New Approach to Cookie Consent Management

      
Dear W3C Privacy Group,
  
​
  
I am writing on behalf of the privacy-first Aloha Browser to propose a new implementation for cookie consent management that aims to address current issues with cookie pop-ups.   
  
​
  
Being committed to privacy protection, we feel it is important to share our observations that the current implementation of the GDPR cookies consent management is            problematic: users — overwhelmed by the frequency and complexity of cookie consent pop-ups — often choose to accept all of them without consideration.    According to Cookies Behaviors Study, nearly 70% of users either ignore cookie banners or accept all cookies.   
  
​
  
We believe it's time for a paradigm shift in how cookie consent is managed, and propose a revolutionary feature— an automated browser-level GDPR Cookie Consent Management solution.   
  
​
  
This solution enables users to configure their cookie preferences once at the browser level which are then uniformly applied to every website visited. By addressing consent management at the browser level, we can provide users with a consistent, easy-to-use interface to manage their privacy preferences across all websites. This approach obviates the need for individual site-specific cookie banners and popups, respects user choice, reduces interruptions, and ensures that user decisions are meaningful and informed.
  
​
  
We believe this innovation enhances the effectiveness of current consent management practices, while maintaining compliance with GDPR and other privacy regulations.    
  
We are confident that the W3C Privacy Group shares our passion for privacy. That’s why we propose uniting our efforts to create a new industry standard. Together, we can create a solution that benefits users, respects privacy, and streamlines compliance for website owners.
  
​
  
Why it is important to implement the new approach now:
  
  
​The current approach, while well-intentioned, has proven largely ineffective and often counterproductive:
  
  
​1. User fatigue: The proliferation of cookie pop-ups on virtually every website has led to "consent fatigue." Users frequently accept all cookies without reading the options, simply to remove the intrusive pop-ups and access content quickly.
  
2. Ineffective privacy protection: Paradoxically, this fatigue results in users consenting to more data collection than they might if presented with a less frequent, more meaningful choice.
  
3. Ad-blocker usage: Many users resort to ad-blockers or pop-up blockers, which remove these prompts entirely. While this eliminates the annoyance, it also bypasses the consent mechanism, potentially leaving users vulnerable to unwanted data collection.
  
4. Poor user experience: Cookie banners and pop-ups often disrupt the user's browsing experience, especially on mobile devices where screen real estate is limited.
  
5. Inconsistent implementations: The variety of consent interfaces across websites leads to confusion and inconsistency in how users manage their privacy preferences.
  
6. Despite many efforts and recommendations from regulators, the “Reject All” option is often hidden and takes significant effort from            the user to find and click.
  
7. Even if the choice is provided, it will be “forgotten” as soon as the choice-storing cookie expires, or it will be asked again repeatedly if browsing in private mode.
  
  
​Benefits of the new approach:
  
  
  
  
Improved user experience: Eliminates repetitive prompts across websites.
  
  
  
Enhanced privacy: Gives users more control over their data across their entire browsing experience.
  
  
  
Simplified compliance: Reduces the burden on website owners to implement and maintain cookie consent systems.
  
  
  
Consistency: Provides a uniform interface for managing cookie preferences across the web.
  
  
  

  
Key features of the proposed standard:
  
  
  
  
Browser-level consent management:
  
- Move consent controls from individual websites to the browser settings.
  
​- Eliminate the need for per-site cookie banners and popups.
  
  
  
Global consent options:
  
  
  
  
  
"Allow all" cookies
  
  
  
"Reject all" cookies
  
  
  
Custom settings for different cookie categories (e.g., necessary, functional, analytics, advertising)
  
  
  
  
  
Per-site granular settings:
  
  
  
  
  
Users can customize their cookie preferences for specific websites.
  
  
  
Ability to override global settings on a site-by-site basis.
  
  
  
  
  
Standardized cookie categories:
  
  
  
  
  
Define a common set of cookie categories across all websites.
  
  
  
Ensure consistency in how cookies are classified and presented to users.
  
  
  
  
  
Consent storage and communication:
  
  
  
  
  
Browsers store user consent preferences securely.
  
  
  
Implement a standardized API for websites to query the user's consent status.
  
  
  
  
  
Audit trail and compliance:
  
  
  
  
  
Maintain a log of consent changes for GDPR compliance.
  
  
  
Provide tools for users to review and modify their consent history.
  
  
  
  
  
Proactive reaction:
  
  
  
  
  
Based on the user's            choice, the browser can decide how to react to third-party            cookies and may block cookie requests from malicious websites.
  
  
  
  
  

  
​Technical details and an example of the implementation is available in our public repository:
  
 https://github.com/AlohaMobile/cookie-consent-management  and will be available as an issue in a W3C Privacy Community Group GitHub as well.
  
  
We would welcome the opportunity to collaborate with the W3C Privacy Group to refine and implement this standard.   
  
We look forward to your feedback and the possibility of working together on this important initiative.
  
Thank you for your consideration.
  
​
  
  
  
  
  
  
​​Best,
  
  
​Andrew Frost Moroz
  
Aloha Mobile
  
​alohabrowser.com