{"id":445,"date":"2012-07-20T12:11:11","date_gmt":"2012-07-20T16:11:11","guid":{"rendered":"http:\/\/jclark.org\/weblog\/?p=445"},"modified":"2012-07-21T11:35:03","modified_gmt":"2012-07-21T15:35:03","slug":"google-chrome-does-not-honor-cookie-blocking-for-youtube-com","status":"publish","type":"post","link":"https:\/\/jclark.org\/weblog\/2012\/07\/20\/google-chrome-does-not-honor-cookie-blocking-for-youtube-com\/","title":{"rendered":"Google Chrome does not honor Cookie Blocking for Youtube.com"},"content":{"rendered":"

UPDATE:<\/strong> Chrome will<\/strong> correctly block youtube (and other cookies). Thanks to Mike West<\/a> at Google for taking the time to leave a comment outlining the fix. The crux of the issue is that a literal pattern like I was using ( youtube.com<\/code> ) will only match the literal domain “youtube.com”. To match all sub-domains, you need to use a wildcard, although the syntax is non-obvious (to me). The correct pattern is [*.]youtube.com<\/code>. Interestingly, if you try to use *.youtube.com<\/code>, the field turns red and you cannot save the pattern, which is what led me to try youtube.com<\/code>. I have also updated my article on HOWTO prevent youtube from tracking your gmail-credentials<\/a>.<\/p>\n

Here’s the original post:<\/p>\n

\n

A few (wow, 10?) months ago, I posted instructions for preventing youtube from tracking your gmail credentials<\/a>, which amounts to blocking youtube from setting cookies in your browser, and removing any existing youtube cookies. However, I’ve noticed that every so often, youtube once again identifies me by my GMail account, and I have to clear the cookies again, even though I am still blocking all cookies matching “youtube.com”.<\/p>\n

I finally decided to investigate, and it appears that Chrome is not honoring my blocked cookies settings at all. Clear all cookies prevents youtube from identifying my GMail account, until I click on a youtube link in an email in GMail, and then the cookie is set and I’m identified until I clear it (don’t log out of youtube, you will be logged out of GMail too). For reference, my Chrome version is currently 20.0.1132.57, and is “Up to date” as of this writing, but I have been having this issue for some time.<\/p>\n

Steps to reproduce:<\/p>\n

    \n
  1. Close any open windows\/tabs for youtube.com<\/li>\n
  2. Open Settings, Advanced Settings; under Privacy click “Content Settings…”<\/li>\n
  3. Click “Content Settings…”<\/li>\n
  4. Under Cookies make sure the “allow local data to be set (recommended)” is selected.<\/li>\n
  5. Click “Manage exceptions…”<\/li>\n
  6. in the box “Add a new hostname pattern”, enter “youtube.com” (without quotes); set the behavior dropdown to “block”, and click ok.<\/li>\n
  7. You are returned to the Content Settings dialog; click “All cookies and site data…”<\/li>\n
  8. in the “Search Cookies” box (top right), type “youtube” (no quotes).<\/li>\n
  9. If the list contains any cookies, click “Remove all”.<\/li>\n
  10. Close the cookie dialog, content settings dialog, and the settings tab.<\/li>\n
  11. Navigate to youtube.com<\/li>\n
  12. Return to settings, advanced settings, content settings, All cookies and site data<\/li>\n
  13. Search again for “youtube” (no quotes). You will see cookies from youtube. If you return to youtube and watch some videos, and then search again, you will have more cookies, plus “local storage”.<\/li>\n<\/ol>\n

    Just because youtube is a google property is no reason for Chrome to not honor my cookie settings. I don’t know if that is the case; I don’t know if Chrome ignores all cookie blocking settings, but this is a case I discovered and can reproduce. I submitted a bug report (essentially the same as this post) via Chrome’s “report an issue” feature. We’ll see if it gets addressed; I’ll post an update if I hear directly from Google.<\/p>","protected":false},"excerpt":{"rendered":"

    UPDATE: Chrome will correctly block youtube (and other cookies). Thanks to Mike West at Google for taking the time to leave a comment outlining the fix. The crux of the issue is that a literal pattern like I was using ( youtube.com ) will only match the literal domain “youtube.com”. To match all sub-domains, you […]<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-445","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/posts\/445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/comments?post=445"}],"version-history":[{"count":7,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/posts\/445\/revisions"}],"predecessor-version":[{"id":451,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/posts\/445\/revisions\/451"}],"wp:attachment":[{"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/media?parent=445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/categories?post=445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jclark.org\/weblog\/wp-json\/wp\/v2\/tags?post=445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}