alt Hacker NewsKill The Cookie Banner
Comments
> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner.
So lawmakers do know how to make legally binding preferences based on device settings? What a crazy innovation.. now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act nonsense...
Or you could just stop spying on people.
No cookie banner is required for functionally necessary cookies.
It's great they're talking about it, but they should just do like California and DO something about it.[1]
> When the law takes effect in January 2027, Californians will see new privacy options in web browsers. When enabled, these controls will automatically inform websites of their privacy preferences, helping to protect personal information from being sold to data brokers and other third parties. This means they will be able to protect their data — like their browsing history, location data, purchase history, and personal interests — across the entire internet with a single step.
Wow, finally. This would be a major quality of life update for browsing the web. As others have stated, not all sites merit the same preferences. Hopefully they can adapt a middleground of default settings with the ability to customize site by site.
Even well meaning bodies like TFL (Transport for London) have cookie warnings that impede the actual access of the website.
Need to look up a bus time? Full screen cookie consent with accept buttons drawn OFF THE SCREEN.
So much legislation about privacy that involves "oh those bad companies" that ends up putting the onus on the individual to manage it all.
I'm visiting a website, i don't want to make a legal agreement with every website ...
Social media bad for kids? Everyone hand over your ID at the door ...
> automated signals that would communicate your privacy preferences between your device and websites or apps0
Sounds good, as long as it covers the "legitimate interest" bollocks⁰ that is often hidden in inconvenient UI nests as well as the basic preference.
-------
[0] "we see your preference not to be stalked, but we want to anyway, click again for every partner to reconfirm you don't want them following you around"
> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner. Unfortunately, the tracking industry is pushing back – and so far, they’ve been successful.
> ...
> You may think that EU privacy law requires cookie banners. But the law is clear: online tracking is prohibited by default.
That's an excellent idea... lets see how its implemented on https://european-union.europa.eu/index_en
Oh... there's a cookie banner.
I always wondered though why a website in the eu, for the love of their users, won't just drop cookie usage and instrusive third party scripts. Just do analytics on the backend and don't set any cookie, except for tokens in authenticated areas
Actual title: "Stop the tracking circus. Kill the cookie banner!"
;dr
The "cookie banner" is an interactive method used by "adtech" companies to try to get user consent, as required by EU law. The forced interaction makes this method annoying
Google and other "adtech" companies are lobbying EU Member States to vote against giving users a means to non-interactively deny consent
Here's the full text of the bill (Articles 88a and 88b):
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
As written, this doesn't eliminate cookie banners completely, only if your browser is sending a Do Not Track header or similar. That's unfortunate news if you use fingerprint protection - those send default headers, so you'll still be bombarded with cookie banners. Hopefully existing anti-fingerprinting solutions will offer a "default headers but with Do Not Track" option.
Okay, but you can quite literally just delete the cookie banner. Cookie banner forces websites to ask for consent, no cookie banner = no consent = less tracking since they usually hold off on ALL tracking until you interact with the cookie prompt.
I have personally never ever had any problems with the cookie banner since Brave deletes them with 100% accuracy, there's sometimes where a site will refuse to function properly, but it's usually sites I don't care about anyway and if I HAVE to get it working I disable brave shield, turn off all tracking, consent and turn the shields back on.
It is unfortunate that most browsers cannot implement this as it goes against what the companies behind the browsers want. Deleting the cookie prompt would stop people from occasionally just accepting all cookies and opting into tracking after getting tired of it.
This just doesn't make sense. EU regulations are already making progress in improving online privacy: (a) No cookie banner required for functionally necessary cookies, (b) there needs to be an option to refuse tracking cookies in the cookie banner, (c) the dreaded cookie banner appears only the first time you visit a site.
I would say, we are like 80% there. Yes, there are still some dark patterns employed by cookie banners, trying to trick you into accepting tracking. But they are not too hard to make out. And they can be fixed by tuning the regulation a bit: Require the opt-out to be the first choice and the only one with highlighting.
Ad tracking is not going away tomorrow. If we ever are going to get rid of it, we first need legislation to defang it so it stops being a cash-cow. "Tracking prohibited by default" is a great end-goal, but we are not there yet.
Reading between the lines, it appears that there is some new solution proposed to "automatically communicate your privacy preference". That's nice, but when e.g. the Do Not Track header was tried, it just fell flat. So until this new solution is implemented and adopted, I'll take my websites with a cookie banner, thank you.
It is an unfortunate choice that the campaign obsesses over the cookie banner, instead of trying to actually advance the solution that would make it obsolete.
I still don't get why every website has a cookie banner by default. I am data controller for several companies and have lots of exposure to GDPR. All my websites have no cookie banner, as they are not required.
I guess that most companies just chuck it up there as a default so they dont have to read the law, or maybe they are all actually harvesting and selling personal data and therefore require cookies? Who knows.
Would have gone harder without the Corporate Memphis/Alegria art which is the art always used to try and convince you to hand over your tracking rights.
At this stage, it's easier to block them with uBlock and move on.
I don't have a lot of confidence for legislative solutions. Although I admire people who keep trying.
I'm from France, and when browsing, I often get paywalled when I reject all non-essential cookies. The CNIL (who is in charge of the application of GDPR) ruled that this was compliant with GDPR as long as another website was offering an alternative without cookies[1]. Are there similar rulings in other EU states?
1: https://www.cnil.fr/fr/cookie-walls-la-cnil-publie-des-premi... (in french, sorry)
It's technically stupid in the first place.
It's YOUR browser, a locally running software on a physical computer YOU own which memorize the cookie key-value pair a remote host told YOU to memorize and YOU return the same value later. It's YOU who allowed the cookie. If YOU don't want to allow the cookie, YOU simply not allow it.
You are technically 100% control on cookie. These JavaScript implemented in-page UI has no guarantee to respect your wish. But you have a power to disable it.
Cookie banners are just a kind of ad. If you're at the site, the demand you have for the content on the site is probably close to inelastic (especially on services websites). The site exploits its effective monopoly on the content to raise prices to the user (in this case your time, attention, and experience).
There is ZERO cost to abusing the user over, and over, and over again by asking for permission to track them.
We shouldn't have the cookie banners at all because NO company should be able to do anything with tracking data. Just ban the use of user data by companies and most of SillyCon Valley's garbage behaviors are fixed.
Similarly, I should never get "terms of service updates" from digital companies because there should be no changes that they can make. You can provide the obvious service that you're providing; you can't aggregate my data for any purpose other than directly serving me; you can't aggregate my data with that of other users; if you retain my data for any other purpose, the government should take percentages of your revenue. I shouldn't have to wade through the BS that the mercenary corporate lawyers cook up to extract value from me.
Also there's a big difference between the sites that easily allow you to simply reject whatever their premade cookie settings are. And, the sites that only allow you to use them after you've accepted (example, politico.eu). Or, the sites that do have a 'reject' option, but you have to click through multiple screens and then manually reject each individual option.
Sites that easily allow you to simply reject everything are then a short hop, skip and a jump into browser settings where you auto-reject all cookie/tracking nonsense
I think this would be a net benefit, but I can see an issue. A lot of news sites today do "accept tracking, or pay us, or you can't access the page". The orgs doing this are reputable-ish so I assume it's considered legal, on some level at least.
So now they'd have a new popup that says "reconfigure your browser to accept tracking, or pay us, or you can't access the page". Which isn't really an improvement.
And guess who makes the most of devices and the most popular browser, I already see post install "Get most of the browsing experience by agreeing to these defaults."
What does enforcement of not having these banners look like? Wha tif people just... didn't.
This ones a little tough. Advertising through trackers is a massive portion of how sites get revenue. Going back to the old days would decimate this space, and have widespread effects on the internet (though im not sure it would be noticed by most of us anymore with how dead the internet feels now)
I guess what I'm saying is, there is no good solution here. I don't want every site I visit to require a usage fee just to browse. Imagine if slashdot turned into WSJ with a paywall for every article.
Kagi already does something like this, and cool - if you use it enough, maybe its worth a subscription. I dont find myself googling (searching) much anymore, so paying to do so just becomes something i need to find a way around. Like API token usage for AI, using it is like making a new recipe in the oven every time. You expect it to work but you have to invest the time and money into the attempt before you can find out the results (whereas you dont have to do this on free chatgpt, google search with ai, etc as comparison). Too much investment without guarantee of results. I'm fine without that guarantee as long as im not wasting my time and money upfront.
Anyways, thanks for letting me rant
Yes please!
> he EU Commission finally proposed a solution to the cookie banner problem: automated signals that would communicate your privacy preferences between your device and websites or apps.
It wasn't on EU Commission to "finally propose a solution". The soluton has always been there.
Somehow, Google, aka world's largest tracking and advertising company incidentally making the worlds' dominant browser and completely dominating all web standards, couldn't be bothered, and instead was pushing crap like FLoC
is there an extension that modifies the cookie, changes values randomly? This will pollute their analysis with junk.
This should just be a browser setting with a per site opt-in when more data collection is needed. Just like you can enable notifications, webcam etc... or set it to always deny.
Why the fuck do people have to keep stating the same preference over and over again. This is a hellscape of bad government AND corporate policy colliding.
The insanity around cookie banners is a good target.
> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner.
Fortunately, if you have uBlock Origin, you can enable Easylist cookie notices under annoyances and avoid most of them. Combine with blocking third-party cookies, and the problem pretty much disappears.
The fact that the EU tried to regulate this stuff is a shame, because regulation is not a good remedy. End-users have agency here. The solution is to enable end-users to have control in their browser (which they always did, so it's an issue of education, like so many things).
Shame that Google is trying to kill uBO though. Extremely pleased that Brave continues to support it.
Every time a Cookie banner pops up, I want to kill it forever
Usually government mandating something is concerning cause it seems to favor the government for its existence. However with EU commission its actually interesting combination, its representing multiple individual governments at once which somehow works good for the citizens.
Overall this is a common sense solution. The challenge is that a significant industry makes money by collecting and selling data. It makes it harder for businesses who depend on it, they are going to get creative and will eventually come up with some dark pattern to circumvent it.
It would have been funny to get a cookie banner on this site. They missed a good opportunity.
No, please don't!
It's great. The current law forces people that don't give a shit about user privacy to have a banner (or any other way of asking for consent first) while giving everyone that cares and everyone not wanting to spy on their visitor a free pass.
uBlock Origin with all "annoyance" filters enabled. I haven't seen a cookie banner in years.
Another good one to have the "hide Youtube shorts" filter, featured on HN a while back.
I am old enough to remember Do Not Track and its failure and problems associated with it. What's new here? Why wasn't it adopted in the first place for GDPR?
The solution would be for browser to send do not track header and have that header be respected.
But we can't have that, can we ? They will lobby to hell and back for that to not happen
Uhm…
> The solution: automatically communicate your privacy preference
Would be lovely and would happen if it weren't for… wait for it… Google and whole effed up ad-busines:
https://ppc.land/eu-council-drops-cookie-signal-after-google...
F*ck google and other BigTech…
So DNT back again?
I expanded Polish politics names and what I saw made me vomit. Will never send email to those fuckups.
This initiative is ignorant and idiotic. The authors don't even understand the purpose of cookie banners.
1. Making tracking impossible/illegal would NOT kill cookie banners, since you need them to record consent for other purposes as well, such as embedding a video from a third party like YouTube.
2. The GDPR explicitly prohibits site-owners from making cookie banners misleading. The law is already there, it is just not very well enforced.
3. "This results in up to 90% of people saying “YES” – even though only around 3% actually want to be tracked online" This claim is grabbed out of thin air and can be dismissed as such.
4. "The solution: automatically communicate your privacy preference" This is nonsense because it does not actually solve anything, because you need to record consent for a variety of purposes, not just analytics/tracking.
5. Killing tracking would kill the value of ads (since they are not targeted anymore), resulting in a reduced ability for small businesses to advertise and a hugely increased amount of ad spam everywhere. Few targeted ads > Many untargeted ads
Unless you want an internet where advertising is no longer possible, this solves nothing apart from stroking a few activists ego.
The captchas are worse imo (from an usability standpoint) especially the newer Cloudflare infront of everything to check for bots trend.
Even if you communicated your preferences sites would still want to ask for an exception to them. At least you won't see them ask for consent if you preapprove it.
how about: -if we really don't like targeted advertising, just outlaw it -then let websites do whatever they want with our cookies so long as they aren't targeted advertising
instead of building websites and writing laws over the span of decades that just seem to want to ban targeted advertising but don't actually do it. FFS.
Doesn't this lead to an all-or-nothing approach?
I don't want randomnewssite to track me. But a favorite online store...I do want help with recommendations.
All browser providers have been required by international law[1] to send such a cookie popup suppression signal as set by the user, or one substantially like it, since July 18, 2026 and all web sites have been required to obey it or a superseding Internet standard:
https://stateofutopia.com/laws/2/law2.html
This is not a proposal, it is duly ratified international law that applies to "Every Browser Maker making a Browser available anywhere" and "Any site anywhere that receives a valid signal".
The EU Commission had until July 18, 2026 to modify its laws:
>"The site shall not display a banner, modal, interstitial, or other prompt requesting a choice already expressed by the signal. It may optionally provide a “Cookie Settings” or “Privacy Settings” link. This Law overrides all laws requiring such a display. Where any country or supernational entity has a conflicting law, it must rectify the Law within 30 days not to require such notification."
Therefore, insofar as it has not rectified its laws not to require such a notification, the EU Commission is in violation of international law as of 8 days ago.
Under section 7.3, "The State of Utopia may order compliance, require corrective updates, suspend non-compliant distribution, and impose civil penalties. Fines may be levied in any amount for continued non-compliance." so we can fine the EU Commission whatever you guys want ($1 billion? $10 billion? whatever four and a half millennia are worth) and just distribute the collected fines among you all as cash payments.
[1] Here is the announcement of the law 38 days ago: https://news.ycombinator.com/item?id=48585778
The other approach to killing the cookie banner is simply to declare that such a thing cannot constitute “informed consent”. (Perhaps: “ticking a checkbox and/or clicking a button cannot constitute informed consent”; and see what they try next.) From a factual perspective, I honestly think that shouldn’t be controversial: it’s well-understood that very few people actually read those things, they just want to get them out of the way. Just as shrink-wrap licenses and even simple contracts have at times in some jurisdictions essentially been neutered, so that only terms that a reasonable person would expect to be there are enforceable, at which point it becomes obvious that the whole thing needs tearing down in favour of standard licenses/contracts. In the Australian state Victoria, for example, there are standard rent and property sale contracts; for renting you must use that contract <https://www.consumer.vic.gov.au/housing/renting/starting-and...>, and I got the impression that residential sales practically always use the standard contract.
But of course it’s impossible to convince someone of something when their livelihood depends on their not understanding it.