Resent-Date: Sat, 24 Aug 2024 18:07:03 +0000
Resent-Message-Id: <E1shvAF-00ECJI-2Z@mab.w3.org>
Received-SPF: pass (puck.w3.org: domain of penteado.me designates 2607:f8b0:4864:20::112f as permitted sender) client-ip=2607:f8b0:4864:20::112f; envelope-from=joao@penteado.me; helo=mail-yw1-x112f.google.com;
MIME-Version: 1.0
From: =?UTF-8?Q?Jo=C3=A3o_Penteado?= <joao@penteado.me>
Date: Sun, 25 Aug 2024 03:06:46 +0900
Message-ID: <CACfd0dFXvK8EhHzabpu++xkTYdTL=zEro09LsSm4wo88N=heGg@mail.gmail.com>
To: ietf-http-wg@w3.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Proposal: Optional "Purpose" Attribute for Set-Cookie Header
Archived-At: <https://www.w3.org/mid/CACfd0dFXvK8EhHzabpu++xkTYdTL=zEro09LsSm4wo88N=heGg@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

Hi all,

I'd like to start a discussion about introducing a new optional "Purpose" (=
or a
generic "Tag") attribute in the Set-Cookie header specification.

The intended use case for this would be for servers to automatically signal=
 to
the client's browser the specific functionality provided by the cookie bein=
g
set. IANA could maintain a registry of standardized purposes, such as "auth=
",
"functional", "preferences", "analytics", "error-reporting", "marketing" an=
d
others.

This could be implemented as follows:

> Set-Cookie: id=3D1234567890; Purpose=3Dauth

The primary goal of this proposal is to alleviate the current UX issues cau=
sed
by cookie consent pop-ups, which have become prevalent since the introducti=
on of
the GDPR and similar privacy regulations. Leaving aside the discussion abou=
t
whether or not these pop-ups are actually required by different privacy
legislations or if they were their intent in the first place, the fact is t=
hat
many websites adopt this behavior nowadays and it is very frustrating. The
idea is that users could set their cookie preferences at the browser level,
potentially reducing the need for repetitive pop-up interactions.

Of course, this proposal hinges on the assumption that servers would be wil=
ling
to adopt this standard and honestly disclose a cookie's purpose. I believe =
this
is a reasonable expectation for the following reasons:

1. Websites that implement cookie consent pop-ups are already disclosing th=
e
purpose of cookies, albeit with a suboptimal user experience. Misrepresenta=
tion
could expose them to legal risks. The UX issues are not present in websites=
 not
implementing the pop-ups, so it wouldn't affect them anyway.

2. These websites also care about user experience, as it directly impacts b=
rand
perception, sales, and other business metrics.

Given how widespread and obnoxious these pop-ups have become, I find it
surprising that a similar proposal hasn't been widely adopted yet. If this =
idea
has been previously discussed and dismissed, I would appreciate any referen=
ces
to those discussions, as I couldn't find them easily.

I look forward to hearing what other folks in the industry think about this=
.

Thanks,

- Jo=C3=A3o