[HN Gopher] Consent-O-Matic
___________________________________________________________________
Consent-O-Matic
Author : throawayonthe
Score : 175 points
Date : 2026-01-18 09:35 UTC (13 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| another_twist wrote:
| Regular user here. Cant live without this addon, I absolutely
| love this. Its been a while since I have to manually dismiss a
| consent popup. Although the redirects from Google and company can
| get a bit annoying.
| cocoto wrote:
| Simply enable the "cookie notices" list in ublock origin
| (available on every platform now, even iOS). According to the EU
| law if you don't click accept it's equivalent to denying.
| bcye wrote:
| This extension gives you more choice than denying or allowing
| everything though, you get granular choice automatically
| applied to all websites where it works
| cocoto wrote:
| I think most people don't want to give consent to any of this
| so a simple block list is enough.
| bcye wrote:
| Well it does change if you have more of a choice than
| reject all or allow all (without needing to go into
| complicated settings each time). Telemetry is not that
| unpopular - I'd like devs to fix bugs I encounter.
| gempir wrote:
| Breaks many websites though and you'll be wondering why
| something doesn't work and then you have to remember you
| checked that ublock checkbox a few months ago.
| benjojo12 wrote:
| I think in the last 12 months of using that unlock list I've
| only counted less than five times where sites have broken
| with that list enabled, I don't have to even disable the
| entire list. You just disable u-block for that specific site
| thevinchi wrote:
| Until this moment, I did the same thing... but right now I
| realize, this behavior incentivizes a domain owner to
| intentionally break their site, to trick the visitor to
| disable their blocker.
|
| Then the browser: refreshes the page, downloadz all the
| thingz... presents cookie banner.
|
| I've been using uBlock (or Brave) for years now, and when
| "something doesn't work right" the first thing I often do
| is lower my shields... :facepalm:
|
| From now on, I'll just bounce. Keep your cookies, I'm not
| hungry.
| lol768 wrote:
| I've found it to happen much more frequently than that,
| unfortunately. Usually it's because the modal is two DOM
| elements - a backdrop, that fades out the rest of the
| content and sits on top of it/prevents interaction; and the
| actual consent modal. Websites then use various mechanisms
| to prevent scrolling. uBlock is often only removing the
| actual dialog, so you end up with a page you can't scroll
| up or down and can't interact with.
|
| If you're going to turn the filters on, it's worth being
| aware of this because it's far from flawless.
| guenthert wrote:
| Complain and use a different site. There are only few
| websites which offer a truly unique service. If enough
| complain and walk away, something might finally change.
| Dilettante_ wrote:
| Thanks for the warning, I'd turned on those lists when I read
| the parent comment and would _not_ have had a good time
| troubleshooting that.
| worble wrote:
| I've never seen a website break from this, got any examples?
| linker3000 wrote:
| LinkedIn - it takes you to the allow/deny page but doesn't
| automate things. It used to be that the LinkedIn login
| would get stuck in a cycle around this, but now it just
| dumps you on to the consent page.
| rsynnott wrote:
| I mean, no great loss.
| nextlevelwizard wrote:
| If a website gets broken by this it isn't a site worth
| visiting
| Fraaaank wrote:
| > According to the EU law if you don't click accept it's
| equivalent to denying.
|
| The result is the same. Technically there's no such thing as
| denying, only providing (explicit) consent. If consent is
| required and no consent is provided, then there is no ground
| for processing.
| atoav wrote:
| Also: the consent has to be _informed_ consent. Me clicking
| away a nag banner, even if I click "accept" isn't informed
| consent by the definition of the law.
|
| You want to share my data with your 300+ "partners" legally?
| Good luck informing me about all the ways in which every of
| those single partners is using my data. If you are unable to
| inform me I can't give consent, even if I click "Accept all".
| That is however a you-problem, not a me-problem. If you share
| my data nontheless you are breaking the law.
| neodymiumphish wrote:
| Undoing whatever data collection and sharing, as well as
| seeking and obtaining restitution, is probably a much
| harder problem to solve (for you) if you select accept.
| JCattheATM wrote:
| A lot of the notices provide exactly the info you need to
| be informed, it's on you if you want to read it or not.
| Rygian wrote:
| How do you object to the site's legitimate interest use of
| your personal data? That is a legal grounds for processing,
| which can be enabled by default as long as you are provided
| with an option to actively object.
|
| https://noyb.eu/en/your-right-object-article-21
| upofadown wrote:
| If it is an actual legitimate interest then you would
| likely be expected to contact the site out of band to
| object to the use of your data. Depending on the technical
| details you might not be able to continue using the site
| after a successful objection. In some cases the site might
| be able to reject your request.
|
| The cookie banner thing is intended to allow the user to
| explicitly provide consent, should they for some reason
| wish to do so.
| Rygian wrote:
| The cookie banners are routinely used to object to
| "legitimate interest" uses and the corresponding sites
| continue to work normally, not sure what your alternate
| understanding is based on.
| upofadown wrote:
| The cookie banners are for initial consent. You just
| consent to less stuff sometimes.
|
| A website might claim some sort of legitimate interest
| for the initial collection of data but might not think
| that they can claim that for the retention of data I
| suppose. That would seem kind of dodgy to me...
|
| Just because a website claims something doesn't mean it
| is valid. There isn't a lot that falls under legitimate
| interest for a website.
| kuschku wrote:
| Legitimate interest is defined as that usage that is
| absolutely technically necessary. Which is why you cannot
| object to legitimate interest.
|
| Legitimate interest is for example a website using your IP
| to send you the necessary TCP/IP packets with the website's
| content upon request.
|
| Many websites use the term "legitimate interest"
| misleadingly (or even fraudulently), but that's not how
| GDPR defines it.
| prox wrote:
| It's also to check if something works. I recently added
| something new and while I cannot and will not track any
| personally identifying information, I still need some
| data if people go through the whole process alright. That
| covers legitimate interest. It's the minimum data I
| collect and its get wiped after some time.
| rglullis wrote:
| An IP address is not "personally identifiable data". You
| can not know who the person is just because you got an IP
| address in the request.
|
| We are almost 10 years into the GDPR, and we still have
| these gross misunderstandings about how to interpret it.
| Meanwhile, it has done _nothing_ to stop companies from
| tracking people and for AI scrapers to run around. If
| this is not a perfect example of Regulatory Capture in
| action, I don 't know what is.
| Nextgrid wrote:
| The lack of enforcement is consistent across all
| companies big and small so I don't think it counts as
| regulatory capture.
| kuschku wrote:
| Tbh, Google and Facebook, after several enforcement
| actions, now provide a simple "Reject All" button, while
| most smaller websites don't.
|
| I'd argue that's the opposite of regulatory capture.
| Fargren wrote:
| This is not my experience at all with Facebook. Since six
| months ago or so, Facebook is saying my three option are
| to pay them a subscription, accept tracking, or not use
| their products. I went with option three, but my reading
| of the GDPR as that it's illegal for them to ask me to
| make this choice.
|
| I'm in Spain, this is probably not the same worldwide.
| rglullis wrote:
| Yeap, but the thing is:
|
| - they don't care about the cookies they are setting on
| their properties, if most of the functionality they have
| require you to be authenticated anyway.
|
| - These "smaller websites" are _exactly_ the ones more
| likely than not to be Google 's and Facebook's largest
| source of data, because these sites are the ones using
| Google Analytics/Meta Pixel/etc.
| Nextgrid wrote:
| The "Reject all" does not in fact reject all. They are
| taking extreme liberties with the "legitimate interest"
| clause to effectively do all tracking and analytics under
| it.
|
| The YouTube consent screen for example includes this as a
| mandatory item:
|
| > Measure audience engagement and site statistics to
| understand how our services are used and enhance the
| quality of those services
|
| I don't believe this complies with the GDPR to have this
| mandatory.
| close04 wrote:
| > An IP address is not "personally identifiable data".
|
| GDPR says it is [1][2].
|
| > We are almost 10 years into the GDPR, and we still have
| these gross misunderstandings
|
| Because people would rather smugly and confidently post
| about their gross misunderstandings. If only there was
| some place to read about this and learn. I'll give you
| the money shot to save 10 more years:
|
| > Fortunately, the GDPR provides several examples in
| Recital 30 that include:
|
| > Internet protocol (IP) addresses;
|
| From Recital 30:
|
| > Natural persons may be associated with online
| identifiers provided by their devices, applications,
| tools and protocols, such as internet protocol addresses
|
| [1] https://gdpr.eu/eu-gdpr-personal-data/
|
| [2] https://gdpr.eu/recital-30-online-identifiers-for-
| profiling-...
| rglullis wrote:
| When an IP address is _linked_ to any other data, then it
| counts as PII. By itself, it 's not.
|
| So, sure, if you stick the user's IP address on a cookie
| from a third-party service, you are sharing PII. But this
| is absolutely not the same as saying "you need to claim
| legimate interest to serve anything, because you will
| need their IP address".
| close04 wrote:
| IPs are PII even before you inevitably link them to
| something in your logs. If you can make a case that you
| absolutely don't store them anywhere, they're just
| transiently handled by your network card, maybe you get
| away with it but only because someone else along the
| stream covers this for you (your hosting provider, your
| ISP, etc.)
|
| Source: I have been cursed to work on too many Data
| Protection Impact Assessments, and Records of Processing
| Activities together with actual lawyers.
| rglullis wrote:
| Basically we are in agreement: IP addresses, by
| themselves, are not PII, only when they are _linked_ to
| other information (a cookie, a request log) then it
| consitutes processing.
|
| So, apologies if I was not precise on my comment, but I
| still stand by the idea: you don't need to a consent
| screen that says "we collect your IP address", if that's
| all you do.
| close04 wrote:
| Not really, no. I don't think I can make it more clear
| than I, or the law, already did: IPs are PII no matter
| what. Period. It's literally spelled out in the law.
|
| The misconception is that you need explicit consent for
| any kind of processing of PII. That is not the case. The
| law gives you alternatives to consent, if you can justify
| them. Some will confuse this with "must mean IPs aren't
| PII", which is not the case.
| kuschku wrote:
| An IP address linked with the website being accessed is
| already PII.
|
| When serving content, you're by necessity linking it to a
| website that's being accessed.
|
| For example, if grindr.com had a display in their offices
| that showed the IP address of the request that's
| currently being handled, that's not saving or publishing
| or linking the data, but it's still obvious PII.
| rglullis wrote:
| > a display in their offices that showed the IP address
| (...) that's not saving or publishing
|
| You are not sharing with a third-party, but that sure
| falls into processing and publishing it.
| youngtaff wrote:
| IP address is considered personal data and can be
| considered personally identifiable data in some
| circumstances for example if you can geolocate someone to
| a small area using it
| Rygian wrote:
| Your interpretation does not match GDPR. I suggest you
| read the link in the post you replied to.
| psychoslave wrote:
| >How do you object to the site's legitimate interest use of
| your personal data?
|
| With the legitimate individual control over one own data
| required to run a healthy society and unavoidable to
| sustain a democracy. If a business can't exist without
| threatening society, the sooner it's going out of existence
| the better.
| geor9e wrote:
| But I don't want to auto deny. I want my shopping carts to
| work. I want websites to save my login and preferences. I just
| don't want the pop-ups. So this extension is great.
| cccbbbaaa wrote:
| Login, preferences, or shopping cart cookies (aka "functional
| cookies") do not need consent. I never saw a banner that
| allowed me to disable them.
| pietz wrote:
| This idea/execution isn't new right? Can someone explain what
| makes this different/better? Is this the ublock Origin of cookie
| banner hiders?
| mort96 wrote:
| It goes through the "reject all tracking" flow. Other solutions
| automate clicking "accept all tracking" (since that's usually
| simpler), or just hide the pop-ups.
| jadtz wrote:
| I use this extension, but I am still always bombarded with the
| pop-ups, not sure if I set it up wrong or its not that useful.
| zevv wrote:
| What works pretty well for me is the "i don't care about cookies"
| extension for firefox; my default privacy policy is to throw away
| cookies when the browser restarts, which I do a few times per day
| anway.
| Semaphor wrote:
| Works pretty well for advertisers as well, as that fails back
| to allowing all tracking, of which cookies are only a tiny
| amount
| johndough wrote:
| That extension might allow tracking. From their Chrome add-on
| page: When it's needed for the website to
| work properly, it will automatically accept the cookie policy
| for you (sometimes it will accept all and sometimes only
| necessary cookie categories, depending on what's easier to do).
|
| Deleting cookies is insufficient because of browser
| fingerprinting, which you just consented to.
| TylerE wrote:
| Believe it or not some of us don't actually give a damn, we
| just want the fucking nags to go away.
| jatari wrote:
| Well the extension is called "I don't care about cookies",
| not "I care deeply about my privacy"
| tcfhgj wrote:
| zevv obviously cares about cookies and privacy
| wartijn_ wrote:
| But this thread stars with someone saying they don't care
| about cookies because they'll delete them anyway. That's
| different than saying they don't care about their privacy,
| so it's worth pointing out that accepting every cookie
| banner does have privacy implications beyond just having
| cookies placed.
| tim1994 wrote:
| True, but considering that the extension was bought in 2022
| by Avast, maybe it has its own tracking built in by now or
| will have something concerning done to it in the future. So
| even if the user does not care about cookies that much I
| would still recommend this new extension over "I don't care
| about cookies"
| XzetaU8 wrote:
| I don't feel ok that Avast bought this extension though
| https://www.i-dont-care-about-cookies.eu/whats-new/acquisiti...
|
| Instead i use this https://github.com/OhMyGuus/I-Still-Dont-
| Care-About-Cookies
| IanCal wrote:
| Th consent is about tracking and your data, not specifically
| cookies. If you accept them tracking and selling your data then
| deleting cookies only impacts one way that happens.
| goodluckchuck wrote:
| I disagree with this idea that businesses should have to keep
| their customers secret. If I go to Wal-Mart, then I should be
| free to tell my neighbors about what products were on sale
| and also how the produce was old / left to spoil. I'm not
| sure why that should be different for the store.
| Forgeties79 wrote:
| There are plenty of places folks visit that they would
| rather not have out loud.
| goodluckchuck wrote:
| I don't see how personal preference should control other
| people's speech. When I put terrible Google reviews down
| for a shop... I'm sure they don't want that said publicly
| either... but it's not libel... what I'm saying is true.
| There isn't generally value in concealing the truth.
| IanCal wrote:
| Do you think Walmart should be handing your credit card
| numbers out? Genetic profiles of you? Is there any limit or
| do you think if you walk into a space whoever owns that
| space can get and do whatever they want with any
| information you might happen to have on you?
|
| > I disagree with this idea that businesses should have to
| keep their customers secret
|
| They don't. They just have to ask the person whose personal
| data it is if they can.
| rtbruhan00 wrote:
| It's the first extension I install on a new machine to keep my
| browsing flow from breaking every 5 seconds. Truly a 'quality of
| life' essential.
| cx0der wrote:
| Does this work better than built-in Firefox feature?
| bcye wrote:
| It seems the feature you are referencing was deprecated?
|
| https://support.mozilla.org/en-US/kb/cookie-banner-reduction
| HelloUsername wrote:
| Previous discussions:
|
| https://news.ycombinator.com/item?id=30625218
|
| https://news.ycombinator.com/item?id=41479882
|
| https://news.ycombinator.com/item?id=35562230
| dijit wrote:
| It always impresses me how its actually easy not to need these
| banners yet everyone will consistently participate in the civil
| disobedience of annoying their users. No doubt in the hope of
| making people mad at the EU.
|
| To the point that people are worried when cookie banners are not
| required now. I have had a few worried conversations on why our
| site doesn't have a cookie banner.
|
| The answer is simple, we don't track our users, and login is
| explicit consent and functionality which doesn't require a prompt
| under GDPR.
| HPsquared wrote:
| You need a "no cookies here" banner.
| pocketarc wrote:
| I've seen that in a few places, yeah! I think I personally
| would just put something in the footer and have a specific
| page for it that I can link people to.
|
| I really hope that I never end up in a situation where
| someone tells me "well the conversion rate would be much
| higher if you just stopped fighting it and put up the damn
| banner".
| jampekka wrote:
| It's really enraging. Even EU's official sites use the banners,
| and probably for sites where they wouldn't (or at least
| shouldn't) even be needed.
|
| It seems that very few, even lawyers, really understand when
| explicit consent is not needed, and instead we get cargo
| culting of pointless consent banners everywhere.
|
| The situation has become such that "consents" aren't really
| meaningful at all, as people just want to get rid of the
| banner, and it becomes US style contract theatre.
| IMTDb wrote:
| If it's that easy to not need the banners, I'd expect EU
| websites themselves to lead the "no cookies needed" movement.
|
| Yet https://european-union.europa.eu displays a cookie banner
| for tracking on what is essentially a static informational
| site. If the EU itself feels tracking is valuable enough to
| warrant the banner on their own pages, it's hard to fault
| businesses (whose survival actually depends on understanding
| their audience) for making the same choice.
|
| At least they're compliant with their own regulation, I
| suppose.
| dijit wrote:
| You're not wrong.
|
| The EU websites require the cookie consent due to this
| section of the cookie policy:
|
| > Third-party providers on Commission websites
|
| * YouTube
|
| * Internet Archive
|
| * ScribbleLive
|
| * Google Maps
|
| * Twitter
|
| * TV1
|
| * Vimeo
|
| * Microsoft
|
| * Facebook
|
| * Google
|
| * LinkedIn
|
| * Livestream
|
| * SoundCloud
|
| * European Parliament
|
| These third-party services are outside of the control of the
| European Commission. Providers may, at any time, change their
| terms of service, purpose and use of cookies, etc.
|
| ----
|
| In other words, due the embeds that track users, consent is
| needed.
|
| They also have their own analytics in the same section, by
| the letter of the rules: they indeed need explicit consent,
| which would be obviated if they didn't run analytics and
| didn't embed stuff.
| jampekka wrote:
| Option a) don't use those embeds
|
| Option b) ask the consent in the embed.
|
| Analytics can be done without banner requiring tracking,
| e.g. https://plausible.io/
| psychoslave wrote:
| Same with https actually. I still reach some home made website
| or paper published in this or that legit small university or
| department without a certificate. Most browser send messages
| like this is a life threatening move.
| weberer wrote:
| >No doubt in the hope of making people mad at the EU.
|
| We should be mad at the EU. They could have easily written a
| clause into the law saying companies must respect the Do-not-
| track header from the browser. But for whatever reason, they
| chose not to.
| jojobas wrote:
| Combine this with auto-delete of cookies except for your
| selection of sites and you're good.
| whazor wrote:
| This extension gives me my preferered web experience. Namely it
| tries to automatically fill in the cookie pop-ups for you,
| instead of hiding it. You can actually enable functional cookies,
| which are useful. Then when filling the cookie popup doesn't
| work, you can fill it in manually. This is a huge improvement
| over the ublock hiding of popups, which actually breaks sites
| time to time.
| xanrah wrote:
| This is why I use it too. UBlock and other options remove the
| banner or consent screens fine, but this breaks functionality
| sometimes. Even not accepting the required cookies can break
| basic functionality.
| cluckindan wrote:
| "Cookie banner" is a misnomer. These consent popups are usually
| asking for you to consent to having hundreds if not thousands of
| companies build and sell a profile of you. They will combine your
| behavior and device data from various sources, identify you
| across platforms by linking device IDs, and ultimately sell your
| privacy to the highest bidder.
|
| Typically, you can't even turn these permissions off, nor can you
| deny consent or object to their purposes: they are increasingly
| claiming they are for "fraud prevention" or some other technical
| purpose which doesn't land under consent or the "legitimate
| interest" umbrella.
| pmarreck wrote:
| ... All so I can have ads that are actually more relevant to
| me.
|
| Sounds horrible. >..<
|
| The (...fortunately a) handful of places I've worked at which
| dealt with this sort of thing were very strict about removing
| PII.
|
| I'm more concerned about only being shown _information_ (not
| just ads for products) relevant to my click-tuned interests as
| I think that 's just contributing massively to political
| polarization.
| cluckindan wrote:
| That's a defeatist post hoc rationalisation, akin to "I don't
| have anything to hide"
| networkadmin wrote:
| The cookie thing is just a red herring. Who gives a damn
| about cookies? Are they suddenly a privacy problem after
| decades in use? The people who want to track you (including
| these crooked governments who are pretending to care about
| cookies) are doing much more than using cookies these days.
| Which is exactly why they felt it safe to raise this giant
| kerfuffle about cookies. It's a distraction.
| treetalker wrote:
| Cookies have always been a privacy problem. That other,
| greater privacy invasions exist does not mean that
| cookies ought not be addressed or ought be tolerated.
|
| Liberty demands the end of systems of control.
| networkadmin wrote:
| Liberty had better start polishing its musket and
| sharpening its sword.
| JCattheATM wrote:
| The EU, the same people that decided Windows shipping a
| default browser was an issue about a decade after it had
| actually stopped being one.
| explodes wrote:
| Indeed. I challenge all bored-enough readers to an exercise:
| compare your doomscroll to your friend's doomscroll. It's
| wild how much they can differ.
| beezlebroxxxxxx wrote:
| Maybe I'm unique in this experience, but the "actually more
| relevant to me" part is just never true. Most of the ads I
| see that are delivered via these auctions are just garbage or
| scams or "relevant" in a tenuous pointless way.
|
| The only really relevant ads I've seen are from blogs that
| literally just sell ad space to brands and the ad is just a
| simple image link you can click on. Philosophy blog?
| Philosophy book ad. High end men's clothing blog? High end
| men's clothing brand ad.
| quickthrowman wrote:
| I get hyper-targeted ads trying to sell me electrical
| distribution equipment and air handling units because I run
| commercial electrical work (mostly mechanical equipment
| focused) and search for a lot of equipment part numbers.
| They're on target, but ineffective.
|
| None of the ads could ever be effective, I have my supply
| houses that I buy from and they don't advertise online.
|
| I do have a decent amount of buying power at work (single
| digit millions a year) but no internet ad from an
| electrical distributor is ever going to influence my
| purchasing decision.
| thatguy0900 wrote:
| The really funny ones are when you buy something online
| then receive a deluge of ads for the thing you just
| purchased
| wernsey wrote:
| Or "relevant" in the sense that it's something I bought
| recently: I searched for vacuum cleaners, found one I liked
| an bought it. Now I will be seeing ads for vacuum cleaners
| for the next few months.
| andy99 wrote:
| "Relevant" in this context means "most likely to extract
| money from" - the optimization is from the perspective of
| the advertiser, not the user
| cons0le wrote:
| I would love for an audit of sites to see if any popular sites
| still do collect the data when you click no. Or if you just
| land on the banner page, and close the tab.
| BobaFloutist wrote:
| Or if you just ignore the pop-up through ublock's element
| picker or something else equivalent and continue to use the
| webpage.
|
| As far as I'm concerned, that doesn't constitutes consenting
| to _anything_ whatsoever.
| jonplackett wrote:
| It's completely ridiculous there isn't just a way to set 'no
| thanks' in the browser
| celsoazevedo wrote:
| On Firefox, there's also Cookie Auto Decline. It seems to work on
| more sites:
|
| - https://addons.mozilla.org/en-US/firefox/addon/cookie-auto-d...
|
| - https://github.com/JobcenterTycoon/cookie-auto-decline
|
| Not sure if it's as advanced, but does a good job at declining or
| simply hiding the banners.
| drnick1 wrote:
| Just block that shit with uBlock Origin (Firefox, not the
| neutered Chromium version).
___________________________________________________________________
(page generated 2026-01-18 23:01 UTC)