Third-party cookies

[mnot]

In the current draft's privacy considerations:

Given this risk to user privacy, some user agents restrict how third-party cookies behave, and those restrictions vary widly. For instance, user agents might block third-party cookies entirely by refusing to send Cookie headers or process Set-Cookie headers during third-party requests. They might take a less draconian approach by partitioning cookies based on the first-party context, sending one set of cookies to a given third party in one first-party context, and another to the same third party in another.

This document grants user agents wide latitude to experiment with third-party cookie policies that balance the privacy and compatibility needs of their users. However, this document does not endorse any particular third-party cookie policy.

Is this still true?

[chlily1]

Which part of it are you asking about, specifically?

The part about "grants user agents wide latitude" is certainly true. It allows UAs to ignore Set-Cookie headers in their entirety and omit the Cookie header entirely. I suppose it does not technically allow for selectively withholding certain cookies from the Cookie header. (Maybe that should be allowed?)

The part about not endorsing any third-party cookie policy is probably also fine. It gives examples of a third-party cookie policy that drops Set-Cookie and Cookie headers entirely on third-party requests, but I don't think this constitutes an endorsement.

[chlily1]

@mnot Does that answer your question? Please reopen if not, or if you think there are any changes needed.

[mnot]

I was wondering if, given how much has changed in the intervening years, we could go a little further and say something about how third-party cookies cannot be relied upon to work by sites because they are abused, and current techniques for mitigating that abuse are not standardised.

Happy to write up a proposal if that would help.

[sbingler]

I don't feel strongly here but if you think some updated wording would help I'm happy to review a proposal.

[mnot]

See PR.

[annevk]

Given that the PR got merged, should this be closed?

There's agreement emerging to block cross-site cookies, but perhaps that's best covered in a new issue.

[mnot]

chair hat on

@jwrosewell, in the comment above you characterise / assume others' motivations. That does not promote good-faith participation in the work, and can be harmful to the consensus process. It also is perceived as an ad hominem attack by some. Please refrain from doing this in the future.

Additionally, this document is a technical document -- it does not purport to state legal constraints, nor do we have the authority to do so. As such, it's off-topic, and so I'm hiding the comment.

[miketaylr]

Given that the PR got merged, should this be closed?

It seems fair to close now, yes.