Proposing a Web Privacy standard?

[luap42]

Hello everyone,

this is my first contribution here, so please be kind if I don't put this in the right way or at the right place or if I propose something, which has already been considered/discussed. Also English isn't my first language, so please ask if something sounds weird or is not understandable.

Paul

In 2018 the European Union General Data Protection Regulation (GDPR) became effective, which introduced more stringent and strict measures to protect the personal identifying information of data subjects. As a consequence of that, a lot of countries have followed up with their own data protection laws. While there are now broad and effective legal frameworks for data protection, I was wondering whether it might be good to accompany those with technical frameworks, which are beneficial to both users and website providers -- for users because they could set general settings in their web browsers and wouldn't need to go through hundreds of thousands of cookie settings modals, but could easily and effectively exercise their decision power; for website owners because they could use a standard API without having to build one of their own.

Such standards would fulfil the promise of privacy by design and might help to end frustration on both the users and the providers site. I suppose this HTML standard repository is the best currently matching one, given that it already includes such modules as "User interaction", "Web application APIs" or "Communication". However if you feel like an other standard would be more applicable or this topic deserving a completely new standard, please let me know.

To be a bit more specific, here are two possible features I would consider for such a "Web Privacy" standard module:

• Cookie Management

  Cookie setting modals are something, website providers employ because they feel (or are) obligated to do so by the privacy laws. However, in the way they currently are, there are multiple design flaws. First of all, (almost) nobody ever reads through these modals at all. In my experience, there are two types of users: those who immediately click "I consent" to get rid of the modal as soon as possible; and those who click "Manage settings", then spend half an hour unticking various boxes, then giving up and clicking "I consent". This is because of the second flaw: the modals are generally designed in a way that makes it very easy to approve but extremely difficult to reject. Which is not only a so-called "dark pattern", but also illegal under many of these privacy laws.

  A possible solution here would be to define in the standard, that website providers could somehow inform browsers about the cookies they set, what type of cookies these are (necessary, additional comfort, tracking, advertisement, ...) and other needed information, and browsers allowing users via a browser dialog window (and likely default-settings) to make a choice based on these information.

• Advertisement Control

  Personalized advertisement is a privacy problem of its own. It is suspected to be used for psychological manipulation, including even for election fraud. It allows companies to track users around the whole internet. And it is used everywhere, you can't "escape" it.

  To better balance the interests of the advertisers and the users, I had the idea that users should be able to categorize themselves using standardized categories (such as, for example: "interested in: Web Standards", "age: 18-35") and advertisement providers using only these categories for selecting the shown ad. The categorization would be completely voluntary and 100%-ly up to the user. While there is currently no regulation yet, which would require this, I think having a web standard for that process could be beneficial already, since it would allow companies to voluntarily switch to these standards; their reason for doing that being to be able to advertise themselves as "fair advertisers".

(These are just two examples for what might be done here, so please propose other ideas if you have them.)

What do you think about having such a "Web Privacy" standard?

[ghost]

Both these proposals are counterproductive as they increase fingerprintability. Privacy is better achieved by modifying existing standards to restrict information made available to websites than by adding new standards.

[luap42]

@shimark I could see that concern with the second example, which would likely need to be accompanied by legal regulations to prevent exploitation; but how should this work for the first one? Maybe it wasn't clear enough, but the settings should be completely client-side. It would just be a way not to need to show these cookie banners (browsers automaticaly rejecting not approved cookies), so I don't see how this would be worse than today in the way you mentioned.

Also, what do you mean with "restricting information"? Stuff like browser versions/settings? Yeah that should probably be done too, but having fundamental "privacy by design" (what you mentioned) and then consent/choice on top of that (what I mentioned) is IMO the best way forward (just choice being ineffective regarding privacy, as can be seen in cookie banners)

[ghost]

The fact that a cookie gets set or does not get set can be observed by the website and hence can be used for fingerprinting.

Legislation won’t prevent exploitation because the bureaucracies that implement it are slow and inefficient. As there exists more than a billion websites, the regulators will go after a number of the more prominent ones, some of the time, and most of the Web will continue tracking you, its effectiveness in doing so helped by the extra bits of identifying information added by the standard.

[rubyFeedback]

Any "web privacy" point is moot when there is a de-facto monopoly (e. g. Google's chromium base).

People need to be aware of that.

The cookie-tracking is not the only way how Google sniffs after users nowadays. The reluctance of officials in both the USA and the EU to refuse protecting the citizens shows how much things deteriorated. Hopefully the average developer does not support this trend.

The web of today is a tracking-web.

[rubyFeedback]

I had the idea that users should be able to categorize themselves using standardized categories (such as, for example: "interested in: Web Standards", "age: 18-35")

This is also tracking information. The "do not track" flag is also tracking by the way.

I'd wish browsers would stop yielding information about me to the outside at any moment in time. Even the "ask for cookie settings" invasive is a tracking method (because you can profile people based on their answers unless they used e. g. random bots or VPNs/TOR).

To better balance the interests of the advertisers and the users,

There can not be a "balance" anymore than there are "acceptable" ads. People don't want to be tracked. What is so hard to understand about this? This is an absolutely horrible idea, even if the intention was not aimed to profile people - it factually tries this.

[annevk]

If you're interested in this space I recommend participating here: https://privacycg.github.io/. Some of this work, e.g., around partitioning state will make its way back into the HTML Standard.

[luap42]

Thank you everyone for your feedback and sorry for taking so long to respond.

I see the issue with the "ads category" proposal which would make things worse without appropriate strict legislation. While I am also absolutely no fan of advertisements and while I am a strong privacy proponent, I considered that a more balancer approach as I thought it could be might be easier to pass in a first step. But, as often in creative processes, you only see the issues when talking to others. Consider the idea retracted.

Regarding the "implemented cookie decisions" proposal, I'm not really convinced by the criticism. All the information, which types of cookies are to be permitted, would fall into the hands of websites already with the current approach of cookie banners. In the implementation suggested in my post, websites wouldn't get data via an explicit browser API. Therefore I don't see any disadvantages to the current system. However I see two big advantages. First less cookie banners because browsers would take care of cookie consent management as decided once by the user. Second users could trust websites employing this feature more than regular websites because they don't have to trust arbitrary cookie banners not setting cookies. Hence I consider it still a good proposal improving web privacy.

What would, in your opinion, be the best way forward to flesh out that consent management proposal? Continuing this discussion here? Editing the original post? Closing this and creating a new issue?

@annevk thanks for that link which seems to be similar to what I'm looking for. Will take a closer look tomorrow during the day.

[ghost]

I think Firefox's total cookie protection does a really good job at maintaining current web standards and protecting the user's privacy. It would be great if other browsers implemented this. Currently it's the only reason I stick to firefox

[annevk]

@luap42 I suspect a better place to take this conversation would be that community group I referenced above or perhaps WICG.

I'm going to close this as this repository is mainly for issues directly pertaining to the HTML Standard.