That's easy. Just ask me (the user) for permission and explain why you would like to do so. If your users don't like it then maybe you shouldn't be doing it.
On the server side, companies are bound by data protection laws. Using the browser as a loop-hole for profit is not acceptable. Instead we get these absurd EU 'this site uses cookies' banners that do less than nothing for user privacy.
Just ask me (the user) for permission and explain why you would like to do so.
Unfortunately, it's not that simple.
From a user's point of view, asking questions that interrupt their browsing experience on every other site is usually unwelcome. The "We use cookies (like everyone else in the known universe)" messages in Europe that you mentioned are a great example, where good intentions ran headlong into practical limitations and the result was something that no-one actually likes.
From a business point of view, that same poor experience is a negative because it makes your site less attractive to visitors and ultimately hurts conversion. This remains true even if you're doing something reasonable with innocent intentions that almost all of your visitors would actually be happy for you to do.
I am very much in favour of protecting privacy on the Web and letting users make informed choices about when they are willing to give it up in return for something they value, but I don't see this working in practice until we have some sort of mandatory (with force of law) standards for disclosure by site operators that allow browsers to offer standardised preferences to their users that can be set once and then safely forgotten about. I think we need some sort of standardised, automation-friendly privacy policies, like the credit agreements where providers are required to provide key information up front in a standard format with the same assumptions for everyone, or the way a few open source licence agreements have become established and much of the time both the licensor and the licensee can just say "GPLv2" or "BSD" and everyone knows the deal.
Unfortunately, the wheels of standards turn slowly, the wheels of law more so, and the wheels of laws respected across borders even more so. Meanwhile, the wheels of businesses funded by invading privacy or otherwise exploiting users via modern technologies tend to turn very fast. I'm not sure how we fix this problem as long as the politicians are as technically illiterate and generally open to manipulation by special interest groups as they obviously are in many first world countries today.
Sounds like you're talking about P3P, which at least is a ridiculous useless standard that I'm guessing most server operators copy-paste and tweak a http header without understanding it just to get IE to work as expected.
P3P is a small step in what I'm arguing would be the right direction, but I doubt anything like that would bring any significant improvement in general privacy standards unless it was widely supported (all major browsers), legally mandated (with meaningful enforcement against violations), and most important of all, able to adapt as technologies and the ethics of privacy evolve.
It needs to be able to capture the things that significant numbers of people care about and summarise the main types of behavior encountered on real world web sites, but in a way that everyday users can see and configure in a few moments in their browser. This is a tall order, of course, but even a decent attempt at it would probably be better than the utter contempt for privacy and blatant exploitation of users' ignorance that is widespread today.
As a benchmark, I suggest looking at the way organisations like Facebook have presented privacy settings. Non-technical people understand concepts like sharing data with everyone vs. limited audiences, or allowing their name/photo to be associated with something. Significant numbers of people do set these preferences, and do object when they are violated or when their "preferences" are changed for them. But the choices probably have to be explained and configured at that kind of level of simplicity or it'll all be too much for most people to bother with.
Oh, you mean like all the apps of Facebook that (the users) just get "Accept" clicked so you can share your Cookieland Adventure scores with everyone that doesn't care.
(If there's a real app named Cookieland Adventure, I'm sure it's awesome, this was just a made up example, if you, your spouse or someone you vaguely remember talking to works on a Cookieland Adventure game for FB, I am sorry to associate your app with the scum of the earth)
Comments
The real deal is to find a way that user and business can both gain something. And this is hard.
That's easy. Just ask me (the user) for permission and explain why you would like to do so. If your users don't like it then maybe you shouldn't be doing it.
On the server side, companies are bound by data protection laws. Using the browser as a loop-hole for profit is not acceptable. Instead we get these absurd EU 'this site uses cookies' banners that do less than nothing for user privacy.
Just ask me (the user) for permission and explain why you would like to do so.
Unfortunately, it's not that simple.
From a user's point of view, asking questions that interrupt their browsing experience on every other site is usually unwelcome. The "We use cookies (like everyone else in the known universe)" messages in Europe that you mentioned are a great example, where good intentions ran headlong into practical limitations and the result was something that no-one actually likes.
From a business point of view, that same poor experience is a negative because it makes your site less attractive to visitors and ultimately hurts conversion. This remains true even if you're doing something reasonable with innocent intentions that almost all of your visitors would actually be happy for you to do.
I am very much in favour of protecting privacy on the Web and letting users make informed choices about when they are willing to give it up in return for something they value, but I don't see this working in practice until we have some sort of mandatory (with force of law) standards for disclosure by site operators that allow browsers to offer standardised preferences to their users that can be set once and then safely forgotten about. I think we need some sort of standardised, automation-friendly privacy policies, like the credit agreements where providers are required to provide key information up front in a standard format with the same assumptions for everyone, or the way a few open source licence agreements have become established and much of the time both the licensor and the licensee can just say "GPLv2" or "BSD" and everyone knows the deal.
Unfortunately, the wheels of standards turn slowly, the wheels of law more so, and the wheels of laws respected across borders even more so. Meanwhile, the wheels of businesses funded by invading privacy or otherwise exploiting users via modern technologies tend to turn very fast. I'm not sure how we fix this problem as long as the politicians are as technically illiterate and generally open to manipulation by special interest groups as they obviously are in many first world countries today.
Sounds like you're talking about P3P, which at least is a ridiculous useless standard that I'm guessing most server operators copy-paste and tweak a http header without understanding it just to get IE to work as expected.
P3P is a small step in what I'm arguing would be the right direction, but I doubt anything like that would bring any significant improvement in general privacy standards unless it was widely supported (all major browsers), legally mandated (with meaningful enforcement against violations), and most important of all, able to adapt as technologies and the ethics of privacy evolve.
It needs to be able to capture the things that significant numbers of people care about and summarise the main types of behavior encountered on real world web sites, but in a way that everyday users can see and configure in a few moments in their browser. This is a tall order, of course, but even a decent attempt at it would probably be better than the utter contempt for privacy and blatant exploitation of users' ignorance that is widespread today.
As a benchmark, I suggest looking at the way organisations like Facebook have presented privacy settings. Non-technical people understand concepts like sharing data with everyone vs. limited audiences, or allowing their name/photo to be associated with something. Significant numbers of people do set these preferences, and do object when they are violated or when their "preferences" are changed for them. But the choices probably have to be explained and configured at that kind of level of simplicity or it'll all be too much for most people to bother with.
Oh, you mean like all the apps of Facebook that (the users) just get "Accept" clicked so you can share your Cookieland Adventure scores with everyone that doesn't care.
(If there's a real app named Cookieland Adventure, I'm sure it's awesome, this was just a made up example, if you, your spouse or someone you vaguely remember talking to works on a Cookieland Adventure game for FB, I am sorry to associate your app with the scum of the earth)