Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack stores browser cookies without user consent

twitter.com

Post reply on HN
Print view View original

81–90 of 118 posts

Re: Slack stores browser cookies without user consent

#81

Post by WhyNotHugo »

ajnin wrote: post #22

Don't know about the actual cookies, but I'm pretty sure the "click a simple button to accept all but go through a long and slow process to reject"-pattern is not compliant with GDPR.

It's not. An update was published to the regulation stating this clearly for those who don't understand what consent means.

The option to accept or reject must be equally prominent, and if there's complications to rejecting, then the consent cannot be considered freely given.

Disclaimer: I'm not a lawyer.

Re: Slack stores browser cookies without user consent

#82

Post by iamacyborg »

yonixw wrote: post #53
avian wrote: post #52

Earlier quoted context omitted.

From my perspective as a user making me click those traffic lights isn't essential functionality.

But for the business, bot protection is essential. And GDPR talks about business perspective.

GDPR talks about balancing business interests against individual rights.

Re: Slack stores browser cookies without user consent

#83

Post by TimWolla »

0df8dkdf wrote: post #72
merb wrote: post #67

Earlier quoted context omitted.

bullshit. any site with a form needs a cookie, unless the site is stupid. any site that tries to use post requests might need some. heck even the confirmation or storing which cookies should be saved needs a fucking cookie.

no you don't unless authentication is needed. How is post request and cookie even related? It is simple web dev 101.

You need to store some kind of state if you want to protect the form from CSRF attacks. You usually want to protect the form.

Re: Slack stores browser cookies without user consent

#84

Post by iamacyborg »

SquareWheel wrote: post #68
Nextgrid wrote: post #43

Earlier quoted context omitted.

Unless there's actually a captcha on that page, they aren't essential. Furthermore, you could argue that recaptcha itself is in breach of the GDPR as it collects a lot more data than necessary (captchas have been done just fine for decades without collecting any personal information).

That isn't how reCaptcha works though. v3 doesn't even show challenges anymore. It wouldn't work at all without analyzing user metrics.

Well then maybe it's not compliant with data protection legislation if they need to analyse user behaviour without consent.

Re: Slack stores browser cookies without user consent

#85

Post by iamacyborg »

merb wrote: post #67
0df8dkdf wrote: post #63

Earlier quoted context omitted.

No cookies are 'necessary' for site functionality, unless there is a login needed. No cookies are 'necessary' to just display information, pics and videos.

bullshit. any site with a form needs a cookie, unless the site is stupid. any site that tries to use post requests might need some. heck even the confirmation or storing which cookies should be saved needs a fucking cookie.

I have a form on my site. My site has no cookies.

I have no issues.

Re: Slack stores browser cookies without user consent

#86

Post by iamacyborg »

lol768 wrote: post #51
hdudjdididbbfk wrote: post #42

Earlier quoted context omitted.

“We need these super high tech cookiemotrons to provide you with the best user experience possible. We consider it a technical necessity to meet your need to have your data harvested. You should be thanking us. We would explain further, but you’re too stupid. What are you gonna do? Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO?.”

> Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO? Slack operates in the EU and has paying customers in the EU. It also likes to take advantage of anti-competition regulations when convenient: https://slack.com/intl/en-in/blog/news/slack-files-eu-compet... CEO pay seemed to be $356,952 at time of Slack's IPO. Maximum fine under GDPR is the greater of 4% annual turno…

> Regulations here have teeth; it's not the United States - and it's a good thing for society that they do.

sadly, the regulators are yet to show that the GDPR has any teeth. Most recently, the ICO gave British Airways and Marriott significant reductions on fines they raised last year.

Re: Slack stores browser cookies without user consent

#87

Post by iamacyborg »

TheRealPomax wrote: post #78
yladiz wrote: post #39

Earlier quoted context omitted.

No, it’s not a PII related issue. You need consent to set nonessential cookies, regardless if they contain PII. An example is Segment, which sets cookies but may not be tied to a particular user. Segment, at least using just for analytics, isn’t necessary for the function of a website or app, so even if the cookies don’t have any PII you still need to get consent. You’re right that you don’t need permission to set se…

No, you don't: GDPR makes zero stipulations about that, and only requires consent if you're dealing with cookies that either contain PII, or themselves act as PII for cross-site tracking purposes. Sites are entirely free to set as many cookies as they like for any and all "non-essential" site purposes because anything in place to make a website work can be trivially argued in any court to be essential to running that…

GDPR may not apply, but regulations like PECR do - and they will frequently require consent as defined by the GDPR.

Re: Slack stores browser cookies without user consent

#88

Post by 411111111111111 »

TimWolla wrote: post #83
0df8dkdf wrote: post #72

Earlier quoted context omitted.

no you don't unless authentication is needed. How is post request and cookie even related? It is simple web dev 101.

You need to store some kind of state if you want to protect the form from CSRF attacks. You usually want to protect the form.

You don't need a cookie for that though... Even a window variable would suffice

Re: Slack stores browser cookies without user consent

#89

Post by g_p »

yonixw wrote: post #53
avian wrote: post #52

Earlier quoted context omitted.

From my perspective as a user making me click those traffic lights isn't essential functionality.

But for the business, bot protection is essential. And GDPR talks about business perspective.

When placing cookies, the bar to essential is actually really high.

It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality.

The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR/ePrivacy directive actual goes further than GDPR when it comes to the cookie rule, and you can't use legitimate interest as a basis here!

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

Re: Slack stores browser cookies without user consent

#90

Post by g_p »

jchw wrote: post #65
0df8dkdf wrote: post #63

Earlier quoted context omitted.

No cookies are 'necessary' for site functionality, unless there is a login needed. No cookies are 'necessary' to just display information, pics and videos.

From GDPR.eu: > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these…

Only if it's needed for giving the user functionality they explicitly request (i.e. after adding something to their basket, they implicitly accept a session cookie that's solely used to hold their basket content). That wouldn't extend to using that cookie for analytics or retargeting though.

https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

So I'd argue it does need to be a specific reason, at least if you follow the ICO guidance (which is probably the best I've found for explaining what's required by the ePrivacy directive)

Post reply on HN