Hacker News

It literally does not matter what you pick on these things - most of them don't work anyway. Think about it: Of course they don't. All the third-party javascript is already on the page. Anything you do inside the sandbox with UI provided by, usually, some other third-party, can't just magically force all that other code to behave in a specific way, unless someone has done a great deal of work to integrate the cookie banner code. If the first-party site were that competent at instrumenting every bit of third-party code, the marketing department threw at the website department, they wouldn't even need the third-party cookie banner vendor in the first place.

Clicking those "REJECT!" buttons might make you feel empowered, but it's pointless. Just set your browser to delete all the cookies at the end of the session except for whatever sites you want to allow to 'remember' you.

The whole thing has always been a problem to be properly solved by the browser, and it's probably just the fact that Google makes the only browser that matters, that it's been foisted upon every website owner, who mostly just wants basic analytics and to track conversions from the ads they run, and isn't "selling your data."

The browser is your user agent. If it's sending any information up to web servers on every request that isn't okay with you, why are you using it?

"Accept all" always makes it go away immediately.

Some variant on "reject" takes more effort like 70% of the time. Which is on purpose, of course. The ones that aren't maliciously-complying have a "necessary only" button that insta-closes it, but tons pretend that you might want to allow some spying but not all of it and make you go through another screen if you don't just "accept all".

> To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.

Then it'd be possible to default it to "nope" (Firefox, and perhaps Safari, might do this) or to allow a "never, anywhere" setting the first time the question is asked, and malware and spyware vendors know that'd mean a much larger proportion of denials.

It's a nag-box that appears every time someone visits a new website. Of course people are going to click it away as fast as possible. In the few cases you repeatedly visit a website one might want to reconsider, but by then it's out of mind due to not being shown after giving consent.

It is known that warnings and pop-ups that show up almost all the time yield diminishing returns. I think it was named "normalization of deviation" by some folks in a blog a while ago, and I believe that name fits. If you get warned about missing https all the time, or that something might be dangerous (even though it does precisely what you want it to do), it will loose its effect by the time you actually need it.

You can argue this is malicious compliance, but if you want it to go away it would probably be easier to go for banning tracking and personalized ads altogether. Eliminate the reason for this behavior, so to speak.

> To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning.

There is one. It's a DNT header. Knucklehead websites ignore it.

I believe myself to be fairly well-informed, and usually accept the cookies, because I don’t foresee any potential harms, and it helps the people running the website. I am worried about many things like phishing and hacking/data leaks, but the valuable data isn’t cookie-related.

What harm are you worried about?

> But in many cases, you could just click "reject" and the banner would also disappear...

Oftentimes the reject flow is substantially more annoying than the accept flow. I click reject myself when it's an option, but I can absolutely understand how people might get conditioned to click accept when clicking reject might result in more popups.

"To me, having a browser setting for cookies is the only sane way to handle this, it's surprising that this was not considered from the beginning."

This is exactly what browsers did back the 90s, they asked about every single cookie.

Then browsers got configurable options to simply accept either all cookies, no cookies, or only first party cookies (excluding third party sites unrelated to the domain you visited).

For now well over 20 years I have disabled 3rd party cookies in all browsers I use, and only in a few cases overall did I need to make exemptions.

Well, the whole thing is theater anyway. It does not matter what you choose.

They will fingerprint you with or without cookies. They may or not try to honor your preferences, but their "partners" will not try, and by the time you see that banner, it's all out there.

"Accept" is the close button.

Most people reasonably assume that if they click Reject they won't get the page they're looking for.

People expect visiting a website to be read only or contained within a sandbox to not read other files on their computer which is correct. Most people just don’t care about tracking and want to get to the content.

>This is a jaw-drop moment for me every single time I observe someone else using the web and quickly clicking "accept"

There's a mismatch between the velocity at which people visit sites and the time it takes to navigate the cookie particulars of each site.

And, we can dismiss this as people being uninformed or lazy but the reality it is that's actually not so unreasonable. Cookies are in some ways near the bottom of the list where privacy is concerned, given everything else from breaches to search dossiers to device finger-printing to mobile device location-tracking to the ubiquity of cameras in the real world, and on and on.

The idea that we're clawing back privacy in any meaningful sense by blocking a few cookies here and there is kind of quaint.

Because 90% don't even do anything? It turns out it's actually one of those really annoying problems to delay cookies which were supposed to be sent already in the HTTP request response until a user interaction has happened. And on a lot of pages, non technical people embed random 3rd party resources. And these 3rd party resources might claim to use only "technically necessary" cookies, but of course that's nonsense; I'm not visiting the 3rd party.

if ever there were a need for a small local ai plugin...

Agreeing to terms and contracts without reading or at least skimming them is not responsible adult behavior and should not be used as a model for legislation, no matter how many people do it. I agree that we do have a culture where private law is not taken very seriously, and that's very unfortunate.

People do not have a right (morally speaking, not legally) to access or use a service (or a website) etc without having to read/agree to the terms (applies to analog and digital).

Just enforce the GPC header... https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

In a way it is - or rather it wouldn’t t change anything if we added more features.

The default is “no”. Without explicit consent you can’t do a lot of things.

You can’t have a default yes, because how can you agree with consent but automatically to everything?

And if it’s a no, are you saying you can’t ask a user for permission to use their data for a specific purpose?

And if you can ask, that’s what we have right now.

If people really cared, they’d choose browsers that have better control, but that’s obviously not a priority for them. Why do you think this sort of thing should be regulated to suit your preferences when most people don’t seem to agree with you?

How to know if they actually read it? The signature implies that the contract has been read, understood, and accepted. I see no need for any alternative mechanism.

You could use Consent-O-Matic https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat...

It already pushes the correct "Reject" button for you on a lot of sites (not all; it works based on rule lists)

How cookie consent has been deployed by the data sponges is my go-to demonstration of malicious compliance.

Session cookies do not require a banner.

> “I didn’t read it” can’t possibly be an excuse to avoid being bound by an agreement

Only engineers have trouble understanding this. It can be a reasonable defense, and it has successfully been used in courts of law many times. The law is not a machine that compiles text like code literally. Imagine someone who coerces a dying or sick person to sign an agreement they couldn’t possibly be in a reasonable state of mind to understand what they were doing -- the law can and does invalidate such “contracts”. That is the same principle behind age of consent laws. The law could theorerically (and does) invalidate “agreements” which no one is reasonably expected to read and understand.

It can and has been in many cases in many legal systems. For example, let’s say you walk into my store to buy a dish washer. I say ”here is an extended warranty that I will give you. Just sign” you sign it instead of reading 15 pages of boilerplate. In the end of the document it says you now owe me 10 billion dollars. Doubt I will be able to enforce it in most legal systems.

That argument has actually worked in some cases, especially when you need to click away to actually access the document. I assume it's why we see more and more examples where you need to scroll the full body of text in order to "agree".

I don’t see how we could possibly prove that the person who clicked “I agree” is still the person using the computer.

Or that any actual human is aware that an agreement was made (since an AI can find a checkbox nowadays or software can be configured to bypass it). One way to add balance could be to require people asking for contracts to actually treat them like real serious legal documents, show up for the signing, and figure out who they are making an agreement with.

> There’s a balance that needs to be carefully managed here. Yes, fairness to consumers is important. But you can’t destroy the incentive to produce value in so doing.

The value is derived from the people consuming the product. Placing the "incentive to produce value" above the people who presumably are the source of this value seems...misaligned.

Of you need a nonstandard contract then you need to provide proof that it was understood. These are not provided in a context where I would expect anyone reading it to have a lawyer to advise so they obviously don't understand it

But "its specifically engineered to ensure that nobody reads it" is a real argument

>If someone does not read a contract or a legal agreement, before accepting or signing, it's on them

When was the last time you read an entire EULA before installing software?

I'm going to guess the time frame is somewhere around "never."

These are nuisance contracts designed to jade people with legalese while stealing their rights to things like class action and enforcing binding arbitration.

Standard contracts sounds like the way to go.

But I don't want to delete cookies? I want websites to use cookies that are technically necessary e.g. for keeping me logged in. I just don't want them to use it to track my behavior especially inter-website.

It’s not about cookies. It’s about what the site is allowed to do with your data. Cookies are an implementation detail.

It’s baffling we’re having this misunderstanding on this site in 2026 still.

Is there any reason to believe that the current laws being passed by the UK, EU are against the will of the people? Everything I have seen makes the "anti-porn" laws or whatever seem extremely popular.

changing IP is not really enough for privacy, there is many ways to fingerprint your machine/browser and uniquely identify you across networks

https://creepjs.org/checker

I think it's because every single website breaks if you don't allow cookies at the browser level. Some knowledge of what the specific cookie does was necessary.

You mean we had the DNT flag in the browser.

> The problem there is that parent's won't know how to do it, or won't care.

This is unfortunately the reality.

The other day a friend asked me to help her make her phone safer for her kids to use. I started by asking if she set permissions on the apps she downloaded. She looked at me blankly, "What permissions?". I proceeded to show her how you can granularly control what you allow each app to do on your phone and what access it is allowed. Her head blew up, she had no idea any of this existed and after gong through a few menus, she didn't care any more. It was all too complicated and too much to think about for a busy mum.

This is why governments unfortunately are having to try to protect people from themselves. As tech competent people it all seems so simple to us, but we need to remember the majority of the population just click 'Allow All' and blow past all permission and security questions as they have no idea what any of it means.

UK mobile operators already defaulted to blocking adult sites before OSA, and lets the subscriber turn it off, which seems like a reasonable option.

It'd be even better if there was a way for people to selectively turn it off for specific devices without MITM the connections. It wouldn't be that hard to come up with a mechanism for that.

When we buy a new phone, the configuration process should ask if the device will be used by a kid. Easy and simple.

When restoring factory defaults, the same question, just in case the phone is sold, gifted, stolen or whatever.

If you are going to give a phone to a minor you should set that option right from the start.

That's why the setting should be on the device, not the browser or individual apps. One setting that you could even get pre-configured when you buy the phone.

It's ok if parents won't care. It's a choice too.

I've build some moderately sophisticated server systems up on "bare metal" (as the kids say), know my way around a shell better than most programmers, understand networking better than most programmers, et c., and I still find restricting and monitoring kids' devices to be a huge pain in the ass. The only places it's not extremely shitty are the Switch (which still isn't great) and Apple devices.

Options between "we don't have tech in the house" and "wide-open tech, we have it all" are all some amount of painful, usually for no good reason.

(I remember once investigating how to do some pretty basic stuff for this in Linux, hoping to find something nicer than manually setting some executable permissions and firewall rules and then having to go back and change them all the time, and the closest thing to a guide I found was an old article from Red Hat that basically lead with "LOL, good luck you poor sap, Linux sucks at this" before going on to explain the various bad ways available to sort-of, but not entirely, accomplish it with a lot of work, and significant ongoing time-burden)

That’s not true. Every TV app has a parent setting. That’s really easy to use browser support profiles just like TV apps do bad. UX doesn’t mean that it can’t be set up easily for parents. Windows itself could have profiles for kids that has all this set automatically. It’s not hard. There’s just no will to do it.

if parents wont make the slightest bit of effort why should the rest of us pay to keep their children safe?

A child can still access knives if the parents don't care.

> Parents can lock devices into "child mode" that emits "user is child" headers. Websites can then block.

CA tried this with AB 1856. I wasn't a fan of this (neither was EFF) because of the privacy and tracking concerns of blasting the fact that the user is a child to all websites.

https://www.eff.org/deeplinks/2026/05/one-step-forward-two-s...

It would better for the block to happen at the device level. That is, the browser knows it's on a child's device and has a whitelist of allowed sites.

There is already an RTA (Restriced to Adults) header where the website self-labels that it's for adults only and the browser can block it while protecting the user's privacy. I'd prefer expanding the use of RTA.

This will work... if you think this is their true motivation, and the panopticon itself isn't the true end goal.

I agree, and I agree with the enthusiasm on which you bring in.

I've long since considered that the efforts for online child safety should be pointed at educating parents and spearheading some kind of certification of compliance for child safety of software and websites.

[this product is certified to adhere to EU:CSA]

Then you can block everything not certified, and the software that does the blocking would also be certified, the two major prongs you need (endpoints and sites working together: else they're blocked). The rest of the money goes to education for parents about this fact, and the dangers of not doing it, and how to do it.

This is super "easy" (when comparing to the effort it would take for putting backdoors in everything).

Which is why I think that the reason is definitely not child safety, and more about crime control.

Me talking about UK blocking people unless they ID themselves in 2013: https://news.ycombinator.com/item?id=6979295

Me talking about how its disingenuous because we have superior technical solutions to this particular issue last year: https://news.ycombinator.com/item?id=45010902

That works well for controlled devices like phones, tablets, and TVs, but it’s much harder on desktops unless you expect parents to become IT administrators.

California AB1043, in other words

Make a website about that. I’ll spread it.

Not wrong in the EU, you don't need to ask for consent nor notify about cookies which are required to make the site functional. Tracking and ads don't fall under that though, which is why every site these days does need to ask for your consent.

Comission wanted that, Google lobbied hard to NOT have automatic sigal… go figure…

I've seen people argue, with a straight face, that they prefer to get ads that are "relevant to them". Including here on Hacker News.

I don't disagree. The ideal state here is really layers of customation for the defaults. Options like reject all, or strictly necessary would be at the forefront. And then it's really up to the individual how they want to proceed when those options are not available.

If offered something in return, I guess

Ask that question to the 99% of people who click 'Allow All' on cookie banners.

Devil's advocate argument: if they were giving you something in return, and that could be cash, but it might also be "you can have this content for free".

In the UK a few news sites have changed cookie banners to "you can accept and see this stuff for free, or you can sign up for a subscription, which would you prefer?". It's the only time I hit accept (and then clear browser history).

If blanket preferences from browser signals became the norm, a segment might open up where you would configure preferences and a data broker would make sure you get something in return for your data. At minimum it might force paywalled publishers to consider that as a "lite" subscription option.

Sometimes I do it to reward the website for being less shit than most websites.

Sloppy, non-privacy-preserving "analytics" set up by some communications intern ≠ malice. They can mean well and still do a poor job. True privacy on the internet is notoriously hard.

More likely it was designed by some firm that put the cookie banner there because "that is just what you do in current year"

That's not true and is a very common misinformation people repeat online. You can save user preferences in cookies without any consent banner, if the cookie isn't used for tracking.

See here[0], page 6:

> As stated in Article 5(3) ePD: ‘This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.’

0: https://www.edpb.europa.eu/system/files/documents/2024-10/ed...

As long as you do not share that info with 3rd party, and the user requested it, you can store via cookies pretty much whatever you want without the need for a consent screen

There are privacy respecting ad brokers that dont require user tracking. Its just that people are too lazy or greedy to use those.

Perhaps someone could publish a clear A/B test on how many views/conversions you lose by having a cookie banner?

Or they had their site developed by an agency and the cookie banner is just part of their standard scaffolding for a new site.

Let businesses who don't know what they're doing be outcompeted by businesses who know what they're doing.

Side note: there’s plenty of Analytics tools that don’t require cookies. Plausible (https://plausible.io) is one of them, there are many others. Not affiliated, just a happy customer.

> We did all the tracking on the backend

Just checking, you do know that still counts as tracking and may fall under GDPR rules? GDPR was never just about cookies.

Sounds like your legal department is broken. You should fix that.

I mean that both in the sense of "you, plural" (your company should fix that) and "you, personally" (because diffusion of responsibility is a real issue, and someone needs to actually do it).

Yeah, the "do not track" setting I think was the browser based solution that sadly never took off. Better government policy should have required respecting that setting instead of the cookie banners.

Still works on Chrome 150, but it is the last supported version. Chrome 151 is being released on July 28.

I think so yes, but Firefox is probably still better.

uBlock Origin -> allows blocking dialogs (legally implies refusal of everything not necessary, because you don't agree to something requiring agreement)

Consent-O-Matic -> automated configuration to your preferences using the dialog provided.

I still don't care about cookies -> least privacy friendliest option, because it may opt into undesired tracking (its goal is just to remove the annoyance of the dialogs)

I use "I still don't care about cookies"; it works well, but I don't have a current comparison to other options.

Eh, maybe.

It's easier to click a single button than hunt for how to create/access an account for the brand.

Logging in isn't consent for tracking. They can even support login by itself without a tracking banner.

Malicious compliance. You do not need a cookie to "store" the fact you have rejected them. They can simply assume you have rejected them from the lack of cookies. They can store a cookie once you (have gone out of your way to) accept them.

Unless disabling cookies means treating all cookies as session cookies (meaning you can still be followed within a session), this has the fun side effect of breaking pretty much every CAPTCHA firewall like Anubis, Cloudflare Turnstile, and any other that relies on cookies.

Unfortunately this means you have to view a lot of the web through archive.today or web.archive.org - I would know because I have uMatrix configured this way.

you can be tracked without cookies - the cookie dialogs are about tracking and processing of personal data in general.

-> not really sensible

You mean: the planet.

(because it drives consumerism)