After years of inaction against adtech, UK’s ICO calls for browser-level controls to fix ‘cookie fatigue’ – TechCrunch

European web users digesting this development in an otherwise monotonously unchanging regulatory saga should be forgiven for any sense of déjà vu they may experience and for wondering if they haven’t been mocked/gaslit quite enough already where cookie consent is concerned.

Last month, UK digital minister Oliver Dowden aimed what he dubbed an “endless” parade of cookie pop-ups — suggesting the government is eyeing watering down consent requirements around web tracking as ministers consider diverging from European Union data protection standards post-Brexit. (He’s slated to present the full sweep of the government’s data ‘reform’ plans later this month, so watch this space.)

Today the UK’s outgoing information commissioner, Elizabeth Denham, stepped into the fray to urge her counterparts in G7 countries to knock heads together and coalesce around the idea of letting web users express generic privacy preferences at the browser/app/device level rather than having to do it through pop-ups every time they visit a website.

In a statement announcing “an idea”, she will present this week during a virtual meeting of fellow G7 data protection and privacy authorities — less briefly described in the press release as being “on how to improve the current cookie consent mechanism, making web browsing smoother and more business-friendly while better protecting personal data” — Denham said: “I often hear people say they are tired of having to engage with so many cookie pop-ups. That fatigue leads to people giving more personal data than they would like.

“The cookie mechanism is also far from ideal for businesses and other organizations running websites, as it is costly and can lead to poor user experience. While I expect businesses to comply with current laws, my office encourages international collaboration to bring practical solutions.”

“There are nearly two billion websites out there taking account of the world’s privacy preferences. No single country can tackle this issue alone. I am calling on my G7 colleagues to use our convening power. Together we can engage with technology firms and standards organizations to develop a coordinated approach to this challenge,” she added.

Contacted for more on this “idea”, an ICO spokeswoman reshuffled the words like this: “Instead of trying to effect change through nearly 2 billion websites, the idea is that legislators and regulators could shift their attention to the browsers, applications, and devices through which users access the web.

“In place of click-through consent at a website level, users could express lasting, generic privacy preferences through browsers, software applications, and device settings – enabling them to set and update preferences at a frequency of their choosing rather than on each website they visit.”

Of course, a browser-baked ‘Do not track (DNT) signal is not a new idea. It’s around a decade old at this point. Indeed, it could be called the idea that can’t die because it’s never truly lived — as a lack of industry support scuppered earlier attempts at embedding user privacy preferences into browser settings.

However, the approach Denham is advocating, vis-a-vis “lasting” preferences, may be somewhat different to DNT — given her call for fellow regulators to engage with the tech industry and its “standards organizations” and come up with “practical” and “business-friendly” solutions to the regional Internet’s cookie pop-up problem.

It’s unclear what consensus — practical or, er, simply pro-industry — might result from this call. If anything. Indeed, today’s press release may be nothing more than Denham trying to raise her profile since she’s on the cusp of stepping out of the information commissioner’s chair. (Never waste an excellent international networking opportunity — her counterparts in the US, Canada, Japan, France, Germany, and Italy are scheduled for a virtual natter today and tomorrow, where she implies she’ll try to engage them with her big idea).

So anything Denham personally champions right now, at the end of her ICO chapter, may have a very brief shelf life — unless she’s set to parachute into a similar role at another G7-caliber data protection authority. Nor is Denham the first person to make a revived pitch for a rethink on cookie consent mechanisms — even in recent years. Her UK replacement, meanwhile, is already lined up.

Last October, for example, a US-centric tech-publisher coalition came out with what they called a Global Privacy Standard (GPC) — aiming to build momentum for a browser-level pro-privacy signal to stop the sale of personal data geared toward California’s Consumer Privacy Act (CCPA), though pitched as something that could have broader utility for Internet users.

By January this year, they announced 40M+ users were using a browser or extension that supports GPC — along with a clutch of big-name publishers signed up to honor it. But it’s fair to say its global impact so far remains limited. 

More recently, European privacy group noyb published a technical proposal for a European-centric automated browser-level signal that would let regional users configure advanced consent choices — enabling the more granular controls it said would be needed to fully mesh with the EU’s more comprehensive (vs. CCPA) legal framework around data protection.

The proposal for which Noyb worked with the Sustainable Computing Lab at the Vienna University of Economics and Business is Advanced Data Protection Control (ADPC). And noyb has called on the EU to legislate for such a mechanism — suggesting there’s a window of opportunity as lawmakers; there are also keen to find ways to reduce cookie fatigue (a stated aim for the still-in-train reform of the ePrivacy rules, for example).

So there are some concrete examples of what practical, less fatiguing yet still pro-privacy consent mechanisms might look like to lend a little more color to Denham’s ‘idea’ — although her remarks today don’t reference any such existing mechanisms or proposals.

(When we asked the ICO for more details on what she’s advocating for, its spokeswoman didn’t cite any specific technical proposals or implementations, historical or contemporary, either, saying only: “By working together, the G7 data protection authorities could have an outsized impact in stimulating the development of technological solutions to the cookie consent problem.”)

So Denham’s call to the G7 does seem relatively low on substance vs. profile-raising noise. The massive elephant in the room here is the lack of enforcement around cookie consent breaches — including by the ICO. (And challenging to interpret as anything other than opportunistically opaque at this point.) Additionally, there’s the now very pressing question of how exactly the UK will ‘reform’ domestic law in this area (post-Brexit), making the timing of Denham’s call look interestingly opportune.

The adtech industry will, of course, be watching developments in the UK with interest — and would indeed be cheering from the rooftops if domestic data protection ‘reform’ results in amendments to UK rules that allow the vast majority of websites to avoid having to ask Brits for permission to process their data say by opting them into tracking by default (under the guise of ‘fixing’ cookie friction and cookie fatigue for them).

That would undoubtedly be a mission accomplished after all these years of cookie-fatigue-generating-cookie-consent-non-compliance by surveillance capitalism’s industrial data complex. It’s not yet clear which way the UK government will jump — but eyebrows should raise to read the ICO writing today that it expects compliance with (current) UK law when it has so roundly failed to tackle the adtech industry’s role in cynically sicking up said cookie fatigue by failing to take any action against such systemic breaches.

The bald fact is that the ICO has — for years — avoided tackling adtech abuse of data protection, despite acknowledging publicly that the sector is wildly out of control. Instead, it has opted for a cringing ‘process of engagement’ (read: appeasement) that has condemned UK Internet users to cookie pop-up hell.

This is why the regulator is being sued for inaction — after it closed a long-standing complaint against the security abuse of people’s data in real-time bidding ad auctions with nothing to show for it… So, yes, you can be forgiven for feeling gaslit by Denham’s call for action on cookie fatigue following the ICO’s repeat inaction on the causes of cookie fatigue…

Not that the ICO is alone on that front, however. There has been a reasonably widespread failure by EU regulators to tackle systematic abuse of the bloc’s data protection rules by the adtech sector — with several complaints (such as this one against the IAB Europe’s self-styled’ transparency and consent framework’) still working, painstakingly, through the various labyrinthine regulatory processes.

France’s CNIL has probably been the most active in this area — last year slapping Amazon and Google with fines of $42M and $120M for dropping tracking cookies without consent, for example. (Before you accuse CNIL of being ‘anti-American’, it has also gone after domestic adtech.)

But elsewhere — notably Ireland, where many adtech giants are regionally headquartered — the lack of enforcement against the sector has allowed for cynical, manipulative, and meaningless consent pop-ups to increase as the dysfunctional ‘norm’. In contrast, investigations have failed to progress. EU citizens have been forced to become accustomed, not to regulatory closure (or indeed rapture), but to an existentially endless consent experience that’s now being (re)branded as ‘cookie fatigue’.

Yes, even with the EU’s General Data Protection Regulation (GDPR) being applied in 2018 and beefing up (in theory) consent standards.

This is why the privacy campaign group noyb is now lodging scores of complaints against cookie consent breaches — to try to force EU regulators to enforce the law in this area, even as it also finds time to put up a practical technical proposal that could help shrink cookie fatigue without undermining data protection standards. 

It’s a shining example of an action that has yet to inspire the lion’s share of the EU’s regulators to act on cookies. The tl;dr is that EU citizens are still waiting for the cookie consent reckoning — even if there is now a bit of high-level talk about the need for ‘something to be done about all these tedious pop-ups.

The problem is that while GDPR cranked up the legal risk on paper, it’s just a paper tiger without proper enforcement. And the pushing around of lots of writing is very tedious. 

Most cookie pop-ups you’ll see in the EU are thus essentially privacy theatre; at the very least, they’re unnecessarily irritating because they create ongoing friction for web users who must constantly respond to nags for their data (typically to repeatedly try to deny access if they can find a ‘reject all’ setting).

But — even worse — many of these pervasive pop-ups are actively undermining the law (as several studies have shown) because the vast majority do not meet the legal standard for consent.

So the cookie consent/fatigue narrative is a story of faux compliance enabled by an enforcement vacuum that’s now also encouraging the watering down of privacy standards due to such much-unpunished flouting of the law.

There is a lesson here, indeed. ‘Faux consent’ pop-ups that you can easily stumble across when surfing the ‘ad-supported Internet in Europe include those failing to provide users with clear information about how their data will be used; or not offering people a free choice to reject tracking without being penalized (such as with no/limited access to the content they’re trying to access), or at least giving the impression that accepting is a requirement to access said content (dark pattern!); and otherwise manipulating a person’s choice by making it super simple to receive tracking and far, far more tedious to deny.

You can also still sometimes find cookie notices that don’t offer users any choice at all — and pop up to inform that ‘by continuing to browse you consent to your data being processed’ — which, unless the cookies in question are essential for the provision of the webpage, is illegal. (Europe’s top court made it abundantly clear in 2019 that active consent is a requirement for non-essential cookies.)

Nonetheless, to the untrained eye — and sadly, there are a lot of them where cookie consent notices are concerned — it can look like it’s Europe’s data protection law that’s the ass because it seemingly demands all these meaningless ‘consent’ pop-ups, which gloss over an ongoing background data grab anyway.

The truth is regulators should have slapped down these dark, manipulative patterns years ago. The problem now is that regulatory failure is encouraging political posturing — and, in a twisting double-back throw by the ICO! — regulatory thrusting around the idea that some novel mechanism is needed to remove all this universally inconvenient ‘friction’.

An idea like Noyb’s ADPC looks useful in ironing out the widespread operational wrinkles wrapping the EU’s cookie consent rules. But when the ICO suggests a quick fix after the regulatory authority has failed so spectacularly over the long duration of complaints around this issue, you’ll have to forgive us for being skeptical.

In such a context, the notion of ‘cookie fatigue’ looks like it’s being suspiciously trumped up, fixed on as a convenient scapegoat to rechannel consumer frustration with hated online tracking toward high privacy standards — and away from the commercial data pipes that demand all these intrusive, tedious cookie pop-ups in the first place — while neatly aligning with the UK government’s post-Brexit political priorities on ‘data’.

Worse still: The whole farcical consent pantomime — which the adtech industry has aggressively engaged in to try to sustain a privacy-hostile business model despite beefed-up European privacy laws — could be set to end in genuine tragedy for user rights if standards end up being slashed to appease the law mockers.

The target of regulatory ire and political anger should be the systematic law-breaking that’s held back privacy-respecting innovation and non-tracking business models — by making it harder for businesses that don’t abuse people’s data to compete.

Governments and regulators should not be trying to dismantle the principle of consent itself. Yet — at least in the UK — that now looks possible. Laws like GDPR set high standards for approval which — if they were robustly enforced — could lead to reform of highly problematic practices like behavioral advertising combined with the out-of-control scale of programmatic advertising. Indeed, we should already see privacy-respecting forms of advertising as the norm, not the alternative — free to scale.

Instead, thanks to widespread inaction against systematic adtech breaches, there has been little incentive for publishers to reform bad practices and end the irritating ‘consent charade’ — which keeps cookie pop-ups mushrooming forth, often with ridiculously lengthy lists of data-sharing ‘partners’ (i.e., if you do click through the dark patterns to try to understand what is this claimed ‘choice’ you’re being offered).

As well as being a criminal waste of web users’ time, we now have the prospect of attention-seeking, politically charged regulators deciding that all this ‘friction’ justifies giving data-mining giants carte blanche to torch user rights — if the intention is to fire up the G7 to send a collect invite to the tech industry to come up with “practical” alternatives to asking people for their consent to track them — and all because authorities like the ICO have been too risking averse to defend users’ rights in the first place.

Last month, Dowden’s remarks suggested the UK government may be preparing to use cookie consent fatigue as a convenient cover for watering down domestic data protection standards — at least if it can get away with the switcheroo. Nothing in the ICO’s statement today suggests it would stand in the way of such a move.

Now that the UK is outside the EU, the UK government has said it believes it has an opportunity to deregulate domestic data protection — although it may find there are legal consequences for domestic businesses if it diverges too far from EU standards.

Denham’s call to the G7 naturally includes a few EU countries (the biggest economies in the bloc). Still, by targeting this group, she’s also seeking to further engage regulators in jurisdictions that currently lack a comprehensive data protection framework. So if the UK moves, cloaked in the rhetoric of ‘Global Britain’, to water down its (EU-based) high domestic data protection standards, it will be placing downward pressure on international aspirations in this area — as a counterweight to the EU’s geopolitical ambitions to drive global standards up to its level.

The risk is a race to the bottom on privacy standards among Western democracies — when awareness about the importance of online privacy, data protection, and information security has never been higher. Furthermore, any UK moves to weaken data protection also risk putting pressure on the EU’s high standards in this area — as the regional trajectory would be down, not up.

And that could, ultimately, assist forces inside the EU that lobby against its commitment to a charter of fundamental rights — arguing that such standards undermine European businesses’ global competitiveness. So while cookies themselves — or indeed ‘cookie fatigue’ — may seem an irritatingly small concern, the stakes attached to this tug-of-war around people’s rights over what can happen to their data are very high.