Prebake: Block EU Cookie Notices with Adblock

[Udo]

This whole thing is ridiculous. While adding these widgets to blocking filters seems like a workable short-term solution, the entire cookie notice scheme is unworkable in the long run. The problem is, this crap will stack up in the future, and none of it will ever get abolished. On some sites, I get a triple-stacked legalese warning banner, and I have to manually close all three of them.

Since internet law will only get worse, maybe it's time for a "real" technical solution to this. For example, if we had a standardized HTML element attribute to mark these widgets, browser/adblock makers could enable people to opt out of displaying them. It might look something like this:

  <div legal-notice="cookies">...</div>
  <div legal-notice="DMCA">...</div>
  <div legal-notice="terms-of-service">...</div>

And ideally, there would be a JavaScript API to query this as well, maybe piggy-backed on the Permissions API:

  navigator.permissions.query({ name : 'skip-notice', topic : 'cookies' })

[mstade]

Frankly, the requirement of notice could (and should) be pushed on to user agents – not sites. For one, it would help standardize both the user experience of notices – and leave the UX of website specific notices alone – but also it would improve the current state of things where many (most?) sites in the EU simply don't care or know about the legislation.

The last thing we need is more cruft sent across the wire.

[gozo]

The "real" technical solution here is to standardize a modern authentication system separate from cookies and have things like "do not track" actually work. The industry has, seemingly deliberately, failed to do that. So the EU has rightfully argued from "first principle" that privacy and data protection is more important than the status quo in the industry.

[blub]

Why block them? It's good that websites have to be more transparent with how they are tracking users.

It is however inconvenient for the websites. They could always stop using privacy-invading ad networks and external services which track users and then they wouldn't have to show any message.

[Kequc]

These laws are still evolving and changing. Different for every country. We don't have something international we can build standards upon at this point in time.

It seems to me there would also be an active push against any such implementation because it would make current solutions for getting around this type of cruft more effective than it already is.

Although if we were going to go this route I'd like to see it be a server-side rather than included in the markup. The browser could detect that you are visiting a new domain and request relevant information upon connection.

[mtgx]

This reminds me there was a push for a 451 error that would represent censorship. Whatever happened to that?

https://boingboing.net/2012/06/13/error-code-451-an-http-err...

[facepalm]

Well browsers could send an "allow cookies" header, like the "don't track" header?

[skrause]

This stupid cookie notification law was actually the main reason why I had to enable cookies permanently. My browser used to delete all cookies at the end of the session (when I closed the browser) except for a few whitelisted domains.

Then these notices popped up everywhere. So where do the sites store the information that you've already seen the notifications? In the cookies of course! So if you're actually serious about your privacy and delete cookies you will the the notices every time...

[belorn]

The reason that the EU cookie law broke down is that directly after the EU directive was issued, several lawyers from large companies changed their interpretation of an older 1995 directive that dictate how consent is given. The directive says that consent require "specific and informed indication", but lawyers from very large companies decided that the act of continuing using a website was the same thing as giving "specific and informed indication", thus users agreed to whatever policy or agreement that is linked in the banner.

I visited a conference during that time which had a panel where those lawyers was discussing this and even brought up a question if a person really could agree to 20 pagers of policy document from the mere fact of just continuing using the website, and their collective answer was yes (through one agreed that 30 pages would be too much). To my knowledge no legal case has ever tested this, and thus we got this ridiculous cookie notice system where things has gone from bad to worse after the 2002 directive.

[facepalm]

Thank god, ehm, the lawyers: otherwise we would not just have annoying banners, every page would start with an blocking dialog. No thanks.

[liam_ja]

Hi HN, I'm the creator of this filter list.

If anyone can spare 5-10 minutes a week to help me and a couple of others maintain this list (testing and merging pull requests, closing issues, etc.), I'd be very appreciative!

You can contact me here or send an email to cookies[at]prebake[dot]eu

[cpeterso]

If an extension like Prebake (which I realize just a filter list) added a 'DNT: 0' HTTP header (Do Track instead of Do Not Track), then automatically dismissing cookie notices would be a "legitimate" new solution and not be "cheating" (as some might call it). If the user also runs a ad or tracker blocker, well, that's their business and a different problem. ;)

[kwhitefoot]

Could you explain what this would entail? You might get more interest if people knew in advance what they would be in for.

[vruiz]

This is great not just from a user's perspective, also the fact that it exists helps pointing out the stupidity of the law.

[oliao]

I think they hoped this law would encourage sites that people don't expect to have cookies to not set cookies until necessary. Like state sponsored news sites for example. I mean, really: why on earth does a site like that need to set cookies? To remember which videos I have watched?

The real problem here is probably Google Analytics.

[cornewut]

I think law is fine and there should be only a handful of sites in the Internet that would need such warnings.

Problem is the abuse of technology to track users.

[sp332]

The law does not require sites to put up giant banners for every page load. As belorn points out, this was caused by the interpretation of nervous lawyers and hasn't ever been tested in court.

[lucb1e]

Tried this before and it helps only so much. Many sites actually don't work before you accept cookies (they pose it as a requirement and tell you that cookies keep you logged in, even though the cookie law is only applicable to tracking cookies) so you need to see the banner before you can see the page. Examples: fok.nl and tweakers.net.

[andrewaylett]

I've been using a different filter list[1] for more than a year, and it's really useful as I already use self-destructing-cookies[2] to exercise control over which cookies my browser will remember, meaning that pretty much all sites think I've never visited before and therefore try to annoy me with their cookie banner.

[1]: https://github.com/r4vi/block-the-eu-cookie-shit-list

[2]: https://addons.mozilla.org/en-GB/firefox/addon/self-destruct...

[DavideNL]

> meaning that pretty much all sites think I've never visited before

True, but also not True (unfortunately), because the websites can identify you anyway by your fingerprint: https://panopticlick.eff.org

[roel_v]

It's depressing that we need something like this.

[DavideNL]

It seems uBlock (Safari 9) doesn't recognise this when i add it to the 3th party filters/custom URLs - when i click "parse" i don't get to see a new row with a checkbox. example:

this works: https://raw.githubusercontent.com/r4vi/block-the-eu-cookie-s...

this doesn't work: https://raw.githubusercontent.com/liamja/Prebake/master/obtr...

[tdkl]

True, although it's already in the 3rd party list and you can just enable it there.

[prodmerc]

Well, this is just funny. Or sad, depending on how you look at it.

Personally, I'm annoyed by the cookie messages, but the law is supposed to help people.

Blocking (or auto-accepting) them is basically saying we don't give a shit about this law :-)

[Kequc]

Cookies are integral to the operation of every modern website. They offer security in the form of features like csrf protection or maintaining login state between visits. There is sufficient protection for cookies in the form of encryption and a laundry list of further details which have been added over the years.

There are far larger security related concerns on the web. The cookie warnings are on par with if you had to agree with Javascript running on any page you visit in the EU. So, yes, I want to auto-accept.

As a developer I feel like I'm not going to make special considerations that ensure you can use forms on my website without cookies enabled. And I'm not going to find another way to detect and re-instate your login state.

[r3bl]

From my experience, most of the sites that have this warning only have a single button: accept. No way to disallow the cookies that get stored regardless of how you react to that popup. This will just save me a click.

[JelteF]

There already existed a plugin for this https://cookiesok.com/, but it misses quite a lot. Hopefully this works better.

[foobuzz]

This law is so badly designed it is beautiful.

It warns users who don't accept cookies that the website uses cookies, at every connexion. It doesn't warn users who accept them that they're used, putting aside the first connexion.

It should be the other way around. The website should warn the user that a cookie is used when the website just accepted a cookie from the browser. The privacy concern happen at this very moment, when you phone back to the website, not when the website phones you information.