[mike_hock]

Don't fall for the "we are just stupid" propaganda, which is used constantly by governments acting in bad faith.

Browsers already had settings for deleting cookies. There was never a reason for banners whose only function was pulling the ladder up from smaller competitors and concentrating power in the hands of an oligopoly that could siphon data directly from the OS.

This coupled with a law mandating ISPs provide a "change IP on demand" feature would have given users a sort of "Tor light" level of privacy. Strong privacy is trivial to achieve for a government that doesn't have a conflicting goal of total surveillance.

[morsch]

But I don't want to delete cookies? I want websites to use cookies that are technically necessary e.g. for keeping me logged in. I just don't want them to use it to track my behavior especially inter-website.

[bhaak]

The EU law already allowed technically necessary cookies without any banner.

Every time you get a cookie banner with options, the website wants to know more about you than the law permits by default.

[toxik]

... or cargo culted a site that did. I think this is far more common. It's almost like you're not a serious web site if you don't have a cookie popup of some kind.

[mike_hock]

Interwebsite is solved by partitioning and login cookies are solved by explicit whitelisting.

[inigyou]

You think the average user is going to explicitly whitelist? The law requires sites to whitelist their own cookies under penalty of law, instead.

[mike_hock]

> You think the average user is going to explicitly whitelist

When prompted by the browser on first login/signup, yes, the same way the password manager works. With stored passwords, keeping the login cookie doesn't even add much value.

[inigyou]

What about the other 200 unskippable prompts you get just by opening the website?

Well, there is a skip button. It's labelled "accept all"

[IanCal]

It’s not about cookies. It’s about what the site is allowed to do with your data. Cookies are an implementation detail.

It’s baffling we’re having this misunderstanding on this site in 2026 still.

[TurdF3rguson]

Is there any other way to get that data? It's clearly about cookies but it's specifically about tracking cookies.

[dredmorbius]

Supercookies: <https://www.comparitech.com/identity-theft-protection/superc...> <https://www.eff.org/deeplinks/2009/09/new-cookie-technologie...> <https://www.eff.org/deeplinks/2014/11/verizon-x-uidh>

Browser fingerprinting / Panopticlick: <https://ssd.eff.org/module/what-fingerprinting> <https://panopticlick.org/>

On-device identifiers --- Google AdID (GAID), Apple IDFA, etc.: <https://developer.transmitsecurity.com/guides/risk/secure_de...> <https://geraguard.com/blog/how-device-fingerprinting-works-m...> <https://alejandrocordon.com/blog/2025/01/18/unique-identifie...>.

[TurdF3rguson]

Sure but these are all the same thing as cookies.

And BYW, browser headers can even be a violation if it's determined that you are using them for tracking users in a way that violates ePrivacy demands.

It's still a cookies thing.

[IanCal]

Browser fingerprinting is not cookies. Cookies are a very specific technical thing.

[IanCal]

GDPR is not about cookies, and what data do you mean? The data about how you use the site, tied to anything they can identify you with?

[rtpg]

This framing of the banners as cookie banners is a dodge. It's not about cookies.

The cookie banner isn't about the usage of cookies, it's about _the underlying tracking_. You're allowed to "just" use cookies for normal shit! You can make a website where you use cookies to store login state for a user, without a single banner.

The thing is that every company in the world feels the need to add 1000 tracking cookies to anonymous users to track them through conversion funnels (on top of the ad stuff). That's what you have to inform people about

You can use cookies normally without a banner! You can't track without consent! Every cookie banner is actually a "we want to track you" banner. Calling it a cookie banner is playing into the confusion about what those banners actually are meant to communicate

[aspbee555]

changing IP is not really enough for privacy, there is many ways to fingerprint your machine/browser and uniquely identify you across networks

https://creepjs.org/checker

[mike_hock]

No, but it's the obvious starting point. You can then put additional laws on top banning fingerprinting out of band (if you care about window dressing), fund development of anti-fingerprinting technologies, fund Tor, run exit nodes in a transparent and publicly auditable fashion, etc.

It's not hard to make privacy work when you are the government rather than working against a hostile one.

[IanCal]

We have those laws. You need consent regardless of how you get the data. That’s they say “we value your data” (a phrase you can read in two ways) and ask if 1368 partners can have it for various uses.

[Jtarii]

Is there any reason to believe that the current laws being passed by the UK, EU are against the will of the people? Everything I have seen makes the "anti-porn" laws or whatever seem extremely popular.

[AlienRobot]

Exactly. Nobody wants to go to a news website/entertainment website/informational website that relies on ad revenue because they will get bombarded by banners and then by a huge number of ads that were increased because those banners slashed their ad revenue.

So instead everyone stays on Facebook, Instagram, Reddit, and Twitter, which ALSO operate on ads and have far more information on their users than any third-party ad tracker could ever have.

None of this has gotten rid of the privacy problems. It just consolidated them into the worst offenders while jeopardizing the plurality of the web. Now instead of people being tracked by Facebook on a website with a third-party cookie in a like button, they are tracked by Facebook on Facebook in a Facebook page because they never leave Facebook.

[inigyou]

I think it's because every single website breaks if you don't allow cookies at the browser level. Some knowledge of what the specific cookie does was necessary.

[croes]

You mean we had the DNT flag in the browser.