new browser buying rules for states?

The W3C TAG, in Third Party Cookies Must Be Removed, writes, Third-party (AKA cross-site) cookies are harmful to the web, and must be removed from the web platform.

But, because of a variety of business, legal and/or political reasons, that’s not happening right now. As power users know but a lot of people don’t, a typical web browser is not really usable out of the box. (Remember when Linux distributions came with a mail server set up as an open SMTP relay? And you had to learn how to turn that off or have your Linux box used by email spammers? Good times.) Some of the stuff that needs to get fixed before using a browser seriously includes:

• Third-Party Cookies

• Built-in advertising/discrimination/adfraud features: Apple Safari, Google Chrome ad features checklist, Mozilla Firefox

• No blocking of search ads, which the FBI keeps warning about: Winners don’t click search ads

Not every user can be expected to reconfigure their browser and install extensions. In a higher-trust society users would not have to learn this stuff—the browser vendors would have been taking their Fiduciary Duties seriously all along. But that’s not the way it is. So the responsibility ends up falling company or school desktop administrator, or family computer person, to fix as much as possible (turning off browser ad features from the command line).

Power users and support people (paid and unpaid) can do some of the work, and another place to pay attention to browser problems is at the state level. States buy a lot of desktop computers, and the procurement process is an opportunity to require some fixes. Back in the late 1990s, the Microsoft Windows game Minesweeper caused a moral panic over government employee time wasting, and three states required that computers purchased by the government must have the pre-installed games removed.

Web surveillance has a much bigger set of risks than just time-suckage, so states could add the necessary browser reconfiguration or extensions to their requirements. The purchasing policy change to remove third-party cookies is about as easy as the change to remove Minesweeper. Requiring a complete ad blocker would be going too far because of speech issues and the use of ads to support legit sites, so a state requirement could result in funding for a blocklist that covers just the super crime-filled and otherwise risky ad services and leaves the rest alone for now. (Update 7 Sep 2025) Another option is an enterprise policy: Search malvertising protection using enterprise policies

More: there ought to be a law

Bonus links

The hammer falls on Apple’s malicious-compliance scheme by Jason Snell, A senior Apple exec could be jailed in Epic case; it’s time to end this disaster by Ben Lovejoy. (Nice economic stimulus—more subscription money will go to small content or software businesses that are more likely to hire people, and less to a big company that’s just going to sit on it or do stock buybacks or whatever.)

Why I’m getting off US tech by Paris Marx. A proper response to the dominance of US tech firms and the belligerence of the US government won’t come through individual actions; it requires governments in Europe, Canada, Brazil, and many other parts of the world to strategize and deploy serious resources to develop an alternative.