Cookie Warning Shenanigans Have Got to Stop

The browser fingerprint nonsense assumes Javascript is turned on and the user has allowed someone else to choose the user agent string and other headers.

Thought experiment: What would these "fingerprints" look like if on given day everyone were to turn off JS and set their user agent string and other headers to the same values?

The author writes that if I visit amiunique.org I "will almost certainly be" informed that I am unique.

Well that is not what happened. According to their test, I am "almost" unique, but still not unique. What the page says is that we can almost certainly be tracked. Does not say whether this would still be worth it to an advertiser.

The question is not "whether we can be tracked". Of course we can. Most people using the computers on the internet, in the same way as people using telephones on a landline or cellular network, are not expecting to be "untraceable".

The question is how easy we are making it for anyone to conduct tracking -- not just those who are properly authorised to do so -- and for what purpose are they collecting this information.

> It appears to me that there's intentional bad faith misunderstanding from some, regarding both the cookie law and GDPR, in order to try and paint it as unworkable.

Very much this. None of the cookie warning dialogs (I've seen) mention this, and a lot of them use the dialog to complain about the law.

Something seems to have changed when GDPR came around though. The cookie warning dialogs before just had angry or condescending warnings with only a big "I accept" button, and otherwise too bad. But recently I've begun to see more and more warning dialogs that both have more honest wording about what they're about, as well as providing a "Decline" button.

IIRC there is something in the GDPR about explaining the privacy choices in clear language to the user, as well as having to provide an alternative if possible. If that's the case then it really does smell like intentional bad faith.

Although to be fair in addition to bad faith, I think it's also a lot of webdevelopers just not doing research what is exactly required and just parroting the scary story off each other.

But there's certainly a large part that just want to scare their users into accepting Google Analytics tracking. I'm curious about what those lawyers told you, though. Analytics data flowing through a third party widget that is doing the same on almost every site anywhere, sure feels like tracking to me. But maybe if you disable the data collection for advertising option, Google really won't cross-correlate that data for their own purposes. Even then, doesn't Analytics track the path users take on a single site too? For measuring "conversions" and such, as well as just detect whether people get "lost" on the site, or something.

Now certainly that's useful information, but it is tracking. Also you can get a lot of that information (and more) by just doing basic usability testing on real users. No tracking required and if you ask 10 people to try your site, you get 90% of the usability issues, with diminishing returns (based on some usability research I once read somewhere). But the information is much higher quality because you can ask them questions, ask them to perform tasks, actually look over their shoulder, etc. Tracking website users through analytics is just numbers and doesn't tell the whole story in very many cases, anyway.

Recital 23 digs into more detail about what is considered "targeting." Choice quote:

  > Whereas [...] the use of a language generally used in 
  > the third country where the controller is established, 
  > is insufficient to ascertain such intention, factors 
  > such as the use of a language or a currency generally 
  > used in one or more Member States [...] may make it 
  > apparent that the controller envisages offering goods 
  > or services to data subjects in the Union.

You are correct that reality is a bit more nuanced, but I think that saying "language and currency have nothing to do with it" is not a supportable claim. Audience and intent matters, but if you have German-language content in a country without a large German-language population, you are going to need a very good excuse why you aren't targeting Germans.

People don't have time to type every single caveat and exception. Translating to Polish is going to be targeting Polish geography 99% of the time.

So I have a question regarding GDPR. I've recently done two projects for intergovernmental organizations (like the UN, to give you an example). Both organizations claim that they do not have to comply with GDPR. I kindof doubt that but IANAL. Short of reading the GDPR laws, or contacting an expensive lawyer, what's the best way to find out if they are right? I'd like to find out before I start the next project for such an organization. Thanks.

Actually, Art. 6 GDPR does leave doors open besides consent, e.g. if "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."

In that case, it's simply not consent, so instead of collecting void consent, which will get you into trouble, you should display a simple privacy notice that links to your privacy policy, where you explain your legitimate interests. That is what you have to do for first-party tracking, for session cookies than can be associated with a specific person, and even for log files that contain IP addresses.

If you offer a free digital newspaper, you may argue in court that your ad-funded offering could not exist without third-party advertising and analysis tools, and that your legitimate interest (secure funding via ads) aligns well with the interests of the data subject (read free news). National Data Protection Authorities have suggested that they consider valid consent necessary for third-party tracking, so it's a somewhat bold strategy, but in the end, the ECJ will have to decide.

Until the ePrivacy regulation arrives with some clarifications, we're effectively living in a limbo. Cases of blatant abuse aside, I doubt that we will see waves of draconian fines regarding third-party tracking until then.

Recommended reading: https://ico.org.uk/for-organisations/guide-to-data-protectio...