Cloud Hosting

In the latest quasi-throwback toward do not track, the U.K.s data protection chief has come out in favor of a browser- and/or device-level setting to allow internet users to set lasting cookie preferences suggesting this as a fix for the barrage of consent pop-ups that continue to infest websites in the region.

European web users digesting this development in an otherwise monotonously unchanging regulatory saga should be forgiven not only for any sense of dj vu they may experience but also for wondering if they havent been mocked/gaslit quite enough already where cookie consent is concerned.

Last month, U.K. digital minister Oliver Dowden took aim at what he dubbed an endless parade of cookie pop-ups suggesting the government is eyeing watering down consent requirements around web tracking as ministers consider how to diverge from European Union data protection standards post-Brexit. (Hes slated to present the full sweep of the governments data reform plans later this month.)

Today, the U.K.s outgoing information commissioner, Elizabeth Denham, stepped into the fray to urge her counterparts in G7 countries to knock heads and coalesce around the idea of letting web users express generic privacy preferences at the browser/app/device level, rather than having to do it through pop-ups every time they visit a website.

In a statement announcing an idea she will present this week during a virtual meeting of fellow G7 data protection and privacy authorities less pithily described in the press release as being on how to improve the current cookie consent mechanism, making web browsing smoother and more business-friendly while better protecting personal data Denham said: I often hear people say they are tired of having to engage with so many cookie pop-ups. That fatigue is leading to people giving more personal data than they would like.

The cookie mechanism is also far from ideal for businesses and other organizations running websites, as it is costly and it can lead to poor user experience. While I expect businesses to comply with current laws, my office is encouraging international collaboration to bring practical solutions in this area.

There are nearly 2 billion websites out there taking account of the worlds privacy preferences. No single country can tackle this issue alone. That is why I am calling on my G7 colleagues to use our convening power. Together we can engage with technology firms and standards organizations to develop a coordinated approach to this challenge, she added.

Contacted for more on this idea, an ICO spokeswoman reshuffled the words thusly: Instead of trying to effect change through nearly 2 billion websites, the idea is that legislators and regulators could shift their attention to the browsers, applications and devices through which users access the web.

In place of click-through consent at a website level, users could express lasting, generic privacy preferences through browsers, software applications and device settings enabling them to set and update preferences at a frequency of their choosing rather than on each website they visit.

Of course a browser-baked do not track(DNT) signal is not a new idea. Its around a decade old at this point. Indeed, it could be called the idea that cant die because its never truly lived as earlier attempts at embedding user privacy preferences into browser settings were scuppered by lack of industry support.

However, the approach Denham is advocating, vis-a-vis lasting preferences, may in fact be rather different to DNT given her call for fellow regulators to engage with the tech industry, and its standards organizations, and come up with practical and business-friendly solutions to the regional Internets cookie pop-up problem.

Its not clear what consensus practical or, er, simply pro-industry might result from this call, if anything.

Indeed, todays press release may be nothing more than Denham trying to raise her own profile because shes on the cusp of stepping out of the information commissioners chair. (Never waste a good international networking opportunity and all that; her counterparts in the U.S., Canada, Japan, France, Germany and Italy are scheduled for a virtual natter today and tomorrow where she implies shell try to engage them with her big idea).

Her U.K. replacement, meanwhile, is already lined up. So anything Denham personally champions right now, at the end of her ICO chapter, may have a very brief shelf life unless shes set to parachute into a comparable role at another G7-caliber data protection authority.

Nor is Denham the first person to make a revived pitch for a rethink on cookie consent mechanisms even in recent years.

Last October, for example, a U.S.-centric tech-publisher coalition came out with what they called a Global Privacy Standard (GPC) aiming to build momentum for a browser-level pro-privacy signal to stop the sale of personal data, geared toward Californias Consumer Privacy Act (CCPA), though pitched as something that could have wider utility for internet users.

By January this year, they announced 40 million-plus users were making use of a browser or extension that supports GPC along with a clutch of big-name publishers signed up to honor it. But its fair to say its global impact so far remains limited.

More recently, European privacy group noyb published a technical proposal for a European-centric automated browser-level signal that would let regional users configure advanced consent choices enabling the more granular controls it said would be needed to fully mesh with the EUs more comprehensive (versus CCPA) legal framework around data protection.

The proposal, for which noyb worked with the Sustainable Computing Lab at the Vienna University of Economics and Business, is called Advanced Data Protection Control (ADPC). And noyb has called on the EU to legislate for such a mechanism suggesting theres a window of opportunity as lawmakers there are also keen to find ways to reduce cookie fatigue (a stated aim for the still-in-train reform of the ePrivacy rules, for example).

So there are some concrete examples of what practical, less fatiguing yet still pro-privacy consent mechanisms might look like to lend a little more color to Denhams idea although her remarks today dont reference any such existing mechanisms or proposals.

(When we asked the ICO for more details on what shes advocating for, its spokeswoman didnt cite any specific technical proposals or implementations, historical or contemporary, either, saying only: By working together, the G7 data protection authorities could have an outsized impact in stimulating the development of technological solutions to the cookie consent problem.)

So Denhams call to the G7 does seem rather low on the substance versus profile-raising noise.

In any case, the really big elephant in the room here is the lack of enforcement around cookie consent breaches including by the ICO.

Add to that, theres the now very pressing question of how exactly the U.K. will reform domestic law in this area (post-Brexit) which makes the timing of Denhams call look, well, interestingly opportune. (And difficult to interpret as anything other than opportunistically opaque at this point.)

The adtech industry will of course be watching developments in the U.K. with interest and would surely be cheering from the rooftops if domestic data protection reform results in amendments to U.K. rules that allow the vast majority of websites to avoid having to ask Brits for permission to process their personal data, say by opting them into tracking by default (under the guise of fixing cookie friction and cookie fatigue for them).

That would certainly be mission accomplished after all these years of cookie-fatigue-generating-cookie-consent-non-compliance by surveillance capitalisms industrial data complex.

Its not yet clear which way the U.K. government will jump but eyebrows should raise to read the ICO writing today that it expects compliance with (current) U.K. law when it has so roundly failed to tackle the adtech industrys role in cynically sicking up said cookie fatigue by failing to take any action against such systemic breaches.

The bald fact is that the ICO has for years avoided tackling adtech abuse of data protection, despite acknowledging publicly that the sector is wildly out of control.

Instead, it has opted for a cringing process of engagement (read: appeasement) that has condemned U.K. internet users to cookie pop-up hell.

This is why the regulator is being sued for inaction after it closed a long-standing complaint against the security abuse of peoples data in real-time bidding ad auctions with nothing to show for it. So, yes, you can be forgiven for feeling gaslit by Denhams call for action on cookie fatigue following the ICOs repeat inaction on the causes of cookie fatigue.

Not that the ICO is alone on that front, however.

There has been a fairly widespread failure by EU regulators to tackle systematic abuse of the blocs data protection rules by the adtech sector with a number of complaints (such as this one against the IAB Europes self-styled transparency and consent framework) still working, painstakingly, through the various labyrinthine regulatory processes.

Frances CNIL has probably been the most active in this area last year slapping Amazon and Google with fines of $42 million and $120 million for dropping tracking cookies without consent, for example. (And before you accuse CNIL of being anti-American, it has also gone after domestic adtech.)

But elsewhere notably Ireland, where many adtech giants are regionally headquartered the lack of enforcement against the sector has allowed for cynical, manipulative and/or meaningless consent pop-ups to proliferate as the dysfunctional norm while investigations have failed to progress and EU citizens have been forced to become accustomed not to regulatory closure (or indeed rapture), but to an existentially endless consent experience thats now being (re)branded as cookie fatigue.

Yes, even with the EUs General Data Protection Regulation (GDPR) coming into application in 2018 and beefing up (in theory) consent standards.

This is why the privacy campaign group noyb is now lodging scores of complaints against cookie consent breaches to try to force EU regulators to actually enforce the law in this area, even as it also finds time to put up a practical technical proposal that could help shrink cookie fatigue without undermining data protection standards.

Its a shining example of action that has yet to inspire the lions share of the EUs actual regulators to act on cookies. The TL;DR is that EU citizens are still waiting for the cookie consent reckoning even if there is now a bit of high-level talk about the need for something to be done about all these tedious pop-ups.

The problem is that while GDPR certainly cranked up the legal risk on paper, without proper enforcement, its just a paper tiger. And the pushing around of lots of paper is very tedious, clearly.

Most cookie pop-ups youll see in the EU are thus essentially privacy theater; at the very least, theyre unnecessarily irritating because they create ongoing friction for web users who must constantly respond to nags for their data (typically to repeatedly try to deny access if they can actually find a reject all setting).

But even worse many of these pervasive pop-ups are actively undermining the law (as a number of studies haveshown) because the vast majority do not meet the legal standard for consent.

So the cookie consent/fatigue narrative is actually a story of faux compliance enabled by an enforcement vacuum thats now also encouraging the watering down of privacy standards as a result of such much-unpunished flouting of the law.

There is a lesson here, surely.

Faux consent pop-ups that you can easily stumble across when surfing the ad-supported internet in Europe include those failing to provide users with clear information about how their data will be used; or not offering people a free choice to reject tracking without being penalized (such as with no/limited access to the content theyre trying to access); or at least giving the impression that accepting is a requirement to access said content (dark pattern!); and/or otherwise manipulating a persons choice by making it super simple to accept tracking and far, far, far more tedious to deny.

You can also still sometimes find cookie notices that dont offer users any choice at all and just pop up to inform that by continuing to browse you consent to your data being processed which, unless the cookies in question are literally essential for provision of the webpage, is basically illegal. (Europes top court made it abundantly clear in 2019 that active consent is a requirement for non-essential cookies.)

Nonetheless, to the untrained eye and sadly there are a lot of them where cookie consent notices are concerned it can look like its Europes data protection law thats the ass because it seemingly demands all these meaningless consent pop-ups, which just gloss over an ongoing background data grab anyway.

The truth is regulators should have slapped down these manipulative dark patterns years ago.

The problem now is that regulatory failure is encouraging political posturing and, in a twisting double-back throw by the ICO, regulatory thrusting around the idea that some newfangled mechanism is whats really needed to remove all this universally inconvenient friction.

An idea like noybs ADPC does indeed look very useful in ironing out the widespread operational wrinkles wrapping the EUs cookie consent rules. But when its the ICO suggesting a quick fix after the regulatory authority has failed so spectacularly over the long duration of complaints around this issue, youll have to forgive us for being skeptical.

In such a context, the notion of cookie fatigue looks like its being suspiciously trumped up or fixed on as a convenient scapegoat to rechannel consumer frustration with hated online tracking toward high privacy standards and away from the commercial data-pipes that demand all these intrusive, tedious cookie pop-ups in the first place while neatly aligning with the U.K. governments post-Brexit political priorities on data.

Worse still: The whole farcical consent pantomime which the adtech industry has aggressively engaged in to try to sustain a privacy-hostile business model in spite of beefed-up European privacy laws could be set to end in genuine tragedy for user rights if standards end up being slashed to appease the law mockers.

The target of regulatory ire and political anger should really be the systematic law-breaking thats held back privacy-respecting innovation and non-tracking business models by making it harder for businesses that dont abuse peoples data to compete.

Governments and regulators should not be trying to dismantle the principle of consent itself. Yet at least in the U.K. that does now look horribly possible.

Laws like GDPR set high standards for consent, which if they were but robustly enforced could lead to reform of highly problematic practices like behavorial advertising combined with the out-of-control scale of programmatic advertising.

Indeed, we should already be seeing privacy-respecting forms of advertising being the norm, not the alternative free to scale.

Instead, thanks to widespread inaction against systematic adtech breaches, there has been little incentive for publishers to reform bad practices and end the irritating consent charade which keeps cookie pop-ups mushrooming forth, oftentimes with ridiculously lengthy lists of data-sharing partners (i.e., if you do actually click through the dark patterns to try to understand what is this claimed choice youre being offered).

As well as being a criminal waste of web users time, we now have the prospect of attention-seeking, politically charged regulators deciding that all this friction justifies giving data-mining giants carte blanche to torch user rights if the intention is to fire up the G7 to send a collect invite to the tech industry to come up with practical alternatives to asking people for their consent to track them and all because authorities like the ICO have been too risk-averse to actually defend users rights in the first place.

Dowdens remarks last month suggest the U.K. government may be preparing to use cookie consent fatigue as convenient cover for watering down domestic data protection standards at least if it can get away with the switcheroo.

Nothing in the ICOs statement today suggests it would stand in the way of such a move.

Now that the U.K. is outside the EU, the U.K. government has said it believes it has an opportunity to deregulate domestic data protection although it may find there are legal consequences for domestic businesses if it diverges too far from EU standards.

Denhams call to the G7 naturally includes a few EU countries (the biggest economies in the bloc) but by targeting this group, shes also seeking to engage regulators further afield in jurisdictions that currently lack a comprehensive data protection framework. So if the U.K. moves, cloaked in rhetoric of Global Britain, to water down its (EU-based) high domestic data protection standards, it will be placing downward pressure on international aspirations in this area as a counterweight to the EUs geopolitical ambitions to drive global standards up to its level.

The risk, then, is a race to the bottom on privacy standards among Western democracies at a time when awareness about the importance of online privacy, data protection and information security has actually never been higher.

Furthermore, any U.K. move to weaken data protection also risks putting pressure on the EUs own high standards in this area as the regional trajectory would be down, not up. And that could, ultimately, give succor to forces inside the EU that lobby against its commitment to a charter of fundamental rights by arguing such standards undermine the global competitiveness of European businesses.

So while cookies themselves or indeed cookie fatigue may seem an irritatingly small concern, the stakes attached to this tug of war around peoples rights over what can happen to their personal data are very high indeed.

Continued here:

After years of inaction against adtech, UKs ICO calls for browser-level controls to fix cookie fatigue - TechCrunch