Cory Doctorow gave us the word enshittification, and it's the right one. His version is about platforms: first they're good to users, then they squeeze users to serve business customers, then they squeeze everyone to serve themselves, then they die. It's a theory of platform decay, and it holds up.
But there's a street-level version of it that doesn't need a two-sided market. You've lived it. You open a page — a recipe, a news story, a local plumber — and before you get one sentence of the thing you came for: a cookie wall with 843 "partners," a newsletter modal, a notification-permission prompt, an autoplaying video following you down the corner of the screen, a chat bubble bouncing for attention, and the paragraph you were reading jumping out from under your cursor as ad slots load in around it. The page you asked for is in there somewhere, under six layers of things you didn't.
Here's the punchline: almost none of it is required. Not by law. Not by the stack. Not by the economics of hosting, which have never been cheaper. Every one of those layers is a business choice somebody made, one meeting at a time, usually because it moved a metric that somebody else was paid on.
01 The compliance lie
The cookie banner is the clearest case, because everyone assumes it's the law. It isn't. GDPR and the ePrivacy rules restrict tracking, not banners. Strictly necessary cookies — sessions, logins, carts, CSRF tokens — need no consent from anyone. The banner only exists because the site chose surveillance and now has to ask permission for it. The banner is the punishment for the choice. Skip the crime, skip the punishment.
So here's a test I hold every "compliance" widget to: name the statute and the clause. If you can't, it isn't compliance — it's cargo-culting, or worse, it's a consent-extraction UI wearing compliance as a costume. What a small business site actually owes is short: a privacy page that tells the truth, consent before non-essential tracking (easiest satisfied by not having any), a working unsubscribe on commercial email, and markup a screen reader can use. That's the list. Everything else is optional, and most of it is optional harm.
I've spent twenty-five years on the security side of large platforms, and I can tell you how this happens, because I've sat in the meetings. Nobody sets out to build the terrible page. The popup is growth's KPI. The chat widget is a tool somebody in support bought. The consent platform is legal covering a tracking decision marketing already made. Each one arrives with an owner and a justification. The sum of them — the actual experience of a human being trying to read the page — has no owner at all. Enshittification at the page level isn't a strategy. It's what you get when nobody is responsible for the whole.
02 A grammar instead
The fix isn't a list of banned widgets, because the widgets keep mutating. The fix is a grammar: a small set of verbs a site is allowed to use, and rules about when. Get the verbs right and the widgets take care of themselves.
A good site behaves like a competent clerk: it acts on request, remembers what it's told, admits mistakes plainly, and never makes you repeat yourself.
The clerk has five verbs: announce, offer, ask, confirm, deliver. Announcements are for the genuinely critical, inline in the page, and dismissed means dismissed. Offers — the newsletter, the upsell — live in a fixed spot and wait to be wanted. Questions come only in response to something the user did, through an element the user summoned. Confirmation is reserved for the irreversible, in words that name the consequence. And delivery is the whole point — the rest of the grammar exists so nothing gets in its way. What that looks like in practice is the list below.
03 The ten rules
Every site I build or host ships under these. They cost nothing — most of them are the absence of work, not the addition of it.
- Don't earn the banner.
No tracking that requires consent — self-hosted, cookieless, aggregate-only analytics or nothing. No banner because there's nothing to confess. - Never speak first.
No prompt of any kind on load, scroll, or exit-intent. The site asks questions only through elements the user summoned. - Nothing moves under the cursor.
Reserve space for everything that loads late. Layout shift is the site shoving the reader; budget CLS at effectively zero. - Deliver first.
The content renders complete on first paint — no sign-up curtains, no blur walls, no "keep reading" gates. If something is genuinely paid, gate it honestly at the door. - The browser is sovereign.
Back, scroll, focus, and keyboard belong to the user. No scrolljacking, no hijacked back button, no autoplay. Every meaningful state has a URL; refresh loses nothing. - Every "no" is persistent.
A dismissed notice stays dismissed. A declined offer isn't repeated for a month. Nothing re-prompts on the next pageview. - Undo beats confirm.
Reserve "are you sure?" for the truly irreversible. Everything else acts immediately and offers a short undo — fewer interruptions and fewer disasters. - Never ask twice.
User input is sacred. Forms survive errors and navigation; preferences stated once are never re-asked. Accept phone numbers and postal codes in any human format and normalize them yourself. - Fail and wait honestly.
Errors in plain language, at the failing field, with the input intact. Real progress or no progress bar. Anything over two seconds says what it's doing. - Symmetric doors.
Unsubscribe, cancel, and delete-account are the same size as the way in: one click, no guilt-trip copy, no retention maze.
Two principles cut across all ten. First, honest labels: buttons name outcomes — "Send message," "Delete 3 photos" — never "Submit." Second, speed is grammar: latency is an interruption like any popup, and it belongs in the same budget.
04 Why bother
The honest answer is that this is easier, not harder. The clean version of a site is less code, fewer vendors, fewer scripts to audit, a smaller attack surface, and no consent infrastructure to maintain. I host sites for shoe repair shops and landscapers and a municipal election campaign, and not one of them has a cookie banner, because not one of them earns the need for one. Their pages load fast, nothing jumps, and nothing begs. Visitors mostly don't notice — which is the point. Nobody ever noticed a popup that didn't open.
The enshittified page is not the natural endpoint of the web. It's the compounding interest on a hundred small choices, each defensible in its own meeting. The grammar is just the decision to stop making those choices — to give the whole page an owner again, and to make that owner answer to the person actually trying to read it.
The annoying web is a choice. You can just choose not to build it.