Google's First Party Sets (FPS) AND WHY SHOULD YOU STOP USING CHROME BEFORE IT'S TOO LATE

[Falna]

Off-topic:

The cookie warning does not improve privacy, but the GDPR rules that it is necessary to inform the user when saving data.

If you only serve 'strictly necessary cookies' - those essential to the functioning of the website (normally first party session coolies) - no warning or permission is required.

If you serve preferences cookies, statistics cookies or marketing cookies (all of which can be used to track a user, directly or indirectly), then permission is required - but the site must remain functional if you refuse them.

So yes, the rules do improve privacy.

The user can deny [cookies], but most sites stop working if they do so.

If the site stops working, it's breaking the law, as above!

In more detail:

To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must:

Receive users’ consent before you use any cookies except strictly necessary cookies.
Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
Document and store consent received from users.
Allow users to access your service even if they refuse to allow the use of certain cookies
Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

https://gdpr.eu/cookies/

[Pentium4User]

Then many sites are breaking the law, there are certain German websites that only work if people allow tracking/statistic cookies.

[Moonchild]

Off-topic:

Then many sites are breaking the law, there are certain German websites that only work if people allow tracking/statistic cookies.

The GDPR isn't about the technical limitations of a website or tracking/statistics being an integral part of the website. It's fine to have a site that requires tracking/statistics to even work; that's not breaking the law, at all.

The GDPR is about consent and informing users that this is occurring. If you aren't using user's data in a way that would breach the GDPR, then you don't have to ask for explicit consent (but should still inform) -- this is the way Pale Moon's website and forum works and why you don't have to tick an obligatory annoyance consent box or what not. Quite a few websites don't actually have to present the annoyance consent box, but it's become a de facto practice to "just be sure" they won't get into legal trouble if the data is actually shared.

the site must remain functional if you refuse them.

This isn't true. The site must remain accessible (i.e. you can't flat-out refuse users if they don't consent) but there's no need to guarantee full functionality.

The GDPR is not straightforward though:
Documenting and storing consent received from users in and of itself would be a tracking datapoint. The GDPR actually enforces tracking in itself to comply with it.
Not a single site I know of has an equally easy consent withdrawal as consent-granting procedure, so the GDPR fails pretty hard there.
In addition, if a cookie prevents a user's use of the site outright then that cookie would be a "strictly necessary cookie" for which no consent is required, so how you interpret that if a site is built explicitly around a tracking cookie (and doesn't work if that cookie is blocked) becomes complicated, legally speaking, and difficult to enforce.

[Falna]

Off-topic:

The site must remain accessible (i.e. you can't flat-out refuse users if they don't consent) but there's no need to guarantee full functionality.

It goes further than that, as also mentioned in the Guidelines 05/2020 on consent under Regulation 2016/679:

In order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information already stored, in the terminal equipment of a user (so called cookie walls)

[Falna]

Off-topic:

The site must remain accessible (i.e. you can't flat-out refuse users if they don't consent) but there's no need to guarantee full functionality.

It goes further than that, as also mentioned in the Guidelines 05/2020 on consent under Regulation 2016/679:

In order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information already stored, in the terminal equipment of a user (so called cookie walls)

In addition, if a cookie prevents a user's use of the site outright then that cookie would be a "strictly necessary cookie" for which no consent is required, so how you interpret that if a site is built explicitly around a tracking cookie (and doesn't work if that cookie is blocked) becomes complicated, legally speaking, and difficult to enforce.

I'd interpret it as clearly illegal, as per the guidance above.

[Moonchild]

Off-topic:

In order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information already stored, in the terminal equipment of a user (so called cookie walls)

I'd say the intent there, also, is, once again, that things may not be specifically blocked. (i.e. you can only use chat if you let us track you, as a specific choice, not a technical side-effect).
But this is why so many lawyers have been busy with GDPR legal cases since its inception. The wording is difficult to interpret.
Let's just leave it at that

[athenian200]

Off-topic:

In order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information already stored, in the terminal equipment of a user (so called cookie walls)

Off-topic:
I could actually see that resulting in a lot more "free" services currently funded by ads going behind paywalls or suddenly begging for donations to try and stay afloat. If they are required to provide service to people who won't allow collection of data, then it could become unprofitable to operate the service if a majority of users opt-out of having their information sold to advertisers who are paying for the site's operation. If they must allow users who don't want their data shared with advertising companies to make use of their service, then they will have a harder time keeping advertisers on board, and eventually only option they have left at that point is to either beg for donations or restrict access to users who will pay.

Another interesting side-effect is that if an advertising company also provides a service, then they might have an advantage in that they don't have to share or otherwise permanently store the user's data to market to them while using that platform. Google could just setup a script that uses your data in real-time, on their own first-party stuff, to serve up an ad that would be internal for them, and then discard the information used to serve the ad rather than storing it, effectively getting around the GDPR. In other words, it could unintentionally provide an incentive for Google to buy up competitors and push users even harder towards services they provide internally and eventually refusing to cooperate with any outside companies or run ads on other sites.

[Moonchild]

Off-topic:

If they are required to provide service to people who won't allow collection of data, then it could become unprofitable to operate the service if a majority of users opt-out of having their information sold to advertisers who are paying for the site's operation.

That shouldn't be much of an issue unless you want personalised ads. Of course showing non-personalised ads might reduce advertiser income too.

Even more off-topic:
Then again, I've discovered new things from ads that weren't personalised, because personalised ads tend to just advertise stuff I already know or have, so am not even interested in...
I don't know how other people work in that respect but I'd be more interested in seeing ads of something I don't know to pique my interest rather than something ive already made up my mind about and purchased before

[mr tribute]

Temporary victory regarding First Party Sets.

W3C Technical Architecture Group slaps down Google's proposal to treat multiple domains as same origin
https://www.theregister.com/2021/04/08/ ... e_domains/

[Moonchild]

"First Party Sets could let a user agent or browser approve sites as a set in the interest of those sites or cookie-issuers (like advertisers), rather than in the interest of the user," said the TAG.

That's exactly what I indicated above
Glad to see the TAG is still somewhat using their brain and not being swept under by Google.

[jangdonggun1234]

Temporary victory regarding First Party Sets.

W3C Technical Architecture Group slaps down Google's proposal to treat multiple domains as same origin
https://www.theregister.com/2021/04/08/ ... e_domains/

Being able to track users across thousands of domains has always been Google's wet dream, they will probably end this once for all. Collecting data is very beneficial nowadays because those data can be used to feed AIs/neural networks.