Abolishing Cookie Banners: Why the Goal Is Right, but Browser Privacy Settings, Plugins or a Central Consent Manager Are Not the Solution

Politicians, data protection authorities and consumer advocates want to abolish cookie banners: the motive is good, but browser privacy settings, browser plugins or a central consent manager are unsuitable for numerous reasons. Let's dig deeper.

Introduction

Shortly before the vote on the new TTDSG (the German Telecommunications and Telemedia Data Protection Act), plans became known that the CDU/CSU and the consumer advocates support default settings in the browser to eliminate so-called cookie banners. These plans were partly revised, but also partly made more concrete by the concept of a central consent manager.

The privacy organization noyb also recently published a concept called ADPC (Advanced Data Protection Control), which is meant to eliminate cookie popups. The idea is good, the solution is not. I even told noyb so after its publication. The responses proved me right.

Everyone will agree that cookie banners are annoying. So I also consider their abolition desirable. However, the arguments put forward by politicians and consumer advocates are not effective, as I will show.

Browser privacy settings

Browsers have offered privacy settings for quite some time. Here is an example from the settings that the Firefox browser provides:

So the options are manifold. There is even another setting called Do Not Track:

The browser sends this setting to every website you visit, in the request data:

So Firefox sends the parameter DNT with the value 1. DNT obviously stands for Do Not Track.

However, if you visit the Google search engine at google.com with Do Not Track enabled, this website still loads a tracker, as the following screenshot shows:

Obviously, the Google website ignores the privacy setting. You can demonstrate the same disregard for privacy on other websites.

Twitter’s privacy notices even admit outright that Do Not Track is ignored (see https://help.twitter.com/de/safety-and-security/twitter-do-not-track).

The responsibility already lies with the website operators. A new browser setting does not change that. Why should all website operators suddenly care more about privacy just because there is a new browser setting?

Browsers themselves cannot block much more than they already do (especially if you use freely available plugins such as Ghostery or uMatrix).

Goal: eliminating cookie popups

The goal is right and I support it. My approach: do not use any services that require consent. This works for about 90 % of German websites. Examples:

• Privacy-friendly interactive map instead of Google Maps
• Local instead of external Google Fonts
• Matomo or similar instead of Google Analytics
• A preview image linking to the video platform instead of an embedded YouTube video, or simply host the video locally
• The same for Vimeo
• Do not use Google Tag Manager if it is not necessary

Politicians want something different: every browser is supposed to offer additional privacy settings. It has to be every browser, I say, because otherwise the approach does not work. It will already fail on that point. Moreover, it will take a while until most browsers have hopefully followed the German requirement. What if a user uses a browser from a foreign vendor that does not implement the German requirement? The annoying popup prompt, together with the violations that come with it on a website, remains.

In addition, ideally every website must respect the new privacy settings. This will not happen. Proof: the settings that are possible today are already ignored by the vast majority of websites. Reasons: higher implementation effort and lack of knowledge. I do not want to offer a general criticism of either reason, just state it. Browsers cannot block everything that is prohibited under data protection law. Example: external Google Fonts. As much as I would be delighted if Google Maps or embedded YouTube videos were blocked automatically by browsers: this will not happen.

Who determines that the following data transfers are unlawful without consent:

• Google Fonts
• Google Maps
• Embedded YouTube or Vimeo videos
• Embedded SoundCloud audio player
• MailChimp
• Files embedded via Cloudflare

All of these cases require consent, as can be demonstrated!

It is factually impossible for a browser to “automatically” prevent the loading of all data transfers that would require consent. On the one hand, because browsers cannot tell whether a data transfer is permissible, for example because a data processing agreement exists. On the other hand, because the functionality of websites could be severely restricted by disabling unlawful but functionally important tools.

Should consent tools promise to respect the new default settings automatically, the following will happen: the shortcomings of the consent tools, which can be established objectively and through practical tests, will remain (see below).

The annoying prompt will disappear, but the privacy problems that already exist millions of times over will not. Moreover, the consent tools, products of commercial vendors, would then hold the power of decision. As part of their consulting approach, the tool vendors would offer their customers, the website operators, a business-friendly but privacy-hostile behavior of their cookie tool as a special service.

Another piece of evidence for why websites will not comply with new privacy settings: “every” website that has a so-called cookie banner embedded already has considerable legal defects – and because of the cookie banner itself! There are objective reasons for this. My extensive investigation additionally shows that even the largest and most capable companies, and even the vendors of the cookie banner tools themselves, do not get it right.

Cookie banners are misunderstood

The terms cookie banner, cookie popup or cookie tool are misleading and miss the point. What is really meant is a consent request.

A consent request asks for permission for data processing that is only allowed with consent. This includes:

1. Avoidable data transfers: Article 5(1)(c) GDPR (data minimization)
2. Data transfers to insecure third countries: Article 44 et seq. GDPR
3. Technically unnecessary cookies: Section 15(3) TMG in accordance with Art. 5(3) ePrivacy Directive (cf. BGH ruling on Planet49)

Cookie banners usually only ask about the third type of data processing just mentioned, cookies. This is obviously not sufficient and increasingly leads to unlawful websites.

Speaking of cookies when what is meant is a consent request is therefore an impermissible simplification of the requirements.

A website often does not “know” itself which data processing operations require consent. In my opinion, this is also due to the agencies that build websites and simply integrate everything that seems trendy. Check it yourself with my online website check.

Conclusion

Browser privacy settings that signal to websites that tracking should be refrained from are not a solution to privacy problems, but only a supplementary building block.

Default settings cannot be a sufficient approach and additionally lead to new problems and more effort.

Proposed solution:

• Use alternatives for tools that require consent
• Remove tools that are not needed
• Sanctions by data protection authorities as a deterrent, since many currently believe they do not have to comply with data protection laws

The last point in particular is the quickest to implement and the most effective at first. A few cases are enough to scare the data offenders.

How website operators can already get by without banners today is shown in the overview Cookies and consent.