Hands-On Tech 291 Transcript
Mikah Sargent [00:00:00]:
Coming up on Hands-On Tech, is clicking reject all on every cookie banner actually doing anything? Stay tuned for the answer.
Mikah Sargent [00:00:18]:
Hello and welcome to Hands-On Tech. I am Mikah Sargent, and today we are answering a very important question. And frankly, this is a question that I've had for a while and something that I've thought a lot about, but it's one of those things that's existed in that space that's sort of between, sort of in the back of my brain and actually making it happen. And I just kind of always pass by it. So I'm really glad to get to answer it today because it meant being able to do this research myself and kind of confirm what the truth is. So let's take a look at the question first and foremost. This question comes in from Bob, who writes— or Bill, I'm sorry. Bill, who writes, Dear Mikah, every site I open throws up a box about cookies before it'll let me read a word.
Mikah Sargent [00:01:09]:
There's always a big friendly accept all, and then the refusing part is buried behind manage preferences and a list of 400 partners. I've started rejecting on principle, but I honestly don't know whether I'm accomplishing anything or just clicking to make the box go away. What is a cookie actually doing? Does rejecting them change anything real? And is there a way to stop being asked 40 times a day? Bill. Well, Bill, I have to say, this is a fantastic question that I'm sure a lot of you have had. As I said, something that I regularly think about. And when it comes to whether this actually makes a difference for you or if this is something that You know, has some insidious components. Let's talk about it. Let's break it down.
Mikah Sargent [00:01:58]:
First and foremost, understand that rejecting it will actually do real— it'll make real changes on sites that will play by the rules, but not everybody plays by the rules. It will keep the ad companies' tracking cookies off your computer, as it's supposed to if it's running properly. But when you talk about seeing 40 times a day the banners pop up, you have to understand, and this is something that's kind of funny, your no, you saying no is actually itself saved as a cookie. And it's done so one side at a time. So saying don't track me and, you know, I don't want all these extra cookies The only way for it to save that is by creating a cookie that says you said that. There is a way though, whenever you're asking about how you can kind of make these go away, and it's letting your browser or an extension handle the process for you, clicking reject for you, and in that way, a lot of these banners will actually disappear. Now, to talk about this, we need to break into the— break down the technology behind a cookie and what a cookie is meant to do. So a cookie is this sort of little bit of data that a website itself will hand to your browser for your browser to save.
Mikah Sargent [00:03:28]:
And then next time you visit the site, your browser hands that little bit of data back to the site and says, see, these are all of the things that you need to know about Mikah's access to the site. It's almost like like a membership card for a grocery store or a, uh, or like a coat check ticket. You visit the site, you hand it over, it, or rather it hands you something, and then you hold onto it. And then the whole time that you're doing things, that gets saved to that little piece of paper, little notes about you. So yes, I like dark mode on at all times. Um, yes, I'm logged in. Yes, I, or no, I don't want, um, the, I don't know, animated images playing automatically. All of that is part of a cookie.
Mikah Sargent [00:04:22]:
And there are actually specific jobs that were meant to be part of what a cookie does. Mozilla, who is at the forefront of a lot of the web development rules and guidelines, lists 3 things. That a— 3 jobs that a cookie is meant to do. Keeping you signed in, remembering your settings, and then tracking. And tracking is the one, of course, that runs into a lot of issues. I'll have a link in the show notes to Mozilla's guide all about using HTTP cookies. And to be clear, it is more of a guide for folks who are using cookies on their sites, but it will give you a better understanding. of what's going on.
Mikah Sargent [00:05:08]:
Now, there are different types of cookies. First-party cookies are very simple in terms of understanding what they're there for. They are more the coat check style cookie. They come from the site that you're on, so that includes like your login, your shopping cart, what you have in your shopping cart, your dark mode setting, like we talked about before. The more nefarious cookies, whether they were intended to be or not, are third-party cookies. These are cookies or bits of data that come from someone else's code that's embedded on the page. So you can think, you know, an ad network or an analytics company or a social media's like button. Those are bits of code that can save information.
Mikah Sargent [00:05:57]:
And then, this is the big thing, If it's all coming from one ad company, then that cookie is the same across all sites. So the same ad company is embedded on thousands of sites. So when you go from place to place, the cookie knows that you've been to the recipe site, knows that you've been to the news site, knows that you've been to the shoe store site. And that is why the next time you're on the recipe site, you see the ad for those shoes that you were looking at before. These are responsible for— cookies are responsible for a lot of that misheld belief that sites are somehow listening to what we do and tracking us that way, when in fact that is not the case. In almost every case, it is not the case. It's just this, tracking us around the web by following our behavior because it has that little bit of a trail on us and what we're doing. Now you may be going, okay, sure, fine.
Mikah Sargent [00:07:07]:
Cookies, they're there. This is what they're meant to do. But why in the world do they exist at all? Well, it is a European law. It's not an American law. The EU has a rule that requires consent before a site is able to store anything that isn't what they call strictly necessary. So what is strictly necessary? Well, they don't require consent in order to save your login, your shopping cart, your load balancing. That is, of course, you know, a matter of protections for the website. But it's often by doing the thing you are consenting to it in the first place, as opposed to having it happen in the background.
Mikah Sargent [00:07:51]:
So logging in, adding to your shopping cart, that's the consent that you're placing. Visiting the website, that part is the consent that you're placing when it comes to load balancing. Now, when it comes to consent needed, that's advertising, that's tracking cookies, and sites can have first-party tracking cookies. Those aren't as much of an issue, but the problem again is those third-party tracking cookies. And withdrawing consent according to the EU rule has to be as easy as giving it. That's why these banners are there. If I can say, Yes, I should be able to say no just as easily. We will include a link in the show notes as well to the EU guide for how to use cookies.
Mikah Sargent [00:08:34]:
This is specifically for people who are building websites. Michigan specifically in this case has no comprehensive privacy law, okay? There was a bill that was introduced in June 2025. It is still sitting in committee. last I checked, Senate Bill 359 of 2025 in the Michigan legislature. So if you were wondering, for you there in Kalamazoo, if you had protections in place at the state level, not to a comprehensive extent. So why, Bill, do you see these banners across all sites? It's probably because plenty of sites show one banner to everyone. because they have to do it for the EU rather than sorting out the visitors by country. Might as well make it a banner that pops up for everybody if we're going to have the code in there anyway.
Mikah Sargent [00:09:32]:
Now, you mentioned it showing a bunch of partners. What's that about? Well, let's kind of take a look at that aspect of cookies. First and foremost, The partner list is very real, okay? The ad industry runs this registry. It's a shared registry of ad tech companies. And so banners will load all of them at once to kind of give you that easy understanding of what's going on. Of course, there's a big old accept all option. And then sometimes those dark patterns include a small manage preferences link that is, you know, not as friendly to access. And arguably, that is a design choice.
Mikah Sargent [00:10:24]:
And I think it's one that works. Our host university and MIT researchers, they sort of looked into this and hiding reject off of the first screen will raise acceptance by 22 to 23 points. So if there's no reject button and just an accept button, AKA just accept, and then instead of saying reject, they say manage preferences, that in and of itself is part of that design. Only 11.8% of the consent popups that the university researchers scraped met the law's minimum requirements. So there are a lot of places that are circumventing the rules, and that is— Bad. You know, I'm not surprised. There's a great study called Dark Patterns After the GDPR: Scraping Consent Pop-ups and Demonstrating Their Influence that was done by these researchers, published in April of 2020. We'll link that in the show notes too so that you can check it out.
Mikah Sargent [00:11:30]:
But if you're wondering what EU regulators say, well, Europe's privacy regulators compared notes in 2023, and then they called out these different tricks. by name to say, hey, no, this is stuff that needs to be addressed. No reject button anywhere a consent button appears. They call that an infringement now. Most regulators do. Pre-ticked boxes means that if you've pre-ticked the boxes, then that's not valid consent. You're not consenting. It's already chosen for you.
Mikah Sargent [00:12:04]:
Hiding the reject button or making it a link in a paragraph, they call that deceptive. A reject button that's there but with text so faint that it's unreadable, that's misleading. Legitimate interest toggles that are buried a layer down that make people refuse twice, they cannot be used as the legal basis for cookies. And then you can, uh, You can keep going and seeing all these different ways that they notice these patterns and how they've addressed them to make it clear that if you're doing them, it can get you in trouble. So the Cookie Banner Task Force, the EDPB, has a whole document that's a report on this. And again, we'll link to it in the show notes. Really, really interesting. So your big question.
Mikah Sargent [00:12:58]:
Does no work? Does rejecting actually change anything? Well, as I mentioned up top, yes, it does on honest sites. Okay. No ad network cookies, no cross-site profile that are built from that visit. If the site is honest, then these, these consent moments actually do count, but not every single site is honest. When researchers looked into it, they checked 1,426 European sites using the industry's standard banner system. You want to hear how it went? Well, 54% broke the rules at least once. 141 recorded yes before the visitor clicked anything. Uh, 27 recorded yes after the visitor clicked no.
Mikah Sargent [00:13:52]:
Excuse me? And so, yeah, They are not all following the rules. 54%, more than half, broke the rules at least once. That said, you know, when no works on the sites that are honest, great, but a no doesn't cover everything. A no never covers the site's own first-party analytics and ads. That's not part of the cookies. Being recognized while you're signed into an account, obviously not part of the cookies, and Well, consent-wise, and fingerprinting, which is that thing where it will identify your browser by its settings and therefore does not require a cookie to do so. So is rejecting worth doing? Yes, but it's kind of one lock you put on one door. It isn't a full-on shield around you.
Mikah Sargent [00:14:46]:
That's— it's not a shields up moment. It's just one place that they can't use One place they can't use to track you. You asked why it keeps asking you over and over again. And I think that the big thing here that people didn't quite get is that your no is also stored in a cookie. And each site keeps its own cookie for that. So rejecting on one site tells the other 39 sites that you got that banner on, nothing. And when you clear out your cookies or you use a private window or you switch browsers, every site doesn't recognize you and therefore sees you as a stranger again who needs to re-opt into the cookie system. The European Privacy Board's own banner actually explains this.
Mikah Sargent [00:15:45]:
It says, say no And it uses a cookie only to remember your choice. If you skip the banner, well, then it's going to reappear every time. Mozilla also had the same to say about private browsing. It will display cookie banners repeatedly, which makes sense. It makes sense. Can you address this? Yes. Just stop clicking it yourself. Let some software say no.
Mikah Sargent [00:16:08]:
There are kind of 2 approaches here. Answer the banner for you. or just hide the banner. And there are ways to do them both. One way is a tool called Consent-O-Matic. This is a free extension from Our House University, one of the teams that looked into these dark patterns. And it's for Chrome, it's for Edge, it's for Firefox, it's also for Safari. And so all you have to do is set your preferences once, and then each of those popups or banners it will fill out for you.
Mikah Sargent [00:16:42]:
You can also make use of the DuckDuckGo browser. It also has cookie pop-up protection, as it's called, and it's on by default. It will pick the most private option and then close the pop-up. And as far as its ability to work across sites, it covers most of the top 10,000 sites in the US, the UK, and the EU. That's what DuckDuckGo says. You can also choose to hide it instead of just answer it, so the banner never gets an answer at all. In Brave, you can use uBlock Origin. Brave blocks cookie consent notices by default on top of blocking third-party cookies.
Mikah Sargent [00:17:25]:
And of course, there's also the option of other browsers. In Firefox, for example, Mozilla, did shelve its own banner blocker and says instead use uBlock Origin because it has a cookie notices filter on it. That said, there is a trade-off here. Under EU rules, no answer means no consent, but that only helps on sites that follow the rules, okay? Answering leaves an explicit no on file, and that makes a difference. Hiding Never talks to the consent system at all. So it's not on record that you said no, and therefore it isn't as easy a thing to enforce. Um, and then there's also a matter of what happens when you turn off certain kinds of cookies, because there are cookies that matter more than others in terms of protecting your privacy online. You want to try to block The cookies that follow you, third-party cookies, they're the tracking cookies.
Mikah Sargent [00:18:31]:
Blocking them at the browser and the banner question actually matters less. It is something that you need to be aware of across sites. So in Safari on a Mac, the way that you can handle this is by launching Safari, going to Settings, going to Privacy, and then choosing Prevent Cross-Site Tracking. Okay. Toggling that on. We'll have a link in the show notes to the support document about preventing cross-site tracking. Chrome does still allow third-party cookies outside of incognito. It was originally going to phase them out in April of 2025.
Mikah Sargent [00:19:09]:
It has not done that. And so incognito is the only way to avoid those cookies, um, by, as part of sort of the, the, you know, phase out. But in Chrome, you can go to More, Settings, Privacy and Security, and then Block Third-Party Cookies. And in that, you're allowed to— you're able to delete, allow, and manage cookies in Chrome. There's also a bonus switch to be aware of, if you can believe it. It's called the Global Privacy Control. This is a place where it's sort of a signal that your browser can send out every time. It says, don't sell or share my data.
Mikah Sargent [00:19:50]:
It is legally binding in certain locations, California's privacy law, and there are similar state laws that have hopped on board as well to make it so that it is more global than it started out as. Sites can choose to honor it, sites can choose not to honor it. It is on by default in Brave and DuckDuckGo. You need to go to globalprivacycontrol.org to learn more about that. On Firefox, you can go to Settings, Privacy and Security, Website Privacy Preferences, and then Tell Websites Not to Sell or Share My Data. And that's sort of the built-in tool for turning on Global Privacy Control. If you're still feeling like, goodness gracious, that's just not enough for me, well, the European Commission has actually proposed new cookie rules in November of 2025. So there are some things coming down the pipeline.
Mikah Sargent [00:20:47]:
A single click of refuse all, so a button that says refuse all, would be added on every banner. Sites would have to respect your choice for at least 6 months before changing it back. You should be able to set your preferences once in the browser, and then sites across the board should honor them. Yay, that's kind of what we're talking about here. And then low-risk cookies, like counting visits, this is sort of the exchange here, that would no longer need a popup. So there's a back and forth that would make it easier for sites that aren't doing all of that extra cookie tracking to be able to track things like visits. There's a guide, again, from the EU that walks through the updates to this plan. It's a proposal right now.
Mikah Sargent [00:21:36]:
It's not a law. And so that means that negotiations are still ongoing and only today's rules apply. But I'm hopeful. Seems like a good change to things for both sides. Here's the bottom line. Keep saying no. A cookie is a ticket that a site hands your browser. A ticket that has information on it.
Mikah Sargent [00:22:00]:
And the third-party ones are how ad companies are following you from site to site, rejecting works on sites that follow the rules. So just keep doing it. The banner keeps coming back. As you, you asked about like, why is it there? Because no actually lives in a cookie and it's only for that specific site. So let something like Consent-O-Matic DuckDuckGo, Brave, or uBlock Origin say no for you, and then it becomes something that you don't have to pay as much attention to. They will handle it, and then you don't have to worry about it. I hope that helps, uh, Bill. And of course, I want to thank you for taking the time to write in.
Mikah Sargent [00:22:49]:
I want to thank you so much for tuning in to this week's episode of Hands-On Tech. I'll be back next week with another episode. Bye-bye. Bye.
