Internet's biggest annoyance: Cookie laws should target browsers, not websites
302 comments
·October 22, 2025michaelmauderer
crazygringo
No, the problem is 100% the law, because it was written in a way that allows this type of malicious compliance.
Laws need to be written well to achieve good outcomes. If the law allows for malicious compliance, it is a badly written law.
The sites are just trying to maximize profit, as anyone could predict. So write better laws.
michaelmauderer
But the courts are saying: the law does NOT allow this.
So maybe “malicious compliance” is a misnomer. We should just call it "illegal dark pattern".
mikae1
Not a radical idea. The EU is already working on it.
> […] the Commission is pondering how to tweak the rules to include more exceptions or make sure users can set their preferences on cookies once (for example, in their browser settings) instead of every time they visit a website.
https://www.politico.eu/article/europe-cookie-law-messed-up-...
narag
Lawmakers must consider enforcement. What are the practical consequences of those rulings?
ferongr
Please post some judicial decisions regarding your claim.
hananova
But the law never allowed this. Enforcement just turned out to be an issue due to the enormity of it all.
Also, please remember that in Europe there is no such thing as "the spirit of the law versus the letter of the law." The intent of the law IS the law.
actionfromafar
Honest question, isn't the spirit of the law the same as the intent of the law?
ahnick
If you can't enforce the law, then it is a bad law. Also, this is a problem that naturally solves itself over time, so no law was ever needed. The UX of the web degraded for everyone after GDPR was passed and that I think everyone can agree on.
If people care about privacy, then over time they will migrate to companies and services that respect their privacy. Government laws are broad based policies that always lack nuance. This is why it is better to let markets drive better outcomes organically.
RHSeeger
Well written laws are difficult to create. You usually wind up with one of
- The law allows things it shouldn't, or
- The law disallows things it should
And the later gets swept under the rug as "we won't enforce it that way"... and then it winds up getting enforced exactly that way because someone has an agenda, and this is a hammer.
noja
> No, the problem is 100% the law, because it was written in a way that allows this type of malicious compliance.
What are you referring to here? Where in the law is this allowed?
Kbelicius
> No, the problem is 100% the law, because it was written in a way that allows this type of malicious compliance.
There is no malicious compliance here, just breaking the law. So if it is the problem of laws that they are broken then according to you all laws are 100% the problem. That stance, IMO, is beyond stupid.
Zanfa
Like mentioned by sibling comments, GDPR explicitly does not allow this. It's just the fact that enforcement is spotty and complicated by the fact that the responsibility is shared across all EU member states with limitations what each country can do by itself, with some countries' data protection authorities intentionally dragging their feet to protect multinationals.
It's the same issue as with most EU-wide issues, where there's always countries competing with each other at the benefit of others.
Also GDPR is not exclusive to browsers or internet, it's applicable universally, for both online and offline businesses and processes, which is why it can't and doesn't prescribe exact technical implementation details.
itopaloglu83
Although I agree the law isn’t as good as it could be. It’s also impossible to create perfect law when websites are looking to avoid the spirit of the law to begin with.
Otherwise how can we explain “please see our privacy policy and send us a sneaker email to opt out” kind of tracking options.
narag
You don't need to write the perfect law. Just write a law that has more or less the intended effect.
Imagine you write a program to do something and it doesn't work at all as expected and at the same time it causes endless annoyance to users.
A law is very similar to a program. It's software for the society. It didn't work and the authors are blaming everybody except themselves.
lesuorac
Yeah law is kinda like the rules in sports leagues. You have to keep updating it as the meta shits.
It's impossible to write things correctly the first or final time and especially with the interpretation of words changing over time it doesn't matter if you could.
atoav
No. The law does not allow it.
To quote Article 4(11) – Definition of Consent
> ‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Meaning if you force users into pressing a button or let them scroll through 1000 no options, with one easy yes option, you have not collected their free consent. Congrats you broke the law.
Meaning if you just have them click yes, but not informed them about the harmful data collection you did not collect free consent.
The law is pretty clear on that.
Measter
Wouldn't this also mean that if a user was using one of those browser extensions that automatically click "yes" to close the pop, then the site would not have informed consent, and therefore would not be allowed to collect the data?
wutbrodo
I may be missing something, but I don't see how this clearly precludes that behavior.
Which descriptor do you think is unambiguously violated by making it easier to provide consent than withhold it? To my eyes, both 'freely' and 'informed' are plausibly upheld.
It would be very straightforward to specify that consent and withholding must be equally accessible in the interface, instead of splitting hairs about definitions of "freely given". This is what people refer to when they say the law is poorly written
isodev
> The problem here is not the law
Of course. The law is clear, the intent is clear and the guidelines are clear.
I think the biggest challenge (and the reason why it feels this is everywhere) is because of the handful of "big corporations" controlling the browsers. Neither Apple nor Google have any interest in making tracking opt-in or working to make this into a standard.
In my view, the situation will be greatly improved with policy like the DMA being amplified even further to prevent cartel-like reactions from the FAANGs (whatever the acronym is today). We have a deep "culture difference" with the US, where everyone expects everything to be spelled out for them in the law so they can sue each other into oblivion, but the reality is this doesn't work. We need to reduce the influence of bigger players and install guardrails so it will never be possible again for a single company to have such dramatic influence over the world.
Imagine how many of these consent prompts can be removed if it wasn't for the fact that even loading a Google Font exposes one to a few hundred "partners"?
itopaloglu83
Tracking by default is not an acceptable solution, so I would say respecting the Do-Not-Track header must be mandatory and enforced by laws and percentage of global revenue fines.
bradleyy
GPC (Global Privacy Control) is the header that's actually being enforced in (parts of) the US. DNT is considered deprecated by many, due to the nonconsensual way that Microsoft rolled it out.
Nextgrid
Why is Microsoft's implementation a problem? Having the setting default to a safe value is the rational choice.
It's like saying having a secure OS/browser would deprive malware authors of revenue, and thus vulnerabilities should be preserved unless the user explicitly opts into patching them.
layer8
That wouldn’t help much in terms of annoyance, because you need the option of per-site or per-service opting-in to tracking cookies (like “remember me” checkboxes and similar functionality), and then you can’t really prevent web pages showing a banner offering that opt-in option. It wouldn’t be exactly the same as today’s cookie banners, but websites would made it similarly annoying.
itopaloglu83
We cannot rule by law if the websites don’t want to abide by the rule of law.
The level of tracking is insane and would never happen in real life, and companies would be fined to oblivion had they tried, if not forced to close by an angry mob of people.
wtetzner
Unless it was a browser level permission, like asking to access the user's location.
carlosjobim
If it's not a third party cooking, then it's not a tracking cookie. So logins and other site functionality will be perfectly fine. They're not subject to GDPR and similar laws.
ajsnigrutin
In my opinion, it would be best to regulate the browsers themselves... preinstalled browser on a device sold in EU? Cookies are silently stored to a temporary jar, deleted on tab/window close. One jar per domain. Then add a button by the address bar to enable the "I want this site to remember me", and it'll make the cookies from that domain 'permanent' (with an additonal 'advanced' setting if you want to allow 3rd party cookies too or not).
But hey, when the regulators are lawyers who have no idea what cookies and browser are, we get consent forms on every domain visit.
null
jrm4
The problem here is the problem everywhere; we still as a world have no remotely effective way to actually punish companies-as-bad-actors on the internet or in tech generally.
None of any technical ANYTHING matters until we (meaning law and government) inflict truly meaningful consequences. Fines, breaking up companies, perhaps even jail time, etc.
sothatsit
I would blame ad providers more than individual website owners. From my experience, ad providers have made it very difficult to serve their ads unless you use an ad-supported cookie consent manager. I tried to write my own simple cookie consent form and gave up after realising how obscenely complicated TCF is. And since most ad-compatible cookie consent banners are provided by the ad companies themselves, you kinda just get stuck with bad options. I even tried to pay for a commercial cookie consent manager but it wasn’t supported by my ad provider.
If I had more time I probably could have figured it out. But unfortunately I’m just running a hobby project and do not have weeks to spend on this. The revenue from the ads is what pays for hosting. I imagine lots of websites are in a similar boat.
I would love if there was a simpler option that could respect people’s privacy more, be less annoying, and that would still allow websites like mine to survive by running ads. Targeting browsers instead of websites could have been that option.
bradleyy
The Global Privacy Control (GPC) is the header that actually has enforcement behind it in the US, and there are already companies getting fined. California has partnered with several other states to broaden enforcement.
Would love something better than GPC, but in the interim, the EU should start considering it as a proper signal of (lack of) consent, obviating the need for a banner altogether.
Macha
Ah, I was wondering why I was seeing more dialogs default to opt out when I hadn’t heard of any notable EU slap downs when it started
tjwebbnorfolk
Important not to confuse the actual result vs. the hoped-for result.
You HOPED that websites' top priority is to provide the best possible experience. The REALITY is that not getting sued is way more important than removing all possible user inconveniences.
rustc
Or just ban this kind of data collection. Is there any reason anyone would willingly click "Accept" when a website asks to share your data with 500+ partner sites?
forgotoldacc
For that matter, companies should be banned from referring to selling off your data to random spam companies as "sharing with partners." Partners comes with an implication of being somewhat equal or at least on trusting terms. The companies selling our data don't trust these companies. They probably don't even know their names.
If the data is being sold, it should be legally required to word it in that way. If there's even the slightest possibility of your data being leaked to spammers, it should be worded to reflect that.
"Do you consent to us selling your data to any party that wishes to buy your data? Do you consent to the possibility that your data will be used to spam you or steal your identity in the future? Yes/No"
johannes1234321
The word "partner" lost its meaning completely. Each business relation is a "partner" these days. Guess it sounds nicer than "company that pays me to do stuff and bug you about"
foofoo12
I always read it as "partner in crime".
lesuorac
I'm not sure all these relationships are monetary.
It may even be the case that the website pays X company to perform the tracking for their own analytics purposes. Or that it's X company's own freemium model where if you add their tracker they grant you a bunch of cross-site information for free.
phkahler
>> If the data is being sold...
Nah. Personal data sharing needs to be banned. It's the right way forward.
looperhacks
That's a bit overzealous, isn't it?
> Hey, please send the shipment to my customer. No, I can't tell you the address, it's personal data.
Some data sharing will always be necessary. What needs to be banned is the unnecessary sharing, but it's hard to 100% define what counts as necessary
bluGill
I think banned it a bit too strong. However there needs to be strong regulations on what can be shared.
If I go to an ER in a different area (read different medical system) I want my doctor to share personal data. I don't want my doctor to share my personal data with a random doctor in the same medical system unless that other doctor is an expert being consulted on something about me. (that is just being a doctor doesn't give you access to my private information, it needs to be on a need to know).
The above is the obvious case. There are likely other cases that are not obvious where after looking closely private information should be shared. Advertisement is never one of those reasons though, and analytics is only a reason if they anonymize the data with prison terms for mistakes.
Workaccount2
Then you need to start directly paying for 90%+ of the websites you visit.
People don't want this, so there is a quick reversion to "pay with your data".
GJim
> Personal data sharing needs to be banned.
Indiscriminate sharing of personal data IS banned under the GDPR.
If you collect personal data, you must only collect it for the stated purpose and can't sell or share it for any other reason.
I continue to be astounded at the ignorance some people have of the GDPR; a vital privacy law and one that is fundamental to modern data use and respect for the customer.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
GJim
> companies should be banned from referring to selling off your data to random spam companies as "sharing with partners."
They are under the GDPR.
If you ask for my data, you must do so fairly and tell me what you are using it for.
In the examples you site, if you read the small print "sharing with partners" will go on to say advertising 'letting you know about products and services' and other such shite.
darig
[dead]
regentbowerbird
The same could be said with all advertising and surveillance.
No one wants to be advertised to, but powerful lobbies argue that ending ads will lower consumption and thus harm the economy; and no politician wants to lower GDP.
No one wants to be spied on, but powerful lobbies argue tracking people allow better security; and no politician wants to be soft on crime and terrorism.
streptomycin
In some sense, "no one wants to be advertised to" is similar to "no one wants to pay for stuff". Like yeah it'd be nice if my groceries were free, but that's not very realistic, the grocery store would just close if they had to give everything away. Advertising is similar - a cost we pay so that websites can make some money in exchange for their services. Most ad supported websites would just disappear without them.
regentbowerbird
In some sense I agree but there is a fundamental difference. I pay for my groceries because I have the fundamental need for sustenance, and that requires land and toil. I have neither and therefore I pay someone else; but for me to survive it is necessary that _someone_ perform that work.
My need for websites is much less predominant and really I could live without. So of course I bounce when mildly interesting websites ask to host cookies on my browser or want me to create an account and enter my card details.
If one considers maximizing utility the goal of economic science, then this is in fact good, as it redirects me to more useful venues like doing chores I'd been putting off instead of mindlessly scrolling online. Some metrics such as GDP however might suffer.
Workaccount2
The single most powerful lobby, by far, to the point that it is essentially the only lobby, is the enormous mass of people who refuse to pay money for content. Absolutely refuse.
Even when you give them the option to pay, with no ads or tracking, the conversion rate is still around 0.5-1%.
regentbowerbird
People are willing to pay for things they value. Those people who "refuse to pay money for content" probably go to the cinema, perhaps purchase magazines, purchase drinks with friends, etc.
We should however make it easier to pay for content online; let's implement HTTP 402 and integrate it into the users' browser and internet bill to reduce friction. Who wants to create an account and enter their credit card details to read a single article or watch a single video?
DangitBobby
This is a false dichotomy. You can have ads without tracking.
phkahler
>> No one wants to be advertised to, but powerful lobbies argue that ending ads will lower consumption and thus harm the economy; and no politician wants to lower GDP.
I doubt that. People tend to spend their money regardless. Advertising just determines what they spend it on.
regentbowerbird
Our culture values the act of buying things for social status (consumerism), and one of the main reasons for that is advertising.
You're assuming people would still have the same amount of money, but for most money is not a given, and people strive to earn money precisely because they want to buy the things they were advertised.
Without the social pressure to acquire things one doesn't need, it's very possible people might simply work less and use that time for other things.
tclancy
Yes, but then you might consume beer based on how it tastes rather than the likelihood of winding up in an impromptu volleyball game with a bunch of Nordic bikini models. So you see where the entrenched players want to keep the status quo.
GJim
Famously....
Advertising is only used heavily when all products are similar, otherwise the best would naturally rise to the top.
For example, washing powder/liquid is advertised heavily on TV, yet do you really believe one brand of powder/liquid gets your clothes cleaner than any other?
tcfhgj
not so sure about that, I am pretty sure ads promote materialism and consumerism, probably even leading to people working more to be able to afford more
janwl
This law was supposed to give me control of my data. If I have control of my data, why can't I use it to pay the owner of the website?
zetanor
Click-through "I agree" buttons are almost never a matter of informed consent and almost always a matter of convenience-driven rape.
Kbelicius
You can freely share your data under GDPR but the owner of the website can not request data as form of payment for the access to the website.
GJim
> Or just ban this kind of data collection
It is banned.
Unless I give me explicit permission otherwise (though as you say, why anybody would is beyond me, but then "there's nowt as queer as folk")
eviks
Yes, of course, the reason is pretty simple - someone would willingly accept that to access ad-surveilance-financed content!
p_l
Guess what, those banners are still up because it's pretty hard to actually bring the banhammer. At best you have too small team working with huge backlog
Xss3
Some websites, mostly news outlets, can legally withhold access completely, and do, unless you accept all cookies or pay for membership.
If my 'data' is a no logs vpn address with a privacy hardened browser running in a VM on an isolated VLAN with encrypted DNS then why wouldn't I just laugh and click accept cookies in a sandboxed tab (so said cookies only exist for that tab and are cleared when it is closed.
What youre saying most users dont have this level of privacy by default? Why not?
Xelbair
>Some websites, mostly news outlets, can legally withhold access completely, and do, unless you accept all cookies or pay for membership.
GDPR article 7, section 4: When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
basically: A data controller may not refuse service to users who decline consent to processing that is not strictly necessary in order to use the service
anyone who does that is in violation of GDPR
jamespo
There could be a multitude of reasons, mobile browsing for example.
dangus
On this note, this is a good reminder that if you don’t collect information in this way, your website is under no obligation to provide a cookie banner.
Any website that uses a cookie banner is going above and beyond what they need to do to run a functional website in order to track you.
vmaurin
Same goes for age verification.
There was the DNT header, that was a bit to simplistic, but was never implemented https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...
The thing people need to understand here is that the annoyance is not due to lack of technical solutions, or regulations forcing something. It is explicitly wanted by the industry so they can maximize the consent rate. The browser solution is probably the best technical/user friendly one, but ad tech/data gathering industry won't have any consent. As they control most of the web, they will never do that
Animats
It was implemented in browsers and ignored by sites. Chrome help says:
Turn "Do Not Track" on or off
When you browse the web on computers or Android devices, you can send a request to websites not to collect or track your browsing data. It's turned off by default.
However, what happens to your data depends on how a website responds to the request. Many websites will still collect and use your browsing data to improve security, provide content, services, ads and recommendations on their websites, and generate reporting statistics.
Most websites and web services, including Google's, don't change their behavior when they receive a Do Not Track request. Chrome doesn't provide details of which websites and web services respect Do Not Track requests and how websites interpret them.[1]
About the best we have browser side is a mode where all cookies are cleared at browser exit.
djoldman
In chrome, saving anything to your device can be blocked completely:
chrome://settings/content/siteData
Here's an extension to block at a per-site granularity (despite it saying cookies, it blocks it all including local storage):
https://chromewebstore.google.com/detail/disable-cookies/lkm...
pessimizer
That's not an implementation. That's a request to sites that you visit to comply willingly. An implementation would be defensive.
It's what you would do if you had the crazy idea that a browser should be a client for the user, and only a client for the user. It should do nothing that a user wouldn't want done. The measure of a client's functionality is indistinguishable from the ability of the user to make it conform to the their desires.
Semaphor
> About the best we have browser side is a mode where all cookies are cleared at browser exit.
No. The best we have are adblockers and scripts like consent-o-matic.
Clearing cookies does mostly clear cookies, tracking goes far beyond that. Clearing cookies has always been a red herring enabling adtech submarines like "I don’t care about cookies".
disruptiveink
Correct. Age verification and privacy consents belong on the browser. The issue is that on the browser, things work a bit too well (remember https://en.wikipedia.org/wiki/P3P ?), so the big players are incentivized to ignore completely the browser-based mechanisms and say/do nothing whenever they see lawmakers going on a dumb direction (risking fines is a reasonable price to pay in order to kill adoption of an actual browser/OS based control that would cause a dent to their tracking operations) that puts the onus on individual website operators.
p_l
Fun fact - if you handle DNT properly, you don't need to show the consent screen... because you're not doing anything requiring said consent.
jeroenhd
I believe Medium's DNT implementation showed a little confirmation button on embedded Youtube players. That's the kind of consent screen you may still need with proper DNT handling.
None of those cookie popups, though. That's all malicious compliance.
voxic11
I don't think this is true. DNT being absent or set to consenting is not enough to infer the user has given specific and informed consent under the GDPR.
> Explicit consent: Under the GDPR and similar laws, consent must be specific, informed, and an unambiguous, affirmative action from the user. Consent cannot be assumed by a user's continued browsing or inaction, which is what DNT would require.
cyanydeez
At this point browsers should become publicly owned. Theres zero benefit in private ownership. Its a utility and nows the time to accept that.
LunaSea
Utilities are not public either anymore in most western countries.
ants_everywhere
Tell me more about your theory that the Trump administration should control everyone's browsing
tbrownaw
> Your browser becomes your personal privacy enforcer, and the law would require it to act on your behalf. Based on your one-time choice, it would be responsible for allowing or declining cookies from every site you visit. If a website tries to use a cookie with an unclear or undeclared purpose?
Browsers are something the end-user installs. Inserting the government into that doesn't make sense.
This sounds like the idea is for the site to add extra metadata that's not there now, about what each cookie does. Which would still involve mandating site owners to do things.
.
Also, both private mode and https://addons.mozilla.org/en-US/firefox/addon/multi-account... are a thing already, without government meddling.
crazygringo
> Inserting the government into that doesn't make sense.
On what basis? What difference is there between regulating website code and browser code? How a website functions and how a browser functions?
asplake
Except that the provider of the most popular browser is also an advertising agency. A conflict there, surely?
tbrownaw
So that would mean that most users must not actually care that much, then?
pessimizer
The provider of the "alternative" browser is also completely supported by the same advertising company, and since this arrangement has begun has shown itself completely uninterested in solutions like this. If anything, it tries to make control over cookies, localstorage, or javascript harder, and to demonize people who would dare to care about such a thing.
moooo99
I disagree that this should be in the scope of a browser.
Cookie banner are called cookie banners because they‘re most frequently associated with the opt in for tracking cookies, but this kind of opt in is required for any kind of third party involvement that goes beyond technical necessity.
Your browser has no way to tell what third party present on the site is a technical necessity and which one isn‘t. So you‘d have to tell it - making it part of the site providers problem as well. But this time its worse, because responsibilities are mixed between the site operator and the third party.
ryukoposting
Legally compel websites to respect the DNT header. Bam, done. This is a simple problem, and should be solved in a simple way.
jeroenhd
DNT doesn't solve all problems, though. Not only is DNT being deprecated, it also lacks the proper customisability the law actually prescribes for data processing.
There's no value you can give DNT that says "you can do your own on-site tracking and telemetry and I accept sharing my data with Sendgrid for your newsletter, but I do not want third-party trackers".
As a practical example: there are news sites that will not play videos if you hit "deny all" because their video host does some viewership analytics. I'm fine with that, but not the 750 other advertisers the news site tries to have me track.
Of course, "deny all" should be an option, "accept all or deny all" isn't control.
For the longest time we had https://en.wikipedia.org/wiki/P3P as a basis to build on, but that officially died the day Edge became Chromium-based.
noirscape
It's already seen as a valid opt-out signal against this sort of thing in Germany. LinkedIn got in trouble and lost a court case for not respecting the DNT header if memory serves me right.
PlotCitizen
This is the best suggestion here with the least friction in my opinion
bradleyy
Companies ARE legally compelled to comply with the GPC header.
gwd
Right, the it would be legally required have to have "third-party" vs "strictly necessary" tags on the cookie itself, which someone could challenge if they were inaccurate (in the same way that the GDPR can in theory be enforced now). Then the browser could simply do what the user wanted with the tags. This could even be a status item in the URL bar, similar to the HTTP / HTTPS icon, that would allow you to enable or disable tracking on a per-site basis (if you didn't want a global policy).
Small website operators would still need to be savvy enough to make sure any cookies their website served up were appropriately tagged; this would ultimately come down to ad networks / analytics companies documenting the behavior of the cookies they add.
jeroenhd
> Small website operators would still need to be savvy enough to make sure any cookies their website served up were appropriately tagged
While enforcement is effectively nill, they already need to do that according to the actual EU "cookie law" (ePrivacy Directive rather than GDPR). If you set cookies, you have to explain to the user what they're there for.
Hilariously, many websites have no idea what the cookies their trackers set are for, and I've caught a bunch of them use language like "seemingly" and "apparently" when describing what purposes cookies actually serve.
If only browsers gave P3P[1] the attention it deserved. The protocol isn't exactly perfect and the unmistakable footprint of early 2000s XML obsession are there, but it could've prevented cookie banners from ever being accepted if only browsers had designed proper UI around an updated version of the protocol.
jsmailes
I believe this is already starting to be solved via Global Privacy Control (GPC) [1], and has already been implemented in Firefox to replace Do Not Track [2]. All that remains is to see if lawmakers will catch up and make it a legal requirement to follow...
[1] https://globalprivacycontrol.org/
[2] https://support.mozilla.org/en-US/kb/global-privacy-control
jeroenhd
DNT already had legal weight in the EU. I don't see what problem is being solved by sending a slightly-renamed version of DNT instead, other than the weird privacy law a few American states have implemented that says "if the browser sends the signal by default it's not a legal signal and you should therefore ignore it" (which will probably be updated to neuter GPC if that ever gets any serious attention, the las were clearly written to give trackers the advantage).
atlasunshrugged
+1 to this, Firefox has been pushing this for a while but my understanding is really the legal side
phendrenad2
We'll have to keep clicking cookie buttons as long as there are idiots who think that sites can "just" give up tracking (and go out of business because without targeting, internet ads are virtually worthless).
sebastian_z
California now has a law that requires browsers to have an opt-out setting (effective in 2027) [1]. So far, websites are required to respect opt outs via browser settings or extensions in California, Connecticut, and Colorado [2]. That is also the case for New Jersey [3].
[1] https://legiscan.com/CA/text/AB566/2025.
[2] https://portal.ct.gov/ag/press-releases/2025-press-releases/....
[3] https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-....
jacquesm
Of course companies could just - I know, weird idea - stop tracking you. Then you don't need those dumb consent boxes.
harel
But unfortunately they won't. This will not happen. They ultimately shift to fingerprinting our browsers instead of using Cookies but they will keep on tracking...
rustc
Another weird idea: make this kind of tracking illegal. Why would anyone willingly agree to be tracked?
crazygringo
And companies could just -- each give me $10,000. Then I wouldn't need to work.
But companies generally do whatever is in their best interest. I don't know why anyone would expect them to do otherwise with regards to tracking.
IMTDb
Please ask the EU to lead by example then. The official EU commission website has a cookie banner (https://commission.europa.eu/index_fr)
So either: The EU commission is including trackers on their websites. And they should stop OR they acknowledge that it's almost impossible to build a website without some form of tracking that falls under the law, and they should look into the law itself.
So they have work on their plate.
rustc
> OR they acknowledge that it's almost impossible to build a website without some form of tracking
Why would it be almost impossible to "build a website" without tracking?
tcfhgj
I created a production web application which does tracking (although not necessary, could remove it within minutes from the application and probably nobody would notice) without needing a "cookie" banner. How? I don't track any personal data, just anonymous interaction.
shadowgovt
The problem with making it a law is tracking is in the eye of the beholder, so site owners are heavily incentivized to err on the side of caution and put up the box just in case.
wat10000
God forbid they err on the side of caution and not set any cookies.
sojournerc
Right?! I have a website for a music studio. I never worry about any of this shit because it's just a static site with no tracking or analytics. It's just that simple. It's there if someone searches for me and that's enough. Rely on being a good business and organic search, word of mouth, and reputation will bring you business. You don't need to seo the shit out of everything and sell your visitors.
jraph
Browsers have no way to determine what code or cookie is tracking and what isn't, and if websites are not targeted, they don't have any incentive to tell browsers "oh, this is for tracking, and this, no, it's not for tracking".
The best we have is heuristics content blockers currently use. But heuristics are not good enough for complying to such laws because there's no guarantee they work in 100% of the cases.
It follows that such laws can't target browsers and not websites.
skeezyjefferson
Wasnt this a benefit of the semantic web we were pushing for? Standardized tags exactly for stuff like this? Just another example of the mess that web dev is - trying to coerce a markup language into a fully fledged programming language.
OP has a nice idea but hes short on technical details, which in this case is where the devil resides.
jraph
As much I like the semantic web, you can embed tracking parameters in images and links put in a perfectly semantic HTML structure :-)
I think we need strong privacy laws, removing the incentive to track, or both, I don't see a technical way around.
tsukikage
> If a website tries to use a cookie with an unclear or undeclared purpose?
How is the browser supposed to determine a cookie's purpose?
sackfield
Is there any evidence that this law is achieving the goals it was designed to tackle? If not, is there any reason it still exists? Why don't laws have to continually justify themselves as a matter of procedure?
moduspol
I wanted to ask something like this, but I think you framed it better.
I am convinced these laws have just made my life and the Internet marginally worse, with no measurable positive impact.
croes
Not the laws but the way companies complied.
Still too few just show a simple „Reject All“ button.
And they ignored things like DNT in the browser on purpose.
So if someone made the Internet is worse it’s them and they successfully shifted the blame.
croes
What do you mean by achieve?
Do sites stop tracking you if you reject the cookies?
Some do, some don’t.
Is the goal still valid.
Yes.
GJim
If your asking if the GDPR is effective, yes, it is.
The only ones ignoring it completely are either dodgy companies, or the clueless. The companies exercising malicious compliance are now (quite rightly) increasingly seen as dodgy and need to up their game if they want to become respectable.
The days of not protecting user data are over.
crazygringo
GP asked for evidence.
GJim
The evidence is all around you.
For example, my insurance company can no longer get away with selling my details to financing companies behind my back. Such shenanigans are no more in the UK and EU thanks to the GDPR.
The problem here is not the law, but malicious compliance by websites that don't want to give up tracking.
"Spend Five Minutes in a Menu of Legalese" is not the intended alternative to "Accept All". "Decline All" is! And this is starting to be enforced through the courts, so you're increasingly seeing the "Decline All" option right away. As it should be. https://www.techspot.com/news/108043-german-court-takes-stan...
Of course, also respecting a Do-Not-Track header and avoiding the cookie banner entirely while not tracking the user, would be even better.