Hacker News new | past | comments | ask | show | jobs | submit login

We should have GDPR settings in the browser.



You mean, like a checkbox that sends a `DNT` header set to `1`?

I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header.

† the consent (or rather, intent not to consent) is explicit, and although non-interactive at the site level it was interactive at the browser level until MS defaulted it to `1`. Now I'm wishing it were like those notifications/location/webcam/mic access and the dialogs were required to go through the browser itself.


> I think both the old cookie law and the GDPR kind of (directly or indirectly) include that case†, and sites know that they don't even need to display the dialog if they receive the header.

Then I think that's the best kept secret of the industry.


Technically with GDPR defaulting to 1 is the only correct option. MS were only ahead of the time :)


GDPR affects the server default. A header that's supposed to show user intent still needs to default to blank.

A law enforcing DNT would be good, but honestly it would change the semantics of the header.


Block any third-party cookies, and then block third-party JavaScript alltogether. Problem solved.

Oh, there's nothing like that in the so-called "HTML standard"? Maybe, just maybe, Google being the standard body might have something to do with it, when Apple have been blocking third-party cookies for years now [1], and is in the progress of banning browser APIs that can be used for fingerprinting.

Best of all, this might rollback all those HTML5 APIs that have no business being shipped with browsers, and bring back the web content we want.

[1]: https://webkit.org/blog/10218/full-third-party-cookie-blocki...


We did, and now they're going away. The "Do Not Track" option is being removed from Safari because it is used (together with other fingerprinting techniques) to track individual users.


DNT. Has been sabotaged from the beginning. Default on leads to sites saying "we don't accept DNT".


Most sites already ignore the "do not track" flag from your browser.


The difference is that "do not track" isn't enforced at all.

It would be much better to make a browser-side dialog like it's done with location tracking and desktop notifications, and also provide a checkbox in the settings. Most importantly it would take away control from shady websites to implement it on their shady terms(though admittedly giving that control to Google's browser may not be ideal either).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: