Defeating Cookie Banners
transcend.io
transcend.io
Or maybe asked differently: Is people giving actual informed consent to tracking actually a thing? I mean for most people I know, the reaction to such banners is one of:
- opting out
- trying to opt out but being tricked by misleading design to press a "opt in" button
- trying to out out but failing and then "opting in" out of desperation
- people who encountered the previous situations before and "opt in" since they don't have the time/patience to work through the opt out dialogues and decide that tracking is "the lesser evil"
- Not understanding what this is about and just clicking anything to make it disappear
Don't get me wrong, I really like the idea and hope that it will be successful. I just don't see users agreeing to this.
This new consent manager makes it easier for site owners to offer incentives to consent (e.g. share your user journey for 5% off at checkout).
Note: 'Selling your privacy' (and likely incentivizing consent) may not be legal under some regimes, so nuance should be applied to any novel implementations using our consent manager. We have a privacy legal regime detection API which helps enable varying UI & behavior based on user-applicable legal regimes.
(Please don't say IP geolocation.)
This method even supports the nuance of detecting a EU-likely user vacationing in California, affording them both CPRA and GDPR protections. You can try out this API by typing `await airgap.getRegimes()` in your browser console on this blog post.
This method won't scale forever as more states and countries enact new privacy laws so we do plan on eventually falling back to IP geolocation as well.
await airgap.getRegimes()
Also, I can confirm it correctly identifies the regime applicable to me (GDPR).
EDIT: I played a bit more with your blog post, after disabling my Adblock and tracking protection features in Firefox. It seems you're dogfooding your system here and now; I don't see any analytics calls happening beyond the scripts being loaded, and I also see a bunch of requests being trapped by airgap (I found it by doing airgap.export("foo") in the console). Nice work!
(So, what kind of analytics are you getting from this blogpost without asking? ;))
Basically, anything but enabling treacherous design.
This product is currently in closed beta, so I am sure you may have many questions. I will try to answer any questions you have in the comments.
With Transcend Consent Manager, site owners can:
• Block, quarantine, & replay tracking events cross-session or in-place (e.g. a same-session DOM mutation is replayed or a fetch() promise is resolved).
• Override requests to use alternative domains or enforce privacy rules on parameters, skipping the SDK. (e.g. we can automatically enforce Facebook's LDU parameters, Google Consent Mode, Google Ads RDP, YouTube Privacy Enhanced Mode, etc. with no site changes)
• Privately sync consent & quarantine data across a first-party set of hosts without data ever leaving the browser.
Most importantly, this enables sites to ask for consent later in the user journey, eliminating cookie banners.
If you have two funnels A and B and users using path A convert slightly more than users using path B, but path A is way more hidden. If you end up only showing the collect prompt after the conversion, you will get a lot of data about path B, and some about path A. It's really hard to tell the efficiency of each path, you now that. more people come from path B, but you don't one which one is best.
I hate cookie banner, but from a data collector perspective, since they are the first thing people interact with, you are argue that they minimize sampling bias. You approach adds a significant one, which makes all the number you can get from it hard to trust.
Every other stakeholder I can think of will want to know details about a failure or drop-off. Some stakeholders, like User Experience, will only want to know about failures. This tool does not meet their needs.
My experience is that the user base of Google Analytics skews heavily towards marketers, and there is a decent-size market of current GA users that only use GA for the subset of data provided by this tool.
It might help answer the question "which campaigns are performing better relative to each other" as long as we assume that no campaigns are more likely to affect opt-in rates than others. It may even be an improvement over up-front consent seeking, if the theory is that a better checkout UX with less upfront annoyances results in better opt-in rates later on. But it doesn't really answer the bigger question of "is this the best place to spend my marketing dollars" vs, say, investing in campaigns/platforms that may have greater reach but less transparent funnels (comparing a Google Ad to a Superbowl TV ad, for example).
If you use this in a vacuum without any statistical modeling thought, you end up optimizing against algorithmic limitations rather than real customers. At the end of the day you're drastically reducing your sample size, and not in a representative, random manner. Your opt-in users are behaviorally different from the majority of people, and it wouldn't be a good idea to make big decisions based on their actions alone. They are essentially a cheaper focus group, with all the pros and cons of such.
(*Probably a very low percentage, if the recent iOS tracking opt-in is any indication. One analysis says <15% of users opt-in: https://www.flurry.com/blog/ios-14-5-opt-in-rate-att-restric...)
It's vulnerable to implementation changes in the browser network traffic API, though, because the "firewall" isn't a real firewall (just something intercepting fetches and such).
I think it could further be improved by sending a no-op script when the user sends a do-not-track header, which clearly indicates their preference already, saving the power it takes to parse the 30KB of JS and the additional network requests associated with it.
That's on our roadmap.
> It's vulnerable to implementation changes in the browser network traffic API, though, because the "firewall" isn't a real firewall (just something intercepting fetches and such).
With CSP, we can ensure a certain level of network compliance. It's not perfect but it provides useful browser-enforced protections against non-consented data sharing and exfiltration. CSP isn't a panacea but it's getting better over time. For example, navigation (e.g. clicking on a link to navigate to it) rules could be enforced through CSP's new `navigate-to` directive. Our consent manager's patchers don't yet regulate automated navigation but that is also on our roadnap as well.
We do regulate automated form submissions (e.g. used by the Snapchat ads SDK) to comply with user consent though.
I really don't need more setting options tweaks etc. How many people do this carefully on each site? How many are annoyed by this STUPID pop up game that means almost nothing.
It's just that a lot of companies are employing dark patterns or getting it wrong on purpose, and it's working because people are now annoyed at GDPR instead of the companies doing this.
Reject all is pointless. You can do it in browser already. You need cookies to hold a login session - folks who try to get websites to block cookies - it doesn't make sense and isn't what most folks want (I need login, shopping cart etc).
No, you can’t. You can block cookies. GPC enables the ”I reject” signal, so websites that honor GPC don’t have to ask you (i.e., no cookie banner)..
You don't even need consent for login session cookies, provided that is all they are used for. Because the user is already asking the site to remember who they are. Similarly for a shopping cart, as the user is asking the site to remember selected items.
"Reject all for privacy" is about rejecting personal tracking cookies for ads, usually while keeping essential login and shopping cart cookies.
The problem is the zealots here are souring generations on actual user control of data by endlessly requiring more and more notices and popups. Don't annoy 95% of users so some random subgroup can feel smug about themselves.
It seems every CA company now sends me - via PAPER MAIL - a privacy notice of privacy practices. I DON'T CARE. There are no teeth in any of this. Even if there were people don't care.
It's a mistake to think privacy zealots are requiring all those things. They are not; they don't want them. And so they are not to blame for them.
They do want to be able to find out what commitments a company is binding itself to, to be able to hold the company accountable under the law, which acts to curtail some abuses, but even that would be much preferred in the form of statutury commitments that could be assumed by default everywhere, the same way consumer protection law works.
Those endless annoyances are the result of companies that are actively hostile to users who value privacy and to statutory privacy policies in general. So companies make the popups, in particular, intrusive and often difficult to reject properly. Sometimes they outright lie about the GDPR requiring some heavy duty options lists.
I say companies. Usually the worst popups on a site are not from a site's own company, they are from third party surveillance-based advertising services or similar used by the company. Naturally, those third parties are the ones most actively hostile to a privacy oriented society, and on an individual level, most interested in persuading or tricking someone into accepting the tracking.
With regards to CA privacy notices: Imagine how refreshing it would be if it was like consumer protection law protecting you when buying things mail order and against false advertising and faulty products. You wouldn't need to receive a privacy policy at all, because there would be a statutory privacy policy you could always assume and all companies adhered to it. Perhaps you would be able to opt out of privacy explicitly, but you always had the option to take the service without opting out of the statutory privacy policy if you wanted.
There are people carefully going through the deep menus that supposedly turn something off. Why not just control yourself, blow them away if you care.
But key is - I want to ACCEPT all cookies in return for not being asked at all. If I care about tracking many other solutions I can use.
Since obviously the "industry" will ignore that, it should be mandated by law. Everything would suddenly become way simpler: for example, the dark patterns involving hoops we have to jump through to deny consent would suddenly disappear. Policing is easy and could even be automated: if a website shows a "consent form" after a header has been sent, issue a fine.
* https://mastercard.com/blog/2019/why-tracking-tricks-are-not... (please mentally agree before opting in)
"Blame it on the GDPR? Many internet users mistake this annoying situation as a direct outcome of the GDPR, when in fact companies misuse designs in violation of the law. The GDPR demands a simple “yes” or “no”, as reasonable people would expect, but companies often have the power over the design and narrative when implementing the GDPR."
Same guy who sued Facebook and won: https://en.wikipedia.org/wiki/Max_Schrems
Your link leads to https://mastercard.com/api/v4/card-actions/send-money?confir... ?! Edit: I guess this was by design, nice trick.
How is the impact of slower and heavier web page experience measured? I'm sure it has more negative impact than whatever improvement this traced information can help improve.
When a user is opted out of tracking, we can actually observe negative overhead due to performance gains from blocking certain requests.
Performance (and security) is something that we always keep in mind with our consent manager.
On the dev machine? Or also on a smartphone, a several years old pc, etc etc?
If I can read the content around it, then I do that. If not, I probably am not missing much.
Of course, you won't be able to get away with just a simple checkbox there - to give informed consent, I need to be able to review what data is being sent, to whom, and for what purpose. Some kind of popup or summary page will still be needed. However, this has a much different feel to it - as a user, I'd feel respected by you, and I might actually be inclined to opt-in as a favor to you.
RE details screen: given the data is already collected, a smart enough screen could let the user inspect actual data, not just promises. That's probably too much work and isn't going to happen unless someone like you implements this as plug-and-play components, but I imagine a details screen giving me summary like:
- Google Analytics
- Your mouse movements (24213 data points)
- Which links you clicked, and when
- 12 internal
- 2 leading to external sites
- EvilNoGoodCorp Ltd
- Input events in text boxes (234 characters)
[click here] to show recording
As I see it, there is a place for analytics on websites and in software, but it has to be respectful, opt-in, in a culture of mutual help. A nice company asks me to do them a favor and let them watch me as I use their services? Sure, why not. If it helps them make the service better, or stay afloat for longer, I might benefit too. That's a polar opposite of the current culture, where companies feel entitled to as much data as they can possibly get.
On the technical side, I appreciate the detailed writeup. I didn't know you could inject CSP entries at runtime! And then:
> We detect JavaScript network API events by patching and overriding all of the global interfaces used to create network requests, such as XMLHttpRequest(), fetch(), and navigator.sendBeacon().
Holy shit you can do that?! That's impressive, in a positive way, both in terms of the browsers allowing this, and you finding a good use for it.
1. Force (by law) all cookie banners to have specific class, e.g. "eu_cookie_consent_banner"
2. I'll write user css rule that hides this class.
Do companies care?
You can contact your DPA for guidance on the exact process – you may first need to contact the website owner and try to resolve the issue between them, before filing a formal complaint to the DPA.
The list of DPAs: https://edpb.europa.eu/about-edpb/about-edpb/members_en
1. Force (by law) all tracking companies to shut down
2. Enjoy a better internet
The recent changes in iOS for example have led to a situation that none of the startups I'm involved in can buy cheap ads anymore. Revenues are down, investors are unhappy, companies are struggling to find new channels.
As a user myself, I avoid places that seem to track me aggressively but at the same time I occasionally click on ads (Facebook is especially good at it) that are well targeted and on point. Maybe the world needs a different way of delivering well-targeted sponsored content, but nobody has invented one so far.
So before saying "fuck tracking" think of the small guy, the entrepreneur who is trying to reach out to the audiences with their limited funds.
But they did! Many times over!
The current solution isn't the only way to deliver ads to the right audience - it's just the cheapest one. It outcompetes all other approaches. The solution is thus simple: just ban it. Everyone will then go back to whatever is the next cheapest option. Rinse, repeat, until the cheapest option is one that doesn't compromise privacy and isn't destructive to the communications medium.
So what are the different, older ways of delivering well-targeted sponsored content? For starters, opt-in approaches. Mail catalogues, e-mail catalogues, yellow pages, catalog websites, trade shows, etc. - all kinds of services where it's the user who seeks out advertisements. People want to spend money on things, want to find solutions to their problems, want to save money by finding cheaper alternatives. You don't have to shout at them to get them on the market.
> the biggest loser of non-trackable Internet would be small businesses and startups that are trying to find their audiences
I'm somewhat skeptical about this, but even if, I also think that the amount of advertising deployed is keeping the market in an artificially oversaturated state. There's more companies selling commodity products, competing on advertising alone, surviving only because they manage to trick people into buying things. Without so much unsolicited advertising, some of those would have to fold, but I think this would be extremely good for everyone - less spam, less resources wasted on unnecessary production, and less resources wasted on the zero-sum game that is advertising in a highly competitive market segment.
> ... opt-in approaches. Mail catalogues, e-mail catalogues, yellow pages, catalog websites, trade shows, etc. - all kinds of services where it's the user who seeks out advertisements
There's a big problem with this. I don't know what I don't know. Even though I wouldn't voluntarily opt in for ads on my Facebook feed if I had the chance, but some ads are so good that I am sometimes even thankful when I see an interesting promoted product. That's only possible because Facebook knows too much about my interests already. But again, I'm not among those who'd voluntarily subscribe to yellow pages in any shape or form. My IDFA has been disabled since my first iPhone, I have the best paid ad blocker in my browser etc.
All in all, I doubt the industry can make a U-turn and go back to the opt-in model. More realistically we'll have a bipolar world with Apple on one end of the spectrum and the rest on the other.
Even though I wouldn't voluntarily opt in for ads on my Facebook feed if I had the chance, but some ads are so good that I am sometimes even thankful when I see an interesting promoted product
Idk, when things were different, I actually read ads on paper, because it was interesting what companies can offer, and it was versatile. It was like going to a monstrous store with shelfs full of different goods and descriptions. You’re asking how to target a specific interest? A directory. I’d go to a tech section (and many more) weekly just to keep up with the world. I’d share good findings with my friends and relatives, buy interesting things which I know much better than FB ever would. Today directories are dead and I have NO, completely NO way to do that, except by the chance of seeing something on HN or few other sites. Github awesome-something lists are a proof for that: you just can’t reach good stuff with how it all works now.
In other words an “agreement” would not be legally valid unless it was short and simple enough for it to be empirically likely that the user has read it, unless we are in a situation in which a user has explicitly selected a service that they are told involves high legal complexity.
You mean cookie banner vandalism committed by companies who couldn't care about laws and privacy and trick people into consenting through barely legal and illegal popups.
All the companies putting up banners today are clearly using cookies in a manner that would require a banner under EU rules. The EU knew this, and knew the effect their rules would have on the aesthetics and UX of the internet. Hence “vandalism”.
The law is just a bad idea poorly executed, like the obsession with cookies? I assume the law is for normies that don't understand that websites are using cookies to track them, but normies don't know that cookies are used to track them so informing them that the site uses cookies means nothing to them, they will agree cookies not knowing they are actually agreeing to being tracked.
From the point of view of a developer the cookie obsession also causes problems, like what if I use cookies to store the fact that people don't want to be tracked so I don't pester them with the notice? do I need a notice for that? What if I don't use cookies but an e-tag for the same purpose. If I uniquely fingerprint your browser can I then just track anyone anywhere without consent? Im not using cookies.
If the EU wanted to ban tracking users they could easily have just wrote that into law instead of this legal, technical and practical mess.
GDPR is superseded by more specific laws, of course. For example, you can use CCTVs for security, but you also have to prominently display a notice that the store uses CCTV cameras. Also, you cannot store that data indefinitely long, you can't sell it to other parties etc.
So, can websites track and log their users? Yes. Can they sell that data to a million ad agencies? No. Can they use that data to track the user to their home? No.
> The law is just a bad idea poorly executed
The law is an amazing idea. The poor execution is purely on the part of companies (and also developers like you) who have become so used to collecting all the data they can wholesale that they can't even imagine not doing it.
> like what if I use cookies to store the fact that people don't want to be tracked so I don't pester them with the notice?
So, save that cookie, there's literally nothing stopping you from doing that.
> If the EU wanted to ban tracking users they could easily have just wrote that into law
That's basically what they did: you can't collect personal user information that's not required for the functioning of your business without consent. This literally prevents tracking.
1. If you use cookies that are strictly necessary for your site to function, you don't need the banner, at all.
2. For anything else you need a banner.
So, the question is: is it EU that "vandalised the web with cookie banners" or "huge number of companies" that indiscriminately collect and sell your data?
What's to stop airgap.js leaking my data, either deliberately or accidentally? How do I disable it before it starts collecting?
It would be nice to see this post describe whether and how they audited what information is collected and why. The slippery-slope towards ever-more pervasive and clever means of collecting ever-more detailed data about users is truly Orwellian. In fact, it's worse, since Orwell thought it would only be governments doing it when in fact it's apparently everyone. It's no longer normal to defend why so much data should be collected; instead it's so normalised that it's not questioned at all, as here.
We really do need to hold up more examples of organisations who successfully achieve their aims without resorting to surveillance capitalism.
We try to push reasonable defaults where possible, and our optional telemetry only consists of encountered hostnames which should generally prevent PII leaks.
Outside of our optional hostname telemetry, we do not collect any tracker data from customer sites for ourselves.
> What's to stop airgap.js leaking my data, either deliberately or accidentally?
Deliberately: Contracts / legal agreements
Accidentally: Airgap.js regulates itself and do not special-case any connections originating from our own library, so our own data emissions are regulated by airgap.js like any other emission.
> How do I disable it before it starts collecting?
As a site owner, you can easily disable the quarantine and replay features for your visitors. We may expose a way in the future for site visitors to signal to our consent manager that they don't want quarantine + replay. For now, you can send an opt-out consent signal automatically with GPC (Global Privacy Control, implemented by Brave)
Airgap.js does not shield you from this requirement.
If you want your users to not have to step through the Cookie Inquisition, consider the actual business loss of not using cookies [for everybody] any more. Yes, a ton of marketing tools require them, but do you require the tracking aspects of those marketing tools? Food for thought.
For anybody unfamiliar with EU ePrivacy Directive derrived laws, here's the UK's implementation (PECR): https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...
Cookies are shared over the network by default. Local storage is not shared over the network by default.
Regardless, we support configuring our consent manager into the bog-standard norm for customers that share your legal interpretation. Even in that case, nuance can be applied specifically to individual privacy legal regimes (e.g. GDPR), allowing you to use most of our features in other legal regimes (CPRA, etc).
> regulation 6 actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in either case by any method
It's deliberately broad. You store it, you notify them. Full text on this: https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/m...
You need consent (as defined by the GDPR) to store tracking related data on a client device.