Hi,

In Spain (and probably other places in Europe) we’ve recently seen a deluge of cookie banners that offer you the option to reject tracking cookies for a fee. The regular GDPR forms are therefore slightly broken, as you get several options: accept, reject (which doesn’t work in most cases), and buy a subscription to reject. Consent-O-Matic, for example, is having a hard time. I don’t doubt it’ll get corrected in time, but I want to talk about something tangential.

Cookie consent has (at least) two layers: the browser layer (where we might delete cookies, reject third party cookies, etc) and the site UI layer (where we’re presented with an option when we load the page). This means we can reject third-party cookies at the browser layer and then accept whatever form at the site UI layer.

With the set up mentioned above, is there really any difference between accepting cookies and rejecting cookies? No tracking cookie are going to get installed in my computer anyway. This, combined with an ad blocker, makes the browsing experience exactly the same whether I accept or reject the cookie form. Is there anything I’m missing here?

  • Shamot@jlai.lu
    link
    fedilink
    arrow-up
    28
    arrow-down
    1
    ·
    10 months ago

    When I see this, the only viable option I see is to close the site and boycott it. Any other choice would encourage more companies to do this blackmail.

    • Cheradenine@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      4
      ·
      10 months ago

      While I agree, and I use TOR or Orbot for everything( which means quite a few things are blocked for me), this doesn’t answer OP’s question.

    • Agility0971@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      10 months ago

      In duckduckgo search results there is a link to block this domain. I always block shitty domains that farm clicks

  • Engywuck@lemm.ee
    link
    fedilink
    arrow-up
    9
    arrow-down
    2
    ·
    edit-2
    10 months ago

    Interesting question. IMHO you’re right: if you reject 3rd party cookies at browser level, so “accepting” them from the GDPR form shouldn’t really matter. Plus, many browsers nowadays forbid 3rd party websites to access cookies from other websites (in my understanding)…

    I’d like someone with a more deep knowledge to contribute to the discussion.

    • Atemu@lemmy.ml
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      10 months ago

      Cookie banners are not really about cookies.

      What they’re actually asking for is consent to process your data for profit in unethical ways. That usually involves cookies but could theoretically be done entirely without. They’re just a technological standard.

      You might aswell say: “We use https. [consent] [settings]”

  • Cheradenine@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    1
    ·
    10 months ago

    It is an excellent question, but there is a third option, which is also blocking at the DNS level. Firefox and Safari block 3rd party cookies by default too.

    In your example I do not think there is a difference, and my firewall logs seem to confirm this.

    • rinze@infosec.pubOP
      link
      fedilink
      arrow-up
      2
      ·
      10 months ago

      Yes, I’m aware those filters exist, but I’m asking about the practical implications of the set up I mentioned in the post.

  • beta_tester@lemmy.ml
    link
    fedilink
    arrow-up
    2
    arrow-down
    4
    ·
    edit-2
    10 months ago

    When accepting a cookie, the cookie is stored on your machine locally for the duration of your browsing session on that site, IF you clear all cookies after a site visit with cookieautodelete. Or they are deleted after quitting the browser session, i.e. after exiting all open tabs AND you’ve enabled the setting to auto clear cookies.

    With cookie autodelete (or firefox containers) and a normal browsing behavior it does not matter much if you accept or delete them, if there is no personal identifier like login data or IP address (always use vpn).

    Consent o matic doesn’t work on as many sites as istilldontcareaboutcookies and with the up and coming internal firefox functionality isdcaac will hopefully be obsolete within a year or so

    • RovingFox@infosec.pub
      link
      fedilink
      arrow-up
      6
      ·
      10 months ago

      I recommend you look into web fingerprinting. IP and login data are no longer the only data required to pin point you on the web.

      • beta_tester@lemmy.ml
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        10 months ago

        I know how web fingerprinting works. I don’t visit sites regularly that use advanced techniques which shouldn’t get my info, and if, I would overthink my web browsing behavior. For regular websites it’s just too much of a hassle to use advanced fingerprinting methods

        • RovingFox@infosec.pub
          link
          fedilink
          arrow-up
          1
          ·
          10 months ago

          How do you know they don’t use “advanced techniques”? I think you gravely overestimate the complexity of adding them to a website.