-
wow a company did the exact thing with tcf that every critic of tcf warned people that companies would do with tcf because of tcf's obvious surface level flaws Digiday/1586349651959205891
-
what an incredible surprise
-
so glad we're using basically the same exact system in the form of gpp to do future united states compliance
-
wow the attacker used vendor consents, an unnecessary & unnecessarily detailed system of consents recorded for individual ad tech vendors, that is the exact part of tcf every critic has identified as a huge fingerprinting risk confiant.com/privacy-hub/voldrakus
-
wow and the attacker used the cmpId, a specific and entirely unnecessary piece of complexity that I identified specifically as a problematic piece of tcf translated to the gpp spec
-
Enjoy my now even more relevant critique of GPP which is mostly just TCF ported over with Even More data fields that can be used to fingerprint users aramzs.github.io/web-standards/2022/09/02/global-privacy-platform-review.html
-
But if you want a shorter version: consent strings should be - Simple - Short - Without encryption - Human readable - With as few bits of data as possible ...
-
It's truly wild to me that the IAB created a consent method that satisfies all these requirements (usprivacy) and has made the decision to--instead of using it as a model for the future--depreciate it and replace it with a more complex data heavy non-human-readable system.
Chronotope’s Twitter Archive—№ 158,827