cookies needed for the site to function. A small message on the bottom of the page could give more details or allow manual changes.

Now we have GDPR which is legally enforceable (officially) so we could use the technical implementation that can automate applying it.

The regulation applies also to all sorts of analytics, fingerprinting, behavior tracking, user tracking, etc., which is far more prevalent and problematic than simple cookies.

How do you "delete" that?

OctoberCMS for example sets a cookie for every user and there's no way of turning this off, and lots of WordPress plugins just don't care with no option to disable this behaviour .

So most banners are just a notification rather than a choice. e.g. Continue to use the site and you automatically opt in. Which is not the intended goal for the law.

Of course they do, or one of their superiors does. Computers are physical devices that do what their operators tell them to do; it’s entirely reasonable to hold the operator responsible for what the computer does at their request. That includes the overt behavior of any software they choose to run, and they always have the option to choose different software or, in the extreme case, unplug the server and discontinue service.

Then the solution is simple: Stop using those CMSes.

>So most banners are just a notification rather than a choice. e.g. Continue to use the site and you automatically opt in. Which is not the intended goal for the law.

That is breaking the law. Generally, people should not do that.

But it turns out that 100% OK is still not good enough. This whole thing should really be managed either by the browsers or by an extension and the consent request should come in a standard, machine digestable way (XML, json, what not). You could then just set your preferences once, that should work for most sites and every now and then (but less and less frequently) you'd be asked about what to do with unknown cookies on unknown sites.

In short, just because part of the industry is trying to circumvent regulation and because the current implementation is not the most efficient, we should not give up on the whole idea.

There are probably some context where “informed consent” is a sensible legal basis for processing data. But no-one in their right mind would freely agree to all this tracking that those pop-ups are trying trick you into. So instead of trying to make “consent” easier to give, just assume that is wont be given.

I can think of two or three entities I interact with for whom I might enter such a consensual agreement with. Neither are “sites”, and the web is not the primary way I interact with them, so a browser would not be to tool to maintain those agreements.

But I might not know what exactly 'consensual agreement' as a legal expression means.

BTW, this is pretty much the same issue as with ToS's. Some sites will try to DoS you.

Tracking required to provide a service for the user don’t require consent f.ex. So you could still get personalized ads from Amazon as service provided for you without needing explicit consent for the tracking as such.

Similarly “non-tracking” analytics don’t require consent either. If you by non-tracking mean more or less anonymous.

You only need consent to for processing PII that you don’t have a a legitimate interest to process.

Amusingly I've just followed a link on HN to The Economist [https://www.economist.com] - their popup offers a link to "manage your cookies" where you can untick huge numbers of them or click "Opt Out All". Great - did that, however on returning to the page found the popup still covers part of the page :-)

However, we must remember Hanlon's Razor.

Normal cookies required for the functioning of the website - e.g. session tracking, user input, etc. are exempted and don't require user consent.

See for ex. here (the official cookie guidelines for EU institutions' websites): https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies

Don't blame these BS popups, interstitials, click-through wrappers etc. on Europe, that's purely site operators' laziness, legal CYA (force these wrappers even where not required) and greed where various analytics and tracking cookies (which do require consent) are being deployed.

It isn't incidental that the penalty for being accused of willfully screwing it up is quite high: having to defend oneself against a 20 million dollar judgement.

When the world disagrees with what you think should be happening the problem is not with the world but with your understanding of it.

If I happen to click a link on a news aggregator website like this one, then why would the website I visit (possibly for the first time) require my browser to accept cookies?

I don’t think GDPR demands “consent” for this though.

What the EU did wrong is not the design of the law, it's the lack of enforcement. Enforcement of the law will fine anyone requesting consent in an annoying/obnoxious way and will clean up the current mess we're in.

If that doesn't work, I use a bookmarklet called "Remove Sticky"[2]. I type "bre" and hit enter when sticky things pop up to get them gone.

[1]: https://chrome.google.com/webstore/detail/vimium/dbepggeogba...

[2]: https://news.ycombinator.com/item?id=23446504

It'll probably have about as much adoption as Do-Not-Track...