[gearhart]

This article is completely incompetent.

Firstly - any number of cookies from a single domain are equivalent, you can always use whatever identifier is in the cookie's data to store and retrieve an arbitrary amount of data about the user. That there are lots of them implies either that the site is using a bunch of different front end libraries / components that don't talk to one another (which is irrelevant from a privacy perspective) or that more data is being stored/cached directly in the browser rather than being retrieved from a remote server which is the opposite of a privacy issue, since it's keeping your data in your browser.

Secondly - cookies are one of: "session", "expiring", "perpetual". With the first set to expire when you close the browser, the second expiring at some period between now and when your browser/cache/computer/operating system gets wiped or replaced (i.e. ~<12 months) and the third expiring at any arbitrary date after that (i.e. anything with an expiration date of more than ~12 months is the same, who cares if it's two years or ten thousand).

It's horrifying that this is a study paid for with public money and fed back to the public from a source purporting to be an expert.

Edit: by saying "from a single domain" I'm expressly avoiding the differentiation between first and third-party cookies - it obviously makes a difference how many third parties you share data with, which defensibly has some relationship to the number of different domains that serve third party cookies on a site.

[matthewmacleod]

I completely disagree with your assessment, and I don't understand why you're so offended by it.

The article is accurate and provides details of the methodology and results. Of particular note, if you look at the report, is that two thirds of cookies on UK sites are third-party ones. That's a significant number, and means the average site places 30 third-party cookies on a users machine.

Your proviso about being 'from a single domain' is pretty much irrelevant – that's not the issue at all!

[gearhart]

You're right, the study's not worthless - the "key findings" are all accurate and portray a reasonably sensible, true-to-life picture of the results, and we do need more easily-consumable, experimentally-justified content to help ensure that the public doesn't end up backing stupid laws.

That said, the article's focus on 31st December 9999 and outliving the lifespan of the user, the discussion around the number of cookies served (rather than the number of parties serving cookies, and the amount and type of data that they're storing, which is what we're really concerned about here), and the click-baity headline to both the page and the HN article take what was probably a very sensible study and pervert the reader into drawing conclusions for all the wrong reasons. Giving public funding to something that's going to place that sort of bias (which in a private news publication would be fine) between the public and science I find pretty galling.

[Nursie]

>> opposite of a privacy issue, since it's keeping your data in your browser.

In a way instantly accessible to the host site. Data I wasn't really consulted about. Data I might not be comfortable sharing every time you ask for it.

This whole law about disclosing cookie use, which I will agree is not necessarily a good approach to the problem, does nevertheless exist because of a problem - People getting tracked, followed and profiled without their permission. Website operators and browser-makers seemed to be complicit in this. Some website operators seem to think it's their god-given right to do whatever they want in the browser on my computer...

[jonatanheyman]

As a website owner I'm free to respond with any HTTP headers I feel like like when your computer makes a request. You're free to use a browser that doesn't decide to store cookies when you get a reply with those headers.

[Nursie]

Indeed you are! Now, how many people have any idea about this, and what have browser-writers been doing to make this area visible and controllable?

Not really very much. Particularly in the mobile space.