The End of Cookie Blockers: Privacy-Friendly Browsers and Ad Blockers

Consent requests are often called cookie popups or cookie tools and regarded as such, which is wrong. Even worse are websites that use so-called cookie blockers, which are supposed to disable all plugins requiring consent until the user has given it. Modern browsers and ad blockers block these cookie services, which in turn can no longer block the critical plugins.

Introduction

A lot has already been written on this blog about so-called cookie tools. Synonyms are cookie popup, cookie service, cookie banner or cookie bar. All of these synonyms are misleading. It is not only about cookies, but about data processing that requires consent. This includes in particular:

• User profiling ("tracking").
• Excessive data processing at the expense of the user, for which the website operator has no legitimate interest.
• Data transfers to unsafe third countries (the USA is still an intelligence state, even if some in the EU see it differently).
• Cookies that are not necessary.
• Other unnecessary access to the end device, for example through JavaScript (see the viewport query in Google Analytics).
• Unnecessary access to terminal equipment, for example needless updates on smart home devices (including car navigation systems)

Cookie tools are meant to ask for consent. The term consent tool would be better. Consent means the permission of the website visitor.

As an additional feature that mostly has a negative effect, many consent tools offer a so-called cookie blocker. The idea is as follows:

1. A webmaster has no idea about data protection.
2. They cram their website full of tools that cannot be operated lawfully, and certainly not without consent.
3. Now the webmaster embeds a consent tool with a cookie blocker.
4. The cookie blocker disables all the evil plugins until the user has given consent. Afterwards the blocker reactivates the evil plugins, which are often still evil.
5. Everything is fine.

The Problem with Cookie Blockers

So much for the world of dreams. Evil plugins such as Google Analytics cannot be brought under legal control. The reason is the completely unclear data processing that takes place at Google. The same applies to some popular services from other providers. Even with consent, such services cannot be used lawfully.

The cookie blocker skips this problem of services that cannot be used lawfully and addresses the other problem, namely that services are supposed to be suppressed until consent has been given. Many website administrators are either not skilled enough or cannot be bothered to load plugins only once they are allowed to load. Instead, they simply embed the plugins and wait for the cookie blocker to block them until consent for these plugins has been obtained via the cookie popup.

I have described several times that it is objectively not technically possible to block plugins reliably with cookie blockers. There is no further need for clarification here.

Recently (for at least a few months now), many cookie tools are themselves regarded as critical by privacy-friendly browsers or ad blockers. As a result, these cookie tools are blocked themselves.

Here you can see a screenshot of my building society, Schwäbisch Hall:

The screenshot has not been edited. This is exactly what you see when you open the Schwäbisch Hall website.

It is a pity that Schwäbisch Hall does not offer me an option to accept nothing. Instead, I am forced to click on "Weitere Optionen" ("More options").

After clicking "Weitere Optionen", Schwäbisch Hall shows the following view:

The screenshot has not been edited. I use a standard Firefox browser in its current version with the standard Ghostery ad blocker, after earlier visits to the website without an ad blocker had led to data processing I did not want.

Now I have exactly one option: close the website again. Since I only visited this website to view the customer documents announced by email from Schwäbisch Hall, I unfortunately have to look for another way.

Had Schwäbisch Hall offered a reject function on the first level of the consent request, as is legally required, the problem of the website being unusable would probably not have arisen. However, I would have liked to know what I am actually supposed to consent to.

After I called Schwäbisch Hall, my concern was recorded and will be passed on to the technical department, which would then get in touch with me. I also received by post the documents that I could not retrieve online. For me, this means extra work: scanning documents, wrestling with other people's mistakes, and so on.

If this leads nowhere, I will offer Schwäbisch Hall to end our business relationship with compensation for services not used. Schwäbisch Hall asked me by post about my system configuration. They said they could not technically reproduce the behaviour of the website. I had sent screenshots beforehand.

However, "Weitere Optionen" is not a reject function, but initially just a piece of information. A reject option on the first level of the consent layer would have solved the problem for me right away. That the technical department (allegedly) could not reproduce my problem even after I pointed out the use of an ad blocker strikes me as difficult and not very customer-centred. That the website cannot be used without an ad blocker without raising data protection questions is another questionable point.

By the Way

What can happen when technology and law collide and responsibilities and competences are unclear can be seen regularly on the websites of online news outlets. Examples are Welt online and the Kieler Nachrichten, which also report on topics relevant across Germany. The naive internet user, like you and me, encounters the following arabesque:

1. You open the website of Welt or the Kieler Nachrichten to read an article.
2. You are asked whether you are willing to put up with advertising in order to read the article for free, or whether you would like to buy a subscription in order to read it for money.
3. You choose advertising.
4. The article does not appear. Instead, you see the article's cover image and a very short teaser text.
5. This is followed by a request to take out a paid subscription.

So you are tricked into advertising, only to be unable to read the article unless you want to pay. Why do Welt and Kieler Nachrichten not ask for money straight away instead of asking for advertising first and then for money? I see two possible answers:

1. Welt and Kieler Nachrichten are incompetent at providing a lawful website.
2. Welt and Kieler Nachrichten want to earn money first with advertising and then with a paid subscription.

Perhaps in future you would rather read magazines other than Welt and Kieler Nachrichten, namely those that treat their readers with respect and respect their privacy.

Conclusion

Privacy-friendly browsers such as Brave or Mullvad block numerous cookie popups. Besides Ghostery, the ad blocker uBlock Origin also often ensures that cookie popups are blocked, which are rightly regarded as annoying and critical.

If a consent request does not appear because of an ad blocker or a privacy-friendly browser, this is not a problem as long as no plugins are used that would need consent as their legal basis. That this is not ideal for marketing is another question. But the fact that Google Analytics is blocked by ad blockers anyway, yet is still often used (as the only tool), shows that some marketing departments have not yet arrived in reality.

The right way for services that require consent, also from a marketing point of view, is the following:

1. Do not embed the code for the respective plugin at all, or embed it in a disabled state. Embedding it disabled works via the directive data-src instead of src in the script tag.
2. After consent, a consent request either loads the code in the first place or activates the code delivered in a disabled state by automatically turning the pseudo-directive data-src into the directive src, which the browser can execute.

The truly advanced do not use services that require consent. Here are a few examples of privacy-friendly alternatives:

• Google Analytics → WP Statistics (for WordPress), Matomo or your own conversion tracking (see this blog)
• Google Maps → no map, a map image with clean licensing, a button for a route planner or a privacy-friendly interactive map
• YouTube video plugin (or Vimeo) → no video, a link to the video platform or a local video player
• Facebook Pixel → no Facebook
• SoundCloud → local audio player
• Cookie tool with guessed defaults → your own cookie tool with details you enter yourself

If you absolutely want or have to use a consent tool, it should ideally be one that is hosted locally. Even more important, however, is that no trust is placed in the pseudo-function of the cookie blocker and that plugins are loaded only after they are allowed to load. Loading something that requires consent and then artificially preventing it from running until consent exists is a sign of utter desperation or incompetent service providers.

How to implement a consent request correctly, or drop it entirely, is shown in the overview of cookies and consent.