I am in my mid forties, been working as a professional software developer for over 20 years.

I click “accept the cookies” almost every time. I just personally don’t feel it’s worth the effort and cost to try to avoid it.

What “dark pattern cookie trick” are you worried about? I just can’t come up with a scenario where it will actually harm me in any way. All the examples I have heard are either completely implausible, don’t actually seem that bad to me, or are things that are trivially easy to do even without any cookies.

Now, I am not going around giving my real email out to random sites, though, although even that doesn’t strike me as particularly dangerous. I already get infinite spam, and I am sure there are millions of other ways to get my email address… it is supposed to be something you give out, after all.

I just don’t think it is something that is worth stressing out about and fighting against. Maybe I am actually naive, but I just have not yet been convinced I should actually care.

> the young people that are growing up conditioned to

How does the conditioning start?

> not value their personal data

Okay, but in practice how much do they do with it that isn't ad placements?

> It is the young people that are growing up conditioned to press accept

It's really alarming, actually. I run the cyber security training & phishing simulations at my work, and it's the younger employees that struggle the most. It's like they just assume that everything on the web is trustworthy.

It's not hard to see why though. They grew up with app stores & locked down devices. No concept of a file or file system, no concept of software outside of the curated store & webapps. People that never had to take responsibility for their own digital safety because "someone else" (Google, Apple) always did it for them.

Accepting cookies vs. entering personal information are very different buckets for me.

I just click "Accept all" on every cookie banner, life it too short to figure out which checkboxes and dark patterns I have to avoid on each site to not hand over some data...that is than later on just tracked in the backend ("server to server tracking"). Or sold by my credit card company, or tracked by me hovering over some video on YouTube. With the amount of data available unselecting some check boxes on a website just doesn't make a difference.

It's not just cookies, it's explicit consent to track you, and sell your browsing history to ~1500 spy companies around the world.

To the sibling comments: don't "accept the cookies" and then delete them.

- - -

I'm super angry at what the web has become, especially at the OS browser community. There is 0 browser (that I know of) that can access the web safely and conveniently. Atm I use Firefox with uBlock which blocks the cookie banners, but Firefox's extension model is broken, and every single extension provides 100% access to my websites to whoever controls the extension. I don't like it.

We need a browser with a safe extension model.

- - -

edit: I guess using 2 Firefox profiles, one with uBlock and one with my google/facebook/bank/amazon/etc accounts solves the threat posed by uBlock and extensions. I still don't like it.

  $ strace echo hello 2>&1 | grep ^open
  openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/proc/self/maps", O_RDONLY|O_CLOEXEC) = 3
  openat(AT_FDCWD, "/usr/lib/cargo/bin/coreutils/echo/en-US.ftl", O_RDONLY|O_CLOEXEC) = -1 ENOTDIR (Not a directory)

I use Cookie AutoDelete on Firefox and it's great. It works with Firefox Container Tabs (groups have their own cookie settings), and let's you greylist (allow cookies from a particular domain pattern until the tab is closed) or whitelist (always allow from the domain pattern). I set it up for my kids computers also. The default is to blacklist (cookies aren't set), and I can whitelist for particular sites where they need say persistent login.

Definitely in 2026 kids should be getting tons of education in public school about how to safely browse the internet, both for personal data privacy and for safety against stalking, doxxing, grooming etc in the same way millenials were grilled about source checking internet resources like Wikipedia.

I remember when it first became widely known that the government could see your library checkouts. People protested. It was a big deal in my tiny town.

I don't even think it would be even a blip on the radar now.

It really is depressing how much ground we've given.

My inclination is to simply close the window as soon as there's a popup of any sort. If someone did that to you in public you would be within your right to punch them in their face as an act of self defense.

Most doesn't event know what cookies too. In fact, most doesn't put extra thought into the things they are clicking/accepting on web.

Because of this, I found it odd that the regulation allows displaying the accept cookies button. Instead, it should be rejecting cookies by default and a separate flow to accept tracking cookies (e.g. via account settings page)

People around me (including engineers) all casually use things like Alexa, Google Home, Ring, Nest, Chrome, are always signed into Google, have all sorts of apps installed on their phones, and have no problems giving up their phone numbers to services for verification. It's crazy.

I do this, more or less, although I am a bit older. It's not as if I enter my real name, address, or email at every opportunity, but there is really no perceptible feedback loop that would force one to contemplate the consequences. I visit my local news site and the first thing I see is a massive cookie banner which lists over a thousand third-party vendors and asks me to either "Accept all", or if I am being prudent, click adjacent button called "Choose" to go to another page, then manually untick dozens of tracker categories, and then click "Allow selection". Whatever I chose, it wouldn't have any tangible impact on my life. I simply do not care.

I use chrome as “burn” browser (i only use it for non important things) and I have a dummy email that I use for signing up in everything non important as well. Perhaps this young adult was doing the same?

Accept the cookies and flush them out every time you close the browser. I think it would be naive anyway to assume that clicking no on a cookie banner would achieve much for your privacy.

Are those young people really doing the wrong thing by accepting? They are getting on and solving their problem, they have probably never had any personal harm done by "some weird dark-pattern cookie trickery".

It's almost like forcing (almost) every website to add these cookie banners has desensitised people to what they're actually saying.

I doubt the average person even reads those. They are just "the thing you must click to get on with things". How many of those does a person even see in a day across all software and websites wanting to pop up with some garbage you do not care about?

There is a third path, Firefox focus.

Accept everything, the end the session.

That said even with throwaway relay emails I don't sign up to much

I prefer to have a rule in ublock that blocks all cookies notices

> It is the young people that are growing up conditioned to press accept

There is a similar story with Ford and how they build pavement everywhere and taught the young population that roads are for cars. Now we have to drive for 10 minutes to get from one shop on the plaza to another shop on the different plaza.

I saw some research awhile ago that 60% of the time, "reject cookies" is ignored.

i've caught a lot of heat in the UK where i live for my position on GDPR, which is that i completely reject it, because people seem to believe it's there to protect any rights

if there's anything remotely good with GDPR is the requirement to companies to disclose known data breaches

all the rest of it is a terrible idea and only serves to nag people and legitimise the darkest of patterns

the regulation should be there to disallow companies from asking certain information, everything else regarding tracking is self-defeating as it's 1) seldom enforceable 2) hardly binding in any meaningful way 3) pushing people to concentrate their services where they have already surrendered their data 4) legitimising of dark patterns

this new and blatant step towards digital id is a hill i intend to die on, I will not comply and I will do everything in my power so that others don't have to and are even punished for doing so

Have you noticed half the internet doesn’t work if you use a vpn? Even a good vpn? Even HN wont let you create an account with a vpn. The friction applied to preventing people from deploying privacy tactics is intense. I’m not sure how we can practically resist the privacy enshittification without abandoning the internet and its convenience entirely. I’m ready to go back to paper statements and visiting my bank and writing paper checks, but I don’t think GenZ is.

That all random game and messaging sites now wants my kids' passport uploaded to some random 'id verification company' is madness.

But now instead, my 11 year old's Roblox thinks she is 18 because she wore glasses in their age verification webcam tool. And it can't be changed unless she uploads a passport, which I will never allow.

Please, gov.uk introduce a gov ID verification service? I could trust that, -ish, I have worked with public sector clients several times...

Most doesn't event know what cookies too. In fact, most doesn't put extra thought into the things they are clicking/accepting on web.

I would go into source, delete the overlay, undo the scroll lock

Breaches will inevitably happen. And each time one does, it'll erode people's trust in this new world of zero-anonymity-allowed. Give it time.

Does it even actually matter what you do? How many lawsuits/investigations have there been in the last decade revealing that some company or another that swore up and down was following privacy laws, protecting your data, and not selling it actually were. I'm at the point where I figure anyone who wants to track me is, and any privacy pop-ups or the like are just for show.

People are getting brainwashed into giving away information on the web and real life.

In the US it's not rare to link accounts through phone numbers that are required in web forms and store memberships.

In Chile they started asking for your National Id with so many stupid pretexts that people got conditioned into just giving it away. It wasn't like this 10yrs ago. I'd rather have membership numbers.

It's technically public information, so collecting Ids is legal, but it's also a universal primary key within the country that allows merging any user-related table you run into.

Retail says it's just to associate it with receipts in case you need that later, but I'd rather just get a photo of the printed receipt for later than rely on them to find my receipt. Supermarkets, Drug stores, and petrol stations tie it to (possible) discounts or points at check-out, which is price discrimination and it's illegal, but we are in our way to get surge pricing as soon as the new US bootlicker president begins his period next week.

I'm pretty old and was the same as you for about five years, but now I just tick anything, much like the young adults. If they want my info, they can have it. I've not heard a convincing explanation why I, personally, should care

Again the HN bubble, I assure that the vast majority of adults of any age are not privacy conscious.

It's been done for about a generation or two, and that's what people don't seem to realize.

In the early aughts I was sitting in on privacy discussions that reluctantly acknowledged that regardless of what we do online, surveys showed you could offer someone at the mall a free Snickers and they'd fill out the whole form.

The perceived cost to the individual of divulging their personal data is near zero; dangling nearly any incentive in front of them will induce them to let it go. And that's not a new phenomenon.

"they"... sadly indeed the damage is done, but not by "them".

The fact that you think declining the cookies gets you privacy is the real grift. The fact that you think you're safe from tracking because of a cookie banner

I've been saying this for years. GDPR and Cookie Law were created for big corporations to legitimise data trade where before it was grey area. Now they get consent as people blindly click accept and they can make money. It was never about privacy.

That very much isn't the only right way, and it is far to close to government tracking activities online. For one it effectively allows governments to disallow someone from accessing the internet.

All this to let you do stuff you were allowed to do anyway.

The problem is handing kids admin level access on a device with full unfiltered access to several communication networks. You do not fix that by demoting everyone's access.

even better would be a solution that didn't require even proxy or direct government log in.

like if you could be issued an E-id that could perform a local signature/challenge-response that allowed the site to confirm an age bracket (like 12 or below,13-17,18-20, 21+), assert the entity that issued the id but not assert a stable identifier (not even pairwise) and not pass any data between other parties.

Obviously not foolproof, credentials can be stolen (same in your scenario) but the site doesn't need to care, they should be legally in the clear. Basically it would let you anonymously assert your age.

And also our countries are being attacked by external actors who want to sow discord and damage our institutions

The problem is those self-same authoritarian strongmen are very successfully using sockpuppeting to change national discourses in ways that benefit them and are detrimental to the targeted countries. Hybrid war is real and has been ongoing for more than a decade. LLMs make it way more cost effective.

Being able to limit the influence of external bad actors is the main goal of ID verification. Age verification is a useful side effect that makes it easier to sell to the general public.

Big Tech has had at least a decade to fix this, did nothing of note, and is all out of ideas. Privacy advocates had the same time to figure out a "least bad" technical solution, but got so obsessed with railing against it happening at all, that nothing got any traction.

So governments are here to legislate, for better or worse. They know it's a trade-off between being undermined by external forces vs. the systems being abused by future governments, but their take is that a future authoritarian government will end up implementing something similar anyway.

>circumventing

I would say the time to buy mesh networking equipment is now. But it's not like I'm capable of defending the transmitter. So when they come for the VPNs, the VPSs, and encryption, I guess I'll just be out of luck.

(Out of luck = resigned to zero digital privacy. No matter I follow the law and “have nothing to hide” of course.)

Perhaps people will pass flash drives like North Korea or Cuba?

People trade away longevity for short term convenience. Then when that convenience is shown to be bad/unhealthy people refuse to give up that convenience.

So many aspects of our lives are like this now. People just accept defeat cuz it would mean giving up one click ordering or free return shipping or they might have to look at labels to avoid bad companies.

Honestly I think these age verification laws are blunt instruments responding to the decade of avoided moderation the big platforms have managed to pull off.

I've run ad blockers for years now, but I'm still trying to forget those disgusting zit popping pictures that trended in ads for a while. Or those incredibly stupid life hack shorts, like the one where someone tied a cord around a mug and the hack to get it loose was smashing the cup... that crap made me despair for humanity as much as the Gaza genocide.

But google and facebook convinced the legislators that it would be impossible to keep that chum away from kids on their platform, so the legislators are going with the next option: banning the kids from the platforms.

Splink is a notable endeavor in this regard from the MoJ.

https://github.com/moj-analytical-services/splink.

Givin a copy of your ID card to a website? Damn. In my times, we didn't even use to provide our _real name_ to websites.

Luckily it’s already possible to verify your age without actually giving out any data like your birthdate

Handing over a phone is certainly cheaper than paying for extra childcare, though most likely much less healthy for the child.

I suppose idea is that Chinese women will stay at home with the child so the state doesn't have to provide any help?

I gave a bunch of details of my personal history to a verification service thinking naively that it would be used to prove I was me.

Instead, they didn't know much about me apparently and just stored what I told them.

Then it appears they were hacked because some completely unrelated release of stolen data included all my data, specifically all that data I had provided to that service, that one time.

The Verification Service is the honeypot for your private information. Arg.

the catch is that for both cases same backend provider is most likely used. persona for example. and you have no choice who will id your face.

How true this is probably varies a whole lot from person to person.

Very few of the things you list are things that I do primarily online (even during the pandemic), and none of those are things that I can only do online.

No Such Agency is the biggest government data collection agency, why not name the hosting country?

Price discrimination comes to mind. What else?

(“what will be the impact to me”)

I'm in the same boat as OP.

The question I'd ask myself is; who would _I_ trust to implement privacy preserving verification?

The only answer I can come up with right now is; myself. I would trust myself.

Could be worse. OpenAI is asking for ID verification to use Codex 5.3, through Persona, which was just exposed as doing extremely dodgy surveillance stuff.

You lost your account and you still back to Gmail? Impressive

I have multiple “real identities”, diagnosed due to trauma. We each want to have our own spaces of interest and experience online.

As a matter of mental health, we really cannot have these overlapping for many reasons, prime among them is that if one part of me becomes aware of another while they’re doing their thing, a mental “table join” can happen and disturbing memories can be shared which is incredibly destabilizing to the system.

As a wireframe example my programming alter cannot be exposed to the alter who browses cptsd forums or they remember things that cause them to dip from the headspace and we lose their knowledge.

We can’t try to pretend we don’t exist and pretend to be one person either, we did that for years and we ended up having a breakdown and went into a fugue state and moved across country leaving everything behind.

This law would destroy our productivity and contribution to economy or whatever corporacrats care about.

It's called parenting. Don't do ipad parenting then. We didn't get a SEGA console and cable TV was restricted to only 2 hours. It was fine. It was fun. The only thing I wish for from my child is more time with friends not more screen time.

> But. Parents worry about their kids being exposed to porn and social media. They want someone to do something about it.

Someone, anyone, but themselves.

I don't like the idea that media services are required to report back to the government that I'm accessing them - I think that is an issue many would have with such a system

I also don't understand any of this kerfuffle. I think it mostly stems from third world countries, like the USA, where no one has a real ID; for those luddites it's "driver's license", or "electricity bill", or "birth certificate" or something to that effect.

Functioning countries have cryptographically secure government-issued ids. Those cards have a cryptographic computer chip. A crazy innovation that makes your nose bleed if you look at it funny. You stick the ID card with a secure chip in a card reader and open bank accounts, sign any document as if in person, even vote. It's free, by the way. It's a pact with the devil, really, or unadulterated communism. In the banana republic of the USA you go around showing your driver's license or uploading selfies to fakebook. So modern. So untraceable. So unspoofable. Go team USA. It's like the rest of us are here sitting by the track while the handicapped team is still three laps away, still figuring out where the finish line is. All in the name of Freedom(TM) of course.

Verifying age: 1- use ID card in reader, challenge is received from website, challenge answered, the website checks with the ID database about that particular challenge/response pair. The website gets a positive match, they don't know anything about you, not even your age. Done. Don't forget to drown three rabbits in goat blood or the authentication will not work.

you should NOT need any face ID to pay taxes.

I too like to appear younger online.

Ah yes, Jews control the world, nefariously plotting to undermine good people. Never heard that before

There is a difference between a liquor store checking your ID, and a liquor store scanning your ID, appending it to a record of your purchase, and uploading it to a service to be processed by third parties (such as insurance companies, perhaps).

(In the US, the latter occurs more often than you may expect.)

When I buy liquor (well, I don't drink anymore, so THC seltzers), the liquor company isn't saving my ID to my profile and then following me around everywhere I go for the rest of my life shouting "This is MALFIST, he's 42! He buys alcohol! He also visited X Y and Z last week and had interests in A, B and C. He's annual income is six figures and buys expensive bourbon."

You can absolutely buy for instance tobacco, cannabis by the pound ("CBD" but actually ~20+% THC[a]), explosives(tannerite), alcohol (wine), and guns (black powder, or perfectly functional cartridge pre-1898) completely legally online without ID check. It's really not a problem, which is why most people probably haven't heard of it being one or even realize all can legally be bought online without ID.