No need to accept cookies every time… New standard ADPC proposal

Many of you may have experienced the difficulty of reading the website displayed on most of the banner screens asking for consent to the use of cookies, or clicking several times to disable cookies. In many countries, the law requires users to consent to the use of cookies on websites. However, a standard called ADPC (Advanced Data Protection Control) that lowers browsing usability and eliminates the need to use a banner has been proposed.

With the implementation of the EU General Data Protection Rule GDPR, prior consent is required for websites to use user cookies. As a result, many websites have taken the form of displaying a banner at the bottom of the website and asking the user for consent. However, these banners take up most of the browser screen and take away readability, especially on smartphones with small screens. In addition, the use of design dark patterns that are intended to deceive users if they agree is also a problem.

Against this background, ADPC is newly proposed. ADPC sets personal information in the browser in advance, and when a user visits a website, the setting is reflected by communication.

ADPC was proposed by a non-profit organization (My Privacy is None of Your Business) and a research institute (The Sustainable Computing Lab). There are two specific methods: a method through HTTP headers and a method through JavaScript. A list of consent identifiers for user cookies is transmitted through communication with the web server in the former and the website in the latter.

Whether through HTTP header or through JavaScript, consent is sent in the form of a JSON file as shown below.

{

“consentRequests”: {

“cookies”: “Store and / or access cookies on your device.”,

“ads_profiling”: “Create a personalized ads profile”

}

}

Also, in the case of the method through the HTTP header, the web server connects directly to the consent file in the response to HTTP GET.

HTTP/1.1 200 OK

Link :; rel = “consent-requests”

When the web browser detects this link, it responds to settings configured by the previous user or prompts the user to respond via a pop-up dialog. And if the user configures it, the browser will include the ADPC in future HTTP GET requests like the one below.

GET /page.htm HTTP / 1.1

Host: website.tld

ADPC: withdraw = * consent = cookies

In the case of the above method, it is not a huge banner at the bottom of the display screen asking for consent to use cookies, but a pop-up that appears when the app requests to use the camera. Existing banners can be intentionally complicated by dark patterns, but this method is simple and can also minimize user click fatigue. Related information can be found here.