In the latest quasi-throwback toward ‘do not track, the UK’s data protection chief has come out in favor of a browser- and/or device-level setting to allow Internet users to set “lasting” cookie preferences — suggesting this as a fix for the barrage of consent pop-ups that continues to infest websites in the region.
European web users digesting this development in an otherwise monotonously unchanging regulatory saga should be forgiven — not only for any sense of déjà vu they may experience — but also for wondering if they haven’t been mocked/gaslit quite enough already where cookie consent is concerned.
Last month, UK digital minister Oliver Dowden took aim at what he dubbed an “endless” parade of cookie pop-ups — suggesting the government is eyeing watering down consent requirements around web tracking as ministers consider how to diverge from European Union data protection standards post-Brexit. (He’s slated to present the full sweep of the government’s data ‘reform’ plans later this month so watch this space.)
Today the UK’s outgoing information commissioner, Elizabeth Denham, stepped into the fray to urge her counterparts in G7 countries to knock heads together and coalesce around the idea of letting web users express generic privacy preferences at the browser/app/device level rather than having to do it through pop-ups every time they visit a website.
In a statement announcing “an idea”, she will present this week during a virtual meeting of fellow G7 data protection and privacy authorities — less pithily described in the press release as being “on how to improve the current cookie consent mechanism, making web browsing smoother and more business-friendly while better protecting personal data” — Denham said: “I often hear people say they are tired of having to engage with so many cookie pop-ups. That fatigue is leading to people giving more personal data than they would like.
“The cookie mechanism is also far from ideal for businesses and other organizations running websites, as it is costly and can lead to poor user experience. While I expect businesses to comply with current laws, my office is encouraging international collaboration to bring practical solutions in this area.”
“There are nearly two billion websites out there taking account of the world’s privacy preferences. No single country can tackle this issue alone. That is why I am calling on my G7 colleagues to use our convening power. Together we can engage with technology firms and standards organizations to develop a coordinated approach to this challenge,” she added.
Contacted for more on this “idea”, an ICO spokeswoman reshuffled the words like this: “Instead of trying to effect change through nearly 2 billion websites, the idea is that legislators and regulators could shift their attention to the browsers, applications, and devices through which users access the web.
“In place of click-through consent at a website level, users could express lasting, generic privacy preferences through browsers, software applications, and device settings – enabling them to set and update preferences at a frequency of their choosing rather than on each website they visit.”
Of course, a browser-baked ‘Do not track (DNT) signal is not a new idea. It’s around a decade old at this point. Indeed, it could be called the idea that can’t die because it’s never truly lived — as earlier attempts at embedding user privacy preferences into browser settings were scuppered by lack of industry support.
However, the approach Denham is advocating, vis-a-vis “lasting” preferences, may, in fact, be somewhat different to DNT — given her call for fellow regulators to engage with the tech industry and its “standards organizations” and come up with “practical” and “business-friendly” solutions to the regional Internet’s cookie pop-up problem.
It’s unclear what consensus — practical or, er, simply pro-industry — might result from this call. If anything.
Indeed, today’s press release may be nothing more than Denham trying to raise her own profile since she’s on the cusp of stepping out of the information commissioner’s chair. (Never waste an excellent international networking opportunity and all that — her counterparts in the US, Canada, Japan, France, Germany, and Italy are scheduled for a virtual natter today and tomorrow where she implies she’ll try to engage them with her big idea).
Her UK replacement, meanwhile, is already lined up. So anything Denham personally champions right now, at the end of her ICO chapter, may have a very brief shelf life — unless she’s set to parachute into a similar role at another G7 caliber data protection authority.
Nor is Denham the first person to make a revived pitch for a rethink on cookie consent mechanisms — even in recent years.
Last October, for example, a US-centric tech-publisher coalition came out with what they called a Global Privacy Standard (GPC) — aiming to build momentum for a browser-level pro-privacy signal to stop the sale of personal data, geared toward California’s Consumer Privacy Act (CCPA), though pitched as something that could have broader utility for Internet users.
By January this year, they announced 40M+ users were making use of a browser or extension that supports GPC — along with a clutch of big-name publishers signed up to honor it. But it’s fair to say its global impact so far remains limited.
More recently, European privacy group noyb published a technical proposal for a European-centric automated browser-level signal that would let regional users configure advanced consent choices — enabling the more granular controls it said would be needed to fully mesh with the EU’s more comprehensive (vs. CCPA) legal framework around data protection.
The proposal, for which noyb worked with the Sustainable Computing Lab at the Vienna University of Economics and Business, is called Advanced Data Protection Control (ADPC). And noyb has called on the EU to legislate for such a mechanism — suggesting there’s a window of opportunity as lawmakers there are also keen to find ways to reduce cookie fatigue (a stated aim for the still-in-train reform of the ePrivacy rules, for example).
So there are some concrete examples of what practical, less fatiguing yet still pro-privacy consent mechanisms might look like to lend a little more color to Denham’s ‘idea’ — although her remarks today don’t reference any such existing mechanisms or proposals.
(When we asked the ICO for more details on what she’s advocating for, its spokeswoman didn’t cite any specific technical proposals or implementations, historical or contemporary, either, saying only: “By working together, the G7 data protection authorities could have an outsized impact in stimulating the development of technological solutions to the cookie consent problem.”)
So Denham’s call to the G7 does seem relatively low on substance vs. profile-raising noise. In any case, the massive elephant in the room here is the lack of enforcement around cookie consent breaches — including by the ICO.
Add to that, there’s the now very pressing question of how exactly the UK will ‘reform’ domestic law in this area (post-Brexit) — which makes the timing of Denham’s call look, well, interestingly opportune. (And challenging to interpret as anything other than opportunistically opaque at this point.)
The adtech industry will, of course, be watching developments in the UK with interest — and would indeed be cheering from the rooftops if domestic data protection ‘reform’ results in amendments to UK rules that allow the vast majority of websites to avoid having to ask Brits for permission to process their personal data say by opting them into tracking by default (under the guise of ‘fixing’ cookie friction and cookie fatigue for them).
That would undoubtedly be mission accomplished after all these years of cookie-fatigue-generating-cookie-consent-non-compliance by surveillance capitalism’s industrial data complex.
It’s not yet clear which way the UK government will jump — but eyebrows should raise to read the ICO writing today that it expects compliance with (current) UK law when it has so roundly failed to tackle the adtech industry’s role in cynically sicking up said cookie fatigue by failing to take any action against such systemic breaches.